In Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-3700 (7th Cir. 2016), the Seventh Circuit Court of Appeals found that plaintiffs, customers of P.F. Chang’s restaurants, had standing to pursue their claims against P.F. Chang’s, following a data breach of the restaurant’s computer system that compromised customers’ credit card data. The Court overturned the district court’s decision and held that plaintiffs’ allegations were sufficient to satisfy Article III standing requirements. Similar to its ruling in Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015), the Court determined that plaintiffs’ present and future injuries were sufficiently concrete. Specifically, the Court identified plaintiffs’ present injuries in the form of fraudulent charges and the purchase of credit monitoring services, and future injuries in the form of the increased risk of fraudulent charges and identity theft. It was generally believed that the U.S. Supreme Court’s decision in Clapper v. Amnesty Int’l USA, 133 S.Ct. 1138 (2013), would severely limit the ability of data breach plaintiffs to satisfy Article III standing requirements. However, the Seventh Circuit’s recent decisions, such as its decision in Lewert, have identified the factual situation, and necessary injuries, that will allow these cases to proceed.
A full copy of the Court’s opinion can be found here.
