The Court of Appeals for the Seventh Circuit has issued its second decision in favor of consumers bringing claims against retailers for injuries following cyber attacks exposing sensitive consumer information in Diefenbach v. Barnes & Noble, Inc. On April 11, 2018 the court resurrected the class action brought against the book retailer by consumers whose debit card information was hacked in 2012. Specifically, the court ruled that the named plaintiffs properly alleged an injury under state consumer protection laws, including lost time, cost of credit monitoring, and inhibited access to bank accounts, did not meet the threshold pleading standards.
Judge Easterbrook, writing for the court, found Barnes & Noble’s arguments against plaintiffs’ constitutional standing ineffective and unconvincing. Supporting her ruling that the victims suffered damages and therefore had standing to initiate this action, Judge Easterbrook opined, “To say that the plaintiffs have standing is to say that they have alleged injury in fact, and if they have suffered an injury then damages are available [. . .] These injuries can justify money damages, just as they support standing.”
This ruling comes three years after the Seventh Circuit’s 2015 decision in Remijas v. Neiman Marcus, where the court ruled that standing existed for consumers whose information had been stolen by hackers — the first federal appellate decision to reject arguments that data breach victims had not suffered enough injury to satisfy the standing requirements as set forth in the 2013 U.S. Supreme Court case, Clapper v. Amnesty International. Since the Remijas ruling, the Third, Sixth, Ninth and D.C. Circuits have followed suit, finding that data breach victims have standing to bring class actions.
The court rejected various rulings cited by Barnes & Noble denying standing for data breach victims, including state court decisions in Illinois and California, where laws tend not to support data breach victim standing. In particular, regarding Illinois law, Judge Easterbrook noted that credit monitoring, costing the consumer monthly, “[. . .] is real and measurable; Illinois does not require more.” The court also rejected Barnes & Noble’s argument regarding California law, finding that “losing the use of money for three days may be a trifle to some people (though to others it may be a calamity), but a trifling loss suffices under California law.”