data security – Consumer Financial Services Watch

The Door May Be Open, but the Ride Isn’t Free: Seventh Circuit Allows Data Breach Class Action to Survive Pleading Stage but Signals Tough Road Ahead for Plaintiffs

May 09 2018

By Andrew C. Glass, David D. Christensen, and Matthew N. Lowe

In Dieffenbach v. Barnes & Noble, Inc.,[1] the Seventh Circuit allowed a data breach class action to survive the pleadings stage, including a challenge to the plaintiffs’ standing. At the same time, the Court indicated that the plaintiffs may have a tough time proving their claims on the merits or establishing that class certification is warranted. That warning may put the brakes on this action as well as others brought on a similar theory of liability.

Risky Business: Whether an Increased Risk of Harm Supports Legal Standing in Data Breach Class Actions Continues to Divide Federal Courts of Appeals

Mar 26 2018

By: Andrew C. Glass, David D. Christensen, and Matthew N. Lowe

Every data breach class action in federal court must confront a threshold question: has the plaintiff alleged a sufficient “injury in fact” to establish Article III standing? The inquiry frequently focuses on whether a plaintiff has standing simply by pleading an increased risk of future injury from the theft of personal identifying information (PII). This is because many named plaintiffs do not––because they cannot––allege any present harm. The federal courts of appeals continue to weigh in on the issue of whether allegations of possible future harm suffice for Article III purposes. But far from providing clarity or consensus, recent appellate decisions have reached differing conclusions, which appear highly dependent on the nature of the facts alleged in each case.[1]

Into The Breach: D.C. Circuit Weighs in on Circuit Split Regarding Standing in Data Breach Class Actions

Aug 14 2017

By Andrew C. Glass, David D. Christensen, and Matthew N. Lowe

The D.C. Circuit recently gave its opinion as to whether pleading an increased risk of future injury is sufficient to establish Article III standing to sue in a data breach class action filed in federal court. The issue has divided federal circuit courts of appeals.

In answering in the affirmative, the D.C. Circuit joined the view of the Sixth, Seventh, and Eleventh Circuits. Compare Attias v. CareFirst, Inc., — F.3d —-, No. 16-7108, 2017 WL 3254941 (D.C. Cir. Aug. 1, 2017), with Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012); Galaria v. Nationwide Mut. Ins. Co., 663 Fed. Appx. 384 (6th Cir. 2016) (unpublished); Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016); and Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015). In Attias, the plaintiffs did not allege that they had suffered identity theft as the result of a hacking incident involving a system containing their data. The defendant argued that the mere threat of future harm was too speculative to give rise to standing. But the D.C. Circuit held that it was plausible that the unauthorized party had “the intent and the ability to use [the] data for ill” and thus that the plaintiffs had jurisdictional standing at least at the pleading stage. Id. at *1, *5-*6. Notably, the standing issue arises under Fed. R. Civ. P. 12(b)(1) as an issue of subject matter jurisdiction. The D.C. Circuit did not otherwise decide whether the plaintiffs’ allegations stated a claim that could withstand a motion to dismiss under Fed. R. Civ. P. 12(b)(6), allowing the district court the opportunity to first review the question.

By contrast, the Second and Fourth Circuits have held that data breach plaintiffs lack standing where they plead nothing more than an increased risk of future injury. See Whalen v. Michaels Stores, Inc., — Fed. Appx. —-, No. 16-260, 2017 WL 1556116, at *1 (2d Cir. May 2, 2017) (unpublished); Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), cert. denied sub nom., Beck v. Shulkin, No. 16-1328, 2017 WL 1740442 (U.S. June 26, 2017).

Notwithstanding the circuit court split, the United States Supreme Court has yet to grant certiorari to review the issue. We will continue to monitor and report on developments in data breach standing law as they occur.

Hold On, You Didn’t Overpay for That: Courts Address New “Overpayment” Theory from Plaintiffs in Data Breach Cases

Aug 10 2016

By Andrew C. Glass, David D. Christensen and Matthew N. Lowe

With the ever-increasing amount of personal information stored online, it is unsurprising that data breach litigation has become increasingly common. A critical issue in nearly all data breach litigation is whether a plaintiff has standing to pursue claims—especially where there is no evidence of actual fraud or identity theft resulting from the purported data breach. The plaintiffs’ bar has pursued a litany of legal theories in the attempt to clear the standing hurdle, including the recent theory of “overpayment” (a/k/a “benefit of the bargain” theory). Under this theory, the plaintiff alleges that the price for the purchased product or service—whether sneakers, restaurant meals, or health insurance—included some indeterminate amount allocated to data security. Depending on how the theory is framed, the purported “injury” is either that the plaintiff “overpaid” for the product or service, or that the plaintiff did not receive the “benefit of the bargain,” because the defendant did not appropriately use the indeterminate amount to provide adequate data security. Despite plaintiffs’ attempts to establish standing through this novel theory, courts have limited its applicability in a variety of ways discussed in this alert.

To read the full alert, click here.

Proactive Protection of Consumers or Premature Penalty? Consumer Financial Protection Bureau Bucks the Trend in Data Security Breach Cases

Mar 15 2016

By: R. Bruce Allensworth, Ryan M. Tosi, Lindsay S. Bishop

Data breaches and cybersecurity attacks appear to be growing in frequency. Despite the increase in the number of such attacks, plaintiffs have found it difficult to establish a legal foothold for data breach claims, as federal courts across the country have routinely dismissed data breach claims brought by private litigants where no cognizable harm has been alleged. The Consumer Financial Protection Bureau (“CFPB”), however, now appears poised to enforce regulations regarding the protection of private consumer information, including holding companies accountable — even without any data breach or misuse of private consumer information.

To read the full alert, click here.

Circuit Court Declares Bank’s Wire Transfer Security to Be Commercially Unreasonable Under UCC Article 4A

Jul 18 2012

By: Holly K. Towle

In 2010 we reported on the “Wave of Online Banking Fraud Targeting Businesses” that use online banking relationships to make electronic fund transfers by wire or ACH. The fraudsters use malware such as key-loggers to steal access credentials and then start draining the business’ account. In the U.S., the transfers are governed by Article 4A of the Uniform Commercial Code (“UCC”). Consumer accounts are not impacted by Article 4A: they are eligible for the consumer protections afforded by the federal Electronic Funds Transfer Act and Regulation E, which limit a consumer’s exposure to fraudulent transfers to a maximum of $50 as long as the consumer promptly reports the fraudulent activity. Read More

Tag:data security