Document Type



DePaul Law Review




Article III standing is difficult to achieve in the context of data security and data privacy claims. Injury in fact must be "concrete," "particularized," and "actual or imminent"--all characteristics that are challenging to meet with information harms. This Article suggests looking to an unusual source for clarification on privacy and standing: recent national security surveillance litigation. There we can find significant discussions of what rises to the level of Article III injury in fact. The answers may be surprising: the interception of sensitive information; the seizure of less sensitive information and housing of it in a database for analysis; and harms arising from data analytics have all been taken seriously in recent national security cases. This Article closes by noting that no discussion of corporate responsibility and data theft can be complete without addressing the roles corporations play in challenging the national security state.