On January 20, 2017, the Third Circuit reversed the dismissal of a putative class action filed against Horizon Healthcare Services, Inc. (“Horizon”).  The suit was brought after two laptops containing personally identifiable information were stolen in 2013 from Horizon’s Newark offices.  The four named Plaintiffs filed suit on behalf of themselves and 839,000 other Horizon customers whose unencrypted personal information was stored on those laptops.  Plaintiffs alleged willful and negligent violations of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681, et seq., claiming that Horizon inadequately protected their personal information.

The District Court dismissed the suit under Fed. R. Civ. P. 12(b)(1) for lack of Article III standing.  According to the lower Court, none of the Plaintiffs had claimed a cognizable injury because, although their personal information had been stolen, none of them had adequately alleged that the information was actually used to their detriment.

According to the Third Circuit, in light of the congressional decision to create a remedy for the unauthorized transfer of personal information, an alleged violation of FCRA gives rise to an injury sufficient for Article III standing purposes.  And, even without evidence that the Plaintiffs’ information was in fact used improperly, the alleged disclosure of their personal information created a de facto injury. Accordingly, the Court ruled that all of the Plaintiffs suffered a cognizable injury, and the Complaint should not have been dismissed under Fed. R. Civ. P. 12(b)(1).  The fact that Horizon offered credit monitoring and identity theft protection services to those affected was not of any import to the majority or concurring opinion.

Reviewing the matter de novo, the Third Circuit first recognized that FCRA was enacted in 1970 “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.” In Re: Horizon Healthcare Services Inc. Data Breach Litigation, No. 15-2309, Slip Op. at 8 (3d Cir. January 20, 2017) (citing Safeco Ins. Co. of Am. v. Burr, 551 U.S. 47, 52 (2007)). With respect to consumer privacy, the statute imposes certain requirements on any “consumer reporting agency” that “regularly … assembl[es] or evaluat[es] consumer credit information . . . for the purpose of furnishing consumer reports to third parties.” 15 U.S.C. § 1681a(f).  Id.  And, any such agency that either willfully or negligently “fails to comply with any requirement imposed under [FCRA] with respect to any consumer is liable to that consumer.” Id.  (citing 15 U.S.C. §§ 1681n(a) (willful violations); 1681o(a) (negligent violations)).  See also Id. at 27 (“But with the passage of FCRA, Congress established that the unauthorized dissemination of personal information by a credit reporting agency causes an injury in and of itself – whether or not the disclosure of that information increased the risk of identity theft or some other future harm.”); Id. at 29, n. 20 (“Congress has elevated the unauthorized disclosure of information into a tort. And so there is nothing speculative about the harm that Plaintiffs allege.”).

Horizon did not challenge the validity of any of the Plaintiffs’ factual claims as part of its standing motion – arguing instead that that the allegations of the Complaint, even accepted as true, are insufficient to establish the Plaintiffs’ Article III standing.  Id. at 13.  This is significant given that the Third Circuit was only hearing the standing issue and not the substantive motion to dismiss.  See Id. at 13, n. 9 (“In its 12(b)(6) motion, which is not before us, Horizon questions whether it is bound by FCRA. In particular, Horizon suggests that it is not a “consumer reporting agency” and therefore is not subject to the requirements of FCRA. . . . Because we are faced solely with an attack on standing, we do not pass judgment on the merits of those questions. Our decision should not be read as expanding a claimant’s rights under FCRA. Rather, we assume for purposes of this appeal that FCRA was violated, as alleged, and analyze standing with that assumption in mind. Likewise, our decision regarding Article III standing does not resolve whether Plaintiffs have suffered compensable damages.”) (emphasis added).

It was this alleged substantive FCRA violation – which again was assumed to exist for purposes of its standing ruling, that ultimately caused the Third Circuit to find in favor of plaintiffs.     See Id. at 22, n. 16 (“Again, whether that injury is actionable under FCRA is a different question, one which we are presently assuming (without deciding) has an affirmative answer. See supra note 9.”); Id. at 28 – 29 (“So the Plaintiffs here do not allege a mere technical or procedural violation of FCRA. They allege instead the unauthorized dissemination of their own private information – the very injury that FCRA is intended to prevent.”) (footnotes omitted).

In reviewing the allegations found in the Complaint, the Third Circuit reasoned that the “trifle of injury” necessary to determine standing was met by virtue of the alleged FCRA violation.  Id. at 15.  Moreover, it found that its prior recent cases of In re Google Inc. Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015) and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016) reconciled with such a result.  Id. at 22 (“In light of those two rulings, our path forward in this case is plain. The Plaintiffs here have at least as strong a basis for claiming that they were injured as the plaintiffs had in Google and Nickelodeon.”).

In a strong nod to what it perceived to be the stare decisis injury-in-fact precedents rendered prior to the Supreme Court’s decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), the Third Circuit reconciled that decision with the following:  “Although it is possible to read the Supreme Court’s decision in Spokeo as creating a requirement that a plaintiff show a statutory violation has caused a “material risk of harm” before he can bring suit, id. at 1550, we do not believe that the Court so intended to change the traditional standard for the establishment of standing.”  Id. at 24.  See also Id. at 25 (“Spokeo itself does not state that it is redefining the injury-in-fact requirement. Instead, it reemphasizes that Congress “has the power to define injuries,” 136 S. Ct. at 1549 (citation and internal quotation marks omitted), “that were previously inadequate in law.” Id.”).

In Re: Horizon Healthcare Services Inc. Data Breach Litigation is an important decision for numerous reasons – not the least of which is the fact the Third Circuit is one of the most influential circuit courts in the country.  First, notwithstanding the fact Defendant is a health insurer, in their Complaint, the Plaintiffs successfully asserted for standing purposes Horizon is also a consumer reporting agency.  This is significant given that the very first count of Plaintiffs’ Complaint claims that Horizon committed a willful violation of FCRA.  And, FCRA permits statutory damages for willful violations. See 15 U.S.C. § 1681n(a) (“Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of … any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000. . . .”).

In other words, counsel recognized that statutory damages are a necessary predicate to successfully pursuing a class action based on a data breach claim and that merely alleging that a company is a consumer reporting agency will now be sufficient to get in the courthouse.   Even though retail breaches may be too difficult a stretch, there is nothing stopping class counsel from branching out from health insurers.   In the future, defense counsel may be forced to simply forego the previously successful standing motions and go straight to a Fed. R. Civ. P. 12(b)(6) substantive motion.   And, given that such motions are quite difficult to win, the end result may be many more “cost of suit” settlements ranging significantly upward.

This decision may ultimately end up being more noteworthy for the concurring opinion of Judge Shwartz.   According to Judge Shwartz, there was no reason to even rely on FCRA to reverse the lower court’s decision.  According to Judge Shwartz, the mere “loss of privacy” was sufficient to demonstrate injury in fact.  See Id. at 1, n. 4 (Shwartz, J., concurring) (“Plaintiffs allege that the theft of the laptops caused a loss of privacy, which is itself an injury in fact.”).    Moreover, the lack of encryption was deemed the efficient cause of this loss.  Id. at 5, n. 4 (Shwartz, J., concurring) (“I also conclude that Plaintiffs have sufficiently alleged that the injury was traceable, in part, to the failure to encrypt the data, and am satisfied that if proven, the injury could be redressable.”).

Judge Shwartz was not persuaded that there was sufficient reconciliation with prior cases or that there was even the need to have such reconciliation based on her view of the law.  Id. at 5, n. 3  (Shwartz, J., concurring) (“My colleagues view In re Google Cookie Placement Consumer Privacy Litigation, 806 F.3d 125 (3d Cir. 2015), and In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262 (3d Cir. 2016), as providing a basis for Plaintiffs to assert that a violation of the FCRA, without any resulting harm, satisfies the injury-in-fact requirement.  I do not rely on the possible existence of a statutory violation as the basis for standing, and am not persuaded that these cases support that particular point.”).   As a result, Judge Shwartz’ concurring opinion will likely be heavily cited by plaintiffs in data breach cases involving unencrypted data whether or not there are any possible FCRA violations.

All in all, January 20, 2017 was a very good day for class counsel pursuing data breach litigation.

On October 20, 2016, Judge William J. Martini of the District of New Jersey ruled, in Kamal v. J.Crew, that actual evidence of fraudulent credit card use was necessary before a customer could properly assert Article III standing in a suit brought under Section 113(g) of the Fair and Accurate Credit Transactions Act of 2003 (“FACTA”). Given FACTA allows statutory damages of up to $1,000 in a private cause of action based on a willful violation, FACTA has been a very popular statute for class actual counsel. For example, in 2015, LabCorp agreed to fund an $11 million settlement – nearly $200 to each class member to settle FACTA charges, which included a nationwide class of plaintiffs comprising 665,000 consumers.

Relying on the May 2016 Supreme Court ruling in Spokeo v. Robins, Judge Martini dismissed a previously-stayed FACTA class action against J.Crew. Judge Martini ruled J.Crew’s printing of ten digits of a customers’ account does not meet or create a claim meeting Article III’s concreteness requirement.

Although FACTA precludes a retailer from printing more than five digits of a credit card number on a sales receipt, Judge Martini found that printing 10 digits instead of five did not raise the risk of fraud sufficiently to create a concrete injury for “case” or “controversy” standing purposes. According to the Court, without the risk of concrete harm, the court lacks subject matter jurisdiction and has no choice but to dismiss the case given Article III of the Constitution did not allow him to hear the case.

In dismissing, the Court essentially ruled that the mere exposure of more numerals of a credit card number did not compromise plaintiff’s security sufficiently to demonstrate actual harm.  Of most significance, the Court ruled: “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right.” Kamal v. J.Crew at 5 – 6.  See also Kamal v. J.Crew at 3 (“Spokeo did not disturb this circuit’s standing jurisprudence. See In re Nickelodeon Consumer Privacy Litigation, 827 F.3d 262, 273 (3d Cir. 2016).”).

Other courts interpreting Spokeo have been more tenuous. For example, in Carr v. Parking Solutions, the District Court ruled: “The Supreme Court did not offer a conclusive ruling, and instead remanded Spokeo to the Ninth Circuit for further consideration of Article III’s injury-in-fact requirements.” See also Spokeo, 136 S. Ct. at 1553 (Thomas, J., concurring) (“Congress can create new private rights and authorize private plaintiffs to sue based simply on the violation of those private rights. A plaintiff seeking to vindicate a statutorily created private right need not allege actual harm beyond the invasion of that private right.”).

No one can predict whether or not Judge Martini’s ruling will stand the test of time.  What is clear, however, is that his ruling has significance with future privacy actions beyond FACTA.  As previously pointed out, FACTA could have been an important stepping stone for privacy class counsel seeking to monetize a data breach.   As it currently stands in the Third Circuit, however, statutory damages would not even be enough to get the job done for class counsel.

Earlier this year, the California Supreme Court ruled on the outer reach of a state statute meant to protect consumers during credit card transactions – the Song-Beverly Credit Card Act of 1971.  See Pineda v. Williams-Sonoma Stores, Inc., 51 Cal. 4th 524 (2011).  Specifically, Song-Beverly precludes retailers from requesting and recording a customer’s “personal identification information” during a credit card transaction and the Pineda court reasoned that such information now includes ZIP code information.  The decision was largely driven by the fact current marketing firms can use a ZIP code to tap into vast stores of personal data about a consumer.  Although the law may have only applied to retail stores in California, the decision immediately gave rise to an avalanche of class action suits given class action counsels’ new-found access to statutory damages.

In fact, given this new extension of the law, California legislators quickly amended Song-Beverly to exclude from its reach retail motor fuel sales and state law obligations.  This proposed law passed both the Senate and Assembly, was presented to the Governor on September 22, 2011 and will likely soon be signed into law.   What this proposed law does not do is expressly reverse Pineda or turn the tide against class actions brought against retailers.

It appears, however, courts on their own have found ways to curtail further extensions of Song-Beverly.  In an August 2011 Order, a California trial court sustained an online service provider’s demurrer to a class action complaint under Song-Beverly.  The action involved the purchase of an online advertisement.  The Order simply states that the law “on its face does not apply to online transactions,” and “the applicable case law, legislative intent and public policy indicate that such transactions are not, and should not be, encompassed” by Song-Beverly.

Other jurisdictions have been reluctant to create Pineda-like precedent.  In an unpublished opinion filed on September 26, 2011, a New Jersey District Court Judge decided that New Jersey’s Truth-in-Consumer Contract, Warranty and Notice Act (TCCWNA) – which provides for a civil penalty of not less than $100 per violation – was not triggered when plaintiff provided her ZIP code during a retail credit card transaction.  The statute requires that the provisions of a specific consumer contract violate a state or federal law.  In dismissing the Complaint, the District Judge found that a credit card transaction did not implicate a specific consumer contract given the card number and ZIP code at issue were merely a series of numbers and not part of a specific consumer contract.  Given that New Jersey’s version of Song-Beverly (Restrictions on Information Required to Complete Credit Card Transactions, N.J.S.A. § 56:11-17) does not provide for a private right of action, plaintiff did not claim standing under that law.  With no small sense of irony, the case was dismissed against the same defendant as in Pineda.

A bench opinion recently entered by a New Jersey state judge came to the exact opposite conclusion.  In that ruling from the bench, the court found that a violation of N.J.S.A. § 56:11-17 was a sufficient predicate for a violation of the Truth-in-Consumer Contract, Warranty and Notice Act – which, in turn, allowed access to the statutory damages so eagerly sought by class action plaintiffs.  Given that it was only a bench opinion, the decision has no precedential weight.  In other words, it’s a decision that now means nothing to other retailers in New Jersey.  On the other hand, it only takes a chip here and there to sometimes break a levy – or the willing hand of an appellate court.  Stay tuned.

Update:  October 1, 2011
After reading a transcript of the oral argument and opinion, it appears the state court judge ultimately gave too much deference to NJ’s motion to dismiss standard.   Although the court concluded by saying he was “making no comment about the merits of the case”, he ultimately found that a common law privacy claim exists when a retailer obtains a customer’s ZIP code during a credit card transaction.  Moreover, he reasoned that a claim under TCCWNA could also exist given ZIP code information was was part of the writings required to complete the consumer transaction.  Accordingly, there was enough of a consumer contract to trigger the statute.

Update:  January 6, 2012
Although it ultimately dismisses an action against Michael’s Stores, Inc. given there is no cognizable common law injury and the applicable law does not provide for statutory damages, a Massachusetts federal court  rules that ZIP code information is “personal identification information”.