Financial Institutions State Negligence Claim Against Restaurant For Data Breach

Nathan A Adams IV is a Partner in Holland & Knight's Tallahassee office

In In Re Arby's Restaurant Gp. Inc. Litigation, No. 1:17-cv-0514-AT, 2018 WL 2128441 (N.D. Ga. March 5, 2018), the district court refused to dismiss several counts filed by financial institutions and a group of consumers after the defendant disclosed that third-party hackers had breached its credit card point of sale machines and retrieved the personal information of hundreds of thousands of consumers. The defendant argued that it owed no common law duty to the plaintiffs to protect their personal credit card data, but the court ruled that a company's knowledge of a foreseeable risk to its data security system is sufficient to establish the existence of a plausible legal duty as a basis for negligence. For negligence per se, the court agreed with the plaintiffs that it could be premised upon an alleged violation of Section 5 of the Federal Trade Commission Act. The court concluded that