court my name is james rosenberg and i want to thank the panel for the opportunity to present arguments this morning i represent i ten so like thousands of other consumers in this case the class that he seeks to represent used a credit card p d q and as a result had his personal financial information and related data compromised in addition to the questions of standing that are directly at issue in this appeal if you presents a number of questions with answers that are largely self evident we consumers trust their private information to a rd party and as a result that information makes its way into the hands of criminals who should bear who should shoulder the blame is it ok for a company to misuse your data and there be no repercussions because you had the good sense to take reasonable steps to protect yourself should a consumer have to wait for bad things to happen before acting upon the unwelcome news that his or her data has been stolen and does the law only protect those who do nothing or does promote a policy where people are proactive it does very mention at the outset i'm sorry issues the only issue that we need to resolve is the standing issue yes the basis on which the district court dismissed that is correct that is correct but does bear bear mention because the courts do draw a distinction here that the allegations of the complaint are that hackers obtain an unauthorized access to the database containing we were here on the twelve b sect ruling are we were here on a twelve b six dismissal instead of a twelve b one you would have some serious trouble with the law standard played because the complaint is extremely conclusory in terms of not only the facts but the legal point well at this point however we are talking about twelve b one and we're simply i understand that well that's just what  jordan mentioned we've got one of the narrow issue here which is standing right and but it does go to the standing the fact that we're talking here about hackers this is not a situation where we have a laptop that was stolen or misplaced that happened to by happenstance contain personal data or where information that was supposed to be private was inadvertently made how was a typical hacking case that it is there are lots of those there are lots of those but it's there is a distinction between hacking cases where there's still information like in the medical context for example where there are still additional steps that need to be taken for that data to be misused whereas here you've got financial information in the form of credit cards names and other identifying information that hacker can use to create havoc right now and is there anyone that believes at this point that when a hacker goes to the time and  effort and incurs the risk associated with stealing all this data that they don't plan to use they're going to sell it they're going to sell they probably already sold i mean the moment you have your data you'll be in full the hat back in there or not sell it that's exactly right you're going to get wind up in prison and you get nothing for that's exactly right and so it makes it very clear that when you're at your dad is compromise is not a question of whether you're there is a risk of that data being misused it means that you're already clearly in the crosshairs and that some point your dad is going to be used against you if it hasn't already if it's not already made its way on to the forth the areas of damage that are alleged and steps that are taken i will i will note here's what i here's what i wrote down and i may have missed something that you allege the imminent immediate and continuing increase risk of harm from identity theft and identity fraud which required them to take time to correct and you saw damages for suffering and for economic loss for impending injury flowing from pro tensional fraud and identity theft loss of privacy value of lost time loss of the rewards on the card stress and nuisance yeah i i don't want to to misstate the record in the instance with respect to mr so in as a result of their inability to use certain cards or certain accounts and cards affected by the data breach and then also k loss of use of an access to their account funds and associated costs because you know  ok that's that's a far cry from going out and as spending money to buy life walk or do some other thing but it does indeed have a financial there is a financial impact associated with that to use the word loss explain that to me sir if you if you you're mr sol and i think i'm hoping pronouncing it correctly but he has his credit information stolen and his identity too is part of this hack that's correct and let's say that he's one of those fortunate few who doesn't have his identity or credit card numbers or accounts used was the out and closed his accounts which is of course what any reasonable person would do and it bears mention that had he not close his accounts defendant would know about would no doubt be arguing that he took no steps to mitigate his losses and for their their you know has no standing for that reason but reward points like e everybody has a preferred credit card and the instance of mr so his preferred credit card is a card that both carried a hefty annual fee and that awarded reward points and had  other several benefits he could not use that card for several days because he closed his account at the use other cards to make purchases and lost the benefit of that so the reward points there is a discrete and concrete financial value of each point that's awarded in connection with those cards it is really not that he lost the ability to obtain rewards points generally because he could have opened up a new credit card account with the same merchant under the same terms and conditions is that he lost the ability to you use the card and get reward points through a certain number of days a period of time that's correct that's correct it's you know a fairly short period of time but there is a period of time where he's not white not able to prove these points furthermore the car that he use carried a four hundred and fifty dollars annual fee so there is a you know a daily if you just do the math there is a daily cost associated with maintaining this account and having it that account and for the days that he was unable to use it he's basically paying for something that he doesn't have access to and courts have recognized that the loss of reward points and the you know being unable to access your funds do indeed support standing even if you weren't going to use the points or access points or use funds well i mean at this point we're getting really into a lot of factual questions that is well no let's talk let's talk will i know you're at the pleading stage but if you are denied your funds that's let's say it let's say a bank proactively closes your accounts and within hours on your request and opens up a new account for you and you've lost access to your funds for three to four hours is that article three injury how would you access at that without having another card that you could you can't it's you you've lost it for three to four hours and i'm asking you if that's article three injury i mean there isn't fact a you go to the you go to the branch and they give you a temporary card which banks used to do i don't think you do it anymore but they used to give you a temporary debit card until you got the other one in the mail for a new account or a closed account i understand there is nevertheless a quantifiable loss associated with a period of time you can't use that art what's the quantifiable loss it's whatever the you know the annual fee is divided by the period of time you can't use it i mean part of the part of like is you're going to get recharged those days when you open up the new account i'm sorry pardon let's say let's say i open up the same credit card account with a four hundred and fifty dollars annual fee today ok yes i use it tomorrow at p d q the day after that there's a hack i pay my annual fee on the day that i open the account that's great i read they claim i close that account they reopen an account i have to pay the for fifty dollars again well no no of course not it carries all the way through sure so where's the injury but there is there is a period of time where you're not a are you about a bad period of number one the suggestion that having your data stolen is trifling but we understand that you know it that should shake us all to the core but more importantly and it runs right into the you know the rule twenty three to me that's the whole reason rule twenty three exists which is to help people vindicate these small losses so there shouldn't be a question of whether it's enough whether it's zero dollars fifty cents or fifty thousand dollars there is in fact a quantifiable loss so shared with this and the cour to say that whenever there is a data breach whenever there is a hacker ipso facto per se there is an entry in fact for purposes of article three standing no circuit court in this country has ever said that or let's talk about the someone like this is a cow let's say that there is suspicious activity in his bank account and his credit card account and both the bank and the court a court of close down or freeze the accounts without him requesting it they just do it and he loses access to those funds credit and cash or a week while he's protesting zero article three injury your honor you made a very important point there and there is a distinction you identified suspicious activity had there been suspicious activity on his account we might have a different case doesn't lose any money because whatever activity there is the bank or credit card company notifies by credit to the account so he's not a single penny we he is without access to his credit card and his bank account for a week in my hypothetical  i think this case is so the facts of this case are so important and we haven't really gotten to the facts yet loss of use tort law is generally a compound so when you get to things like mitigation costs loss of use when the courts start talking about those types of losses and the text of the data breach they've already gone to step one dollar they've already said ok is there an actual injury an actual theft or that identity theft or fraud  there a certainly impending identity theft or if you can meet one of those hurdles then you go to step two which is what your honor is asking ok you've now allege that something actually happened you see something on your credit card someone's try open up an account your name with a social security number the bank has called you and said we're going to freeze your account because there's been suspicious activity you've received all these charges that is an actual identity theft so you can meet article three  some courts have said yes and some courts have had said no in the tourist case that help me a bit well but the circuit so i'm asking you whether or not if there is a breach but no financial harm incurred cardholder the account holder is recompense completely is there article we would say we would go along with the nd circuit and the wailing case where there was a breach and there were some charges in ecuador that amounted to about two thousand dollars but the pla never had to pay those charges so the circuits the nd circuit said no article three dollars standing so we would say no we think there needs to be more we need to we think there needs to be financial harm in addition to the breach for there to be article three stand as opposed to some constitutional wagering we would presume so your honor if there were a breach correct if there were a breach it would be because along with a breach of contract of course you have to have deemed arguing against you i just make that observation right not so that whatever injury in fact occurred in this case was generated by a breach of contract wrecked your honor and when in the case of a breach of contract before you have a cause of action you'd have to have to we're saying that all that happened here the facts are so critically important in this we don't know some customers information may have been accessed but in an abundance of caution of course you issues the notice style has suffered no misuse whatsoever of his credit card information or eight months he is tasked under article three with showing two things an actual injury which means somebody used his card and he incurred a financial charge or a certainly impending risk of future injury how can he show a certainly impending risk of future injury if for an eight month period nothing has ever happened with this card you're assuming that people who are hacking these accounts and operating on a dark web are operating on a certain sort of business model where they're going to use something over a period of time your honor but that's crazy more importantly what i am operating under is precedent from every circuit court in this country every circuit court in this country that has addressed a data breach claim whether it's a hacker or whether it's somebody stole information on a laptop whether article three standing rises and falls on whether there's been an access or a misuse of the information that is the pivotal fact to every single one of these cases were the view but if but if i'm trying to get back to this mitigation issue if you decide i can't take a chance on my accounts being breached or accessed and i am going to go out and buy protection you don't think that's a reasonable step taken by a consumer that might constitute injury in fact it may be a reasonable thing for a consumer to do but it does not constitute an injury and why not i will tell you in the wor of some of the circuit courts and back the th circuit said mitigation costs incurred in response to a speculative threat here it would be speculation whether he's ever going to suffer any sort of you've got to talk to the hacker to find out listen are you really going to access mr sauza countering you not if you're not going to do it then your honor that's crazy to do work it courts have said and i'm but that but how masking you whether that makes sense i think it makes perfect sense because your honor if you don't if you don't limit liability that's the whole point of article three the injury in fact a liability there has to injury in fact requirement there has to be a limitation of liability if the court were to reverse the dismissal in this case it will be the very st circuit court in this country to say that evidence of a doubt a breach equals article three injury in fact if you've incurred some sort of mitigation costs let me tell you how the courts that it and back there was birthdate social security numbers etc physical descriptors stolen the that the court went on to say mitigation costs incurred in response to a speculative threat i e a threat where there's been no showing whatsoever on your card the bank calling you of any misuse if you don't  so you have to wait until you get breached for article three standing there has to be access or a misuse and or not making it out let me give you a hypothetical give me a hypothetical a simple lawsuit suppose that the contract the within the common plays of the parties they anticipated the entry you follow me it's with then that this is a breach of contract case so the question becomes whether or not they contemplated these injuries and compensation for them you agree ok so let's just take this very simple case where there is a contract and the parties contemplated the injuries you are unwilling to accept for the sake of discussion the assumption is that when they sat down at the bargaining table when he went into p d q they had a contractual relationship and part of the contract was if a hacker takes the information you're telling me that it under those circumstances to be no standing we don't know that the hacker took mr so i understand i'm making the allegation counsel do you agree that there is standing under that hacker x you call me money would you agree that there is standing i said very difficult to argue with with the hypothetical would you agree there is standing for breach of contract there could be your honor i of course there would be i'll take your word for it your honor ok your laugh why you might laugh why there was a twelve b six motion filed the case but in the context of data breach cases in every circuit court throughout the country if this court issues an opinion reversing it will be the only circuit court are all those other cases breach of contract cases on a twelve b six level they may have a lead no no no on twelve b one i'm not i don't know your honor but their data breach case makes a big difference doesn't your data breach cases there breed there are cases where there has been infiltration of a computer system or the stuff that's up to the information and what i'm trying to say to the court as we see this is in a very simple way based on the roadmap that has been laid out by every circuit court in this country if you have not seen an actual misuse or access of your information you cannot allege an article three injury in fact and if you go and voluntarily incur mitigation costs because if you're  afraid of a speculative fear of future theft you're on your own that's not article three standing and that is from clapper that is from just about every circuit court in the country and we've cited them in our brief let's let me switch the hypothetical to the medical arena so you go into a hospital and the hospital and you're in a waiting room waiting for a relative to see a doctor and through some negligence the hospital allows some contagious something to be released and you decide and the hospital tells you this happened and you know we recommend that you might want to get a shot for this and you go out and you get a shot that you have to pay for to protect against any contagion is your article three injury even though you haven't incurred the disease so it's interesting that your honor brings that up because in the to see out a case where there was standing it was the one outlier case the court said well we're going to like an article or article three standing in a database case to a toxic toward exposure a medical implement case the courts have can have criticized the p c or th compensable form of injury and damage is what's different in those cases you don't know whether you're going to be struck with a disease but you have the risk of it i will tell you need to protect against it because you don't know what the future brings and so you have monitoring you go see a doctor every year you get certain tests done every year to make sure that you're ok if those are compensable in the in the toward arena what's the difference even know whether the hacker has accessed it and you have not suffered any harm whatsoever you know on your card thanks not calling you if you have not suffered an injury that is the difference toxic tort case there's an injury data breach without evidence you've got four minutes left that's really merging thank you we have here to some extent a conflation of immediacy of risk with immediacy a result as a matter of fact the moment that your dad is compromised you have then an immediate risk of harm that can support standing under under spokeo it's it is a concrete and real threat that actually it's more of a promise at this point knowing what we know now about what hackers do with this data so there is no need to speculate about whether or not the data has been stolen or will be misused you have a problem the moment that you learn that your data has been accessed by hackers and you need to do something to address it we should not pretend by the way owes the contract between the parties didn't call for that injury at all zero that's all just a minute i'm sorry and suppose under your negligence count cover this kind of loss at all let's make that assumption and neither does the negligence count make that assumption then you don't have any you don't have any stat you have you have no kit you have no case basically but no injury from from what you've alleged well i mean if the contract expressly cart out any anything of that sort i make on the assumption the contract does not cover the loss and that neither does the port but that's not the that's not the facts that well then your argument has to be that whatever loss you have whatever injury you suffer came out of the contract if not your argument it certainly flows from it but where the end comes out of it it w part of the bargain intrinsic in that bargain is that they're going to keep the data safe that's what you levs of the complaint that it was part of the bargain absolutely it is ok absolutely it is but you know we ought not pretend that the only  comes from having your data compromised is the risk of an authorized transactions hackers are increasingly creative in the way that they use these these things that they will that they uncover in these br and can use them in ways to wreak havoc with people's lives there was an instance there's a scam that goes around where people will take passwords that they've gleaned from prior prior breaches and use that to you know send something to people saying i know your password or this i also know these things about you and if you don't pay me i'm going to release this information to the masses and i've had people contact me getting these things and being concerned and it's  is your purse that is true but the thing i want to point out about that that information came from the linked in data breach which happened in two thousand and twelve these things are just starting to come to light in the last year or so hackers said on this stuff the fact that you haven't seen a financial impact from something right away doesn't mean you're not going to as a matter of fact it's likely that it will manifest can amity enjoy don't you do you have a claim of course of well it has to come from somewhere the come out of the air well if it's floods what your argument is your argument is you have a hacker therefore you have a claim well what it stems from is the fact that your data is now in the hands of a hacker i understand and i was proud to throw you a softball understood the softball is that you've alleged breach of contract you have breached our greenman and you've got to compensate me that your case ok thank you very much i thank you both very much we appreciate it our last case is number eighteen dash