Data breaches typically involve lots of people, making them prime targets for class actions. Most cases have not gotten to the class certification stage because they have been dismissed on standing grounds, and when they have reached the class phase, certification has been denied because of the predominance of individualized issues. Two recent Supreme Court decisions, Clapper v. Amnesty International USA, in which the court held that actions based on speculative injury cannot proceed due to lack of standing, and Comcast Corp. v. Behrend, an antitrust case in which the court held that when damages are individualized, a class cannot be certified, reinforce these trends. While neither case involves a data breach, both have significant ramifications in the data breach context.
Many cases have been dismissed on standing grounds, such as Hammond v. The Bank of New York Mellon and Randolph v. ING Life Insurance and Annuity Company. A number of circuit courts have recognized standing, but nevertheless have dismissed the action for lack of a compensable injury. For example, see Pisciotta v. Old National Bancorp from the 7th Circuit in 2007 and Ruiz v. GAP, Inc. from the 9th Circuit in 2010.