Anderson v. Hannaford Bros. Co.
2011 U.S. App. LEXIS 21239
| 1st Cir. | 2011Background
- Hannaford suffered a data breach affecting up to 4.2 million card numbers (Dec 7, 2007–Mar 10, 2008).
- Hannaford announced the breach publicly on Mar 17, 2008; banks varied in issuing replacements and monitoring activity.
- Plaintiffs (consolidated class) alleged seven claims including breach of implied contract, implied warranty, fiduciary duty, negligence, and UTPA, seeking damages and credit monitoring.
- District court dismissed several claims under Maine law; allowed negligence, implied contract, and UTPA to proceed for certain damages.
- District court certified Maine-law questions about cognizable injury and mitigation costs; Maine Law Court answered time-and-effort alone are not cognizable injuries.
- Court of appeals affirmed in part and reversed in part, allowing recovery for certain mitigation damages (card replacement costs and identity theft insurance) under negligence and implied contract, and affirmed dismissal of other claims.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Fiduciary duty recognized under Maine law | Hannaford had confidential trust with customers | No confidential relationship existed | No fiduciary duty found |
| Implied contract to safeguard card data | Implied term to protect data exists | No implied term necessary to effectuate contract | Implied contract claim viable for data protection duty |
| Private Maine UTPA action—substantial injury requirement | Private action should cover data-breach harms | Private action narrowly construed; requires substantial injury | Limited private UTPA damages concept; threshold substantial injury required |
| Mitigation damages for card replacement and credit monitoring | Mitigation costs are recoverable | Mitigation costs not recoverable or too speculative | Mitigation damages for reasonable card replacement costs and insurance recoverable under negligence/implied contract |
Key Cases Cited
- Bartner v. Carter, 405 A.2d 194 (Me. 1979) (private UTPA action narrowly construed; loss requirement)
- McKinnon v. Honeywell Int'l, Inc., 977 A.2d 420 (Me. 2009) (loss of money or property required; substantial injury standard)
- In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 4 A.3d 492 (Me. 2010) (certified questions; time and effort not cognizable injury; mitigation)
- Rubin v. Matthews Int'l Corp., 503 A.2d 694 (Me. 1986) (Contract damages exclude emotional distress for breach of contract)
- Stull v. First American Title Ins. Co., 745 A.2d 975 (Me. 2000) (contract damages limitations for non-physical harms)
- Marchesseault v. Jackson, 611 A.2d 95 (Me. 1992) (mitigation costs recoverable if reasonable at time of mitigation)
- Gagliardi v. Sullivan, 513 F.3d 301 (1st Cir. 2008) (dea novo review standard for motions to dismiss)