Jennifer Clemens v. Execupharm Inc ( 2022 )

PRECEDENTIAL
UNITED STATES COURT OF APPEALS
FOR THE THIRD CIRCUIT
____________
No. 21-1506
____________
JENNIFER CLEMENS,
Appellant
v.
EXECUPHARM INC.; PAREXEL INT’L CORP.
____________
On Appeal from the United States District Court
for the Eastern District of Pennsylvania
(Civil No. 2-20-cv-03383)
District Judge: Honorable Gerald J. Pappert
____________
Argued December 14, 2021
____________
Before: GREENAWAY, JR., KRAUSE, and PHIPPS, Circuit
Judges.
(Filed: September 2, 2022)
Mark S. Goldman
Goldman Scarlato & Penny
161 Washington Street
8 Tower Bridge, Suite 1025
Conshohocken, PA 19428
J. Austin Moore [ARGUED]
Norman E. Siegel
Barrett J. Vahle
Caleb J. Wagner
Stueve Siegel Hanson
460 Nichols Road
Suite 200
Kansas City, MO 64112
Counsel for Appellant
Shifali Baliga
Kristine M. Brown
Donald M. Houser [ARGUED]
Alston & Bird
1201 West Peachtree Street
One Atlantic Center, Suite 4900
Atlanta, GA 30309
Mathieu Shapiro
Obermayer Rebmann Maxwell & Hippel
1500 Market Street
Centre Square West, 34th Floor
Philadelphia, PA 19102
Counsel for Appellees
2
____________
OPINION OF THE COURT
___________
GREENAWAY, JR., Circuit Judge.
In this appeal, Jennifer Clemens asks us to reverse the
District Court’s dismissal of her complaint seeking equitable
and monetary relief in connection with a data breach that
resulted in the publication of her sensitive personal information
on the Dark Web. Clemens argues that her injury was
sufficiently imminent to constitute an injury-in-fact for
purposes of standing. We agree. Accordingly, we will vacate
the judgment of the District Court and remand for
consideration of the merits.
I. Background1
Clemens is a former employee of ExecuPharm, Inc.
(“ExecuPharm” or “the Company”), a subsidiary of the global
biopharmaceutical company Parexel International Corp.
(“Parexel”). As a condition of her employment, Clemens was
required to provide ExecuPharm with sensitive personal and
financial information, including her address, social security
1
Where, as here, the challenge to a District Court’s subject
matter jurisdiction was made on the face of the pleadings, we
accept all “well-pleaded factual allegations as true and draw all
reasonable inferences” in favor of the plaintiff. In re Horizon
Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625, 633
(3d Cir. 2017).
3
number, bank and financial account numbers, insurance and
tax information, her passport, and information relating to her
husband and child. In exchange, Clemens’s employment
agreement provided that ExecuPharm would “take appropriate
measures to protect the confidentiality and security” of this
information. J.A. 41 ¶ 58. Based on the complaint’s
allegations, ExecuPharm did not perform its obligation.
After Clemens had left ExecuPharm, a hacking group
known as CLOP accessed ExecuPharm’s servers through a
phishing attack in March 2020, stealing sensitive information
pertaining to current and former employees, including
Clemens. Specifically, the stolen information contained social
security numbers, dates of birth, full names, home addresses,
taxpayer identification numbers, banking information, credit
card numbers, driver’s license numbers, sensitive tax forms,
and passport numbers. In addition to exfiltrating the data,
CLOP installed malware to encrypt the data stored on
ExecuPharm’s servers. Then, CLOP held the decryption tools
for ransom, threatening to release the information if
ExecuPharm did not pay the ransom. Either because
ExecuPharm refused to pay or for nefarious reasons unknown,
the hackers made good on their threat and posted the data on
underground websites located on the Dark Web, which is “a
portion of the Internet that is intentionally hidden from search
engines and requires the use of an anonymizing browser to be
accessed. It is most widely used as an underground black
market where individuals sell illegal products like . . . sensitive
stolen data that can be used to commit identity theft or fraud.”
J.A. 25 ¶ 15. Screenshots by an Israel-based intelligence firm
confirm that CLOP made available for download at least one
archive containing nearly 123,000 files and 162 gigabytes of
4
data pertaining to ExecuPharm and Parexel, including sensitive
employee information.
Throughout March and April of 2020, ExecuPharm
provided periodic updates to current and former employees to
inform them of the breach and encourage them to take
precautionary measures. ExecuPharm appreciated the risks,
cautioning current and former employees that “[u]nauthorized
access to [the compromised] information may potentially lead
to the misuse of [their] personal data to impersonate [them]
and/or to commit, or allow third parties to commit, fraudulent
acts such as securing credit in [their] name.” J.A. 30 ¶ 28.
To mitigate potential harm, Clemens took immediate
action. She conducted a review of her financial records and
credit reports for unauthorized activity; placed fraud alerts on
her credit reports; transferred her account to a new bank;
enrolled in ExecuPharm’s complimentary one-year credit
monitoring services; and purchased three-bureau credit
monitoring services for herself and her family for $39.99 per
month for additional protection. As a result of the breach,
Clemens alleges that she has sustained a variety of injuries—
primarily the risk of identity theft and fraud—in addition to the
investment of time and money to mitigate potential harm.
Seeking redress, Clemens brought suit against
ExecuPharm and Parexel in the United States District Court for
the Eastern District of Pennsylvania. She sought to represent
herself and a class of all others whose personal information was
compromised, as well as a subclass of current and former
ExecuPharm employees whose employment agreements
promised that the Company would take appropriate measures
to protect their personal data. She invoked the subject matter
5
jurisdiction of the District Court under the Class Action
Fairness Act, 28 U.S.C. § 1332(d).
She asserted claims for negligence (Count I),
negligence per se (Count II), and breach of implied contract
(Count III) against both Defendants. She also asserted claims
for breach of contract (Count IV), breach of fiduciary duty
(Count V), and breach of confidence (Count VI) against
ExecuPharm. Lastly, she sought a declaratory judgment that
Defendants’ existing data security measures fail to comply
with their fiduciary duties of care and that instructs them to
implement and maintain industry-standard measures.
ExecuPharm and Parexel filed a motion to dismiss the
complaint under Federal Rule of Civil Procedure 12(b)(6). The
District Court ordered the parties to submit supplemental
briefing regarding Clemens’s standing, and, after receiving that
briefing, granted the motion to dismiss on February 25, 2021
based on lack of Article III standing. Specifically, the District
Court stated that it sought to follow our “bright line” rule
providing that allegations of an increased risk of identity theft
resulting from a security breach are insufficient for standing.
J.A. 9 (quoting In re Rutter’s Inc. Data Sec. Breach Litig., 511
F. Supp. 3d 514, 525 (M.D. Pa. 2021)). Applying our decision
in Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011), the
District Court concluded that Clemens’s risk of future harm
was not imminent, but “speculative,” because she had not yet
experienced actual identity theft or fraud. J.A. 9-11. This
conclusion also meant that any money Clemens spent to
mitigate the speculative risk was likewise insufficient to confer
standing. The District Court additionally held that, even if
ExecuPharm breached the employment agreement, it would
not have automatically given Clemens standing to assert her
6
breach of contract claim. Clemens timely appealed and seeks
vacatur of the District Court's dismissal of her complaint.
II. Applicable Law2
A. Article III Standing Requirements
Article III standing requires a plaintiff to demonstrate:
“(1) that he or she suffered an injury in fact that is concrete,
particularized, and actual or imminent, (2) that the injury was
caused by the defendant, and (3) that the injury would likely be
redressed by the requested judicial relief.”3 Thole v. U.S. Bank
N.A., 140 S. Ct. 1615, 1618 (2020) (citing Lujan v. Defs. of
Wildlife, 504 U.S. 555, 560-61 (1992)). Only the first two
prongs are disputed on appeal.
a. Injury-in-fact: Imminent
2
The District Court had jurisdiction over the underlying
putative class action pursuant to 28 U.S.C. § 1332(d). We have
jurisdiction pursuant to 28 U.S.C. § 1291.
3
Our concurring colleague suggests that because Clemens
“brings causes of action ‘of the sort traditionally amenable to,
and resolved by, the judicial process,’” we need not apply the
typical tri-partite standing analysis in this case. Concurring
Opinion at 5 (quoting Uzuegbunam v. Preczewski, 141 S. Ct.
792, 798 (2021)). We disagree, and apply this tri-partite
approach consistent with binding precedent. See, e.g., Lujan v.
Defs. of Wildlife, 504 U.S. 555, 560-61 (1992) (citations
omitted); Thorne v. Pep Boys Manny Moe & Jack Inc., 980
F.3d 879, 885 (3d Cir. 2020) (quoting Spokeo, Inc. v. Robins,
578 U.S. 330, 338 (2016)).
7
With regard to the injury-in-fact prong, the injury must
be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’”
Lujan, 504 U.S. at 560 (citations omitted). That “actual or
imminent” is disjunctive is critical: it indicates that a plaintiff
need not wait until he or she has actually sustained the feared
harm in order to seek judicial redress, but can file suit when the
risk of harm becomes imminent. This is especially important
in the data breach context, where the disclosure of the data may
cause future harm as opposed to currently felt harm. In this
way, depending on the nature of the data at issue, claims
flowing from a data breach can differ from traditional tort
claims like defamation or invasion of privacy. While a claim
arising from a data breach may share some commonalities with
such torts—e.g., in that it may involve the publication of
information to a third party or unauthorized access to private
information—the latter claims involve actual injury. A claim
for defamation, for instance, rests on the “reputational harm”
that flows from the publication of a statement “that would
subject [the victim] to hatred, contempt, or
ridicule.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208-
09 (2021) (quoting Milkovich v. Lorain Journal Co., 497 U.S.
1, 13 (1990)). And a claim for invasion of privacy
contemplates that the exposure “cause[s] mental suffering,
shame or humiliation” to the victim. Pro Golf Mfg., Inc. v.
Tribune Rev. Newspaper Co., 809 A.2d 243, 248 (Pa.
2002). By contrast, the type of data involved in a data breach
may be such that mere access and publication do not cause
inherent harm to the victim. Reilly, 664 F.3d at 42. Even then,
however, it can still poise the victim to endure the kind of
future harm that qualifies as “imminent.”
Indeed, allegations of future injury “suffice if the
threatened injury is ‘certainly impending’ or there is a
8
‘substantial risk’ that the harm will occur.” Susan B. Anthony
List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v.
Amnesty Int’l USA, 568 U.S. 398, 414 n.5 (2013)). A
substantial risk means a “‘realistic danger of sustaining a direct
injury.’” Pennell v. City of San Jose, 485 U.S. 1, 8 (1988)
(quoting Babbitt v. United Farm Workers Nat’l Union, 442
U.S. 289, 298 (1979)). While plaintiffs are not required “to
demonstrate that it is literally certain that the harms they
identify will come about,” a “possible future injury”—even
one with an “objectively reasonable likelihood” of occurring—
is not sufficient. Clapper, 568 U.S. at 409-10, 414 n.5
(emphasis omitted).
In Reilly, we considered whether an alleged risk of
future identity theft or fraud stemming from a data breach in
which an unknown hacker potentially accessed sensitive
personal and financial information from a company’s network
was sufficiently imminent for purposes of standing. 664 F.3d
38 (3d Cir. 2011). We held that it was not. We observed that
the injury alleged was a future injury as opposed to a present
injury. Id. at 42. Consistent with Susan B. Anthony List, that
an injury will occur in the future is not fatal to standing. 573
U.S. at 158. But where the future injury is also hypothetical,
there can be no imminence and therefore no injury-in-fact.
Because the plaintiffs in Reilly alleged a future,
hypothetical risk of identity theft or fraud, we concluded that
they had not suffered an injury-in-fact. Specifically, the risk
was “dependent on entirely speculative, future actions of an
unknown third-party.” 664 F.3d at 42. Further, we could not
“describe how the [Appellants] will be injured . . . without
beginning our explanation with the word ‘if’: if the hacker read,
copied, and understood the hacked information, and if the
9
hacker attempts to use the information, and if he does so
successfully.” Id. at 43.
In holding that the Reilly plaintiffs lacked standing, we
did not create a bright line rule precluding standing based on
the alleged risk of identity theft or fraud. Such a rule would
require plaintiffs to wait until they had sustained an actual
injury to bring suit. This would directly contravene the
Supreme Court’s holding in Susan B. Anthony List, which
authorizes suits based on a “‘substantial risk’ that the harm will
occur.” 573 U.S. at 158 Instead, Reilly requires consideration
of whether an injury is present versus future, and imminent
versus hypothetical.
Courts rely on a number of factors in determining
whether an injury is imminent—meaning it poses a substantial
risk of harm—versus hypothetical in the data breach context.
These non-exhaustive factors can serve as useful guideposts,
with no single factor being dispositive to our inquiry. Among
them is whether the data breach was intentional. See, e.g.,
McMorris v. Carlos Lopez & Assocs., 995 F.3d 295, 301-03
(2d Cir. 2021) (holding that the intentional nature of an attack
renders standing more likely); Pisciotta v. Old Nat’l Bancorp,
499 F.3d 629, 632 (7th Cir. 2007) (finding standing where a
breach was “sophisticated, intentional and malicious”); In re
U.S. Off. of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42,
58-59 (D.C. Cir. 2019) (noting that “hackers targeted—and
extracted data”); In re Zappos.com, Inc., 888 F.3d 1020, 1029
n.13 (9th Cir. 2018) (emphasizing that hackers “specifically
targeted” the data to distinguish from a case in which there was
no substantial risk of identity theft).
10
Courts also consider whether the data was misused.4
See, e.g., McMorris, 995 F.3d at 301-02 (holding that misuse
cuts towards standing); Krottner v. Starbucks Corp., 628 F.3d
1139, 1142-43 (9th Cir. 2010) (finding standing where a laptop
with personal unencrypted data was stolen and a plaintiff
alleged that someone “attempted to open a bank account in his
name”); Remijas v. Neiman Marcus Grp., 794 F.3d 688, 692-
94 (7th Cir. 2015) (finding standing where plaintiff alleged that
personal data had “already been stolen” and that 9,200 people
had “incurred fraudulent charges”).
Of note, misuse is not necessarily required. The
Seventh Circuit has found standing despite no allegations of
misuse, holding that it was sufficient that a data breach
“increas[ed] the risk of future harm that the plaintiff would
have otherwise faced, absent the defendant’s actions.”
Pisciotta, 499 F.3d at 634.
Further, courts consider whether the nature of the
information accessed through the data breach could subject a
plaintiff to a risk of identity theft. See, e.g., McMorris, 995
F.3d at 302. For instance, disclosure of social security
4
In accordance with Spokeo, Inc. v. Robins, which provides
that “named plaintiffs who represent a class ‘must allege and
show that they personally have been injured,’” our inquiry
should focus on the misuse of information particular to the
plaintiff—not other members of the class. 578 U.S. 330, 338
n.6 (2016) (quoting Simon v. E. Ky. Welfare Rts. Org., 426 U.S.
26, 40 n.20 (1976)); but see McMorris v. Carlos Lopez &
Assocs., 995 F.3d 295, 301-02 (2d Cir. 2021) (holding that any
misuse of the data, even if the class representative has not yet
been affected, cuts towards standing).
11
numbers, birth dates, and names is more likely to create a risk
of identity theft or fraud. Id. (citing Attias v. CareFirst, Inc.,
865 F.3d 620, 628 (D.C. Cir. 2017)). By contrast, the
disclosure of financial information alone, without
corresponding personal information, is insufficient. See, e.g.,
In re SuperValu, Inc., 870 F.3d 763, 770-71 (8th Cir. 2017);
Tsao v. Captiva MVP Rest. Partners, 986 F.3d 1332, 1343
(11th Cir. 2021). This is because financial information alone
generally cannot be used to commit identity theft or fraud. See
In re SuperValu, Inc., 870 F.3d at 770-71.
b. Injury-in-fact: Concrete
The injury-in-fact prong of the standing analysis also
requires that the alleged injury be “concrete,” meaning “real,
and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340
(2016) (internal quotation marks omitted); see Lujan, 504 U.S.
at 560
The Supreme Court recently clarified in TransUnion
LLC v. Ramirez that “[c]entral to assessing concreteness is
whether the asserted harm has a ‘close relationship’ to a harm
traditionally recognized as providing a basis for a lawsuit in
American courts—such as physical harm, monetary harm, or
various intangible harms.” 141 S. Ct. at 2200 (citing Spokeo,
578 U.S. at 340-41). The fact that an injury is intangible—that
is, it does not represent a purely physical or monetary harm to
the plaintiff—does not prevent it from nonetheless being
concrete, as various intangible harms have been “traditionally
recognized as providing a basis for lawsuits in American
courts.” Id. at 2204 (citing Spokeo, 578 U.S. at 340-41). For
example, certain privacy harms, like the disclosure of private
information and intrusion upon seclusion, though intangible,
have long given rise to tort claims. Id.
12
The first step in assessing concreteness is to ask whether
the asserted harm is adequately analogous to a harm
traditionally recognized as giving rise to a lawsuit. In the data
breach context, there are several potential parallels to harms
traditionally recognized at common law, depending on the
precise theory of injury the plaintiff puts forward. For
example, if the theory of injury is an unauthorized exposure of
personally identifying information that results in an increased
risk of identity theft or fraud, that harm is closely related to that
contemplated by privacy torts that are “well-ensconced in the
fabric of American law.” In re Horizon Healthcare Servs. Inc.
Data Breach Litig., 846 F.3d 625, 638-39 (3d Cir. 2017)
(quoting David A. Elder, Privacy Torts § 1:1 (2016)).5 Though
such an injury is intangible, it is nonetheless concrete.
5
At argument, ExecuPharm contended that any analogies to
the traditional privacy torts fail because the stolen data here
was not the sort of inherently private information that could
have given rise to a successful privacy claim at common law.
For example, the “private facts” contemplated in the tort of
public disclosure of private facts would not include the
transactional employee data that was exposed here.
Even if we were to accept the premise that this particular
combination of stolen information could not form the basis for
common law privacy tort liability—and we have no occasion
to address that issue here—this mistakes the nature of the
inquiry required for an assessment of Article III standing. In
looking for a common law analog to an asserted theory of
harm, “we do not require an exact duplicate.” TransUnion
LLC v. Ramirez, 141 S. Ct. 2190, 2209 (2021). Indeed, in
TransUnion itself, the Supreme Court cites Davis v. Fed.
Election Comm’n, in which the information disclosed was only
13
TransUnion also made clear, though, that the mere
existence of a common law analog for the asserted harm does
not necessarily end our inquiry. In a suit premised on the
“mere risk of future harm”—that is, where the alleged injury-
in-fact is “imminent” rather than “actual”—we must also
consider the type of relief sought. TransUnion LLC, 141 S. Ct.
at 2210-11. Where the plaintiff seeks injunctive relief, the
allegation of a risk of future harm alone can qualify as concrete
as long as it “is sufficiently imminent and substantial.” Id. at
2210 (citing Clapper, 568 U.S. at 414 n.5). However, where
the plaintiff seeks only damages, something more is required.
Specifically, that plaintiff can satisfy concreteness where “the
exposure to the risk of future harm itself causes a separate
concrete harm.” Id. at 2211.
the fact that the plaintiff had spent a certain amount of personal
funds in his campaign, 554 U.S. 724, 733 (2008), as a case in
which the asserted intangible harm was concrete because it was
closely related to the “disclosure of private information.”
TransUnion LLC, 141 S. Ct. at 2204.
Likewise, we are content for now that the exposure of the type
of information that was alleged here—information employees
would normally choose to keep to themselves and would
reasonably not want to make publicly available—and the
resulting substantial risk of identity theft or fraud is a harm that
bears at least a “close relationship” to harms traditionally
recognized in privacy torts. Id. at 2208 (citing Spokeo, 578
U.S. at 341). Accordingly, the asserted injury supports Article
III standing—and whether a plaintiff has successfully made out
claims under a particular cause of action is a separate question.
14
The Supreme Court did not reach the question of what
separate harms might qualify as concrete to support a
substantial-risk theory of future harm in an action for damages,
but it did indicate that “a plaintiff’s knowledge that he or she
is exposed to a risk of future . . . harm could cause its own
current emotional or psychological harm,” which could be
sufficiently analogous to the tort of intentional infliction of
emotional distress. Id. at 2211 n.7.
Following TransUnion’s guidance, we hold that in the
data breach context, where the asserted theory of injury is a
substantial risk of identity theft or fraud, a plaintiff suing for
damages can satisfy concreteness as long as he alleges that the
exposure to that substantial risk caused additional, currently
felt concrete harms. For example, if the plaintiff’s knowledge
of the substantial risk of identity theft causes him to presently
experience emotional distress or spend money on mitigation
measures like credit monitoring services, the plaintiff has
alleged a concrete injury.
III. Analysis
We exercise de novo review over the District Court’s
dismissal of a complaint for lack of subject matter jurisdiction.
Horizon Healthcare, 846 F.3d at 632.
Clemens’s complaint asserts contract, tort, and
secondary contract claims—each based on the same underlying
facts. “[A] plaintiff must demonstrate standing for each claim
he seeks to press.” DaimlerChrysler Corp. v. Cuno, 547 U.S.
332, 352 (2006). Accepting the well-pleaded factual
allegations in Clemens’s complaint as true, we hold that
Clemens has standing to assert her contract, tort, and secondary
15
contract claims. Her alleged injuries are sufficiently imminent
and concrete to qualify as injuries-in-fact.
A. Contract Claims
The District Court erred in dismissing Clemens’s
contract claims, which are raised in Counts III (breach of
implied contract) and IV (breach of contract). These claims
arise from her employment agreement with ExecuPharm.
When Clemens provided ExecuPharm with her sensitive
personal information upon hire, ExecuPharm expressly
contracted to “take appropriate measures to protect the
confidentiality and security” of this information in Clemens’s
employment agreement. J.A. 40-41 ¶¶ 57-58. Clemens alleged
that ExecuPharm breached this express provision when it
failed to adequately protect her information, allowing CLOP to
steal sensitive employee information, hold it for ransom, and
publish it on the Dark Web. Moreover, Clemens has alleged
an injury stemming from the breach—the risk of identity theft
or fraud—that is sufficiently imminent and concrete.6
As employment agreements have become routine,
information security provisions like the one in the instant case
have assumed a new prominence. Likewise, the failure to
uphold these provisions—particularly in the digital age—can
yield uniquely drastic consequences. Namely, victims of a data
breach must live with the perpetual, well-founded fear and risk
6
Because Clemens has alleged an injury separate and apart
from the breach of contract itself, we have no occasion to reach
her additional argument that the breach of contract alone is a
sufficiently imminent and concrete injury that confers standing
for her to raise her contract claims.
16
that hackers will misuse their data. The only way to allay those
concerns is to invest time and money into precautionary
measures that could mitigate the potential misuse, like
changing one’s banking information. But there is no guarantee
that mitigative measures will be effective—especially given
that some information, such as our names and social security
numbers, generally stay with us for life.
In Reilly, we had occasion to discuss the contours of the
injury-in-fact requirement in the data breach context. This
time, the alleged injury-in-fact is far more imminent. Whereas
Reilly involved an unknown hacker who potentially gained
access to sensitive information, 664 F.3d at 42-43; here, a
known hacker group named CLOP accessed Clemens’s
sensitive information. CLOP is a sophisticated ransomware
group that is notorious for encrypting companies’ internal data
and placing in every digital folder a text file called
“ClopReadMe.txt” that contains a message demanding
ransom. J.A. 24-25 ¶ 14. These attacks are particularly
threatening given that, according to a data specialist, there are
“no known decryption tools for CLOP ransomware.” J.A. 35
¶ 40.
In this instance, CLOP launched its signature attack
against ExecuPharm: it encrypted ExecuPharm’s information
and held it for ransom. Further, while the injury to the
plaintiffs in Reilly depended upon a string of hypotheticals
being borne out, 664 F.3d at 43, CLOP has already published
Clemens’s data on the Dark Web, a platform that facilitates
criminal activity worldwide. Clemens has alleged that the
Dark Web is “most widely used as an underground black
market where individuals sell illegal products like drugs,
weapons, counterfeit money, and sensitive stolen data that can
be used to commit identity theft or fraud.” J.A. 25 ¶ 15.
17
Because we can reasonably assume that many of those
who visit the Dark Web, and especially those who seek out and
access CLOP’s posts, do so with nefarious intent, it follows
that Clemens faces a substantial risk of identity theft or fraud
by virtue of her personal information being made available on
underground websites. This set of facts clearly presents a more
imminent injury than the ones we deemed to establish only a
hypothetical injury in Reilly.
Adopting and applying the factors that our Sister
Circuits consider in determining imminence in the data breach
context confirms this point. CLOP intentionally gained access
to and misused the data: it launched a sophisticated phishing
attack to install malware, encrypted the data, held it for ransom,
and published it. See McMorris, 995 F.3d at 301-03; Remijas,
794 F.2d at 693-94; Attias, 865 F.3d at 628-29. The data was
also the type of data that could be used to perpetrate identity
theft or fraud. Not only did it contain financial information—
which, on its own, could subject the breach victims to credit
card fraud—but it also contained social security numbers, dates
of birth, full names, home addresses, taxpayer identification
numbers, banking information, credit card numbers, driver’s
license numbers, sensitive tax forms, and passport numbers.
This combination of financial and personal information is
particularly concerning as it could be used to perpetrate both
identity theft and fraud. See McMorris, 995 F.3d at 302; cf. In
re SuperValu, Inc., 870 F.3d at 770-71 (noting that financial
information, without accompanying personally identifying
information, is unlikely to give rise to identity theft).
Together, these factors show that Clemens has alleged
a “‘substantial risk’ that the harm will occur” sufficient to
establish an “imminent” injury. Anthony List, 573 U.S. at 158
18
(quoting Clapper, 568 U.S. at 414 n.5).7 Further, that injury is
concrete, because the harm involved is sufficiently analogous
to harms long recognized at common law like the “disclosure
of private information.” TransUnion LLC, 141 S. Ct. at 2204.
And although the substantial risk of identity theft is a risk of
future harm and this is a suit for damages, which may under
other circumstances pose a problem for concreteness, id. at
2210-11, Clemens has alleged several additional concrete
harms that she has already experienced as a result of that risk
(that is, her emotional distress and related therapy costs and the
time and money involved in mitigating the fallout of the data
breach). Thus, her injury is also “concrete.”
In addition to proving injury-in-fact, standing also
requires Clemens to prove traceability and “that the injury
would likely be redressed by the requested judicial relief.”
Thole, 140 S. Ct. at 1618. Traceability means that the injury
was caused by the challenged action of the defendant as
opposed to an independent action of a third party. Lujan, 504
U.S. at 560. We have yet to articulate a single standard for
establishing this “causal relationship.” See Khodara Env’t,
Inc. v. Blakely, 376 F.3d 187, 195 (3d Cir. 2004). Instead, we
have held that but-for causation is sufficient to satisfy
traceability. See, e.g., Edmonson v. Lincoln Nat’l Life Ins. Co.,
725 F.3d 406, 418 (3d Cir. 2013). So, too, is concurrent
7
At Oral Argument, ExecuPharm agreed that, in the abstract,
facts satisfying the imminence inquiry yet falling short of
actual harm could confer standing in a data breach case.
However, it was unable to articulate such a scenario. If the
facts in this case—which fall short of actual harm—do not
meet the test for imminence, we would be hard pressed to
conjure up a set of facts that would.
19
causation. See, e.g., Const. Party of Pa. v. Aichele, 757 F.3d
347, 366 (3d Cir. 2014).
Here, Clemens has alleged facts that establish
traceability, at least at the pleading stage. Specifically, she has
identified her injuries as “a direct and proximate result of
Defendants’ breach” of contract: ExecuPharm’s failure to
safeguard her information enabled CLOP to publish it on the
Dark Web as part of the stolen dataset of ExecuPharm and
Parexel employee information. J.A. 65 ¶ 141, J.A. 66 ¶ 146.
Likewise, Clemens satisfied redressability. As we observed in
Reilly, the injuries caused by a data breach are “easily and
precisely compensable with a monetary award,” 664 F.3d at
45-46, and Clemens is seeking those damages to compensate
for her losses here. This traceability and redressability analysis
applies with equal force to the tort and secondary contract
claims as well.
We will vacate the District Court’s dismissal regarding
these claims and remand for a consideration of the merits of
these claims.
B. Tort Claims
In addition, the District Court erred in dismissing
Clemens’s tort claims, which are raised in Counts I
(negligence) and II (negligence per se). The tort claims have
the same factual genesis as the contract claims: namely, that
ExecuPharm breached its duty to adequately safeguard
sensitive employee information, which allowed CLOP to steal
and misuse the data, and subjected Clemens to a substantial
risk of identity theft or fraud.
20
In an increasingly digitalized world, an employer’s duty
to protect its employees’ sensitive information has
significantly broadened. Information security is no longer a
matter of keeping a small universe of sensitive, hard-copy
paperwork under lock and key. Now, employers maintain
massive datasets on digital networks. In order to protect the
data, they must implement appropriate security measures and
ensure that those measures continue to comply with ever-
changing industry standards.
Failure to satisfy this duty could leave employer
networks vulnerable to data breach, subjecting data breach
victims to a unique kind of harm: the perpetual risk of identity
theft or fraud, necessitating the investment of time and money
to hopefully mitigate that risk. With rare exception, where
multiple pieces of personally identifying information about a
given consumer are stolen and then publicized, one can draw a
reasonable inference that the victims of the data breach face an
imminent risk of identity theft or fraud. When that
information is made available for download on the Dark
Web—a platform that exists primarily to facilitate illegal
activity—the risk that a criminal will access it and use it for a
nefarious purpose is particularly acute.
As discussed supra in Section III Part A, Clemens’s
alleged risk of identity theft or fraud is sufficiently imminent.
Compared to Reilly, the risk is not hypothetical: a known
hacking group intentionally stole the information, misused it,
ultimately published it on the Dark Web, and the sensitive
information is the type that could be used to perpetrate identity
theft or fraud. Consistent with Anthony List, Clemens cannot
be required to wait until she has experienced actual identity
theft or fraud before she can sue; the “substantial risk” that she
has established is enough. 573 U.S. at 158. Her asserted injury
21
is also concrete, as intangible harms like the disclosure of
private information qualify as concrete. See TransUnion LLC,
141 S. Ct. at 2204.
Because Clemens has sufficiently asserted her standing
to bring her tort claims, we will vacate the District Court’s
dismissal and remand for a consideration of the merits of those
claims.
C. Secondary Contract Claims
Finally, the District Court erred in dismissing
Clemens’s secondary contract claims which are raised in
Counts V (breach of fiduciary duty) and VI (breach of
confidence). The breach of the duties underlying these claims
and the resulting harm are based on the same facts as the
contract and tort claims. As with the prior claims, the District
Court identified the failure to allege an imminent injury as fatal
to standing.
Because we have rejected the contention that a risk of
identity theft or fraud cannot qualify as sufficiently imminent,
and hold that Clemens has alleged an injury-in-fact, we
likewise will vacate the District Court’s decision and remand
for a determination of the merits of these claims.
IV. Conclusion
Clemens has standing to assert her contract, tort, and
secondary contract claims. For all claims, she has alleged a
future injury—the risk of identity theft or fraud—that is
sufficiently imminent. The breach was conducted by a known
hacking group CLOP, which intentionally stole the
information, held it for ransom, and published it to the Dark
22
Web, thereby making it accessible to criminals worldwide.
The nature of the information—a combination of personal and
financial data—is the type that can be used to perpetrate
identity theft or fraud. Given that intangible harms like the
publication of personal information can qualify as concrete,
and because plaintiffs cannot be forced to wait until they have
sustained the threatened harm before they can sue, the risk of
identity theft or fraud constitutes an injury-in-fact.
Accordingly, we will vacate the judgment of the District Court
on all counts and remand for consideration of the merits.
23
Clemens v. ExecuPharm Inc., No. 21-1506
PHIPPS, Circuit Judge, concurring in the judgment
The Majority Opinion labors through the modern tripartite
test for Article III standing and concludes that Jennifer
Clemens has standing to assert common-law claims for
negligence, breach of contract, breach of confidence, and
breach of fiduciary duty. The modern test for Article III
standing, however, typically governs claims seeking to
vindicate constitutional or statutory rights.1 It has always been
the rule that a litigant has standing in federal court to pursue a
cause of action that was recognized as well suited for judicial
resolution at the time of the Constitution’s ratification:
When a suit is made of “the stuff of the
traditional actions at common law tried by the
courts at Westminster in 1789” and is brought
within the bounds of federal jurisdiction, the
responsibility for deciding that suit rests with
Article III judges in Article III courts.
1
See, e.g., Spokeo, Inc. v. Robins, 578 U.S. 330, 338–39
(2016); Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409
(2013); Summers v. Earth Island Inst., 555 U.S. 488, 493
(2009); Friends of the Earth, Inc. v. Laidlaw Env’t Servs.
(TOC), Inc., 528 U.S. 167, 180–81 (2000); Lujan v. Defs. of
Wildlife, 504 U.S. 555, 560–61 (1992); Allen v. Wright,
468 U.S. 737, 751 (1984); Valley Forge Christian Coll. v. Ams.
United for Separation of Church & State, Inc., 454 U.S. 464,
472 (1982); see also 20 Charles Alan Wright & Mary Kay
Kane, Federal Practice and Procedure: Federal Practice
Deskbook § 14 (2d ed. Apr. 2022 update) (“The law of standing
is almost exclusively concerned with public-law questions
involving determinations of constitutionality and review of
administrative or other governmental action.”).
Stern v. Marshall, 564 U.S. 462, 484 (2011) (citation omitted)
(quoting N. Pipeline Constr. Co. v. Marathon Pipe Line Co.,
458 U.S. 50, 90 (1982) (Rehnquist, J., concurring in
judgment)); see also Ariz. Christian Sch. Tuition Org. v. Winn,
563 U.S. 125, 132 (2011) (“[Article III] restricts the federal
judicial power ‘to the traditional role of the Anglo-American
courts.’” (quoting Summers v. Earth Island Inst., 555 U.S. 488,
492 (2009))); Commodity Futures Trading Comm’n v. Schor,
478 U.S. 833, 854 (1986) (“[P]rivate, common law rights were
historically the types of matters subject to resolution by
Article III courts.”); N. Pipeline Constr. Co., 458 U.S. at 86
n.39 (plurality opinion) (stating that, “in the Framers’ view, the
tasks of [Article III] courts, for which independence was an
important safeguard, included . . . matters of common law”);
Tenn. Elec. Power Co. v. Tenn. Valley Auth., 306 U.S. 118, 137
(1939) (holding that litigants have standing when “the right
invaded is a legal right,” such as “one of property, one arising
out of contract, [or] one protected against tortious invasion”);
Murray’s Lessee v. Hoboken Land & Improvement Co.,
59 U.S. 272, 284 (1855) (explaining that “any matter which,
from its nature, is the subject of a suit at the common law, or
in equity” is within “judicial cognizance”).2
The modern test builds on that principle by using
traditionally recognized causes of action as a foundation for its
comparative analysis. The premise of the test is that litigants
2
See also Erwin Chemerinsky, Federal Jurisdiction 74 (8th ed.
2020) (“Injury to rights recognized at common law – property,
contracts, and torts – are sufficient for standing purposes.”);
Cass R. Sunstein, Standing and the Privatization of Public
Law, 88 Colum. L. Rev. 1432, 1439 (1988) (explaining that
“the existence of an interest protected at common law [has
been] sufficient to confer standing”).
2
have standing for claims traditionally recognized as well suited
for judicial resolution. See TransUnion LLC v. Ramirez,
141 S. Ct. 2190, 2204 (2021) (explaining that the concreteness
component of the injury-in-fact element requires that a
statutory cause of action bear a “close relationship” to a
“historical or common-law analogue”).3 Thus, the modern test
for Article III standing operates as a supplement to, not a
substitute for, the rule that a litigant has Article III standing to
bring a traditionally recognized cause of action in federal
court.4
3
See also Hollingsworth v. Perry, 570 U.S. 693, 700 (2013)
(“As used in the Constitution, [‘case’ and ‘controversy’] do not
include every sort of dispute, but only those ‘historically
viewed as capable of resolution through the judicial process.’”
(quoting Flast v. Cohen, 392 U.S. 83, 95 (1968)));
DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 (2006)
(“[W]e must find that the question is presented in a ‘case’ or
‘controversy’ that is, in James Madison’s words, ‘of a Judiciary
Nature.’” (quoting 2 Records of the Federal Convention of
1787 430 (Max Farrand ed., 1966))); Schlesinger v. Reservists
Comm. to Stop the War, 418 U.S. 208, 220–21 (1974)
(explaining that federal courts can resolve only disputes that
take “a form traditionally capable of judicial resolution”).
4
See F. Andrew Hessick, Standing, Injury in Fact, and Private
Rights, 93 Cornell L. Rev. 275, 277 (2008) (“The purpose of
the factual injury requirement is to ensure that plaintiffs are
asserting their own private rights. The requirement therefore
is superfluous in cases alleging the violation of a private
right.”); 20 Charles Alan Wright & Mary Kay Kane, Federal
Practice and Procedure: Federal Practice Deskbook § 14 (2d
ed. Apr. 2022 update) (“The person suing for breach of contract
or for a tort must be found to be the real party in interest, but
in practice those suits are brought only by a person harmed by
the supposed wrong, and standing to sue is self-evident. It is
3
The claims that Clemens pursues here – for negligence,
breach of contract, breach of confidence, and breach of
fiduciary duty – are traditional causes of action that were
recognized as well suited for judicial resolution at the time of
the Constitution’s adoption.5 She therefore has standing. Yet
by applying the modern test for Article III standing when it is
unnecessary to do so, the Majority Opinion gives the mistaken
impression that the modern test replaces the original
understanding of what constitutes a case or controversy subject
to resolution in federal court.6
only when the question is of a public nature that the interested
bystander is likely to attempt suit.”).
5
See Robert J. Kaczorowski, The Common-Law Background
of Nineteenth-Century Tort Law, 51 Ohio St. L.J. 1127, 1129
(1990) (explaining that some negligence claims were “in the
common law for centuries,” while others “primarily emerged
in the last quarter of the seventeenth century”); Harold J.
Berman & Charles J. Reid, Jr., The Transformation of English
Legal Science: From Hale to Blackstone, 45 Emory L.J. 437,
460–61 (1996) (stating that “the common-law courts in the late
seventeenth and early eighteenth centuries expanded the forms
of action to cover . . . obligations arising from breach of
contract”); Neil M. Richards & Daniel J. Solove, Privacy’s
Other Path: Recovering the Law of Confidentiality, 96 Geo.
L.J. 123, 136 (2007) (describing how “[l]egal remedies for
divulging . . . confidential information began to emerge as
early as the eighteenth century,” when “English courts of
equity . . . fashion[ed] an action for breach of confidence”);
Leonard I. Rotman, Fiduciary Law’s “Holy Grail”:
Reconciling Theory and Practice in Fiduciary Jurisprudence,
91 B.U. L. Rev. 921, 922 (2011) (“Fiduciary law has been a
part of the common law tradition since its crystallization in the
landmark case of Keech v. Sandford in 1726.”).
6
In footnote three, the Majority Opinion asserts that its
approach is consistent with binding precedent, but despite the
4
I cannot join that analysis, and I respectfully concur in the
judgment only. It suffices for her Article III standing that
Clemens brings causes of action “of the sort traditionally
amenable to, and resolved by, the judicial process.”
Uzuegbunam v. Preczewski, 141 S. Ct. 792, 798 (2021)
(quoting Vt. Agency of Nat. Res. v. United States ex rel.
Stevens, 529 U.S. 765, 774 (2000)); see also Stern, 564 U.S. at
494 (stating that “the most prototypical exercise of judicial
power” is a court’s adjudication of “a common law cause of
action”). Nothing more is needed.
abundance of precedent on Article III standing, the Majority
Opinion identifies no Supreme Court case applying the modern
test to a traditionally recognized cause of action.
5