{"id":651,"date":"2023-07-12T21:29:20","date_gmt":"2023-07-13T01:29:20","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=651"},"modified":"2023-07-12T21:29:20","modified_gmt":"2023-07-13T01:29:20","slug":"the-first-circuit-finds-article-iii-standing-requirements-met-in-data-breach-class-action","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2023\/07\/12\/the-first-circuit-finds-article-iii-standing-requirements-met-in-data-breach-class-action\/","title":{"rendered":"The First Circuit Finds Article III Standing Requirements Met In Data Breach Class Action"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Alex W. Karasik, and George J. Schaller<\/strong><\/p>\n

Duane Morris Takeaways<\/em>: <\/strong>In Webb et al. v. Injured Workers Pharmacy, LLC, No. 22-1896, 2023 U.S. App. LEXIS 16650 (1st Cir. June 30, 2023), the First Circuit reversed<\/a> a district court\u2019s ruling finding that Plaintiffs\u2019 complaint plausibly alleged a concrete injury in fact where Defendant misused personally identifiable information, affirmed the district court\u2019s ruling on injunctive relief , and remanded the case for further proceedings consistent with its First Circuit\u2019s findings. For employers facing data breach class actions, this decision is instructive in terms of what courts consider for Article III standing requirements and, in particular, the \u201cinjury in fact\u201d and \u201cconcrete harm\u201d requirements.<\/em><\/p>\n

Case Background<\/strong><\/p>\n

Alexis Webb and Marsclette Charley (\u201cPlaintiffs\u201d) brought a putative class action against Defendant, Injured Workers Pharmacy, LLC (\u201cIWP\u201d or \u201cDefendant\u201d), asserting various state law claims related to a data breach that allegedly exposed their personally identifiable information (\u201cPII\u201d) and the PII of over 75,000 other IWP patients. \u00a0Id. <\/em>at *2.\u00a0 In January 2021, IWP suffered a data breach. \u00a0Id.<\/em>\u00a0at *3. \u00a0Plaintiffs\u2019 complaint alleged hackers infiltrated IWP\u2019s patient record systems and gained access to the PII of over 75,000 IWP patients, and stole PII including patient names and Social Security numbers.\u00a0 Id<\/em>.\u00a0 As a result of the breach, Plaintiff Webb alleged she \u201cfears for her personal financial security and [for] what information was revealed in the [d]ata [b]reach,\u201d she \u201chas spent considerable time and effort monitoring her accounts to protect herself from identity theft,\u201d and she \u201cis experiencing feelings of anxiety, sleep disruption, stress and fear.\u201d\u00a0 Id.<\/em> at 4-5.\u00a0 In 2021, Webb\u2019s PII was used to file a fraudulent 2021 tax return.\u00a0 Id. <\/em>at *5.\u00a0 Plaintiff Charley alleged that she, \u201cfears for her personal financial security,\u201d \u201cexpends considerable time and effort monitoring her accounts to protect herself from identity theft,\u201d and \u201cis experiencing feelings of rage and anger, anxiety, sleep disruption, stress, fear, and physical pain.\u201d\u00a0 Id.<\/em><\/p>\n

On May 24, 2022, Plaintiffs filed a class action complaint against IWP in the U.S. District Court for the District of Massachusetts, and invoked the court\u2019s jurisdiction under the Class Action Fairness Act of 2005 (\u201cCAFA\u201d).\u00a0 Id. <\/em>at *5-6.\u00a0 The complaint asserted state law claims for negligence, breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty.\u00a0 Id. <\/em>at 6.\u00a0 The complaint sought damages, an injunction \u201cenjoining IWP from further deceptive and unfair practices and making untrue statements about the [d]ata [b]reach and the stolen PII,\u201d \u201cother injunctive and declaratory relief \u2026 as is necessary to protect the interests of [the] [p]laintiffs and the [c]lass\u201d, and attorneys\u2019 fees.\u00a0 Id.<\/em>\u00a0 Plaintiffs also sought to certify a class of U.S. residents whose PII was compromised during the data breach.\u00a0 Id.<\/em><\/p>\n

On August 9, 2022, IWP moved to dismiss the complaint for lack of Article III standing, under Rule 12(b)(1), and for failure to state a claim as to each of the complaint\u2019s asserted claims, pursuant to Rule 12(b)(6).\u00a0 Id. <\/em>\u00a0Plaintiffs opposed the motion.\u00a0 On October 17, 2022, the district court granted IWP\u2019s motion and dismissed the case under Rule 12(b)(1).\u00a0 Id.<\/em>\u00a0 The district court concluded that Plaintiffs lacked Article III standing because their complaint did not plausibly allege an injury in fact.\u00a0 Id. \u00a0<\/em>The district court reasoned that the complaint\u2019s allegations that the fraudulent tax return filed in Webb\u2019s name did not sufficiently allege a connection between the data breach and this false return.\u00a0 Id.<\/em> at 6-7.\u00a0 <\/em>The district court also reasoned the complaint\u2019s other allegations that the potential future misuse of the Plaintiff\u2019s PII was not sufficiently imminent to establish an injury in fact and that actions to safeguard against this risk could not confer standing either.\u00a0 Id. <\/em>at 7. \u00a0<\/em>The district court did not reach IWP\u2019s Rule 12(b)(6) arguments because the case was dismissed under Rule 12(b)(1).\u00a0 Id.<\/em>\u00a0 Plaintiffs timely appealed the district court\u2019s decision. \u00a0Id.<\/em><\/p>\n

The First Circuit\u2019s Decision<\/strong><\/p>\n

The First Circuit reversed the judgment of the district court and held that Plaintiffs plausibly alleged a concrete injury in fact. \u00a0In regards to Plaintiff Webb, the First Circuit concluded that \u201cthe complaint plausibly alleged a concrete injury in fact as to Webb based on the plausible pleading that the data breach resulted in the misuse of her PII by an unauthorized third party (or third parties) to file a fraudulent tax return.\u201d\u00a0 Id<\/em>. at *10-11. \u00a0The First Circuit rejected the district court\u2019s conclusion that the complaint did not plausibly allege a connection between the data breach and the filing of the false tax return.\u00a0 Id<\/em>. at *13.\u00a0 Instead, the First Circuit opined \u201c[t]here is an obvious temporal connection between the filing of the false tax return and the timing of the data breach.\u201d\u00a0\u00a0Id<\/em>.<\/p>\n

Turning to Plaintiff Charley, the First Circuit held that in light of the plausible allegations of some actual misuse, the complaint plausibly alleged a concrete injury in fact based on the material risk of future misuse of Charley\u2019s PII and a concrete harm caused by the exposure to this risk.\u00a0 Id<\/em>. at *15.\u00a0 Further, the First Circuit opined that the totality of the complaint plausibly alleged an imminent and substantial risk of future misuse of the Plaintiffs\u2019 PII.\u00a0 Id<\/em> at *19.<\/p>\n

In addition, the First Circuit found the complaint\u2019s allegations satisfied the traceability and redressability standing requirements.\u00a0 Id. <\/em>at *21.\u00a0 The complaint alleged IWP\u2019s actions led to the exposure and actual or potential misuse of Plaintiffs\u2019 PII, making their injuries \u201cfairly traceable to IWP\u2019s conduct.\u201d\u00a0 Id.<\/em> \u00a0As to redressability, the First Circuit stated \u201cmonetary relief would compensate [the plaintiffs] for their injur[ies], rendering the injur[ies] redressable.\u201d\u00a0 Id. <\/em>at *22. \u00a0The First Circuit thus held that Plaintiffs supported each of their five causes of action for damages with at least one injury in fact caused by the defendant and redressable by a court order.\u00a0 Id. <\/em><\/p>\n

Finally, the First Circuit affirmed the district court\u2019s ruling that Plaintiff\u2019s lacked standing to seek injunctive relief.\u00a0 The sole allegation in the complaint that injunctive relief was necessary was that Plaintiffs\u2019 PII was still maintained by IWP with its inadequate cybersecurity system and policies. \u00a0Id.\u00a0 <\/em>The First Circuit rejected the idea that an injunction requiring IWP to improve its cybersecurity measures would protect Plaintiffs from future misuse of their PII and instead would only safeguard against a future breach. \u00a0Id.<\/em> \u00a0The First Circuit declined to extend injunctive relief where IWP faces, \u201cmuch the same risk of future cyberhacking as virtually every holder of private data.\u201d \u00a0Id.<\/em> at *24.\u00a0 For these reasons, the First Circuit affirmed the district court\u2019s holding that Plaintiffs lacked standing to seek injunctive relief.<\/p>\n

Implications For Employers<\/strong><\/p>\n

For employers facing data breach class actions, Article III standing defenses are often an optimal avenue to attack the pleadings at the outset, especially in situations involving questionable \u201cinjuries\u201d to the named plaintiffs. Businesses that endure data breaches should take note that the First Circuit relied heavily on the temporal connection between the data breach and fraudulent tax filing which constituted a concrete injury.\u00a0 Accordingly, the lowered pleading threshold that results from this ruling suggests that employers should carefully evaluate the safeguards in place for any personally identifiable information stored, and swiftly respond to any data breaches.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Alex W. Karasik, and George J. Schaller Duane Morris Takeaways: In Webb et al. v. Injured Workers Pharmacy, LLC, No. 22-1896, 2023 U.S. App. LEXIS 16650 (1st Cir. June 30, 2023), the First Circuit reversed a district court\u2019s ruling finding that Plaintiffs\u2019 complaint plausibly alleged a concrete injury in fact … <\/p>\n

Continue reading “The First Circuit Finds Article III Standing Requirements Met In Data Breach Class Action”<\/span><\/a><\/p>\n","protected":false},"author":583,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"ppma_author":[30],"class_list":["post-651","post","type-post","status-publish","format-standard","hentry","category-general"],"authors":[{"term_id":30,"user_id":583,"is_guest":0,"slug":"classactiondefense","display_name":"Class Action Defense","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2020\/10\/dmlogo.jpg","author_category":"","last_name":"Defense","first_name":"Class Action","job_title":"","user_url":"","description":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/583"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=651"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/651\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=651"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}