close

For more than four decades, Fenwick & West LLP has helped some of the world’s most recognized companies become, and remain, market leaders. From emerging enterprises to large public corporations, our clients are leaders in the technology, life sciences and cleantech sectors and are fundamentally changing the world through rapid innovation.  MORE >

Fenwick & West was founded in 1972 in the heart of Silicon Valley—before “Silicon Valley” existed—by four visionary lawyers who left a top-tier New York law firm to pursue their shared belief that technology would revolutionize the business world and to pioneer the legal work for those technological innovations. In order to be most effective, they decided they needed to move to a location close to primary research and technology development. These four attorneys opened their first office in downtown Palo Alto, and Fenwick became one of the first technology law firms in the world.  MORE >

From our founding in 1972, Fenwick has been committed to promoting diversity and inclusion both within our firm and throughout the legal profession. For almost four decades, the firm has actively promoted an open and inclusive work environment and committed significant resources towards improving our diversity efforts at every level.  MORE >

FLEX by Fenwick is the only service created by an AmLaw 100 firm that provides flexible and cost-effective solutions for interim in-house legal needs to high-growth companies.  MORE >

Fenwick & West handles significant cross-border legal and business issues for a wide range of technology and life sciences who operate internationally..  MORE >

At Fenwick, we are proud of our commitment to the community and to our culture of making a difference in the lives of individuals and organizations in the communities where we live and work. We recognize that providing legal services is not only an essential part of our professional responsibility, but also an excellent opportunity for our attorneys to gain valuable practical experience, learn new areas of the law and contribute to the community.  MORE >

Year after year, Fenwick & West is honored for excellence in the legal profession. Many of our attorneys are recognized as leaders in their respective fields, and our Corporate, Tax, Litigation and Intellectual Property Practice Groups consistently receive top national and international rankings, including:

  • Named Technology Group of the Year by Law360
  • Ranked #1 in the Americas for number of technology deals in 2015 by Mergermarket
  • Nearly 20 percent of Fenwick partners are ranked by Chambers
  • Consistently ranked among the top 10 law firms in the U.S. for diversity
  • Recognized as having top mentoring and pro bono programs by Euromoney

MORE >

We take sustainability very seriously at Fenwick. Like many of our clients, we are adopting policies that reduce consumption and waste, and improve efficiency. By using technologies developed by a number of our cleantech clients, we are at the forefront of implementing sustainable policies and practices that minimize environmental impact. In fact, Fenwick has earned recognition in several areas as one of the top US law firms for implementing sustainable business practices.  MORE >

At Fenwick, we have a passion for excellence and innovation that mirrors our client base. Our firm is making revolutionary changes to the practice of law through substantial investments in proprietary technology tools and processes—allowing us to deliver best-in-class legal services more effectively.   MORE >

Mountain View Office
Silicon Valley Center
801 California Street
Mountain View, CA 94041
650.988.8500

San Francisco Office
555 California Street
12th Floor
San Francisco, CA 94104
415.875.2300

Seattle Office
1191 Second Avenue
10th Floor
Seattle, WA 98101
206.389.4510

New York Office
1211 Avenue of the Americas
32nd Floor
New York, NY 10036
212.921.2001

Shanghai Office
Unit 908, 9/F, Kerry Parkside Office
No. 1155 Fang Dian Road
Pudong New Area, Shanghai 201204
P.R. China
+86 21 8017 1200


Litigation Alert: Second Circuit Limits Standing to Bring Data Breach Class Actions

This week, the U.S. Court of Appeals for the Second Circuit issued an important decision in Whalen v. Michaels Stores, placing the court at the center of the controversy around what allegations are sufficient to establish Article III standing in data breach class actions. In Whalen, the plaintiff alleged that payment card information stolen in a data breach was used in unsuccessful, attempted fraudulent transactions. The payment card owner further alleged that she faced an increased risk of future identity fraud, forcing her to spend time and money resolving the attempted fraudulent charges and monitoring her credit. The court ruled that these allegations did not establish a concrete injury sufficient to confer Article III standing.

Background

Michaels Store, Inc. (“Michaels”) is an arts and craft retail chain. On January 25, 2014, Michaels notified its customers in press release of “possible fraudulent activity on some U.S. payment cards.” The company announced that it was investigating the incident and advised customers to monitor their credit accounts for unauthorized charges. On April 17, 2014, Michaels confirmed the existence of a data breach in another press release. The company reported that hackers had used a “highly sophisticated malware” to retrieve payment card information from the computer systems of Michaels and its subsidiary, Aaron Brothers.  However, Michaels also reported that there was no evidence that the hackers had obtained any other customer information, such as names, addresses, or PIN numbers. Michaels estimated that approximately 2.6 million payment cards may have been affected for the period between May 8, 2013 and January 27, 2014. As a result, the company offered free identity protection and credit monitoring services for twelve months to affected customers.

Mary Jane Whalen made purchases with her credit card at a Michaels store on December 21, 2013. On January 14 and 15, 2014, Whalen’s credit card information was used unsuccessfully in two attempted fraudulent transactions in Ecuador. On January 15, 2014, Whalen cancelled her credit card. No other fraudulent transactions were either incurred or attempted on Whalen’s credit card.

On December 2, 2014, Whalen filed a putative class action against Michaels, alleging claims for breach of implied contract and violation of New York General Business Law § 349. On December 28, 2015, the district court dismissed the complaint, finding that Whalen lacked standing because she “neither alleged that she incurred any actual charges on her credit card, nor, with any specificity, that she had spent time and money monitoring her credit.” Whalen v. Michaels Stores, Inc., No. 16-260 (L); 16-335 (XAP), Summary Order, at 3 (2d Cir. May 3, 2017).

Second Circuit Decision 

The Second Circuit affirmed the district court’s dismissal, concluding that Whalen “alleged no injury that would satisfy the constitutional standing requirements of Article III.”  Whalen, at 4. Citing Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147-48, 1151 (2013), the Second Circuit explained that a plaintiff must allege an injury that is “concrete, particularized, and actual or imminent’ and that a “threatened injury must be certainly impending,” rather than simply speculative. Id. at 3-4. The Second Circuit further elaborated that, under Clapper, a “theory of standing[] which relies on a highly attenuated chain of possibilities[] does not satisfy the requirement threatened injury must be certainly impending.” Id. at 5 (citation omitted).

Turning to Whalen’s factual allegations, the Second Circuit rejected the three theories of injury that Whalen had raised. Whalen had alleged that (1) her credit card information was stolen and used in two attempted fraudulent transactions; (2) she faced a risk of future identity theft; and (3) she had lost time and money resolving the attempted the fraudulent charges and monitoring her credit. The Second Circuit found that “Whalen does not allege a particularized and concrete injury suffered from the attempted fraudulent purchases… she never was either asked to pay, nor did pay, any fraudulent charge. And she does not allege how she can plausibly face a threat of future fraud, because her stolen credit card was promptly canceled after the breach and no other personally identifying information—such as her birth date or Social Security number—is alleged to have been stolen.” Id. at 4. The Second Circuit also found that “Whalen pleaded no specifics about any time or effort that she herself ha[d] spent monitoring her credit,” instead relying on the general allegation that the putative class had suffered damages based on “the opportunity cost and value of time” they had been forced to expend to monitor their financial accounts. Id.

Takeaways

Whalen puts the Second Circuit in the middle of a Circuit split concerning what allegations are sufficient to establish Article III standing in data breach class actions. On one end of the spectrum, the Sixth Circuit in Galaria and the Seventh Circuit in Neiman Marcus and P.F. Chang’s have held that plaintiffs can plead a concrete injury that will satisfy Article III by alleging that their personal information was stolen, they face an increased risk of future harm and they have incurred mitigation costs in response to that risk. The Sixth and Seventh Circuits have also held an offer by a company to provide free identity fraud protection and credit monitoring following a data breach can be inferred to establish that the company recognizes that the risk of future harm from the breach is substantial.

On the opposite end of the spectrum, the Second Circuit in Whalen and the Fourth Circuit in Beck have heightened pleading requirements for standing in data breach cases. Plaintiffs in the Second and Fourth Circuits cannot rely on general allegations of increased risk of identity theft from stolen personal information coupled with mitigation costs to establish a concrete injury. Nor can they rely on an offer of free credit monitoring by a company to supplement those otherwise deficient factual allegations. Instead, these plaintiffs must allege actual injuries, such as successful fraud charges based on stolen personal information that creates liability on the part of the payment card owner, to survive a motion to dismiss for lack of standing. This Circuit split is not likely to be resolved if and until the Supreme Court weighs in on the issue.   ​​​​