Concrete Injury in Data Breach and Privacy Class Actions: Evolving Standards, Experts, Discovery Strategy

Description

Large numbers of data breach and privacy class actions continue to be filed and routinely sit atop CEOs' lists of "most troubling issues." Consumers and privacy advocates uncover alleged privacy violations and substandard consumer protections on a near daily basis. TransUnion L.L.C. v. Ramirez requires plaintiffs to demonstrate "concrete injury" to maintain these actions, and there is some consensus that, at a minimum, a risk of concrete or imminent harm is required.

Nonetheless, how imminent and how severe the risk must be is not settled and may vary by jurisdiction. It may be necessary to offer evidence of its actual exploitation. In making the case for certification, plaintiffs must decide what experts to call and how those experts can quantify and reliably predict the alleged harm. Evidence of classwide liability may also assist in class certification efforts and counsel may want to pursue such early in litigation.

Defendants may want to challenge these allegations with their own experts or try to show that the alleged harms are too individualized to justify class treatment. They have strategic decisions to make regarding the scope of discovery at the certification stage, whether to challenge standing, and the types of experts to retain. Mounting a full press against plaintiffs' certification experts has proved successful in some instances but can be expensive.

Listen as this expert panel guides class action counsel through what is required to demonstrate concrete injury in a data breach/privacy class action, the experts needed by plaintiffs or defendants, and factors to be considered in assessing whether to engage in full or limited pre-certification discovery.