U.S. Supreme Court building.

The U.S. Supreme Court declined to settle a circuit split concerning if actual and immediate damages are needed to adequately allege an injury from a data breach, leaving some jurisdictions hotspots for data breach class action filings because of a lower threshold for standing.

On March 25, the U.S. Supreme Court declined Zappos’ petition for writ of certiorari in a case involving the 2012 data breach of Zappos’ computer systems that led to hackers stealing 24 million customers’ names, email and physical addresses and partial credit card information. Although no fraudulent charges were reported by breached customers, class action suits followed after Zappos revealed the breach. The central issue of the case was whether individuals whose data is breached have Article III standing without concrete injury.

Last year the U.S. Court of Appeals for the Ninth Circuit held that imminent risk of identity theft from the breach was enough to establish standing to sue for customers who weren’t fraud victims. That view differs with the higher bar needed to adequately allege injury in the First, Second, Fifth and Eight circuits.

The Supreme Court’s inaction on the matter means there won’t be a uniform view anytime soon, and the Ninth, Third, Sixth, Seventh and D.C. circuits will likely see the most fillings for class action data breach lawsuits.

Plaintiffs will want to bring class actions in circuits “where the courts recognize you have standing without showing you suffered actual losses, monetary or otherwise,” said Jones Walker partner and privacy and data security team co-chair Andy Lee. “It’s geographical now, it has been, that’s because the split has been there for a while in terms of history from the last 10, 12 years. This has been sent up to the Supreme Court a couple of times and it hasn’t accepted cert yet.”

The circuit courts’ varying decisions is partially based on the U.S. Supreme Court’s 2016 Spokeo v. Robins ruling, which held Article III standing requires concrete harm.

Fox Rothschild U.S. chief privacy officer and partner Mark McCreary said the Spokeo ruling was a “big deal” that hasn’t translated over to data breach litigation. “There have been courts that have leaned toward allowing speculative risk causes of action, such as a heightened risk of future identity theft, and permitting standing for those cases,” McCreary said.

Plaintiffs attorney and founder of Edelson law firm Jay Edelson said litigating breach cases is less a question of standing but damages.

“Standing is a jurisdictional requirement and Spokeo was pretty clear that you don’t need to have out-of-pocket harm to have standing in court,” Edelson noted.

“If a company promises to deliver a product with a certain amount of security and they didn’t, the consumer overpaid for that. ... That’s how they’ve been harmed. To us that’s the best damages theory,” he added.