morning your honour's may please the court joe separate on behalf of talent that's plaintiff in the class below i'd like to think that hopefully my job this morning is a little easier given that we have the benefit of the court's recent very recent opinion and of course the neiman marcus case i think neiman is directly on point truly just like in neiman here there is no dispute there we have alleged certainly that a large security breach occurred that compromised massive amounts of payment card info and in fact imeem and it was around three hundred four hundred thousand here it seems to be more like seven million but certainly massive do you think we need either for purposes of standing over purposes of something else fact finding on the question whether the data was stolen exclusively from the thirty three stores that he have chang's is talking about in which case since these plaintiffs didn't patronize any of those  stores i'll just say different measures might be necessary or do you think that there's enough in this record right now to say that maybe the scope of the breach was beyond that there is absolutely enough on the record right now to say the scope of the breach is not limited to the thirty three stores that p f chang's claims unilaterally and contrary to the pleadings or limited in that are involved in the breach and in fact even p f chang's in making that unilateral statement had plenty of caviar that did not limit it to thirty three stores you know forever written in stone if you will in fact the language was to the effect of you know thirty three stores investigation continues we're still trying to figure it out so they right now a year later since that statement was made may know that there are more stores involved than the thirty three of course we the plaintiffs don't know that because we haven't gotten to discovery yet what really matters is that we have alleged the breach occurred  compromised in fall was payment card information for millions of people our plaintiff in addition to other class members but our class representative plaintiff had actual authorized activity on his account there's  separate your your briefing seems to assume that if you allege it that's good enough for standing is that your understanding of it being an authorized transaction your honor that of a breach of these pla yes well the problem i have with that is that since standing is a matter of the course of a matter jurisdiction it can be challenged as a factual matter and so i'd like to go back to to chief judge woods question about a need for a fact finding the defense is telling us if they didn't really tell the district court quite as clearly as they could have but it did it certainly seems like there might be a need for  fact finding as to whether your named plaintiffs actually suffered any breach of their data well before the standing for decisions can be made perhaps i'm not telling the court or suggesting that that is a theoretically impossible thing to do however i would think that a lot of all the instances in which fact finding for subject matter jurisdiction on article three challenge were to potentially take place this would not really be the right situation for that standing that we're talking about right now yeah it's really a twofold answer i think so i'll try to be as clear as possible on the one hand even if we accept the premise which i don't and i'll return to this but even if we accept the premise that you can't have standing unless you as a class member were at the thirty three stores that p f chang's claims involve the breach and not anything more than those thirty three even if that was the premise i don't see how you get around  fact intensive investigation as to what that even means is that thirty three is a thirty four how do they know that it's going to be the subject of expert discovery it's not like he have changed he just put in an affidavit and say it was thirty three i mean we don't agree with that we have got that as well i mean i can't believe each store has its own independent computer network and so if there's a central computer network i don't know how the files are organized i don't know how fire walls exist it seems very easy for me and see that there might be  the kind of fact finding to support our three authority that judge hamilton is talking about yeah i if there is fact finding to be done in that regard will be nothing more or less than what you would expect to see a full blown discovery at the trial court below looked like if the case were to proceed on the merits i mean the amount of discovery and investigation and empirical analysis done by experts on this very issue is largely what marriage discovery is going to look like so i guess we could do that now or we could embark on that but that seems to me to be sort of defeating the whole purpose of making an initial threshold a fact finding on this issue which is to sort of you know nip it in the bud or crystallize the issue i just don't see how that's possible as a practical matter here the other point though and i said i would challenge the premise of p f chang's what i meant by that is that we don't really accept that only the people who were involved in the thirty three stores have standing i mean again indulging the fiction that it turns out to only be thirty three and not anything more what about the people who shopped at p f chang's at during the time of the breach who received notice that their you know information was compromised they don't yet know if they're in or out of the thirty says might be more it might be less we're still investigating so that reasonable person gets that information because their bank spends time on the phone monitors their accounts deactivates their credit card gets a new one spends money on identity theft protection as our plane is dead if it turns out after all the smoke clears to later that lo and behold he was that the thirty fifth store not the thirty three wouldn't really matter i don't think it would that sounds like you're describing modern for those rather modest expenses but it's hard for me to see how somebody whose data was not actually compromised has the kind of claim that the federal courts out of a lot of to cover the well that's exactly the point though the information was compromised and whether that's really that's the conclusion that you're assuming here let me let me suppose suppose you've got a retail credit card with x y z corporation x announces we are upgrading our data security and as a customer you say upgrading must not have been very good before so i'm going to take all these precautionary steps so i'm going to ask for a new critic heard i'm going to buy the insurance on the monitoring services and so on to have a clone you do not what's the difference the difference is whether you're on one side or the other of the article three threat of imminent harm reasonable apprehension  line i'm and i'm perfectly well i've got perfectly good reasons to worry they're upgrading they couldn't have been doing this properly before had your arguments would seem to apply just as strongly respectfully i don't think so it whether a person in that situation decides to spend their own money and time to do these things could be the right or wrong decision for them might be reasonable might not be but they don't they don't have a claim and the reason they don't have a claim is because under the court's current jurisprudence and that includes nieman specifically that's not good enough for article three standing there is no claim against the company whereas by contrast one of the courts currently was perkins and again neiman crystallizes this if an actual data breach occurs and notice goes out to people and it says server sorry to tell you but your card was in a data breach that was you know compromised three hundred four hundred million four hundred thousand whatever the number is you're one of them potentially if that person without knowing anything more says i better call my bank i better  know from all the press releases there can't be any doubt about that and b because at least one of your name plaintiffs shortly after the breach experienced an authorized activity on the card that he used at p f chang's that at least for purposes of article three is enough to get you over the line to let the case go forward that's precisely correct your honor that all those seem like a step beyond nieman marcus farber who significant step in broadening liability if you have simply the possibility that my data has been compromised gives me a claim it least at this stage your honor we don't need to go beyond even marcus to to win outright and the reason for that is to be in the reason for that i think is because the whole issue of whether the breach was in fact limited to thirty three stores which would exclude our class representative that really is a fact issue so at most you're saying that's a statement of a claim issues and you could lose on the merits of course i would say that this is i guess the judge hamilton's point but also in response to your point your honor it is possible that this court could see this issue again down the road after summary judgment or perhaps after a trial when we're debating whether or not the breech should include or the scope of the breach should be deemed to include people outside the thirty three stores if again we actually establish that as factual matter and then if it's limited to thirty three factually two years from now and if my class representative is outside that school then the legal question of the legal issue the judge hamilton you're putting your finger on would be crystallized for today however i think my job is a little easier because truly it is a fact i mean frankly the very fact that our plane of had his accounts compromised he's never had a fraudulent transaction attempted ever on that account and one week before p f chang's announces the breach someone is trying to go into his account and steal his information or steal his money from the account to me that strongly suggests that actually the scope is bigger than p f chang's indicated and frankly we would have to find out in discovery if even they would admit that their initial estimates of the scope might have been a little bit low and maybe now it's broadened those are classic fact issues we have to get to the bottom of that discovery for now the only point is have we alleged enough for article three standing to simply go forward on our case the answer is yes by a long shot under the standard just given to us by neiman marcus ok thank you thank you and i'm sorry i clipped my time i did try to reserve a little for me but i think you've used it so a little c f o thank you while we have the press release we've read a sure i want of the ways this distinguishes our case from even marcus and many of the other high high profile breaches this in some cases a reached a retailer can have a breach of the corporate level that may expose information regarding all of the retail customers that was not the situation here that is not what is described in the press release we have so the question for me let me back up and figure out the extent to which we are being faced right now with the facial challenge to the standing of these potential class representatives and the potential class and to what extent we're looking at a factual challenge about that i mean i guess it's possible you know that a restaurant or you know a small retailer that's part of the national chain might have its own internal computer network but i would be rather surprised about that it's seems much more likely to me that there's a corporate wide network and maybe things are uploaded to it every day i don't know how it works but at the level of to take your word for at this stage well that the record before the court as we made our announcement on june twelfth thirteen days later mr lord files a suit and the only investigation suggested by the complaint is our press release he says based on our sure and so this is your twelve b six theory but i'm going to remind you that at least as far as i can tell you didn't file across appeal this case was dismissed without prejudice and standing statute of limitations period within the lawsuit so you can't get more than you got without across appeals so in my own mind there's a big difference between whether there's article three standing on the one side and whether a claim has been stated on the other side and i think the neiman marcus case makes it very clear so maybe they're standing but you may just failed state a claim on which relief can be granted and i recognize you were trying to preserve both things but at this stage we're just looking the basically that equipment up to a particular stores that's all we announced he filed his complaint based on our announcement that's why we call him the sprinting bystander he didn't wait to do any more investigation he didn't make any inquiries suggested by the complainer otherwise to figure out which stores were those was he involved and interestingly mr lu work doesn't allege that he suffered any harm whatsoever his complaint is very clear in saying that he was worried that members of the class suffered an authorised bank charges that's a page that paragraph thirty three of his complaint he doesn't allege he suffered any harm whatsoever he clearly is nothing more than a bystander wanting to pursue a claim just as he did against the dandy and in the other litigation where he was the class rep and cyber breach litigation in california he wanted to rush to the courthouse he wanted to be the class rep to pursue these claims even though he was nothing more than a bystander well if we accept you know that i'm looking at the press release and i appreciate your attaching it to your brief in the exercise of caution in this was probably very prudent of course p f chang switches to the manual processing system at all of its branded restaurants located in the continental united states just trying to figure out of course that they stress preliminary stage of the investigation everybody should be vigilant and check cards and then there's the update august for that gets more specific that that's the first one that mentions the thirty three location of the chronology here but he doesn't know what i think he's a bystander he says you know and again this is a little bit about clapper you know how much does it take to get from the possible to the probable or the substantial risk of harm somebody who's data has been in fact compromised in the immediate aftermath of this they have reason to think that there's a link clearly what he does as he cites to our press release that says some stores in this complaint he makes no allegation that he challenges that he doesn't suggest that he thinks that's a false statement that it was only some stores he doesn't allege anywhere that he thinks this breach somebody can't have standing by just saying i've read this piece of chain press release i've been a customer i've got a reasonable fear that my data has been compromised so i'm going to take these precautionary measures well is it a reasonable fear if p f chang says we've had thirty three stores that have had a problem and you didn't dine at one of those thirty three stores well did first of all the press release the june press release doesn't tell me which stores it says we don't know how extensive this is we are taking it you are taking precautionary measures all over the united states why isn't it reasonable for your customers to take similar precautionary measures like hamlet on june tennessee for service tells us there's a problem you have to investigate state law requires or my hot notice yes so june twelfth we get noticed saying what we know at the time and that is we don't want to answer to the actual question judge him i'm interested in that answer as well what i come back to if you data was never at a store that was subject that r h no might take to your question would take the logic of nieman marcus ok which is that precautionary measures protective measures for someone who's data has been compromised can give rise to an actionable injury ok here we've got a press release from you or your client saying our data has been compromised for our customers we don't know how extensive it is we are taking nationwide precautionary measures why is it not equally reasonable for your customers to take precautionary measures in till they have some assurance that their data was not compromised judge their act correctly cited the rule regarding standing when he cited hiring versus freedom from religion and it requires a concrete and particularized injury in fact having occurred ok are you disagreeing with neiman marcus that no what i'm doing and what i'm saying is are cases distinguish your client announces your data and that in that press release basically says to all customers throughout the united states your data may be compromised right we don't know what nicholas i we don't know we're still investigating and data thieves are going to be working faster than your investigation ok so why shouldn't i go ahead and protect myself in the way to neiman marcus is compensable with no further investigation there's no imminent threat to you