In In re SuperValu, Inc. (subsequently referred to as Alleruzzo), the Eighth Circuit deepened the circuit split on the issue of whether the substantial risk of future identity theft is sufficient to establish the injury-in-fact prong of standing. In Clapper v. Amnesty Int’l USA, the Supreme Court addressed substantial risk of injury as a basis for standing. The Court held that the future injury alleged in the complaint was insufficient for standing because it “relie[d] on a highly attenuated chain of possibilities.” Several circuits, coming to varying conclusions, have applied Clapper in data breach cases to determine whether the increased risk of future identity theft is sufficient to satisfy the injury-in-fact requirement. In Alleruzzo, the court applied Clapper to hold that fifteen of the named plaintiffs had not alleged a substantial risk of future identity theft sufficient for standing. The Eighth Circuit was correct in its holding because limiting the application of substantial risk as a basis for standing simplifies the analysis and prevents generalized claims from making it into the courts. Particularly in the context of data breaches, limitations must be placed on the standing doctrine to prevent wasting judicial resources.
Jennifer Wilt, Cancelled Credit Cards: Substantial Risk of Future Injury as a Basis for Standing in Data Breach Cases, 71 SMU L. Rev. 615 (2018)