Home > Print > Don’t Just Do Something, Stand There

Don’t Just Do Something, Stand There

What Criminal Law Teaches Us About Article III Standing in Data Breach Cases

Data breaches of companies that expose consumer information are a pervasive and growing issue. The United States Courts of Appeals are divided over whether consumers have Article III Standing to sue the hacked organizations that did not protect their personal data. This Comment draws on insights from criminal law to argue that courts should take a more expansive view of the harm to consumers when their personal data is exposed, even where the plaintiffs cannot allege that their data has been misused. This approach would give more consumers the opportunity to have a day in court to vindicate the real but hard-to-define harms of exposure.