Antitrust Law Daily Wrap Up, PRIVACY—M.D. Pa.: Use of misappropriated personal information required for standing in data breach case, (Mar 16, 2015)

By Jody Coultas, J.D.

The federal district court in Harrisburg, Pennsylvania, has ruled that plaintiffs whose personal information was accessed by hackers lacked standing to bring claims against Paytime, Inc., a national payroll service company that suffered the security breach (Storm v. Paytime, Inc., March 13, 2015, Jones, J.).

Current and former employees of companies that used Paytime as their payroll processing service filed suits against Paytime based on an unknown third party’s alleged access of their confidential personal and financial information stored on Paytime’s servers. The plaintiffs alleged that as many as 233,000 individuals could be members of a class consisting of persons whose information was compromised. As a result of this data breach, the plaintiffs and the proposed class members have spent, or will need to spend, time and money to protect themselves from identity theft.

To have standing, a plaintiff must allege a personal injury fairly traceable to the defendant’s allegedly unlawful conduct. The injury must also be actual or “imminent,” not “conjectural” or “hypothetical.”

The Third Circuit has held that in data breach cases, a plaintiff does not suffer harm unless the plaintiff alleges actual “misuse” of the information, or that such misuse is imminent. The plaintiffs allege that they and the proposed class members “are at an increased and imminent risk of becoming victims of identity theft crimes, fraud and abuse.” One plaintiff, a government contractor, had his security clearances suspended for a period of time so that his employer could investigate the effect of the data breach situation, which resulted in a loss of time and travel expenses. However, the plaintiffs failed to allege misuse of their information or that misuse was certainly impending. The plaintiffs did not allege that they actually suffered identify theft. The government contractor’s data had not been misused; his preventive measure taken was different in form but not in substance from the classic forms of preventive measures taken in data breach cases, such as credit monitoring. An increased risk of identity theft is not an imminent injury. The fact that the harm of misuse had not occurred almost a year after the breach undercut the argument.

The case is No. 14-cv-1138.

Attorneys: Gary F. Lynch (Carlson Lynch Sweet & Kilpela, LLP) for Daniel B. Storm. Claudia D. McCarron (Lewis Brisbois Brisgaard & Smith, LLP) for Paytime, Inc.

Companies: Paytime, Inc.

Cases: Privacy StateUnfairTradePractices PennsylvaniaNews