7th Circuit Court of Appeals finds Article III Standing for P.F. Chang’s Plaintiffs

On April 14, 2016, the Court of Appeals for 7th Circuit reinstated plaintiffs’ action against P.F. Chang’s restaurant chain that arose out of the well-reported breach of payment card information. The action was previously dismissed by the District Court for the Northern District of Illinois, Eastern Division, on the basis of what the lower Court ruled was the plaintiffs’  lack of Article III standing.

As this Blog has discussed, P.F. Chang’s notified its customers of a PCI data breach in June 2014. Plaintiff Kosner dined at the P.F. Chang’s restaurant in Northbrook, Illinois.  Some time later he incurred fraudulent credit card charges and associated them with the P.F. Chang’s breach.  Kosner cancelled the credit card in question and retained a credit monitoring company to monitor his accounts.  Plaintiff Lewert also dined at P.F. Chang’s in Northbrook, IL, but did not incur fraudulent charges.  He monitored his card statements and credit reports for any fraudulent charges himself.

Kosner and Lewert sought to represent a class action of P.F. Chang’s customers who paid with credit cards and whose data may have been stolen. The District Court previously dismissed their claim based upon lack of standing and the plaintiffs appealed.

Article III of the Constitution requires plaintiffs to show that they “suffered a concrete and particularized injury that is fairly traceable to the challenged conduct, and is likely to be redressed by a favorable judicial decision.” Hollingsworht v. Perry, 133 S. Ct. 2652, 2661 (2013).  In reversing the District Court’s dismissal, The 7th Circuit Court of Appeals found that Plaintiffs meet constitutional standing requirements and remanded the matter for further proceedings.

In reaching its decision, the Court expressly relied upon its prior decision Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015).  In Remijas, the 7th Circuit Court of Appeals found that customers whose data was breached suffered sufficiently concrete and particularized injuries under Article III to support standing.  The injuries identified by the Remijas Court were an increased risk of fraudulent charges and an increased risk of identity theft.

The Court of Appeals found that Remijas’ alleged injuries were “certainly impending” – the future harm required to establish standing.  The Court noted that the customers should not have to wait until hackers commit identity theft or credit card theft in order to have standing because “objectively reasonable likelihood” exists that such injury will occur.  The Court also found that the time and money spent resolving fraudulent charges and identity theft were sufficient injuries for purposes of standing.

Applying the foregoing reasoning, the Appellate Court concluded that because Plaintiffs’ credit card data had already been stolen, the injuries to Kosner and Levert fall under the same categories as set forth in Remijas – increased risk of identity theft and credit theft.  The 7th Circuit also found that Plaintiffs already suffered sufficient injuries to convey standing in the form of fraudulent charges and credit monitoring.

As to the remaining criteria for standing, causation and redressability, the Court also found in favor of the Plaintiff determining with respect to causation that while a dispute exists as to the extent of the breach, that in itself does not destroy standing and will be the subject of discovery during litigation. With regard to redressability, the Court found that a favorable judgment would compensate Plaintiffs for their injuries via reimbursement of costs related to credit monitoring, and loss of accrual of points on the credit card while awaiting its replacement.

Courts are now squarely pitted in different directions on this issue and the Spokeo case – where the U.S. Supreme Court may decide whether Article III standing is conferred upon a plaintiff who suffers no concrete harm, and could not otherwise invoke the jurisdiction of a federal court, by authorizing a private right of action based on the mere violation of a federal statute – is still outstanding.