Remijas v. Neiman Marcus: Seventh Circuit Affords Broad Standing To Sue Over Consumer Data Breaches

When hackers breach a business's systems, class actions are sure to follow. Often, however, these suits have faltered right out of the starting gate. Citing the Supreme Court's 2013 decision in Clapper v. Amnesty International, many federal district judges have dismissed these suits, holding that consumers whose personal data have been compromised—but who have not actually incurred any fraudulent charges or suffered identity theft—lack standing under Article III of the U.S. Constitution.

This week, the Seventh Circuit declined to follow these decisions. This may subject businesses that collect consumer data to an elevated threat of class-action liability in Illinois, Indiana, and Wisconsin federal courts.

In Remijas v. Neiman Marcus, four shoppers filed a class-action complaint against Neiman Marcus over a 2013 data breach, in which "hackers" had apparently gained access to the credit card numbers of some 350,000 customers. Of those 350,000 customers, only 9,200 had actually "incurred fraudulent charges," and all of those fraudulent charges were "later reimbursed." Of the remaining customers, some had paid for credit-monitoring services or otherwise spent time or money guarding against potential fraud or identity theft, and others had not.

The Seventh Circuit held that all of these categories of consumers had standing to sue.

It first found that the 9,200 shoppers who had already incurred fraudulent charges had standing, even though those charges were reimbursed. This was because "there [were] identifiable costs associated with the process of sorting things out," such as the time and effort spent seeking reimbursement and updating auto-pay settings for replacement cards. Here, Remijas broke no new ground: courts have long held that the cost of remediating a concrete injury is itself an injury.

But what about the 97% of shoppers who had not experienced any fraudulent activity? As in many other cases, the district court had held that these consumers lack standing under Clapper. In Clapper, the Supreme Court found that the plaintiffs lacked standing to challenge the government's warrantless wiretapping program. It was not enough to furnish standing that some people in their position would inevitably be wiretapped; the question was whether the plaintiffs themselves would be. Because there was only a "speculative" possibility that this would occur, there was no presently existing or "certainly impending" future harm, as Article III requires.

The...