IRS Claims Data Breach Suit Barred by Sovereign Immunity

A special to USLAW NETWORK and USLAW DigiKnow

By Karen Painter Randall, Connell Foley LLP, Roseland, New Jersey

This past week, the Internal Revenue Service (IRS) filed a Motion in D.C. federal court for a dismissal of a proposed class action lawsuit. The class action lawsuit seeks to hold the IRS accountable for a data breach that affected approximately 330,000 taxpayers earlier this year, contending that the district court did not have jurisdiction over the claims. In support of same, the IRS argued, among other things, that such a claim is barred by the doctrine of sovereign immunity. Sovereign immunity is a judicial doctrine that prevents the government or its political subdivisions, departments, and agencies from being sued without its consent.

In January 2014, it seemed likely that the IRS’ “Get Transcript” program would facilitate the depredations of identity thieves against the IRS. Sixteen months later, sophisticated hackers bore out concerned parties’ fears when they did in fact breach the IRS’s database, forcing the IRS to suspend its “Get Transcript” program.

A class action lawsuit entitled Welborn v. Internal Revenue Service, et al., Civil Action No. 1:15-cv-01352-RMC was subsequently filed against the IRS on behalf of all individuals whose personal identifiable information (PII) was compromised in the data breach. According to the Complaint, the number of individuals affected is estimated at approximately 330,000.

On November 17, 2015, the IRS filed a Motion contending that the class action lawsuit should be dismissed. Although the IRS’ Motion argues a number of theories for a dismissal, including lack of standing, one of the alternative arguments raised contends that the suit is barred by the doctrine of sovereign immunity, which immunizes the United States from these types of civil lawsuits.

Unlike the situation where a private corporation is the victim of a cyberattack and then subsequently becomes involved in costly class action litigation, a data breach involving a governmental agency raises different jurisdictional issues. In particular, when attempting to assert a claim against a public entity, such as the IRS, an additional hurdle for a plaintiff to overcome is the doctrine of sovereign immunity. Ultimately, the decision from the D.C. federal court will be significant in determining whether or not these types of class action lawsuits will be permitted to proceed against governmental agencies.