Who is entitled to bring a lawsuit? For the most part, the law says only a party who has suffered the actual or potential injury the suit seeks to redress may bring the action. California law codifies this requirement in its Code of Civil Procedure §367, which specifies that “[e]very action must be prosecuted in the name of the real party in interest ….” Thus, for example, if you were injured a car accident, you could bring a lawsuit. But, say, your neighbor– a person with no involvement in the accident– could not.
In Federal court, the question of whether a plaintiff is entitled to sue is referred to as “standing,” and it stems from the Constitution’s Article III, which restricts Federal court jurisdiction to the resolution of “Cases” and “Controversies.” As the Supreme Court has instructed, Article III requires that a Federal court resolve only “a real controversy with real impact on real persons,” and not “hypothetical or abstract disputes.”
Plaintiff bears the burden of establishing her standing. To do this, she must show: (i) That she suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) That the injury was likely caused by the defendant; and (iii) That the injury would likely be redressed by judicial relief. As to the injury requirement, when all that alleged is the risk of future harm, a plaintiff has standing to seek an injunction (a court order requiring a party to refrain from certain conduct). But where a plaintiff brings a suit for damages, the mere risk of future harm, standing alone, cannot qualify as a concrete harm– at least unless the exposure to the risk of future harm itself causes a separate, concrete harm.
In 2019 Zynga, Inc.(which develops, markets, and operates live social games including the popular Words With Friends and Farmville franchises) was hit with a criminal hack. The company posted on its website that “certain player account information may have been illegally accessed.” Over a year and a half later, some users filed a class action alleging that Zynga failed to protect their personal information. Their complaint, however, failed to allege that the hack resulted in any actual identity theft. Zynga moved to dismiss the case based on lack of standing.
The court ruled that the release of “basic contact information” (names, email addresses, phone numbers) and dates of birth– the information compromised by the hack– could not support a claim for invasion of privacy. Such a claim requires the dissemination of information such that its release would be “highly offensive to a reasonable person.” Basic contact info (which is meant to be released) and dates of birth do not meet that test.
As to the risk of future harm, i.e., identity theft, the plaintiffs had no standing there either. Again, a risk of harm must either materialize or cause some other injury in order to confer standing in a suit for damages. Because no plaintiff alleged that she had suffered actual identity theft, this test was not satisfied.