Listen to this article
A putative class action brought after unknown third parties hacked an employer’s network servers and obtained the personal identifying information of employees has been dismissed because of the employees’ inability to establish that they suffered “actual” and “present” injuries.
The complaint was filed in U.S. District Court by two plaintiffs against the defendant company, which was their former employer.
“Insofar as plaintiffs allege to have suffered injuries associated with the ‘risk’ or ‘imminent threat’ of future harm, those damages are not cognizable under Michigan law because they ‘are wholly derivative of a possible, future injury rather than an actual, present injury,’” Judge Robert J. White wrote.
“Nor can state negligence law remedy the asserted injuries that appear to be ‘actual’ and ‘present.’ For instance, Michigan does not recognize plaintiffs’ current ‘loss of privacy’ or the ‘publication’ of their personal identifying information alone as forms of compensable injury,” White stated.
“What is more, the consolidated class action complaint contains no allegations that plaintiffs themselves are victims of identity theft or fraud; that they incurred ‘financial costs … due to actual identity theft’; or that they incurred any ‘loss of time … due to actual identity theft,’” he added.
“So, taken together, none of the averments in the consolidated class action complaint plausibly establish that plaintiffs suffered ‘actual’ and ‘present’ injuries,” the judge concluded.
The 16-page decision is In re Grede Holdings LLC Data Breach Litigation; MiLW No. 02-110309.
