A federal court gave new hope this month to victims of data breaches. In the past, most class-action lawsuits filed by victims have been dismissed by courts due to lack of standing—although a victim's personal data might have been stolen, unless he or she suffered actual damages from identity theft or fraudulent bank card charges—they had no standing to sue under Article III of the Constitution. And since banks promise zero-liability to consumers whose cards are stolen and misused, victims of card breaches suffer no actual losses.
But this month the Seventh Circuit Court, which covers Illinois, Indiana, and Wisconsin, bucked the trend when it ruled that breach victims do have standing, regardless of whether they suffer damages.
The case, Remijas v. Neiman Marcus, involves four consumers who filed a class-action complaint against Neiman Marcus after a breach of its computers in 2013 gave intruders access to card data for some 350,000 customers. About 9,200 of the victims had cards that were subsequently used for fraudulent transactions, but none of them suffered actual losses. Nonetheless, the court ruled that everyone affected by the breach, regardless of whether or not their account numbers were used for fraud, had standing to sue because once a card number got stolen the likelihood that it would be used for fraud was high, and there were "identifiable costs" associated with the effort expended to sort out the issue, seek reimbursement if fraud did occur and update auto-pay accounts with the new numbers on replacement cards.
