Privacy & Information Security Law Blog

On July 20, 2015, the United States Court of Appeals for the Seventh Circuit reversed a previous decision that dismissed a putative data breach class action against Neiman Marcus for lack of Article III standing. Remijas et al. v. Neiman Marcus Group, LLC, No. 14-3122.

The litigation arose from a 2013 data breach in which approximately 350,000 customers’ cards were exposed. The named plaintiffs in the consolidated actions sought to represent all of the roughly 350,000 customers whose card numbers were compromised, including the more than 340,000 customers who did not discover any fraudulent use of their cards. The plaintiffs’ causes of action included: negligence, breach of implied contract, unjust enrichment, unfair and deceptive business practices, invasion of privacy and violations of multiple state data breach laws.

Alleged categories of injury. Plaintiffs claimed four categories of actual injury: (1) lost time and money resolving the fraudulent charges; (2) lost time and money protecting themselves against future identity theft; (3) overpayment for items because the store allegedly failed to invest in adequate cybersecurity; and (4) lost control over their personal information. They also asserted two imminent injuries: increased risk of future fraudulent charges and greater susceptibility to identity theft. The court ruled that the first two categories of actual injury and the two imminent injuries satisfied Article III standing.

Clapper distinguished for imminent injuries. The Seventh Circuit’s analysis of imminent injury distinguished the Supreme Court of the United States’ opinion in Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (2013). In Clapper, the complainants were not able to show that the act underlying the alleged injuries had occurred, or that the alleged harm was “certainly impending.” Finding support in a footnote from Clapper, the Seventh Circuit stated that standing could be established when the “substantial risk” of future harm causes a party to take reasonable steps to mitigate those imminent damages. The court found that although 9,200 customers had been reimbursed for actual fraudulent charges, redress for future fraudulent charges or future identity theft remained uncertain. It also held that there was an “objectively reasonable likelihood” that identity theft would occur.

Two actual injuries found adequate for standing. The court’s analysis of the actual injuries also distinguished Clapper, where the complained-of act may not have even happened to some or all of the plaintiffs. In contrast, the actual injuries related to the Neiman Marcus breach were sustained for an event that unquestionably occurred. Therefore, the lost time and money for protection against future identity theft and fraudulent charges were sufficient for standing and more than de minimis.

Overpayment and lost-control bases for injury not analyzed. Because it found adequate injury to support standing with the first two categories of injury, the panel declined to address the remaining two theories arising from overpayment and lost-control. The court described these asserted injuries as “more problematic” and it is questionable whether these injuries would be sufficient, on their own, to establish standing.

Causation and redressability. The court stated that other large-scale data breaches that occurred around the same time had “no bearing” on the traceability of the breach to Neiman Marcus. Rather, the court viewed this as a defense that might be raised by Neiman Marcus later in the proceedings. Regarding redressability, it also held that reimbursement of actual fraudulent charges did not negate the injuries related to mitigation expenses or future injuries.

Rule 12(b)(6) arguments not addressed. The Seventh Circuit declined to analyze the dismissal under Federal Rule of Civil Procedure 12(b)(6) because the district court decided the case on the standing issues alone, and Neiman Marcus did not file a cross-appeal for additional relief.

While the case has been remanded to the district court for further proceedings, it is another indicator that data breach litigants are more likely to weather a standing attack in the Ninth and Seventh Circuits compared to other federal circuits.

Read the full opinion from the Seventh Circuit court.