PRECEDENTIAL

UNITED STATES COURT OF APPEALS

FOR THE THIRD CIRCUIT

_____________

No. 15

- 2309

_____________

In Re: HORIZON HEALTHCARE SERVICES INC. DATA

BREACH LITIGATION

Courtney Diana; Mark Meisel; Karen Pekelney;

Mitchell Rindner,

Appellants

_______________

On Appeal from the United States District Court for the District of New Jersey ( D.N.J. No. 2

- 13

- cv

- 0 7418) District Judge: Hon orable Claire C. Cecchi

_ ______________

Argued : July 12, 2016

Before: JORDAN, VANASKIE, and SHWARTZ, Circuit Judges

.

(Filed : January 20, 2017 )

_______________2 Ben Barnow

Erich P. Schork [ARGUED]

Barnow & Associates , P.C. One North LaSalle Street, S ui te 4600 Chicago, IL 60602

Joseph J. DePalma Jeffrey A. Shooman Lite DePalma Greenberg , LLC

570 Broad St reet, S ui te 1201 Newark, NJ 07102

Robert N. Kaplan

David A. Straite Kaplan Fox & Kilsheimer LLP 850 Third Avenue, 14 th Fl oor New York, NY 10022

Laurence D. King Kaplan Fox & Kilsheimer LLP

350 Sansome Street, S ui te 400 San Francisco, CA 94 104

Philip A. Tortoreti

Wilentz

, Goldman & Spitzer , PA 90 Woodbridge Center Drive, S ui te 900 Woodbridge, NJ 07095 Counsel for Appellants3 Kenneth L. Chernof [ARGUED]

Arthur Luk

Arnold & Porter LLP 601 Massachusetts Avenue, NW Washington, DC 20001

David Jay Philip R. Sellinger Greenberg Traurig 500 Campus Drive, Suite 400 Florham Park, NJ 07932 Counsel for Appellee

_______________

OPIN ION

_______________

JORDAN, Circuit Judge

.

The dispute at the bottom of this putative class action began when two laptops

, containing sensitive personal information, were stolen from health insurer Horizon Healthcare Services, Inc. The four named Plaintiffs filed suit

on behalf of themselves and other Horizon customers whose personal information was stored on th ose laptops. They allege willful and negligent violation s of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681, et seq. , as well as numerous violations of state law. Essentially, the y say that Horizon inadequately protected the ir personal information.

The District Court dismissed the suit under Federal Rule of Civil Procedure 12(b)( 1) for lack of Article III standing. According to t he Court

, none of the Plaintiffs had claimed a cognizable injury because, although their personal4 information had been stolen, none of them had adequately alleged that the information was actually used to their

detriment.

We will vacat e and remand. In light of the

c ongressional decision to create a remedy for the unauthorized transfer of personal information, a violation of FCRA gives rise to a n injury sufficient for Article III standing purposes. Even without evidence that the Plaintiffs’ information was in fact used improperly, the alleged disclosure of their personal information created a de facto injury. Accordingly, a ll of the Plaintiffs suffered a cognizable injury, and the Complaint should not h ave been dismissed under Rule 12(b)(1).

I. B ACKGROUND

A. Factual Background 1

Horizon Healthcare Services, Inc., d/b/a Horizon Blue Cross Blue Shield of New Jersey (“Horizon”) is a New Jersey

- based company that provides health insurance products and se rvices to approximately 3.7 million members.

In the regular course of its business, Horizon collects and maintains personally identifiable information ( e.g. , names,

1 Because this is an appeal from the District Court’s grant of a motion to dismiss, we recite the facts as alleged and

make all reasona ble inferences in the Plaintiff s ’ favor. Oshiver v. Levin, Fishbein, S edran & Berman , 38 F.3d 1380, 1384 (3d Cir. 1994).5 dates of birth, social security numbers, and addresses) and protected health information ( e.g. , demographic information, medical histories, test and lab results, insurance information,

and other care

- related data) on its customers and potential

customers. The named Plaintiffs

– Courtney Diana, Mark Meisel, Karen Pekelney, and Mitchell Rindner 2

– and other

class members are or were participants in, or as Horizon puts it, members of Horizon insurance plans . They entrusted Horizon with their personal information. 3

Horizon’s privacy policy states that the company “maintain[s] appropriate admin istrative, technical and physical safeguards to reasonably protect [memb ers’] Private

2 Only Diana was listed as a named Plaintiff in the original c omplaint. Plaintiffs Pekelney and Meisel filed a separate putative class action c omplaint on January 28, 2014. Pekelney and Meisel then file d a motion to consolidate the cases on February 10, 2014. Horizon joined the motion. The

cases were consolidated and Rindner was later added as a

P laintiff in the amended c omplaint. We will refer to the

amended c omplaint as “the Complaint.”

3 The C ompl aint identifies the class members as: “All persons whose personal identifying information (PII) or protected health information (PHI) were contained on the computers stolen from Horizon’s Newark, New Jersey office

on or about November 1

- 3, 2013.” (App. at 44.) For ease of reference, we will refer to “personally identifiable information” and “protected health information”

– a distinction made by the C omplaint

– together as “personal
information.”6 Information.” (App. at 29.) The policy also provides that, any time Horizon relies on a third party to perform a business service using personal information, it require s the third party to “safeguard [members’] Private Information” and “agree to use it only as required to perform its functions for [Horizon] and as otherwise permitted by ... contract and the law.” (App. at 29.) Through the policy, Horizon pledges to “noti fy [members of its insurance plans ] without unreasonable delay ” of any breach of privacy. (App. at 29.)

During the weekend of November 1 st to 3rd, 2013, two laptop computers containing the unencrypted personal

information of the named Plaintiffs and mor e than 839,000
other Horizon members were stolen from Horizon’s headquarters in Newark, New Jersey. The C omplaint alleges that “[t]he facts surrounding the Data Breach demonstrate that the stolen laptop computers were targeted due to the storage

of Plaint iffs’ and Class Members’ highly sensitive and private [personal information] on them.” ( App. at 32. ) Horizon discovered the theft the following Monday, and notified the Newark Police Department that day. It alerted potentially

affected members by letter and a press release a month later, on December 6. The press release concerning the incident noted that the computers “may have contained files with differing amounts of member information, including name and demographic information (e.g., address, member identification number, date of birth), and in some instances, a Social Security number and/or li mited clinical information.” (App. at 33 .)

Horizon offered one year of credit monitoring and identity theft protection services to those affected, which th e Plaintiffs allege was inadequate to remed y the effects of the7 data breach. At a January 2014 New Jersey Senate hearing, “Horizon confirmed that it had not encrypted all of its computers that contain ed [personal information].” (App. at 35.) Thereafter, “Horizon allegedly established safeguards to
prevent a similar incident in the future

— including tougher policies and stronger encryption processes that could have been implemented prior to the Data Breach and prev ented it.” (App. at 35

. )

Some personal history about the named Plaintiffs is

included in the C omplaint. Diana, Meisel, and Pekelney are all citizens and residents of New Jersey who were Horizon

members who received letters from Horizon indicating that their personal information was on the stol en laptops. The Complaint does n ot include any allegation that their identities

were stolen as a result of the data breach. Plaintiff Rindner is

a citizen and resident of New York. He was a Horizon member but was not initially notified of the data breac h.

After Rindner contacted Horizon in February 2014, the company confirmed that his personal information was on the stolen computers. The Plaintiffs allege that, “[a]s a result of the Data Breach, a thief or thieves submitted to the [IRS] a

fraudulent In come Tax Return for 2013 in Rindner’s and his
wife’s names and stole the ir 2013 income tax refund.” (App.

at 27.) Rindner eventually did receive the refund, but “spent time working with the IRS and law enforcement ... to remedy the effects” of the fraud, “ incurred other out

- of

- pocket expenses to remedy the identity theft [

, ] ” and was “damaged financially by the related delay in receiving his tax refund.” (App. at 27, 41.) After that fraudulent tax return, someone also fraudulently attempted to use Rindner’ s credit card number in an online transaction. Rindner was also “recently8 denied retail credit because his social security number has

been assoc iated with identity theft.” (App. at 27.)

B. Procedural Background

The Plaintiffs fil ed suit on June 27, 2 014. Count I of

the C omplaint claims that Horizon commit ted a willful violation of FCRA; Count II al leges a negligent violation of FCRA; and the remaining counts allege various violations of

state law. 4 FCRA was enacted in 1970 “to ensure fair and

accura te credit reporting, promote efficiency in the banking system, and protect consumer privacy.” Safeco Ins. Co. of

Am. v. Burr , 551 U.S. 47, 52 (2007). With respect to consumer privacy, the statute imposes certain requirements on any “ consumer reporting ag ency” that “regularly ... assembl[es] or evaluat[es] consumer credit information ... for the purpose of furnishing consumer reports to third parties.” 15 U.S.C. § 1681a (f). Any such agency that either willfully

4 In particular, Count III alleges negligence; Count IV

alle ges breach of contract; Count V alleges an invasion of privacy; Count VI alleges unjust enrichment; Count VII alleges a violation of the New Jersey Consumer Fraud Act; Count VIII alleges a failure to destroy certain records

, in violation of N.J.S.A. § 56:8

- 162; Count IX alleges a failure to promptly notify customers following the security breach

, in violation of the New Jersey Consumer Fraud Act; and Count X alleges a violation of the Truth

- in

- Consumer Contract,

Warrant y and Notice Act. In their response t o Horizon’s motion to dismiss, the Plaintiffs consented to the dismissal of Count X without prejudice.9 or negligently “fails to comply with any re quirement imposed under [FCRA] with respect to any consumer is liable to that

consumer.” Id . §§ 1681n(a) (willful violations) ; 1681o (a) (negligent violations)

.

In their C omplaint, the Plaintiffs assert that Horizon is

a consumer reporting agency and tha t it violated FCRA in several respects. They say that Horizon “furnish[ed]” their information in an unauthorized fashion by allowing it to fall

into the hands of thieves. (App. at 48.) They also allege that Horizon fell short of its FCRA responsibility to adopt reasonable procedures 5 to keep sensitive information

confidential. 6 Accord ing to the Plaintiffs

, Horizon’s failure to

5 15 U.S.C. § 1681(b) states:

Reasonable procedures [

- ] It is the purpose of this subchapter to require that consumer reporting agencies adopt reason able procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other

information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper

utilization of s uch information in accordance with the requirements of this subchapter.

6 “In addition to properly securing a nd monitoring the stolen laptop computers and encrypting Plaintiffs’ and Class Members’ [personal information] on the computers,” Horizon

should h ave

– according to the Complaint

– conducted periodic risk assessments to identify vulnerabilities,10 protect their personal information violated the company’s responsibility under FCRA to maintain the confidentiality of their per sonal information

. 7

T he Plaintiffs seek statutory, 8 actual, and punitive damages, an injunction to prevent Horizon from continuing to

developed information security performance metrics, and taken steps to monitor and secure the room and areas whe re the laptops were stored. (App. at 48

- 49. ) Therefore

, say the Plaintiffs, “Horizon failed to take reasonable and appropriate

measu res to secure the stolen laptop computers and safeguard and protect Plaintiffs’ and Class Member s’ [personal information].” (App. at 49.)

7 Section 1681a(d)(3) of t itle 15 of the U.S. C ode imposes a restriction , with certain exceptions, on the sharing of medical information with any persons not related by common ownership or affiliated by corporate control.

Section 1681 b (g) (1) states that “[a] consumer reporting

age ncy shall not furnish for employment purposes, or in connection with a credit or insurance transaction, a consumer report that contains medical information ... about a

consumer, ” with certain limited exceptions.

Section 1681c(a)(6) states that a consumer re porting agency

cannot , with limited exceptions, make a consumer report containing “[t]he name, address, and telephone number of any medical information furnisher that has notified the agency of
its status ... .”

8 FCRA permits statutory damages, but only fo r willful

violations. See 15 U.S.C. § 1681n(a) (“Any person who11 store personal information in an unencrypted manner, reimbursement for ascertainable losses, pre

- and post

judgment in terest, attorneys’ fees and costs, and “such other

and further relief as this Cour t may deem just and proper.” (App. at 64.)

Horizon moved to dismiss the Complaint for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim upon which relief can be granted under Rule 12(b)(6). T he District Court granted dismissal under Rule 12(b)(1) , ruling that the

Plaintiffs lack Article III standing. The Court concluded that

, even taking the Plaintiffs’ alle gations as true, they did not have standing because they had not suffered a cognizable injury. Because the Court granted Horizon’s Rule 12(b)(1) motion, it did not address Horizon’s Rule 12(b)(6) arguments and declined to exercise supplemental jurisdictio n over the remaining state law claims.

The Plaintiffs filed this timely appeal.

willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of

... any actual damages sust ained by the consumer as a result of the failure or damages of not less tha n $100 and not more than $1,000 ...

. ”).12 II. D ISCUSSION

A. Jurisdiction and Standard of Review

The District Court exercised jurisdiction over the

Plaintiff s ’ FCRA claims pursuant to 28 U.S.C. § 1331, though

it ultimately concluded that it did not have jurisdiction due to the lack of standing. Having decided that the Plaintiffs did not have standing under FCRA, the District Court also concluded that it “lack[ed] discretion to retain supplemental jurisdiction over the state law cl aim s ” under 28 U.S.C. § 1367. (App. at 23 (citation omitted).) See Storino v. Borough of Pleasant Beach , 322 F.3d 293, 299 (3d Cir. 2003) (holding that “because the [plaintiffs] lack standing, the District Court lacked original juris diction over the federal claim, and it therefore could not exercise supplemental jurisdiction”). We exercise appellate jurisdiction pursuant to 28 U.S.C. § 1291.

Our review of the District Court’s dismissal of a

com plaint pursuant to Federal Rule of Civ il Procedure 12(b)(1) is de novo

. United States ex rel. Atkinson v. Pa. Shipbuilding Co. , 473 F.3d 506, 514 (3d Cir. 2007). Two types of challenges can be made under Rule 12(b)(1)

– “either
a facial or a factual attack.” Davis v. Wells Fargo

, 824 F.3d

3 33, 346 (3d Cir. 2016). Th at distinction is significant because, among other things, it determines whether we accept

as true the non

- moving party’s facts as alleged in its pleadings. Id. (noting that with a factual challenge, “[n]o presumpti ve truthfulne ss attaches to [the] plaintiff’s allegations

... .” (internal quotation marks omitted) (second alteration in original)). Here, the D istrict C ourt concluded13 that Horizon’s motion was a facial challenge because it “attack[ed] the sufficiency of the consolidat ed complaint on the grounds that the pleaded facts d[id] not establi sh constitutional standing.” (App. at 10

. ) We agree. Because Horizon did not challenge the validity of any of the Plaintiffs’ factual claims as part of its motion, it brought only a fac ial challenge . It argues that the allegations of the C omplaint, even accepted as true, are insufficient to establish the Plaintiffs’ Article III standing.

In reviewing facial challenges to standing, we apply

the same standard as on review of a motion to dismiss under Rule 12(b)(6). See Petruska v. Gannon Univ. , 462 F.3d 294,

299 n. 1 (3 d Cir. 2006) ( noting “that the standard is the same when considering a facial attack under Rule 12(b)(1) or a motion to dismiss for failure to state a claim under Rule

1 2(b)(6)” (citation omitted) ). Consequently, we accept the

P laintif f s ’ well

- pleaded factual allegations as true and draw all reasonable inferences from those allegations in the

P laintiff s ’ favor. 9 Ashcroft v. Iqbal , 556 U.S. 662, 678

9 In its 12(b)(6) motion, which is not before us
, H orizon questions whether it is bound by FCRA. In particular, Horizon suggests that it is n ot a “consumer reporting agency” and therefore is not subject to the requirements of FCRA. At oral argument, Horizon also argued that FCRA does not apply when data is stolen rather than voluntarily “furnish[ed]

, ” 15 U.S.C. § 1681a (f)

. Because we are fac ed solely with an attack on standing, we do not pa ss judgment on the merits of tho se questions. O ur decision should not be read as expanding a claimant ’ s rights

under FCRA

. Rather, we assume for purposes of this appeal14 (2009). Nevertheless , “[t]hreadbare recitals of the elements of [standing], supported by mere conclusory statements, do
not suffice.” Id . We disregard such legal conclusions

. Santiago v. Warminster Twp. , 629 F.3d 121, 128 (3d Cir. 2010). Thus, “[t]o survive a motion to di smiss [for lack of standing], a complaint must contain sufficient factual matter” that would establish standing if accepted as true. Iqbal , 556 U.S. at 678 ( citing Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570 (2007)).

There are three well

- recognized e lements of Article III standing: First, an “injury in fact,” or a n “invasion of a legally protected interest ” that is “concrete and particularized

. ” Lujan v. Defs. of Wildlife

, 504 U.S . 555, 5 60 (1992) . Second, a “causal connection between the injury an d the conduct complained of [

. ] ” Id. And t hird, a likelihood “that the injury will be redressed by a favorable decision.” Id. at 561 ( citation and internal quotation marks omitted).

This appeal centers entirely on the injury

- in

- fact

element of standin g

– m ore specifically

, on the concreteness requirement of that element. 10

that FCRA was violated

, as alleged, and analyze standing with that assumption in mind. Likewise, our decision regarding Article III standing does not resolve whether

Plaintiffs have suffered compensable damages. Some injuries

may be “enough to open the courthouse door” even though they ul timately are not compensable. Doe v. Chao , 540 U.S.

614 , 625 (2004).

10 There is no doubt that the Plaintiffs compl ain of a particularized injury

– the disclosure of their own private15 “In the context of a motion to dismiss , we have held that the [i]njury

- in

- fact element is not Mount Everest. The contours of the injury

- in

- fact requirement, while not precisely

de fined, are very generous, requ iring only that claimant allege [ ] some specific, identifiable trifle of injury.” Blunt v.

Lower Merion Sch. Dist. , 767 F.3d 247, 278 (3d Cir. 2014) (emphasis omitted ) ( citation and internal quotation marks omitted) (second a lteration in original) . “At the pleading stage, general factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to dismiss we presum[e] that general allegations embrace those specific facts that are necessary to s upport the claim.” Lujan , 504 U.S. at 561 ( citation and internal quotation marks omitted) (alteration in original)

.

The requirements for standing do not change in the class action context. “[N]amed plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Lewis v. Casey , 518 U.S. 343, 357 (1996) ( citation and internal quotation mark s omitted). “[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on

information. Spokeo , Inc. v Robins , 136 S. Ct. 1540, 1548 (2016) (“For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’” ( quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560 n.1. (1992) ) )

.16 behalf of himself or any other member of the class.” O’Shea

v. Littleton , 414 U .S. 488, 494 (1974). 11 Accordingly, at least

one of the four named Plaintiffs must have Article III standing in order to maintain this class action.

B. Analysis of the Plaintiffs’ Standing

All four of the named Plaintiffs argue that the violation

of t heir s tatutory rights under FCRA gave rise to a cognizable and concrete injury that satisfies the first element of Article III standing. They claim that the violation of their statutory right to have their personal information secured against

unauthorized disclosure constitutes, in and of itself

, an injury in fact. The District Court rejected that argument, concluding

that standing requires some form of additional, “specific

11 Once Article III standing “is determined vis

- à

- vis the named parties ... there remai ns no further separate class standing requirement in the constitutional sense.” In re Prudential Ins. Co. Am. Sales Practice Litig. Agent Actions

, 148 F.3d 283, 306

- 07 (3d Cir. 1998) (citations and internal quotation marks omitted)

. Therefore, “unnamed, putative class members need not establish Article III standing. Instead, the ‘cases or controversies’ requirement is satisfied so long as a class representative has standing, whether in the context of a settlement or litigation class.” Neale v. Volvo

Car s of N. Am., LLC , 794 F.3d 353, 362 (3d Cir. 2015); see also 2 William B. Rubenstein, Newberg on Class Actions § 2:8 (5th ed. 2012); id . § 2:1 (“Once threshold individual standing by the class representative is met, a proper party to raise a particular iss ue is before the court; there is no further, separate ‘class action standing’ requirement.”).17 harm,” beyond “mere violations of statut ory and common law rights [

. ] ” (App. at 1 5

- 16.)

In the alternative, the Plaintiffs argue that Horizon’s violation of FCRA “placed [them] at an imminent, immediate, and continuing increased risk of harm from identity theft, identity fra ud, and medical fraud ...

. ” (App. at

40

. ) They say the in creased risk constitutes a concrete injury for Article III standing purposes. In their C omplaint

, they

assert that those who se personal information has been stolen

are “ approximately 9.5 times more likely than the general public to suffer identity fraud o r identity theft.” (App. at 36

. )

T hey go on to note the various ways that identity thieves can inflict injury

, such as draining a bank account, fil ing for a tax refund in another’s name, or getting medical treatment using

stolen health insurance informat ion. The District Court rejected th at argument as well because it found that any future risk of harm necessarily depended on the “conjectural conduct of a third party bandit,” and was , therefore, too “attenuated ” to sustain standing. ( App. at 18.) (relyi ng on Reilly v. Ceridian Corp. , 664 F.3d 38, 42 (3d Cir. 2011) )

. 12

12 On appeal, Plaintiffs argue that Horizon’s offer of

free credit monitoring can be taken as proof that Horizon “knows that its conduct has put Plaintiffs and Cla ss Members at a significantly increased risk of identity theft.” (Opening Br. at 8.) We agree with Horizon that its offer should not be used against it as a concession or recognition that the Plaintiffs have suffered injury. We share its concern that su ch a rule would “disincentivize[] companies from offering credit or other monitoring services in the wake of a breach.” (Answering Br. at 19

. ) Cf. F ED

. R. E VID

. 407

- 08 (excluding18 We resolve this appeal on the basis of Plaintiff s ’ first argument and conclude that the y have standing due to

Horizon ’s alleged violation of FCRA.

That the violation o f a statute can c ause an injury in fact and grant Article III standing is not a new doctrine. T he Supreme Court has repeatedly affirmed the ability of Congress to “cast the standing net broadly” and to grant individuals the ability to sue to enforce their statutory rights

. Fed. Election Comm’n v. Akins , 524 U.S. 11, 19 (1998) ; 13 s ee also Warth v. Seldin , 422 U.S. 490, 500 (1975) (“The actual

or th reatened injury required by Art[icle] III may exist solely by virtue of statutes creating legal rights, the invasion of

which c reates standing.” ( citation, internal quotation marks

, and ellipses omitted)); Linda R.S. v. Richard D. , 410 U.S. 614, 617 n. 3 (1973) (“Congress may enact statutes creating legal rights, the invasion of which creates standing, even though no injury would e xist without the statute.”); Havens Realty Corp. v. Coleman , 455 U.S. 363, 373

- 74 (1982)

admission of evidence of subsequent remedial measures and compromise offers as proof of negligence or culpable conduct).

13 Many cases focus on the question of whether Congress truly intended to create a private right of action and whether a particular individual was in the “zone of interest s ”

of the statute. But traditionally

, once it was clear that Congress intended to create an enforceable right and that an

individual falls into th e “zone of interest s ” that individual was found to have standing. See Akins, 524 U.S. at 20.19 ( explaining that one “ who has been the object of a misrepresentation made unlawful under [the statute] has suffered injury in precisely the form the statute was intend ed to guard against, and therefore has standing to maintain a

claim for dam ages under the Act’s provisions ”).

Despite those precedents , our pr onouncements in this

area have not been entirely consistent . In some cases, we have appeared to reject the idea that the violation of a statute can, by itself, cause an injury sufficient for purposes of

Article III standing

. 14 But we have also accepted the argument, in some circumstances, that the breach of a statute

14 For instance, we have observed that “[t]he proper

a nalysis of standing focuses on whether the plaintiff suffered an actual injury, not on whether a statute was violated. Although Congress can expand standing by enacting a law enabling someone to sue on what was already a de facto injury to that person, it cannot confer standing by statute
alone.” Doe v. Nat’l Bd. of Med. Exam’rs , 199 F.3d 146, 153 (3d Cir. 1999) (holding that a violation of the Americans with Disabilities Act could not, by itself, confer standing without evidence “demonstrating more than a mere possibility” of harm); cf. Fair Hous. Council of Sub. Phila. v. Main Line

Times , 1 41 F.3d 439, 443

- 44 (3d Cir. 1998) (holding that a government agency could not sue on behalf of third parties injured by discriminatory advertisements because it coul d not “demonstrate that it has suffered injury in fact” (emphasis removed) ).20 is enough to cause a cognizable injury

– even wi thout economic or other tangible harm. 15

Fortunately, a pair of recent cases touching upon this question, specifically in the context of statutes protecting data privacy, provide welcome clarity. Those cases have been decidedly in favor of allowing indi viduals to sue to remedy violations of their statutory right s , even without additional injury.

15 The Plaintiffs rely heavily upon Alston v. Countrywide Financial Corp. , 585 F.3d 753 (3d Cir. 2009).

That case involved a consumer class action in which homebuyers sought stat utory treble damages under the Real Estate Settlement Procedures Act (“RESPA”). They claimed that their private mortgage insurance premiums were funneled into an unlawful kickback scheme operated by their mortgage lender and its reinsurer, in violation of RESPA. “The thrust of their complaint was that, in enacting and amending [RESPA], Congress bestowed upon the consumer the right to

a real estate settlement free from unlawful kickbacks and unearned fees, and Countrywide’s invasion of that statutory right , even without a resultant overcharge, was an injury in fact for purposes of Article III standing.” Id . at 755. We agreed. We emphasized that the injury need not be monetary in nature to confer standing and that RESPA authorizes suits by those who recei ve a loan accompanied by a kickback or

unlawful referral. Id . at 763. That statutory injury

– even where it did not also do any economic harm to the plaintiffs

– was sufficient for purposes of Article III standing.21 First, in In re Google Inc. Cookie Placement Consumer Privacy Litig ation

, 806 F .3d 125 (3d Cir. 2015), certain internet users brought an action against interne t advertising providers alleging that their placement of so

called “cookies”

– i.e. small files with identifying information

left by a web server on users’ browsers

– violated a number of federal and state statutes, including the Stored

Communications Act. Id. at 133

. The defendants argued that

because the users had not suffered economic loss as a result

of the violations of the SCA , they did not have standing

. Id.

at 134 . We emphasized that, so long as an injury “affect[s] the plaintiff in a personal a nd individual way,” the plaintiff need not “suffer any particular type of harm to have standing.” Id. ( citation and internal quotation marks and citation omitted)

. Instead, “the actual or threatened injury required by Art[icle] III may exist solely by v irtue of statutes creating legal rights , the invasion of which creates standing

, ” even absent evidence of actual monetary loss. Id. ( citation

and internal quotation marks omitted) (emphasis added).

We then reaffirmed Google ’s holding in In re
Nickelode on Consumer Privacy Litigation

, 827 F.3d 262 (3d Cir. 2016). That case involved a class action in which the plaintiffs alleged that Viacom and Google had unlawfully collected personal information on the Internet, including what webpages the plaintiffs had visited and what videos they

watched on Viacom websites. Id. at 267. We addressed the plaintiffs’ basis for standing, relying heavily upon our prior analysis in Google

, i d

. at 271

- 272, saying that, “when it comes to laws that protect privacy, a focus on economic loss is misplaced.” Id . at 27 2

- 7 3 ( citation and internal quotation marks omitted). Instead, “ t he unlawful disclosure of legally protected information” constituted “a clear de facto injury

. ”22 Id. at 274. We noted that “Congress has long provide d plaintiffs with the right to seek redress for unauthorized disclosures of information that, in Congress’s judgment, ought to remain private.” Id.

In light of th o se two rulings, our path forward in this case is plain . The Plaintiffs here have at leas t as strong a basis for claiming that they were injured as the p laintiffs had

in Google and Nickelodeon

. 16

Horizon nevertheless argues that the Supreme Court’s

recent decision in Spokeo, Inc. v. Robins , 136 S. Ct. 1540 (2016)

, compels a different outcom e. We disagree. In Spokeo , a consumer sued a we bsite operator for an allegedly

willful violation of FCRA for publishing inaccurate

information about him. Id. at 1544. The c omplaint did not include any allegation that the false information was actually used to the plaintiff’s detriment. Id. ; Robins v. Spokeo, Inc.

, 742 F.3d 409,411 (9th Cir. 2014). Nonetheless, the United States Court of Appeals for the Ninth Circuit held that the plaintiff had standing because his “personal interests in the handling o f his credit information ” meant that the harm he

suffered was “ individualized rather than collective.” Robins,

742 F.3d at 413.

The Supreme Court vacate d and remanded. 136 S. Ct.

at 1550 . It highlighted that there are two elements that must

16 Again, whether that injury is actiona ble under FCRA is a different question, one which we are presently assuming (without deciding) has an affirmative answer. See supra note
9.23 be establi shed to prove an injury in fact

– concreteness and particularization. Id. at 1545. The Ninth Circuit had relied solely on the “particularization” aspect of the injury

- in

- fact inquiry and did not address the “concreteness” aspect. Id. The Supreme Court therefore provided guidance as to what constituted a “concrete” injury and remanded to the Ninth

Circuit to determine in the first instance whether the harm

was concrete. Id.

In laying out its reasoning , t he Supreme Court rejected the argument that an injury must be “tangible” in order to be

“concrete.” Id. at 1549. It noted that many intangible injuries have nevertheless long been understood as cognizable

– for instance violations of the right to freedom of speech or the free exercise of religion. Id. It then explained that “both history and the judgment of Congress play important roles” in determining whether “an intangible in jury constitutes injury

in fact. ” I

d. T here are thus two tests for wh ether an intangible injury can ( despite the obvious linguistic contradiction) be “concrete.” The first test, the one of history,

asks whether “an alleged intangible harm” is closely related “to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American Courts

. ” I d. If so,

it i s likely to be sufficient to satisfy the injury

- in

- fact element of standing. Id. But even if an injury was “ ‘ previously inadequate in law, ’ ” Congress may elevate it “ ‘ to the status of [a] legally cognizable injur[y]. ’ ” Id. (quoting Lujan

, 504 U.S. at 578). B ecause “Congress is well positioned to identify intangible harms that meet minimum Article II I requirements, its judgment is ... instructive and important.” Id. T he second

test therefore asks whether Congress has expressed an intent

to make an injury redressable.24 The Supreme Court cautioned , however, that

c ongressional power to elevate i ntangible harms into concrete injuries is not without limits . A “bare procedural violation, divorced from any concrete harm

, ” is not enough. Id. On the other hand, the Court said, “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one

Co ngress has identified.” Id

.

Although it is possible to read the Supreme Court’s

decision in Spokeo as creating a requirement that a p laintiff show a statutory violation has caused a “ material risk of harm” before he can bring suit

, 17 id . at 1550, we do not
believe that the Court so intended to change the traditional standard for the establishment of standing. As we noted in

Nickelodeon , “ [ t ] he Supreme Court’s recent decision in

17 Some other courts have interpreted Spokeo in such a

manner

– most notably the Eighth Circuit. See Braitberg v.
Charter Commc’ ns, Inc.

, 836 F.3d 925, 930 (8th Cir. 2016) ( concluding that, in light of Spokeo

, the improper retention of information under the Cable Communications Policy Act did not provide an injury in fact absent proof of “material risk of

harm from th e retention”) ; see also Gubala v. Time Warner

Cable

, Inc.

, No. 15

- CV

- 1078

- PP, 2016 WL 3390415 , at *4 (E.D. Wis. June 17, 2016) (finding that, as a result of Spokeo

, the unlawful retention of an individual’s personal information

under the Cable Communicatio ns Policy Act did not constitute a cognizable injury absent a concrete risk of harm).25 Spokeo

... does not alter our prior analysis in Google .”

Nickelodeon

, 827 F.3 d at 273 (citation omitted).

We reaffirm th at conclusion today

. Spokeo itself does

not state that it is redefining the injury

- in

- fact requirement

. Instead, it reemphasizes that Congress “has the power to define injuries ,” 136 S. Ct. at 1549 ( citation and in ternal quotation marks omitted)

, “ that were previously inadequate in
law.” Id. ( citation and internal quotation marks omitted). In the absence of any indication to the contrary, we understand

that the Spokeo Court meant to reiterate traditional not ions of standing

, 18 rather than erect any new barrier s that might

preven t Congress from identifying new causes of action though they may be based on intangible harms. In short, out of a respect for stare decisis , we assume that the law is stable

unless the re is clear precedent to the contrary. And that means that we do not assume that the Supreme Court has altered the law unless it says so. Cf

. Rodriguez de Quijas v. Shearson/Am. Exp., Inc. , 490 U.S. 477 , 484 (1989) (“If a precedent of this Court has dire ct application in a case, yet appears to rest on reasons rejected in some other line of

18 Justice Thomas’s concurrence also illustrates t hat Spokeo was merely a restatement of traditional standing principles . In that concurrence, he reiterated that a plain tiff is not required to “ assert an actual injury beyond the violation of his personal lega l rights to satisfy the ‘injury

- in

- fact’ requirement.” Spokeo , 136 S. Ct. at 1552 (Thomas

, J.,

concur ring). Yet Justice Thomas joined the majority opinion

in full. And nowhere in his concurrence did he critique the majority for creating a new injury

- in

- fact requirement

.26 decisions, the Court of Appeals should follow the case which directly controls, leaving to this Court the prerogative of overruling its own decisions.”).

It is neve rtheless clear from Spokeo that there are some

circumstances where the mere technical violation of a procedural requirement of a statute cannot, in and of itself, constitute an injury in fact. 136 S. Ct. at 1549 (“Congress’ role in identifying and elevati ng intangible harms does not mean that a plaintiff automatically satisfies the injury

- in

- fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.”). Th o se limit ing circumst ances are not defined in Spokeo and we have no occasion to consider them now

. In

some future case, we may be required to consider the full

reach of congressional power to elevate a procedural v iolation into an injury in fact, b ut this case does not strain that reach

.

As we noted in Nickelodeon , “unauthorized

disclosures of information” have long been seen as injurious.

827 F.3d at 274 (emphasis added). The common law alone

will sometimes protect a person’s right to prevent the dissemination of private information. See Rest atement (Second) of Torts § 652A (2016 ) (“ One who invades the right of privacy of another is subject to liability for the resulting

harm to the interests of the other. ”); s ee also Samuel D. Warren & Louis D. Brandeis, The Right to Pri vacy , 4 Harv.

L. Rev. 193 , 193 (1890) (advancing the argumen t for a “right
to be let alone” )

. In d eed, it has been said that “ t he privacy

torts have become well

- ensconced in the fabric of American

law .” David A. Elder, Privacy Torts § 1:1 (2016)

. And wit h privacy torts, improper dissemination of information can itself constitute a cognizable injury

. Because “[d] amages for27 a violation of an individual's privacy are a quintessential example of damages that are uncertain and possibly

unmeasurable ,” such cau ses of action “provide[] privacy tort

victims w ith a monetary award calculated

without proving actual damage s.” Pichler v. UNITE , 542 F.3d 380, 399 (3d Cir. 2008) (citation omitted).

We are not suggesting that Horizon’s actions would give rise to a cau se of action under common law. No common law tort proscribes the release of truthful information that is not harmful to one’s reputation or

otherwise offensive. But w ith the passage of FCRA, Congress established that the unauthorized dissemination of

per sonal information by a credit reporting agency ca uses an injury in and of itself

– whether or not the disclosure of that information increased the risk of identity theft or some other

future harm. 19 It created a private right of action to enforce

19 Again, it is Congress’s decision to protect personal
information from disclosure that “elevates to the status of legally cognizable injuries c oncrete, de facto injuries that were previously inadequate in law.” Lujan , 504 U.S. at 578 (emphasis in original). That is the focus of our decision today. Nevertheless, we note our disagreement with our concurring colleague’s view that “the risk of fut ure harm” in this case “requires too much supposition to satisfy Article III standing.” (Concurring Op. at 6 n.5.) T he facts of this case suggest that the data breach did create a “material risk of

harm

. ” Spokeo , 136 S. Ct. at 1550. The information tha t was stolen was highly personal and could be used to steal one’s identity. Id

. (noting that with the “dissemination of an incorrect zip code,” it is difficult to see the risk of concrete28 the provi sions of FCRA, and even allowed for statutory damages for willful violations

– which clearly illustrates that Congress believed that the violation of FCRA c a uses a

concrete harm to consumers

. 20 And since the “intangible

harm). The theft appears to have been directed towards the acquisi tion of such personal information. Cf. In re Sci. Applications Int’l. Corp. (SAIC) Backup Tape Data Theft Litig. , 45 F. Supp. 3d 14, 25 (D.D.C. 2014) (concluding that plaintiffs did not suffer an injury in fact as a result of the theft

of devices with the ir personal information when it appeared that the theft was not directed at accessing the personal information). The stolen laptops were unencrypted, meaning that the personal information was easily accessible. Cf. i d

. ( noting that the stolen data had be en encrypted which made it unlikely that anyone could access it). And Rindner alleged that he had already been a victim of identity theft as a result

of the breach. Cf. Remijas v. Neiman Marcus Grp., LLC , 794

F.3d 688 , 692

- 95 (7th Cir. 2015) (concluding that the plaintiff suffered an injury in fact in light of credible evidence that others had experienced identity theft as a result of the same breach). Plaintiffs make a legitimate argument that they face

an increased risk of future injury, which at least weighs in

favor of standing.

20 Congress’s decision to prohibit unauthorized disclosure of data is something that distinguishes this case from a prior case in which we addressed Article III standing

after a data breach. In Reilly v. Ceridian Corp, 664 F .3d 38 (3rd Cir. 2011), we concluded that a security breach that compromised private information held by a payroll processing firm did not cause an injury in fact. In that case,29 harm” that FCRA seeks to remedy “has a close relationship to

a harm [i.e

. invasion of privacy] that has traditionally been regarded as providing a basis for a lawsuit in English or American courts,” Spokeo , 136 S. Ct. at 1549, we have no trouble concluding that Congress properly defined an i njury

that “give[s] rise to a case or controversy where none existed
before.” Id. (citation and internal quotation marks omitted).

So the Plaintiffs here do not allege a mere technical or procedural violation of FCRA. 21 They allege instead the

the claims were based solely on the common law and

concerned the increased ri sk of identity theft, the incurred costs, and the emotional distress suffered. See id. at 40. For those common law claims, we held that the plaintiffs did not have standing because their risk of harm was too speculative.

See id. at 42. I n Reilly , the p laintiffs’ claims centered on the future injuries that they expected to suffer as a result of a data breach such as the increased risk of identity theft. Id. at 40. And we concluded that those future injuries were too speculative. Id at 42

. Here, in co ntrast, the Plaintiffs are not complaining solely of future injuries. Congress has elevated

the unauthorized disclosure of information into a tort. And so there is nothing speculative about the harm that Plaintiffs allege.

21 In this way, the failure to protect data privacy under FCRA is distinguishable from the Fifth Circuit’ s recent treatment of a violation of the Employee Retirement Income Security Act (ERISA) as a result of improper “plan management.” Lee v. Verizon Commc’ns. Inc. , 837 F.3d 523,

529 (5th Cir. 2016). In that case, the court concluded that a30 unauthor ized dissemination of their own private information 22

– the very injury that FCRA is intended to prevent. 23 Th ere is

participant’s interest was in his right to “the defined level of benefits” rather than in the procedural protections of the act.

Id. at 530 (citation and internal quotation marks omitted). A

mer e procedural violation, without proof of the diminution of benefits, was not a cognizable Article III injury. Here, the privacy of one’s data is a cognizable interest even without consequent harm.

22 Horizon has expressed concern that a reporting

agency c ould be inundated with lawsuits for a technical breach of FCRA (such as failing to post a required 1

- 800 number). But in addition to concreteness, a plaintiff must also allege a particularized injury. Here the Plaintiffs are suing on their own behalf wit h respect to the disclosure of their personal information. See Beaudry v. TeleCheck Servs.,

Inc. , 579 F.3d 702, 707 (6th Cir. 2009) (explaining that FCRA “creates an individual right not to have unlawful practices occur ‘with respect to’ one’s own credit information” (citations omitted) )

. T he particularization requirement may impose limits on the ability of consumers to bring suit due to more generalized grievances such as those mentioned by Horizon.

23 Our conclusion that it was within Congress ’s

discret ion to elevate the disclosure of private information into a concrete injury is strengthened by the difficulty that would follow from requiring proof of identity theft or some other tangible injury. “[R]equiring Plaintiffs to wait for the

threatened harm t o materialize in order to sue would pose a31 thus a de facto injury that satisfies the concreteness requirement for Article III standing. 24 See In r e Nickelodeon

,

standing problem of its own ... .” In re Adobe Sys., Inc. Privacy Litig. , 66 F. Supp. 3d 1197, 1215 n.5 (N.D. Cal. 2014). Namely, the “more time that passes between a data breach and an instance of identity theft, the more latitude a defendant has to argue that the identity theft is not ‘fairly
traceable’ to the defendant’s data breach.” Id.

24 The weight of precedent in our sister circuits is to
the same effect

. See Sterk v. Redbox Automated Retail, LLC

, 770 F.3d 618, 623 (7th Cir. 2014) (noting that “ ’ technical ’ violations of the statute ... are precisely what Congress sought to illegalize” and that therefore tangible harm is not required to confer standing); accord Remijas v. Neiman Marcus Grp., LLC , 794 F.3d 688, 692 (7th Cir. 2015) (observing that the alleged harm suffered by the loss of privacy incurred by a data breach “go[es] far beyond the complaint about a website’s publication of inaccurate
information” in Spokeo ) ; Beaudry v. TeleCheck Services, Inc.

, 579 F .3d 702, 707 (6th Cir. 2009) (holding that bare procedural violations of FCRA are sufficient to confer standing); accord Galaria v. Nationwide Mut. Ins. Co., No.

15

- 3386 /3387, 2016 WL 4728027, at *3 (6th Cir. Sept. 12, 2016) (concluding that a data breach in violation of FCRA causes a concrete injury

– at least when there is proof of a substantial risk of harm); see also Church v. Accretive Health,

Inc.

, 654 Fed.Appx. 990

, 993 (11th Cir. 2016) (concluding that a health company’s failure to provide required

disclosures under the F air Debt Collections Practices Act

ca used a concrete injury because C ongress had created a righ t32 827 F.3d 274 (concludi ng that the “unlawful disclosure of legally protected information” in and of itself constitutes a

“ de facto injury”). Accordingly, the District Court erred

when it dismissed the Plaintiffs ’ claims for lack of standing. 25

III. C ONCLUSION

Our precedent an d congressional ac tion lead us to
conclude that the improper disclosure of one’s personal data in violation of FCRA is a cognizable injury for Article III standing purposes. W e will therefore vacate the District
Court’s order of dismissal and remand for f urther proceedings consistent with this opinion.

and a remedy in the statute); Robey v. Shapiro, Marianos & Cejda, L.L.C. , 434 F.3d 1208, 1211

- 12 (10th Cir. 2006) ( holding that a violat ion of the Fair Debt Collection Practices

Act in the form of an unlawful demand for attorney’s fees

– even where the fees are not actually paid and so no economic injury was inflicted

– is a cognizable injury for Article III standing ).

25 The Plaintiffs al so argue that they were injured by systematically overpaying for their Horizon insurance because “Horizon either did not allocate a portion of their premiums to protect their [personal information] or allocated an inadequate portion of the premiums to prot ect [personal

informat ion].” (Opening Br. at 19

- 20.) Because they have standing under FCRA, we do not reach th at purported basis for standing; nor do we address Rindner’s alternative argument for standing based on the fraudulent tax return or

his denial of credit

.1 SHWARTZ, Circuit Judge , concurring in the judgment

.

I agree with my colleagues that Plaintiffs have standing

, but I reach this conclusion for different reasons. In short, Plaintiffs allege that the theft of the laptops caused a loss of privacy, which is itself an injury in fact. Thus, regardless of whether a violation of a statute itself constitutes an injury in fact, and mindful that under our precedent, a risk

of identity theft or fraud is too speculative to constitute an injury in fact, see Reilly v. Ceridian Corp. , 664 F.3d 38 (3d Cir. 2011), Plaintiffs have nonetheless allege d an injury in fact sufficient to give them standing.

I

As my colleagues have explained, Horizon Healthcare Services provides insurance to individuals in New Jersey.

Hori zon obtains personally identifiabl e information (“PII”)

, including names, dates of birth, and social security numbers, as well as protected health information ( “ PHI ” ) , such as

medi cal histories and test results

, from its insureds. This

information is view ed as private and those in possession of it

are r equired to ensure that it is kept secure and used only for

proper purposes

.

PII and PHI were stored on laptop computers kept at Horizon’s Newark, N ew J ersey headquarters

. In Januar y, November, and Decem ber 2008

, a s well as April and November 2013, laptop computers were stolen. The laptop
computer s stolen in November 2013 were cable

- lock ed to workstations and password

- protected

, but the content s , which2 included the PII/PHI of 839,0 0 0 people, w ere not e nc rypted

. 1

P laintiffs assert this theft places them at risk of future identity theft and fraud, and subjected them to a loss of privacy, in

violation of the Fair Credit Reporting Act , 15 U.S.C. § 1681
et seq. (“FCRA”)

, and various state laws. The District Court

c onclud ed that P laintiffs lack standing to bring a claim under

the FCRA because the pleadings failed to allege any plaintiff

suffered an injury in fact. 2

1 My colleagues infer that these thefts were committed

to obtain the PII/PHI. Maj . Op. at 27 n.1 9. I would not necessarily draw that inference. Plaintiffs do not al lege that any of the 839,000 individuals whose inform ation was stored on the laptop computers , or on the laptop computers taken in the earlier thefts, suffered any loss or that their identities were

misused

. Given the number of laptop computer thefts, and the absence of any allegation of a loss tied to their contents, it

is at least equally reasonable to infer that the laptop
computer s were taken for their hardware, not their contents. I acknowledge, however, that we are to draw a reasonable

inference in Plaintiffs’ favor in the context of a facial challenge pursuant to a Rule 12(b)(1) motion. See Petruska

v. Gannon Univ. , 462 F.3d 294, 299 n.1 (3d Cir. 2006) (“[T]he standard is the same when considering a facial attack under Rule 12(b)(1) or a motion to dismiss for failure to state a claim under Rule 12(b)(6).”); Mortensen v. First Fed. Sav.

& Loan Ass’n , 549 F.2d 884, 891 (3d Cir. 1977) (explaining that Rule 12(b)(6) safeguards apply to facial attacks under Rule 12(b)(1) and provide that plaintiffs’ alle gations are taken as true and all inferences are drawn in plaintiffs’ favor).

2 The District Court declined to exercise supplemental jurisdiction over the state law claims.3 II

As my colleagues accurately state, there are three elements of Article III standing: (1) injury in fact, or “an invasion of a legally protected interest” that is “concrete and particularized”; (2) traceability, that is a “causal connection between the injury and the conduct complained of” ; and (3) redressability, meaning a likelihood “that the injury will be redressed by a favorable decision.” Lujan v. Defs

. of

Wildlife , 504 U.S. 555, 560

- 61 (1992).

The i njury

- in

- fact element most often determines standing

. See Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). Such injury must be partic ularized and concrete. Id.

at 1548. “For an injury to be particularized, it must affect the plaintiff in a personal and individual way.” Id. (internal quotation marks and citation omitted). To be “concrete,” an injury must be “real” as opposed to “abs tract,” but it need not be “tangible.” Id. at 1548

- 49.

As my colleagues eloquently explain, the Spokeo

C ourt identified two approaches for determ ining whether an intangible injury is sufficient to constitute an injury in fact

. Maj. O p

. at 23 (citing Spokeo , 136 S. Ct. at 1549 )

. Under the first approach, a court considers history and asks whether the intangible harm is closely related “to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts

. ” Id

. at 1549 ; Maj. Op. at 23

. If so, “it is likely sufficient to satisfy the injury

- in

- fact element of standing. ” Maj. Op. at 23 (citing Spokeo , 136 S. Ct. at 1549). Under the second approach, a court considers whether Congress has “expressed an intent to make an injury redressable.” Maj. O p. at 23 . My colleagues rely on this4 latter approach , but I rely on the former.

The common law has historically recognized torts based upon invasions of privacy and permitted such claims to proceed even in the absence of proof of actual damages. See,

e.g.
, Pichler v. UNITE , 542 F.3d 380, 399 (3d Cir. 2008) (cit in g Doe v. Chao

, 540 U.S. 614 , 621 n. 3 ( 2004) ) ; Restatement ( Second ) Torts §652A (2016) (stating that “ [ o ] ne who invades the right of privacy of another is subje ct to liability for the resulting harm to the interest of the other”)

. While Plaintiffs do not allege that the laptop thieves looked at

or used the ir PII and PHI

, Plaintiffs lost their privacy once it got into the hands of those not intended to have it. Cf. United States v. Westinghouse Elec. Corp. , 638 F.2d 570, 577 n.5 (3d Cir. 1980) (observing that “[p]rivacy . . . is control over knowledge about oneself” (citation omitted)). While this may

or may not be sufficient to state a claim for relief under Fe d. R. Civ. P. 12(b)(6), Maj. O p. at 27

, the intangible harm from the loss of privacy appears to have sufficient historical roots

t o satisfy the requirement that P laintiff s have allege d a sufficiently concrete harm for standing purposes.

Our Court has em

braced the view that an invasion of privacy provides a basis for standing. In In re Google Cookie Placement Consumer Privacy Litigation , 806 F.3d 125 (3d

Cir. 2015 )

, and In re Nickelodeon Consumer Privacy Litigation , 827 F.3d 262 (3d Cir. 20 1 6), Google an d

Nickelodeon were alleged to have invaded the plaintiffs’ privacy by placing cookies into the plaintiffs ’ computers

, which allowed the companies to monitor the plaintiffs ’
computer activities . In these cases, the injury was invasion of privacy and not ec onomic loss, and thus the standing analysis5 focused on a loss of privacy

. 3 In re Nickelodeon , 827 F.3d at

272

- 73; In re G oogle , 806 F.3d at 134. Although the
perpetrator s of the invasion of privacy here are the laptop

thieves and in Google and Nickelodeo n the invaders were the

defendants themselves , the injury was the same: a loss of privacy. Thus , those cases provid e a basis for concluding

Plaintiffs here have suffered an injury in fact based on the

loss of privacy. 4

III

While I have concluded that P laintiffs have alleged an injury in fact by asserting that that they sustained a loss of privacy, the other grounds that Plaintiffs rely upon are unavailing. Although this is not necessary for my analysis, I offer these observations to help explain the ty pes of “injuries” that are not sufficient to provide standing in the context of

data thefts. First, under our precedent, the increased risk of identity theft or fraud due to a data breach , without more,

3 My c olleagues view In re Google Cookie Placement Consumer Privacy Litigation

, 806 F.3d 125 (3d Cir. 2015 )

, and In re Nickelodeon Consumer Privacy Litigation , 827 F.3d 262 (3d Cir. 20 1 6), as providing a basis for Plaintiffs to assert that a violation of the FCRA, without any resulting harm,

satisfies the injury

- in

- fact requirement

. I do not rely on the possible existence of a statutory violation as the basis for standing , and am not persuaded that the se cases support that particular point.

4 I also conclude that Plaintiffs have sufficiently alleged that the injury was traceable, i n part, to the fai lure to encrypt the data, and am satisfied that if proven, the injury

could be redressable

.6 does not establish the kind of imminent or substanti al risk required to establish standing. See Reilly , 664 F.3d at 42

. Like in Reilly , the feared economic injury here depends on a speculative chain of events beginning with an assumption that

the thief knew or discovered that the laptop contained

valuable information, that the thief was able to access the data despite the password protection, and that the thief opted to

use the data maliciously. 5 See Reilly , 664 F.3d at 42; see also Clapper v. Amnesty Int’l USA , 133 S. Ct 1138, 1150 n.5 (2013)

. Second, R eilly and Clapper have rejected P laintiffs ’

a ssertion that standing exists because they expended time and
money to monitor for misuse of their information . The Clapper C ourt reason ed that a plaintiff cannot “manufacture” standing by choosing to undertake burdens or “ make expenditures ” based on a “hypothetical future harm” that does not itself qualify as an injury in fact. Clapper

, 133 S. Ct. at
1050

- 51 ; se e also Reilly , 664 F.3d at 46 ( rejecting a claim for standing based upon “ expenditures to monitor the ir financial

information

. . . because costs incurred to watch for a speculative chain of future events based on hypothetical future criminal acts are no more ‘actual’ injuries than the

5 As noted earlier, my colleagues rely on the second approach, finding standing based upon a statutory violation. The alleged statutory violatio n here, however, creates only an

increased risk of future harm. Al though Spokeo says that a

violation of a s tatute c an provide standing, Spokeo

, 136 S. Ct.

at 1549

- 50, standing still require s a showing of a concrete, particularized, nonspeculative injury in fact and

, under Reilly

, the link between the theft here and the risk of future harm require s too much supposition to satisfy Article III standing, Reilly

, 664 F.3d at 42 ; see also Clapper , 133 S. Ct. at 1148

- 50.7 alleged ‘increased risk of injury’ which forms t he basis for Appellant s’ claims ”). 6 The Supreme Court observed that to conclude otherwise would have problematic implications, as “an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.” Clapper , 133 S.

Ct. at 1151

. Third, courts have rejected claims of standing

based on assertions that plaintiffs suffered economic harm by paying insurance premiums that allegedly included additional

fees for measures to secure PII/PHI

, but such m easures were not implemented

. See , e.g.
, Remijas v. Neiman Marcus , 794

F.3d 688, 694

- 95 (7th Cir. 2015) (describing this type of
overpayment theory as “problematic” and suggesting that

6 Plaintiffs also assert in a conclusory fashion that, “as

a result of the Data B reach,” plaintiff Mitchell Rind n er was the victim of identity theft. While Plaintiffs allege that a false

tax return was submitted to the Internal Revenue Service bearing Mr. Rind n er ’s and his wife’s name s , and tha t

someone use d his credit card, the factual allegations do not show that these events were tied to theft. First, the Amended Complaint does not allege that any of Mrs. Rind n er ’s PII/PHI

was included in the stolen data

. Second, there is no allegation

that the stolen data contained Mr. Rind n er ’s credit card

information. This leads to “[t]he inescapable conclusion . . . that [ Rind n er ] has been subjected to another . . . data breach involving his financial

. . . records

. ” In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig. , 45 F. Supp. 3d 14, 32 (D.D.C. 2014) . Because Plaintiffs do not plausibly plead that this injury was “fair ly traceable” to Horizon’s alleged failure to adequately guard Plaintiffs’ data, this particular injury fail s t o provide standing for a claim against Horizon. See Lujan , 504 U.S. at 560

- 61.8 such a theory is limited to the products liability context); Katz

v. P ershing, LLC , 672 F.3d 64, 77

- 78 (1st Cir. 2012) ( holding

that the “bare hypothesis” that brokerage fees were artificially

inflated to cover sec urity measures was implausible) ; In re Sci. Applications Int’l Corp

. (SAIC) Backup Tape Data Theft Litig. , 45 F. Supp. 3d 14, 30 (D.D.C. 2014) (rejecting the
overpayment theory since the plaintiffs had paid for health insurance and did not allege that they were denied such coverage or services). 7 Accordingly, none of these grounds provides a basis for standing in a data theft case like we have

here

.

I V

For these reasons, I concur in the judgment.

7 Plaintiffs identify two cases to support their overpayment theory: Resnick v. AcMed, Inc. , 69 3 F.3d 1317, 1328 (11 th Cir. 2012)

, and In re Ins urance Brokerage

Antitrust Liti g ation, 5 79 F.3d 241, 264 (3d Cir. 2009). Neither supports their position. Resnick ’s endorsement of an overpayment theory occurred o nly in the context of a Fed. R. Civ. P. 12(b)(6) motion to dismiss the claim for unjust enrichment, and was not used to su pport standing. 698 F.3d

at 1323. In re Ins urance Brokerage involved a kickback

scheme that artificially inflated premiums. 579 F.3d at 264. Here, Plaintiffs do no t allege that the premiums they paid were artificially inflated because funds that were t o be used for securing their data were not used for that purpose, nor do they allege that their premiums would otherwise have been cheaper.