7th Circuit Rules PIN-Terminal Theft Sufficient Injury to Create Standing

The Seventh Circuit ruled that two plaintiffs’ complaint against a national bookstore chain—seeking damages for stolen personal financial data captured by thieves using the bookstore’s debit card PIN pads—could not be dismissed “on the ground that the plaintiffs failed to adequately allege compensable damages” when it did not include specific details about the plaintiffs’ injury.

Despite the existence of controlling case law stating that “consumers who experience a theft of their data” have standing, the district court initially held that the plaintiffs had no standing to sue and their complaint did not adequately plead damages.  The circuit court disagreed, stating that the plaintiffs suffered financial and opportunity-cost losses and injuries which justified money damages and supported standing when they spent money for credit-monitoring, suffered unauthorized withdrawals from their accounts, and squandered valuable time requesting bank refunds for unauthorized debits.

The bookstore argued, and the district court agreed, that the plaintiffs insufficiently pled damages because they did not identify the specific items of loss in their complaint that “would have been required” if the case had been tried in state court.  The court ruled that the plaintiffs’ complaint “cannot be faulted as insufficient,” reiterating the rule that “in federal court … the federal rules . . . determine what must be in a complaint.”  Because Federal Rules of Procedure 8 and 9 only require the complaint to “allege generally that [the] plaintiffs [had] been injured,” the plaintiffs alleged enough information in their complaint to justify money damages and support standing.

Finally, the court dealt with the plaintiffs’ individual state law claims.  First, the circuit court condemned the district court’s construction of the meaning of “injury” in the California civil code.  The district court took the absence of a definition of “injury” in the California civil code “as equivalent to conditioning recovery on satisfaction of the Unfair Competition Law, which states that ‘lost money or property’ supports recovery.”  Although the circuit court found the district court’s assumption problematic because the statutes were distinct, it found that three of the losses that the California plaintiff identified fell squarely within the California judiciary’s understanding of “lost money or property” as “economic injury.”  Because the California courts have determined that economic injury includes significant time and paperwork costs and the time value of money, the circuit court found that even under the district court’s problematic construction, the California plaintiff had justifiable claims for money damages for three of her four claims.

Additionally, the circuit court reasoned that the Illinois plaintiff suffered “actual damage” as dictated by the Illinois Consumer Fraud and Deceptive Business Practices Act when the theft influenced her to renew a credit-monitoring service for $17 per month.  The court wrote that the damage was “real and measurable.” The circuit court disregarded an Illinois appellate court decision which “held that a person who purchases credit-monitoring services after a merchant discloses personal information has not suffered actual damages.”  The court reasoned that it believed the Illinois Supreme Court would disagree with that court’s decision on the definition of “actual damages,” given the “breath of the statutory language” and the common legal understanding of actual damages as “money out of pocket.”  The circuit court wrote that the complaint cannot be dismissed before giving the plaintiffs the chance to show that the data breach caused the monthly payments.

The judgment was vacated and remanded for proceedings consistent with the opinion.

The case is Dieffenbach v. Barnes & Noble, Inc.