May 14, 2015
On May 4, 2015, a US District Court judge in the Eastern District of Louisiana dismissed a class action lawsuit that sought damages from eBay based on the “threat of future harm” stemming from the online retailer’s 2014 data breach (Green v. Ebay, Inc.) (2015 U.S. Dist. LEXIS 58047). Between February and March 2014 eBay was the target of a cyber-attack that compromised the encrypted passwords and personal information, including mailing addresses, phone numbers and dates of birth, for 145 million users. eBay notified its users and advised them to change their passwords. The lawsuit alleged that the breach subjected eBay users to economic damages, identify theft and damages for having to take preventative measures due to an increased risk of identity theft. In dismissing the suit, the court ruled that the plaintiffs did not have standing because their complaint was based on the threat of future harm and not ongoing or past harm. The ruling comes after the Supreme Court on April 27 agreed to hear a case recently decided by the 9th Circuit (Spokeo, Inc. v. Robins) that turns on whether Congress can confer Article III standing on a plaintiff that does not suffer concrete harm, by authorizing a private right of action based on a bare violation of a federal law.