Data breach cases are often brought as class actions because large numbers of people can potentially be affected. But the potential for injury is not enough to create constitutional standing. Before a putative data breach class action can make it to the class certification stage, the named plaintiffs must show that they have standing to pursue the case for themselves, which boils down to a showing that they were injured as a result of the breach.
While the question of standing remains hotly debated in the data breach context, the defense bar has been winning many recent cases, most recently in In re: Science Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, slip op., Misc. Action No. 12-347 (JEB) MDL 2360 (U.S. D.C. May 9, 2014), in which the U.S. District Court for the District of Columbia held that the “mere loss of data” in a data breach case does not constitute an injury sufficient to confer standing.
