Is Invasion of Privacy an Appropriate Analogue for Data Breach Cases?

The authors examine whether invasion of privacy torts—intentional torts—are actually analogous to data breaches where claims sound in negligence and the alleged harm may be a risk of future identity theft, rather than embarrassment or other dignitary harms. The diverging approaches of lower courts in addressing this question suggests a struggle with applying historical tradition to these novel data privacy claims.

September 13, 2024 at 10:00 AM

8 minute read

Cybersecurity

Judith Archer, Sean Topping

Joe Hughes

Data breach plaintiffs suing in federal court must demonstrate that they suffered an injury-in-fact to establish the "'irreducible constitutional minimum' of standing." Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). Such plaintiffs often invoke privacy harms that they allege are similar to common law "invasion of privacy," following the Supreme Court's "close relationship" test articulated in Spokeo and TransUnion L.L.C. v. Ramirez, 594 U.S. 413 (2021).

NOT FOR REPRINT