Friday, March 9, 2018
The Ninth Circuit ruled this week that victims of a commercial web-site hacking have standing to sue the site for failure to secure their personal information, even though their information hasn't (yet) been used for identity theft. Importantly, the court distinguished Clapper v. Amnesty International. The ruling aligns with similar cases out the D.C. and Seventh Circuits.
The case, Stevens v. Zappos.com, arose when hackers stole personal information from the retailer-web-site. Victims brought two kinds of claims against the retailer: claims based on theft of their personal information that led to actual financial loses from identity theft; and claims based on theft of their personal information without allegations of actual financial losses from identity theft. The lower court held that the first group had standing, but the second did not. So they appealed.
The Ninth Circuit reversed. The court said that its own case, Krottner v. Starbucks Corp., controlled. Krottner held that employees of Starbucks had standing to sue based on "the increased risk risk of future identity theft" after a company laptop containing their personal information was stolen.
The court explained why Krottner was still good law after Clapper v. Amnesty International:
Unlike in Clapper, the plaintiffs' alleged injury in Krottner did not require a speculative multi-link chain of inferences. The Krottner laptop thief had all the information he needed to open accounts or spend money in the plaintiffs' names--actions that Krottner collectively treats as "identity theft." Moreover, Clapper's standing analysis was "especially rigorous" because the case arose in a sensitive national security context involving intelligence gathering and foreign affairs, and because the plaintiffs were asking the courts to declare actions of the executive and legislative branches unconstitutional. Krottner presented no such national security or separation of powers concerns.
And although the Supreme Court focused in Clapper on whether the injury was "certainly impending," it acknowledged that the other cases had focused on whether there was a "substantial risk" of injury. Since Clapper, the Court reemphasized in Susan B. Anthony List v. Driehaus that "[a]n allegation of future injury may suffice if the threatened injury is 'certainly impending,' or if there is a 'substantial risk that the harm will occur.'"