Court Rules Drivers Lack Standing to Pursue Claims Against Uber Because Data Breach Did Not Include Drivers’ Social Security Numbers

09 August 2018 Dashboard Insights Blog
Author(s): Tony Tootell

California companies housing their drivers’ personal information may feel less exposed to liability in light of the Northern District of California’s holding in Antman v. Uber Technologies, Inc. in May.[1] The trial court in Antman found that Uber was not liable to its drivers after hackers illicitly accessed their personal information through Uber’s computer system.[2]

Plaintiffs Sasha Antman and Gustave Link alleged that the company failed to protect their personal information, as well as that of a putative class of individuals similarly situated.  Plaintiffs stated claims for violation of California’s Unfair Competition Law (UCL), negligence, and breach of implied contract.[3][4]

According to the allegations, Uber drivers’ personal information (including names, driver’s license numbers, and bank information) was compromised in two separate incidents in May 2014 and October 2016.[5]  Notably, there was no allegation that the Social Security numbers of the putative class were compromised.  The putative class alleged injuries including the time and expense related to monitoring their financial accounts for fraud, an increased risk of fraud and identity theft, and invasion of privacy.[6] Antman individually alleged that an unknown person had used his personal information to apply for a credit card in or around June 2014.[7]

The court rejected the suggestion that Uber’s failure to protect plaintiffs’ personal information was an injury per se sufficient to confer standing.[8]  Judge Beeler dismissed plaintiffs’ case on two grounds: (1) failure to establish Article III standing; and (2) failure to show injury and causation sufficient to defeat Uber’s Rule 12(b)(6) motion to dismiss.[9] The court determined that plaintiffs lacked standing because they had not adequately established injury.[10] In doing so, the court distinguished the action from another case in which the plaintiffs’ Social Security numbers were compromised.[11] Without Social Security numbers, the court reasoned, the “disclosed information does not plausibly amount to a credible threat of identity theft that risks real, immediate injury.”[12]

The trial court further held that plaintiffs failed to establish causation. The court reiterated that Article III requires the injury be “trace[able] to the challenged action of the defendant” and not the “result [of] the independent action of some third party …”[13] Because a person could not plausibly apply for a credit card without a Social Security number—which plaintiffs did not allege was accessed in the breach—there was nothing to suggest that Uber caused Antman’s injuries.[14]

The court also took care to rebut plaintiffs’ claim that Uber’s “pattern of dishonesty means that it cannot be trusted.”[15] Rather, allegations regarding other lawsuits, and what they reveal about the company and its business practices, “do not affect the court’s inquiry.”[16] Because plaintiffs failed to show personal injury or plausible risk of immediate harm, they failed to establish Article III standing.

Having dismissed two earlier versions of the complaint, the court dismissed the latest version without leave to amend, closing the door on any subsequent attempts by the plaintiffs to allege adequate proof of injury and causation.[17] Plaintiffs filed a notice of appeal on June 8, 2018, to the Ninth Circuit Court of Appeals, which issued an order on July 19 releasing the case from the court’s mediation program.[18]

[1] See No. 15-cv-01175-LB, 2018 WL 2151231, at  *1 (N.D. Cal. Mar. 10, 2018).

[2] Id.

[3] Id.

[4] Id.; see Antman v. Uber Techs., Inc., No. 3:15-cv-01175-LB, 2015 WL 6123054, at *9-12.

[5] Antman, 2018 WL 2151231, at *2-3.

[6] Id. at *5.

[7] Id.

[8] See id.

[9] Id. at *9-12.

[10] Id. at *9. The Court had earlier dismissed plaintiffs’ First and Second Amended Complaints for lack of standing. Id. at *1; see also Antman v. Uber Techs., Inc., No. 3:15-cv-01175-LB, 2015 WL 6123054, at *9-12.

[10] Antman, 2018 WL 2151231, at *2-3.

[11] Id. at *10; see Attias v. Carefirst, Inc., 865 F.3d 620, 625-28
(D.C. Cir. 2017).

[12] Antman, 2018 WL 2151231, at *10.

[13] Id. (internal citation omitted).

[14] Id.

[15] Id. at *11.

[16] Id.

[17] Id. at *12.

[18] See Antman, et al. v. Uber Technologies, Inc., No. 18-16100 (9th Cir. June 8, 2018).

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.

Related Services