Barbarians At The Gate: Seventh Circuit Finds Article III Standing For Data Breach Class Actions

As a result of the Supreme Court's decision in Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, 1147 (2013), data breach class actions were largely considered dead in the water.  The overwhelming majority of courts, relying heavily on Clapper, dismiss data breach actions for the simple reason that until a consumer suffers actual identity theft, she lacks Article III standing to sue.  In other words, without actual identity theft, the risk of future harm—as well as any money spent attempting to protect against potential identity theft—is purely speculative and does not suffice to constitute a legally cognizable injury.

On July 20, 2015, the Seventh Circuit issued its decision in Remijas v. Neiman Marcus Group, LLC, which may have effectively removed the Clapper barrier to data breach suits in the Seventh Circuit.  Remijas stemmed from the 2013 hacking of Neiman Marcus's customer information, exposing roughly 350,000 customer credit cards.  The Court began by reframing