A significant roadblock for plaintiffs in data breach cases in Florida is the threshold issue of Article III standing. Plaintiffs must show an actual or imminent injury. Eleventh Circuit courts do not clearly articulate a rule as to the type of actual harm required to survive a motion to dismiss. Plaintiffs and defendants must therefore navigate the case law to determine the degree of harm that must be alleged in the growing canon of data breach litigation.

Under Article III, Section 2 of the U.S. Constitution, the plaintiff bears the burden of proving standing, which requires a three-part showing: the plaintiff must have suffered an injury-in-fact; the plaintiff's injury must be fairly traceable to the defendant's actions; and the relief requested must redress the plaintiff's injury, see Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–560 (1992).

To establish injury-in-fact, the plaintiff must demonstrate she has “a legally cognizable interest that has been or is imminently at risk of being invaded,” see Mulhall v. UNITE HERE Local 355, 618 F.3d 1279, 1286 (11th Cir. 2010). At the pleading stage, this requirement is satisfied by “general factual allegations of injury resulting from [the defendant's] conduct.” How much of an injury is required to show an injury-in-fact in a data breach case? Possibly, a mere trifle.