For lawyers who frequently litigate class action lawsuits, whether or not the named plaintiffs have standing to bring a claim is one of the first issues that is analyzed and considered.  Plaintiffs’ lawyers often look for named plaintiffs that have suffered easily identifiable damages, while defense lawyers often rely on standing defenses to ward off costly class action cases.

Background

In order to have standing under Article III of the United States Constitution, potential plaintiffs must be able to show that the injury suffered is (1) concrete, particularized, and actual or imminent, (2) fairly traceable to the challenged action, and (3) redressable by a favorable ruling.  These three factors have been subject to much debate and judicial review.  In recent years, standing has been frequently litigated in cases where plaintiffs claim that they were injured due to someone gaining access to their confidential or private information.

In 2013, the United States Supreme Court attempted to provide guidance on standing questions in the digital age in the case of Clapper v. Amnesty International.  In Clapper, the plaintiffs challenged the constitutionality of section 702 of 50 U.S.C. § 1881a, the Foreign Intelligence Surveillance Act (“FISA”).  Section 702 was added by the FISA Amendments of 2008 and permits the Attorney General and the Director of National Intelligence to conduct warrantless wiretapping of telephone and email communications of certain persons located outside the United States.  Plaintiffs contended that the FISA violated their fourth amendment rights because plaintiffs may have confidential communications with non-United States persons who are subject to surveillance under FISA.

In ruling that the plaintiffs did not have standing to challenge the statute, the Supreme Court made several impactful statements that have resonated with the lower courts.  With respect to the first standing element that the injury suffered must be concrete, particularized, and actual or imminent, the Supreme Court stated that the “threatened injury must be certainly impending to constitute injury in fact.”  Since the plaintiffs could only speculate as to whether their conversations would be intercepted, the first standing element was not met. The court found that allegations of possible future injury are not sufficient.  Alternatively, plaintiffs argued that they have already suffered a concrete injury because they were undertook costly and burdensome measures to protect the confidentiality of their communications.  The Supreme Court found that plaintiffs could not “manufacture standing merely by inflicting harm upon themselves” and that fear is insufficient to create standing.

Clapper was considered a win by many retailers who were vulnerable to large class action suits by customers following incidents of privacy breach.  In many district court cases, relying on the reasoning in Clapper, retailers were able to successfully dismiss claims where customers claimed that their confidential information was exposed to hackers, but were unable to articulate a concrete and imminent injury, as opposed to a hypothetical future injury, had already occurred.

Decision

The Seventh Circuit, however, took a more expansive view of standing in Remijas v. Neiman Marcus Group, LLC.  In mid-December 2013, Neiman Marcus suffered a data breach caused by hackers.  The banking information of approximately 350,000 may have been compromised.  Neiman Marcus notified all customers and offered one year of free credit monitoring and identity-theft protection.  The plaintiffs in Neiman Marcus, filed suit relying on a number state data breach laws for relief.  Neiman Marcus’s motion to dismiss for lack of standing was granted by the district court and plaintiffs appealed to the Seventh Circuit.

The Seventh Court reversed, and held that plaintiffs did have standing to proceed against Neiman Marcus.  The class of plaintiffs contained persons who experienced fraudulent charges on their accounts, and those that did not.  With respect to plaintiffs who experienced fraudulent charges, Neiman Marcus argued that they had not suffered actual injuries because they were reimbursed.  The court found this argument unavailing because there are identifiable costs associated with “the process of sorting things out.”  With respect to the plaintiffs who have not yet seen fraudulent charges on their accounts, the Seventh Circuit said those plaintiffs had standing because there was a “substantial risk” of future harm.  The Seventh Circuit stated that Clapper does not foreclose any use whatsoever of future injuries to support Article III standing.  Notably, the Seventh Circuit also referenced the fact that Neiman Marcus offered one year of credit monitoring and identity-theft protection as a reason for concluding that the risk of harm is not “so ephemeral that it can be safely disregarded.”

Implications

The ruling in Neiman Marcus is at odds with prior, lower court precedent interpreting Clapper.  Nevertheless, it will likely be cited as a leading authority on the scope of Clapper and the issue of standing in data breach cases.  Retailers should be aware of the ruling in Neiman Marcus and its implications, as it arguably makes the standing hurdle easier to overcome for plaintiffs in data breach or privacy cases.  Retailers should also be mindful that “good-will” policies, such as notification to customers of a data breach and offering of credit monitoring services, may be considered by the Court in its reasoning to find that plaintiffs have standing.  The business benefits of these “good-will” policies need to be weighed against the litigation costs when formulating company strategies.

The reach of the Seventh Circuit’s ruling in Neiman Marcus has yet to be tested, but we anticipate that it will spawn more litigation and lengthier cases as more plaintiffs file suit and survive past motions to dismiss based on standing.  We will continue to provide updates on this topic if more circuit courts weigh in on this important issue.