BOOING BOHNAK: HOW THE SECOND CIRCUIT DROPPED THE ARTICLE III BALL IN ANALYZING STANDING IN CLASS ACTIONS ARISING FROM CYBERATTACKS.

• Date: 01 January 2025
• Author: Meal, Douglas H.

 TABLE OF CONTENTS
                ABSTRACT 1
                INTRODUCTION 3
                 I. BACKGROUND TO BOHNAK: TRANSUNION AND THE APPLICATION OF 4
                 TRANSUNION IN BOHNAK BY THE DISTRICT COURT
                 A. TransUnion 4
                 B. The Application of TransUnion in Bohnak by the District 6
                 Court
                II. EVALUATING BOHNAK: THE SECOND CIRCUIT'S ARTICLE III HOLDINGS, 11
                THE HOLDINGS' POTENTIAL JURISPRUDENTIAL IMPACT, AND THE HOLDINGS'
                FUNDAMENTAL LEGAL FALLACIES
                 A. The Second Circuit's Article III Holdings in Bohnak 11
                 B. The Potential Impact of the Second Circuit's Article 13
                 III Holdings
                 C. The Fundamental Legal Fallacies in Bohnak's Article 15
                 III Holdings
                 1 Bohnak's Intangible Injury Holding 16
                 2 Bohnak's Risk-of-Future-Injury Holding 24
                CONCLUSION 35
                

INTRODUCTION

In August 2023, the Court of Appeals for the Second Circuit handed down its much-anticipated decision in Bohnak v. Marsh & McLennan Cos. ('Bohnak") (1) Bohnak analyzes how the Supreme Court's seminal 2021 ruling on Article III standing in TransUnion LLC v. Ramirez ('TransUnion'") (2) ought to be applied in the context of a class action arising from a cyberattack. As discussed below, in Bohnak the Second Circuit held that where a cyberattack has resulted in unauthorized access to personal information of the plaintiff, such unauthorized access in and of itself constitutes an "injury" sufficient to give the named plaintiff Article III standing to pursue damages claims in federal court. (3) In this author's view, Bohnak's holding on this point misconstrues TransUnion and constitutes clear error. (4) Moreover, if taken to its logical conclusion, that holding would be a game-changer in cyberattack class action litigation, as it would make Article III standing a given in any and every such class action. By so doing, Bohnak's application of TransUnion would overturn dozens of federal court decisions that reject Article III standing in such class actions. (5)

The Second Circuit's Bohnak decision offered an alternative holding regarding Article III standing in cyberattack class actions that is nearly as problematic as its core Article III standing holding. Under this alternative holding, a plaintiff who is at "substantial risk" of future injury from a cyberattack has Article III standing to pursue a damages claim for his or her current injuries, such as emotional distress or the cost of his or her efforts to reduce the future injury risk, flowing from the threatened future injury. This applies even if the threatened future injury is unlikely to occur anytime soon. (6) In this author's view, Bohnak's alternative Article III holding creates a wholly subjective standard that misconstrues both TransUnion and the Supreme Court's other recent Article III decisions; as such, it too constitutes clear error. (7) Moreover, if perpetuated, the low (albeit unspecified) threshold created by that holding's "substantial risk" standard would--separate and apart from Bohnak's core Article III holding--result in virtually every cyberattack class action plaintiff's having Article III standing, as long as the plaintiff alleges that he or she did or felt something (such as spending incremental time monitoring his or her accounts or incurring emotional distress) upon being made aware of the cyberattack and the theoretical risk of future injury that it posed. (8)

By demonstrating the legal fallacies of Bohnak's Article III holdings and their enormous potential jurisprudential impacts if they become the prevailing view among federal courts as to how Article III standing should be analyzed in the cyberattack-class-action context, this article seeks to enable other federal courts and the litigants who appear before them to nip Bohnak's Article III holdings in the bud, before they can do any further jurisprudential damage.

I. BACKGROUND TO BOHNAK: TRANSUNION AND THE APPLICATION OF TRANSUNION IN BOHNAK BY THE DISTRICT COURT

A. TransUnion

In TransUnion, the Supreme Court addressed Article III standing in a class action that alleged TransUnion violated the Fair Credit Reporting Act ("FCRA") when it included misleading information of each of the 8,185 class members in their credit reports. This information identified the class member as a potential match to a name on the "OFAC list" of "specially designated nationals" who threaten America's national security. (9) TransUnion distributed the allegedly violative credit reports of 1,853 of the class members to third-party businesses, but did not distribute the allegedly violative credit reports of the other 6,332 class members. (10) The Supreme Court considered whether, as found by the courts below, TransUnion's conduct caused the class members to suffer a "concrete" injury sufficient to give them Article III standing to pursue their claims for statutory and punitive damages in federal court. (11)

In resolving this issue, the Supreme Court quoted familiar principles: that to be considered "concrete" to create Article III standing, an injury must be "real, and not abstract," which depends on whether the injury "has a 'close relationship' to a harm 'traditionally' recognized as providing a basis for a lawsuit in American courts." (12) Tangible injuries (i.e., physical injury to person or property and monetary injuries), the Court explained, readily qualify as concrete injuries for Article III standing purposes, but here none of the class members had allegedly suffered such an injury. (13) As for intangible injuries of the sort allegedly suffered by these class members, the Court explained that such injuries can also be concrete where they have "a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts" such as "reputational harms, disclosure of private information, and intrusion upon seclusion." (14)

Applying these principles to the case at hand, the Court held that the 1,853 class members whose credit reports had been distributed by TransUnion to third-party businesses had suffered a concrete injury sufficient to sustain Article III standing because their injuries "b[ore] a 'close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts--namely, the reputational harm associated with the tort of defamation." (15) The Court explained that "[u]nder longstanding American law, a person is injured when a defamatory statement 'that would subject him to hatred, contempt, or ridicule' is published to a third party." (16) The Court reasoned that this injury bears a close relationship to (even if it did not "exactly match") the reputational injuries suffered by the 1,853 class members whom TransUnion misleadingly identified to third parties as being potential terrorists. (17)

As for the other 6,332 class members whose credit reports had not been distributed by TransUnion to third parties, the Court found they had not suffered a concrete injury sufficient to give them Article III standing to pursue their damages claims. (18) First, the Court noted that because there had been no "publication" to a third party of these class members' misleading credit reports, these class members' injuries (unlike those of the other 1,853 class members) did not bear a close relationship to the reputational injury that is the basis for the common-law tort of defamation. (19) Second, the Court rejected these class members' alternative argument that their risk of future concrete injury from TransUnion's potential future dissemination of their misleading credit reports sufficed to give them Article III standing. (20) The Court explained that where the defendant's allegedly unlawful conduct puts the plaintiff at risk of suffering a future injury that has not yet materialized, that risk cannot support finding a concrete injury for Article III standing purposes unless (1) the future injury is "sufficiently" imminent and substantial (21) and (2) the plaintiff's risk of incurring that injury "itself causes a separate concrete harm." (22) Noting that the 6,332 class members in question had shown neither a sufficiently imminent and substantial future injury (23) nor that their risk of suffering such a future injury had already caused them a separate concrete injury, (24) the Court rejected these class members' argument that their "risk of future injury" could support a finding that they had Article III standing. (25)

B. The Application of TransUnion in Bohnak by the District Court

While TransUnion was not a cyberattack case, commentators immediately recognized that TransUnion stood to have significant impact on the question of Article III standing in cyberattack cases, especially cyberattack class actions. (26) Before TransUnion, plaintiffs in cyberattack class actions had customarily eschewed theories of injury and damages predicated on their having already suffered an actual tangible injury as a direct result of the attack. Such theories of injury and damages, while well-suited towards establishing that the named plaintiffs had Article III standing to pursue their claims in federal court, were poorly suited for cyberattack class actions. That is because few individuals whose personal information is involved in a cyberattack suffer any tangible harm that can be traced to the particular cyberattack at issue. As a result, relying on such a theory of injury and damages would nearly always eliminate from the putative class the overwhelming majority of the individuals whose personal information was involved in the cyberattack at issue. Moreover, because individualized person-by-person inquiries would be necessary first to identify, and then to prove and quantify the damages suffered by, the relatively few people who had actually suffered tangible injuries from the cyberattack, it would be nearly impossible to establish the "predominance of common issues" required to certify a damages class even if the class were limited to such people. (27)

Instead, prior to TransUnion, plaintiffs in putative cyberattack class actions had normally predicated...