[00:00:01] Speaker 00: Counsel, can you hear us? [00:00:05] Speaker 04: Yes, your honor. [00:00:06] Speaker 00: All right. [00:00:07] Speaker 00: Counsel for appellant, please proceed. [00:00:11] Speaker 04: Thank you, your honor. [00:00:12] Speaker 04: May it please the court. [00:00:13] Speaker 04: My name is Tillen Breckenridge for the plaintiffs. [00:00:16] Speaker 04: Plaintiffs have established an injury in fact based on both direct present injuries and injuries related to potential future identity fraud concerns. [00:00:25] Speaker 04: I'd like to focus on the first because the direct present injuries are a direct course to reversal. [00:00:30] Speaker 04: on whether the plaintiffs have established an injury in fact based on clear Supreme Court precedent. [00:00:36] Speaker 04: The district court in illuminate missed the boat on present injuries because they assume based on cases about financial identity theft, that social security numbers and bank account information are the only forms of sensitive information. [00:00:48] Speaker 04: That's plainly untrue. [00:00:49] Speaker 04: It's easy to imagine highly sensitive information such as a person's STD health status or credit worthiness that is highly offensive to lose control of. [00:00:58] Speaker 01: We don't have to. [00:00:59] Speaker 01: May I ask you this? [00:01:02] Speaker 01: You seem to argue on your appeal that the limitations articulated in Spokeo and TransUnion only apply when a plaintiff pursues a federal statutory claim. [00:01:13] Speaker 01: Why isn't that argument waived? [00:01:14] Speaker 01: I don't see where you raised it below. [00:01:16] Speaker 01: Did I miss it? [00:01:18] Speaker 04: Oh, no, Your Honor, that specific argument wasn't raised below, but that's also not what we're arguing here. [00:01:25] Speaker 01: To the degree that's a relevant argument, would you agree that's waived? [00:01:32] Speaker 04: I wouldn't agree that it's necessarily forfeited. [00:01:35] Speaker 04: But nonetheless, the discussion of whether or not the application of statutory claims with really more background for how kind of out of left field it is in this case [00:01:48] Speaker 04: to then determine that there was no concrete injury given the fact that there's no federal statute at issue and that's really been the focus of standing cases in the Supreme Court. [00:02:01] Speaker 04: But nonetheless, the court doesn't need to reach any of that in this case because we've articulated injury in fact based on common law injuries directly. [00:02:12] Speaker 01: And help me with this. [00:02:14] Speaker 01: Are you talking about the tort of inclusion upon seclusion? [00:02:17] Speaker 01: I mean, inclusion upon seclusion, is that right? [00:02:21] Speaker 04: Intrusion upon seclusion, sir, your honor, yes. [00:02:23] Speaker 01: And you believe that you've pled such a common law tort before the district court? [00:02:33] Speaker 04: Yes, your honor. [00:02:34] Speaker 04: It's in the complaint in Count Ford invasion of privacy. [00:02:39] Speaker 04: But even if we hadn't, [00:02:41] Speaker 04: We pleaded the injury and that's really what's at issue here. [00:02:44] Speaker 04: Not necessarily pleading the entire cause of action, but pleading the injury. [00:02:49] Speaker 01: So basically if you have this old tort, basically, and you don't indicate what the elements of the tort are and you don't claim those, but you claim that the injury that would come from that, that's enough under TransUnion and Spokeo for standing? [00:03:05] Speaker 04: That's enough to establish a concrete injury in fact. [00:03:08] Speaker 04: the other elements of standing. [00:03:09] Speaker 04: It's not enough for, but those are not an issue here. [00:03:13] Speaker 01: Okay. [00:03:13] Speaker 01: Well, let me ask you this in terms of a concrete injury. [00:03:16] Speaker 01: In fact, let's say, arguing though, that you pled this. [00:03:20] Speaker 01: Tell me in what way these folks, the students, were injured. [00:03:25] Speaker 01: They got their grades, their disciplinary histories, accommodation information that was potentially compromised. [00:03:31] Speaker 01: How were they harmed? [00:03:33] Speaker 01: And in fact, [00:03:35] Speaker 04: Well, they were harmed, in fact, in the same way that there's an injury and intrusion upon seclusion insofar as their private information became known and they lost control of it. [00:03:47] Speaker 04: And so as the California Supreme Court stated in Hernandez and stated in Shulman, there is an inherent injury there, just like in Trespass case. [00:03:58] Speaker 04: There is an injury, in fact, just by someone coming on one's property, even if they don't actually disturb anything on the property. [00:04:05] Speaker 04: You don't have to cut down a tree or break something at someone's house for there to be an injury with trespass. [00:04:12] Speaker 04: It's just the measure of the injury of having been intruded upon in that way. [00:04:17] Speaker 01: So if I understand you correctly, you're saying that based upon the tort that you rely upon, that [00:04:26] Speaker 01: any potentially confidential information that is out there, regardless of whether anybody ever uses it, regardless of whether it would be confidential or would be harmful, that in and of itself constitutes enough of a harm that you've met the standing requirement. [00:04:42] Speaker 01: Is that correct? [00:04:44] Speaker 04: It constitutes enough of a harm. [00:04:46] Speaker 04: Any confidential information that is particularly sensitive would then meet the standard required for establishing a concrete injury in fact. [00:04:57] Speaker 01: In this particular case, if I understand the facts correctly, let me just get my notes here. [00:05:03] Speaker 01: I want to say this correctly. [00:05:05] Speaker 01: It seems to me that lots and lots of time has passed since this information was taken. [00:05:13] Speaker 01: And nothing seems to have happened with it. [00:05:16] Speaker 01: And I'm wondering how that constitutes an injury. [00:05:22] Speaker 01: Oh, here it is. [00:05:23] Speaker 01: It's been three years since the hack. [00:05:26] Speaker 01: There have been no requests for the data on the dark web. [00:05:29] Speaker 01: And the data has not been sold. [00:05:31] Speaker 01: There was a ransomware attack, criminal activity. [00:05:35] Speaker 01: But aside from that, what's the harm? [00:05:40] Speaker 01: Who's been harmed by this? [00:05:42] Speaker 04: Well, your honor, every student who lost private information in this act has been harmed. [00:05:48] Speaker 04: Does it matter the nature of the private information? [00:05:51] Speaker 04: Yes, the nature of the private information does matter. [00:05:54] Speaker 04: If it's completely nonsensitive information, then this would at least be a closer case. [00:06:00] Speaker 04: But given the incredible sensitivity of the information here, grades, disability. [00:06:07] Speaker 01: Why would that be information of that nature? [00:06:10] Speaker 01: That's routinely requested. [00:06:13] Speaker 04: by employers it's routinely requested by people when you apply to college or other things those are routinely requested why is that confidential information well it's confidential information because they are requested of the person who actually owns that information so that person has to then give it over so that that person has control over the information it's still very sensitive information that is recognized in federal statutes such as FERPA [00:06:42] Speaker 00: Council, in the data breach context, what is your strongest case authority to support your position that the mere taking of the information constitutes the injury, the mere existence of the information constitutes the injury? [00:07:02] Speaker 00: What is your strongest case in the data breach context? [00:07:07] Speaker 04: Well, there would probably be two that I would go to. [00:07:09] Speaker 04: Number one would be Horizon Healthcare in the Third Circuit, and then here in the Home Circuit, there would be NIAP. [00:07:15] Speaker 04: So with NIAP, you have a situation where Capital One just went in, obtained credit reports on people without any authorization or anything like that. [00:07:25] Speaker 04: There's no indication that they disclosed any information. [00:07:28] Speaker 04: There's no indication that they actually did anything with the information. [00:07:32] Speaker 04: But this court recognized that the harm there of them taking the credit information was akin to the harm in intrusion upon seclusion. [00:07:42] Speaker 00: That would be true if you were suing the person who actually took the information, but you're suing the people who hailed the information, so that case isn't really on point, is it? [00:07:58] Speaker 04: Well, it's completely on point for the injury, Your Honor, and that's what we're here about. [00:08:02] Speaker 04: We're here about them being the same injury. [00:08:04] Speaker 00: You would have a different argument if you were suing the people who actually [00:08:10] Speaker 00: um breach the confidentiality of the information because the illuminate had the information with permission well i would disagree with that premise your honor um because really yes for reasons stated do you disagree with the with the notion that illuminate was permitted to have the information [00:08:32] Speaker 04: Yes, Your Honor. [00:08:33] Speaker 04: So on page six of our opening brief, there are facts stated that I can't address here because it's under seal because Illuminate has determined that that information is sensitive and confidential. [00:08:45] Speaker 00: Did you make the argument to the district court that Illuminate did not have permission to store the information? [00:08:54] Speaker 04: No, Your Honor, that wasn't an issue that was relevant in the district court. [00:08:58] Speaker 04: So we never had to address it. [00:09:01] Speaker 04: Because in the end, like I said before, it's not relevant to the issue of whether or not there's actually injury. [00:09:09] Speaker 00: Well, it's relevant if you say that Nyop is a similar case because it's not similar facts. [00:09:19] Speaker 04: Well, Your Honor, it is. [00:09:21] Speaker 04: I suppose I'll have to disagree with you on whether it's similar facts on the injury. [00:09:25] Speaker 04: But even then, you still have Horizon Healthcare, which if you're looking for similar facts in that respect, in Horizon Healthcare, the company that had the information was the defendant in that case where a laptop was stolen. [00:09:42] Speaker 04: And the Third Circuit recognized that the injury at issue was a privacy injury that is redressable [00:09:51] Speaker 04: in federal court. [00:09:53] Speaker 01: That involved a negligence on the part of the company, did it not? [00:09:58] Speaker 04: Yes, Your Honor, and here there is gross negligence on the part of the company as stated at page six of the opening brief. [00:10:06] Speaker 02: Yeah, so isn't, just to pursue that or make sure I understand that, so let's take what would normally be pretty sensitive information, which is disability status. [00:10:18] Speaker 02: and the particulars of the disability. [00:10:23] Speaker 02: And as I understand it, that information was provided, but under a promise of confidentiality. [00:10:32] Speaker 02: And then through the gross negligence of Illuminate, it became available to the hacker. [00:10:38] Speaker 02: Do I have that right? [00:10:39] Speaker 02: That's absolutely right. [00:10:46] Speaker 01: Well, the very fact that [00:10:48] Speaker 01: they were hacked by this ransomware people. [00:10:53] Speaker 01: That in and of itself constitutes from your perspective an actionable, it was actionable on what they did, right? [00:11:03] Speaker 01: By not protecting from the ransomware people? [00:11:07] Speaker 04: Well, it depends on how you define actionable. [00:11:09] Speaker 04: There's certainly more to the claims than that, more required to the claims than that. [00:11:12] Speaker 04: To prove negligence, we have to prove that they had done something negligent. [00:11:17] Speaker 04: and things like that. [00:11:18] Speaker 04: But as far as whether or not there's a concrete injury in fact, which is the issue here, yes, all it takes is that there was a data breach of sensitive information that a person has a common law right to control. [00:11:33] Speaker 04: And that's what happened here. [00:11:35] Speaker 04: So for that narrow issue that we're here for of whether there's a concrete injury in fact, those three elements establish a concrete injury in fact. [00:11:45] Speaker 04: But you'd still have to establish that it's a particularized injury and things like that. [00:11:50] Speaker 04: But that, of course, is obvious here that it is a particularized injury. [00:11:54] Speaker 04: The plaintiffs are the people who own the information. [00:11:56] Speaker 04: It's not some random person off the street or anything like that. [00:11:59] Speaker 01: What do we do with the concept that I think the district court went off on, which was that these were conclusory allegations on your part about this information being available? [00:12:11] Speaker 04: Being mindful that I would like to keep a couple of minutes for rebuttal. [00:12:17] Speaker 04: My response to that is just that the district court was wrong to say it's conclusory when we've provided a myriad of facts supporting the conclusion because the conclusion was that they were injured. [00:12:30] Speaker 04: But then we provided all of the facts establishing that this is sensitive, that sensitive information was taken and the sensitivity of the information, particularly given all the statutory protections of that information. [00:12:44] Speaker 04: So I'm not sure where the district court came to the conclusion that it was conclusory to allege an injury in fact, a concrete injury in fact. [00:12:54] Speaker 00: Well, but you talked about a number of the ways that the information could be used to injure the students in the future. [00:13:04] Speaker 00: I think that's what the district court was talking about as being somewhat speculative about what some of the potential uses of the information could be. [00:13:14] Speaker 00: And as Judge Smith said, that hasn't materialized [00:13:18] Speaker 04: Well, Your Honor, I disagree with that concept by the district court, but that's only relevant to the second set of injuries, which is the injuries related to the potential future injuries. [00:13:31] Speaker 04: That is completely irrelevant to whether there is our present injuries involving the invasion of the privacy of these students. [00:13:38] Speaker 00: So are you no longer standing on the allegations regarding potential future injuries? [00:13:44] Speaker 04: No, we are, Your Honor. [00:13:45] Speaker 04: That's our second argument in the briefing. [00:13:48] Speaker 04: establishing that there is definitely an imminent threat and risk here. [00:13:54] Speaker 00: How can it be imminent if all of this time has passed and nothing has materialized? [00:14:00] Speaker 04: Well, Your Honor, it depends on the record kind of being stable since or not supplemented since the complaint. [00:14:09] Speaker 04: In the end, it can be imminent insofar as that the risk is still very substantial and it sits in grand importance, but on the flip side of that, as far as nothing having materialized yet, we've argued and we pointed out in our complaint that it often takes years for particularly children's information to be used against them. [00:14:29] Speaker 04: The allegation that it takes years for information to be used against people was something this court credited in Zappos and recognize that that's an important allegation establishing the risk of future injury. [00:14:42] Speaker 02: And maybe I'm misremembering, but correct me if I'm wrong, I think you allege that because of that ongoing threat, some of the members of the class have gone out and had to expend money to get better protection than the protection that Illuminate should have provided. [00:15:02] Speaker 04: That's right, Your Honor. [00:15:03] Speaker 04: Some of the members of the class with this non-speculative risk of future injury [00:15:08] Speaker 04: had to go out and get monitoring protection. [00:15:11] Speaker 04: That said, paragraph 160 of the complaint, page ER168. [00:15:17] Speaker 00: But that has not been credited as an injury in data breach cases, has it? [00:15:26] Speaker 00: Having to get credit monitoring services, has that been credited as an injury in data breach cases? [00:15:32] Speaker 04: I'm not aware of any specifically, but I'm also not aware of any cases saying that that can't be an injury. [00:15:38] Speaker 04: And going back to your question, Your Honor, about whether or not there have been injuries, there is the JMV Illuminate case that's currently in the California Supreme Court. [00:15:49] Speaker 04: The California Court of Appeal did recognize there that there was an allegation by JM that his information had been sold and used. [00:16:00] Speaker 00: All right. [00:16:01] Speaker 00: Thank you, Counsel. [00:16:01] Speaker 00: We'll give you a couple of minutes for rebuttal. [00:16:04] Speaker 00: Thank you, Your Honor. [00:16:06] Speaker 03: Good morning and may it please the court, Devin Anderson on behalf of Illuminate Education. [00:16:11] Speaker 03: The district court here correctly found that these plaintiffs have not shown that they have standing to pursue their claims. [00:16:18] Speaker 03: I think three key factors drive this conclusion. [00:16:22] Speaker 03: First, the alleged injuries are entirely hypothetical. [00:16:25] Speaker 03: There are no allegations that these plaintiffs, let alone anybody else, has experienced bullying, spearfishing, blackmail, identity theft, or any of the harms that plaintiffs have committed. [00:16:35] Speaker 02: Well, I think the argument being made by your adversary is [00:16:39] Speaker 02: that it's an inherent injury. [00:16:41] Speaker 02: If, for example, I've had to disclose as a student that I suffer from a severe disability, let's say schizophrenia, but it's controlled by medication, nevertheless, even within a university, that would be kept highly, highly confidential. [00:17:05] Speaker 02: And so the argument, as I understand it, from your adversary is when some third party having no right to that information gets it, that in itself is sufficient injury. [00:17:19] Speaker 03: So two points in response to that Judge Rakoff. [00:17:22] Speaker 03: I think the first point and the dispositive point here is no plaintiff has made that sort of allegation. [00:17:27] Speaker 03: And at the motion to dismiss stage here, we're not talking about some hypothetical class. [00:17:32] Speaker 03: We're talking about the standing of these plaintiffs to bring these claims. [00:17:36] Speaker 03: But setting that aside, let me address kind of the more overarching doctrinal point, which is the trans-union test says we have to look to see whether plaintiffs have pointed to [00:17:48] Speaker 03: an intangible harm, which can be concrete, which is what TransUnion held, if it has a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts. [00:17:59] Speaker 03: Here, plaintiffs sort of bounce back and forth before the district court. [00:18:04] Speaker 03: The most that they may be argued was public disclosure of private facts. [00:18:07] Speaker 03: on appeal, they've now pivoted to this intrusion upon seclusion. [00:18:11] Speaker 03: I don't think that was squarely presented to the district court. [00:18:15] Speaker 02: Let's assume you're right about waiver. [00:18:17] Speaker 02: That would be the end of that. [00:18:18] Speaker 02: But let's assume now that it was waived. [00:18:21] Speaker 03: Sure. [00:18:21] Speaker 03: So let me take on intrusion upon seclusion. [00:18:24] Speaker 03: I think this court's decision last year, I guess, or 2025, two years ago or a year and a half ago in the Phillips case, [00:18:31] Speaker 03: lays out how we approach this test. [00:18:33] Speaker 03: And it builds on, frankly, the court's prior work in the Facebook internet tracking case, in the Patel case, and in the Nyab case about how we do this common law comparator analysis. [00:18:45] Speaker 03: So for intrusion upon seclusion, the essence of the harm is that there's somebody, the defendant, has intentionally intruded upon the solitude or seclusion of the private affairs of the plaintiffs. [00:18:56] Speaker 03: And that intrusion has to be highly offensive to a reasonable person. [00:18:59] Speaker 03: That's how this court has articulated the comparator framework in the cases I just discussed. [00:19:07] Speaker 03: Here, however, the allegations that plaintiffs have made are fundamentally incompatible with the essence of the harm arising from the tort of intrusion upon seclusion. [00:19:17] Speaker 03: Here there was no intentional intrusion by Illuminate. [00:19:21] Speaker 03: We were the victim of a cyber attack. [00:19:24] Speaker 02: So the question under the TransUnion question is, is gross negligence sufficiently related to that common law contention that it can substitute for intent? [00:19:40] Speaker 03: So, Your Honor, I don't think it is. [00:19:43] Speaker 03: And let me explain why I think that. [00:19:46] Speaker 03: I think the essence of the tort, if you look at the restatement, the California Supreme Court's decision that my friend on the other side referenced, Hernandez versus Hillsides, does a very thorough job of [00:19:56] Speaker 03: describing what the harm associated with intrusion upon seclusion looks like and it looks a lot like the cases this court dealt with in Patel and in Facebook tracking where you had the defendant, let's take Facebook internet tracking case, you had the defendant in that case surreptitiously and contrary to the representations it had made to its users, [00:20:17] Speaker 03: recording every web page that that user was visiting once it left Facebook and basically sitting on the shoulder of that plaintiff as those plaintiffs went around visiting a bunch of different sites on the internet. [00:20:29] Speaker 03: And in that case, this court found that the harm there was closely analogous or bore a close relationship to the harm associated with the tort of intrusion upon seclusion. [00:20:39] Speaker 03: I think the key distinction here, though, is that there is no allegation beyond negligence [00:20:46] Speaker 03: and maybe even gross negligence. [00:20:48] Speaker 03: I don't think gross negligence is actually alleged here, but I'm going to grant you that, Judge Rakoff, for purposes of the hypothetical. [00:20:54] Speaker 03: There are no, I'm not aware of any cases, certainly my friend on the other side hasn't pointed to any, in which a court has sustained an intrusion upon seclusion claim in the presence of negligent activity by the defendant, as opposed to affirmative activity by the defendant. [00:21:09] Speaker 03: Affirmative activity is what was present in those cases that we just discussed. [00:21:13] Speaker 03: And indeed, plaintiffs here haven't even alleged facts showing that their personal data was ever opened, viewed, or otherwise intruded upon. [00:21:22] Speaker 03: As Judge Smith talked about in the colloquy with my friend on the other side, the allegation here is of a particular style of attack against illuminate in which illuminate is extorted. [00:21:33] Speaker 03: and the allegations and the complaint, I would encourage the court to review those allegations at 3ER 136 through 138 that describe the interactions between the threat actor and Illuminate. [00:21:48] Speaker 03: I think the nature of this attack distinguishes it pretty significantly from some of the cases like this Neiman Marcus case, Ramajas, that my friend on the other side points to where the court in that case is like, [00:22:00] Speaker 03: You know, why else would someone break in and steal this data if not to use it in the future? [00:22:04] Speaker 03: Well, we have an answer to that question in this case, namely to extort money from my client, Illuminate, which they did. [00:22:11] Speaker 03: And there's been no further instances or examples of that data being used in any way, even granting the point that the complaint sort of froze in time in June of 2023 when it was last filed. [00:22:26] Speaker 03: That complaint was filed 18 months after the incident and with the benefit of substantial discovery from my client, discovery that you see scattered throughout that complaint. [00:22:36] Speaker 03: I think that those facts, talking about the nature of the attack, the absence of any allegations showing that this data has been misused in any way or any of the ways that the plaintiffs hypothesize about, and then the nature of the data itself, [00:22:51] Speaker 03: are the three factors that really support the way the district court thought about this. [00:22:56] Speaker 03: Although some of the data at issue certainly may be sensitive for some individuals in some ways, plaintiffs have not shown or alleged that they have data that they gave that was given to illuminate that is the sort of data that this court has previously found gives rise to an injury. [00:23:12] Speaker 03: So I've talked a little bit about intrusion upon seclusion. [00:23:15] Speaker 01: Counsel, let me just be sure I understand what you're saying. [00:23:17] Speaker 01: In other words, even if there [00:23:21] Speaker 01: is a cause of action or disclosing or due to gross negligence having someone discover sensitive information. [00:23:32] Speaker 01: Your claim I gather is that the individual plaintiffs in this case [00:23:37] Speaker 01: have not alleged that they personally had particular types of sensitive information disclosable. [00:23:43] Speaker 01: Is that correct? [00:23:45] Speaker 03: That's correct, Your Honor. [00:23:46] Speaker 03: And it's an unpublished decision, but we submitted it via our 28J submission. [00:23:50] Speaker 03: This court had a decision, Greenstein, about six or seven months ago that I think is quite similar and instructive on this issue. [00:23:58] Speaker 03: And in Greenstein, the claim there related to identity theft, and the plaintiffs had claimed that [00:24:03] Speaker 03: They might have had, for example, driver's license numbers in that case as part of the set of data that had been taken by the threat actor. [00:24:12] Speaker 03: And this court said that wasn't enough to say, well, maybe our data might be in that set. [00:24:17] Speaker 03: And that's entirely consistent with standing precedents from this court and the Supreme Court going back a long ways. [00:24:23] Speaker 03: So I don't think that the plaintiffs in this case have alleged an action or a valid intangible injury. [00:24:29] Speaker 03: We talked a little bit about intrusion upon seclusion. [00:24:32] Speaker 03: There is some stray references to the tort of defamation and the injury associated with defamation in plaintiff's briefs. [00:24:39] Speaker 03: And that's actually the one that they argued below. [00:24:41] Speaker 03: You can sort of squint and see that argument. [00:24:43] Speaker 03: They said they were like the portion of the class for which standing was found in the trans-union case. [00:24:50] Speaker 03: I don't think that's correct at all. [00:24:52] Speaker 03: And I think Judge Selma rightly rejected that argument. [00:24:54] Speaker 03: Recall that the Supreme Court's analysis in TransUnion found that the essence of an injury that was a close analog to the common law tort of defamation was the dissemination of a false statement. [00:25:07] Speaker 03: Here, you don't have either of those. [00:25:09] Speaker 03: There's no allegation that the information that Illuminate had from plaintiff's schools was false. [00:25:14] Speaker 03: And there's certainly no allegation that Illuminate disseminated that in the way that TransUnion was [00:25:21] Speaker 03: alleged to have disseminated false terrorist designations as to that subset of plaintiffs for whom there had been evidence that TransUnit had sent those to other third parties. [00:25:32] Speaker 01: That to me gets back to Judge Rawlinson's question to your friend. [00:25:37] Speaker 01: The claim here is not brought against the ransomware attackers. [00:25:42] Speaker 01: It's brought against the victim of the ransomware attack. [00:25:46] Speaker 01: There was no intention on the part of Illuminate to have this information [00:25:50] Speaker 01: put out there. [00:25:52] Speaker 01: What role, if any, does that play in our analysis? [00:25:55] Speaker 03: I think it plays an important role. [00:25:57] Speaker 03: Your Honor, I think it does go to the question of whether plaintiffs have made out an injury analogous to the tort of intrusion upon seclusion. [00:26:04] Speaker 03: The answer might be different if they had sued the threat actor. [00:26:07] Speaker 03: as opposed to illuminate. [00:26:08] Speaker 03: And I think that the defendant, of course, matters. [00:26:11] Speaker 03: When we're looking at standing, we're looking at the standing of these parties to bring these claims against this defendant, not whether some hypothetical claims might exist against some defendant in the future. [00:26:21] Speaker 03: So I think that really undermines plaintiff's case for an intangible harm associated with the tort of intrusion upon seclusion. [00:26:28] Speaker 03: I also think the nature of the attack, as Your Honor described it, really undermines the claim that plaintiffs face a substantial imminent risk of future harm. [00:26:37] Speaker 03: Plaintiffs have never really explained exactly what form that harm might take or brought that home to themselves. [00:26:44] Speaker 03: This is why I think Judge Selna was correct to say, look, you can talk about all these potential harms that might happen in certain fact patterns, but without the connective tissue to these plaintiffs and the data that they had and this particular attack, that truly is speculative. [00:26:59] Speaker 03: And I think Judge Selna got that exactly right when he looked at the allegations in this complaint. [00:27:04] Speaker 03: If you look at this court's prior decisions in the Zappos case and in the Krotner case, those cases, number one, dealt with identity theft, which is something that plaintiffs really have. [00:27:14] Speaker 03: I'm not quite sure if they're still pursuing it, but they seem maybe to have dropped those arguments here on appeal. [00:27:20] Speaker 03: And in two, those cases involved information that is known to be associated with and used to commit identity theft. [00:27:28] Speaker 03: And there were examples of identity theft that were at least temporally related to the attack that occurred in that case. [00:27:37] Speaker 03: So I think plaintiffs have basically abandoned [00:27:40] Speaker 03: any of their arguments, any other types of injuries beyond the intangible injury associated with them on seclusion, and that I think they didn't even argue below, or the risk of future harm. [00:27:50] Speaker 03: I think both of those are insufficient on these allegations as they pertain to these specific plaintiffs. [00:27:56] Speaker 03: If there are no further questions by the court on standing, I want to say just a few general points about the merits and then I'll otherwise rest on my briefs unless the panel has any questions. [00:28:05] Speaker 03: The first point that I would make is that even if the court finds that these plaintiffs have satisfied the standing inquiry, that's not at all dispositive. [00:28:13] Speaker 03: of whether plaintiffs have alleged a cognizable injury as a matter of the state law claims that they bring. [00:28:19] Speaker 03: In fact, this court issued memorandum dispositions in Crotner. [00:28:24] Speaker 03: Crotner they found standing, but then dismissed on state law grounds. [00:28:27] Speaker 03: Same thing with Pruchnicki. [00:28:29] Speaker 03: For example, a risk of future harm is not a cognizable harm under tort and contract law. [00:28:35] Speaker 03: Emotional distress is also not recoverable in the garden variety negligence case. [00:28:41] Speaker 03: We've cited cases to that extent in our briefs. [00:28:44] Speaker 03: Second, and Judge Rollinson alluded to this, Illuminate contracts with schools and school districts. [00:28:50] Speaker 03: It doesn't deal with the individual students. [00:28:52] Speaker 03: It's not contracting with them. [00:28:53] Speaker 03: It's not interacting with them. [00:28:55] Speaker 03: And that lack of relationship between plaintiffs and Illuminate precludes a great many of plaintiff's claims. [00:29:02] Speaker 03: It goes to the availability of the economic loss doctrine for the negligence claims. [00:29:07] Speaker 03: It shows the lack of mutual assent or third party beneficiary status for contract claims. [00:29:12] Speaker 03: It undermines their breach of confidence claim where there hasn't been a conveyance from plaintiffs to illuminate, and it undermines any examples of causation or reliance when it comes to consumer protection statutes or fraud claims because there's no connection between illuminates conduct and actions that plaintiffs took or did not take. [00:29:30] Speaker 03: If there are no further questions from the panel, we would ask that the court affirm the dismissal of plaintiffs claims. [00:29:35] Speaker 01: Counsel, let me just ask you this following on what you just said about the third-party beneficiary concept. [00:29:40] Speaker 01: That, of course, relies upon a [00:29:42] Speaker 01: reasonable expectation of what might happen. [00:29:46] Speaker 01: In this particular case, I gather there are no allegations that the basically you got a third party beneficiary issue because it was reasonably expected that someone would basically an attacker would get this information and take it out. [00:30:03] Speaker 01: Is that right? [00:30:05] Speaker 03: So if you're talking about the breach of contract theory, their breach of contract theory relies upon the contracts that Illuminate has with the school districts. [00:30:15] Speaker 03: And they want to say school districts are obviously serving students. [00:30:21] Speaker 03: And so we must be third party beneficiaries. [00:30:24] Speaker 03: But they actually attach the one agreement with my client has with the New York Department of Education. [00:30:31] Speaker 03: 3ER85, and that agreement has very specific language that limits the benefits of the agreement to the parties. [00:30:39] Speaker 03: And in this court's decision in no versus BMW, that's precisely the sort of language that the court found did not give rise to valid third-party beneficiary status. [00:30:50] Speaker 03: If there are no further questions, I thank the court for its time and would ask the court to affirm the decision below. [00:30:57] Speaker 00: Thank you, counsel. [00:30:58] Speaker 00: Let's have two minutes for rebuttal. [00:31:03] Speaker 00: Two minutes. [00:31:10] Speaker 00: Thank you. [00:31:11] Speaker 00: Your bottle. [00:31:13] Speaker 04: Thank you, Your Honor. [00:31:14] Speaker 04: I'd like to take my time to correct a few mischaracterizations made in the illuminates argument, but specifically is not true that we haven't alleged that the named plaintiffs gave data that's sensitive. [00:31:32] Speaker 04: Right there in the complaint, numerous paragraphs establishing sensitivity. [00:31:36] Speaker 04: Let's take, for instance, [00:31:38] Speaker 04: Ms. [00:31:38] Speaker 04: Vitro stating that the complaint statements, I believe starting at paragraph 214, stating that Ms. [00:31:46] Speaker 04: Vitro gave information about her child's disability to the school district and the school district had that information and then received a letter from Illuminate indicating that that information may have been taken. [00:31:59] Speaker 04: And then with respect to grades and free lunch status and other sensitive information like that, of course the school district has that information. [00:32:09] Speaker 04: It seems kind of judicially noticeable that the school district has the information that it has their grades. [00:32:17] Speaker 04: Another misstatement I'd like to correct is the third party beneficiary question. [00:32:24] Speaker 04: The notion that the students are not beneficiaries of this contract. [00:32:30] Speaker 04: The California Court of Appeal has established in JMV Illuminate, so Illuminate is the defendant in that case, that the students are the beneficiaries of the contract and the contract does in your to their benefit. [00:32:46] Speaker 04: There is some specific discussion of that in the last page of the reply brief, so that can direct you directly to the page [00:32:53] Speaker 04: where the court is 100% clear. [00:32:56] Speaker 04: The California Court of Appeals 100% clear that the students are the people who are intended to be protected by the privacy provisions and the other provisions of the contract that I cannot discuss because of the seal. [00:33:07] Speaker 04: And so therefore, the students are the people who were injured. [00:33:10] Speaker 04: The students are the victims of this data breach, the true victims of this data breach. [00:33:15] Speaker 04: And unless they're- Thank you. [00:33:17] Speaker 02: I do have one question, forgive me. [00:33:20] Speaker 00: As long as you have questions, we'll go forward. [00:33:22] Speaker 02: the so what do you say in response to your adversaries argument that the analogous common law tort is an intentional tort and here there was no allegation of intent on the part of illuminate two things your honor number one intent [00:33:45] Speaker 04: doesn't get to whether there was an actual injury or concrete injury. [00:33:49] Speaker 04: It just gets to the merits of whether or not we can prove that claim, but that claim is not essential to every cause of action that we have. [00:33:57] Speaker 04: And number two, the standard isn't that we have to meet every single element of the common law injury. [00:34:04] Speaker 04: It's to a certain injury that is akin to a common law injury. [00:34:08] Speaker 04: Here it is akin to the common law injury of intrusion upon seclusion. [00:34:13] Speaker 04: And as we stated below, intrusion upon seclusion, disclosure of private fact, and defamation, because there was a disclosure here. [00:34:22] Speaker 04: Illuminate, disclose to cyber criminals this information. [00:34:30] Speaker 04: And in defamation, there's no element requiring establishing that people intended to do bad things with the information. [00:34:37] Speaker 04: It's just that there has to be a disclosure of information. [00:34:41] Speaker 04: And so here we have [00:34:43] Speaker 04: very clear injury that has three common law analogs for a present direct injury. [00:34:51] Speaker 04: When that information was taken, very sensitive private information of the plaintiff was taken by cyber criminals. [00:35:01] Speaker 01: Justin, if you had a question. [00:35:05] Speaker 01: I'm OK with it. [00:35:05] Speaker 01: I'm OK. [00:35:06] Speaker 01: Thank you. [00:35:07] Speaker 00: All right. [00:35:08] Speaker 00: Judge Rakoff, anything else? [00:35:09] Speaker 01: No, that's fine. [00:35:10] Speaker 00: Thank you. [00:35:11] Speaker 00: Thank you to both counsels for your helpful arguments. [00:35:13] Speaker 00: The case just argued is submitted for a decision by the court.