11th Cir. Rejects Standing Due to Threat of Future Identity Theft & Further Deepens Circuit Split

On Thursday, February 4, the 11th Circuit held that a plaintiff cannot establish Article III standing to sue based on an increased risk of identity theft. The 11th Circuit joins the 2d, 3d, 4th, and 8th Circuit’s in rejecting standing based on such allegations. However, the 6th, 7th, 9th, and D.C. Circuit have all held to the contrary that a plaintiff can establish Article III standing when the defendant’s conduct has increased the risk of identity theft. The circuit split augurs U.S. Supreme Court intervention on this question in the coming years, if not sooner.

Under the U.S. Constitution, a plaintiff only has standing to sue in federal court when an “injury in fact” exists. In 2013, the U.S. Supreme Court ruled that an injury in fact does not exist where there are only “allegations of possible future injury” and there is not a “substantial risk” that harm will occur. Based on these principles, the Supreme Court also stated that plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.”

In the 11th Circuit case, the plaintiff alleged that he and a class of similarly-situated customers faced an increased risk of future identity theft due to a hacker gaining access to their credit and debit card information in the defendant-corporation’s computer system. The plaintiff also alleged that he suffered a concrete injury when he took steps to mitigate the risk caused by the cyber-attack. The three-judge panel rejected both injury-in-fact theories, affirming the District Court’s determination.

To the panel, the first theory amounted to the plaintiff alleging that he “could suffer future injury from misuse of the personal information disclosed during the cyber-attack (though he had not yet).” The panel stated however that a “continuing increased risk” of identity theft is, as a matter of law, insufficient to confer standing, and strongly suggested that standing requires “some evidence of actual misuse of class members’ data.” Moreover, the panel stated that the plaintiff’s work to mitigate the risk of injury by cancelling his cards made any future harm too speculative for standing purposes.

The panel described the second injury-in-fact theory as the plaintiff’s “mitigation injuries—for example, lost time, lost reward points, and lost access to [credit card] accounts.” The panel noted that after learning of the breach, the plaintiff “proactively t[ook] steps to mitigate the damage done,” and as a result suffered three distinct actual injuries: “(1) lost opportunity to accrue cash back or rewards points on his cancelled credit cards, (2) costs associated with detection and prevention of identity theft in taking the time and effort to cancel and replace his credit cards; and (3) restricted account access to his preferred payment cards.”

The panel did not hold that these injuries could, on their own, constitute injuries in fact. Instead, the panel, quoting the Supreme Court, held that these mitigation efforts cannot confer standing as a matter of law because that would amount to a plaintiff “manufactur[ing] standing merely by inflicting harm on [himself] based on [his] fears of hypothetical future harm that is not certainly impending.” The panel explained that because the plaintiff voluntarily took these steps, standing could not be conferred:

By cancelling his cards, [the plaintiff] voluntarily forwent the opportunity to accrue cash back or rewards points on those cards. By cancelling his cards, he voluntarily restricted access to his preferred payment cards. And by cancelling his cards, he voluntarily spent time safeguarding his accounts. [The plaintiff] cannot conjure standing here by inflicting injuries on himself to avoid an insubstantial, non-imminent risk of identity theft. To hold otherwise would allow “an enterprising plaintiff . . . to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.” Clapper, 568 U.S. at 416, 133 S. Ct. at 1151. The law does not permit such a result.

The 11th Circuit’s decision has deepened the circuit split on whether the increased risk of identity theft is enough for federal standing. For companies that do work nationwide, this split creates litigation uncertainty. The split also may encourage forum-shopping or other related efforts to move cases to a forum where the law is more favorable to one party. Under these conditions, it is quite likely that the U.S. Supreme Court will determine that it is appropriate to grant certiorari, and ultimately clarify the law on federal standing.