Hutton, et al. v. National Board of Examiners in Optometry, Inc. 4th Circuit June 12, 2018 Case No. 17-1508
Class action on behalf of a group of individuals who registered to take the professional optometry licensure exam. Groups of optometrists began to notice that fraudulent Chase credit card accounts began being opened in their names. The group determined that it was the National Board of Examiners in Optometry, Inc. (NBEO), instead of American Optometric Association or other similar groups, because only the NBEO stored their social security numbers. Additionally, several of the credit cards were opened with individual class members maiden names, names that they had not used since applying with the NBEO.
The Maryland District Court dismissed the complaint ruling that it did not possess subject matter jurisdiction due to the Plaintiffs’ lack of standing. The District Court concluded that the Plaintiffs had failed to sufficiently allege that they suffered an injury-in-fact because, even if NBEO confirmed an actual breach, the Plaintiffs had incurred no fraudulent charges and had not been denied credit. The Court also explained that the allegations relied upon online conversations to conclude that NBEO suffered a data breach and, therefore, rested on pure speculation.
The Fourth Circuit noted that the situation in its earlier decision in Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), where the Court ruled that a Plaintiff fails to establish Article III standing based on hard frim the increased risk of future identity theft and the cost measure to protect against it, was different because in that case, the data breach occurred, but no personal information had yet been used. In this case, Plaintiffs allege that they have already suffered hard in the form of identity theft and credit card fraud. The fraudsters have used, and attempted to use, the Plaintiffs’ personal information without their knowledge or approval. Accordingly, there is no need to speculate on whether substantial herm will befall the Plaintiffs.
The Plaintiffs do not allege that they have suffered fraudulent charges, but the Supreme Court has long ago made clear that interpreting injury in fact . . . standing is not confined to those who can show economic harm. Although incurring costs for mitigating measures to safeguard against future identity theft may not constitute an injury-in-fact when that injury is speculative, the Court has recognized standing to sue on the basis of costs incurred to mitigate or avoid harm when a substantial risk of harm actually exists.
As to the traceability of the Defendant’s conduct to the harm alleged, the pleadings must be something more than an ingenious academic exercise in the conceivable. The ‘fairly traceable’ standard is not equivalent to a requirement of tort causation. Based on the facts alleged including the storage of social security information and the use of the maiden names of several plaintiffs, the Court ruled that the Complaint contained sufficient allegations that the NBEO was a plausible source of the Plaintiffs’ personal information.
Based on this, the 4th Circuit held that the standing elements of injury-in-fact and traceability are both sufficiently alleged in the Complaints and the judgment was vacated and remanded back to the district court for further proceedings.