A federal judge in Florida granted final approval of a $3 million settlement in a data breach class action with AvMed, Inc., an integrated managed care organization.  The settlement agreement is unique in that it allows affected plaintiffs to recover even if exposure of their data did not result in identity theft.

The data breach resulted from the theft of two laptops from AvMed’s Florida facility in December 2009. Although they recovered one laptop, the laptop at large contained unencrypted information, including the names, addresses, dates of birth, Social Security numbers, and personal health information of customers and former customers. AvMed initially divulged that the security breach compromised the personal information of 208,000 people in February 2010, before twice revising that number to eventually conclude that it affected 1.2 million.  They notified those affected, and offered two years of credit monitoring.

The plaintiffs who did not suffer from identity theft rode into this settlement on the coattails of those that did.  The district court originally dismissed plaintiffs’ claim because they failed to satisfy the pleading standard under Twombly by not alleging actual identity theft.  Plaintiffs then dropped those whose personal information was merely exposed, and added a named plaintiff whose identity was stolen, amending their complaint accordingly.  The district court again granted AvMed’s motion to dismiss for failure to state a cognizable injury.

The Eleventh Circuit Court of Appeals reversed in part, and remanded the action to the district court. It determined that the plaintiffs who suffered identity theft had Article III standing.  Their economic injuries constituted a cognizable injury as a matter of law.  Further, it was “fairly traceable” to the breach in AvMed’s data security, and a monetary award of compensatory damages would redress plaintiffs’ grievances.  The Eleventh Circuit also found that plaintiffs met the pleading standards under Twombly, rebuffing AvMed’s argument that they failed to allege a cognizable injury because they plead losses without noting that they were unreimbursed.

Mediation that followed led to the settlement recently approved by the district court. It remains to be seen how much of the $3 million settlement will go to each of the 1.2 million customers affected by the breach, considering the various guaranteed costs from this amount.  From this settlement, the plaintiffs’ attorneys netted $750,000.  The two named plaintiffs win $5,000 each for their perseverance, in addition to whatever else they receive under the settlement.  Costs related to settlement notices and administrative fees are also deducted from the award.  The remaining funds will be provided to the identity theft victims in the amount of their unreimbursed losses, and to customers whose data was exposed in the amount of $10 per year—up to $30.  Two hundred and fifty thousand dollars is set aside exclusively for the identity theft victims.  If the claims exceed the remaining amount, then the amount paid to each plaintiff will be reduced pro rata.  Additionally, AvMed agreed to implement security measures and training.

Although this case is unique in that plaintiffs will recover some amount of money despite not suffering from identity theft, this is a settlement and not a ruling.  There is no indication of how this settlement will affect future data breach plaintiffs, if at all.  These types of plaintiffs will still need to establish standing by demonstrating that they suffered a cognizable injury that is fairly traceable to the defendant’s actions, and that can be redressed by a favorable court action.  Whether this settlement will encourage courts to allow data breach plaintiffs to overcome some of their largest hurdles, or encourage similar payouts remains to be seen.

The action is Resnick et al. v. AvMed Inc., Case Number 1:10-cv-24513, in the U.S. District Court for the Southern District of Florida.

In Galaria v. Nationwide Mutual Insurance Company, an Ohio federal judge dismissed claims stemming from a large scale data breach because plaintiffs failed to demonstrate an injury sufficient to confer legal standing. The judge found their data was not misused and that any threatened harm was not “certainly impending.” The court rejected plaintiffs’ arguments that they had standing based on an increased risk of identity theft, loss of privacy, and deprivation of value of personally identifiable information.

The class action litigation arose from an October 2012 breach in Nationwide’s data security that exposed the personally identifiable information of an estimated 1.1 million Americans. The cyber thieves made off with names, Social Security numbers, driver’s license numbers, and birthdays of Nationwide customers as well as those seeking insurance quotes. In response, Nationwide notified those affected and offered free credit monitoring and identity theft protection services for a year. It is important to note that the named plaintiffs did not allege that their personally identifiable information was actually misused or that they suffered from identity theft resulting from the data breach.

In dismissing these claims, the court relied heavily on the Supreme Court’s decision in Clapper v. Amnesty International, which held that a “threatened injury must be ‘certainly impending’ to constitute injury in fact” sufficient to confer Article III standing. While the Galaria court was not the first to apply the year-old decision to bar claims arising from a large-scale data breach, it is the latest example of the difficulties data breach plaintiffs face in surviving a motion to dismiss based on a lack of Article III standing.

Increased Risk of Harm

Similar to other data breach plaintiffs, the Galaria plaintiffs attempted to establish standing by arguing that their increased risk for identity theft and related mitigation costs caused them injury in fact. The court disagreed, finding that the subsequent harm depended on the criminal actions of independent decision makers. The Galaria court likewise found that mitigation costs did not confer standing. Citing Clapper, it reasoned that, “respondents cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.”

Loss of Privacy

Plaintiffs also argued they had standing because Nationwide publicly disseminated their personally identifiable information. The court, however, ruled that plaintiffs failed to allege adverse consequences aside from increased risk. The alleged loss of privacy did constitute an injury in fact for plaintiffs’ state invasion of privacy claim, but plaintiffs failed to establish a causal connection between Nationwide’s actions and plaintiffs’ injuries. That is, plaintiffs lacked standing because they failed to properly allege that defendants disclosed their private affairs where the data were stolen rather than published, and because any public dissemination would result from independent hack activity.

Deprivation of Value of Personally Identifiable Information

Finally, plaintiffs claimed that deprivation of the value of their personally identifiable information constituted an injury in fact. They reasoned that because personally identifiable information has value on the black market, Nationwide injured them by exposing their information and therefore depriving the plaintiffs of the information’s value. The Galaria court disagreed, holding that regardless of the information’s value, plaintiffs did not demonstrate they had access to this black market, nor that third parties deprived them of profits by selling their information there.