Source: http://www.privacydatabreach.com/author/cspiezia/
Timestamp: 2019-04-25 14:01:05+00:00

Document:
On December 13, 2016, the Seventh Circuit Court of Appeals became the first post-Spokeo circuit court to address the issue of Article III standing in a putative class action brought for an alleged violation of the Fair and Accurate Credit Transactions Act (“FACTA” or “the Act”), 15 U.S.C. § 1681c(g), which is itself an amendment to the Fair Credit Reporting Act (“FCRA”). Generally, FACTA prohibits a vendor or retailer who accepts a credit or debit card as a means of payment from printing more than the last five (5) digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction. 15 U.S.C. § 1681c(g)(1). Willful violations of the Act could subject a defendant to any actual damages sustained by the consumer, or statutory damages of not less than $100.00 and not more than $1,000.00. 15 U.S.C. § 1681n(a). The Act also provides for the potential recovery of punitive damages along with reasonable attorney’s fees and costs. Id. Thus, per the plain language of the statute, actual damages are not necessarily a precondition for a FACTA suit. Aggregated statutory damages in a class claim, as one might imagine, could prove ruinous for a defendant.
In Spokeo v. Robbins, the United States Supreme Court held that a plaintiff could not establish Article III standing by relying solely on a “bare procedural violation” divorced from any real-world harm, because “Article III standing requires a concrete injury even in the context of a statutory violation.” In the five months since Spokeo was decided however, district court decisions as to whether a plaintiff may enjoy standing to bring actions premised upon statutory violations alone have been far from consistent.
In Meyers v. Nicolet Restaurant of De Pere, the Seventh Circuit dismissed a plaintiff’s putative class claim for lack of Article III standing, as he sought only those damages that are statutorily provided-for under FACTA. More specifically, Mr. Meyers alleged that, after dining at Nicolet Restaurant of De Pere, he was given a receipt that did not truncate the expiration date of his credit card. He subsequently filed suit on behalf of all customers who had similarly been provided with receipts that were not compliant with FACTA’s requirements. While Mr. Meyers admitted seeking only statutory damages, he argued that standing was conferred upon him because, in enacting FACTA, Congress granted him the legal right to receive a receipt that truncated his credit card’s expiration date. The Seventh Circuit disagreed, finding it significant that Mr. Meyers discovered the violation immediately, and that no one ever saw the violative receipt. The Seventh Circuit found it difficult to imagine how the presence of the expiration date could have increased the risk that Mr. Meyer’s identity would be compromised, and accordingly held that, without a showing of injury apart from the failure to truncate a credit card’s expiration date, the injury-in-fact requirement under Article III could not be satisfied.
While district courts continue to interpret Spokeo in cases implicating various “no-injury” consumer and privacy statutes, this decision provides defendants with additional grounds to potentially move for dismissal. Conversely, plaintiffs are sure to use it is a roadmap to creatively tailor pleadings to establish an injury in fact.
The Seventh Circuit’s opinion in Meyers v. Nicolet Restaurant of De Pere can be found here.
In response to an April 2014 data breach, P.F. Chang’s Bistro, Inc. effected a rapid response plan in an attempt to minimize potential injury to its consumers. The restaurant announced that its computer system had been hacked and card data had been stolen, conceding that it did not know how many consumers were affected, whether the breach was limited to certain locations, or how long the breach lasted. As an additional precautionary measure, P.F. Chang’s also switched to a manual card-processing system and encouraged all customers to monitor their credit reports for new activity.
Last week, in Lewert v. P.F. Chang’s China Bistro, Inc., No.14-3700, (7th Cir. Apr. 14, 2016), the Seventh Circuit Court of Appeals again held that two plaintiffs who filed a class action suit against it had the Article III standing required to survive dismissal. Citing to its July, 2015 decision in Remijas v. Neiman Marcus Group, LC, 794 F.3d 688 (7th Cir. 2015)), the Court concluded that the P.F. Chang’s plaintiffs’ alleged injuries were sufficient to support a lawsuit – the consumers were at an increased risk of fraudulent charges and identity theft.
In reaching its decision, the Seventh Circuit pointed to P.F. Chang’s remedial efforts to prevent consumers’ exposure to the breach. Specifically, P.F. Chang’s addressed customers who dined at all of its restaurants in its initial press release, and advised consumers to monitor their credit reports, “rather than simply the statements for existing affected cards.” The court explained that by doing so, the company implicitly acknowledged that there could be a substantial risk of harm from the data breach. P.F. Chang’s eventually determined that only thirty-three of its restaurant locations had been affected, an argument which the court stated could create a factual dispute on the merits, but that would not destroy standing.
The Seventh Circuit’s decision underscores that the initial Article III hurdle for data breach plaintiffs is not high, and should serve to mold a company’s public reaction to a potential breach.
As was previously reported, October 1, 2015 signaled a fraud “liability shift” between credit card issuers and merchants, in which liability for fraudulent credit card transactions began falling on whichever party used the lower level of security and compliance with EMV standards. While merchants are not required to adopt EMV technology (which reads chip cards, as opposed to the less secure magnetic strip cards), in the event of a data breach, their failure to do so can now render them responsible for the costs associated with the fraudulent use of stolen credit card information. This liability shift has created a very strong incentive for merchants to implement EMV chip card readers.
For companies that have not opted to make the EMV transition, lawsuits may begin to abound. One of the first suits targeting a retailer for its failure to keep up with industry standards was filed on February 8, 2016, in the wake of a possible data breach at the nationwide fast food chain, Wendy’s.
On January 27, 2016, Wendy’s announced that it was investigating a possible breach of its point of sale systems, after the company was alerted of “unusual activity” involving customers’ credit or debit cards at some of its locations. Wendy’s hired a cybersecurity firm to investigate the potential breach – which involved transactions in late 2015 – who discovered malware designed to steal customer payment data on computers that operate Wendy’s payment processing systems in certain locations.
An Orlando, Florida man purporting to be a victim of the Wendy’s breach initiated a class action lawsuit against the company on February 8, 2016, claiming that Wendy’s “lackadaisical” and “cavalier” security measures allowed his debit card data to be stolen and used to purchase nearly $600.00 of merchandise from various retailers. The lawsuit alleges that Wendy’s could have prevented the breach, yet maintained a system that was insufficient and inadequate to protect customers’ data. An attorney representing the plaintiff suggested that Wendy’s failed to incorporate technology allowing for use of chip-enabled cards, and that the lawsuit may expose the danger of failing to adopt such a system.
The threat of similar class action litigation may serve as a wake-up call for retailers who have failed or otherwise delayed in implementing up-to-date security measures. The suit, Jonathan Torres vs. The Wendy’s Company, can be found here.
As has been previously reported here, a series of recent federal court decisions has suggested a trend in data breach litigation – that an increased risk of harm will be sufficient to satisfy the injury-in-fact requirement for Article III standing. In fact, less than three weeks ago, the Seventh Circuit Court of Appeals revived a previously-dismissed data breach class action lawsuit, ruling that plaintiffs did not have to wait until hackers actually committed identity theft in order to establish standing. On August 6, 2015, the Illinois Appellate Court held exactly the opposite.
In Maglio v. Advocate Health and Hospitals Corporation, several plaintiffs sued Advocate Health and Hospital after computers containing patients’ personal information were stolen. 2015 IL App (2d) 140782 (August 6, 2015). Plaintiffs did not allege that their personal information was used in any unauthorized manner as a result of the burglary, but they claimed that they faced an increased risk of identity theft and identity fraud. Advocate Health moved to dismiss the complaint, arguing that mere stolen information is insufficient to establish standing, because an increased risk of identity theft and/or identity fraud is too speculative to constitute cognizable injury-in-fact.
Affirming the trial court’s dismissal of the action, the Illinois Appellate Court agreed with the defendant’s argument, concluding that the increased risk of harm arising out of a data breach is inadequate to confer standing on consumers. The Illinois Appellate Court noted the similarity between Illinois’ and federal standing principles, and relied for the most part on federal decisions, including Clapper v. Amnesty International USA, Inc., 133 S.Ct. 1138 (2013) – a case which the Seventh Circuit interpreted as not completely foreclosing on the use future injuries to support Article III standing. Yet, in stark contrast to recent federal court decisions, the Illinois Appellate Court opined that where no identity theft had yet occurred, the elevated risk of such harm was too speculative and conclusory to be considered a distinct and palpable injury.
The plaintiffs in Maglio also tried to achieve standing by alleging that they suffered emotional injury as a result of the data breach, such as anxiety, and that their privacy had been invaded. Again, the court found such allegations to be speculative and therefore insufficient, absent allegations of actual disclosure of personal information.
We expect to see fewer data breach class actions being filed in Illinois state courts – long criticized as plaintiff-friendly venues – and an uptick in federal court filings. The full opinion is available here.

References: § 1681
 § 1681
 § 1681
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.