morning runners may please the court joe separate on behalf of the plaintiff and appellant that's the class below i'd like to think that hopefully my job this morning is a little easier by the standards of data breach cases because as far as data breach cases go we have about the strongest set of facts or allegations that you could possibly have or that we've seen in any of the cases out there we have a breach on the michael system that in fact compromised the information of three million people survived it will be six unfortunately we have to deal with his standing issue because it's not to do shingles so we have to deal with it but why do you survive will be six what is it that is well under new york law technically but more generally stated implied contract that implied contract of what the implied contract and that the other side had where have you pled anything that says that they did not act reasonably well the reasonable standard i'm not sure fits in quite with the implied contract claim i think that that more fits in with the second of the two paths i loaded two which is the statutory claim under new york law g p l yes your honor that what is what is v implied contract well as the as several courts have held in affirming it's the exact same implied contract claim namely the target court in minnesota the michaels court as it happens in the northern district of illinois that is the exact same defendant that we have here who had yet another da breach five years ago had an implied contract claim survive in lead to a class settlement in that case this is the same claim that we're pleading here by them yes i want to know what the implied contract  have leg in your complaint of your new york is that was violent an implied contract to do what never to breach no matter the answer is to collect the information for purposes of that transaction only that is the answer to your question so when i go to michaels and i buy what do they sell their kites arts and crafts  and i present my credit card at the transaction at the at the point of sale when they scan my information and it's processed on my credit card my expectation as a consumer is that that information is not indefinitely retained in a database the reason it turns out why everyone does that although maybe less so in this area your complaint say that that is a breach it's one of the express allegations in the implied contract  for example if michael's had put a sign let's say for example that michael's had a sign at the point of sale saying dear customers just so you know when you present your credit card for payment we're going to keep all of your question is what is it you start out imply and why you think any any dealer would make would be a lawyer term like that in a contract just as i don't see they would imply in a contract that it would never be a week well the distinction is absent any representations to the contrary are allegation is that a consumer has the right to i don't want to say right but the terms of the implied contract  that you present your credit card for payment it's for purposes of that transaction only that's it you're done because there's no reason for a consumer so i'll use the word reasonable a reasonable consumer has no reason to believe the information is held indefinitely for marketing slash nefarious purposes unless the retailer says dear customer we're going to hold your information for marketing in the faeries purposes why her why is marketing and if areas why would most consumers expect that when you use information that people you give you information who will you well some some do and some don't know other words if you go into a store and a in some stores do this they say dear customer we're going to send you information that we think you're going to love to get in the mail and i hope i'm answering your question directly your honor so if you go into a store today it is possible that they will say judge when you you know present your credit card for payment we're going to keep your information on file and we're going to send you a bunch of stuff in the mail that we just know you're going to love you may hear that and say i don't think so i need to opt out or i'm not going to give you my business i mean this is how it works but if they don't tell you anything and they just take your credit card and swipe it you have the right on that basis to believe that your information is not being held indefinitely yes and i'd like to turn back if we could before you sit down will take a little extra time to help me dam her credit card number were taken the credit card was cancelled there was no additional information how is she phone rable to and why is there an impending threat that's credible as to her identity theft well two reasons one is even if it were true that the parm is already been done the very fact that and i don't even really see any harm there's been a disclosure and there was a payment limited series of events here unlike in many other cases your social security wasn't taken other identifying information wasn't taken her past passwords weren't appropriated we had her name and a credit card and the credit card number was then canceled right not quite what one additional was there that creates a credible threat of an impending danger that she's can be subject right so the answer is in this particular case with this actual plaintiff yes there was attempted there was actual an authorized fraudulent usage of her card and attempted is presented for payment but yes she didn't have to pay anything still she was liable to pay fifty dollars that is that is true the fact that the company might choose not to do it but under of a contract she was liable to pay fifty dollars when the card was told that's precisely in sting is that that's enough for standing that's exactly right your honor and thank you that's why i went directly to well be suspect but i think that standing here doesn't that but the answer is yes we have i believe that we have that and several other allegations also pointing out that in this day and age when someone has only i use air quotes only your name and your credit card information it is astounding what they can reverse engineer from that so to your honor's point about the threat of future harm even though the card has been cancelled unfortunately that is of little consolation to someone who has gone through this because what they can do just from that information alone does in fact as we have allege subject you to continuing threat of personal identity being stolen and it happens every day which is every time that i bank america calls me and says you know are you really buying a home and  tell them now then i have standing if i can find out where they got what company they got that information from the money from amazon not do i have standing to sue  amazon no not necessarily because there's two different situations that are distinguishable he or one is suppose that on the way out of this courthouse i drop my card on the floor by accident and some guy finds it and tries to you know use it to buy a home and  bank calls me well whose fault is that i mean you know there's no company to sue and even if the transaction was at a company the point of sale maybe the reason why it happened is because i left my credit card on the on the counter on the way out of the store so the mere fact that you get a phone situation where a data breach occurs and not just any data breach by the way so we're not talking about like a stolen laptop situation or lost laptop where you know someone leaves a laptop in a car and there's a bunch of important information on there and then someone a lawsuit and says i'm very fearful of the fact that my information has been compromised well they probably weren't after the laptop they were probably after the car so even that perhaps would not rise to the level of article three standing but to your honor's point when amazon has your credit card information and they say someone hacked into our database because of inadequate security measures p s the reason they are hacking into it is precisely for the purpose of stealing your information and then you get a phone call from your bank saying someone is trying to use your credit card to buy a house in buenos aires yes you absolutely have standing so says every circuit court of appeals to have addressed that issue so far the seventh twice the s card whether you alleged it or not in this case provided for a fifty dollar possible loss because since the issue is constitutional standing that is a question of it we can decide and must decide for ourselves under justice scalia's opinion in steel so it doesn't really matter whether you alleged it if there is constitutional standing we invent can whoa you might lose on that issue if you didn't get it we've then can assume standing and decide it will be six it will be six is easier so it's terribly important on this because if you do whenever you allege did or not if a card is a card that made her libel for fifty dollars then we can avoid the very difficult standing issue if we can decide the case on over grounds otherwise maybe we cannot so you look for what your allegations were and whether the record reflects any charge of the  i think it's important to start here the supreme court has instructed that the standing inquiry requires careful judicial examination of complaints allegations this court in bauer of event and then said the same thing the injury in fact analysis highly case specific and that's what the district court did hear it here to those principles what ms whalen wants to do is talk about things that do not affect her she wants to lump this case in with data breach cases that are markedly different factually in paragraphs twelve and thirteen he pleaded neiman marcus collects a wide variety of p r i including names addresses mobile telephone numbers driver's license numbers he goes on to say in that same complaint hackers had access both to the payment card data and the p r i defined that way different so and then you get to lure where a couple things you have a card members who do not have cancelled cards and again the seventh circuit jumps on this notion that there was more than just a card breach it said p f chang's warned about the need for credit monitoring not account monitoring if you look at  supplemental appendix four and six in this record michaels warned about exactly the opposite the only details compromised were the card numbers and what's the icing on the cake is that's precisely what he pleaded here let's look at eleven paragraph seven he said credit card information insensitive financial information occasionally tosses out the term but when you finally turn to where p somebody steals my car and i don't hear of it for so time my car has a statement that if i don't then no not in a case against american express if you look at app forty eight the district judge here found that american express the very car she pleaded had a zero policy she's one i think the provision you're pointing to is a provision in federal law she hasn't pleaded that provision of federal law one she hasn't pleaded fifty dollars to three i think on these facts it's inconceivable that there could ever be a fifty dollars because she canceled the charge and here we are three years on and there's no other char in lesser further questions on article three standing and i'd like to turn to  the implied contract briefly i think this kind of implied contract judge calibers you would be remarkably sweeping it would not just apply to data breaches it's a completely unilateral subjective expectation it's the kind that i think this court rejected a much stronger facts in the guthrie case that's a case where a person went to a hospital and was treated and an employee of the hospital disclosed that the person had a sexually transmitted disease in this court said no implied contract under new york law there your remedy lies and tort there's no facts here and if anything there's the opposite of facts it's interesting that ms w pleads regarding this p c i standard that she obliquely references that michaels and the card companies had an express contract to make that binding on them it strikes me is inconceivable that  client or really the way this complaint paints every merchant from the smallest bodega to the largest company has guaranteed subsequent c e o to every consumer who uses a credit card that they're going to protect their data from any occurrence that occurs and here it's worse yet because there's no real allegation that michael's did anything wrong it's notable here this complaint when originally filed had a negligence claim they got rid of that negligence claim on time three because new negligence here all you have is an allegation i think it's standard it's a consumer protection claim and here this would be a pretty remarkable consumer protection claim where the plaintiff identifies no representation two plaintiffs neither representations on which material was omitted or representations that had misrepresentations so really what you end up with is a plaintiff a sensually implying a duty of disclosure precisely the kind of duty of disclosure that this court reject a range of context securities law g p l so on and so forth and it would be a pretty remarkable expansion of new york law thank you your honor it following a judge on your point about the fifty dollar limit in our complaint actually his counsel correctly points out we don't expressly plead that arpa name plaintiff herself incurred fifty dollars of losses for that reason and the reason why she did not is because in fact she stopped the charges or the bank was able to stop the charges before they posted her account someone her case she didn't have only fifty dollars charge out of a thousand dollars that was more like zero out of zero but we do plead however is that across the spectrum of the class members who had their information passed to have standing she if that's right last night that's right so therefore in her case the reason she has standing is because first of all this up under the seven circuits rationale not that we're bound by that here but even if there was no fraudulent charge in the first place she would have already had standing by virtue of the fact that the breach occurred she was one of the three million that's the end of the analysis according to the seventh circuit if you go further in because she was a breach occurred she was one of the three million and on that basis there's an imminent standing is that what you're saying i'm saying that the seven circuit in p f chang's said that is what leads to the imminent apprehension of harm data that's that that's no that's exactly what did happen here that's the other reason why she has standing is i'm sort of trying to layer this for the court so if you'll just allegation this plaintiff spent money on credit yes mitigation expenses yes we do and the point i'm trying to make just to be crystal clear on this is that under the seven circuits rule should that be adopted here we wouldn't even need the expenditure of mitigation expenses to have standing  question and that is even vote in this case she did not actually lose fifty dollars at the time of a card was tol d why she in danger of losing fifty dollars yes she was and more under of a no fault policy which our policies that the cards have because of which the facts of the case of it happened after she didn't lose but the question is in terms of the breach at the time of the breach was she in imminent danger of losing fifty dollars yes she was that is and you rely on what for that proposition that her card made her liable for what is their terms in the in the record terms of her contract with american express because i understood also that there are cards that guarantee you that you will not have a deductible of some kind of fifty dollars or so some do and some don't i mean it's a matter is that in the record but the terms of this card were we allege that as a matter of policy american express may have chosen to reimburse her but as a matter of law they were not required to do so you were saying that the policy of american express would keep her from being in danger but that is a policy of it is not contractual that's precisely correct the card  far as american express they could be liable for a minute you would limit it to fifty is a law and the reason we haven't is that we don't rely on the policy yes that's correct and like to points is because these are very specific questions for which i want to give the exact citation not just paragraphs x through y with the court's indulgence i'd like to submit a letter directing the court to the specific language in our pleadings in the record and the specific sites what i must say if i may is that not only following judge your point not only did we have this instance where the fraudulent transaction occurred and at that moment it was not clear whether she'd be liable or not that was the genesis of her decision to then spend money actual out of pocket dollars on mitigation expenses now there has never been a data breach case to come up to a circuit court of appeals on those facts and then find the plaintiff did not have standing why didn't you give us a  find we will thank you your honor we will address that and i know i'm well past my time i have ten seconds to just address one final point that my opponent brought up here in response to the idea that michael's never promised anything or never said to these people you know will take certain precautions with your about the nature and full extent of the data breach after it closed the failure to timely disclose the fact what are you referring to are reading right now you're reading from right now my own notes but i can give you a side on this it's appendix ten to eleven and also page thirty one appendix eleven to twelve twenty eight thirty one these are the series of misrepresentations that we allege were in fact made by michael's concerning the data breach now counsel make it up here and say it's all wrong but that's a fact question we've played it and on that basis we survived the six at this stage very much i thank you your arguments mr joyce you have reserved two minutes  f the court on supplemental letters but i'm not sure that's necessary here fifty dollars in losses isn't pleaded anywhere we put in the record in the district judge found that amex as a policy or as a contract however think the best that would come out of that is there would be this amorphous statutory claim that doesn't affect plaintiff here but really want us to write pion that can look as if it is in conflict with the seventh circuit no judge caliber receive the facts are completely different from those before the second the seventh circuit all you have here is a cancelled credit card and that's why all the parade of horribles about what could have happened just doesn't come to pass here in both of those seven circuit cases you had plaintiffs without canceled credit cards and in both of those seven circuit cases the court understood in the record that a broader set of data had been breached both cases talk about central data storage systems design most as if not the pos system in the lower level downstairs had been breached but your chambers a system where the way second circuit floating around and and draft opinions are and so this there's no allegation like that here the only allegations time and time again are credit card numbers and names and this is old technology i'm sure you've seen more of these in eighteen u s c then i am and but all you need to breach a credit card number is to take it to breach a credit card account is to take that magnetic strip data you had a case where there was a phony a t m machine set up and you recognized in that case people made new cards from it that's what we've got here but when you cancel the credit card the bleeding has stopped you can't do anything else i can't write it or his hands and here your honor the fact she pleaded what were that she that point she commands that's correct you know that there was a period of time between the time that there was a breach and the time that she cancels where if she was law hoebel for any amount of cars if she was before she told before she told or cancelled that you would have been liable for  something yes but i don't think those those facts apply to wayland she didn't bring the claim in this interim period where there wasn't a cancer card she did not ask the question of whether she broke play i am asking a narrow question of whether her ease constitutional standing sumit recant and sue standing despite chief scalia's opinion and go to twelve b six which i hope i've indicated i think is have very easy question that's my only point not whether she pled not whether but whe was a time in which she was even danger of losing money which is enough to constitute constitutional constitutional standing the  jurisdiction and very far allows us to do something which we used to do all of a time until that fortunate decision and i think the answer judge talent receives no one under the particulars ation standards set forth in spokeo i think what you're positing is that a different plaintiff existed and maybe there's some plaintiff found out there who is at risk for some amount of time but this planet was not at the very first opportunity to use her information american express caught it so no there was no risk and even if m x hadn't caught it amex had essentially absolved her of any risk through the policy is that they add that i think the debit card cases are different i think the cases have a carcases are different but let's assume that a man somebody had taken this card and bought p d s for thirty seven cents and american express did stop it because american express wouldn't think of stopping that and american express sho despite its policy to charge her thirty seven's yes that's my question i think that standing but the question at this point in time and on these facts was was there any certainly impending possibility that amex would do that even if it charge had gone through and i think that answer is no if i could briefly just address the last point that i was starting to address before that dialogue with judge calibur e c there is nothing in the two paragraphs about ms whalen paragraph seven and eight about mitigation expenses there is a throwaway paragraph here to your question judgment on apt twenty three paragraph fifty four plaintiff in the class suffered additional damages based on the opportunity cost and value of time the plaintiff in the class have been forced to expend to monitor their financial and bank accounts as a result of the security breach so much damages also include the cost of obtaining replacement credit and debit cards there's no spaced from you on the allegations with regard to fifty dollars and where the record the terms of the that relationship are stablished and then by the following say wednesday so friday wednesday is that ok