Following a severe data breach of the Office of Personnel Management’s cybersecurity that affected millions of current and former federal employees, workers and their unions filed a class action lawsuit against the OPM. The consolidated lawsuits allege gross negligence and a violation of constitutional rights to informational privacy.
The United States District Court for the District of Columbia dismissed the case on September 19, 2017.
On October 12, 2017, the employees appealed the dismissal to the United States Court of Appeals for the D.C Circuit. Oral arguments were held in early November before a panel of three judges of the D.C. Circuit.
Some of the comments from the circuit judges indicate that the court of appeals may be reversing the dismissal and remanding the case back to the district court to proceed on the merits.
The district court decision dismissing the lawsuit was primarily based on three factors, the first of which was the issue of “standing.”
Standing is a pre-condition to any lawsuit, and worth highlighting. As the district court stated in its dismissal, “[t]he fact that the breaches occurred is not disputed, and the identities of the individuals whose information was compromised are known. There is no doubt that something bad happened, and many people are understandably chagrined and concerned.”
However, the court observed that prior to exploring the facts, including whether OPM was on notice that it was being targeted by hackers, or whether OPM did enough to design and maintain safeguards, it must answer a “foundational” question: “whether plaintiffs have set forth a cause of action that a court has the power to hear.”
The district court stated that the “judiciary does not operate as a freestanding advisory board that can opine about the conduct of the executive branch as a general matter or oversee how it manages its internal operations. The Court’s authority is derived from Article II of the U.S. Constitution, and a federal court may only consider live cases or controversies based on events that caused actual injuries or created real threats of imminent harm to the particular individuals who brought the case.”
In other words, the employees must demonstrate that there has been harm or that there is an imminent threat of harm due to the government’s actions.
But the district court found there is no Supreme Court or D.C. circuit precedent for the employees’ contention that a “breach” on its own is harm. The district court also found that the employees who alleged that their private information had already been misused could not tie it back to the OPM breach. For those reasons, the district court found the employees could not allege the necessary harm in order to gain standing.
On appeal, the government found resistance to its standing argument. Two of the judges, noted that plaintiffs incurred real costs as a result of the breach and may face legitimate risks beyond the 10 years for which the government is currently offering protections.
Judge Tatel addressed the government’s argument regarding standing by telling the government attorney that it had an “uphill battle” to show that one set of plaintiffs lacked standing, and that if the court found standing for one case, it would likely apply to the other.
If the DC Circuit panel finds in favor of standing, the lawsuit may likely be headed back down to the district court. It’s about your rights, so stay tuned.
Debra Roth is a partner at Shaw Bransford & Roth, a federal employment law firm in Washington, D.C. Email your legal questions to firstname.lastname@example.org.