On June 17, 2009, the Eleventh Circuit Court of Appeals affirmed the decision of the United States District Court for the District of Alabama and held that veterans were not entitled to damages as a result of data security breach.
In February 2007, the Department of Veterans Affairs announced that a computer hard drive, which contained the unencrypted names, social security numbers, birth dates and healthcare files for more than 198,000 living veterans, was missing. Veterans instituted a lawsuit against the VA and claimed that the “stress caused by their fear of identity theft” and “from their loss of trust in the VA” aggravated certain of their medical conditions. The district court granted the VA’s motion for summary judgment and dismissed the veterans’ claims. The Eleventh Circuit upheld the district court’s decision and stated that the veterans were not entitled to monetary damages because they failed to prove “actual damages” or “pecuniary losses”. The Eleventh Circuit did, however, remand the case to the district court to order the VA to take certain steps to avoid similar incidents in the future.