Judge John A. Kronstadt, of the Central District of California, dismissed putative class action claiming damages as a result of an alleged data breach.
Background: Glickman brought a putative class action arising from a December 2023 data breach involving First American’s systems. According to the complaint, unauthorized actors may have accessed names, dates of birth, Social Security numbers, and other personal information belonging to customers of First American’s clients. Glickman asserted negligence, breach of contract, unjust enrichment, UCL, and CCPA claims, alleging that the breach exposed him to identity-theft risks and caused harm including lost time, anxiety, diminished value of personal information, privacy injuries, and increased spam communications. First American moved to dismiss, compel arbitration, and strike class allegations.
The Court’s Analysis: The court held that Glickman failed to establish Article III standing. Relying heavily on the Ninth Circuit’s decision in Greenstein v. Noblr Reciprocal Exchange, the court concluded that the complaint alleged only that personal information may have been accessed, not that Glickman’s information was actually stolen or misused. The court found that allegations of future identity-theft risk rested on a speculative chain of possibilities and therefore could not support standing. It likewise determined that allegations of mitigation costs, anxiety, diminished value of personal information, loss of privacy, and benefit-of-the-bargain injuries were too conclusory to establish a concrete injury. Because Glickman lacked standing, the court dismissed the complaint with leave to amend and denied as moot the motions to compel arbitration and strike class allegations.
Significance: The decision reflects the Ninth Circuit’s increasingly demanding approach to Article III standing in data-breach litigation. Courts find allegations of future risk of harm too speculative and unpersuasive to establish concrete harm.
