« Ind. Decisions - 7th Circuit decides Blagojevich appeal | Main | Ind. Decisions - 7th Circuit decides a second Indiana case yesterday »

Tuesday, July 21, 2015

Ind. Courts - "The 7th Circuit just made it a lot easier to sue over data breaches"

Alison Frankel has just posted a long "On the Case" Reuters story on yesterday's 7th Circuit opinion in Hilary Remijas v. Neiman Marcus Group, LLC. A quote:

On Monday, a 7th Circuit panel reinstated a data breach class action against the retailer Neiman Marcus, holding that the theft of customers’ financial information was enough to satisfy constitutional standing requirements, even after Clapper.

“The Neiman Marcus customers should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an ‘objectively reasonable likelihood’ that such an injury will occur,” wrote Chief Judge Diane Wood for a panel that also included Judges Michael Kanne and John Tinder.

This is a really consequential decision. It’s the first time a federal appeals court has looked at a data breach class action that was dismissed because the trial judge said it fell short of Clapper standing requirements. The 7th Circuit said flatly that Clapper “does not, as the district court thought, foreclose any use whatsoever of future injuries to support Article III standing.” Sometimes, the opinion said – quoting a footnote from the Clapper opinion – standing can be established when there is a “substantial risk” of harm and plaintiffs “reasonably incur costs to mitigate or avoid that harm.”

According to the 7th Circuit, Neiman Marcus customers have standing to sue because are at substantial risk of fraudulent charges or identity theft. “Why else would hackers break into a store’s database and steal consumers’ private information?” the opinion said.

Posted by Marcia Oddi on July 21, 2015 05:30 PM
Posted to Ind. (7th Cir.) Decisions