Standing In Data Breach Cases

Many data breach and cybersecurity cases have faltered for failure to establish concrete harm necessary to support standing, in cases where personally identifiable information has been accessed but not used to cause harm. It was hoped that the Supreme Court’s decision in Spokeo, Inc. v. Robins would resolve a split in the courts over what injury was sufficiently concrete to support Article III standing, but that split has continued and the issue remains unsettled. In a Today’s General Counsel article, attorneys Thomas Rohback, Patricia Carreiro and James Goldfeier look at some recent cases and what can be gleaned from them.