Lawsuits alleging injuries from data breaches within businesses are increasingly common in the digital age, and 2018 has seen a host of such cases. See, e.g., Joseph Lazzarotti, et al., “California May Lower The Standing Threshold in Data Breach Litigation,” Lexology, Jul. 11, 2018, at https://www.lexology.com/library/detail.aspx?g=2bbb37f5-2c8e-4d01-ae4a-2301c1ca3447 (last visited Aug. 1, 2018). Federal and state legislatures have considered several privacy protection measures this year, and the California Senate is attempting to address what parties should have standing to sue in the event of such breaches. See, e.g., id. This article examines the issue of standing in data breach lawsuits and the role expert witnesses may play in resolving such matters.
The importance of standing in lawsuits that allege a breach of information is perhaps best explained by a group of attorneys in the field: “[a] key issue for any business facing class action litigation in response to a data breach is whether the plaintiffs, particularly consumers, will have standing to sue. Standing to sue in a data breach class action suit  largely turns on whether plaintiffs establish that they have suffered an ‘injury-in-fact’ resulting from the data breach.” Id. According to some analysts, demonstrating standing in such matters is no easy task. See id. In fact, “[p]aintiffs…are often not able to demonstrate that they have suffered financial or other actual damages resulting from a breach of their personal information. Instead, plaintiffs will allege that a heightened ‘risk of future harm’ such as identity theft or fraudulent charges is enough to establish an ‘injury-in-fact.”’ Id.
Many federal circuit courts have attempted to address who should have standing to sue in litigation of this nature, and state and federal lawmakers are weighing in. See id. To best inform such decisions, policymakers, attorneys, judges, and juries may require the assistance of experts. As consultants, experts can help craft laws that are clear and fair to both sides without being too burdensome on either. They can assist litigators in determining whether a given jurisdiction’s definition of standing can be readily met by parties. In the event that new legislation is enacted, consulting experts may play an indispensable role in helping attorneys to clarify statutory meaning.
Testifying experts also have an important place in resolving what parties should have standing to sue in the event of a data breach. For instance, the U.S. Supreme court is expected to consider this matter, and their decision may turn on expert testimony regarding what constitutes an “injury-in-fact” in such cases. See id. If legislation is passed to address standing in data breach litigation, lower courts will likely require and be informed by expert testimony to assist them in interpreting newly-enacted laws. Unless or until the Supreme Court provides clarity on this question, expert testimony may be the best way to sway adjudicators, and a current federal circuit split may cause unpredictability. If the Supreme Court establishes a rule or test for standing in litigation of this nature, expert witnesses can help litigators demonstrate whether that standard has been met in specific instances. See, e.g., id.
Many legal analysts have noted a nationwide trend towards broadening privacy protections and have suggested that federal and state policymakers are likely to follow the EU’s lead. See, e.g., id. In the meantime, the current circuit split and lack of Supreme Court guidance leaves the question of standing somewhat unresolved. See id. While five circuits seem to favor a broad interpretation that would allow for the “risk of future harm” to establish standing in data breach cases, six of them have generally rejected such breadth and prefer a more restrictive standard. See id. Litigation over data breaches is likely to increase in the coming months and years, and expert witnesses can help legislators, attorneys, and adjudicators to address the question of standing and resolve competing claims on the matter.