Emerging Changes in Standing’s “Injury” Requirement
Companies holding large quantities of consumer data have long feared that the courts might unleash nationwide class actions against those that suffer data breaches. One recent and one impending court ruling could bear importantly on whether the “injury” portion of the Article III standing requirement for federal court jurisdiction will stand as a bar to such actions.
The Neiman Marcus Case
The July decision by a Seventh Circuit panel in Remijas v. Neiman Marcus Group, LLC, 794 F. 3d 688 (7th Cir. 2015), held that the plaintiffs did have Article III standing to proceed with a proposed nationwide class action arising from the breach of payment card data at Neiman Marcus stores. In seeking reconsideration by the full Seventh Circuit, Neiman Marcus characterized this decision as “enormously consequential to the national legal landscape” and one that “will impose wasteful litigation burdens on retailers and the federal courts.”
In January 2014, Neiman Marcus publicly disclosed that between July 16, 2013, and October 30, 2013, malware installed in its computers had attempted to collect “payment card account information” from some 350,000 cards and “9,200 of those 350,000 were known to have been used fraudulently.” Neiman Marcus reimbursed fraudulent charges and offered all 2013 customers “one year of free credit card monitoring and identity theft protection.”
In July, four named plaintiffs brought suit under the Class Action Fairness Act based on diversity of citizenship and alleging liability for negligence, breach of implied contract, violations of state unfair or deceptive practices statutes, violations of state breach notification laws, and other state remedies. The complaint sought compensatory damages, punitive damages, prejudgment interest, attorney’s fees, and other types of relief. The named plaintiffs proposed to represent a nationwide class.
The four named plaintiffs alleged that they had made card purchases from Neiman Marcus during 2013; two alleged they subsequently had detected fraudulent card charges and two alleged they had received breach notices from Neiman Marcus. The district court dismissed on the grounds that both the named plaintiffs and the class lacked Article III standing.
The Panel’s Ruling
The Seventh Circuit panel (Chief Judge Wood, Judges Kanne and Tinder) reversed. Chief Judge Wood’s opinion observed that to establish standing a plaintiff must “prove that he has suffered a concrete and particularized injury that is fairly traceable to the challenged conduct, and is likely to be redressed by a favorable judicial decision.” Here the main focus was on whether these plaintiffs had suffered such an injury.
The adequacy of the injury alleged was discussed in terms of the Supreme Court’s 2013 decision in Clapper v. Amnesty International, 133 S. CT. 1138. There, by a 5-4 majority, the Court reversed the Second Circuit and held that the plaintiffs lacked standing to bring a facial challenge to 2008 amendments to the Foreign Intelligence Surveillance Act making it easier for the government to intercept calls and emails between foreigners abroad and persons in the U.S. Justice Alito’s majority opinion (in which Chief Justice Roberts and Justices Scalia, Thomas, and Kennedy joined) ruled that a “threatened injury must be certainly impending” and found that the plaintiffs’ claimed future injuries relied on “a highly attenuated chain of possibilities” and, thus did not meet that standard. Justice Breyer, writing for the dissenters (including Justices Ginsburg, Sotomayor, and Kagan) disagreed with the “certainly impeding” standard, contending that “what the Constitution requires is something more akin to ‘reasonable probability’ or ‘high-probability.’”
Before the Seventh Circuit, the plaintiffs argued a number of standing theories based on alleged present and future injury, including “lost time and money resolving the fraudulent charges,” “lost time and money protecting themselves against future identity theft” and “an increased risk of future fraudulent charges and greater susceptibility to identity theft.”
The Seventh Circuit ruled that “Neiman Marcus customers should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an ‘objectively reasonable likelihood’ that such injury will occur.” The “injuries associated with resolving fraudulent charges and protecting oneself against future identity theft” are injuries sufficient to satisfy the injury requirement of Article III standing.
In applying an “objectively reasonable likelihood” standard, Chief Judge Wood appears to have adopted the views of the dissenters in Clapper. Neiman Marcus’ en banc review petition stressed that the panel erred by adopting a standard expressly rejected by the Supreme Court. If the panel’s standard prevails, it predictably will make it easier to establish standing in other cases.
Though not discussed by Chief Judge Wood’s opinion, Neiman Marcus argued for an en banc review based partly on their being a conflict with the Third Circuit’s decision in Reilly v. Ceridion Corp., 664 F. 3d 38(3d Cir. 2011). There the Court of Appeals affirmed dismissal of a proposed security breach class action for lack of injury, and thus lack of Article III standing. The facts there were different in that “no identifiable taking occurred; all that is known is that a firewall was penetrated” and “no evidence suggests that the data has been – or ever will be misused.” At least in that context, the claim that plaintiffs “incurred expenses in anticipation of future harm” was “not sufficient to confer standing.”
The Seventh Circuit’s discussion does not highlight which of the facts there were thought critical to producing standing. So the decision predictably will be used by other breach-case plaintiffs having fewer facts related to injury, but still some, to argue that the Third Circuit’s decision should not be followed in their case.
Robins v. Spokeo
Another important standing issue concerns the Ninth Circuit’s decision in Robins v. Spokeo, Inc., 742 F. 3d 409 (9th Cir. 2014). There the Court of Appeals held that an individual had Article III standing to sue for willful violations of the Fair Credit Reporting Act based on the defendants allegedly having published false information describing the plaintiff “as holding a graduate degree and as wealthy.” It rejected the defendant’s argument that a plaintiff must show “actual harm,” finding that Congress may create standing by statute so long as the plaintiff is someone whose own statutory rights have been injured and the statutory right protects against “individual, rather than collective, harm.”
Supreme Court Review
Earlier this year, the U.S. Supreme Court took review of this decision to address whether “Congress may confer Article III standing upon a plaintiff who suffers no concrete harm, and who therefore could not otherwise invoke jurisdiction of a federal court, by authorizing a private right of action based on a bare violation of a federal statute.” Merits briefs have been filed and the parties have been joined by the United States and a cloud of amici. The matter has been set for oral argument on November 2.
Time will tell what answer will emerge, but it could be quite significant. If the Court were to rule that Congress has no such authority or that it is severely confined, that could affect construction of a number of existing statutes. It also could signal to the lower federal courts a need for caution in finding what otherwise constitutes injury sufficient to support standing. Conversely, if Congress is held to have broad authority to create Article III standing for violations of statutory rights, that may increase pressure for legislation conferring standing where the courts have been reluctant to find the requisite injury. Stay tuned.