Class Action and Product Insights for Your Business
April 21, 2016 - Privacy

Seventh Circuit’s Latest Word on Standing Requirements for Data Breach Claims

On April 14, 2016, the Seventh Circuit again weighed in on Article III standing requirements in a putative class action involving an alleged data breach.  In Lewert v. P.F. Chang’s China Bistro, Inc., Case No. 14-3700 (7th Cir.), the two named plaintiffs each allegedly dined at a P.F. Chang’s location in Illinois during a period that was affected by a data breach.  One plaintiff alleged that fraudulent charges appeared on his debit card and that he canceled his card and purchased a credit monitoring service.  The other plaintiff alleged no fraudulent charges on his card, but alleged that he spent time and effort monitoring his card statements and credit report.  The plaintiffs sought to represent a class of all customers whose payment data may have been compromised during the breach.  The district court dismissed the claims for lack of standing, concluding that the plaintiffs had not suffered the requisite personal injury.  The Seventh Circuit reversed.

The court focused its standing analysis on the requirement of a concrete and particularized injury.  The court relied on its recent decision in Remijas v. Neiman Marcus Grp., LLC, in which it concluded that plaintiffs in a data breach case had sufficiently alleged Article III standing based on their increased risk of fraudulent credit- or debit-card charges and the increased risk of identity theft.

The Lewert court reasoned that the named plaintiffs adequately alleged these same injuries.  Regarding plaintiffs’ other alleged injuries, the Seventh Circuit did not reach a conclusion but expressed skepticism that plaintiffs’ other claimed injuries based on the cost of their meals or based on a property right to personally identifiable data would be sufficient injuries for Article III standing.  The Seventh Circuit thus concluded that the plaintiffs had plausibly alleged at least some injuries that were sufficiently immediate and concrete as to satisfy the standing requirement.  It reasoned that the defendant’s arguments regarding whether the plaintiffs’ data was in fact exposed and whether defendant actually caused any of the claimed injuries were matters going to the merits of the case rather than the sufficiency of the pleading.