Recent Standing Decision in Data Breach Context (SD Cal.)


Another federal court has weighed in on Article III standing in a data breach class action. In Dugas v. Starwood Hotels, plaintiff alleges that criminal hackers inflicted a series of attacks on the United States hospitality industry.  2016 WL 6523428 (S.D. Cal. Nov. 3, 2016).  Plaintiff claims the data breach affected hundreds of thousands of customers of the Starwood Hotel system.

When defendants moved to dismiss, the court focused on plaintiff’s alleged injury-in-fact for under Article III.  The court categorized the claimed injuries within four categories:

These claimed injuries can be summarized as (1) past financial costs associated with detecting and preventing identity theft or unauthorized use of credit cards; (2) future costs in terms of time, effort and money to prevent or repair identity theft or future unauthorized use of credit cards; (3) theft of personal identifying information and; (4) past loss of productivity from efforts to mitigate consequences of data theft.

The court then concluded that plaintiff lacked standing for the first three types of injuries.

First, the court held “Plaintiff merely alleges that he was ‘exposed’ to economic losses. Such indirect allegations do not demonstrate injury in fact.”

Second, the court emphasized that the theft of personal information had been relatively limited–it did not involve social security information or usernames, passwords, or emails, but rather names, addresses, billing information, and credit card numbers.  … Read more