Data Breach Claim Requires “Injury-In-Fact,” Says 8th Circuit

Two cases from the Eighth Circuit Court of Appeals have come to a similar conclusion about what’s required for a plaintiff to be granted standing in a data breach case: There must be a real “injury-in-fact.” In one case, the court found specifically that risk of future injury was not actionable and that efforts required to mitigate that risk, like figuring out what happened and monitoring your account information, did not constitute an injury. But other appeals courts – including D.C. and the Seventh Circuit – have held that a substantial risk that stolen personal information will be misused in the future is enough to establish standing, and this post from Squire Patton Boggs predicts the issue will eventually reach the Supreme Court. Meanwhile, the authors write, “plaintiffs in data breach matters will be looking to file in more favorable jurisdictions while defendants in the Eighth Circuit will have a powerful tool for dismissal.”