In re: Horizon Healthcare — class action — reversal — Jordan

The Third Circuit today ruled in favor of a putative class of data-theft victims who sued the company that their data was taken from. The introduction of the Court’s opinion:

The dispute at the bottom of this putative class action began when two laptops, containing sensitive personal information, were stolen from health insurer Horizon Healthcare Services, Inc. The four named Plaintiffs filed suit on behalf of themselves and other Horizon customers whose personal information was stored on those laptops. They allege willful and negligent violations of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681, et seq., as well as numerous violations of state law. Essentially, they say that Horizon inadequately protected their personal information. The District Court dismissed the suit under Federal Rule of Civil Procedure 12(b)(1) for lack of Article III standing. According to the Court, none of the Plaintiffs had claimed a cognizable injury because, although their personal information had been stolen, none of them had adequately alleged that the information was actually used to their detriment.

We will vacate and remand. In light of the congressional decision to create a remedy for the unauthorized transfer of personal information, a violation of FCRA gives rise to an injury sufficient for Article III standing purposes. Even without evidence that the Plaintiffs’ information was in fact used improperly, the alleged disclosure of their personal information created a de facto injury. Accordingly, all of the Plaintiffs suffered a cognizable injury, and the Complaint should not have been dismissed under Rule 12(b)(1).

Joining Jordan was Vanaskie. Judge Shwartz concurred in the judgment based on her view that the plaintiffs’ loss of privacy, apart from any statutory violation, constitutes injury in fact. Arguing counsel were associate Erich Schork of Chicago for the plaintiffs and Kenneth Chernof, litigation co-chair of Arnold & Porter, for the company.