Is the Injury Real?: The Seventh Circuit Extends Article III Standing to Data Breach Victims

Data breaches are becoming a more frequent and more troubling part of modern life. When customer or employee information is stolen en masse, lawsuits often follow. Courts have frequently dismissed such cases very early for want of Article III standing. For purposes of standing, courts are faced with the question of whether or not the fact of a breach is sufficient for plaintiffs to bring lawsuits against the credit card companies, employers, or stores that, as victims of a cyberattack, have compromised the information of hundreds or thousands. But the real victims are those whose personal information has been stolen. Therefore, the essential question is whether or not their harm is sufficient to allege the injury element of Article III standing. The Seventh Circuit addressed this matter in Remijas v. Neiman Marcus, LLC, in which Neiman Marcus shoppers brought suit against the luxury store following a data breach that compromised the information of 350,000 shoppers, 9,200 of whom suffered fraudulent charges on their credit cards. At the trial level, the United States District Court for the Northern District of Illinois held, inter alia, that the fraudulent charges were not enough to prove injury sufficient to confer standing because the charges were reimbursed, rendering the alleged injury insufficiently “concrete.” The district court also found that the remaining shoppers who did not suffer fraudulent charges also suffered no injury-in-fact. The Seventh Circuit reversed, holding that the District Court had improperly applied the Supreme Court’s holding in Clapper v. Amnesty International USA. The Seventh Circuit held that Clapper did not foreclose the use of future injuries. On the contrary, standing was held to be appropriate where there was a substantial risk of future harm to all plaintiffs whose information was stolen. This Comment first discusses the history of Article III standing, with a focus on data breaches, followed by a discussion of the Seventh Circuit’s decision in Remijas. Finally, this Comment argues that Remijas was correctly decided and was properly distinguished from Clapper