No Harm, No Foul: The Fourth Circuit Struggles with the “Injury-in-Fact” Requirement to Article III Standing in Data Breach Class Actions

On February 6, 2017, in Beck v. McDonald, the United States Court of Appeals for the Fourth Circuit held that the increased risk of future identity theft created by two data breaches was too speculative to constitute an injury-in-fact for the purposes of Article III standing. The court surveyed the split between its sister circuits and determined that, without allegations that a thief deliberately targeted information, misused, or attempted to misuse that personal information, the risk of identity theft was not sufficiently high so as to meet the injury-in-fact requirement of Article III standing. This Comment examines the Fourth Circuit’s holding and argues that the deepening split among circuits leaves plaintiffs uncertain about how to adequately plead injury-in-fact.