Antitrust Law Daily Wrap Up, PRIVACY—E.D. Mo.: Scottrade customers lack standing in data breach suit, (Jul 15, 2016)

By John M. Jascob, J.D., LL.M.

Customers of Scottrade, Inc. lacked standing to sue the retail brokerage for claims resulting from a data breach that involved the personal information of over four million customers. The federal district court in St. Louis, Missouri dismissed the consolidated class action, ruling that it lacked subject matter jurisdiction because the customers had not demonstrated any injury in fact (Duqum v. Scottrade, Inc., July 12, 2016, Mensah, S.).

Data breach. Between September 2013 and February 2014, hackers gained access to Scottrade’s customer databases and exported the confidential personal identifying information (PII) of approximately 4.6 million customers from those databases. The hackers used the PII for the purpose of building their own competing customer database and to operate a stock price manipulation scheme that amassed millions of dollars. The Department of Justice filed criminal charges against the hackers in November 2015.

After the FBI alerted Scottrade of the data breach in August 2015, the firm began notifying its customers via email or mail. Among other things, Scottrade stated that it would provide one year of credit monitoring and identity theft insurance to affected persons. Several of Scottrade's customers then filed putative class action lawsuits, alleging various causes of action including breach of contract, negligence, and violations of various state consumer protection statutes.

No injury in fact. The district court, however, granted Scottrade’s motion to dismiss, holding that the investors lacked standing because they had not demonstrated any actual or imminent injury. The plaintiffs did not allege that any of the stolen PII had been used to commit any identity theft or fraud that resulted in harm to them, nor did they allege any facts suggesting that the hackers intended to commit any act that would result in harm. Thus, the court could not determine whether the plaintiffs would suffer harm in the future without engaging in considerable speculation about the hackers’ possible intentions and future actions. Given that uncertainty, the court could not find that any harm was "certainly impending" or that there was a substantial risk of it occurring, particularly in light of the passage of more than two years without it having occurred.

Similarly, the court rejected the plaintiffs' argument that they had suffered injury in the form of financial or temporal costs of monitoring their credit and financial accounts and mitigating their damages. As the plaintiffs’ increased risk of identity theft or fraud did not constitute an imminent harm, the cost of monitoring for that risk or mitigating that risk could not constitute an injury in fact.

The plaintiffs’ argument that they were harmed by the lost benefit of their bargain with Scottrade also failed because they did not show how any fee they paid was understood by both parties to be allocated toward the protection of customer data. And although the plaintiffs alleged that they would have rather sold their PII on the black market than have it used without their authorization, they did not allege that they ever intended to sell their information, or that they ever attempted to sell it and were forced to accept a lower price. Finally, the plaintiffs’ theories that they had suffered damages or injury due to a loss of privacy or breach of confidentiality were not sufficiently concrete to support standing.

The case is No. 4:16-cv-00124-SPM.

Attorneys: Anthony Anderson Benton Dogali (Dogali Law Group, P.A.) and Karen Hanson Riebel (Lockridge Grindal Nauen PLLP) for Angela Martin. Brandi Lynne Burke (Thompson Coburn, LLP) for Scottrade, Inc.

Companies: Scottrade, Inc.

Cases: Privacy MissouriNews