Takeaway: With new stories of data breaches popping up almost daily, a recent Second Circuit decision illustrates the difficulties named plaintiffs face establishing actual injury and surviving a motion to dismiss based on Article III standing. To establish standing, the plaintiff must allege more than a refunded fraudulent charge or the fear of future identity theft. A recent ruling by the Second Circuit demonstrates that, especially in cases involving only exposure of payment card information (and not personal information), standing limitations can be a potent weapon in the class action defendant’s arsenal.
In Whalen v. Michaels Stores, Inc., No. 16-260 (L), 2017 WL 1556116, at *1 (2d Cir. May 2, 2017), the Second Circuit upheld the district court’s dismissal of a putative class action alleging claims arising out of a data breach at Michaels stores, agreeing with the Eastern District of New York that the plaintiff failed to show either actual injury or impending future injury.
Whalen involved a data breach affecting around 2.6 million credit cards used at Michaels stores between May 8, 2013 and January 27, 2014. Whalen v. Michael Stores Inc., 153 F. Supp. 3d 577, 578 (E.D.N.Y. 2015), aff’d sub nom. Whalen v. Michaels Stores, Inc., No. 16-260 (L), 2017 WL 1556116 (2d Cir. May 2, 2017). Whalen alleged that she made a purchase with her credit card during the relevant period and brought claims against Michaels for breach of implied contract and violations of the New York GBL § 349. Critically, the breach only involved the release of payment card information. There was no allegation that any customer personal information (such as social security numbers or addresses) had been released. Michaels persuaded the district court to dismiss for lack of standing. 2017 WL 1556116 at *1.
The Second Circuit’s analysis focused on the specific harm suffered by Whalen as a result of the data breach. Whalen alleged that (1) her credit card information had been used twice in attempted fraudulent purchases in Ecuador; (2) she faced a future risk of identify fraud; and (3) she lost time and money attempting to resolve the charges and monitoring her credit. The Court of Appeals rejected all three contentions.
First, the Second Circuit ruled that, because Whalen did not pay and was never asked to pay the fraudulent charges, the unauthorized use of her credit card did not constitute actual injury. Whalen, 2017 WL 1556116, at *2. On this point, the district court...
