In In re Horizon Healthcare Servs. Inc. Data Breach Litig., 846 F.3d 625 (3d Cir. 2017), the Third Circuit decided the issue of whether a violation of statutory rights under the Fair Credit Reporting Act (“FCRA”) was a de facto injury that satisfied the concreteness requirement for standing. The dispute began when two laptops which contained sensitive personal information were stolen from Horizon Healthcare Services, a health insurer. Plaintiffs filed suit on behalf of themselves and other similarly situated persons alleging that Horizon willfully and negligently violated the FCRA by inadequately protecting their personal information. The District Court dismissed the case for lack of Article III standing, finding that none of the Plaintiffs had alleged a cognizable injury because none of them alleged that the information stolen had been used to their detriment.
The Third Circuit disagreed, vacated the order of dismissal entered by the District Court, and remanded. The Court found first that a statutory violation has long been held by the Supreme Court to cause an injury in fact and grant Article III standing, and that recent Third Circuit precedent had allowed individuals to sue to remedy violations of their statutory rights in data privacy cases, even where no additional injury was suffered. Congress had established, by passing the FCRA, that the “unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself” regardless of whether further harm results from the disclosure of such information. Clearly, the Third Circuit reasoned, the creation of a private right to enforce the provisions of the FCRA and the allowance of statutory damages for willful violations, evidenced the Congressional belief that a violation of the FCRA causes a concrete harm to consumers affected. The Court found that since the Plaintiffs in the case at bar alleged the unauthorized dissemination of their private information, they had suffered a de facto injury. The Court concluded by stating clearly that “the improper disclosure of one’s personal data in violation of FCRA is a cognizable injury for Article III standing purposes.