The Question of Standing in Leaks of Non-‘Salacious’ Data

When can people sue companies for failing to keep their personal data safe?

In 2021, the Supreme Court held that plaintiffs suing in federal court must point to a common-law analogue for any intangible harms they allege—or else be barred for lack of standing. Since then, circuit courts have diverged on when the harm stemming from data breaches resembles one traditionally recognized under common law. One recurring question is what to do when the leaked information is neutral rather than compromising or salacious. Is the harm of having a driver’s license number wind up in shady corners of the internet close enough to the traditional injury of, say, having an affair splashed across the front page of the newspaper?