Torres v. Wendy's Co.
195 F. Supp. 3d 1278
M.D. Fla.2016Background
- Plaintiff Jonathan Torres alleges Wendy’s suffered a data breach from malware that exposed customers’ payment card data and PII; Torres experienced two unauthorized debit-card charges after a January 2016 Wendy’s visit.
- Torres filed a putative class action asserting breach of implied contract, negligence, and violations of Florida’s Deceptive and Unfair Trade Practices Act.
- Wendy’s moved to dismiss under Fed. R. Civ. P. 12(b)(1) and 12(b)(6), principally arguing Torres lacks Article III standing because he did not plead a cognizable injury-in-fact.
- Torres claims actual identity theft, ongoing risk of identity theft/fraud, out-of-pocket mitigation costs, lost value of his data, and that he overpaid for Wendy’s products lacking adequate security.
- The court analyzed standing under the injury-in-fact, causation, and redressability framework, focusing on (1) actual monetary harm from fraudulent charges and (2) the imminence of threatened future harm.
- The court granted Wendy’s motion, dismissing the complaint without prejudice for lack of Article III standing, but gave Torres leave to amend by a set deadline.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Torres alleged actual monetary injury from fraudulent charges | Torres contends the fraudulent charges and identity-theft risk constitute actual injury | Wendy’s argues Torres alleged no unreimbursed out-of-pocket loss and thus no concrete monetary injury | Court: Torres failed to allege actual monetary harm sufficient for standing (no unreimbursed loss pleaded) |
| Whether threatened future identity theft/fraud is sufficiently imminent to confer standing | Torres asserts theft of his data creates a certainly impending risk and costs to mitigate confer standing | Wendy’s invokes Clapper: speculative future harm is insufficient; risk here is too remote | Court: Speculative future harm not certainly impending; mitigation costs not enough absent imminent harm; standing not established |
| Whether other asserted harms (lost value of data, overpayment for services) support standing | Torres alleges loss of value of his PII/PCD and that he paid for security in Wendy’s prices | Wendy’s contends these allegations are conclusory and unsupported (no facts showing diminished value or price differentiation) | Court: These theories are speculative and insufficient to establish injury-in-fact |
Key Cases Cited
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (future harm must be "certainly impending" to establish injury-in-fact)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (pleading-stage injury-in-fact may rest on general factual allegations but must be concrete and imminent)
- Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012) (actual identity theft causing monetary damages constitutes injury-in-fact)
- Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015) (substantial risk of future identity theft and mitigation costs can support standing under facts showing a concrete, imminent risk)