Court Rules Drivers Lack Standing to Pursue Claims Against Uber Because Data Breach Did Not Include Drivers’ Social Security Numbers

California companies housing their drivers’ personal information may feel less exposed to liability in light of the Northern District of California’s holding in Antman v. Uber Technologies, Inc. in May.[1] The trial court in Antman found that Uber was not liable to its drivers after hackers illicitly accessed their personal information through Uber’s computer system.[2]

Plaintiffs Sasha Antman and Gustave Link alleged that the company failed to protect their personal information, as well as that of a putative class of individuals similarly situated.  Plaintiffs stated claims for violation of California’s Unfair Competition Law (UCL), negligence, and breach of implied contract.[3][4]

According to the allegations, Uber drivers’ personal information (including names, driver’s license numbers, and bank information) was compromised in two separate incidents in May 2014 and October 2016.[5]  Notably, there was no allegation that the Social Security numbers of the putative class were compromised.  The putative class alleged injuries including the time and expense related to monitoring their financial accounts for fraud, an increased risk of fraud and identity theft, and invasion of privacy.[6] Antman individually alleged that an unknown person had used his personal information to apply for a credit card in or around June 2014.[7]

The court rejected the suggestion that Uber’s failure to protect plaintiffs’ personal information was an injury per se sufficient to confer standing.[8]  Judge Beeler dismissed plaintiffs’ case on two grounds: (1) failure to establish Article III standing; and (2) failure to show injury and causation sufficient to defeat Uber’s Rule 12(b)(6) motion to dismiss.[9] The court determined that plaintiffs lacked standing because they had not adequately established injury.[10] In doing so, the court distinguished the action from another case in which the plaintiffs’ Social Security numbers were compromised.[11] Without Social Security numbers, the court reasoned, the “disclosed information does not plausibly amount to a credible threat of identity theft that risks real, immediate injury.”[12]

The trial court further held that plaintiffs failed to establish causation. The court reiterated that Article III requires the injury be “trace[able] to the challenged action of the defendant” and not the “result [of] the independent action of some third party …”[13] Because a person could not plausibly apply for a credit card without a Social Security number—which plaintiffs did not allege was accessed in the breach—there was nothing to suggest that Uber caused Antman’s injuries.[14]

The court also took care to rebut plaintiffs’ claim that Uber’s “pattern of dishonesty means that it cannot be trusted.”[15] Rather, allegations regarding other lawsuits, and what they reveal about the company and its business practices, “do not affect the court’s inquiry.”[16] Because plaintiffs failed to show personal injury or plausible risk of immediate harm, they failed to establish Article III standing.

Having dismissed two earlier versions of the complaint, the court dismissed the latest version without leave to amend, closing the door on any subsequent attempts by the plaintiffs to allege adequate proof of injury and causation.[17] Plaintiffs filed a notice of appeal on June 8, 2018, to the Ninth Circuit Court of Appeals, which issued an order on July 19 releasing the case from the court’s mediation program.[18]

[1] See No. 15-cv-01175-LB, 2018 WL 2151231, at  *1 (N.D. Cal. Mar. 10, 2018).

[2] Id.

[3] Id.

[4] Id.</EM>; see Antman v. Uber Techs., Inc., No. 3:15-cv-01175-LB, 2015 WL 6123054, at *9-12.