Online Data Breaches, Standing, and the Third-Party Doctrine

The third-party, standing, and reasonable expectation of privacy doctrines make it more difficult for citizens to recover damages that are directly and proximately caused by online data breaches, and make it less likely that private companies will adopt stringent procedures to protect personal information. In an era of hackers, malware, and inadvertent disclosures of private information, the law should allocate the risk to companies that are in a position to minimize or prevent infringements on consumers’ privacy. In the context of online data breaches, abandoning the third-party doctrine, eliminating the “imminent harm” prong of the standing doctrine, and focus on a societal, not subjective, expectation of privacy, will provide the types of safeguards that meet the challenges posed by digital era technology