Consumer class action revived for Neiman Marcus data breach

The 7th Circuit Court of Appeals reversed the district court’s dismissal of a consumer class lawsuit against luxury department store Neiman Marcus.  Last Monday (7/20), the Court held that the plaintiffs had successfully alleged the concrete, particularized injuries necessary to support standing.

While we haven’t covered standing explicitly in class, standing is defined as a party’s right to make a legal claim or seek judicial enforcement of a duty or right.  For example, to have standing in federal court, a plaintiff must show (1) that the challenged conduct has caused the plaintiff actual injury, and (2) that the interest sought to be protected is within the zone of interests meant to be regulated by the statutory or constitutional guarantee in question.  Sometimes it can be referred to as “standing to sue

The initial lawsuit against Neiman Marcus was in January 2014, when the company publicly disclosed that it had suffered a data breach where hackers collected the credit card information of approximately 350,000 customers. A number of consumers filed a class action lawsuit. The suit alleged that Neiman Marcus put the plaintiffs at risk for risk for identity theft and fraud by delaying to disclose information about the breach for a month. In September 2014, the district court dismissed the case, ruling that both the individual plaintiffs and the class lacked standing.

On appeal, the 7th Circuit analyzed the injuries the Neiman Marcus consumers claimed to have suffered in order to determine whether they constituted the type of “concrete and particularized injury” required to establish standing. In this instance, plaintiffs alleged lost time and money spent in protecting against fraudulent charges and future identity theft, as well as two “imminent injuries:” an increased risk of future fraudulent charges and greater susceptibility to identity theft. The 7th Circuit ultimately determined that these allegations sufficiently established standing, as they showed a “substantial risk of harm” from the Neiman Marcus data breach. Importantly, the Court explained that the Neiman Marcus customers did not have to wait until hackers actually committed identity theft or credit-card fraud to obtain class standing, as there was an “objectively reasonable likelihood” that such an injury would occur. The full opinion is available here.

The 7th Circuit’s ruling combined with and the Central District of California’s ruling in Corona last month [Corona, et al. v. Sony Pictures Entertainment, Inc., No. 2:14-cv-09600-RGK-E (C.D. Cal. June 15, 2015).] suggests a trend: consumers nationwide may find it easier to survive a motion to dismiss based on a lack of standing.  For other cases in the trend see: In re Sony Gaming Networks and Customer Data Security Breach Litigation, 996 F.Supp.2d 942 (S.D. Cal. 2014); Moyer v. Michaels Stores, Inc., 2014 U.S. Dist. LEXIS 96588 (N.D. Ill. July 14, 2014); In re Adobe Systems Inc. Privacy Litigation, 2014 U.S. Dist. LEXIS 124126, (N.D. Cal. Sept. 4, 2014).


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s