American Bar Association
Media Alerts
Media Alerts - In re: Horizon Healthcare Services Inc. Data Breach Litigation - Third Circuit
Decrease font size
Increase font size
January 27, 2017
  In re: Horizon Healthcare Services Inc. Data Breach Litigation - Third Circuit
Headline: Third Circuit Holds that Consumers Who Have Their Personal Data Stolen Can Sue for a Violation of the Fair Credit Reporting Act Even if They Cannot Show the Data Has Been Improperly Used

Area of Law: Civil Procedure

Issues Presented: Whether Plaintiffs' alleged injury of improper disclosure of personal information is sufficient to satisfy Article III standing (injury in fact), without additional injury.

Brief Summary: On the weekend of November 1 - 3, 2013, two unencrypted laptops were stolen from the headquarters of Horizon Healthcare Services, Inc. The stolen laptops contained personal identifying information and personal health information for 839,000 of Horizon's customers. After being notified of the theft, Plaintiffs (Horizon customers whose personal information was contained on the stolen laptops) filed this class action in district court against Horizon, for violation of the Fair Credit Reporting Act's (FCRA) consumer privacy requirements. The District Court ultimately dismissed Plaintiff's claim, concluding that Plaintiffs' lacked Article III standing since they had not shown that the stolen information had been used to their detriment. On appeal, the Third Circuit relied on precedent to support the proposition that the unlawful disclosure of legally protected information was a recognizable injury in itself, even if the information was never used improperly. The Court then analyzed Congress' intent regarding FCRA violations to address defendant's claim that a recent Supreme Court case, Spokeo, Inc. v. Robins, required a different result The Court concluded that "Congress believed that the violation of FCRA causes a concrete harm to consumers." Thus, the Third Circuit held that both "precedent and congressional action lead [to the conclusion] that the improper disclosure of one's personal data in violation of FCRA is a cognizable injury for Article III standing purposes." Therefore, the Court vacated the District Court's order of dismissal and remanded the matter for further proceedings consistent with the opinion. Judge Shwartz concurred in the judgment.

Extended Summary: This case concerns a class action against a health insurer, Horizon Healthcare Services, Inc., by Horizon customers. The dispute originated on the weekend of November 1 - 3, 2013, when two unencrypted laptops, containing personal information for more than 839,000 Horizon members, were stolen from Horizon's headquarters. Horizon was made aware of the theft the following day, and alerted "potentially affected members" through a press release and letters a month later. As a result of the theft of personal information (including names, dates of birth, social security numbers, and addresses), Plaintiffs filed this action on June 27, 2014, and alleged that Horizon had committed violations of the Fair Credit Reporting Act (FCRA) as well as various state laws.

FCRA was enacted "to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy." FCRA imposes requirements on any "consumer reporting agency" in order to protect consumer privacy. FCRA further ensures that "any such agency that either willfully or negligently 'fails to comply with any requirement imposed under [FCRA] with respect to any consumer is liable to that consumer."

Plaintiffs alleged that Horizon failed to adequately comply with FCRA requirements. Plaintiffs specifically alleged that Horizon furnished their information in an "unauthorized fashion allowing it to fall into the hands of thieves," and failed to maintain "reasonable procedures" to keep their personal information confidential. Horizon moved to dismiss for, among other things, failing to establish standing under Federal Rule of Civil Procedure 12(b)(1. The District Court granted Horizon's FRCP 12(b)(1) motion, concluding that Plaintiff's lacked Article III standing because they had not shown that the stolen information had been used to their detriment.

The Third Circuit characterized the FRCP 12(b)(1) challenge as a "facial" attack, and thus applied the same standard of review as when the Court reviews a motion to dismiss under FRCP 12(b)(6). Thus, the Court noted that they accepted "the Plaintiff's well-pleased factual allegations as true and [drew] all reasonable inferences from those allegations in the Plaintiff's favor."

The Third Circuit began its analysis by noting the three elements of Article III standing, including injury in fact, a causal connection between the injury and the conduct complained of, and that the injury will be redressed by a favorable decision. Here, the Court noted that the sole element at issue was the first element described, injury in fact. Plaintiffs claimed that "the violation of their statutory right to have their personal information secured against unauthorized disclosure constitutes, in and of itself, an injury in fact." In rejecting this argument, the district court had stated that a showing of standing must include a specific harm that goes beyond "mere violations of statutory and common law rights."

After noting that injury-in-fact determinations are "very generous," the Court proceeded to analyze the Plaintiffs' claim in light of recent Court decisions. The Court relied on a pair of recent Third Circuit decisions, both which allowed "individuals to sue to remedy violations of their statutory rights, even without additional injury. First, the Court discussed In re Google Inc. Cookie Placement Consumer Privacy Litigation, which held that "the actual or threatened injury required by Article III may exist solely by virtue of statutes creating legal rights, the invasion of which creates standing." Similarly, the Court next relied on In re Nickelodeon Consumer Privacy Ligation, holding that "'the unlawful disclosure of legally protected information' constituted 'a clear de facto injury." However, the Court then turned its attention to a recent Supreme Court decision, Spokeo, Inc. v. Robins (2016), which Horizon had relied on, arguing it necessitated the opposite outcome. However, the Third Circuit disagreed, and instead noted that Spokeo stood for the proposition that "Congress has the power to define injuries" and thus this analysis must include a determination of "whether Congress has expressed an intent to make an injury redressable." The Third Circuit further noted that it would not interpret the Spokeo decision to "erect new barriers that might prevent Congress from identifying new causes of action though they may be based on intangible harm." Instead, the Third Circuit read Spokeo to "reiterate traditional notions of standing."

Finally, the Third Circuit addressed the issue of Congress' intent. The Court concluded that by creating a private right of action in order to enforce the requirements of the FCRA, Congress illustrated that it "believed that the violation of FCRA causes a concrete harm to consumers." Therefore, because Plaintiffs alleged the unauthorized disclosure of their personal information, they have alleged the "very injury that FCRA is intended to prevent." The Third Circuit thus held that Plaintiffs' allegations constitute a "de facto injury" sufficient to satisfy the requirements of Article III standing: "Our precedent and congressional action lead us to conclude that the improper disclosure of one's personal data in violation of FCRA is a cognizable injury for Article III standing purposes." Based on this holding, the Court vacated the District Court's order of dismissal and remanded the matter for further proceedings consistent with the opinion.

Judge Shawtz wrote separately concurring in the judgment, but based this conclusion on a different analysis. The concurrence framed the issue of injury as a loss of privacy, which occurred as soon as the laptops were stolen. Judge Shwartz stated, "Plaintiffs here have suffered an injury in fact based on the loss of privacy," which injury provided the necessary standing to bring this case.
To read the full opinion, please visit http://www2.ca3.uscourts.gov/opinarch/152309p.pdf

Panel: Jordan, Vanaskie, and Shwartz, Circuit Judges

Argument Date: July 12, 2016

Date of Issued Opinion: January 20, 2017

Docket Number: No. 15-2309

Decided: Vacated and remanded

Case Alert Author: Tessa M. Carson

Counsel: Ben Barnow, Erich P. Schork, Joseph J. DePalma, Jeffrey A. Shooman, Robert N. Kaplan, David A. Straite, Laurence D. King, Philip A. Tortoreti, Counsel for Appellants; Kenneth L. Chernof, David Jay, Philip R. Sellinger Greenberg Traurig Counsel for Appellee.

Author of Opinion: Judge Jordan

Circuit: Third Circuit

Case Alert Supervisor: Professor Mark Anderson

    Posted By: Susan DeJarnatt @ 01/27/2017 12:57 PM     3rd Circuit  

FuseTalk Enterprise Edition - © 1999-2018 FuseTalk Inc. All rights reserved.

Discussion Board Usage Agreement

Back to Top