Supreme Court Declines to Review Standing in the Data Breach Context Despite Ongoing Circuit Split

Late last month, the Supreme Court declined to review the D.C. Circuit’s decision in CareFirst v Attias.

In CareFirst, the D.C. Circuit ruled that the mere theft of personal information was sufficient to provide standing to bring suit, even in the absence of other alleged harm.

As we have previously discussed, the federal Courts of Appeals have reached differing conclusions on the issue—with the D.C., Third, Sixth, Seventh, Ninth, and Eleventh Circuits holding that data theft, with the attendant risk of future identify theft fraud, is by itself sufficient for Article III standing, and the Second, Fourth, and Eighth Circuits holding, in contrast, that such allegations are not sufficient on their own to satisfy Article III’s injury requirements.

Click here, to continue reading on the Cleary Cybersecurity and Privacy Watch blog.