A recent federal appeals court ruling may narrow the burden for plaintiffs to prove that they are victims of identity theft as result of a data breach.
Plaintiffs Juana Curry and William Moore alleged in a class-action lawsuit filed in 2010 that they sustained ID theft following an incident the year prior in which two unencrypted laptops, containing the personal information of 1.2 million customers, were stolen from Florida health insurer AvMed. (The victim total initially was much lower, but later revised by the company).
In August 2011, a U.S. District Court judge dismissed the case after concluding that the plaintiffs were unable to represent "injury" as a result of the laptop thefts.
But earlier this month, the 11th U.S. Circuit Court of Appeals, in a 2-1 decision (PDF), ruled that the plaintiffs were "explicitly" able to prove a link between the breach and ID theft they incurred.
The plaintiffs contended that roughly a year after the incident, bank and brokerage accounts were opened in their names, resulting in unauthorized charges and transactions. They were forced to spend money to place fraud alerts and purchase identity theft protection services, among other costs.
Ben Thomassen, an associate with Edelson McGuire, the Chicago law firm representing the plaintiffs, said that in addition to winning the ID theft argument, the court also sided, in an unprecedented fashion, with the claimants' allegations of "unjust enrichment." The court held that the premiums AvMed members pay to the company includes an expectation for the protection of personal information.
"When a company doesn't live up to the obligation that it's supposed to...that person [victimized by a breach] has a cause of action for that money he paid toward the protection of his personal information," Thomassen told SCMagazine.com.
Now, the case again will return to the lower court, so AvMed can answer the allegations. The appeals court did dismiss the negligence and breach of contract claims.
An AvMed spokeswoman could not immediately be reached for comment.
David Navetta, founding partner of InfoLawGroup, said in a blog post that he predicts the 11th Circuit will see more breach cases as a result.
"Whether plaintiffs making such allegations can ultimately prove their claims is a question for another day," he wrote. "Even so, this decision may give some plaintiffs litigation leverage to move their cases toward a jury trial and possibly force settlement."
