A recent federal court decision from Connecticut rejected claims brought by data breach plaintiffs.  (McLoughlin v. People's United Bank, Inc. (Civ. No. 3:08-cv-00944) (Aug 31, 2009) (2009 U.S. Dist Lexis 78065).)  Given the number of consistent decisions on this issue, the case doesn't warrant extensive discussion, except for one thing that jumped out at me.

The facts follow a fairly familiar pattern.  Consumer data is lost from bank.  Bank notifies customers and offers free credit monitoring. Customers sue bank.  Court says customers are out of luck because they have not suffered out of pocket loss.  So far fairly typical.  But tucked into the discussion of this otherwise unfortunately commonplace set of facts is a zinger the court throws out there in the context of discussing whether the harm suffered by plaintiffs is speculative:

there is no allegation as to the fate of the missing box of tapes.  They could have been inadvertently discarded or destroyed, or they could be collecting dust in some forgotten warehouse.  It is only through speculation that one concludes that they are in possession of an individual who is driven to maliciously mine the tapes for the personal data that they contain.  Accordingly, this is not a "risk of injury" case but rather a speculation as to a possible risk of injury.

Huh?  I'm not sure what to say to that exactly, except that it reflects a rather naive view of the state of affairs.  Lost customer data from a bank pretty much speaks for itself (in legal parlance, one might say you're in res ipsa loquitur territory). I understand there are arguments on both sides as to whether and how much aggrieved customers should be able to recover in these circumstances, but courts do an awful lot of contorting to get to the point of saying that the plaintiffs are not "aggrieved."  And these types of statements are great ammunition for legislators.  

Added:  Proskauer Rose (who was on the winning side on this one) posts at its Privacy Law Blog:  "Proskauer Litigation Team Helps Secure Dismissal of Speculative Identity Exposure Claims Against BNY Mellon".