Client Alert Litigation
Pillsbury Winthrop Shaw Pittman LLP pillsburylaw.com | 1
August 13, 2015
Seventh Circuit Finds Article III Standing for
Data Breach Class Action Based on
Allegations of Future Harm
By Joseph R. Tiffany II and Connie J. Wolfe, Ph.D.
In the wake of numerous data breach cases dismissed for lack of Article III
standing based on the Supreme Court’s decision in Clapper v. Amnesty Int’l
USA, 133 S. Ct. 1138, 1147 (2013), the Seventh Circuit Court of Appeals has
become the first post-Clapper appellate court to hold that data breach victims
adequately alleged standing based on risks of future harm. In Remijas v.
Neiman Marcus Group, LLC, --- F.3d ----, 2015 WL 4394814, Case No. 14-
3122 (7th Cir. July 20, 2015) (“Remijas”), the district court dismissed a class
action complaint against retailer Neiman Marcus based on the plaintiffs’ lack of
Article III standing. Plaintiffs appealed, and the Seventh Circuit reversed. The
decision adds a new element of uncertainty for custodians of customer data
impacted by data breaches.
The Remijas complaint arose from a cyberattack in 2013, in which data for approximately 350,000 payment
cards was potentially exposed to hacker malware. Fraudulent use was reported on 9,200 (approximately
2.6 percent) of the potentially exposed cards. The plaintiffs alleged, among other things, “imminent injuries”
based upon an increased risk of future fraudulent charges and greater susceptibility to identity theft.
In an opinion written by Chief Judge Wood, the Court first considered whether plaintiffs’ “imminent injury”
allegations satisfied the standard established in Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147
(2013), that harm must be “certainly impending.”
1
The Seventh Circuit noted that the Clapper decision did
not eliminate the possibility of finding standing based on “a ‘substantial risk’ that the harm will occur.”
2
In
Clapper, the Supreme Court held that human rights organizations and media groups who challenged the
1
Id. at *3
2
Id. at *4
Cybersecurity Task
Force
Litigation
Privacy, Data Security &
Information Use
