Data Security Breach Litigation Post-Spokeo

California enacted the nation’s first data security breach notification law 15 years ago. Following a few high-profile incidents in 2005, other states rapidly began enacting breach-notice requirements based largely on the California model. 

This proliferation of laws — and the constant news of security incidents — led many to predict a significant increase in data security breach litigation.

While nearly every jurisdiction in the U.S. has adopted similar breach notification laws, there has not been a tidal wave of successful private litigation relating to data security breaches. Why? To this point the reason is, in a word, standing. Standing is a prerequisite to bringing a lawsuit in federal court. It derives from Article III of the U.S. Constitution.

To this point the reason is, in a word, standing. Standing is a prerequisite to bringing a lawsuit in federal court. It derives from Article III of the U.S. Constitution.

Originally published in Westlaw Journal; reprinted with permission.