PUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 21-2144

BRADY O’LEARY, on behalf of himself and all others similarly situated,

Plaintiff − Appellant,

v.

TRUSTEDID, INC.,

Defendant – Appellee.

Appeal from the United States District Court for the District of South Carolina, at Columbia. Sherri A. Lydon, District Judge. (3:20−cv−02702−SAL)

Argued: December 7, 2022 Decided: February 21, 2023

Before AGEE, DIAZ, and QUATTLEBAUM, Circuit Judges.

Vacated and remanded with instructions by published opinion. Judge Diaz wrote the opinion, in which Judge Agee and Judge Quattlebaum joined.

ARGUED: David Andrew Maxfield, DAVE MAXFIELD, ATTORNEY, LLC, Columbia, South Carolina, for Appellant. Ashley Charles Parrish, KING & SPALDING LLP, Washington, D.C., for Appellee. ON BRIEF: Justin T. Holcombe, SKAAR & FEAGLE, LLP, Woodstock, Georgia, for Appellant. Gabriel Krimm, Washington, D.C., Zachary A. McEntyre, Robert D. Griest, KING & SPALDING LLP, Atlanta, Georgia, for Appellee. USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 2 of 12

DIAZ, Circuit Judge:

Brady O’Leary appeals the dismissal of his claim against TrustedID, Inc. under

South Carolina’s Financial Identity Fraud and Identity Theft Protection Act (the “Act”),

S.C. Code Ann. § 37-20-180. The district court held that O’Leary alleged an Article III

injury in fact but failed to state a claim under the Act. O’Leary agrees with the district

court’s decision on standing but appeals its Rule 12(b)(6) dismissal. But we hold that

O’Leary hasn’t alleged an Article III injury, so we vacate and remand with instructions.

I.

A.

O’Leary’s First Amended Class Action Complaint alleges the following.

Nonparty Equifax was subject to a data breach. Equifax then engaged its subsidiary,

TrustedID, to use TrustedID’s website to inform customers whether they were impacted

by the data breach.

O’Leary had no other way to learn whether his data had been compromised, so he

went to TrustedID’s website. The website prompted O’Leary to enter six digits of his

social security number (“SSN”). In exchange for this information, the website informed

O’Leary that he was “not impacted” by Equifax’s data breach. J.A. 28 ¶ 11. TrustedID

didn’t use any other security precautions, such as a password, unique personal

identification number, or another authentication device. O’Leary alleges that TrustedID

shared the six digits of his SSN with Equifax.

2 USCA4 Appeal: 21-2144 Doc: 42 Filed: 02/21/2023 Pg: 3 of 12

B.

O’Leary sued TrustedID in state court, alleging that TrustedID’s practice of

requiring six digits of consumers’ SSNs violated the Act and South Carolina’s common-

law right to privacy.

The Act prohibits “requir[ing] a consumer to use his social security number or a

portion of it containing six digits or more to access an Internet web site, unless a password

or unique personal identification number or other authentication device is also required to

access the Internet web site.” S.C. Code Ann. § 37-20-180(A)(4). O’Leary alleges that

TrustedID “could have avoided violating the statute simply by requesting five or fewer

digits” of consumers’

Click Here to Read the rest of this document