The Intangible Concrete Injury: A 2024 Update of Post-TransUnion Decisions on ‎Standing for Data Breach Class Actions

Jurisprudence on Article III standing requires a plaintiff to demonstrate an injury in fact, which must be both (1) concrete and (2) actual or imminent.^[1] For a plaintiff seeking redress in a data breach case, sufficiently pleading and proving the “injury in fact” standing requirement often proved elusive. Although a framework has developed relating to these elements, the application of this framework has yet to yield consistent results.

This article focuses on the element of concreteness. Subsequent articles will provide additional analysis on the element of actual or imminent injury as well as other considerations concerning pursuing claims in response to a data breach.

In 2021, two key decisions provided guidance on the concrete and actual or imminent elements in the data breach context.^[2] First, in TransUnion v. Ramirez, the Supreme Court held that an intangible injury can be concrete, but only if the asserted harm has a “close relationship” to a harm “traditionally” recognized as providing a basis for a lawsuit in American courts.^[3] Second, in McMorris v. Carlos Lopez & Assocs., the Second Circuit outlined factors to be considered when evaluating whether an alleged future harm is imminent enough to confer standing.^[4] Unfortunately, in the two-and-a-half years since, the courts have not uniformly applied and interpreted the various factors and considerations outlined in TransUnion and McMorris. The question still remains: after a data breach, who has an injury in fact?

The Requirement to Show a Concrete Injury – Tangible or Intangible

To have Article III standing to sue in federal court, a plaintiff must show, among other things, that they suffered concrete injury in fact.^[5] The TransUnion Court confirmed that the concreteness requirement must be met for a plaintiff claiming injury by a defendant’s statutory violation, which was FCRA in the TransUnion case.^[6] Establishing that an alleged harm is concrete is relatively easy when the plaintiff claims a tangible harm such as the typical allegation of suffering a physical injury or economic loss.^[7] Examples of tangible harms that satisfy the concrete injury requirement for data breach cases include the need to pay for a credit-monitoring service^[8] and loss of access to a credit card for even a few days.^[9] The assertion of an intangible injury by a plaintiff is more complicated. 

If the core injury is intangible, unlike the more common physical or monetary tangible harms, there needs to be a close common-law analog to the injury alleged.^[10] Indeed, the evaluation for whether the intangible harm is a concrete harm for standing purposes centers on “whether the alleged injury to the plaintiff has a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in American courts.”^[11] The Supreme Court acknowledged in TransUnion that “public disclosure of private information” is “traditionally recognized as providing a basis for lawsuits in American courts.”^[12] Relying on TransUnion, the Second and Third Circuits have held that exposure of a plaintiff’s personally identifiable information to unauthorized third parties, due to hacks of their employer, was sufficiently analogous to the common-law claim of public disclosure of private facts.^[13] Accordingly, the plaintiffs in those cases satisfied the requirement of alleging a concrete, intangible harm.

The analogous common law claim employed in data breach cases for the concreteness element is frequently, but not always,^[14] public disclosure of private information. However, the standard to establish that the common law claim is analogous varies widely among cases. The standard varies even within cases evaluating the same analogous common law claim. In addition, when drawing an analog to the common law claim of public disclosure of private information, there is a secondary focus as it pertains to the “public disclosure” aspect. For both, there is no consensus regarding what is required to satisfy the intangible harm requirement for standing.

1. Pleading of the Analogous Common Law Claim

Three Circuit decisions exhibit the varying requirements courts have applied when determining whether a plaintiff has articulated a concrete injury under an analogous common law claim. Although each analysis, like nearly everything with standing, is fact-specific, there is a distinct difference for a plaintiff to establish a concrete, intangible injury under these different holdings. 

• Second Circuit: The plaintiff does not need to assert the analogous common law claim nor does the state law need to even recognize that particular common law claim.^[15]
• Seventh Circuit: The plaintiff’s alleged harm was not closely related to the common law claim because his allegations were “missing an element essential to liability.”^[16]
• Tenth Circuit: The plaintiff does not have to “plead and prove the tort’s elements to prevail. But to proceed, she had to at least allege a similar harm.”^[17]

2. Factual Requirements for Public Disclosure

The Circuit courts are also not uniform regarding the extent of the analogous disclosure necessary for the “public disclosure of private information” common law claim to be deemed sufficiently analogous. 

On the one hand, many courts do not struggle to determine that an allegation of unauthorized disclosure pursuant to a data breach is satisfactorily analogous to public disclosure of private information. When there was actual “exposure of personally identifying information” on the dark web, the plaintiff’s alleged harm was sufficiently concrete and easily analogous to the tort of public disclosure.^[18] Yet, the Second Circuit has affirmatively held that the private information does not need to be published or publicly available for the tort to be analogous. The Bohnack Court (2023) found that a third-party obtaining private information in a targeted hack is close enough to “public disclosure,” even if such information was not published.^[19] The Salazar Court (2024) went further and held that intentional disclosure to a third-party by the defendant, although the defendant did not inform the plaintiff that such disclosure was occurring, was a sufficiently analogous public disclosure.^[20]

Conversely, in factually similar cases, the Third (2024) and Tenth (2022) Circuits also held that “[w]hen the communication of personal information only occurs between a debt collector and an intermediary tasked with contacting the consumer, the consumer has not suffered the kind of privacy harm traditionally associated with public disclosure.”^[21] More generally, the Seventh Circuit (2023) held that without the publication of private information, a plaintiff has not suffered an injury similar to the public disclosure tort.^[22] This was echoed in a Florida district court opinion (2022) that denied standing because “Plaintiffs fail to allege that Defendant or the hacker(s) communicated their private information to the public at large.”^[23] 

The interpretation that requires publicization to meet the “analogous common law claim” requirement for intangible injuries seems to negate the fact that the next element of the “injury in fact” analysis permits an injury to be imminent rather than have actually occurred. The evaluation of the second element (actual or imminent) for establishing an injury in fact for standing will be assessed in depth in the next article.

---