E-Alert Case Updates

Speculative Future Harm Won’t Stand: Fourth Circuit Affirms Dismissal for Lack of Standing of Appellants’ Claims Resulting from Compromised Medical Information

Watson v. McDonald
No. 15-1715 (4th Cir. Feb. 6, 2017). United States Court of Appeals for the Fourth Circuit
by Matthew S. Sarna, Law Clerk
Semmes, Bowen & Semmes (www.semmes.com)

Available at:
https://www.gpo.gov/fdsys/pkg/USCOURTS-ca4-15-01715/pdf/USCOURTS-ca4-15-01715-0.pdf

In Watson v. McDonald, No. 15-1715 (4th Cir. Feb. 6, 2017), the United States Court of Appeals for the Fourth Circuit affirmed the district court’s dismissal for lack of standing of Appellants’ claim of harm from increased risk of future identity theft after their personal medical information had been compromised.

This consolidated appeal arose from two distinct acts of theft of the William Jennings Bryan Dorn Veterans Affairs Medical Center (“Dorn VAMC”) in Columbia, South Carolina. In the first instance, on February 11, 2013, a laptop containing unencrypted personal information of approximately 7,400 patients was stolen from Dorn VAMC’s Respiratory Therapy department (the “Beck Case”). After determining that the laptop had in fact been stolen, Dorn VAMC officials notified every patient tested using the laptop and offered one free year of credit monitoring. In the second instance, in July 2014, Dorn VAMC discovered that four boxes of pathology reports, containing the identifying information of over 2,000 patients had been stolen (the “Watson Case”). Again, Dorn VAMC official notified those affected and offered a free year of credit monitoring.

The Becks filed suit on behalf of the 7,400 effected patients, seeking declaratory relief and monetary damages under the Privacy Act of 1974, 5 U.S.C. § 522a (“Privacy Act”) for the “embarrassment, inconvenience, unfairness, mental distress, and the threat of current and future substantial harm from identity theft and other misuse of their Personal Information.” The Becks also sought broad injunctive relief under the Administrative Procedure Act, 5 U.S.C. § 701 (“APA”), requiring the VA to account for all Privacy Act records in Dorn VAMC’s possession and recover and destroy any improperly maintained records.

The Defendants moved for dismissal based on a lack of Article III standing, alleging that the Becks had “not submitted evidence sufficient to create a genuine issue of material fact as to whether they face[d] a ‘certainly impending’ risk of identity theft.” Watson, No. 15-1395, at *5. The Defendants relied heavily on Clapper v. Amnesty International USA, 133 S. Ct. 1138, 1148 (2013) (denying standing because the harm was too speculative and “contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendants.”

The Defendants similarly moved for and were granted dismissal in the Watson Case for lack of Article III standing. According to the district court, for Watson to suffer the feared injury, the court would have to assume: (1) the boxes were stolen by someone with mal-intent towards the personal information; (2) the thief would select this individual report; (3) the thief would attempt to sell the personal information; and (4) the thief or purchaser would successfully use the information to steal Watson’s identity. This attenuation was too big a pill for the district court to swallow.

On Appeal, the Fourth Circuit set the table by examining the minimum requirements for Article III standing: injury-in-fact, causation, and redressability. Focusing first on injury-in-fact, the Court stated that a plaintiff must show he or she suffered “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). While threatened injuries can constitute injury-in-fact, they cannot be overly speculative.

Exploring the theory of threatened injuries, the Fourth Circuit conducted an in-depth analysis of Clapper. In Clapper, attorneys, human-rights, labor, legal, and media organizations claimed that the Foreign Intelligence Surveillance Act of 1978 (“FISA”) impeded their ability to “locate witnesses, cultivate sources, obtain information, and communicate confidential information,” and that they had to take “costly and burdensome measures” to protect their confidentiality. Clapper, 133 S. Ct. at 1145–46. First, the Court determined that the respondents’ standing theory was too attenuated and could not “satisfy the requirement that threatened injury must be certainly impending.” Id. at 1148 (emphasis added). Second, the Court did not indulge the respondents’ claim for costly and burdensome measures, and would not allow the respondents to “manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Id. at 1151.

Despite the fact that several sister circuits, namely the Sixth, Seventh, and Ninth Circuits, have all recognized threatened injury as establishing injury-in-fact at the pleading stage, the Fourth Circuit was able to distinguish sufficiently the facts of each of the respective cases from the case at hand. See, e.g., Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692, 694–95 (7th Cir. 2015) (plaintiff-customers’ increased risk of future fraudulent charges and identity theft theory established “certainly impending” injury-in-fact). Underlying in each of these sister circuit cases were allegations that “sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent.” Watson, No. 15-1395, at *18.

In this case, the Court noted that there had been no evidence uncovered that the stolen laptop in the Beck Case had been misused or resulted in any identity theft, or that the laptop was stolen with the intent to steal private information. The Watson Case facts suffered from the same deficiency. Accordingly, and unlike the heightened allegations in the previously discussed cases, the Appellants’ “attenuated chain” could not confer standing.

Not stopping its inquiry there, the Court also explored whether the Appellants had standing based on a “substantial risk” that harm would occur. The Appellants had alleged that: 33% of health-related data breaches results in identify theft; the Defendants expend substantial funds to avoid and mitigate those risks; and the offering of one free year of credit monitoring constituted a concession that the thefts created a “reasonable risk of harm” to the victims. Addressing the first, the Court simply analogized these allegations with several other cases, concluding that the risk was not substantial enough to constitute standing.

As to the cost of mitigative measures, the Court cited to prior case law and bolstered its public policy position that, if the Court adopted such a presumption of guilt through future assistance, this presumption would “surely discourage organizations from offering these services to data-breach victims, lest their extension of goodwill render them subject to suit.” Watson, No. 1395, at *22. Accordingly the Court found that the risk of harm was not substantial enough as to confer standing, and affirmed the judgments of the district court.