Whalen v. Michaels Stores, Inc.
689 F. App'x 89
| 2d Cir. | 2017Background
- Plaintiff Mary Jane Whalen used a credit card at a Michaels store on December 31, 2013; her card was later presented for payment twice in Ecuador on January 14–15, 2014. She canceled the card on January 15.
- Whalen does not allege any fraudulent charges were actually incurred or that she was held liable before cancellation.
- Michaels announced a possible data breach on January 25, 2014, and confirmed on April 17, 2014 that payment card numbers and expiration dates were exposed, but not names, addresses, or PINs. Michaels offered 12 months of identity protection and credit monitoring.
- Whalen sued alleging breach of an implied contract and violation of N.Y. Gen. Bus. Law § 349, claiming theft/use of card data, risk of future identity fraud, and loss of time/money monitoring accounts.
- The District Court dismissed for lack of Article III standing; Whalen appealed. The Second Circuit affirmed the dismissal.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing to assert data-breach claims | Whalen argues her card data was stolen and used (attempted charges), she faces future identity-fraud risk, and she spent time/money monitoring accounts | Michaels argues Whalen suffered no concrete, particularized injury: no actual fraudulent charges, card was canceled, exposed data did not include other identifying information, and monitoring/effort allegations are conclusory | Court held Whalen lacked Article III standing: no concrete injury from attempted charges, speculative future harm, and no specific allegations of time/money spent monitoring her credit |
Key Cases Cited
- Carter v. HealthPort Tech., LLC, 822 F.3d 47 (2d Cir. 2016) (standard of review and standing principles applied in data-breach contexts)
- Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (U.S. 2013) (future injuries must be certainly impending, not speculative)
- Upstate Citizens for Equality, Inc. v. United States, 841 F.3d 556 (2d Cir. 2016) (Article III injury, traceability, redressability framework)
- Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384 (6th Cir. 2016) (standing found where breached data included highly sensitive personal identifiers)
- Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015) (Seventh Circuit decision finding standing in vendor data-breach case)
- Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016) (Seventh Circuit decision relevant to data-breach standing analysis)