The U.S. Court of Appeals for the Ninth Circuit has held that the disclosure of sensitive medical information can constitute an injury sufficient to establish standing to sue in federal court, relying on scholarship by Neil Richards, Koch Distinguished Professor in Law and Co-Director at The Cordell Institute.
In its October 9 decision in Black v. IEC Group, the court cited Professor Richards’ 2006 Georgetown Law Journal article titled Privacy’s Other Path: Recovering the Law of Confidentiality, co-authored with Daniel Solove, a professor at George Washington University Law School and a 1994 WashU college graduate. The article traces the longstanding role of privacy protections in American and English law, particularly the duty to maintain the confidentiality of information entrusted to others.
The ruling comes amid increased scrutiny of what qualifies as an “injury in fact” under Article III of the U.S. Constitution, which governs a plaintiff’s ability to bring a case in federal court. In recent years, courts have increasingly required plaintiffs to show that an alleged injury bears a close relationship to harms traditionally recognized under Anglo-American law.
Professor Richards and Solove’s paper showed the deep roots in American law of principles of confidentiality, and their research was relied on by the court for the important proposition that a data breach of sensitive medical information is itself a well-recognized legal injury. As the court put it, “[i]n short: a trust betrayed is the harm.” While Richards’s paper is twenty years old, he has continued to work on questions of privacy, trust, and reliance. His work at the Cordell Institute on these issues led earlier this year to Utah becoming the first state to pass a statute mandating a duty of data loyalty on state-enabled digital identity technologies.
