During questioning by the 7th Circuit Court of Appeals, a panel of justices indicated that plaintiffs suing restaurant chain P.F. Chang’s over a data breach may, despite a district court ruling to the contrary, have standing to bring their case. The dispute stems from an incident that occurred at P.F. Chang’s in the summer of 2014. During that time, P.F. Chang’s announced that an intruder may have stolen card numbers, names and expiration dates for consumer credit and debit cards used by the restaurant chain’s customers over an eight-month period. In total, P.F. Chang’s said it believed 33 of its locations were impacted.
While the two plaintiffs in the case ate at P.F. Chang’s prior to the restaurant chain’s announcement of the data breach, neither one ate at one of the 33 affected locations. Despite this fact, each plaintiff filed a separate putative class action against P.F. Chang’s seeking damages for time and money spent monitoring their accounts and canceling payment cards after the data breach was announced. At the district court level, the district court judge dismissed the plaintiffs’ claims, finding that the plaintiffs lacked standing because they failed to allege injury. The district court further found that the mere risk of future injury to the plaintiffs, stemming from the possibility that their identities could be stolen after the breach, did not constitute an actual injury.
While it is unclear how the 7th Circuit Court of Appeals ultimately will rule on the plaintiffs’ appeal, the panel of justices indicated that the plaintiffs may, based on an earlier decision of the court, have standing if the plaintiffs can show their data were actually breached. Moreover, the court indicated that had the case moved to the discovery stage, proof of this actual breach may have been uncovered, despite the fact neither plaintiff ate at an affected restaurant, because of the interconnectivity of the restaurant chain’s computers worldwide.
If the 7th Circuit reverses the district court’s decision, it could open the door for wider class action litigation against P.F. Chang’s and other retailers that experience limited data breaches only affecting a limited number of locations or a subset of its card processing database.