Sixth Circuit Rules That Theft Of PII From Insurance Company Results In Article III Standing

In its recent decision in Galaria v. Nationwide Mut. Ins. Co., no. 15-3386 (6th Cir. Sept. 12, 2016). Co., No. 15-3386 (6th Cir. Sept. 12, 2016), a divided Sixth Circuit panel held that plaintiffs had standing to assert claims arising from hackers' alleged theft of data containing plaintiffs' sensitive personal data, including dates of birth and Social Security numbers. In so ruling, the court became the latest to hold that hackers' targeted theft of personal identifying information ("PII"), standing alone, creates a substantial risk of harm that is sufficient to satisfy the concrete injury requirement for standing under Article III of the United States Constitution.

The lawsuit concerned a 2012 data breach in which hackers stole data that Nationwide collected for purposes of underwriting life insurance policies. Plaintiffs were among those who received notice that hackers had stolen data containing the names, dates of birth, marital status, genders, occupations, employers, Social Security numbers and driver's license numbers for individuals who had applied for insurance from Nationwide. Criminals are increasingly targeting PII like that stolen here because it can be used to engage in fraudulent borrowing or to file false tax returns to obtain illegal refunds, making such data valuable on the black market. However, as is true in many cases involving PII data breaches, plaintiffs did not allege that their PII had actually been misused. Also, Nationwide offered a year of free credit monitoring and identity-theft protection insurance to individuals whose information has been stolen. Based on those protections and plaintiffs' failure to allege actual misuse of stolen data, the district court granted Nationwide's motion to dismiss for lack of standing.

On appeal, plaintiffs argued that the district court had failed to appreciate the injury that plaintiffs had suffered. Because hackers target PII for the express purpose of misusing it, plaintiffs contended that the risk of injury was neither speculative nor remote. And, even absent actual misuse of data, plaintiffs argued that instituting credit monitoring and other protections against identity theft imposed a cost in time and money on affected individuals. The Sixth Circuit agreed, rejecting Nationwide's argument that misuse of data must be "literally certain" to confer Article III standing. In the court's view, criminals' deliberate theft of plaintiffs' PII created an immediate, serious and...