In Re Zappos.com, Inc.

• Author: Jackson, Katrina
• Position: Data breach and standing rulings

IN RE ZAPPOS.COM, INC., 888 F.3D 1020 (9TH CIR. 2018)

In In Re Zappos.com, Inc., (1) the United States Court of Appeals for the Ninth Circuit reversed and remanded the district court's judgement. (2) The court determined that its previous decision in Krottner v. Starbucks Corp., and the court's most recent decision in Clapper v. Amnesty International USA, are not irreconcilable. (3) The Ninth Circuit held, pursuant to Krottner, that plaintiffs have Article III standing. (4)

1. BACKGROUND

   In January 2012, hackers successfully breached the online retailer Zappos.com. (5) The hackers obtained personal identifying information (PII) for over 24 million Zappos customers, including individuals' names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers, and credit and debit card information. (6) Following the breach, several Zappos customers filed putative class actions throughout the United States, claiming that Zappos.com did not sufficiently protect their personal information. (7) The law suits were consolidated for pretrial proceedings. (8) The district court granted in part and denied in part Zappos's motion to dismiss and granted Zappos's motion to strike the Complaint's class allegations. (9) The district court dismissed plaintiffs' claims for lack of Article III standing. (10) In doing so, the district court distinguished between the Plaintiffs, dividing them in two separate groups. (11) The district court ruled that the first group of plaintiffs, who had already suffered financial losses from the hacking incident, had Article III standing, while the plaintiffs who had not yet experienced any such loss lacked Article III standing. (12) The district court reasoned that only the first group of plaintiffs had Article III standing because those plaintiffs had experienced "actual fraud... as a direct result of the breach." (13) The district court found that, unlike the first group of plaintiffs, the second group lacked Article III standing because those plaintiffs "failed to allege instances of actual identity theft or fraud." (14) At issue on appeal was whether both groups of plaintiffs, solely focusing on the hacking incident itself and not any subsequent illegal activity, had Article III standing. (15)

2. ANALYSIS

   "The court reviewed the district court's standing determination de novo." (16) The court began its analysis by establishing what a plaintiff must show to establish Article III standing. (17)...