CareFirst Asks SCOTUS to Sort Out Data Breach Split

By Perry Cooper

A data breach without any identity theft or other actual harm isn’t enough to create standing to sue in federal court, insurer CareFirst Inc. told the U.S. Supreme Court Oct. 30.

CareFirst asked the court to review an August ruling by the U.S. Court of Appeals for the District of Columbia Circuit that revived class claims stemming from a 2015 data breach that compromised information of 1.1 million consumers ( CareFirst, Inc. v. Attias , U.S., no. not available, review sought 10/30/17 ).

Federal courts continue to struggle with how to interpret the U.S. Supreme Court’s holding in Spokeo Inc. v. Robins that plaintiffs must allege a harm that is “actual or imminent” rather than speculative. The issue is particularly challenging for the courts in data breach cases where hackers may not yet have used stolen data.

Circuit Split

The D.C. Circuit joined the Seventh Circuit, which said in Remijas v. Neiman Marcus Grp. that data breaches create a substantial risk of identity theft because, presumably, the purpose of a hack is to eventually make fraudulent charges or assume the consumers’ identities.

But the Third, Fourth, and Eighth circuits have held that plaintiffs don’t have standing based on an increased risk of identity theft without an allegation of actual harm, CareFirst said in its petition to the high court.

“The D.C. Circuit’s approach reduces the substantial risk standard to one of plausibility, a far less stringent test than even the objectively reasonable likelihood standard that the court found inadequate in Clapper,” CareFirst said. It referred to Clapper v. Amnesty Int’l, where the Supreme Court held that claims based on future injures require that the injuries are imminent or that there is a substantial risk of that they will occur.

Matthew O. Gatewood in Washington, and Robert D. Owen and Francis X. Nolan IV in New York, all of Eversheds Sutherland LLP filed the petition on behalf of CareFirst.

To contact the reporter on this story: Perry Cooper in Washington at

To contact the editor responsible for this story: Steven Patrick at

For More Information

Full text at

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.