Antitrust Law Daily Wrap Up, PRIVACY—E.D.N.Y.: Victim of credit card breach lacked standing to represent class in action against issuing store, (Dec 29, 2015)

By Michael Menzhuber, J.D., LL.M.

An individual, whose credit card information had been retrieved by hackers from the systems of Michael Stores, Inc., lacked standing to file a class action suit, according to the federal district court in Central Islip, New York. The court determined that the individual lacked standing because she did not allege any actual harm, or an increased risk of future harm, as a result of the security breach (Whalen v. Michael Stores Inc., December 28, 2015, Seybert, J.).

During the time period between May 8, 2013, and January 27, 2014, hackers retrieved credit and debit card information from the systems of Michaels and its subsidiary, Aaron Brothers. Michaels estimated that approximately 2.6 million cards may have been affected. There was, however, no evidence that the hackers retrieved any other customer information (names, addresses, PIN numbers, etc.). As a result of the security breach, Michaels offered its customers free credit monitoring services for twelve months.

Jane Whalen (Whalen) made credit card purchases at Michaels during the time period. Following the security breach, her credit card was twice presented for payment. However, Whalen did not alleged that the attempted charges were approved or that she suffered any financial loss. She subsequently cancelled her credit card and did not experience any other attempted fraudulent charges.

Whalen filed a class action suit against Michaels that asserted claims for breach of implied contract and for violations of the New York General Business Law (GBL). Whalen asserted that, as a result of the security breach, she suffered actual harm, and faced an increased risk of future harm.

Actual Harm. Michaels argued that Whalen lacked Article III standing to bring a class action suit because she did not allege any actual damages arising out of the security breach. The court agreed. Although Whalen contended that she had standing because she experienced unauthorized charges, she did not allege that she suffered any unreimbursed charges.

Whalen also argued that she had standing because she lost time and money associated with credit monitoring and other mitigation expenses. The court noted, however, that the Supreme Court has dismissed this type of argument on the basis that a plaintiff cannot manufacture standing through credit monitoring.

The court found that Whalen’s argument that she had standing because she paid for her Michaels purchases with a credit card, and that she reasonable expected her data would be safeguarded, lacked merit because she failed to alleged that Michaels: (1) charged a different price for credit card payments and cash payments; or (2) used any customer payments for its security services.

The court also found that Whalen’s argument that her credit card information had lost value lacked merit because she failed to allege how credit card information because less valuable after the security breach. Whalen’s argument that Michaels violated GBL also did not confer standing because it not assert an actual injury, merely a statutory violation.

Increased Risk of Future Harm. Whalen contended that she presented a threat of “certainly impending” injury because she faced threats of identity theft and fraudulent charges. The court, however, determined that her allegations of future harm were too remote to establish an injury-in-fact, for purposes of Article III standing, because she did not assert any injuries that were: (1) “certainly impending;” or (2) based on a substantial risk that harm would occur.

The case is No. 14-CV-7006 (JS) (ARL).

Attorneys: Joseph Siprut and Gregory W. Jones (Siprut PC); Brian Phillip Murray and Gregory B. Linkh (Glancy Binkow & Goldberg LLP); and Kyle A. Shamberg (Lite Depalma Greenberg LLC) for Mary Jane Whalen. James D. Arden and Sonia Marquez (Sidley Austin LLP) and Dan Edelman (Edelman, Combs, Latturner & Goodwin, LLC) for Michael Stores Inc.

Companies: Michael Stores Inc.

Cases: Privacy NewYorkNews