Emotionally Unstable: Addressing Emotional Distress as a Concrete Injury in Data Breach Cases Post-TransUnion

Authors

Anna P. Cox, Fordham University School of Law

Keywords

data; data privacy; privacy; data breach; data breaches; standing; privacy standing; Article III; concrete; concrete injury; common-law analogue; TransUnion; Spokeo; Clapper; privacy tort; torts; cybersecurity; emotional distress; emotional harm; NIED; IIED; risk of harm; fear of harm; common law

Abstract

Data breaches and data breach litigation are exponentially on the rise. Plaintiffs whose information is stolen in a data breach often claim emotional distress for fear of future harm the data breach may cause. However, plaintiffs who bring suit in federal court must show that they have suffered an injury in fact for purposes of Article III standing before a federal court will exercise jurisdiction. The U.S. Supreme Court’s decision in TransUnion LLC v. Ramirez requires that plaintiffs who seek money damages under a theory of risk of future harm show that they have suffered a present concrete injury to fulfill the injury in fact requirement. The Court held that, for an injury to be “concrete,” it must have a “close relationship” with a traditional basis for a suit at common law. How to conduct this analysis, however, is cryptic at best. Furthermore, the Court suggested that current emotional distress from risk of future harm may be a concrete injury—but specifically reserved judgment on the issue. Subsequently, lower courts have diverged on whether emotional distress suffered as a result of the risk of future harm from the data breach is a concrete injury.

Guided by theories of constitutional interpretation and tort law, this Note argues that lower courts should look to the qualitative nature of harms as conceived throughout common law to understand which harms are justiciable. Using this method, courts can analogize to negligent infliction of emotional distress as recoverable in fear-of-future-disease cases. This requires that plaintiffs show that their suffered emotional distress is severe. Provided that plaintiffs are suffering severe emotional distress, this framework aligns with the Court’s instructions to analogize to common-law harms and the Court’s concern of not improperly expanding federal jurisdiction. This framework simultaneously provides an avenue to federal court for plaintiffs suffering severe emotional distress from fear of future harms a data breach may cause.

Recommended Citation

Anna P. Cox, Emotionally Unstable: Addressing Emotional Distress as a Concrete Injury in Data Breach Cases Post-TransUnion, 94 Fordham L. Rev. 181 (2025).
Available at: https://ir.lawnet.fordham.edu/flr/vol94/iss1/4