Michael Daly Shares Insights on Concrete Injury in Data Breach Claims for ABA’s Litigation Section

In an article for the American Bar Association’s Litigation Section, business litigation partner Michael Daly, who also co-chairs the Section’s Consumer Litigation Committee, commented on recent cases that are redefining the extent of injury necessary to establish standing in data breach cases.

The article discusses a class action that the Fourth Circuit recently revived involving a data breach that compromised the driver’s license numbers of nearly three million people. The appeals court held that two plaintiffs, who alleged their information was for sale on the dark web, suffered a concrete and particularized injury analogous to the common-law tort of public disclosure of private information.

Daly referenced the court’s reliance on the common-law analogue tort of public disclosure of private information and shared that “The problem with that analogy is that the defendant didn’t make such a disclosure,” Daly noted, explaining that the public disclosure tort is “meant to protect against disclosure of things like ‘loathsome diseases.’”

Daly also offered guidance on litigation strategies for data breach cases. “It is always important to scrutinize any threshold defense to a claim. But it is also important to consider whether to assert that defense at the pleading stage or reserve it for later,” he explained. “[Making such claims at the beginning of the case] can lead to dismissal without prejudice, which can allow the claims to reappear in state court.”