We wrote recently about how the certiorari petition in Zappos.com, Inc. v. Stevens was a possible vehicle to put the question of standing in data breach cases back before the Supreme Court. Alas, the Court denied the certiorari petition on March 25.
Combined with the Supreme Court’s remand in Frank v. Gaos, those wishing for a landmark standing decision must wait a little longer.
Given the small number of certiorari petitions granted, the odds are always against a particular petition producing a merits decision. That said, this issue will likely demand resolution at some point – denying a petition does not resolve the underlying split between the various Circuit Courts of Appeal.
As matters now stand, the 3rd, 6th, 7th, 9th and D.C. Circuits have all decided cases in a manner that suggests that a plaintiff suffers an injury-in-fact if the plaintiff’s information is contained in a database that is breached. The 1st, 2nd, 4th and 8th Circuits all require an injury beyond a mere breach. As this split becomes more entrenched (and presumably expands into the 10th and 11th Circuits), expect the issue to return to the Supreme Court’s docket.