Although this story is from the U.S., we keep a close eye on American data protection affairs as our laws can be similar, and cases and challenges can reflect on how we may see the law here.<\/p>\n
In this big news story from the States, a recent federal appeals court in the U.S. have said that claimants can sue defendants who breach their data protection obligations for ‘fear of damage’, even if no actual damage has occurred. This can make sense, as the damage could be done at any point in the future; but this decision moves away from one Supreme Court case that said claimants needed to prove a risk of “imminent” and “concrete” injury to bring a claim.
\n<\/p>\n
The appeals court in this case heard how an intruder managed to access CareFirst Inc.’s computers and databases that contained customers’ personal information. The District Court – as the court of first instance – dismissed the case with the view that claimants couldn’t prove real injury “nor a high enough likelihood of future injury.”<\/p>\n
However, the appeals court reinstated the case, noting that the district court failed to consider the risk of harm through fear<\/strong>.<\/p>\n The panel of three judges also noted the impact breaches involving medical data theft can have on the victim’s health and life through inaccurate data belonging to one being merged with another on the same file. Without accurate records, patients may “receive improper medical care, have their insurance depleted, become ineligible for health or life insurance or become disqualified for some jobs.”<\/p>\n In passing this judgment, the appeals court also recognised that it’s not just stolen social security numbers that can put individuals at risk. Whilst the social security number is often deemed the most important identifying data for an individual, medical and other personal records can prove a “substantial risk of identity fraud”.<\/p>\n Other personal data can be misused and lead to psychological harm, loss of earnings and even direct financial loss.<\/p>\n However, not all courts are unanimous in this viewpoint.<\/p>\n A second U.S. Circuit Court of Appeal in New York dismissed one claim because she could not prove a “cognizable injury” after her credit card information was exposed during a data breach. Similar courts are reportedly of the view that data protection claims must prove that some “real” injury occurred.<\/p>\n Initially, a lower judge followed the first position of dismissing claims for ‘fear of future fraud and identity theft’. The case was later reinstated on the basis that ‘fear of what hackers may do with exposed personal data’ is a legitimate cause for a claim.<\/p>\n Chief Judge Diane Wood believes data victims have a right to be scared of potential harm: <\/p>\nRecognising substantial risks of identity theft<\/h3>\n
Verdict is out there…<\/h3>\n
Right to be concerned for future harm<\/h3>\n