From Casetext: Smarter Legal Research

Whalen v. Michaels Stores, Inc.

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT
May 2, 2017
No. 16-260 (L) (2d Cir. May. 2, 2017)

Summary

finding that the plaintiff suffered no particularized and concrete injury from fraudulent credit card purchases where the plaintiff did not pay, any fraudulent charge incurred

Summary of this case from Pena v. British Airways, PLC (UK)

Opinion

No. 16-260 (L) No. 16-352 (XAP)

05-02-2017

MARY JANE WHALEN, Plaintiff-Appellant-Cross-Appellee, v. MICHAELS STORES, INC., Defendant-Appellee-Cross-Appellant.

FOR APPELLANT: JOSEPH SIPRUT (Gregory W. Jones, on the brief), Siprut PC, Chicago, IL. Brian Philip Murray, Gregory B. Linkh, Glancy Prongay & Murray LLP, New York, NY. Katrina Carroll, Kyle A. Shamberg, Lite Depalma Greenberg LLC, Chicago, IL. Robert Ahdoot, Tina Wolfson, Bradley King, Ahdoot & Wolfson, PC, West Hollywood, CA. Dan Edelman, Edelman, Coombs, Latturner & Goodwin, LLC, Chicago, IL. FOR APPELLEE: EAMON P. JOYCE (James D. Arden, on the brief), Sidley Austin LLP, New York, NY. Edward R. McNicholas, Joshua J. Fougere, Sidley Austin LLP, Washington, DC.


SUMMARY ORDER RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007 IS PERMITTED AND IS GOVERNED BY FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT'S LOCAL RULE 32.1.1. WHEN CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION "SUMMARY ORDER"). A PARTY CITING TO A SUMMARY ORDER MUST SERVE A COPY OF IT ON ANY PARTY NOT REPRESENTED BY COUNSEL.

At a stated term of the United States Court of Appeals for the Second Circuit, held at the Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the 2nd day of May, two thousand seventeen. PRESENT: GUIDO CALABRESI, SUSAN L. CARNEY, Circuit Judges, CAROL BAGLEY AMON, District Judge. FOR APPELLANT: JOSEPH SIPRUT (Gregory W. Jones, on the brief), Siprut PC, Chicago, IL. Brian Philip Murray, Gregory B. Linkh, Glancy Prongay & Murray LLP, New York, NY. Katrina Carroll, Kyle A. Shamberg, Lite Depalma Greenberg LLC, Chicago, IL. Robert Ahdoot, Tina Wolfson, Bradley King, Ahdoot & Wolfson, PC, West Hollywood, CA. Dan Edelman, Edelman, Coombs, Latturner & Goodwin, LLC, Chicago, IL. FOR APPELLEE: EAMON P. JOYCE (James D. Arden, on the brief), Sidley Austin LLP, New York, NY. Edward R. McNicholas, Joshua J. Fougere, Sidley Austin LLP, Washington, DC.

Judge Carol Bagley Amon, of the United States District Court for the Eastern District of New York, sitting by designation.

Appeal from a judgment of the United States District Court for the Eastern District of New York (Seybert, J.).

UPON DUE CONSIDERATION, IT IS HEREBY ORDERED, ADJUDGED, AND DECREED that the January 8, 2016 judgment of the District Court is AFFIRMED.

Plaintiff-appellant Mary Jane Whalen appeals the District Court's dismissal of her complaint against defendant-appellee Michaels Stores, Inc. ("Michaels"), asserting claims for breach of an implied contract and for violation of New York General Business Law § 349. The District Court dismissed Whalen's claims for lack of standing, concluding that Whalen had failed to allege a cognizable injury from the exposure of her credit card information following a data breach at one of Michaels' stores. We assume the parties' familiarity with the underlying facts and the procedural history of the case, to which we refer only as necessary to explain our decision to affirm.

Whalen made purchases via credit card at a Michaels store on December 31, 2013. Her complaint alleges that

on January 14, 2014, Whalen's credit card was physically presented for payment to a gym in Ecuador for a charge of $398.16. On January 15, 2014, Whalen's credit card was also physically presented for payment to a concert ticket company in Ecuador for a charge of $1,320.00.
App'x 11. She canceled her card on January 15, 2014. She does not allege that any fraudulent charges were actually incurred on the card, or that, before the cancellation, she was in any way liable on account of these presentations.

On January 25, 2014, Michaels issued a press release saying that there had been a possible data breach of its system, apparently involving theft of customers' credit card and debit card data. The company announced that it was investigating the breach, and advised customers to monitor their credit accounts and be vigilant about unauthorized charges. On April 17, 2014, in another press release, Michaels confirmed the existence and scope of the data breach. The press release noted that "[t]he affected systems contained certain payment card information, such as payment card number and expiration date . . . . There is no evidence that other customer personal information, such as name, address or PIN, was at risk in connection with this issue." Sp. App'x 6. The company extended an offer of twelve months of identity protection and credit monitoring services to affected customers.

The District Court held that these allegations in the complaint did not suffice to establish Article III standing for Whalen to pursue her claims, because Whalen neither alleged that she incurred any actual charges on her credit card, nor, with any specificity, that she had spent time or money monitoring her credit. We agree.

We review de novo the grant of a motion to dismiss for lack of standing. See Carter v. HealthPort Tech., LLC, 822 F.3d 47, 56 (2d Cir. 2016). The general Article III standing requirements are familiar: a plaintiff must allege an injury that is "concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling." Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, 1147 (2013) (internal quotation marks omitted); see Upstate Citizens for Equality, Inc. v. United States, 841 F.3d 556, 565 (2d Cir. 2016). In Clapper, the Court emphasized that, to establish Article III standing, a future injury must be "certainly impending," rather than simply speculative. It explained that a "theory of standing[] which relies on a highly attenuated chain of possibilities[] does not satisfy the requirement that threatened injury must be certainly impending." 133 S. Ct. at 1148.

Whalen asserts, inter alia, the following theories of injury: (1) her credit card information was stolen and used twice in attempted fraudulent purchases; (2) she faces a risk of future identity fraud; and (3) she has lost time and money resolving the attempted fraudulent charges and monitoring her credit. Whalen does not allege a particularized and concrete injury suffered from the attempted fraudulent purchases, however; she never was either asked to pay, nor did pay, any fraudulent charge. And she does not allege how she can plausibly face a threat of future fraud, because her stolen credit card was promptly canceled after the breach and no other personally identifying information—such as her birth date or Social Security number—is alleged to have been stolen. Cf. Galaria v. Nationwide Mut. Ins. Co., 663 F. App'x 384, 386 (6th Cir. 2016) (holding that plaintiffs had standing to bring data breach claims when the breached database contained personal information such as "names, dates of birth, marital statuses, genders, occupations, employers, Social Security numbers, and driver's license numbers"). Finally, Whalen pleaded no specifics about any time or effort that she herself has spent monitoring her credit. Her complaint alleges only that "consumers must expend considerable time" on credit monitoring, and that she "and the Class suffered additional damages based on the opportunity cost and value of time that [she] and the Class have been forced to expend to monitor their financial and bank accounts." App'x 22-23. She did not seek leave to amend her complaint to add anything more substantial. Accordingly, she has alleged no injury that would satisfy the constitutional standing requirements of Article III, and her claims were properly dismissed.

These shortcomings in Whalen's complaint distinguish her case from two Seventh Circuit cases, both involving vendor data breaches, upon which she heavily relies, Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016). --------

* * *

We have considered Whalen's remaining arguments and find them to be without merit. Accordingly, we AFFIRM the judgment of the District Court.

FOR THE COURT:

Catherine O'Hagan Wolfe, Clerk of Court


Summaries of

Whalen v. Michaels Stores, Inc.

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT
May 2, 2017
No. 16-260 (L) (2d Cir. May. 2, 2017)

finding that the plaintiff suffered no particularized and concrete injury from fraudulent credit card purchases where the plaintiff did not pay, any fraudulent charge incurred

Summary of this case from Pena v. British Airways, PLC (UK)

finding that standing requires a future injury be certainly impending rather than simply speculative, and that because the plaintiff's personal identification information--date of birth or Social Security number--was not stolen and the plaintiff had not expended any time or effort monitoring her credit, there was no injury or threat of future injury

Summary of this case from State ex rel. W.Va. Univ. Hosps. - E. v. Hammer

finding that standing requires a future injury be certainly impending rather than simply speculative, and that because the plaintiff's personal identification information--date of birth or Social Security number--was not stolen and the plaintiff had not expended any time or effort monitoring her credit, there was no injury or threat of future injury

Summary of this case from Statee., Inc. v. Hammer ex rel. Situated

concluding a customer who had her card information stolen had not suffered an injury in fact because she changed her card information so there was no threat of future harm

Summary of this case from Stapleton v. Tampa Bay Surgery Ctr., Inc.

affirming dismissal for lack of standing where plaintiff's personal credit card information was stolen in a security breach finding that plaintiff alleged no injury that would satisfy the constitutional standing requirements

Summary of this case from Gilot v. Equivity

In Whalen, Michaels Stores publicly announced a breach of card data, and Whalen filed suit alleging that her card—which was used at Michaels during the breach period—had been "physically presented for payment" at two locations in Ecuador, though no charges were actually incurred.

Summary of this case from I Tan Tsao v. Captiva MVP Rest. Partners, LLC

In Whalen v. Michaels Stores, Inc., 689 Fed.Appx. 89 (2d Cir. 2017) (summary order), the Second Circuit concluded that a plaintiff lacked standing where her credit card number was stolen as part of a data breach, but she promptly canceled her card “and no other personally identifying information - such as her birth date or Social Security number - is alleged to have been stolen, ” id. at 90.

Summary of this case from Cooper v. Bonobos, Inc.

In Whalen v. Michaels Stores, Inc., 689 F. App'x 89, 90 (2d Cir. 2017), the Second Circuit rejected the idea that the "risk of future identity fraud," standing alone, is sufficient to confer standing in these circumstances.

Summary of this case from Cohen v. Experian Info. Sols.

In Whalen, the Second Circuit concluded that the complaint failed to allege standing because the plaintiff never paid a fraudulent charge, nor did she face a plausible threat of future harm. Her "stolen credit card was promptly canceled after the breach and no other personally identifying information—such as her birth date or Social Security number—is alleged to have been stolen."

Summary of this case from Sackin v. Transperfect Global, Inc.

In Whalen, the Supreme Court considered a challenge to a New York statute that required physicians and pharmacists to report prescription information for certain narcotics to the state health department, which would maintain the information in a centralized computer file.

Summary of this case from In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig.
Case details for

Whalen v. Michaels Stores, Inc.

Case Details

Full title:MARY JANE WHALEN, Plaintiff-Appellant-Cross-Appellee, v. MICHAELS STORES…

Court:UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT

Date published: May 2, 2017

Citations

No. 16-260 (L) (2d Cir. May. 2, 2017)

Citing Cases

Rudolph v. Hudson's Bay Co.

Courts, including the Second Circuit, have looked to the facts surrounding a data breach when deciding…

I Tan Tsao v. Captiva MVP Rest. Partners, LLC

See Beck v. McDonald , 848 F.3d 262, 273–76 (4th Cir.), cert. denied sub nom. Beck v. Shulkin , ––– U.S.…