Privacy litigation requires a factual account of harm for each claim and remedy, with particular attention to disclosure, present loss, future risk, and classwide proof.
A breach notice describes a security event. It does not necessarily establish every recipient’s standing to recover damages in federal court. For privacy litigators, the important work is connecting the event to an identified plaintiff’s concrete harm and then explaining how the chosen remedy addresses it. In a proposed class action, that same inquiry affects the class definition, discovery plan, and proof available at judgment.
Separate statutory violation from concrete injury
TransUnion LLC v. Ramirez (2021) requires concrete injury even when Congress authorizes a lawsuit for a statutory violation. Tangible losses readily fit that requirement; intangible injuries need an adequate relationship to harms traditionally recognized in American courts. The analogy does not demand an exact historical duplicate. The Court also distinguished damages from prospective relief: future risk alone does not support damages without additional concrete harm, although sufficiently imminent and substantial risk can support an injunction. Every class member seeking individual damages must have standing.
That framework suggests organizing allegations by harm rather than by statutory subsection alone. Identify what information was exposed, who obtained or could access it, what happened afterward, and what the plaintiff experienced. A complaint stating only that privacy is valuable leaves the court to supply the missing connection between the asserted right and the asserted injury.
Disclosure and risk are different factual theories
In Holmes v. Elephant Insurance Co. (4th Cir. 2025), allegations that driver’s-license numbers appeared on the dark web supported a concrete-injury theory analogous to public disclosure of private information. The court emphasized sensitivity and accessibility to many people. It expressly disagreed with the Seventh Circuit’s treatment of similar information in Baysal v. Midvale Indemnity Co. Practitioners should therefore resist presenting disclosure of a particular data field as a nationally uniform standing rule.
For an asserted risk of identity theft, the Third Circuit’s Clemens v. ExecuPharm Inc. (2022) examines circumstances such as intentional targeting, misuse, and the sensitivity of the exposed data. In a damages action, its analysis also requires presently felt concrete harm accompanying the substantial risk, such as adequately alleged mitigation costs or emotional harm. The case involved a malicious intrusion and publication of sensitive information; its reasoning should be applied to the actual breach facts rather than reduced to a rule that any monitoring expense establishes standing.
Clapper v. Amnesty International USA (2013) supplies a related caution: plaintiffs cannot manufacture standing by spending money in response to a hypothetical future threat. A useful factual investigation therefore asks why protective measures were taken, what objective risk supported them, when expenses arose, and which expenses were attributable to this incident. The same file should distinguish an unreimbursed loss from a reversed fraudulent charge.
Plan proof for the claim and requested remedy
Hypothetical: A company sends notices to everyone whose records were stored on a compromised server. One customer has evidence of publicly posted account information and documented unreimbursed fraud. Another has only the notice, while investigators cannot determine whether that person’s data was accessed. Those customers should not automatically be treated as evidentially interchangeable. Their allegations, available proof, and possible remedies require individual attention even if the alleged security failure was common.
Build an evidence matrix identifying the plaintiff, relevant data, exposure evidence, actual loss or privacy harm, mitigation, and requested relief. Preserve notices and contemporaneous records. Distinguish proof of a security weakness from proof that a person’s information was disclosed. Traceability likewise requires a reasoned connection to the defendant’s conduct; chronological sequence is a starting point for investigation, not a substitute for it.
Do not postpone the class problem
In Laboratory Corp. of America Holdings v. Davis (2025), the Supreme Court dismissed review as improvidently granted. The dismissal did not resolve the question presented about certifying a damages class containing uninjured members. The distinction matters: TransUnion establishes the standing requirement for individual damages, while the timing and implications of that showing at certification still require attention to controlling circuit law.
Before proposing a class, describe how the evidence will identify members with the asserted injury. If logs distinguish accessed records from merely stored records, explain how they will be used. If the theory depends on a particular disclosure or financial consequence, evaluate whether common evidence can establish it or whether narrower groups are appropriate. A damages model cannot repair an unproven premise that all recipients of a notice experienced the same harm.
Standing also remains separate from liability. Establishing a concrete privacy injury does not establish negligence, statutory coverage, causation on the merits, or recoverable damages under the governing cause of action. Keeping those inquiries distinct makes both the pleading and the defense more precise.
Jurisdiction note: Article III governs federal courts. State courts apply their own standing rules, and state privacy statutes differ in coverage, available claims, and remedies. Federal circuit differences should be checked before relying on a particular data-breach theory.