PHILADELPHIA (Legal Newsline) – A data breach case against Horizon Healthcare Services Inc. might be far from over after the plaintiffs scored a major victory in the U.S. Court of Appeals for the Third Circuit.
The plaintiffs took the case to the Third Circuit after the
U.S. District Court for the District of New Jersey dismissed the case;
stating that they didn't establish standing to sue under Article III. It determined they did
not suffer any “cognizable injury” as “none of them had adequately alleged that
the information was actually used to their detriment,” according to court
The Third Circuit decided otherwise and said the plaintiffs do have
an argument under Article III because of their claims that their personal information
was distributed without their permission; thus violating the regulations in Fair
Credit Reporting Act (FCRA).
“The court’s ruling is driven by its analysis of whether plaintiffs had alleged sufficient facts to support Article III standing,” Phil
Yannella, a partner at Ballard Spahr LLP, told Legal Newsline. He co-authored an article on the Third Circuit Court’s decision.
“This is invariably
a critical issue in most data breach class actions," he said. "The court found that plaintiffs had asserted sufficient facts to meet Article III requirements
because the claim fell under the FCRA, which explicitly provides privacy
protection of personal information protected by the state.
"The court found that
an alleged violation of this statutory privacy right was sufficient to
establish standing. The case was remanded to the district court for additional
proceedings. Horizon has other defenses, so the court ruling doesn’t
necessarily mean that plaintiffs will ultimately prevail.”
The lawsuit began shortly after two Horizon laptops
containing the unencrypted data of nearly 840,000 customers were stolen in
November 2013. A handful of customers took legal action, stating that this
violated their rights under the FCRA. They sued for statutory, actual and
punitive damages and an injunction that would ban Horizon from using
unencrypted methods to store their personal information.
The district court
dismissed their case. That’s when plaintiffs took the case to the Third Circuit.
“The biggest surprise about the ruling is that it
runs counter to a trend in the Third Circuit against finding standing in data
breach class actions," he said.
Circuit has previously held that fear of
future identity theft alone is not sufficient to establish standing. This
case was analogous in the sense that plaintiffs weren’t able to demonstrate, at
this stage, that they had suffered direct losses as a result of the data
"The court's opinion focused on the plaintiff's statutory privacy
interests, suggesting a different mechanism for plaintiffs to establish
standing in data breach class actions.”
The Third Circuit used the precedent of three cases: In re: Google Inc. Cookie Placement Consumer
Privacy Litigation, in which the court decided that plaintiffs were
negatively impacted after cookies were put inside of their computers and In re: Nickelodeon Consumer Privacy
Litigation, in which the Third Circuit decided plaintiffs did suffer an
injury when they said Viacom and Google used their sensitive information after
they went to certain websites. It also referred to Spokeo Inc. v. Robins, a major ruling from the U.S. Supreme Court in 2016 that required plaintiffs to allege a concrete injury.
“Spokeo has not been uniformly positive for
defendants since the Supreme Court's ruling last year. One issue is that
the Supreme Court's ruling allows that Congress can create rights through
statutes, the violation of which can constitute a concrete injury within the
meaning of Article III," Yannella said.
The Third Circuit's rejected Horizon's Spokeo
argument and focused heavily on the fact that the alleged injury was not a
technical violation of the FCRA. Rather, the Court held that the FCRA
creates a privacy interest by requiring credit reporting agencies to maintain
the confidentiality of consumer's personal information and allows for a private
cause of action.”