PHILADELPHIA (Legal Newsline) – A data breach case against Horizon Healthcare Services Inc. might be far from over after the plaintiffs scored a major victory in the U.S. Court of Appeals for the Third Circuit.
The plaintiffs took the case to the Third Circuit after the U.S. District Court for the District of New Jersey dismissed the case; stating that they didn't establish standing to sue under Article III. It determined they did not suffer any “cognizable injury” as “none of them had adequately alleged that the information was actually used to their detriment,” according to court documents.
The Third Circuit decided otherwise and said the plaintiffs do have an argument under Article III because of their claims that their personal information was distributed without their permission; thus violating the regulations in Fair Credit Reporting Act (FCRA).
“The court’s ruling is driven by its analysis of whether plaintiffs had alleged sufficient facts to support Article III standing,” Phil Yannella, a partner at Ballard Spahr LLP, told Legal Newsline. He co-authored an article on the Third Circuit Court’s decision.
“This is invariably a critical issue in most data breach class actions," he said. "The court found that plaintiffs had asserted sufficient facts to meet Article III requirements because the claim fell under the FCRA, which explicitly provides privacy protection of personal information protected by the state.
"The court found that an alleged violation of this statutory privacy right was sufficient to establish standing. The case was remanded to the district court for additional proceedings. Horizon has other defenses, so the court ruling doesn’t necessarily mean that plaintiffs will ultimately prevail.”
The lawsuit began shortly after two Horizon laptops containing the unencrypted data of nearly 840,000 customers were stolen in November 2013. A handful of customers took legal action, stating that this violated their rights under the FCRA. They sued for statutory, actual and punitive damages and an injunction that would ban Horizon from using unencrypted methods to store their personal information.
The district court dismissed their case. That’s when plaintiffs took the case to the Third Circuit.
“The biggest surprise about the ruling is that it runs counter to a trend in the Third Circuit against finding standing in data breach class actions," he said.
"The Third Circuit has previously held that fear of future identity theft alone is not sufficient to establish standing. This case was analogous in the sense that plaintiffs weren’t able to demonstrate, at this stage, that they had suffered direct losses as a result of the data breach.
"The court's opinion focused on the plaintiff's statutory privacy interests, suggesting a different mechanism for plaintiffs to establish standing in data breach class actions.”
The Third Circuit used the precedent of three cases: In re: Google Inc. Cookie Placement Consumer Privacy Litigation, in which the court decided that plaintiffs were negatively impacted after cookies were put inside of their computers and In re: Nickelodeon Consumer Privacy Litigation, in which the Third Circuit decided plaintiffs did suffer an injury when they said Viacom and Google used their sensitive information after they went to certain websites. It also referred to Spokeo Inc. v. Robins, a major ruling from the U.S. Supreme Court in 2016 that required plaintiffs to allege a concrete injury.
“Spokeo has not been uniformly positive for defendants since the Supreme Court's ruling last year. One issue is that the Supreme Court's ruling allows that Congress can create rights through statutes, the violation of which can constitute a concrete injury within the meaning of Article III," Yannella said.
The Third Circuit's rejected Horizon's Spokeo argument and focused heavily on the fact that the alleged injury was not a technical violation of the FCRA. Rather, the Court held that the FCRA creates a privacy interest by requiring credit reporting agencies to maintain the confidentiality of consumer's personal information and allows for a private cause of action.”