2.1.1 Applicable Supreme Court Rulings on Standing

The primary barrier to establishing standing in data breach cases is the requirement that the plaintiff demonstrate that he or she suffered an actual injury. Also known as the “injury-in-fact” requirement, the plaintiff must demonstrate “an invasion of a legally protected interest which is “(a) concrete and particularized … and (b) “actual or imminent, not conjectural or hypothetical.”⁵ Courts have held that mere “[a]llegations of possible future injury” are not sufficient to demonstrate the injury-in-fact that is necessary to establish Article III standing.⁶ A threatened injury may constitute an injury in fact, but only if it is “certainly impending.”⁷

Although the Supreme Court has ruled on the injury-in-fact standing requirement many times over the years, it has not issued any decisions in data breach litigation regarding Article III standing. Therefore, we do not know with certainty whether the Supreme Court would conclude that the mere possibility of identity theft after a data breach is sufficient to establish an injury-in-fact for Article III standing. However, two recent privacy-related Supreme Court opinions shed some light on the factors that the Supreme Court likely would consider if it were to hear a data breach case.

In 2016, the Supreme Court issued its opinion in Spokeo v. Robins,⁸ which many believed had the potential to completely change the landscape for standing in private litigation. However, the decision was fairly narrow and did not cause a major revolution in standing jurisprudence, perhaps because the Court was operating with only eight members, after the death of Justice Antonin Scalia. However, the Spokeo case is important because it provides some insight into the Supreme Court's overall thought process about standing in cases that do not clearly involve harm that has already occurred.

The case involved Spokeo, a website that provides detailed information about individuals, such as their home addresses, phone numbers, age, finances, and marital status. Spokeo is available to the general public. Plaintiff Thomas Robins alleged that an unidentified individual searched for Robins's name on Spokeo and obtained a profile that contained incorrect information about his family status, age, employment status, and education. He filed a class action lawsuit against Spokeo, alleging that the company violated the Fair Credit Reporting Act's requirements that consumer reporting agencies follow reasonable procedures to ensure the accuracy of their information and to limit the circumstances in which their reports are used for employment purposes. Spokeo moved to dismiss the lawsuit, arguing that Robins had not alleged an injury-in-fact, and the district court granted that motion. The U.S. Court of Appeals for the Ninth Circuit reversed the dismissal, concluding that Robins alleged that Spokeo violated his rights under the FCRA – not only the statutory rights of others, and that was sufficient to establish an injury-in-fact and standing.

The Supreme Court sent the case back to the Ninth Circuit for further analysis, concluding that the appellate court did not apply the proper test for standing. As discussed above, an injury-in-fact must be both (1) concrete and particularized, and (2) actual or imminent. The Supreme Court concluded that although the Ninth Circuit concluded that the alleged injury was particularized (i.e., that Robins claimed his statutory rights were violated), the Ninth Circuit failed to also consider whether the alleged injury was “concrete,” which the Supreme Court said is a separate inquiry from particularization. For an injury to be “concrete,” the Supreme Court ruled, it “must actually exist.”

In a partial victory to plaintiffs' lawyers, the Supreme Court in Spokeo said that “concreteness” does not necessarily require an injury be tangible. For instance, the Court noted that violations of free speech or free exercise of religion may be sufficiently concrete to constitute injuries-in-fact. The Court also left open the door for the possibility of satisfying Article III's standing requirement with the allegation of the “risk-of-real-harm.”⁹

However, the Court in Spokeo indicated that there are some limits to this ruling. The Court concluded that an allegation of a “bare procedural violation,” without any further indication of harm, is not sufficiently concrete to constitute an injury-in-fact. ¹⁰

Applying these principles to the dispute between Spokeo and Robins, the Supreme Court ordered the Ninth Circuit to analyze whether the violations of Robins's FCRA rights were sufficiently concrete. The Supreme Court indicated that such analysis could result in either dismissing the lawsuit or allowing it to proceed:

On the one hand, Congress plainly sought to curb the dissemination of false information by adopting procedures designed to decrease that risk. On the other hand, Robins cannot satisfy the demands of Article III by alleging a bare procedural violation. A violation of one of the FCRA's procedural requirements may result in no harm. For example, even if a consumer reporting agency fails to provide the required notice to a user of the agency's consumer information, that information regardless may be entirely accurate. In addition, not all inaccuracies cause harm or present any material risk of harm. An example that comes readily to mind is an incorrect zip code. It is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.¹¹

Another recent Supreme Court opinion to address standing and the injury-in-fact issue was Clapper v. Amnesty International USA,¹² issued in 2013. In that case, a group of attorneys, media organizations, labor groups, and others that often communicate with individuals abroad filed a lawsuit against the federal government, challenging the Foreign Intelligence Surveillance Act, which allows surveillance of non-U.S. persons reasonably believed to be located abroad.¹³ At issue in this case was both the requirement that the plaintiffs allege an injury-in-fact and that they allege the injury was fairly traceable to the surveillance program.

The plaintiffs did not argue that the government actually intercepted their communications; rather, they argued that (1) there is a “reasonable likelihood” that the government will obtain their communications at some point, and (2) this risk is so great that they will be forced to “take costly and burdensome measures to protect the confidentiality of their international communications[.]”¹⁴

The Supreme Court rejected the plaintiffs' first argument, concluding that the plaintiffs' “speculative chain of possibilities does not establish that injury based on potential future surveillance is certainly impending or is fairly traceable” to FISA.¹⁵ The Court focused on the plaintiffs' failure to allege that the government had actually targeted any of them for surveillance. Instead, the Court wrote, the plaintiffs “merely speculate and make assumptions about whether their communications with their foreign contacts will be acquired[.]”¹⁶

Likewise, the Court rejected the plaintiffs' second argument, reasoning that “allowing respondents to bring this action based on costs they incurred in response to a speculative threat would be tantamount to accepting a repackaged version of respondents' first failed theory of standing.”¹⁷

The Court concluded that standing simply does not exist because the plaintiffs “cannot demonstrate that the future injury they purportedly fear is certainly impending and because they cannot manufacture standing by incurring costs in anticipation of non-imminent harm.”¹⁸

Taken together, Spokeo and Clapper demonstrate that the Supreme Court has set a very high bar for plaintiffs who bring a lawsuit based on the risk of a future, intangible injury. However, the Court has not entirely ruled out the possibility of allowing such lawsuits to proceed, provided that the potential risk of harm is particularized as to the plaintiffs bringing the lawsuit, and sufficiently concrete.

These standing rules matter immensely for lawsuits arising from data breaches, since in many of these cases the plaintiffs are alleging that the defendants' inadequate data security left them open to future harm. It would not be surprising if the Supreme Court eventually agrees to hear a standing challenge to a data breach lawsuit. Until then, the lower federal courts are free to develop their own rules as to whether a plaintiff has standing in a data breach case.

2.1.2 Lower Court Rulings on Standing in Data Breach Cases

The lower courts of appeals are not unified in their standing requirements for data breach lawsuits. Some courts will only allow a lawsuit to proceed if the defendant has demonstrated that a breach already has led to actual harm, such as identity theft. Other courts, however, have found standing when plaintiffs concretely allege that the breach could reasonably lead to future harm.

The decisions often are difficult to reconcile, and the practical effect is that data breach class actions are more likely to be dismissed for lack of standing in some federal courts than in others.

2.2.1 Negligence

A common claim related to data breach-related lawsuits is negligence. This common-law claim is a frequent basis for lawsuits against companies. Customers frequently claim that retailers are negligent if the customers slip on freshly washed or waxed floors. Similarly, plaintiffs who are injured in car accidents may sue the driver for negligence. In recent years, customers have claimed that companies' inadequate data security measures also are negligent.

Because negligence is a common-law tort, precise rules have developed over centuries by court rulings. Accordingly, the exact requirements for negligence vary by state (the highest courts in each state – and not federal courts – ultimately are responsible for creating common-law torts). Typically, common-law negligence requires that a plaintiff demonstrate four elements: (1) the defendant owed a “legal duty” to the plaintiff (e.g., a duty to protect the plaintiff's personal information), (2) the defendant breached that duty (e.g., by failing to adequately safeguard the plaintiff's personal data), (3) the defendant's breach caused (4) a “cognizable injury” to the plaintiff.⁵⁷

2.2.2 Negligent Misrepresentation or Omission

In a claim somewhat related to general negligence, some consumers and businesses bring data breach lawsuits against companies for misrepresenting their data security practices or omitting crucial details about their failure to adequately safeguard customer data.

In many states, negligent misrepresentation claims require the same elements as general negligence claims: legal duty, breach, causation, and injury. But some states allow negligent misrepresentation claims to proceed even if the plaintiffs only allege economic losses. This makes it easier, in those states, for plaintiffs to bring claims under the tort of negligent misrepresentation than general negligence.

For instance, a Nevada federal judge refused to dismiss negligent misrepresentation claims that customers brought against online retailer Zappos.com after a data breach. Quoting a Nevada Supreme Court case, the federal judge reasoned that liability “is proper in cases where there is significant risk that the law would not exert significant financial pressures to avoid such negligence,” and that such cases include “negligent misstatements about financial matters.”⁸³ The Court reasoned that because the customers did not have a “highly interconnected network of contracts” outlining the company's data security obligations, the customers did not have the ability to exert pressure to prevent such negligence, and therefore the tort of negligent misrepresentation should be available to them.⁸⁴

Many state courts have adopted the definition of negligent misrepresentation from the Restatement (Second) of Torts, which states that negligent misrepresentation occurs under the following circumstances:

One who, in the course of his business, profession or employment, or in any other transaction in which he has a pecuniary interest, supplies false information for the guidance of others in their business transactions, is subject to liability for pecuniary loss caused to them by their justifiable reliance upon the information, if he fails to exercise reasonable care or competence in obtaining or communicating the information.⁸⁵

In the banks' lawsuit against TJX, negligent misrepresentation was among the claims against the retailer. The banks claimed that because TJX accepted Visa and Mastercard credit cards, the retailer had implied that it would comply with credit card companies' data security rules. To determine whether this amounted to negligent misrepresentation, the U.S. Court of Appeals for the First Circuit applied Massachusetts common law, which has adopted the Restatement's test for negligent misrepresentation. The Court was highly skeptical about the banks' argument that merely accepting credit cards constitutes a representation about TJX's data security, stating that the “implication is implausible and converts the cause of action into liability for negligence – without the limitations otherwise applicable to negligence claims.”⁸⁶ Although conduct “can be part of a representation,” the Court reasoned, “the link between the conduct and the implication is typically tight.”⁸⁷ However, because the Court only was considering a motion to dismiss – a stage at which all factual claims must be viewed in the light most favorable to the plaintiff – the Court allowed the negligent misrepresentation claim to survive “on life support.”⁸⁸

The financial institutions suing Target alleged that Target “failed to disclose material weaknesses in its data security systems and procedures,” and therefore was liable for negligent misrepresentation by omission.⁸⁹ The district court concluded that the plaintiffs plausibly alleged that Target owed a duty to disclose because it “knew facts about its ability to repel hackers that Plaintiffs could not have known, and that Target's public representations regarding its data security practices were misleading.”⁹⁰ The Court also found that the plaintiffs complied with Federal Rule of Civil Procedure 9(b), which requires plaintiffs alleging fraud or mistake to “state with particularity the circumstances constituting fraud or mistake.” The Court concluded that the plaintiffs complied with this rule because they “have identified the omitted information, namely Target's failure to disclose that its data security systems were deficient and in particular that Target had purposely disengaged one feature of those systems that would have detected and potentially stopped the hackers at the inception of the hacking scheme.”⁹¹ However, the Court ultimately found that the financial institutions' Complaint fell short of properly alleging negligent misrepresentation because it did not plead that the institutions relied on Target's omissions. The Court rejected the plaintiff's claims that they were not required to plead reliance, and held that although securities fraud-by-omission claims do not require such an allegation, “courts have not extended this presumption of reliance outside of the securities fraud context.”⁹²

2.2.3 Breach of Contract

Consumers whose information has been compromised in a data breach often allege claims that the companies with which they entrusted their information breached a contract with the customer. As with torts, the precise elements of breach of contract may vary by state. For services, contract laws are set by courts under the common law, and for the sale of goods, contract laws are set by the state legislature's adoption of the Uniform Commercial Code. Typically, however, a plaintiff must demonstrate (1) a contract between the plaintiff and defendant, (2) the defendant's breach of a duty imposed by that contract, and (3) damage caused to the plaintiff as a result of that breach.⁹³

If a company enters into a contract in which it guarantees a specific level of data security, then the company fails to provide that data security, and a breach exposes customers' information and leads to identity theft or other harm, the customer would have a fairly strong claim for breach of contract. The company would have breached an express duty in the contract, and that breach would have caused damage to the plaintiff. However, breach of contract claims in data breach cases often are not so clear-cut.

Data breach plaintiffs have attempted to bring breach of contract claims against companies for promises that they have made in their privacy policies or other public statements. Such claims will fail unless the plaintiff can prove that these statements are part of the bargained-for agreement between the plaintiff and defendant. For example, in 2016, a California district court dismissed a breach of contract claim in the class action lawsuit against Anthem, Inc., the health insurer that had experienced a large data breach. The plaintiffs alleged that Anthem had failed to adhere to a statement in its privacy notice, which stated “We keep your oral, written and electronic [PII] safe using physical, electronic, and procedural means.”⁹⁴ The court dismissed this claim, concluding that the plaintiffs' Complaint fails to “allege that the privacy notices or public website statements were part of or were incorporated by reference” into the plaintiffs' contracts with Anthem.⁹⁵

In some cases, the plaintiff alleges that a company – such as a service provider – breached an agreement with an intermediary by failing to safeguard information, and that in turn caused harm to the plaintiff. In that case, the plaintiff must convince a court that he was a third-party beneficiary to this agreement. Unless a contract explicitly names a third party as a beneficiary of a contract, a court must determine whether a third party was an “intended beneficiary” of the contract's data security provisions.

A number of state courts have adopted the test for intended beneficiaries as articulated in Section 302 of the Restatement (Second) of Contracts:

Intended and Incidental Beneficiaries

1. Unless otherwise agreed between promisor and promisee, a beneficiary of a promise is an intended beneficiary if recognition of a right to performance in the beneficiary is appropriate to effectuate the intentions of the parties and either
   1. the performance of the promise will satisfy an obligation of the promisee to pay money to the beneficiary; or
   2. the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.
2. An incidental beneficiary is a beneficiary who is not an intended beneficiary.⁹⁶

In 2008, the U.S. Court of Appeals for the Third Circuit applied this definition of intended beneficiary in a case arising from the BJ's retailer data breach described above. A number of lawsuits arose out of that breach, including a lawsuit by Sovereign Bank, a credit card issuer, against BJ's and the retailer's bank, Fifth Third. Among the many claims by Sovereign was a breach of contract action, alleging that Fifth Third breached its agreement with Visa to ensure that BJ's adequately secured credit card information. Sovereign claimed that BJ's breached this agreement, and banks whose customers' data were breached – such as Sovereign – were intended third-party beneficiaries of the agreement between Fifth Third and Visa.⁹⁷ Fifth Third argued that the contract was not intended to benefit issuing banks such as Sovereign, but instead to “benefit the Visa system as a whole.”⁹⁸ The district court dismissed this claim, but the Third Circuit reversed, finding that a Visa executive's testimony that the data security requirements are intended to benefit “the members that participate in it” was sufficient to allow a reasonable jury to conclude that Sovereign was an intended beneficiary, and therefore could sue Fifth Third for breach of contract.⁹⁹

Some contracts, however, clearly preclude third-party beneficiary claims. For instance, Pershing LLC, which provides an electronic platform for financial services institutions, was sued by the customer of a financial institution that used Pershing's platform. The plaintiff filed a lawsuit against Pershing, alleging that the company failed to adequately secure her personal information by using safeguards such as encryption and proper end-user authentication.¹⁰⁰ Among her legal claims was that Pershing breached the data confidentiality provision of an agreement between Pershing and the plaintiff's financial institution. The U.S. Court of Appeals for the First Circuit swiftly rejected this claim, noting that the agreement stated that it “is not intended to confer any benefits on third-parties[.]'”¹⁰¹ The Court held that when the intent to preclude third-party beneficiaries is “unambiguously disclaimed, a suitor cannot attain third-party beneficiary status.”¹⁰²

In many data breach cases, there is not an express contract between a consumer and company. For instance, if a customer walks into a store and purchases a product with her credit card, the customer typically does not first require the retailer to agree to adequately safeguard her credit card number and other personally identifiable information. However, in many states, it is possible to allege that a company's failure to safeguard data breaches an implied term of a contract.

For instance, in the Hannaford case, which consumers brought against a retailer after a breach of payment card information, the plaintiffs relied on Maine common law, which states that contracts can include “all such implied provisions as are indispensable to effectuate the intention of the parties and as arise from the language of the contract and circumstances under which it was made,” provided that the provision is “absolutely necessary to effectuate the contract.”¹⁰³ In the Hannaford case, the plaintiffs allege that when they provided their credit cards to the grocers' cashier at the cash register, they entered into an implied contract for the grocer to protect their credit card numbers. The grocer moved to dismiss this claim, stating that such an assumption is not absolutely necessary to engage in the payment transaction. The district court disagreed with the grocer and refused to dismiss the claim. The judge reasoned that a jury “could reasonably find that customers would not tender cards to merchants who undertook zero obligation to protect customers' electronic data.”¹⁰⁴ However, the judge recognized that such an implied contract is limited, because “in today's known world of sophisticated hackers, data theft, software glitches, and computer viruses, a jury could not reasonably find an implied merchant commitment against every intrusion under any circumstances whatsoever (consider, for example, an armed robber confronting the merchant's computer systems personnel at gunpoint).”¹⁰⁵ In short, the court held that a jury could find an implied contract for the grocer to enact reasonable safeguards, similar to the negligence standard. However, the court does not believe that the implied contract creates an absolute prohibition on all data breaches because such a duty would be impossible in light of modern cyber threats. Nor did the judge agree with the plaintiff that there is an implied contract for the grocer to notify consumers of data breaches because such notification is not “absolutely necessary” for the contract.¹⁰⁶ The grocer appealed the district court's refusal to dismiss the claim entirely, and the U.S. Court of Appeals for the First Circuit affirmed the district court's conclusion, stating that a jury “could reasonably conclude, therefore, that an implicit agreement to safeguard the data is necessary to effectuate the contract.”¹⁰⁷

In contrast, the plaintiff in the case against Pershing, described above, claimed that in addition to being a third-party beneficiary to an express contract between Pershing and her service provider, she had an implied contract with Pershing, in which Pershing implicitly agreed to protect her personal information.¹⁰⁸ The First Circuit rejected this argument, holding that a contract did not exist between the plaintiff and Pershing because there was not any consideration (i.e., the plaintiff did not provide a “bargained-for benefit,” nor did she suffer any “bargained-for detriment in exchange for the defendant's supported promises.”¹⁰⁹

In sum, there are three primary methods that a plaintiff could attempt to bring a breach of contract lawsuit arising from a data breach or poor data security. First, the plaintiff could sue for breaching an express contract between the plaintiff and a defendant in which the defendant agreed to provide a specified level of data security. This is the most likely route for success for the plaintiff, but in many recent data breach cases, such contracts did not exist. Second, the plaintiff could claim that she was the intended third-party beneficiary of a contract between the defendant and another party, in which the defendant agreed to provide a certain level of data security. As demonstrated above, it often is difficult to prove that the plaintiff was an intended third-party beneficiary of a contract. Third, the plaintiff can claim that even though there was not an express contract with the defendant, the parties had an implied contract in which the defendant agreed to provide a reasonable level of data security. Such claims are fact-specific and their success is difficult to predict with great certainty.

2.2.4 Breach of Implied Warranty

Consumers also have claimed that companies breached implied warranties by failing to safeguard their data. Under this claim, plaintiffs typically argue that by selling the plaintiffs a product, the defendants provided an implied warranty that the good was fit for a particular purpose. The defendants breached that warranty, they argue, by failing to provide proper data security.

In the United States, there are two general sources of implied warranties: Article 2 of the Uniform Commercial Code, which applies to the sale of goods, and the common law (rulings by state court judges over many decades), which applies to the sale of services. Implied warranties under both the Uniform Commercial Code and the common law have arisen in data breach cases.

Most states have adopted the implied warranty provisions of Article 2 of the Uniform Commercial Code, which governs the sale of goods. Article 2 creates two implied warranties that are relevant to data breach cases: warranty of merchantability and warranty of fitness for a particular purpose.

Section 2-314 of the Uniform Commercial Code, which creates an implied warranty of merchantability, requires goods to be “merchantable,” which the statute defines as:[

1. pass without objection in the trade under the contract description; and
2. in the case of fungible goods, are of fair average quality within the description; and
3. are fit for the ordinary purposes for which such goods are used; and
4. run, within the variations permitted by the agreement, of even kind, quality and quantity within each unit and among all units involved; and
5. are adequately contained, packaged, and labeled as the agreement may require; and
6. conform to the promise or affirmations of fact made on the container or label if any.¹¹⁰

The implied warranty of merchantability only applies to merchants who sell “goods of that kind.” In other words, a car dealer implicitly warrants the merchantabilities of cars that it sells, but if it sells an old desk that it had used in its office, it will not imply merchantability of the desk.

Section 2-315 of the Uniform Commercial Code, which creates an implied warranty of fitness for a particular purpose, states:

Where the seller at the time of contracting has reason to know any particular purpose for which the goods are required and that the buyer is relying on the seller's skill or judgment to select or furnish suitable goods, there is unless excluded or modified under the next section an implied warranty that the goods shall be fit for a particular purpose.¹¹¹

Data breach plaintiffs have alleged that by failing to provide adequate security for personal information, the company breached both the implied warranties of merchantability and fitness.

The UCC allows merchants to “disclaim” implied warranties – and thus avoid the obligations imposed by these requirements. To do so, the UCC states, the disclaimer must be “by a writing and conspicuous.”¹¹² To disclaim implied warranties, the UCC states that it is sufficient for the written disclaimer to use expressions such as “with all faults,” “as is,” or “There are no warranties which extend beyond the description on the face hereof.”¹¹³ Many states prohibit disclaimers from being buried in contracts; therefore, user agreements often contain the disclaimers in capital letters.

However, the UCC is only a model for states to use as a framework for adopting their own laws governing the sale of goods. Some states do not allow companies to disclaim the UCC's implied warranties. For instance, Massachusetts' version of the UCC states that any attempts to limit or exclude the implied warranties of merchantability or fitness for a particular purpose are “unenforceable.”¹¹⁴ This prohibition of such disclaimers makes Massachusetts a particularly attractive venue for implied warranty claims.

However, the UCC often does not apply to data breach lawsuits. Many data breach cases arise when customers sue online networks, banks, healthcare providers, and other companies that provide them with services. The UCC only applies to the sale of goods, while the common law (law created by centuries of court rulings) typically applies to the sale of services. Determining whether a data breach arises from a sale of good or a sale of services, however, can be tricky.

For instance, in the Sony Play Station Network data breach class action, among the plaintiffs' many claims was a breach of the implied warranty of fitness for a particular purpose under the Massachusetts UCC.¹¹⁵ Because Sony had disclaimed implied warranties, the Massachusetts statute appeared to be an attractive route for the plaintiffs to bring an implied warranty claim. However, the Court rejected the claim because it involved a breach of the online services that Sony provided via the Play Station Network. The Massachusetts version of the UCC defines “goods” as “all things … which are movable at the time of identification to the contract for sale.”¹¹⁶ The Court concluded that even though the online services could only be accessed by the consumer's purchase of a Play Station Network game console, the “thrust, or purpose of the contract” was to provide access to the Play Station Network, which is not a movable “thing” as defined by the UCC. ¹¹⁷

Similarly, in the Hannaford case,¹¹⁸ a lawsuit arising from the breach of payment card information at a grocery store, the plaintiffs brought a breach of implied warranty claim under Maine's version of the Uniform Commercial Code. They alleged that the retailer's acceptance of card data rendered its electronic payment processing system a “good” that it implicitly guaranteed to securely process card transactions. The Court swiftly dismissed this claim, concluding that “goods” under the UCC would include the retailer's groceries but not the payment system that it uses to process card data.¹¹⁹

Many states also recognize common law implied warranty claims. Because these are not derived from the UCC, the warranties do apply to the sale of services, such as online accounts, but the common law in many states typically allows companies to use clear and prominent disclaimers to avoid being bound by implied warranties.

For instance, in the Sony Play Station Network case, the plaintiffs claimed that Sony breached implied warranties under the common law of Florida, Michigan, Missouri, and New York. Sony argued that these claims are invalid because it disclaimed all warranties both in the Play Station Network User Agreement and Privacy Policy. The user agreement stated:

No warranty is given about the quality, functionality, availability or performance of Sony Online Services or any content or service offered on or though Sony Online Services. All services and content are provided "AS IS" and "AS AVAILABLE" with all fault. SNEA does not warrant that the service and content will be uninterrupted, error-free or without delays. In addition to the limitations of liability in merchantability, warranty of fitness for a particular purpose and warranty of non-infringement, SCEA assumes no liability for any inability to purchase, access, download or use any content, data, or service.¹²⁰

Likewise, the Play Station Network Privacy Policy stated:

We take reasonable measures to protect the confidentiality, security, and integrity of the personal information collected from our website visitors … . Unfortunately, there is no such thing as perfect security. As a result, although we strive to protect personally identifying information, we cannot ensure or warrant the security of any information transmitted to us through or in connection with our websites, that we store on our systems or that is stored on our service providers' systems.¹²¹

The court granted Sony's motion to dismiss, reasoning that the two documents, when read together, sufficiently disclaim any guarantees that consumers' personal information will be secure.¹²² It is unclear whether one of those documents, standing alone, would be sufficient to avoid all implied warranty lawsuits arising from the data breach. The disclaimer in the User Agreement satisfies the long-standing legal rule that disclaimers of warranties should state that goods and services are provided “as is.” However, the Privacy Policy provides a clear disclaimer that Sony does not guarantee the safety of personal information. Had this language not been in the Privacy Policy, the plaintiffs would have had a strong argument that a reasonable consumer would not expect the User Agreement's “As Is” provision to apply to data security.

Common law implied warranty claims are not as common as UCC implied warranty lawsuits, and many state courts have not ruled on the exact scope of these implied warranties as applied to services such as computing and data storage. Courts have recognized common law implied warranties for construction¹²³ and the repair of goods that were sold by the merchant.¹²⁴ Courts decide whether to extend implied warranties to services on a case-by-case basis, assessing the public interest in recognizing such obligations.¹²⁵ Accordingly, it is likely that more precise rules for common law implied warranty claims in data breach cases will emerge over the next decade.

In short, implied warranty claims probably are not the strongest route for plaintiffs in data breach lawsuits. Unless a related data breach loss arises from the plaintiff's purchase of a tangible good, it is unlikely that the UCC's implied warranties will apply. And it remains to be seen whether state supreme courts will conclude that recognizing common law implied warranties for data security is in the public interest. Even if a warranty does apply, many large companies easily address such risk with clear and conspicuous disclaimers.

2.2.5 Invasion of Privacy by Publication of Private Facts

In some data breach cases, plaintiffs bring a claim under the common-law tort of invasion of privacy due to publication of private facts. These claims will almost definitely fail, absent extraordinary circumstances.

Publication of private facts is one of four common-law privacy torts, and the most applicable to data breaches.¹²⁶ To state a claim for the publication of private facts, the plaintiff generally must prove "(1) the publication, (2) of private facts, (3) that are offensive, and (4) are not of public concern."¹²⁷ If plaintiffs' personal data are exposed due to a data breach, they could seek damages under this tort.

However, convincing a court to allow such a lawsuit is difficult, absent demonstration that the materially was widely circulated and the defendant was somehow involved in the publication. For instance, in Galaria v. Nationwide Mutual Insurance Co.,¹²⁸ plaintiffs filed a class action lawsuit against Nationwide Mutual Insurance, after a breach of Nationwide's computer systems allowed hackers to obtain personal information that the plaintiffs had provided to the insurer. The plaintiffs did not allege misuse of their personal information or identity theft. Among the claims in the plaintiffs' putative class action lawsuit was invasion of privacy due to publication of private facts. The district court dismissed this claim for two reasons. First, the court stated that even though the breach exposed their personally identifiable information, there was no allegation that Nationwide disclosed the data. Instead, the data was allegedly stolen from Nationwide.¹²⁹ This ruling suggests that only if the defendant in a breach case takes an affirmative action to disseminate information – such as posting it on a website – an invasion of privacy claim will not succeed. Second, the court held that even if Nationwide had disseminated the data, the plaintiffs did not allege publicity of the information. The plaintiffs would have needed to demonstrate “publicity to the public at large or to so many persons that the information is certain to become public knowledge.”¹³⁰

2.2.6 Unjust Enrichment

Even if a plaintiff cannot establish a breach of an express or implied contract due to a data breach or inadequate data security, the plaintiff may attempt to bring a similar type of claim under the theory of “unjust enrichment.”

Unjust enrichment is a theory of recovering damages “when one person has obtained a benefit from another by fraud, duress, or the taking of an undue advantage.”¹³¹ As with other common law claims, the precise rules for unjust enrichment vary by state. The U.S. Court of Appeals for the Eleventh Circuit articulated a common framework for unjust enrichment in the AvMed data breach case.¹³² Applying Florida law, the court held that a plaintiff must demonstrate “(1) the plaintiff has conferred a benefit on the defendant; (2) the defendant has knowledge of the benefit; (3) the defendant has accepted or retained the benefit conferred; and (4) the circumstances are such that it would be inequitable for the defendant to retain the benefit without paying fair value for it.”¹³³ Applying these factors, the Eleventh Circuit concluded that the plaintiffs alleged a viable unjust enrichment claim. The court reasoned that the plaintiffs paid monthly premiums to the company, which AvMed should have used to cover the costs of adequate data security, and that the company failed to do so.¹³⁴

Similarly, in the consumer class action against Target, the district court refused to dismiss the unjust enrichment claim against the retailer, reasoning that if the plaintiffs “can establish that they shopped at Target after Target knew or should have known of the breach, and that Plaintiffs would not have shopped at Target had they known about the breach, a reasonable jury could conclude that the money Plaintiffs spent at Target is money to which Target in equity and good conscience should not have received.”¹³⁵ However, the court rejected the plaintiff's other unjust enrichment claim, in which they asserted that they were overcharged for their products because the goods that Target sold “included a premium for adequate data security.”¹³⁶ The court found that this allegation did not support an unjust enrichment claim because Target charges the same price to customers who pay with credit cards as it charges to customers who pay with cash, and the customers who paid with cash were not harmed by the data breach. This unjust enrichment claim, the Court concluded, might be more viable if Target charged a higher price to credit card customers.

Typically, unjust enrichment is not available to plaintiffs if another cause of action covers the same claim.¹³⁷ So, for example, if a plaintiff's unjust enrichment claim regarding a data breach arises primarily out of the defendant's failure to abide by the terms of a contract, then the unjust enrichment claim would not succeed.¹³⁸

2.2.7 State Consumer Protection Laws

Besides the court-created common-law claims that companies face after data breaches, state consumer protection statutes provide plaintiffs with an additional cause of action. All fifty states and the District of Columbia have enacted consumer protection laws. Although the exact wording of the statutes – and courts' interpretations of them – varies by state, they generally prohibit unfair competition, unconscionable acts, and unfair or deceptive acts of trade or commerce. The state consumer protection laws are similar to Section 5 of the FTC Act, but unlike Section 5, most of the state consumer protection laws allow private plaintiffs to bring lawsuits.

State consumer protection law claims in data breach cases often allege that the defendant fraudulently misrepresented its data security practices. However, such claims typically will only succeed if the court concludes that the misrepresentations likely would deceive a reasonable person. For instance, in the Sony Play Station Network breach litigation, the plaintiffs brought claims under California consumer protection laws, alleging that Sony misrepresented the following aspects of its products and services:

• continual access to the Play Station Network was a feature of the game consoles;
• online connectivity was a feature of the game consoles;
• characteristics and quality of the security of the Sony Play Station Network; and
• Sony uses “reasonable security measures” to protect its consumers' personal information.¹³⁹

The court ruled that the first two alleged misrepresentations were not valid grounds for a consumer protection lawsuit because a reasonable consumer would not believe that Sony promised “continued and uninterrupted access” to its online services,¹⁴⁰ in part because its Terms of Service explicitly stated that Sony “does not warrant that the service and content will be uninterrupted, error-free or without delays.” However, the Court concluded that the third and fourth statements provided a sufficient basis for consumer protection claims, as Sony's policies had promised “reasonable security” and “industry-standard” encryption”.¹⁴¹

Common among the obstacles to cybersecurity-related consumer protection law claims is the demonstration that the consumer suffered a financial loss. For instance, in the Sony Play Station Network litigation, the plaintiffs also brought a claim under Florida's consumer protection statute, which requires consumers to demonstrate “actual damages.” Florida state courts have defined “actual damages” as the “difference in the market value of the product or service in the condition in which it was delivered and its market value in the condition in which it should have been delivered according to the contract of the parties.”¹⁴² The Sony plaintiffs sought to recover three costs: (1) the amount that they overpaid for their game consoles, (2) the monthly premiums for the services when they were unavailable, and (3) the value of their breached personal information. The district court dismissed this claim, concluding that none of these claims constitutes actual damages under the Florida law. The plaintiffs failed to demonstrate that they overpaid for the consoles or the services because of Sony's alleged misrepresentations about its data security, the court concluded.¹⁴³ Moreover, the court concluded that personal information “does not have an apparent monetary value” and therefore is not a proper basis for a claim of actual damages under the Florida law.¹⁴⁴

However, the injury requirement is surmountable for plaintiffs, particularly during the early stages of litigation. For example, in the Target consumer class action arising from the 2013 data breach, the plaintiffs alleged violations of the consumer protection laws of forty-nine states and the District of Columbia. They claimed that Target violated these laws by failing to implement adequate data security, failing to disclose its inadequate data security, failing to notify consumers of the breach, and continuing to accept credit and debit cards after it knew, or should have known, of the breach. Twenty-six of the consumer protection laws require economic injury, and Target argued that the claims under those statutes therefore should be dismissed. However, the district court denied this motion, concluding that plaintiffs alleged that they suffered fees for new credit cards, late fees, and other charges as a result of the breach.¹⁴⁵

State consumer protection laws are primarily designed to be enforced by state officials, such as state attorney general, just as the FTC enforces Section 5 of the FTC Act. Accordingly, courts are hesitant to allow private lawsuits under consumer protection statutes when common-law remedies such as negligence are available. In the Hannaford grocery store data breach case, the plaintiffs brought a claim under the Maine Unfair Trade Practices Act, which provides that “[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce are declared unlawful.”¹⁴⁶ The provision of the statute creating a private right of action states that “[a]ny person who purchases or leases goods, services or property, real or personal, primarily for personal, family or household purposes and thereby suffers any loss of money or property, real or personal,” due to the defendant's actions, may sue for damages and other relief.¹⁴⁷ The First Circuit affirmed the district court's dismissal of the claim under the Maine law, concluding that the substantial injury requirement, combined with the requirement that a plaintiff suffer a loss of money or property, requires a narrow reading of the Maine statute. Claims for breach of contract and negligence are more appropriate for the data breach in which the plaintiffs are not seeking damages for restitution.¹⁴⁸

In re Hannaford Bros. Co. Customer Data Security Breach Litigation, No. 2:08-MD-1954 (D. Me. March 13, 2013)

In this putative class action lawsuit, described above, the class representatives brought seven claims arising from a large data breach of a grocery store chain. The U.S. Court of Appeals for the First Circuit upheld the district court's dismissal of five claims, but allowed the plaintiffs to proceed on claims of negligence and breach of implied contract. The case returned to the district court, which then faced the task of deciding whether to certify the class.

The district court concluded that the plaintiffs satisfied all four of the Rule 23(a) requirements:

• Numerosity. The court relied on data from credit card issuers that showed that thousands of cardholders whose data was compromised purchased identity theft protection in the year after the breach, and thousands also were charged card replacement fees. The court acknowledged that it was impossible to determine whether the Hannaford breach was the cause of all of the expenses, but noted that it is permitted to draw “reasonable inferences” about numerosity. The judge noted that the case likely will result in “generous fees” for the lawyers representing the plaintiffs, and that he is concerned that “few class members will ultimately be interested in taking the time to file the paperwork necessary to obtain the very small amount of money that may be available if there is a recovery.” However, the judge stated that such concerns are for Congress, and that he cannot consider such issues when ruling on numerosity.
• Commonality. Although the losses suffered by the individual class members may vary, the judge determined that the plaintiff satisfied the commonality requirement because all of the claims arise from the common question of whether Hannaford's actions caused the breach and remediation measures.
• Typicality. The judge concluded that the class representatives satisfied the typicality requirement because the interests of the class members and representatives are aligned: demonstrating that Hannaford was negligent and breached an implied contract. Hannaford argued that the alleged economic harm to class members varied; for example, some purchased credit monitoring and others paid fees for new cards. Because the claims differ, they require different evidence of causation, and therefore fail to satisfy the typicality requirement, the company asserted. The judge acknowledged that “there is some force” to this argument, but held that the customers' mitigation steps – whether by purchasing identity theft protection or ordering a new card – was mitigation from the same alleged action (or inaction) of Hannaford.
• Adequacy. To satisfy the adequacy requirement, class representatives must demonstrate: (1) there is not a potential conflict between the representatives and class members, and (2) the lawyers are qualified, experienced, and able to conduct the litigation. Hannaford argued that the class representatives chose to file a lawsuit rather than apply to the company for refund gift cards, but the judge concluded that this is not a conflict.

Although the court concluded that the plaintiffs satisfied all of the requirements of Rule 23(a), the court denied class certification because the plaintiffs failed to satisfy Rule 23(b). The plaintiffs argued that their lawsuit satisfies Rule 23(b)(3), a lawsuit in which common questions of law and fact predominate questions regarding individual class members and a class action is superior to other available methods. Accordingly, the court considered both (1) superiority and (2) predominance. The court had little difficulty finding that the class action is superior to individual lawsuits, since “[g]iven the size of the claims, individual class members have virtually no interest in individually controlling the prosecution of separate actions[.]”

However, the judge concluded that the plaintiffs did not satisfy the predominance requirement. Although the class members' alleged injuries arise from the same data breach, the types of injuries (lost card fees, identity theft protection, etc.) varies. The plaintiffs claimed that they could find expert witnessess to testify, based on industry statistics, about the proportion of the fees and costs that could be attributed to the Hannaford breach, and that class administrators would determine how to distribute any proceeds from the case. However, the plaintiffs had not presented the judge with an expert opinion about how the damages would be determined, and therefore, the judge ruled that the plaintiffs cannot prove total damages, and the alternative “is a trial involving individual issues for each class member as to what happened to his/her data and account, what he/she did about it, and why.”

The Hannaford case demonstrates a key barrier to plaintiffs in achieving class certification for data breach cases. Even if all class members are affected by the same data breach, it is quite likely that at least some class members suffered different types of damage. Before seeking class certification, the plaintiff must be able to demonstrate to the court how it can accurately determine the damages that this wide range of class members have suffered.