In any case involving a data breach of customer or employee information, the first line of defense for the defendant is to assert that the plaintiff(s) lack standing to bring suit. In Remijas v. Neiman Marcus Group, the Seventh Circuit became the first United States Court of Appeals to tackle the issue of standing in the context of data breach litigation since the Supreme Court's pronouncement on standing in Clapper.
In an opinion written by Chief Judge Wood, the Seventh Circuit ruled that the potential class of plaintiffs affected by the Neiman Marcus data breach had standing to sue based on a combination of actual and threatened injury. Constitutional standing has three elements: injury-in-fact, causation and redressability. In Clapper v. Amnesty International, the Supreme Court held that allegations of future harm can establish Article III standing if the harm is "certainly impending." Although Neiman Marcus also contested the causation and redressability elements, the focus of the Court's opinion and Neiman Marcus' arguments was on the injury-in-fact element.
The plaintiffs in Remijas alleged the following injuries in their complaint: (1) lost time and money resolving fraudulent charges; (2) lost time and money protecting against future identity theft; (3) financial loss attributable to payments they made to Neiman Marcus for goods they would not have purchased had they known of the store's approach to cyber security; (4) loss of the intrinsic value of their personal information; (5) an increased risk of future fraudulent charges; and (6) greater susceptibility to identity theft.
The Court concluded that the loss of money and time suffered by 9200 of the plaintiffs in connection with "sorting things out" and after being made aware of fraudulent charges on their cards as a result of the breach were actual injuries that conferred standing. The Court also held that the complaint sufficiently alleged a concrete risk of harm to the rest of the plaintiffs (who had not yet incurred fraudulent charges) that satisfied the requirement in Clapper that injury either already have occurred or be "certainly impending." The Court concluded there was a substantial risk of harm to these other members of the potential class from the data breach because "[w]hy else would hackers break into a store's database and steal consumers' private information . . . [other than] sooner or later, to make fraudulent charges or assume those customers' identities."
The Court did not address the plaintiffs' other allegations of injury, such as the loss of the intrinsic value of their private information or making payments to Neiman Marcus that they would not have made had they known of its data security practices, because the other injuries were sufficient to confer standing. However, the Seventh Circuit expressed doubts as to whether these injuries could confer standing on plaintiffs in and off themselves.
It is important to note that the Seventh Circuit's ruling in Remijas merely holds that the plaintiffs in Remijas have standing to sue (i.e., the right to assert their claims in federal court). The Court expressly refused to address Neiman's arguments that the plaintiffs had failed to state a claim upon which relief may be granted as to their claims. It is unclear whether or not the injuries asserted by the plaintiffs in Remijas are sufficient to satisfy the cognizable injury element of a claim for common law negligence or an actual injury to support a claim for violation of a state data breach notification law. The Seventh Circuit did not address the failure to state a claim argument because it concluded that the issue was not before the Court because Neiman Marcus had failed to cross-appeal on this aspect of the district court's ruling.
Thus, although the Seventh Circuit may have cracked open the doors of the courthouse a little wider for data breach plaintiffs, it expressed no view about how those same plaintiffs will fare on their claims once inside the courthouse doors. Thus, defendants in data breach litigation can still argue that the a plaintiff has failed to state a claim upon which relief may be granted due to lack of a cognizable or actual injury as this argument is unaffected by the Seventh Circuit's opinion in Remijas.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
