Imagine that your credit card information is stolen in a data breach. Do you have standing to sue the company where the data breach occurred? Most courts would say “no,” not unless the hackers misuse your information and you incur fraudulent charges. But if there is a substantial risk that this may happen and you take steps to prevent it, you may be able to recover your mitigation costs.
The Legal Standards
The U.S. Supreme Court recently reviewed the standing requirements in Spokeo v. Robins, 136 S. Ct. 1540 (2016). In Spokeo, the court confirmed that standing requires an injury-in-fact, i.e., an injury that is “concrete and particularized,” and “actual or imminent, not conjectural or hypothetical.” Id. at 1548 (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). In the example above—where hackers steal information, but do not use it—plaintiffs have not suffered an actual injury.
