[Infowarrior] - Court dismisses lawsuits over OPM data breach

[Richard Forno]

Court dismisses lawsuits over OPM data breach

By Morgan Chalfant - 09/19/17 03:40 PM EDT

http://thehill.com/policy/cybersecurity/351395-court-dismisses-lawsuits-over-opm-data-breach

A District of Columbia court has dismissed two lawsuits over the Office of Personnel Management (OPM) data breach disclosed in 2015. 

The American Federation of Government Employees, the largest federal workers union, filed the class action lawsuit against OPM in June 2015, alleging that the breaches stemmed from gross negligence on the part of federal officials.

The lawsuit was one of two consolidated complaints related to the OPM breach that the U.S. district court for D.C. dismissed on Tuesday, ruling that both sets of plaintiffs lacked the standing to bring their cases. 
In 2015, OPM disclosed two related cybersecurity breaches in which data on over 20 million Americans, most of them federal workers, was stolen by hackers.

The plaintiffs in the AFGE suit, which included the union and an additional 38 federal workers, sought damages  under the Privacy Act and the Little Tucker Act, as well as declaratory and injunctive relief under the Administrative Procedure Act. 

OPM argued last year that the case should be dismissed, arguing that the federal workers did not meet the basic requirements of the court for bringing forth the lawsuit.

Another union, the National Treasury Employees Union, also sued against OPM’s acting director, alleging violations of their constitutional right to information privacy. 

On Tuesday, the D.C. court dismissed both complaints, saying that neither set of plaintiffs “has pled sufficient facts to demonstrate that they have standing.” 

“Defendants’ motions to dismiss will be granted, and both cases will be dismissed in their entirety. The Court finds, applying the case law it is required to follow, that neither set of plaintiffs has pled sufficient facts to demonstrate that they have standing,” the court wrote in a memorandum opinion filed on Tuesday. 

“Plaintiffs seek damages for improper disclosure of information and for a failure to maintain adequate safeguards under the Privacy Act, but they have not alleged that private information was ‘disclosed,’ as opposed to stolen, and they have not alleged facts to show that their claimed injuries were the result of the agency’s failures,” the court wrote. 

“Plaintiffs have of stated a claim for breach of contract under the Little Tucker Act since they have not shown that OPM entered into a contract with them or that any contract was breached, and they have not alleged any violation of the United States Constitution.”

OPM attracted massive scrutiny following the breach disclosures, a controversy that precipitated the resignation of then-director Katherine Archuleta.