# In Re Horizon Healthcare Services Inc. Data Breach Litigation

> Court of Appeals for the Third Circuit · January 20, 2017 · 846 F.3d 625

URL: https://www.frixlaw.com/law-library/cases/9871433

## Case

- **Full name:** In RE: HORIZON HEALTHCARE SERVICES INC. DATA BREACH LITIGATION Courtney Diana; Mark Meisel; Karen Pekelney; Mitchell Rindner, Appellants
- **Court:** Court of Appeals for the Third Circuit
- **Decided:** January 20, 2017
- **Citations:** 846 F.3d 625; 2017 WL 242554
- **Precedential status:** Published
- **Opinion:** Concurrence by Shwartz
- **Judges:** Jordan, Vanaskie, Shwartz
- **Cited by:** 341 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/9871433

## How later opinions describe it (automated extraction)

- concluding that Spokeo did not intend to change the traditional standard of establishing standing, observing that there may be instances where a mere procedural violation does not establish an injury in fact, but concluding that that issue was not before the court because plai…
- finding a movant “brought only a facial challenge”—rather than a factual challenge—where the movant “did not challenge the validity of any of the... factual claims as part of its motion” and “argues that the allegations ..., even accepted as true, are insufficient to establish…
- concluding that in the Fair Credit Reporting Act, "Congress properly defined an injury that 'give[s] rise to a case or - 9 - controversy where none existed before'": the "unauthorized dissemination of [the plaintiffs'] own private information" (quoting Spokeo, 136 S. Ct. at 15…
- stating that “procedural" violation of FCRA might not confer standing under Spok-eo, but that the plaintiffs had pled a substantive privacy breach where lax procedures had permitted the theft of laptops containing private information
- noting that the “particularization requirement” of standing requires more than a plaintiff pleading “generalized grievances”

## Opinion text

SHWARTZ, Circuit Judge,
concurring in the judgment.
I agree with my colleagues that Plaintiffs have standing, but I reach this conclusion for different reasons. In short, Plaintiffs allege that the theft of the laptops caused a loss of privacy, which is itself an injury in fact. Thus, regardless of whether a violation of a statute itself constitutes an injury in fact, and mindful that under our precedent, a risk of identity theft or fraud is too speculative to constitute an injury in fact, see Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), Plaintiffs have nonetheless alleged an injury in fact sufficient to give them standing.
I
As my colleagues have explained, Horizon Healthcare Services provides insurance to individuals in New Jersey. Horizon obtains personally identifiable information (“PH”), including names, dates of birth, and social security numbers, as well as protected health information (“PHI”), such as medical histories and test results, from its insureds. This information is viewed as private and those in possession of it are required to ensure that it is kept secure and used only for proper purposes.
PII and PHI were stored on laptop computers kept at Horizon’s Newark, New Jersey headquarters. In January, November, and December 2008, as well as April and November 2013, laptop computers were stolen. The laptop computers stolen in November 2013 were cable-locked to workstations and password-protected, but the contents, which included the PII/PHI of 839,000 people, were not encrypted. 1 Plaintiffs assert this theft places them at *642 risk of future identity theft and fraud, and subjected them to a loss of privacy, in violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq. (“FCRA”), and various state laws. The District Court concluded that Plaintiffs lack standing to bring a claim under the FCRA because the pleadings failed to allege any plaintiff suffered an injury in fact. 2
II
As my colleagues accurately state, there are three elements of Article III standing: (1) injury in fact, or “an invasion of a legally protected interest” that is “concrete and particularized”; (2) traceability, that is a “causal connection between the injury and the conduct complained of’; and (3) redressability, meaning a likelihood “that the injury will be redressed by a favorable decision.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 , 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992).
The injury-in-fact element most often determines standing. See Spokeo, Inc, v. Robins, — U.S. -, 136 S.Ct. 1540, 1547 , 194 L.Ed.2d 635 (2016). Such injury must be particularized and concrete. Id. at 1548 . “For an injury to be particularized, it must affect the plaintiff in a personal and individual way.” Id. (internal quotation marks and citation omitted). To be “concrete,” an injury must be “real” as opposed to “abstract,” but it need not be “tangible.” Id. at 1548-49 .
As my colleagues eloquently explain, the Spokeo Court identified two approaches for determining whether an intangible injury is sufficient to constitute an injury in fact. Maj. Op. at 637 (citing Spokeo, 136 S.Ct. at 1549 ). Under the first approach, a court considers history and asks whether the intangible harm is closely related “to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id. at 1549 ; Maj. Op. at 637. If so, “it is likely sufficient to satisfy the injury-in-fact element of standing.” Maj. Op. at 637 (citing Spokeo, 136 S.Ct. at 1549 ). Under the second approach, a court considers whether Congress has “expressed an intent to make an injury redressable.” Maj. Op. at 637. My colleagues rely on this latter approach, but I rely on the former.
The common law has historically recognized torts based upon invasions of privacy and permitted such claims to proceed even in the absence of proof of actual damages. See, e.g., Pichler v. UNITE, 542 F.3d 380, 399 (3d Cir. 2008) (citing Doe v. Chao, 540 U.S. 614 , 621 n.3, 124 S.Ct. 1204 , 157 L.Ed.2d 1122 (2004)); Restatement (Second) Torts § 652A (2016) (stating that “[o]ne who invades the right of privacy of another is subject to liability for the resulting harm to the interest of the other”). While Plaintiffs do not allege that the laptop thieves looked at or used their PII and PHI, Plaintiffs lost their privacy once it got into the hands of those not intended to have it. Cf. United States v. Westinghouse Elec. Corp„ 638 F.2d 570 , 577 n.5 (3d Cir. 1980) (observing that “[pjrivacy ... is control over knowledge about oneself’ (citation omitted)). While this may or may not be sufficient to state a claim for relief under Fed. R. Civ. P. 12(b)(6), Maj. Op. at 639, the intangible harm from the loss of privacy appears to have sufficient historical roots to satisfy the requirement that Plaintiffs have alleged a sufficiently concrete harm for standing purposes.
Our Court has embraced the view that an invasion of privacy provides a basis for *643 standing. In In re Google Cookie Placement Consumer Privacy Litigation, 806 F.3d 126 (3d Cir. 2015), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), Google and Nickelodeon were alleged to have invaded the plaintiffs’ privacy by placing cookies into the plaintiffs’ computers, which allowed the companies to monitor the plaintiffs’ computer activities. In these cases, the injury was invasion of privacy and not economic loss, and thus the standing analysis focused on a loss of privacy. 3 In re Nickelodeon, 827 F.3d at 272-73 ; In re Google, 806 F.3d at 134. Although the perpetrators of the invasion of privacy here are the laptop thieves and in Google and Nickelodeon the invaders were the defendants themselves, the injury was the same: a loss of privacy. Thus, those cases provide a basis for concluding Plaintiffs here have suffered an injury in fact based on the loss of privacy. 4
Ill
While I have concluded that Plaintiffs have alleged an injury in fact by asserting that they sustained a loss of privacy, the other grounds that Plaintiffs rely upon are unavailing. Although this is not necessary for my analysis, I offer these observations to help explain the types of “injuries” that are not sufficient to provide standing in the context of data thefts. First, under our precedent, the increased risk of identity theft or fraud due to a data breach, without more, does not establish the kind of imminent or substantial risk required to establish standing. See Reilly, 664 F.3d at 42 . Like in Reilly, the feared economic injury here depends on a speculative chain of events beginning with an assumption that the thief knew or discovered that the laptop contained valuable information, that the thief was able to access the data despite the password protection, and that the thief opted to use the data maliciously. 5 See Reilly, 664 F.3d at 42 ; see also Clapper v. Amnesty Int’l USA, — U.S.—, 133 S.Ct. 1138 , 1160 n.5, 185 L.Ed.2d 264 (2013). Second, Reilly and Clapper have rejected Plaintiffs’ assertion that standing exists because they expended time and money to monitor for misuse of their information. The Clapper Court reasoned that a plaintiff cannot “manufacture” standing by choosing to undertake burdens or “make expenditures” based on a “hypothetical future harm” that does not itself qualify as an injury in fact. Clapper, 133 S.Ct. at 1050-51 ; see also Reilly, 664 F.3d at 46 (rejecting a claim for standing based upon *644 “expenditures to monitor their financial information ... because costs incurred to watch for a speculative chain of future events based on hypothetical future criminal acts are no more ‘actual’ injuries than the alleged ‘increased risk of injury’ which forms the basis for Appellants’ claims”). 6 The Supreme Court observed that to conclude otherwise would have problematic implications, as “an enterprising plaintiff would be able to secure a lower standard for Article III standing simply by making an expenditure based on a nonparanoid fear.” Clapper, 133 S.Ct. at 1151 . Third, courts have rejected claims of standing based on assertions that plaintiffs suffered economic harm by paying insurance premiums that allegedly included additional fees for measures to secure PII/PHI, but such measures were not implemented. See, e.g., Remijas v. Neiman Marcus, 794 F.3d 688, 694-95 (7th Cir. 2015) (describing this type of overpayment theory as “problematic” and suggesting that such a theory is limited to the products liability context); Katz v. Pershing, LLC, 672 F.3d 64, 77-78 (1st Cir. 2012) (holding that the “bare hypothesis” that brokerage fees were artificially inflated to cover security measures was implausible); In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F.Supp.3d 14, 30 (D.D.C. 2014) (rejecting the overpayment theory since the plaintiffs had paid for health insurance and did not allege that they were denied such coverage or services). 7 Accordingly, none of these grounds provides a basis for standing in a data theft case like we have here.
IV
For these reasons, I concur in the judgment.
. My colleagues infer that these thefts were committed to obtain the PII/PHI. Maj. Op. at 639 n.19. I would not necessarily draw that inference. Plaintiffs do not allege that any of the 839,000 individuals whose information was stored on the laptop computers, or on the laptop computers taken in the earlier thefts, suffered any loss or that their identities were misused. Given the number of laptop computer thefts, and the absence of any allegation of a loss tied to their contents, it is at least equally reasonable to infer that the laptop computers were taken for their hardware, not their contents. I acknowledge, however, that we are to draw a reasonable inference in Plaintiffs’ favor in the context of a facial challenge pursuant to a Rule 12(b)(1) motion. See Petruska v. Gannon Univ., 462 F.3d 294 , 299 n.1 (3d Cir. 2006) ("[T]he standard is the same when considering a facial attack under Rule 12(b)(1) or a motion to dismiss for failure to state a claim under Rule 12(b)(6).”); Mortensen v. First Fed. Sav. & Loan Ass'n, 549 F.2d 884 , 891 (3d Cir. 1977) (explaining that Rule 12(b)(6) safeguards apply to facial attacks under Rule 12(b)(1) and provide that plaintiffs’ allegations are taken as true and all inferences are drawn in plaintiffs' favor).
. The District Court declined to exercise supplemental jurisdiction over the state law claims.
, My colleagues view In re Google Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), as providing a basis for Plaintiffs to assert that a violation of the FCRA, without any resulting harm, satisfies the injury-in-fact requirement. I do not rely on the possible existence of a statutory violation as the basis for standing, and am not persuaded that these cases support that particular point.
. I also conclude that Plaintiffs have sufficiently alleged that the injury was traceable, in part, to the failure to encrypt the data, and am satisfied that if proven, the injury could be redressable.
.As noted earlier, my colleagues rely on the second approach, finding standing based upon a statutory violation. The alleged statutory violation here, however, creates only an increased risk of future harm. Although Spok-eo says that a violation of a statute can provide standing, Spokeo, 136 S.Ct. at 1549-50 , standing still requires a showing of a concrete, particularized, nonspeculative injury in fact and, under Reilly, the link between the theft here and the risk of future harm requires too much supposition to satisfy Article III standing, Reilly, 664 F.3d at 42 ; see also Clapper, 133 S.Ct. at 1148-50 .
. Plaintiffs also assert in a conclusory fashion that, "as a result of the Data Breach,” plaintiff Mitchell Rindner was the victim of identity theft. While Plaintiffs allege that a false tax return was submitted to the Internal Revenue Service bearing Mr. Rindner’s and his wife’s names, and that someone used his credit card, the factual allegations do not show that these events were tied to theft. First, the Amended Complaint does not allege that any of Mrs. Rindner’s PII/PHI was included in the stolen data. Second, there is no allegation that the stolen data contained Mr. Rindner's credit card information. This leads to "[t]he inescapable conclusion ... that [Rindner] has been subjected to another ... data breach involving his financial ... records.” In re Sci, Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F.Supp.3d 14, 32 (D.D.C. 2014). Because Plaintiffs do not plausibly plead that this injury was "fairly traceable” to Horizon’s alleged failure to adequately guard Plaintiffs’ data, this particular injury fails to provide standing for a claim against Horizon. See Lujan, 504 U.S. at 560-61 , 112 S.Ct. 2130 .
. Plaintiffs identify two cases to support their overpayment theory: Resnick v. AvMed, Inc., 693 F.3d 1317, 1328 (11th Cir. 2012), and In re Insurance Brokerage Antitrust Litigation, 579 F.3d 241, 264 (3d Cir. 2009). Neither supports their position. Resnick's endorsement of an overpayment theory occurred only in the context of a Fed. R. Civ. P. 12(b)(6) motion to dismiss the claim for unjust enrichment, and was not used to support standing. 698 F.3d at 1323. In re Insurance Brokerage involved a kickback scheme that artificially inflated premiums. 579 F.3d at 264 . Here, Plaintiffs do not allege that the premiums they paid were artificially inflated because funds that were to be used for securing their data were not used for that purpose, nor do they allege that their premiums would otherwise have been cheaper.

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/9871433. Public record. Not legal advice.