Data Breach Class Action: Standing, Class Certification, and Liability

Every state now has a breach notification law requiring companies to notify affected individuals and, in most states, regulators after a breach is discovered. Timing requirements and covered data categories vary by state. That notice triggers the plaintiffs' litigation timeline. Attorneys review the company's security practices, the scope of compromised data, and prior incidents before filing.

Large breaches affecting millions of individuals typically generate dozens of parallel lawsuits in multiple federal districts. The Judicial Panel on Multidistrict Litigation may transfer these cases to a single district for coordinated pretrial proceedings under 28 USC § 1407. MDL consolidation reduces duplicative discovery and produces a single framework for settlement negotiations. The MOVEit breach in 2023, for example, was consolidated into MDL 3083 in the District of Massachusetts, involving hundreds of affected organizations.

The primary defendant is usually the company that suffered the breach. Third-party vendors whose software or systems were the point of entry are increasingly named as co-defendants. In healthcare breaches, covered entities and their business associates may both face negligence claims in state court even though HIPAA itself does not create a private right of action.

In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court held that each class member must demonstrate a concrete harm bearing a close relationship to a traditionally recognized harm at common law. The decision arose from an FCRA dispute, not a data breach, but courts have applied its reasoning to data breach standing arguments. Under TransUnion, a plaintiff whose data was exposed but who cannot point to actual misuse, out-of-pocket mitigation costs, or another cognizable injury faces dismissal in federal court. An attorney experienced in commercial litigation can assess which injuries are likely to survive the pleading stage.

Courts have found concrete injury where a plaintiff demonstrates actual identity theft, fraudulent charges, or unauthorized account access traceable to the breach. Time and money spent on credit monitoring, purchasing fraud alerts, or resolving fraudulent accounts have also supported standing in multiple circuits. Bare exposure of data without any evidence of actual misuse or cognizable cost has generally not been enough.

State courts are not governed by Article III. Some plaintiffs file in state court because state standing doctrines are more permissive. An express state-law private right of action may broaden the available remedy without automatically eliminating the forum state's own standing and injury requirements. And if the case is removed to federal court, Article III standing applies regardless.

HIPAA requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured protected health information. Notification to the Department of Health and Human Services follows a separate timeline depending on whether the breach affects 500 or more individuals. The Gramm-Leach-Bliley Act imposes data security and notification obligations on financial institutions. The FTC Act Section 5 authorizes the Federal Trade Commission to bring enforcement actions against companies that fail to maintain reasonable data security as an unfair or deceptive trade practice.

All 50 states have breach notification laws, but their timing rules differ. Some impose fixed deadlines of 30, 45, or 60 days. Others require notice without unreasonable delay or as soon as practicable. Most define covered personal information to include Social Security numbers, financial account credentials, and government-issued ID numbers. A growing number of states have expanded coverage to include login credentials, medical information, and biometric data.

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, extends beyond breach notification and provides a limited private right of action for unauthorized access, exfiltration, or disclosure of specified categories of personal information resulting from a business's failure to maintain reasonable security. Data privacy counsel can map applicable notification and security requirements before a breach occurs.

Where federal and state laws both apply, the organization must analyze and satisfy each applicable requirement. The shortest deadline or broadest notice obligation may drive the operational response, unless federal law preempts a particular state requirement. Preemption analysis varies by statute, and companies operating in regulated industries should not assume federal compliance automatically satisfies state obligations.

Rule 23(a) requires numerosity, commonality, typicality, and adequacy of representation. Numerosity is rarely disputed in cases affecting thousands of individuals. Commonality requires at least one question common to the class capable of generating a common answer. Typicality requires that the named plaintiff's claims arise from the same event and legal theory as the class, and adequacy requires that the named plaintiff and class counsel will fairly represent it.

Predominance is the most contested requirement. Defendants argue that injury and causation must be proven individually, because not every class member whose data was exposed suffered actual harm. Some courts have found that the common question of whether the defendant's security practices were deficient predominates even if individual damages vary. Others have denied certification when individualized injury questions dominate.

A plaintiff seeking to certify a damages class must offer a class-wide damages methodology consistent with Comcast Corp. .. Behrendt, 569 U.S. 27 (2013). A damages model that does not match the theory of liability will defeat certification.

The central negligence theory is that the defendant owed a duty to protect personal information, breached that duty through inadequate security, and caused harm as a result. Some courts have found a common law duty of care based on the foreseeable harm from a breach. Others have required a pre-existing relationship or statutory obligation to establish the duty.

Depending on state law, a violation of a statute designed to protect the plaintiff's class from the type of harm suffered may establish or support the duty and breach elements. Causation and damages still require separate proof. Both plaintiffs and defendants should evaluate the strength of this theory with litigation counsel before the motion to dismiss stage.

Where a company's privacy policy promised specific security measures, plaintiffs allege that the breach violated those promises. Courts are divided on whether a privacy policy creates an enforceable contract. Some have found that a privacy policy incorporated into a user agreement is a binding commitment. Others have found it too vague to support a breach of contract claim.

Defendants challenge standing, causation, and the damages model at every stage. At the motion to dismiss stage, the argument is that plaintiffs failed to plead a concrete injury traceable to this specific breach. At class certification, defendants contest predominance and challenge the class-wide damages methodology through expert testimony. On the merits, defendants argue that their security measures were reasonable under industry standards and that plaintiffs cannot link any actual harm to this particular breach.

Most settlements include a cash fund, credit monitoring services for affected class members, and injunctive relief requiring specified security improvements. Cash distributions to individual class members are often small when the class is large. Rule 23(e) requires court approval of any class settlement, and the court must find it fair, reasonable, and adequate.

Ompanies facing a breach should engage business litigation counsel immediately to coordinate the incident response with litigation privilege considerations. Communications with outside counsel created for the purpose of legal advice may be protected from discovery. Forensic reports prepared at counsel's direction for litigation purposes may qualify as work product, depending on how the engagement is structured. Early decisions about how the investigation is documented affect what is discoverable if litigation follows.

Data Breach Class Action: Key Legal Standards

Any individual whose personal information was compromised in a breach may be a potential class member. To serve as a named plaintiff, a person must have suffered a concrete injury traceable to the breach and must adequately represent the class. Plaintiffs who can document actual misuse, fraudulent activity, or out-of-pocket costs have the strongest standing arguments under TransUnion.

Most state breach notification statutes are enforced by state attorneys general and do not create a private right of action. A company's failure to provide timely notice or to maintain adequate security can support a negligence claim in private litigation. California's Consumer Privacy Act, as amended by the CPRA, is an exception: it provides a limited private right of action for unauthorized access or disclosure of specified categories of personal information resulting from a failure to maintain reasonable security.

At minimum, nearly all state statutes cover Social Security numbers, financial account numbers with access credentials, and state-issued ID numbers. A growing number of states also cover medical and health information, login credentials, biometric data, and precise geolocation data. Companies operating nationally must map their data holdings against the definition of covered information in each state where they have customers.

An FTC enforcement action is brought by the Federal Trade Commission under Section 5 of the FTC Act. The FTC can seek injunctive relief and other equitable remedies. Civil penalties are available in more limited circumstances, such as violations of specific rules, prior FTC orders, or where the penalty-offense doctrine applies. The FTC cannot recover compensatory damages for affected individuals. A class action is brought by private plaintiffs seeking compensation for their own losses, and the two proceedings can run simultaneously.

The limitations period and accrual date depend on the claim and governing state law. Some jurisdictions apply a discovery rule that starts the clock when the plaintiff knew or should have known of the breach and resulting injury. Others measure accrual from the date of the breach, the notice date, or the occurrence of a legally cognizable injury. Consulting counsel promptly after discovering a breach protects against limitations issues regardless of which rule applies.