In finding plaintiffs lacked standing to bring an action for a data breach, the U.S. District Court for the District of Columbia held the “increased likelihood” of personal information being used was insufficient to establish a viable cause of action. In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 2014 U.S. Dist. LEXIS 64125 (D.D.C. May 9, 2014), the plaintiffs’ medical information was stolen from a car owned by an employee of the Science Applications International Corporation, a company that handles data for the U.S. Government.

The SAIC Court held the majority of the plaintiffs lacked standing because they could not show they had suffered any injuries. The fact that the plaintiffs may be more likely to be subjected to identity theft or that the plaintiffs may need to incur costs related to monitoring their credit did not establish that the plaintiffs had suffered a compensable injury.

The SAIC Court also found the minority of plaintiffs that could show they suffered some form of an injury from identity theft could not establish such injuries were directly caused by the theft of the tapes. Here, the SAIC Court held that even if the plaintiffs suffered injury, the alleged injury was caused by the theft of financial information and the plaintiffs alleged only that thief obtained unrelated medical data from the car.

The SAIC Court noted there was evidence submitted that approximately 3.3% of the population will experience some form of identity theft. Therefore, it was not unexpected to see some of the plaintiffs had suffered identity theft. The plaintiffs were not able to show this identity theft was caused by their medical information being stolen from the car.

Consequently, at a bare minimum, to establish standing in a data breach case, a party must demonstrate actual injury that was directly caused by the data breach.