The IT Law Wiki


Whitaker v. HealthNet of CA, Inc., Civ. S-11-0910 KHM DAD (E.D. Cal. Jan. 19, 2012) (full-text).

Factual Background[]

Defendant IBM manages the information technology infrastructure for defendant HealthNet, which maintains personal and medical information for a large number of California residents. Plaintiffs in this matter are all California citizens who received a notice from HealthNet regarding the loss of their personal information. Plaintiffs filed a putative class action alleging (1) violation of the Confidentiality of Medical Information Act ("CMIA") and (2) violation of the Customer Records Act ("CRA"). The matter was dismissed pursuant to IBM’s motion to dismiss for lack of standing after the court determined the plaintiffs had not sufficiently plead an injury in fact.

Trial Court Proceedings[]

Plaintiffs’ sole claim for damages stems from the loss of their data, which, allegedly, supports a holding that they face the threat of further harm. To establish standing, plaintiffs rely on Krottner v. Starbucks Corp.,[1] and Ruiz v. Gap, Inc.,[2] Both Krottner and Ruiz, however, dealt with the theft of information, not the loss of information. Both courts also found standing where there was a high degree of risk of identity theft.

Recently, in Low v. Linkedin Corp.,[3] the Northern District of California found the named plaintiff lacked standing where the plaintiff failed to allege any present harm and his allegations of possible harm were "too theoretical to support injury-in-fact for the purposes of Article III standing." The Low plaintiffs had alleged that private information was disclosed to third parties, but did not allege that such disclosure had caused the plaintiffs harm.

In the present case, the only allegation of harm alleged is in paragraph 30 of the amended complaint, in which plaintiffs allege that one of them received a letter informing them their minor daughter’s Social Security Number had been misused. The minor is not a named plaintiff in this action.

That a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that the injury has been suffered by other, unidentified members of the class of which they belong and which they purport to represent.[4]

The court, holding that the plaintiffs’ allegations of harm were wholly conjectural and hypothetical, granted IBM's motion insofar as it alleged lack of subject matter jurisdiction.


  1. 628 F.3d 1139 (9th Cir. 2010) (full-text).
  2. 380 Fed. Appx. 689 (9th Cir. May 28, 2010).
  3. 2011 U.S. Dist. Lexis 130840, at *9 (N.D. Cal. Nov. 11, 2011) (full-text).
  4. Lewis v. Casey, 518 U.S. 343, 357 (1996) (full-text).