Source: Lexology
This week, the U.S. Court of Appeals for the Second Circuit issued an important decision in Whalen v. Michaels Stores, placing the court at the center of the controversy around what allegations are sufficient to establish Article III standing in data breach class actions. In Whalen, the plaintiff alleged that payment card information stolen in a data breach was used in unsuccessful, attempted fraudulent transactions. The payment card owner further alleged that she faced an increased risk of future identity fraud, forcing her to spend time and money resolving the attempted fraudulent charges and monitoring her credit. The court ruled that these allegations did not establish a concrete injury sufficient to confer Article III standing.
Background
Michaels Store, Inc. (“Michaels”) is an arts and craft retail chain. On January 25, 2014, Michaels notified its customers in press release of “possible fraudulent activity on some U.S. payment cards.” The company announced that it was investigating the incident and advised customers to monitor their credit accounts for unauthorized charges. On April 17, 2014, Michaels confirmed the existence of a data breach in another press release. The company reported that hackers had used a “highly sophisticated malware” to retrieve payment card information from the computer systems of Michaels and its subsidiary, Aaron Brothers. However, Michaels also reported that there was no evidence that the hackers had obtained any other customer information, such as names, addresses, or PIN numbers. Michaels estimated that approximately 2.6 million payment cards may have been affected for the period between May 8, 2013 and January 27, 2014. As a result, the company offered free identity protection and credit monitoring services for twelve months to affected customers.
Mary Jane Whalen made purchases with her credit card at a Michaels store on December 21, 2013. On January 14 and 15, 2014, Whalen’s credit card information was used unsuccessfully in two attempted fraudulent transactions in Ecuador. On January 15, 2014, Whalen cancelled her credit card. No other fraudulent transactions were either incurred or attempted on Whalen’s credit card.
On December 2, 2014, Whalen filed a putative class action against Michaels, alleging claims for breach of implied contract and violation of New York General Business Law § 349. On December 28, 2015, the district court dismissed the complaint, finding that Whalen lacked standing because she “neither alleged that she incurred any actual charges on her credit card, nor, with any specificity, that she had spent time and money monitoring…
Click here to read more
