Joseph J. Siprut
Consumers whose debit- or credit-card data may have been stolen got the go-ahead Thursday to sue the restaurant chain that was the target of a security breach.
The 7th U.S. Circuit Court of Appeals revived a class-action lawsuit filed against P.F. Chang’s China Bistro Inc. after the restaurant chain’s computer system was hacked.
The court rejected the argument that the named plaintiffs did not allege they suffered the kind of harm needed to support standing under Article III of the U.S. Constitution.
Quoting Hollingsworth v. Perry, 133 S. Ct. 2652 (2013), a panel of the court acknowledged that the purported harm must be in the form of “a concrete and particularized injury.”
It is not enough for a plaintiff to allege that he or she might suffer an injury in the future, Chief Judge Diane P. Wood wrote for the panel.
However, she wrote, quoting Clapper v. Amnesty International USA, 133 S. Ct. 1138 (2013), it is enough to allege the existence of imminent or “certainly impending” future harm.
And the increased risk of fraudulent charges or identity theft stemming from a data breach falls into that category, Wood wrote.
That increased risk, she wrote, causes injuries in the form of the time and money spent monitoring card statements or taking other steps to prevent fraud.
The victims of a data breach “should not have to wait until hackers commit identity theft or credit-card fraud in order to give the class standing,” Wood wrote, quoting Remijas v. Neiman Marcus Group LLC, 794 F.3d 688 (7th Cir. 2015).
Joseph J. Siprut of Siprut P.C. argued the case before the 7th Circuit on behalf of the plaintiffs.
In an e-mail, he described the ruling as “a hugely important addition” to the law concerning data breaches.
The ruling reaffirms last year’s decision in the Neiman Marcus case, Siprut said, but “goes even further.”
One of the two named plaintiffs in the P.F. Chang’s suit does not allege he found any fraudulent transactions on his debit card, Siprut said, but was still found to have standing.
Jon P. Kardassakis of Lewis, Brisbois, Bisgaard & Smith LLP in Los Angeles argued the case on behalf of P.F. Chang’s. He could not be reached for comment.
In June 2014, the Secret Service notified P.F. Chang’s that credit- and debit-card data had been stolen from certain restaurants operated by the chain in the continental United States.
Two months later, the chain announced it had determined that data had been stolen from 33 P.F. Chang’s restaurants.
The restaurants included the one at Woodfield Mall in northwest suburban Schaumburg.
A few days before P.F. Chang’s announced its computer system had been hacked, four fraudulent charges had been made on plaintiff Lucas Kosner’s debit card.
Kosner, who had previously eaten at a P.F. Chang’s in Northbrook, concluded his data was among the information stolen.
Kosner, who had already canceled his card, bought a credit-monitoring service for $106.89.
John Lewert, who had eaten at the same P.F. Chang’s in Northbrook, did not find any fraudulent charges on his debit card.
But he alleges he spent time and effort monitoring his card statements and his credit report to ensure no fraudulent charges had been made and no fraudulent accounts had been opened in his name.
Kosner and Lewert filed separate suits in federal court under the Class Action Fairness Act. The suits ultimately were consolidated.
U.S. District Judge John W. Darrah dismissed the suit for lack of standing.
The 7th Circuit panel overturned that decision.
The suit met all the requirements for alleging Article III standing, the panel held.
In addition to contending the plaintiffs had suffered a concrete injury, it wrote, the suit alleged that the injury — the time and money spent monitoring card statements and credit reports — was caused by the data breach.
The assertion by P.F. Chang’s that Kosner’s and Lewert’s data were not compromised by the breach concerns a disputed matter and, therefore, does not defeat standing, the panel wrote.
And the panel wrote that a decision in court in favor of the plaintiffs would redress the injuries they and members of any class that is certified suffered.
Joining the opinion were Judges William J. Bauer and David F. Hamilton. John Lewert, et al. v. P.F. Chang’s China Bistro Inc., No. 14-3700.