The federal Circuit Courts of Appeals have not seen eye to eye on standing to bring data breach class actions. Into this jumble now leaps the Second Circuit in a decision that, in effect, splits the baby.
On May 2, 2017 the U.S. Court of Appeals for the Second Circuit, in Whalen v. Michaels Stores, affirmed the District Court’s dismissal of the Complaint, stating that theft of credit card information, without the loss of additional personal information such as date of birth, Social Security Number or Driver’s License number, or proof of identity theft, was not a sufficiently concrete injury to grant standing to sue.
Yet, the Court took pains to discuss what might have been had the named plaintiff chosen to, or been able to, assert a more well-defined harm. Citing the U.S. Supreme Court in Clapper v. Amnesty International, the Second Circuit in this decision did not require that an actual injury be alleged if a risk of harm from a data breach could be described as “certainly impending.” Recognizing the difficulty in making square-peg real-life losses fit into to round-hole phrases like “concrete” and “certainly impending,” the Court explained that Ms. Whelan was not the victim of consummated identity theft as a result of this data breach because the one attempt to use her purloined credit card number was unsuccessful and she incurred no costs as a result. Additional harm was not “certainly impending” because her credit card was cancelled shortly after the breach was known, and no additional personal information which could have led to future fraud was disclosed in the breach.
The Court observed that these “shortcomings” in her Complaint distinguished her claim from cases that found standing in the wake of data breaches from P.F. Chang’s, Inc. and Neiman-Marcus. The Court also noted that Ms. Whalen did not seek to amend her Complaint to aver more specific fraud or costs or even detailed efforts to monitor her credit. The Complaint stated that the named plaintiff and the class lost “opportunity costs” in expending time and effort in credit monitoring, but offered no details on these monitoring efforts and the Court held that this allegation didn’t meet the injury standard. While the choice of the phrase “opportunity costs” may cause some litigators to scratch their heads, those same litigators are also undoubtedly aware that one takes one’s client, and her injuries or lack thereof, as one finds her.
If you have questions regarding standing or other components of a claim arising from a data breach, or defenses to such claims, please contact Kenneth N. Rashbaum.
