Hyatt & Weber, P.A. is pleased to welcome attorney Sean Hatley to the firm’s Civil Litigation and Business Law practice groups. As part of the Civil Litigation practice group, Sean regularly advocates on behalf of individuals and businesses in commercial, medical malpractice, personal injury, real estate, insurance coverage and employment matters. In the Business Law practice group, Sean works with entrepreneurs and small-business owners to provide advice for, and assistance with, starting, buying, managing, closing and/or selling any type of business.

Prior to joining Hyatt & Weber, Sean completed a clerkship with the Honorable Michele D. Jaklitsch in the Circuit Court of Maryland for Anne Arundel County. While pursuing his J.D./M.B.A. at the University of Baltimore, Sean was a member of the American Association of Justice Trial Team, served on the executive board for the award-winning University of Baltimore Law Forum, and honed his legal skills as a law clerk for experienced litigation and business law attorneys at two law firms in the Annapolis and Baltimore area. As an undergraduate student at St. Mary’s College of Maryland, Sean captained the Men’s Varsity Lacrosse Team and served as President of the Pre-law Advisory Network.

Sean was raised in the Annapolis area and attended Archbishop Spalding High School. In his free time, Sean enjoys golfing, motorcycling and playing club lacrosse. He also volunteers his time coaching youth lacrosse and serving as Vice-President of the Spalding Lacrosse Alumni Association.

Since 1979, Hyatt & Weber, P.A. has served Annapolis, Anne Arundel County and surrounding areas of Maryland, DC and Virginia in our practice areas of: real estate, land use & zoning, business & banking, estate planning & probate, employment, maritime, commercial and civil litigation, medical malpractice and personal injury law.

With cyberattacks on the rise, so is data breach litigation initiated by plaintiffs who claim that they have been harmed by the exposure of their personal information. As a result, more and more courts are confronting the threshold issue of standing under Article III of the Constitution for these plaintiffs, and they are coming to different conclusions.

The United States Court of Appeals for the Eighth Circuit is the latest federal appellate court to rule in a case involving Article III standing for data breach litigation. In In re SuperValu, Inc. , 870 F.3d 763 (8th Cir. 2017), the Eighth Circuit held that fifteen out of sixteen plaintiffs failed to allege they had suffered identify theft and/or incurred fraudulent charges and, thus, they did not meet the Constitutional requirements for standing. The Eighth Circuit concluded that the alleged risk of some future harm was not sufficient to satisfy the standing requirements to bring a lawsuit.

SuperValu, the defendant in this case, owned and operated grocery stores across the United States. In 2014, SuperValu suffered two cyberattacks in which “[t]he hackers installed malicious software on defendants’ network that allowed them to gain access to the payment card information of defendants’ customers (hereinafter, Card Information), including their names, credit or debit card account numbers, expiration dates, card verification value (CVV) codes, and personal identification numbers (PINs).” In both instances, SuperValu issued a press release acknowledging the cyberattack and the potential theft of some customers’ Card Information, but there was no determination as to whether “such information ‘was in fact stolen.’” Following the data breach, customers who shopped at the affected SuperValu stores had to determine if their cards were compromised. They spent time reviewing the information released about the breaches and the impacted locations, and monitored account information to guard against potential fraud. Only one of the plaintiffs, however, David Holmes (“Holmes”), specifically noticed a fraudulent charge on his credit card statement following the breach. He immediately cancelled his credit card, and waited two weeks to receive a replacement card.

The customers allegedly affected by the data breach brought numerous class actions, which were later consolidated in the United States District Court for the District of Minnesota. The complaint alleged violations of state consumer protection statutes and state data breach notification statutes, negligence (including negligence per se), breach of implied contract, and unjust enrichment. SuperValu moved to dismiss the complaint, and the district court granted dismissal under Federal Rule of Civil Procedure 12(b)(1). According to the district court’s findings, all of the plaintiffs had failed to allege an injury-in-fact and, thus, they lacked standing to bring a suit. The plaintiffs appealed the court’s dismissal and the defendants cross appealed, arguing for dismissal with prejudice under Rule 12(b)(6).

On appeal, the plaintiffs took the position that the complaint “sufficiently alleged an injury in fact because the theft of their Card Information in the data breaches at defendants’ store created a substantial risk that they will suffer identity theft in the future.” They alleged “on information and belief, [that] illicit websites [were] selling their Card Information to counterfeiters and fraudsters, and that plaintiffs’ financial institutions [were] attempting to mitigate their risk.” Only one of the plaintiffs, Holmes, alleged the “actual misuse of his Card Information” as a result of the data breaches – a present injury, which he specifically argued was “causally connected to defendants’ careless security practices.”

Relying on prior cases decided by the United States Supreme Court ( Clapper v. Amnesty Int’l USA , 568 U.S. 398 (2013), and Susan B. Anthony List v. Driehaus , ­­­___ U.S. ___, 134 S. Ct. 2334 (2014)), the Eighth Circuit explained that future harm can be sufficient to establish Article III standing only if plaintiffs can “demonstrate that ‘the threatened injury is certainly impending , or there is a substantial risk that harm will occur.” (emphasis added). The Eighth Circuit was tasked with “determin[ing] whether plaintiffs’ allegations plausibly demonstrate[d] that the risk that plaintiffs [would] suffer future identity theft [was] substantial.” In support of their position that the threat of future identity theft was certainly pending or substantial, the plaintiffs relied on a 2007 Government Accountability Office (“GAO”) report. The Eighth Circuit found the GAO report unpersuasive because, even though the report acknowledged some data breach incidents could result in identity theft, “it conclude[d] based on the ‘available data and information’ that ‘most breaches have not in fact resulted in detected incidents of identity theft.” The court further noted the possibility that in some years, “more detailed factual support for plaintiffs’ allegations of future injury” may become available, but the complaint, as it stood, alleged a “mere possibility,” which was insufficient for standing. The Eighth Circuit also rejected the plaintiffs’ argument that the time spent and the costs incurred to “mitigate their risk of identity theft [by] reviewing information about the breach and monitoring their account information” amounted to an injury in fact. Because plaintiffs had failed to allege a substantial risk of future identity theft, the court concluded that the costs incurred by the plaintiffs were to protect against a “ speculative threat[,]” and did not create an injury for standing purposes. (emphasis added).

The Eighth Circuit, however, found that Holmes met the threshold requirement for Article III standing by alleging the actual “misuse of his Card Information.” The court concluded that the complaint, as it related to Holmes, “contained sufficient allegations to show that [he] suffered an injury in fact, fairly traceable to defendants’ security practices, and likely to be redressed by a favorable judgment [and, thus,] Holmes had standing under Article III’s case or controversy requirement.”

The Eighth Circuit acknowledged that other courts, such as the United States Court of Appeals for the District of Columbia Circuit (written about here ) and the United States Court of Appeals for the Seventh Circuit, had reached different conclusions on standing for data breach litigation. In those cases, the courts found it plausible to infer that hackers stole consumers’ private information with the intent to make fraudulent charges or steal their identities and, thus, the data breach had created a substantial risk of harm to those plaintiffs because their personal information had been exposed. The Eighth Circuit, however, followed the analysis of the United States Court of Appeals for the Fourth Circuit ( Beck v. McDonald , 848 F.3d 262 (4th Cir. 2017)), and declined to make such an inferential step that a breach would result in future harm. In Beck , the Fourth Circuit explained even if the statistics relied upon by plaintiffs were true, which purported to show that 33% of individuals impacted in the data breach would suffer identity theft, it necessarily followed that 66% would not suffer such harm, which was insufficient to establish a substantial risk of harm necessary for Article III standing.

As cyberattacks increase and more plaintiffs initiate data breach litigation, courts will continue to grapple with these different positions on what data breach plaintiffs must allege to establish a substantial risk of future harm. In the meantime, however, the Eighth Circuit’s holding in In re SuperValu shows that courts are not moving uniformly on the issue of Article III standing as it relates to data breach litigation and, as a result, some circuits are more plaintiff friendly while others are not.

If you have any questions regarding this post, please contact Stephen B. Stern at sstern@hwlaw.com or (410) 260-6585 or Amitis Darabnia at adarabnia@hwlaw.com or (410) 260-6592.

DISCLAIMER: This Blog/Website is for educational purposes and to provide readers with general information about developments in the law. This Blog/Website is not intended and should not be relied on for legal advice. This Blog/Website does not constitute an advertisement for legal services and it does not endorse, promote, or recommend the products, services, or websites of any third party. Reading, reviewing, or any other use of this Blog/Website does not create an attorney-client relationship between the reader and the firm or any attorney at the firm.

Join Hyatt & Weber Partner Stephen Stern in NYC on November 2-3, 2017 as he participates on a panel on Insurance Claims Lifecycle Management, presented by the New York State Bar Association Corporate Counsel Section.

The Corporate Counsel Institute brings together a distinguished faculty to address the wide array of issues important to in-house counsel and outside practitioners. The Institute faculty will cover vital topics, including employment law; maximizing value and reducing cost of corporate legal services; predictive technology in e-discovery; government requests, subpoenas, investigations; crisis management, ethics and privilege issues; trademark branding and more.

Date: November 2, 2017
Location: The Cornell Club, 6 E. 44th Street, New York, NY
Session Details: 3:30 – 4:20 p.m. Insurance Claims Lifecycle Management
Panelists: Stephen Stern, Esq., Hyatt & Weber (Annapolis, MD) Jonathan Hardin, Esq., Counsel, Perkins Coie (Washington, DC) Jesse Dunbar, Esq., Partner, Barclay Damon LLP Michael Mendelson, Esq., Partner, Wissing Miller LLP Linda Van Baars, Senior Vice President and Regional Risk Control Director at USI Insurance Services

More information: http://www.nysba.org/workarea/DownloadAsset/?id=76562

The attorneys and staff at Hyatt & Weber have been busy out in our Annapolis and Anne Arundel County community this fall.

On September 28, the Central Maryland Chamber held their annual Tour & Taste. First, they provided a bus tour of up-and-coming development projects in Anne Arundel County. The evening continued at Live Casino with a “taste” of some of the area’s delicious restaurants. Chamber board attorney and Hyatt & Weber partner Stephen Stern was joined by paralegal Amanda Smith and marketing director Alice Simons at this popular event.

On the same night, Hyatt & Weber attorneys Chris Buck and Steven Heinl represented the firm at Historic Annapolis’ 4th annual Blazers Bourbon Cigars event at the William Paca House & Gardens. Guests enjoyed bourbon, scotch and rum tastings, along with cigars, delightful food from the area’s top chefs, and an array of vendors. Hyatt & Weber is a proud sponsor of this event and of Historic Annapolis, whose mission is to preserve and protect the historic places, objects, and stories of Maryland’s capital city, and provide engaging experiences that connect people to the area’s diverse heritage.

The fall celebrations continued on our own Green Roof on October 4th, as we were joined by our local legal and professional colleagues for an absolutely stunning night in Annapolis. These semi-annual events overlooking the Annapolis skyline have become a highly-anticipated local tradition, with delicious food from Mission BBQ, cool beverages and great company. We hope you can join us for the next one!

On October 12, the firm was pleased to support the 5th annual Anne Arundel Community College Foundation’s All-In fundraiser, held at Live Casino. This annual event has now raised over $500,000 in support of student scholarships and academic programs, helping to maintain AACC’s standing as one of the best community colleges in the U.S. Attorney Steven Heinl is pleased to continue the firm’s long tradition of serving as a member of the board of trustees for the Foundation.

Check back to our News & Events page for more community events.

Before surgery, a doctor has a duty to completely inform the patient about the proposed procedure and the risks that are associated with it. “Informed Consent,” gives the patient the ability to make an informed decision with as much information available regarding risks and alternatives about whether or not to undergo the procedure.

Components of Informed Consent

Nature and Purpose of Proposed Procedure

In order for the patient to be fully informed about a specific procedure, the doctor needs to outline precisely what the diagnosis is that is causing the procedure to be necessitated. The doctor should then explain how the procedure will be performed, and exactly how it will help or resolve the patient’s diagnosis.

Risks and Benefits of Proposed Procedure

Every procedure comes with risks. These risks can vary in frequency and severity. Before consenting to a specific procedure, it always important to have an understanding of both the risks and the benefits. The doctor should explain what could go wrong during the procedure and the effects that could follow, as well as the benefits, so that the patient can weigh the risks and benefits for themselves.

Alternatives and Risks and Benefits of the Alternatives

Very rarely is the proposed procedure the only available option. The doctor should always inform the patient on any alternative procedures or treatments before the patient agrees..

Risks and Benefits of Not Having Procedure

There is always an option to refuse treatment. The doctor is responsible for explaining the risks and benefits that are associated with the patient’s choice to refuse treatment.

Why It Matters

Informed consent is a doctor’s permission to perform a procedure, with knowledge that the patient understands exactly what is going to or may happen. If a procedure results in an error or an anticipated risk that wasn’t explained to the patient occurs, the patient could be entitled to compensation.

Were You Fully Informed?

If you underwent a surgery that resulted in an error and you feel you weren’t adequately informed, you may have a potential claim.

We at Hyatt & Weber will make it our mission to get you the compensation that you deserve. Contact our office at (410) 384-4316 to learn more about how we can help.