CHRISTOPHER R. Deubert discusses recent legal guidance regarding data breach claims in the United States, particularly in Massachusetts. In 2021, the U.S. Supreme Court determined that the mere risk of future harm does not qualify as a concrete harm for establishing legal standing.
This has led to varied interpretations in federal and state courts regarding whether individuals whose personal information was compromised in data breaches have sufficient grounds to bring lawsuits, particularly when no clear injury has occurred. In June, the Appeals Court of Massachusetts clarified this issue in the case of 'Cruceta v. J.C. Cannistraro LLC', ruling that plaintiffs must demonstrate 'cognizable damage' to have standing in data breach cases.