Supreme Court Declines to Weigh in on What Constitutes “Personally Identifiable Information” Protected by the Video Privacy Protection Act
Deadline Looming For Comments About FDA Guidance on Lead in Cosmetic Products

The Third Circuit Reinstates Data Breach Lawsuit, Finding Spokeo Simply Reiterates Existing Law

Shutterstock_90095539By Reena R. Bajowala

Spokeo, Inc. v. Robbins, 136 S. Ct. 1540 (2016), which many read as elevating the standing requirements for statutory claims, remains an effective tool for class action defense lawyers – at least in some circuits.  In other circuits, as we reported here and here, Spokeo has been afforded much less status.  The Third Circuit remains circumspect about Spokeo, as it laid out in In re Horizon Healthcare Services, Inc. Data Breach Litigation, ___ F.3d __, 2017 WL 242554 (3d Cir. Jan. 20, 2017).  In Horizon, a group of insurance plan participants alleged that Horizon failed, under the Fair Credit Reporting Act (FCRA), to adequately safeguard their personal information, which was stored on laptops stolen from Horizon’s headquarters.  The district court dismissed the lawsuit, finding no cognizable injury (and, consequently, no Article III standing) because the plaintiffs failed to adequately allege that the stolen information was actually used to their detriment.  The Third Circuit reversed, finding that the unlawful disclosure of legally protected information is “a clear de facto injury.”  Spokeo, it reasoned, did not “erect any new barriers” to standing, even “though [an alleged violation] may be based on intangible harms.”  Accordingly, the court rejected the “possible . . . read[ing of] Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a ‘material risk of harm’ before he can bring suit.”  The court opined that the Supreme Court did not “intend[] to change the traditional standard for the establishment of standing.”  It remains to be seen whether the Third Circuit’s approach truly realizes the Supreme Court’s intent.