Is D.C. Circuit’s Data-Breach Standing Decision a Tipping Point for High Court Review?

Guest Commentary by David T. Cohen, Counsel at Ropes & Gray LLP in its New York, NY office.

Article III of the U.S. Constitution requires all private litigants in federal court to establish “standing,” that is, to show that they are proper litigants to raise the defendant’s alleged legal violations with the court. To have standing, a plaintiff must face an actual or sufficiently imminent future injury from the legal violation.  Several recent federal appellate decisions have grappled with the issue of when, if ever, a plaintiff whose personal information was compromised in a data breach—but who has suffered no actual harm from that compromise—faces a sufficiently imminent future harm to have Article III standing.

One such recent case stands out from the pack, both because it hails from the particularly prominent U.S. Court of Appeals for the D.C. Circuit, and because it is the subject of a forthcoming petition for a writ of certiorari, setting the stage for what could become the first-ever ruling by the U.S. Supreme Court on the issue in a data breach matter. Continue reading