Since TransUnion LLC v. Ramirez, a reliable defense playbook in data privacy class actions has been to recast the plaintiff’s injury as a speculative future risk: no identity theft, no fraud, no out-of-pocket loss, and so no standing. In a published opinion issued October 9, 2026, the Ninth Circuit offered plaintiffs a different route. In Black v. IEC Group, Inc., No. 25-5952 (9th Cir. Oct. 9, 2026), a unanimous panel held that health plan participants who alleged that their claims administrator disclosed sensitive health information it had promised to keep confidential suffered a concrete injury in fact, with no need for a further showing of misuse or future harm. The decision makes alleged breach of confidence claims central to standing in Ninth Circuit privacy litigation. It also openly disagrees with how the Third, Fourth, and Seventh Circuits have approached the same analogues.

Although Black arose from a misdirected email containing health information, its reasoning according to the plaintiffs’ bar may reach well beyond traditional data breach litigation. Because the court located the injury in the disclosure itself, plaintiffs are likely to invoke the same breach of confidence theory in website tracking cases involving pixels, cookies, and similar technologies, and in other cases where a company allegedly shared information it promised to keep confidential, whether by accident or by design. The historical authorities the panel relied on were not limited to any one category of information. As the Ninth Circuit noted last month and as Joseph Story put it in 1839, “it matters not whether the secrets be secrets of trade, or secrets of title, or other secrets of the party important to his interests.”

Read on to learn more.

I.       Relevant Background

In Black, the plaintiffs receive health insurance through a plan administered by IEC Group, Inc. (d/b/a AmeriBen). In August 2023, AmeriBen notified them that an associate had emailed a spreadsheet containing their sensitive health information to “one or more [plan] members.” The information that “may have been disclosed” included names, unique tracking numbers, provider names, claim numbers, dates of service, and the amounts billed or paid. The plaintiffs alleged that AmeriBen “expressly and impliedly promised, including through its Privacy Policy, to keep their information confidential and not to disclose it without consent.” They brought eight state-law claims, including negligence, breach of contract, breach of implied contract, breach of fiduciary duty, and a claim under Florida’s Deceptive and Unfair Trade Practices Act.

The District of Idaho granted AmeriBen’s Rule 12(b)(1) motion. Relying on an unpublished Ninth Circuit disposition, the court held that a plaintiff alleging disclosure of personal information must show that “the nature of the information disclosed, the context of the disclosure, and other alleged injuries associated with the disclosure demonstrate an imminent and substantial injury.” It found that the plaintiffs had not shown a substantial likelihood of future injury.

II. The Ninth Circuit’s Holding: Breach of Confidence as the Historical Analogue

Assessing the case on appeal, Judge Tung opened the opinion with: “If you entrust a company to keep your sensitive health information private, but the company then discloses that information to others without your consent, have you been injured? We hold yes.”

The panel applied the Spokeo and TransUnion framework, which asks whether an intangible harm has a “close historical or common-law analogue” in harms traditionally recognized as a basis for suit in English or American courts. It found that analogue in the action for breach of confidence. Under that action, a defendant is liable for “the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship.”

Much of the opinion traces the history of that action. Coke’s Institutes named “breach of confidence” as one of the three classic grounds of equity jurisdiction. The panel then followed the doctrine through a line of Chancery decisions from 1758, including a line of more recent decisions from American courts standing for the proposition that: “a trust betrayed is the harm.” On this view, adopted by the Ninth Circuit, the injury lies in the abuse of the confidential relationship itself, separate from any property interest or economic loss.

The panel acknowledged that the modern privacy tort has largely eclipsed breach of confidence, though breach of confidence “appears more recently to have made a comeback.” In the view of the Court, this was a distinction without a difference as breach of confidence supported a suit in English and American courts, and that history is enough to make it a close analogue under TransUnion.

The court drew on two further sources of support for its ruling. The first was breach of contract. A relationship of confidence is often formed by contract, and actions for breach of contract were available at common law even without pecuniary or physical injury. The second was congressional judgment. HIPAA creates no private right of action, but it prohibits disclosure of individually identifiable health information and in some circumstances makes knowing disclosure a crime. In the panel’s view, Congress decided that even “mundane” data such as provider names, dates of service, and amounts billed deserve statutory protection. The court gave examples of why: such information could reveal daily psychiatric treatment or fertility care.

Finally, the panel addressed the rule that standing is not “dispensed in gross.” It explained that injury in fact “turns on the harm a plaintiff has suffered rather than the legal theory he invokes,” so where every count rests on the same injury, the inquiry “yields a single answer.”

III. A Widening Circuit Divide

In a footnote, the Ninth Circuit described out-of-circuit decisions holding otherwise as “readily distinguishable” because none involved “a breach of confidentiality grounded in contractual promises to keep sensitive HIPAA-protected health information private.” Regardless, footnotes 2 and 3 of the opinion show clear disagreement with other circuits on two fronts.

Breach of confidence and nominal-damages contract claims. In footnote 3, the panel noted that the Third Circuit, “hesitate[d] to conclude” that breach of confidence was traditionally recognized as a basis for suit. The Ninth Circuit rejected that hesitation. It reasoned that nominal damages in a breach of contract case are “a historical recognition that a party is harmed by the very act of the breach itself,” much like a trespasser who sets “merely one foot” on another’s land.

Disclosure of private information and the “publicity” element. In footnote 2, the panel observed that sister circuits—with the Eleventh, Tenth, Seventh, Third and Fourth Circuits on one side, and the D.C. , Second, and Sixth Circuits on the other—“have apparently adopted different approaches” on whether a plaintiff relying on a disclosure-of-private-information theory must allege the tort’s “publicity” element. The panel expressly declined to decide whether disclosure of private information, standing alone, would also confer standing.

IV. Conclusion

The practical significance of Black is that in privacy litigations in the Ninth Circuit, Plaintiffs will likely argue they no longer need to plead facts showing that identity theft or fraud is imminent. Instead, they may assert they can allege for purposes of Article III standing that they entrusted nonpublic information to the defendant within a confidential relationship, that the defendant promised to keep it confidential, and that the defendant disclosed it without consent.

The Court’s holding is distinguishable, as it was dependent on the circumstances of the case presented. Cases without those features, especially those involving disclosures by parties with no relationship of trust with the plaintiff, and others, should be easier to distinguish.

Because the Ninth Circuit includes California, where much of the nation’s privacy class action litigation is filed, Black is likely to be cited widely in motions to dismiss on standing grounds. With the circuits divided on breach of confidence, nominal-damages contract claims, and the publicity element, the question of what counts as a concrete privacy injury after TransUnion may well return to the Supreme Court.

Privacy World will continue to monitor related developments. Stay tuned.