In a move counter to the trending precedent in data breach litigation, the U. S. Court of Appeals for the Seventh Circuit ruled on July 20 that data breach plaintiffs whose personal information was potentially exposed in a confirmed hacking breach of a major retailer’s network alleged enough risk of harm to meet the standing requirements of Article III of the U.S. Constitution. Plaintiffs’ lawyers will herald this decision, but standing is only the first of many hurdles data breach plaintiffs must cross to proceed to the merits in data breach litigation.
Earlier this month, the Court of Appeals for the Seventh Circuit held that damages are not available under the Video Privacy Protection Act (VPPA) for violations of subsection (e) of the statute, the “Destruction of Old Records” provision. The court concluded that the damages provision only applies to a video tape service provider’s knowing disclosure of a consumer’s personally identifiable information–such as video viewing history–in violation of subsection (b) of the statute. The court relied on two key factors in reaching this decision: (1) the location of the damages provision vis-à-vis the prohibitions in subsections (b), (d), and (e); and (2) the absence of injury in the event that a video tape service provider fails to timely destroy consumers’ personally identifiable information as required by subsection (e).