Antitrust Law Daily Wrap Up, PRIVACY—7th Cir.: Neiman Marcus customers subject to credit card data breach had standing for claims against retailer, (Jul 21, 2015)

By Edward L. Puzzo, J.D.

A class of Neiman Marcus customers had Article III standing to bring claims against the retailer as soon as a data breach of their credit card information occurred, the U.S. Court of Appeals for the Seventh Circuit has ruled. They were not required to wait for the fraudulent use of the stolen data to gain standing (Remijas v. Neiman Marcus Group, LLC, July 20, 2015, Wood, D.).

On January 10, 2014, department store retailer Neiman Marcus announced that hackers had been successful in planting malware in Neiman Marcus’ computer systems during the July 2013 through October 2013 time period, resulting in the exposure of the private credit card information for 350,000 of its customers, and fraudulent charges for 9,200 of those customers. Neiman Marcus offered one year of free credit card monitoring to all of its customers for which it had contact information.

Subsequently, Hilary Remijas and others, seeking to represent themselves and the other Neiman Marcus customers whose information had been hacked, brought a class action against Neiman Marcus alleging negligence, breach of implied contract, unjust enrichment, unfair and deceptive business practices, invasion of privacy and violation of various state data breach laws.

The federal district court ruled that the plaintiffs lacked Article III standing and consequently dismissed the complaint without prejudice. Reviewing the lower court’s dismissal de novo, the appellate court reversed and remanded, ruling that plaintiffs did have standing.

Injury-in-fact. The court stated that there were three requirements for Article III standing: injury-in-fact, causation and redressability. Plaintiffs alleged several types of injury, including the actual injuries of (1) lost time and money resolving the fraudulent charges, (2) lost time and money protecting themselves against future identity theft, (3) the financial loss of buying items at Neiman Marcus that they would not have purchased had they known of the store’s careless approach to cybersecurity, and (4) lost control over the value of their personal information and the imminent injuries of an increased risk of future fraudulent charges and greater susceptibility to identity theft.

Neiman Marcus argued that the 9,200 victims of credit card fraud had already been reimbursed, and therefore they had not been injured. But the appellate court stated that there was more to the injury to those victims and to future victims of fraud. Class members were also susceptible to future unreimbursed fraudulent charges and identify theft, injuries which were likely enough that immediate preventive measures, such as credit monitoring, were necessary. Even if future fraudulent charges were to be reimbursed, class members would still need to spend time and money replacing cards and monitoring their credit, and there was no guarantee that full reimbursement would be forthcoming.

Under Clapper v. Amnesty International USA, 133 S. Ct. 1138 (2013), stated the court, Article III standing requires that the injury already have occurred or be “certainly impending.” Speculative injuries would not support standing. While Clapper precludes standing when injuries are too speculative, standing is still appropriate where there is a “substantial risk” that harm will occur. Here, the putative class members’ credit card information was already stolen. Customers should not have to wait until the stolen information was used to commit identify theft or credit-card fraud before they gain standing, stated the court. To do so would unfairly present plaintiffs with an additional obstacle: the more time passed between the time of the data breach and an instance of fraud or identity theft, the more latitude the defendant would have to challenge causation by arguing that the harm was not fairly traceable to the data breach.

The court noted that two of the plaintiffs alleged bases for injury—the financial loss of buying items at Neiman Marcus that they would not have purchased had they known of the store’s careless approach to cybersecurity, and lost control over the value of their personal information—may be insufficient to support standing. However, the other bases alleged—lost time and money resolving fraudulent charges and protecting themselves against future identity theft and the imminent injuries of an increased risk of future fraudulent charges and greater susceptibility to identity theft—were sufficient to satisfy the injury requirement for standing.

Causation. Neiman Marcus argued that plaintiffs could not show that their injuries were specifically traceable to the data breach at Neiman Marcus when other large-scale data breaches, such as at retailer Target, occurred at the same time. The court stated that this theory, which Neiman Marcus might later raise as a defense, has nothing to do with plaintiffs’ standing to sue. If there were multiple companies that could have exposed plaintiffs’ private information, the burden would shift to the defendant to show that its negligent actions were not the case of plaintiffs’ injuries.

The case is Civil Action No. 14-3122.

Attorneys: Theodore W. Maya (Ahdoot & Wolfson, PC) for Hilary Remijas. Daniel Craig (Sidley Austin LLP) for Neiman Marcus Group, LLC.

Companies: Neiman Marcus Group, LLC

Cases: Privacy ConsumerProtection IllinoisNews IndianaNews WisconsinNews