McMorris v. Carlos Lopez & Assocs., LLC, No. 19-4310 (2d Cir. 2021)
Annotate this Case
The Second Circuit affirmed the district court's order dismissing plaintiff's claims against CLA and its principal for lack of Article III standing. Plaintiff and two other non-appealing plaintiffs filed a class action complaint alleging state law claims against CLA and its principal based on an errant email sent to all of CLA's employees containing the sensitive personal identifiable information (PII) of approximately 130 current and former CLA workers. On appeal, plaintiff argues that, even though she did not allege that her PII had actually been misused as a result of CLA's errant email, she alleged an increased risk of identity theft sufficient to confer Article III standing.
The court agreed that in the context of unauthorized data disclosures, plaintiffs may establish an Article III injury in fact based solely on a substantial risk of identity theft or fraud, even when those plaintiffs have not yet been the victims of such identity theft or fraud. Nevertheless, the court concluded that the district court correctly concluded that plaintiff failed to establish an injury in fact in this case. The court explained that plaintiff fails to allege that her PII was subject to a targeted data breach or alleges any facts suggesting that her PII (or that of any others) was misused. The court considered plaintiff's remaining arguments and found them to be without merit.
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.