The cost of fraud prevention services, fraudulent credit card charges, and time spent monitoring for fraudulent activity are sufficient to confer standing upon data breach victims, or so says the Seventh Circuit. In its second ruling on the question of Article III standing for breach victims, the Court of Appeals reversed a lower court’s ruling dismissing claims brought by customers against P.F. Chang’s China Bistro, Inc. in connection with a June 2014 data breach.
In Lewart v. P.F. Chang’s China Bistro, Inc., two P.F. Chang’s customers argued that, as a result of the data breach, they suffered damages in the form of fraudulent charges on their credit cards, money spent on fraud prevention services, and time spent monitoring their own statements for fraudulent activity. Relying heavily on its previous ruling in Remijas v. Neiman Marcus Grp. LLC, the Seventh Circuit concluded that those alleged injuries were sufficient to establish constitutional standing. In Remijas, the Seventh Circuit had identified two future injuries that were sufficiently imminent to confer standing in that case: the increased risk of fraudulent charges, and the increased risk of identity theft. Moreover, the past injuries of identity theft and credit monitoring costs were likewise sufficient to confer standing in Remijas. Applying that reasoning in Lewart, the Seventh Circuit came to the same conclusions—the customers’ suit could proceed. P.F. Chang’s argued that its case was distinguishable from Remijas because P.F. Chang’s actually disputed whether its customer’s data was actually stolen. The Seventh Circuit was unconvinced, noting that plausible allegations must be taken as true at the pleading stage. In dicta, the Seventh Circuit voiced its skepticism toward several other types of injuries alleged by the customers, including the cost of their meals at P.F. Chang’s and the violation of their property interests in their personal information.
Lewart and Remijas suggest that at least in the Seventh Circuit certain kinds of past and future injuries will confer standing in data breach cases. However, Lewart indicates that courts will look skeptically at injuries that do not stem from actual or potential fraud or identity theft.
