PITTSBURGH -- The Pennsylvania Superior Court recently upheld a lower court decision to reject class-action certification in a data breach case for a lack of ascertainable loss, but plaintiffs are not without recourse if the data loss leads to identify theft.
In Baum v. Keystone Mercy Health Plan, et al., the plaintiff attempted to certify a class of individuals who may have suffered a privacy loss after the defendant lost a USB flash drive containing personal information of 286,000 subscribers. In 2013, the Philadelphia Court of Common Pleas denied the plaintiff’s motion for class certification.
The case was appealed to the Superior Court, which upheld the ruling but sent the case back to the lower court to determine if the case might be able to be class certified based on the claim under a separate provision of the Pennsylvania Unfair Trade Practices and Consumer Protection Law (UTPCPL).
The lower court again denied the class-action certification, and the plaintiffs appealed to the Superior Court again. In the second ruling, which was handed down in April, the Superior Court determined the case fell short of class-action certification.
“The court found that the plaintiff hadn’t suffered ascertainable losses,” Brian Willett recently told the Pennsylvania Record. “The allegations don’t reflect that anyone had been the victim of identity theft. Once I dug into the facts of the case, I wasn’t (surprised by the ruling). There was no demonstration of injury for the plaintiffs.”
The plaintiff in the case, Avrum M. Baum, filed suit on behalf of his minor child. Baum brought the case to the court to protect a class interest, but the trial court ruled that none of the data on the flash drive could be linked to the plaintiff’s daughter.
“Identify theft is a serious issue, but in Pennsylvania, when a plaintiff is suing after a data breach under state law, they have to show reliance,” Paul Bond, a partner at Reed Smith, told the Pennsylvania Record.
Reliance is the legal theory where a prudent person acts on the promise of someone else, particularly in a contract. In the Baum case, the defendant promised to protect the individual’s data, but the plaintiff was unable to show where each plaintiff relied on that promise.
“The plaintiffs probably will not appeal the case, because they risk a decision that affirms the Superior Court decision,” Bond said.
He said even though the Pennsylvania Supreme Court has a Democratic majority, “privacy issues go beyond party lines.”
Although the class-action suit has been denied, “if anyone suffers an injury from this data breach, there is recovery in individual litigation, provided an injury can be proved,” Bond noted.