Consumer Law

Should Victims of Data Breaches Be Able to Recover Absent a Showing of Identity Theft?

By Jeff Sovern

Most courts have rebuffed suits by consumers against companies that suffered data breaches when the consumers could not show that they had been victimized by identity thieves. For example, in Bell v. Acziom Corp., 2006 WL 2850042 (E.D.Ark. 2006), the court found that the plaintiff lacked standing when she alleged that defendant?s failure to prevent the breach of security had ?jeopardized her privacy and left her at a risk of receiving junk mail and of becoming a victim of identify theft.? The court observed that ?Plaintiff does not know whether her name and information were contained within the databases stolen by Levine. More than three years after the theft, Plaintiff has not alleged that she has suffered anything greater than an increased risk of identity theft.? But Ruiz v. Gap, Inc., 540 F.Supp.2d 1121, 1126 (N.D.CA 2008) is a recent case going the other way, After Ruiz applied for a job at the Gap, a Gap contractor lost two laptops containing Ruiz?s Social Security number and other personal information. Ruiz sued in negligence, among other claims, arguing that as a result of the loss he faced an increased risk of identity theft. The court denied the Gap?s motion to dismiss the negligence claim, finding that Ruiz had standing, but noting that it ?is far from clear what damages, if any, Ruiz will be able to recover if he eventually prevails on his negligence claim.?  We don't know what will happen at the summary judgment stage, but this is more encouragement than most consumer-plaintiffs whose data has been compromised have received.  Will consumers eventually be able to recover for anxiety caused by breaches?  Because the data of a great many consumers has been compromised, if courts start allowing recovery for the increased risk of identity theft when no identity theft has occurred, businesses (and universities too, for that matter) face enormous exposure.  Of course, that exposure would increase the incentive to be careful with consumer data. 

Full post as published by CL&P Blog on July 21, 2008 (boomark / email).