Standing in the Future: The Case for a Substantial Risk Theory of "Injury-in-Fact" in Consumer Data Breach Class Actions

IntroductionIn the age of the Internet consumer market, merchants and service providers hold increasing amounts of private personal data in their databases and on their servers.1 With this vast amount of data storage comes increased risk that thieves and rouges, from both inside and outside a custodian entity, will breach the security protecting individual personal information.2 Because the federal Class Action Fairness Act ("CAFA") provides a lower threshold for Article Ill diversity jurisdiction in multistate class actions than in traditional diversity suits, many data breach cases are brought in federal district courts.3 As courts of limited jurisdiction, the district courts are required to ensure cases are properly before them as a threshold matter.4 Among other required components of proper jurisdiction, plaintiffs must have standing to sue.5 Plaintiffs bear the burden of showing standing at every stage of litigation, and must allege sufficient facts to support their right to sue at the pleading stage or risk dismissal under Federal Rule of Civil Procedure 12(b)(1). 6In data breach class actions, often the most difficult aspect of standing for plaintiffs to adequately allege is that they have suffered an "injury in fact. "7 In essence, plaintiffs must show that they themselves have suffered the invasion of a legally protected right, and that their injury is neither hypothetical nor conjectural.8 In many cases, data breach plaintiffs have not suffered actual misappropriation of their personal data, but are at increased risk for future data misuse.9 The federal circuits have split on the adequacy of a future misappropriation theory of injury in fact, with some finding standing and others dismissing suits for want of it.10 Many district courts assess the future misappropriation theory in light of the 2013 U.S. Supreme Court decision in Clapper v. Amnesty International USA, which was decided in the context of a challenge to the Foreign Intelligence Surveillance Act ("FISA"). 11This is Note argues that Clapper may not have narrowed the standing inquiry as much as some district courts have concluded, and that there are valid reasons even in light of the Supreme Court's decision in Clapper to uphold Article III standing in at least some future injury theory data breach class ac3 tions.12 Part I reviews the state of standing in the federal circuits and at the Supreme Court as it relates to data breach cases.13 Part II provides a summary of the factual background and the Court's decision in Clapper}4 Part III argues that the Court's opinion in Clapper embraces both a "certainly impending" injury theory and a "substantial risk" of injury theory for Article III standing, depending on the nature of the case.15 Part IV argues that at least some data breach cases meet the requisite criteria for consideration under a substantial risk of injury theory of standing.16I. Data, Breach, and the State of StandingThis Part begins in Section A with a brief examination of digitally stored information, and then sketches the challenges associated with its security.17 Section B explores the state of the Supreme Court's standing doctrine, especially as it relates to consumer data breach class actions.18A. Personal Data in the Modern WorldHumanity produces 2.5 quintillion bytes of data daily.19 One recent study concluded that the amount of data housed on the Internet in 2020 will be fortyfour times larger than in 2009.20 Companies have been quick to capitalize on this newfound source of consumer information, with U.S. Internet revenue reaching $42.8 billion in 2013.21 A single data analytics company, Acxiom, recorded $850 million in revenue during 2015.22 Consumer data now constitutes a more than $300 billion industry.23Companies are not, however, the only actors interested in capitalizing on the growth of personal information.24 Along with all ofthis increased data have come significant security challenges, and companies have been slow to react. …