On April 14, 2016 the 7th U.S. Circuit Court of Appeals issued its opinion in Lewert v. P.F. Chang’s China Bistro, Inc. where it held, once again, that data breach class action plaintiffs suffered damages that “were concrete and particularized enough to support Article III standing.”
In 2014, P.F. Chang’s experienced a credit card breach involving 33 restaurants nationwide, including one in the Chicago area. Two customers affected by the breach sued and sought class certification. While neither plaintiff dined at a compromised restaurant, one discovered fraudulent charges and purchased credit monitoring services. The second plaintiff did not discover any fraudulent charges, but was alarmed by the breach and also purchased credit monitoring services. The District Court denied class certification on grounds the plaintiffs failed to demonstrate that they “suffered a concrete and particularized injury”, and therefore lacked standing.
The 7th Circuit reversed the lower court, finding that the class representatives alleged sufficient harm by way of fraudulent credit card charges, credit monitoring costs and time monitoring potential identity theft. In support, the court relied heavily on its July 2015 decision in Rejimilas v. Neiman Marcus. P.F. Chang’s tried to distinguish Neiman Marcus, arguing that it disputed whether the plaintiffs’ information was disclosed during the breach. The court disagreed, holding that the plaintiffs had “plausibly alleged” that their data was stolen because P.F. Chang’s initial statement regarding the breach was directed to all P.F. Chang’s customers and did not distinguish between restaurant locations.
This case, along with Neiman Marcus, continues to show that the 7th Circuit is friendly territory for data breach class action plaintiffs. We will continue to monitor the Article III standing issue in other federal circuit and state courts around the country.