Recent Indiana Court of Appeals’ Ruling on Standing May Benefit Data Breach, Class Action Defendants Recent Indiana Court of Appeals’ Ruling on Standing May Benefit Data Breach, Class Action Defendants

Recent Indiana Court of Appeals’ Ruling on Standing May Benefit Data Breach, Class Action Defendants

The Indiana Court of Appeals recently found that a putative class action plaintiff, whose main basis for filing suit was a privacy interest in a previously taken blood sample, had no standing to maintain her lawsuit.  This decision, Doe v. Adams, et al., --- N.E.3d ----, 2016 WL 1572590 (Ind. Ct. App. Apr. 19, 2016), could be helpful to defendants involved in privacy litigation in Indiana, including those involved in data breach and class action lawsuits.
Doe’s lawsuit stems from Indiana’s newborn screening program, which requires hospitals to take blood samples from every infant born under their care, and is aimed at identifying, treating and preventing serious conditions/diseases in infants.  Id. at *1.  The sample, usually obtained by heel stick, is collected in five circles on a newborn screen card (the “DBS sample”), which is then transported to a designated lab for testing.  Id.  The lab performs the testing by punching out small portions from the DBS sample; often, not all of the five circles are used.  Id.  From approximately 1991 to June 2013, the Indiana State Department of Health (“ISDH”) retained and stored the remaining portion of the newborn screen card.  Id.  In June 2013, however, the ISDH changed its storage and retention policies, enabling parents or guardians of newborns to either allow the DBS sample to be used for medical research purposes for a three-year period and then destroyed, or kept for a period of six months (to ensure further testing was not necessary) and then destroyed.  Id. (internal quotation omitted). 
Doe, by her parents, filed a Class Action Complaint and Request for Emergency Declaratory and Injunctive relief against ISDH.  Id. at *2.  Doe sought to represent a class of “[a]ll individuals who had a blood sample taken pursuant to [Indiana’s newborn blood screening program] that has been or will be stored by the [ISDH] for more than six months without any documentation of consent,” and asserted claims under the United States Constitution, the Indiana Constitution, and Indiana state law.  Id.  The trial court dismissed Doe’s Complaint, finding, in part, that Doe lacked standing to maintain the lawsuit.  Id. at *10.  Specifically, the trial court found that Doe lacked standing because (a) she had not sustained and was not in imminent danger of sustaining some direct injury as a result of the act of storing her DBS sample, (b) she had not made any request for destruction of her DBS sample that had been denied by ISDH, and (c) any injury is “completely speculative.”  Id.  On appeal, Doe argued that she had standing because “ongoing governmental violations of the Fourth, Fifth, and Fourteenth Amendments to the Constitution constitute an immediate danger of sustaining some direct injury.”  Id.  Doe also maintained that she had a reasonable privacy interest in her DBS sample, which contained her DNA, and the ISDH’s continued storage beyond the time necessary to conduct the screening tests violated the Fourth Amendment’s protections against unreasonable searches and seizure.  Id.  According to Doe, “the essential question . . . is whether the person asserting a violation has a reasonable expectation of privacy in the material examined.”  Id.
The Court of Appeals disagreed.  Assuming, but not finding, that Doe had a constitutionally protected interest in her DBS sample, the Court found that Doe still must show that she has suffered, or is in immediate danger of suffering, some direct injury in order to have standing.  Id. at *11.  The Court rejected Doe’s assertion that she had a reasonable fear that her DBS sample might be misused, citing record evidence that Doe’s blood was not used for medical research, nor would it be, without parental authorization.  Id.  Under the facts of the case, Doe’s fear was merely speculative, and did not constitute the type of direct injury necessary to support a finding of standing.  Id. at *12. 
This decision could be helpful to class action defendants in a number of respects.  First, the Court of Appeals rejected Doe’s attempts to rely on the alleged harm to the putative class to prove her case should not be dismissed.  Id. at *5.  Because the class had not yet been certified, the Court found that only Doe’s claims were at issue.  Id. (citing Arthur and Withered, 11 Ind. Prac., Civil Trial Practice § 18.4 (2015)).  See also Alexander v. PSB Lending Corp., 800 N.E.2d 984, 991-92 (Ind. Ct. App. 2003) (rejecting plaintiffs’ argument that standing may be determined on classwide basis), trans. denied. 
Second, the Court found that a mere privacy interest is not enough to demonstrate standing – a plaintiff must still show a direct injury, or an immediate danger of direct injury, in order to have standing to bring her claim.  Such a holding could be helpful to defendants in data breach class actions.  While Indiana has little case law to provide guidance in the developing data security realm, defendants could argue that data breach plaintiffs – who often argue that they have an increased risk of fraudulent charges or identity theft, but do not actually suffer such injuries – do not have standing to maintain individual or class actions under Indiana state law against companies who experience a data breach.  Given the trend of recent Seventh Circuit opinions which have seemingly relaxed the standing requirement for plaintiffs seeking to bring data breach class actions (read analysis here), an argument to defeat similar claims under Indiana law would be extremely useful to defendants.  The Seventh Circuit’s expansion would seemingly conflict with the Court’s holding in Doe, which requires a specific showing of injury on the part of the named plaintiff – separate of the injury alleged on behalf of the putative class.
Transfer has been sought in the above case, and this article will be updated as needed.  For guidance on responding to data security breaches to minimize the risk of litigation and handling such litigation if it occurs, please contact Judy Okenfuss, Stephen Reynolds, or Jenny Buchheit.  Judy Okenfuss is a Managing Partner of Ice Miller and chair of Ice Miller’s Internet of Things Practice who focuses her practice in defending manufacturers, distributers, and retailers against all types of litigation, including class actions.  Stephen Reynolds, a former computer programmer and IT analyst, is a Partner in Ice Miller’s Litigation and Intellectual Property Group and co-chair of Ice Miller’s Data Security and Privacy Practice.  Jenny Buchheit is a Partner in Ice Miller’s Litigation and Intellectual Property Group who represents clients at both the trial and appellate levels, and focuses much of her work on defending companies in both state and national putative class actions.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader’s specific circumstances.
View Full Site View Mobile Optimized