American Bar Association
Media Alerts
Media Alerts - Beck v. McDonald -- Fourth Circuit
Decrease font size
Increase font size
March 16, 2017
  Beck v. McDonald -- Fourth Circuit
"That Alone Is Not Enough" -- Fourth Circuit Takes Stand on Standing in Data Breach Case

Areas of Law: Civil Procedure, Constitutional Law

Issue Presented: Whether a plaintiff can establish an Article III injury-in-fact based on an increased risk of identity theft.

Brief Summary: In consolidated appeals from two class action suits alleging injury from a data breach, the United States Court of Appeals for the Fourth Circuit affirmed the dismissal of the cases for lack of subject matter jurisdiction. The Plaintiffs alleged they had been harmed by the William Jennings Bryan Dorn Veterans Affairs Medical Center's ("Dorn VAMC") loss of a laptop and files containing patients' medical records and personal information. The court found the alleged harm was too speculative and hypothetical to establish the "certainly impending" injury-in-fact that is required for standing. The Fourth Circuit also rejected the Plaintiffs' argument that standing existed based on the "substantial risk" that harm will occur as a result of the data breach. With regard to this argument, the court refused to infer that such a risk existed when an organization offers remedial free credit monitoring services.

Extended Summary: This case arose from consolidated appeals from two class actions (Beck v. McDonald and Watson v. McDonald) filed by veterans who received medical treatment and health care at the Dorn VAMC. The Plaintiffs sought money damages and declaratory and injunctive relief under the Privacy Act of 1974 ("Privacy Act") and the Administrative Procedures Act ("APA").

In both cases, the Plaintiffs attempted to establish standing and sufficient injury-in-fact based on the potential damages that could arise from the VAMC's loss of information. In the first class action suit, filed by Richard Beck and Lakreshia Jeffery, the Plaintiff's claims were based on the loss of a laptop computer containing unencrypted, confidential patient information of 7,400 patients. While the Beck litigation was still pending, Beverly Watson brought a class action lawsuit on behalf of the over 2000 individuals whose medical files were lost or stolen while being transported to a long term storage facility. The laptop contained patient's names, birth dates, the last four digits of social security numbers and physical descriptions. The files contained patient's names, full social security numbers, and medical diagnoses. Both the computer and the files have never been recovered and all parties affected by the loss of the data were offered one year of free credit monitoring.

In both cases, the Plaintiffs attempted to establish standing and injury-in-fact by arguing that the loss of information by the Dorn VAMC violated the Privacy Act, and caused Plaintiffs "embarrassment, inconvenience, unfairness, mental distress, and the threat of current and future substantial harm from identity theft and other misuse." Additionally, Plaintiffs argued that the risk of identity theft required them to frequently monitor their credit reports, bank statements, health insurance reports, purchase credit watch services, and shift financial accounts.

In Beck, the district court denied the Defendant's' initial motion to dismiss so the Plaintiff could conduct discovery. After discovery concluded, the Defendants again made a motion to dismiss, which was granted. In granting the motion, the district court found that the Plaintiffs had not submitted enough evidence to establish an issue of material fact that they faced a "certainly impending" risk of identity theft. In Watson, the district court did not even allow for discovery, and granted the Defendant's motion to dismiss.

On appeal, the United States Court of Appeals for the Fourth Circuit affirmed the dismissal of both cases for lack of subject matter jurisdiction. The court held that the Plaintiffs' alleged harm was too speculative and hypothetical to establish "certainly impending" injury-in-fact. In dismissing both cases, the Fourth Circuit noted that in other circuits where plaintiffs can establish injury-in-fact based on an increased risk of future identity theft, the plaintiff also alleged that "the data thief intentionally targeted the personal information comprised in the data breaches."

The Fourth Circuit also rejected the Plaintiffs' argument that they had standing based on a "substantial risk" that harm will occur. The Plaintiffs argued there was a substantial risk that harm would occur because generally 33% of health related data breaches result in identity theft. The Fourth Circuit, however, found that if that general point was true, than 66% of the veterans impacted by the breach would suffer no harm at all. The Fourth Circuit also declined to infer a substantial risk of harm exists if an organization offers free credit monitoring services, because that inference would discourage organizations from offering assistance. Finally, the Fourth Circuit found that the Plaintiffs did not suffer an injury-in-fact because they incurred a cost to protect against speculative threat because "self-imposed harms can not confer standing."

Finally, in denying the Plaintiffs injunctive relief request, the Fourth Circuit found that the Plaintiffs did not have standing under the APA. This was because allegations of the Dorn VAMC's past Privacy Act violations only demonstrated that the Plaintiffs could be victimized by a future data breach, not that there is an immediate danger that they will be victimized by a future data breach.

To read the full opinion, click here.

Panel: Judges Niemeyer and Diaz, and District Judge Keeley

Argument Date: 9/20/2016

Date of Issued Opinion: 2/6/2017

Docket Numbers: No. 15-1395

Decided: Affirmed by published opinion

Case Alert Author: Fernando Kirkman, Univ. of Maryland Carey School of Law

Counsel: ARGUED: Douglas J. Rosinski, Columbia, South Carolina, for Appellants. Sonia Katherine McNeil, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Appellees. ON BRIEF: D. Michael Kelly, Bradley D. Hewett, MIKE KELLY LAW GROUP, LLC, Columbia, South Carolina, for Appellants. Benjamin C. Mizer, Principal Deputy Assistant Attorney General, Mark B. Stern, Civil Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; William N. Nettles, United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Columbia, South Carolina, for Appellees.

Author of Opinion: Judge Diaz

Case Alert Supervisor: Professor Renée Hutchins

    Posted By: Renee Hutchins @ 03/16/2017 01:40 PM     4th Circuit  

FuseTalk Enterprise Edition - © 1999-2018 FuseTalk Inc. All rights reserved.

Discussion Board Usage Agreement

Back to Top