Insurance Dispute Lawyer Blog
As more and more aspects of our lives are conducted online, data breaches have become an increasingly troubling prospect. If you have been involved in a data breach, you have likely worried about potential adverse effects and the possibility that you could become a victim of identity theft. However, the mere fact that a person’s information is compromised in a data breach does not necessarily mean victory in a lawsuit for damages.
Walter Bradix worked for Advance Auto Parts (“Advance”), which informed him by mail in March of 2016 that employee information held by Advance, including his own, had been inadvertently disclosed to a third party. This included personal information such as names, social security numbers, and salary details. Advance provided affected employees with identity protection services for two years and advised them to be vigilant for any signs of identity theft.
Subsequently, Bradix noticed two unidentified inquiries in his credit report. He also experienced anxiety over the data breach due to his fear of identity theft. Bradix filed a class action lawsuit in Louisiana state court against Advance on behalf of himself and “similarly situated employees” whose information was affected by the breach. He claimed that Advance negligently allowed the information to be stolen, was grossly negligent in handling the information, violated its fiduciary duties, and invaded employees’ privacy.
The case was removed to the U.S. District Court of the Eastern District of Louisiana (“EDLA”), where Advance filed a motion to dismiss for failure to state a claim and lack of standing. The EDLA found persuasive the fact that Bradix did not even allege that the two unidentified credit inquiries had harmed his credit score. Finding it had no subject matter jurisdiction, the EDLA remanded the case to the state court to determine if there was an applicable remedy under Louisiana law.
In the state trial court, Advanced filed peremptory exceptions of “no right and action” and “no cause of action.” Under Louisiana law, a peremptory exception of no right of action applies when the plaintiff’s claim is legally nonexistent. See La. C.C.P. art. 923. To assert a claim, a party must have standing, which requires that the person have an actual and real interest in what he is asserting. See La. C.C.P. art. 681. The trial court granted Advance’s exceptions and dismissed the lawsuit. Bradix appealed, arguing that he had standing based on the harm he suffered from the unidentified credit inquiries and his anxiety.
Louisiana’s Fourth Circuit Court of Appeal noted that Bradix did not allege that anyone had successfully stolen his identity but that he might suffer identity theft at some time in the future. Nor, as the EDLA pointed out, did Bradix allege that his credit score had been negatively affected by the credit checks or that the checks were in any way related to the data breach. Therefore, the Court concluded that Bradix did not allege a sufficiently particular injury but only a theoretical future injury.
Furthermore, under Louisiana law, the plaintiff must show that he suffered actual damages to prevail in a claim involving negligence, gross negligence, invasion of privacy, or breach of fiduciary duty. The Court found that Bradix did not prove that he had suffered any actual damages but merely alleged speculative future harm. Based on these conclusions, the Court affirmed the trial court’s grant of an exception of no right of action in favor of Advance.
This case shows the potential pitfalls of litigating a data breach. Though the possible negative effects are real, the mere occurrence of a breach is not enough for recovery at law. A breach victim must show he suffered actual damages — in the form of a reduced credit score, actual identity theft, or some other harm — to have his day in Court. Anyone involved in a data breach who wishes to pursue litigation for damages should consult an experienced attorney.
Additional Sources: BRADIX v. ADVANCE STORES CO.
Additional Berniard Law Firm Articles on Security Breaches: Security Breach Case Fleshes Out Requirements for Successful Suit