Court Dismisses Class Action Relating to Loss of Backup Tapes and Holds Plaintiffs’ Lacked Standing And Had Not Asserted Legally Cognizable Claims

Blogs, Cyber Risks, Liabilities, Insurance and Litigation

Between February and April, 2008, an archive transport company for the Bank of New York Mellon Corporation (BNY), while transporting backup storage tapes, lost several tapes from its truck, including “’a BNY metal box with six to ten unencrypted computer back up tapes’” containing personal information, including names, addresses, financial data and Social Security numbers. Id. at *2. The missing tapes allegedly “‘contained the unencrypted Sensitive Data of approximately 12.5 million individuals.’” Id. at *4.

In response, BNY notified the affected individuals that “computer tapes containing some of your personal information were lost while being transported to an off-site storage facility by our archive services vendor. “ Id. at *4. BNY offered the affected individuals 24 months of credit monitoring, $25,000 of identity theft insurance, and reimbursement for certain credit freeze costs, as well as a toll-free number to handle inquiries. Id.

Various individuals filed a class-action lawsuit, seeking remedies beyond those that BNY voluntarily provided, as well as compensatory damages. See Hammond v. The Bank of New York Mellon Corp., 08-CV-6060, 2010 WL 2643307 (S.D.N.Y. Jun. 25, 2010). 

The court in Hammond v. The Bank of New York Mellon Corp. summarized the development of the law as to these types of claims arising from data loss as being disposed in one of two ways:

While there is a split of authority as to how to analyze these cases, every court to do so has ultimately dismissed under Rule 12(b)(6) of the Federal Rules of Civil Procedure (“Fed. R.Civ.P.”) or under Rule 56 following the submission of a motion for summary judgment.

Id. at *1. The court also noted that several courts have “determined that the potential risk of identity theft resulting from the loss of personal information is not an ‘injury in fact’ within the meaning of Article III of the United States Constitution and have dismissed these cases after concluding that plaintiffs lacked ‘standing’, . . . [whereas] [o]ther courts have determined that similarly situated plaintiffs had standing but concluded, for one reason or another, that loss of identity information is not a legally cognizable claim.” Id. at *1-2. A copy of the June 25, 2010 decision in Hammond v. The Bank of New York Mellon Corp. 

The court in Hammond v. The Bank of New York Mellon Corp. applied the reasoning of both lines of cases, and held that (1) the plaintiffs lacked Article III standing because the plaintiffs’ claims were “future-oriented, hypothetical, and conjectural;” and (2) even assuming, arguendo, that the plaintiffs had standing, Plaintiffs’ alleged increased risk of identity theft is insufficient to support Plaintiffs’ substantive claims.”

In finding that the plaintiffs lacked standing, the court noted that “[n]one of the named Plaintiffs has alleged in the Complaint or adduced any evidence in discovery to suggest that their alleged injuries are more than ‘speculative’ or ‘hypothetical’. Id. at *8.

In concluding that the plaintiffs had not demonstrated any damages as a result of the tape losses, the court noted that “Plaintiffs’ principal complaint is that they have a heightened fear of having their identities stolen in the future and have, as a result, taken steps to monitor their credit more vigilantly .”

The court also rejected several common law claims, including state consumer protection law claims, holding that there could be no recovery under New York, California, Illinois, or Michigan law for a potential future loss that has not actually occurred, regardless of whether the backup tapes were lost or stolen. Id.at *13.