A significant roadblock for plaintiffs in data breach cases in Florida is the threshold issue of Article III standing. Plaintiffs must show an actual or imminent injury. Eleventh Circuit courts do not clearly articulate a rule as to the type of actual harm required to survive a motion to dismiss. Plaintiffs and defendants must therefore navigate the case law to determine the degree of harm that must be alleged in the growing canon of data breach litigation.
Under Article III, Section 2 of the U.S. Constitution, the plaintiff bears the burden of proving standing, which requires a three-part showing: the plaintiff must have suffered an injury-in-fact; the plaintiff’s injury must be fairly traceable to the defendant’s actions; and the relief requested must redress the plaintiff’s injury, see Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–560 (1992).
To establish injury-in-fact, the plaintiff must demonstrate she has “a legally cognizable interest that has been or is imminently at risk of being invaded,” see Mulhall v. UNITE HERE Local 355, 618 F.3d 1279, 1286 (11th Cir. 2010). At the pleading stage, this requirement is satisfied by “general factual allegations of injury resulting from [the defendant’s] conduct.” How much of an injury is required to show an injury-in-fact in a data breach case? Possibly, a mere trifle.
In I Tan Tsao v. Captiva MVP Restaurant Partners, 2018 WL 5717479 (M.D. Fla. Nov. 1, 2018), the court rejected nominal damages as sufficient to establish standing. The plaintiff was a customer in one of the defendant’s restaurants. He filed a data breach action after a cyberattack by a third-party hacker on the restaurant’s computer system.
In his class action complaint, the plaintiff alleged he purchased food at an affected restaurant using two different reward payment credit cards. When he contacted the bank, the cards were cancelled, causing him to lose the opportunity to accrue rewards. The plaintiff sought damages for impending injury flowing from potential fraud and identity theft and the loss of cash-back rewards. For damages, the plaintiff included in his claim the loss of his cash-back reward accrual from the time he cancelled his cards to the time they were reissued. This category of damages could have been a concrete, quantifiable loss. But the court sweepingly dismissed all the allegations as “speculation of future, potential injury at best” and cited the Latin phrase de minimus non curat lex, meaning “the law does not concern itself with trifles.”
Tsao concluded that the plaintiff’s failure to include any factual specificity as to, among other things, the monetary value associated with any purported misuse of the information, compelled a finding that no concrete injury-in-fact occurred. The court dismissed the complaint without prejudice, allowing the plaintiff to amend the complaint to allege, potentially, the lost value of his cash-back rewards.
Case v. Miami Beach Healthcare Group, 166 F.Supp.3d 1315 (S.D. Fla. 2016) also dismissed a data breach claim for lack of standing based on nominal damages. The plaintiff was a patient whose personal data, along with that of 85,000 other patients, was stolen by the health care provider’s employee after she received hospital treatment. As a result of the breach, she claimed she did not receive the entirety of the services for which she paid. In reviewing the plaintiff’s itemized bill and statement of account, the court was not persuaded that the defendants’ charges explicitly or implicitly included the cost of data protection, such that an employee’s access to sensitive information, without more, would necessarily diminish the value of the services that she received. The court also stated that those documents revealed that the plaintiff only paid a de minimis amount of her total bill for healthcare services toward protection of her sensitive information., thus rendering negligible any purported injury she sustained or damages she incurred. The court did not indicate whether the plaintiff could show standing by amending her complaint to allege the value of the portion of her bill attributed to protecting her sensitive information.
While Tsao and Case suggest that nominal damages will not establish standing, Torres v. Wendy’s International, 2017 WL 8780453 (M.D. Fla. Mar. 21, 2017) found “trifling” damages sufficient to establish a concrete injury in data breach cases. In Torres, the plaintiff, after dismissal of his initial complaint for lack of standing, alleged in his amended complaint that due to a data breach at a Wendy’s restaurant, during which hackers stole his payment card data and personal identity information, he was unable to make a timely payment for a utility bill. His delay caused him to incur a $3 late fee. He also alleged that he and six other plaintiffs experienced credit or debit card fraud and were required to use alternative sources of funds to make purchases while awaiting their replacement cards, thereby foregoing credit card reward points and/or cash-back rewards and experiencing actual damages.
The court denied the motion to dismiss the amended complaint because the plaintiff suffered a concrete injury of a $3 late fee as a result of the data breach. The court stated that this $3 loss alone was sufficient to show standing. As an added basis for finding standing, the court pointed to the plaintiffs’ allegations that they lost credit card reward points and cash-back rewards. The court did not, unlike in Tsao, require the plaintiffs to allege the lost value of the cash-back rewards, possibly because the $3 loss had already been pleaded.
Plaintiffs will argue under Torres that injury can be negligible, as little as $3 in damages, a position which Torres noted is supported by the purpose of class actions, which is to provide meaningful redress to plaintiffs with claims too small to justify individual litigation. Defendants will cite Tsao and Case to argue that the injury alleged cannot be de minimus, though no threshold value is spelled out by the courts. These standards bode well for plaintiffs who can allege even the smallest concrete financial injury, but also for defendants who can show no actual loss has occurred.
Nicole Rekant is an attorney and Stevan Pardo is a partner at Pardo Jackson Gainsburg in Miami. The litigators represent clients on a wide range of matters including complex litigation and class actions before federal and state courts.