Enter to open, tab to navigate, enter to select
P.F. Chang's Diners Have Standing in Data Breach Action: Seventh Circuit
Practical Law Legal Update w-001-8985 (Approx. 4 pages)
P.F. Chang's Diners Have Standing in Data Breach Action: Seventh Circuit
by Practical Law Intellectual Property & Technology
| Published on 18 Apr 2016 • USA (National/Federal) |
In Lewert v. P.F. Chang's China Bistro, Inc., the US Court of Appeals for the Seventh Circuit held that customers who had dined at the restaurant during the time the restaurant suffered a data breach had alleged sufficient injuries to support Article III standing.
On April 14, 2016, the US Court of Appeals for the Seventh Circuit issued an opinion in Lewert v. P.F. Chang's China Bistro, Inc., reversing the US District Court for the Northern District of Illinois's dismissal of Lewert's suit for lack of standing ( (7th Cir. Apr. 14, 2016)). In a de novo review, the court found that Lewert, and others who would be included in his proposed class, suffered a concrete injury which could be traced back to P.F. Chang's China Bistro, Inc.'s conduct.
In June 2014, P.F. Chang's announced its computer system had been breached and some consumer credit and debit card data had been stolen. Although it apparently did not know at the time how many consumers were affected or which of its locations had been targeted, the company advised consumers to monitor their credit statements. The company later identified 33 locations from which data had been stolen.
After this announcement, John Lewert and Lucas Kosner both realized they had dined at P.F. Chang's during the time of the breach, and although the restaurant they visited was not among the 33 identified locations, each separately filed suit against the company for damages resulting from the breach on behalf of themselves and a class. The district court consolidated the suits but ultimately granted P.F. Chang's motion to dismiss for lack of standing.
On appeal, and relying on its recent holding in Remijas v. Neiman Marcus Group, LLC, the Seventh Circuit determined the plaintiffs did allege sufficient injuries to confer Article III standing (794 F.3d 688 (7th Cir. 2015)). In particular, the court reasoned:
- Similar to the future injuries described in Remijas, Lewert and Kosner both face an increased risk of fraudulent charges and identity theft because their data has already been stolen.
- Both Lewert and Kosner sufficiently alleged they have suffered present injuries. Kosner, after identifying fraudulent charges on his debit account, cancelled his debit card and purchased credit protection services. Lewert alleged he spent time and effort monitoring his accounts and credit reports for fraud.
- Despite P.F. Chang's position that the plaintiffs' mitigations were unreasonable because the breach only posed a risk of fraudulent charges, not identity theft, Lewert's and Kosner's actions were not unreasonable given the court's recognition in Remijas that hackers can use stolen payment card information to open new accounts in a consumer's name.
- Although P.F. Chang's alleged that none of the plaintiffs' data was exposed in the breach, at the motion to dismiss stage, a court must take a plaintiff's factual allegations as true, once the allegations have crossed the line from conceivable to plausible.
The court also found that the plaintiffs met the criteria for causation and redressability because:
- Plaintiffs plausibly alleged that the restaurant location they visited was affected by the breach, and any potential alternative causes P.F. Chang's may allege can be pursued at the merits phase.
- Potential class members similarly situated to Kosner may have quantifiable financial injuries. Other class members, like Lewert, may claim they spent time and resources researching possible fraud, changing automatic charges, and replacing cards as a precautionary matter. A favorable judgment would redress these injuries.