Massachusetts Dismisses Pharmacy Data Breach Class Action
District of Massachusetts Dismisses Data Breach Class Action for Lack of Injury
Wednesday, November 16, 2022
On October 18, 2022, in Webb v. Injured Workers Pharmacy, LLC, the District of Massachusetts dismissed a class action complaint brought by former pharmacy patients alleging that their sensitive personal information had been exposed in a data breach affecting more than 75,000 customers. In its analysis, the court determined that the named plaintiffs and putative class members could not satisfy the injury-in-fact requirement for constitutional standing. Plaintiffs Webb and Charley had claimed the breach caused “anxiety, sleep disruption, stress, and fear” and cost them “considerable time and effort” monitoring their accounts.
The court rejected these factual allegations as an insufficient basis to confer constitutional standing under Article III:
The Complaint does not sufficiently allege that the breach caused any identifiable harm. It is only alleged that Webb and Charley spent “considerable time and effort” monitoring their accounts and, in Webb’s case, dealing with the IRS. Plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on … hypothetical future harm.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). The Complaint alleges neither monetary loss, the misuse of data, nor that a third party stole their PII. Plaintiffs’ alleged injuries rest entirely on the future possibility that an unauthorized third party will, at some undetermined time, misuse their PII. Based on the facts of the Complaint, this potential harm is not sufficiently threatening to establish an “injury in fact.” Katz, 672 F3.d at 71.
In footnotes, the court noted that Webb had not made a “plausible connection between the data breach and the filing of the [tax] return” filed by an unknown and unauthorized third-party and rejected a theory that plaintiffs were harmed by the loss of their personal information’s “black market value.”
The court’s decision is especially notable in that it comes on the heels of the First Circuit’s recent decision in Laufer v. Acheson Hotels LLC, which overturned the dismissal of and thus revived a class action on standing grounds based on the dignitary harm caused by website accessibility barriers. As discussed in a prior post on informational injury, the First Circuit rejected the lower court’s reasoning, holding that “[d]ignitary harm or stigmatic injuries caused by discrimination have long been held a concrete injury in fact.”
It remains to be seen whether Webb, like Laufer, will make its way to the First Circuit docket and, if so, how the First Circuit will apply its recent logic from Laufer to the data breach context. Of particular interest would be the First Circuit’s analysis of the alleged informational injury that occurred when, according to the allegations set forth in the complaint, the “Defendant breached its duties by failing to provide reasonably timely notice of the Data breach to Plaintiffs and members of the Class.” Regardless of whether an appeal proceeds in Webb, there will certainly be more occasions for the First Circuit to consider the limits of constitutional standing in the aftermath of the Supreme Court’s ruling in TransUnion LLC v. Ramirez.
Wednesday, November 16, 2022
On October 18, 2022, in Webb v. Injured Workers Pharmacy, LLC, the District of Massachusetts dismissed a class action complaint brought by former pharmacy patients alleging that their sensitive personal information had been exposed in a data breach affecting more than 75,000 customers. In its analysis, the court determined that the named plaintiffs and putative class members could not satisfy the injury-in-fact requirement for constitutional standing. Plaintiffs Webb and Charley had claimed the breach caused “anxiety, sleep disruption, stress, and fear” and cost them “considerable time and effort” monitoring their accounts.
The court rejected these factual allegations as an insufficient basis to confer constitutional standing under Article III:
The Complaint does not sufficiently allege that the breach caused any identifiable harm. It is only alleged that Webb and Charley spent “considerable time and effort” monitoring their accounts and, in Webb’s case, dealing with the IRS. Plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on … hypothetical future harm.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). The Complaint alleges neither monetary loss, the misuse of data, nor that a third party stole their PII. Plaintiffs’ alleged injuries rest entirely on the future possibility that an unauthorized third party will, at some undetermined time, misuse their PII. Based on the facts of the Complaint, this potential harm is not sufficiently threatening to establish an “injury in fact.” Katz, 672 F3.d at 71.
In footnotes, the court noted that Webb had not made a “plausible connection between the data breach and the filing of the [tax] return” filed by an unknown and unauthorized third-party and rejected a theory that plaintiffs were harmed by the loss of their personal information’s “black market value.”
The court’s decision is especially notable in that it comes on the heels of the First Circuit’s recent decision in Laufer v. Acheson Hotels LLC, which overturned the dismissal of and thus revived a class action on standing grounds based on the dignitary harm caused by website accessibility barriers. As discussed in a prior post on informational injury, the First Circuit rejected the lower court’s reasoning, holding that “[d]ignitary harm or stigmatic injuries caused by discrimination have long been held a concrete injury in fact.”
It remains to be seen whether Webb, like Laufer, will make its way to the First Circuit docket and, if so, how the First Circuit will apply its recent logic from Laufer to the data breach context. Of particular interest would be the First Circuit’s analysis of the alleged informational injury that occurred when, according to the allegations set forth in the complaint, the “Defendant breached its duties by failing to provide reasonably timely notice of the Data breach to Plaintiffs and members of the Class.” Regardless of whether an appeal proceeds in Webb, there will certainly be more occasions for the First Circuit to consider the limits of constitutional standing in the aftermath of the Supreme Court’s ruling in TransUnion LLC v. Ramirez.
