Security Magazine logo
search
cart
facebook twitter linkedin youtube
  • Sign In
  • Create Account
  • Sign Out
  • My Account
Security Magazine logo
  • NEWS
    • Security Newswire
    • Technologies & Solutions
  • MANAGEMENT
    • Leadership Management
    • Enterprise Services
    • Security Education & Training
    • Logical Security
    • Security & Business Resilience
    • Profiles in Excellence
  • PHYSICAL
    • Access Management
    • Fire & Life Safety
    • Identity Management
    • Physical Security
    • Video Surveillance
    • Case Studies (Physical)
  • CYBER
    • Cybersecurity News
    • More
  • BLOG
  • COLUMNS
    • Cyber Tactics
    • Leadership & Management
    • Security Talk
    • Career Intelligence
    • Leader to Leader
    • Cybersecurity Education & Training
  • EXCLUSIVES
    • Annual Guarding Report
    • Most Influential People in Security
    • The Security Benchmark Report
    • The Security Leadership Issue
    • Top Guard and Security Officer Companies
    • Top Cybersecurity Leaders
    • Women in Security
  • SECTORS
    • Arenas / Stadiums / Leagues / Entertainment
    • Banking/Finance/Insurance
    • Construction, Real Estate, Property Management
    • Education: K-12
    • Education: University
    • Government: Federal, State and Local
    • Hospitality & Casinos
    • Hospitals & Medical Centers
    • Infrastructure:Electric,Gas & Water
    • Ports: Sea, Land, & Air
    • Retail/Restaurants/Convenience
    • Transportation/Logistics/Supply Chain/Distribution/ Warehousing
  • EVENTS
    • Industry Events
    • Webinars
    • Solutions by Sector
    • Security 500 Conference
  • MEDIA
    • Videos
      • Cybersecurity & Geopolitical Discussion
      • Ask Me Anything (AMA) Series
    • Podcasts
    • Polls
    • Photo Galleries
  • MORE
    • Call for Entries
    • Classifieds & Job Listings
    • Continuing Education
    • Newsletter
    • Sponsor Insights
    • Store
    • White Papers
  • EMAG
    • eMagazine
    • This Month's Content
    • Advertise
  • SIGN UP!
CybersecuritySecurity NewswireSecurity Enterprise ServicesSecurity & Business Resilience

Supreme Court decision may have significant implications for data breach and privacy class actions

By Joshua Briones, Arameh Zargham O'Boyle, Matthew Novian
supreme court rules on data privacy case; could have implications for future cybersecurity data breach class action lawsuits against enterprises
July 2, 2021

The United States Supreme Court has reshaped class standing in a landmark ruling.  TransUnion LLC v. Ramirez asked whether class members who suffer no actual injury can be included in a damages class under Federal Rule of Civil Procedure 23.  The Court, in a 5-4 opinion led by Justice Kavanaugh, put it simply: “no concrete harm, no standing.”  The Court’s holding has potentially significant implications for data breach and privacy class actions.

In Ramirez, the lead Plaintiff attempted to purchase a car from a dealership when an inaccurate credit report identified him as a potential terrorist.  After a jury trial, the certified class of 8,815 members was awarded $40 million in statutory and punitive damages for TransUnion’s alleged violations of the Fair Credit Reporting Act.  On appeal, the Ninth Circuit impermissibly bundled into one class members whose credit files were disclosed to third-parties and members whose files were not disclosed.  In doing so, the Ninth Circuit found that Ramirez’s claims were sufficiently “typical” of the class and that the absent class members suffered an “injury” because they had been erroneously notified by mail that they were on the same terrorist list.

The Supreme Court reversed, finding that only the members who had that their misleading credit reports were disclosed to third-parties by TransUnion had suffered a sufficient harm to trigger Article III standing.  In assessing whether a class member has suffered a “concrete harm” under Article III, the Court reaffirmed principles from Spokeo v. Robins, namely that courts must “[a]ssess . . . whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts – such as physical harm, monetary harm, or various intangible harms including (as relevant here) reputational harm.” 

Beyond the facts of Ramirez, the Court’s decision will impact data security and privacy class action litigation by providing defendants with a more powerful defense in cases where alleged privacy and security violations do not result in a disclosure of information resulting in any tangible harm.  In the data breach context, if private information was not published, or if the data was not used in any fraudulent way, defendants may be able to argue that the class has not been harmed and, therefore, lacks standing.

Courts across the country have been waiting for Ramirez to decide certification issues in data breach class actions.  For example, in Stoll v. Musculoskeletal Inst., Chtd., the plaintiffs alleged that “Defendant experienced a ransomware attack which resulted in exposure of sensitive and private personally identifiable information (PII) of at least 100,000 patients, and potentially in excess of 150,000 patients of Defendant.” 2021 U.S. Dist. LEXIS 30154 (M.D. Fla. Feb. 18, 2021).  The court stayed the case pending Ramirez finding that “the parties would benefit significantly from the Supreme Court's ruling in litigating the issue as to whether a class can be certified and who may be included within that class.”  Now, the Stoll Court (and district courts throughout the country) will have to dissect classes at—or before—certification to determine which members have suffered a cognizable injury, and which have not.  For this reason, Ramirez will successfully chip away large putative classes where real injury may be limited to only a few individuals.

On the other hand, Ramirez may also cause a flood of “no injury” privacy class actions in state courts, where standing thresholds are lower than the mandates of Article III.  In dissent, Justice Thomas cautioned that Ramirez “might actually be a pyrrhic victory for TransUnion.”  He reasoned that plaintiffs without Article III standing will simply file complaints in state court moving forward.  Moreover, Justice Thomas warned that defendants will be unable to remove because Ramirez “does not prohibit Congress from creating statutory rights for consumers; it simply holds that federal courts lack jurisdiction to hear some of these cases.” States like California, for example, with more lenient standing requirements, and also have judges that are likely to liberally interpret federal statutes upon which most “no injury” class actions are based. 

While it is yet to be seen how and at what stage of litigation Ramirez will be applied, it will be a prominent authority in privacy and data breach class actions moving forward in federal court.  Under its standard, all class members must have standing, not just a select few.  At the very least, plaintiffs will now be required to allege that data was actually misused not just improperly exfiltrated by hackers.  As a result, defendants will be successful in paring down class size by exposing class members who did not suffer the same harms as the class representative.

 

KEYWORDS: cyber security cybersecurity liability data breach data security duty of care lawsuits privacy issues privacy laws

Share This Story

Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!

Briones j pr300

Joshua Briones is Managing Member of Mintz’s Los Angeles office and has served as lead defense counsel on over 500 alleged nationwide class actions in state and federal courts across the country. Image courtesy of Briones

Oboyle a pr300

Arameh Zargham O’Boyle is a litigator and Member at Mintz, where she represents companies in a variety of industries in complex product litigation as well as in class actions involving data privacy issues. Image courtesy of O'Boyle

Novian mj pr300

Matthew Novian is an Associate with Mintz in the Los Angeles office and focuses his practice on complex commercial litigation, including consumer protection matters, and privacy class actions. Image courtesy of Novian

Recommended Content

JOIN TODAY
To unlock your recommendations.

Already have an account? Sign In

  • Security's Top Cybersecurity Leaders 2024

    Security's Top Cybersecurity Leaders 2024

    Security magazine's Top Cybersecurity Leaders 2024 award...
    Top Cybersecurity Leaders
    By: Security Staff
  • cyber brain

    The intersection of cybersecurity and artificial intelligence

    Artificial intelligence (AI) is a valuable cybersecurity...
    Columns
    By: Pam Nigro
  • artificial intelligence AI graphic

    Assessing the pros and cons of AI for cybersecurity

    Artificial intelligence (AI) has significant implications...
    Technologies & Solutions
    By: Charles Denyer
Subscribe For Free!
  • Security eNewsletter & Other eNews Alerts
  • eMagazine Subscriptions
  • Manage My Preferences
  • Online Registration
  • Mobile App
  • Subscription Customer Service

More Videos

Sponsored Content

Sponsored Content is a special paid section where industry companies provide high quality, objective, non-commercial content around topics of interest to the Security audience. All Sponsored Content is supplied by the advertising company and any opinions expressed in this article are those of the author and not necessarily reflect the views of Security or its parent company, BNP Media. Interested in participating in our Sponsored Content section? Contact your local rep!

close
  • Crisis Response Team
    Sponsored byEverbridge

    Automate or Fall Behind – Crisis Response at the Speed of Risk

  • Perimeter security
    Sponsored byAMAROK

    Why Property Security is the New Competitive Advantage

  • Duty of Care
    Sponsored byAMAROK

    Integrating Technology and Physical Security to Advance Duty of Care

Popular Stories

Pills spilled

More than 20,000 sensitive medical records exposed

Laptop in darkness

Verizon 2025 Data Breach Investigations Report shows rise in cyberattacks

Coding on screen

Research reveals mass scanning and exploitation campaigns

White post office truck

Department of Labor Sues USPS Over Texas Whistleblower Termination

Computer with binary code hovering nearby

Cyberattacks Targeting US Increased by 136%

2025 Security Benchmark banner

Events

May 22, 2025

Proactive Crisis Communication

Crisis doesn't wait for the right time - it strikes when least expected. Is your team prepared to communicate clearly and effectively when it matters most?

September 29, 2025

Global Security Exchange (GSX)

 

View All Submit An Event

Products

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

Security Culture: A How-to Guide for Improving Security Culture and Dealing with People Risk in Your Organisation

See More Products

Related Articles

  • New Newswire Feature Image 3/8/2012

    Class Action Lawsuit Filed Against Target for Data Breach

    See More
  • VPN

    Google VPN and privacy and data implications

    See More
  • data-freepik1170x658v493863656.jpg

    Department of Justice investigates data breach of court records system

    See More
×

Sign-up to receive top management & result-driven techniques in the industry.

Join over 20,000+ industry leaders who receive our premium content.

SIGN UP TODAY!
  • RESOURCES
    • Advertise
    • Contact Us
    • Store
    • Want More
  • SIGN UP TODAY
    • Create Account
    • eMagazine
    • eNewsletter
    • Customer Service
    • Manage Preferences
  • SERVICES
    • Marketing Services
    • Reprints
    • Market Research
    • List Rental
    • Survey/Respondent Access
  • STAY CONNECTED
    • LinkedIn
    • Facebook
    • YouTube
    • X (Twitter)
  • PRIVACY
    • PRIVACY POLICY
    • TERMS & CONDITIONS
    • DO NOT SELL MY PERSONAL INFORMATION
    • PRIVACY REQUEST
    • ACCESSIBILITY

Copyright ©2025. All Rights Reserved BNP Media.

Design, CMS, Hosting & Web Development :: ePublishing