Slashdot Mirror
Judge Tosses Class Action Over Michaels Data Breach Citing Lack of Damages (digitalguardian.com)
chicksdaddy writes: Data breaches have become so common that they've taken on a kind of formality. One of the phrases that often accompany such incidents goes something like this: "[Company X] has no evidence that any of the stolen information has been used inappropriately." Or you might read that "there is no evidence of fraud linked to the stolen data." Such assurances are generally interpreted as wishful thinking. But when courts are asked to weigh in on the question of damages resulting from cyber incidents in civil suits, the question of what harm resulted from the incident is very different – and very real. To put it simply: if nobody can prove harm resulting from a cyber incident, a company can't be held liable for those damages.
That fact was underscored again late last month, when a federal judge in U.S. District Court for the Eastern District of New York dismissed a class action suit against arts and crafts giant Michaels Stores that was filed in the wake of that company's widely-reported data breach. As part of her ruling, the judge, Joanna Seybert, cited a legal precedent set by the recent Supreme Court ruling in "Clapper v. Amnesty International," concluding that the plaintiffs hadn't proven that any harm resulted from the Michaels breach. "Simply put, Whalen has not asserted any injuries that are 'certainly impending' or based on a 'substantial risk that the harm will occur,'" Seybert wrote in her decision, referring to Mary Jane Whalen, the Michaels customer in whose name the class action suit was filed. "Thus, Whalen's claims are DISMISSED WITHOUT PREJUDICE for lack of subject matter jurisdiction," Seybert concluded.
This isn't to say that Whalen or other Michaels stores customers were not the target of fraudsters. In fact, Whalen's attorneys presented evidence that her stolen credit card (or a clone of it) was presented for payment fraudulently in Ecuador: at a local gym and at a venue that sold concert tickets. But regulations in the U.S. exempt consumers from paying the cost of credit card fraud, and Whalen wasn't asked to pay any unreimbursed charges as a result of the fraudulent use, the court noted. Whalen's other attempts to establish "costs" associated with the breach were also disregarded. They included the cost of credit monitoring services and the cost (in time and effort) to obtain replacement cards, the intrinsic value of her credit card information and the risk of future fraud tied to the theft of her credit card data.
That fact was underscored again late last month, when a federal judge in U.S. District Court for the Eastern District of New York dismissed a class action suit against arts and crafts giant Michaels Stores that was filed in the wake of that company's widely-reported data breach. As part of her ruling, the judge, Joanna Seybert, cited a legal precedent set by the recent Supreme Court ruling in "Clapper v. Amnesty International," concluding that the plaintiffs hadn't proven that any harm resulted from the Michaels breach. "Simply put, Whalen has not asserted any injuries that are 'certainly impending' or based on a 'substantial risk that the harm will occur,'" Seybert wrote in her decision, referring to Mary Jane Whalen, the Michaels customer in whose name the class action suit was filed. "Thus, Whalen's claims are DISMISSED WITHOUT PREJUDICE for lack of subject matter jurisdiction," Seybert concluded.
This isn't to say that Whalen or other Michaels stores customers were not the target of fraudsters. In fact, Whalen's attorneys presented evidence that her stolen credit card (or a clone of it) was presented for payment fraudulently in Ecuador: at a local gym and at a venue that sold concert tickets. But regulations in the U.S. exempt consumers from paying the cost of credit card fraud, and Whalen wasn't asked to pay any unreimbursed charges as a result of the fraudulent use, the court noted. Whalen's other attempts to establish "costs" associated with the breach were also disregarded. They included the cost of credit monitoring services and the cost (in time and effort) to obtain replacement cards, the intrinsic value of her credit card information and the risk of future fraud tied to the theft of her credit card data.
The court was right in my opinion. The breach is bad, but showing concrete material damages (outside of copyright infringment suits) is a usual requirement. If the plaintiffs couldn't show they were harmed, Michael's doesn't need to make them whole.
There is still potential for various other types of lawsuits to succeed; PCI compliance, or criminal negligence, etc.
I think we should toss judges due to lack of usefulness
Longest summary ever.
What about all the time the credit card owners have to waste getting a new card and updating all of their vendors, services, etc. If the business is responsible for the credit card data being stolen, and I lose 12 hours of my time dealing with that, then that's "damage", and I deserve to be reimbursed for my time.
Vonal Declosion
If someone broke into a bank vault but you couldn't prove they took anything would they get away with it?
A bullet may have your name on it but splash damage is addressed "To whom it may concern."
My bank was supposed to issue Chip and Pin enabled credit and debit cards by the end of 2015 and they still haven't done it. At this point merchants are starting to give me the stink-eye for not having a C&P card as they now have to pick up the tab for fraudulent transactions. It sucks being stuck in middle of all this b*llsh*t.
chip and signature. Get a different bank.
Dox Joanna Seybert and see how she feels about her ruling...
https://en.wikipedia.org/wiki/Joanna_Seybert
At this point merchants are starting to give me the stink-eye for not having a C&P card as they now have to pick up the tab for fraudulent transactions.
They don't have to pick it up......if the bank hasn't sent you a C&P card, but the merchant has a C&P card reader, then it's up to the bank to pay for fraud.
"First they came for the slanderers and i said nothing."
Ok, if this has no harm to the end user, i.e. nothing physical stolen, then why would copying music or movies be damaging? That has all of the same IP, as my information about myself that michaels and others would just have given up.
I prefer the "u" in honour as it seems to be missing these days.
Hint: It doesn't always have to be monetary.
What about the psychological damage of the details of your life falling into the hands of someone you'd rather not want having them? Freedom of association also includes the right to choose not to associate with someone.
Have gnu, will travel.
I'm SURE the judge wouldn't mind if someone broke into his house and looked around. And he certainly wouldn't hold his security company at fault, even though their alarms didn't.
She showed a cost for credit monitoring, and her time to fix the problems THEY created by willful negligence should be reimbursed.
Near as I can tell, the judge was bought.
As Drugs become legalized the feds are turning to fleecing companies over their data breaches with little to no benefit for the little person because the feds WANT this to continue so they have a new cash cow.
now can we please use the same logic for copyright lawsuits?
Near as I can tell, the judge was bought.
More likely, she is ignorant of technology, and the plaintiff's lawyers did a lousy job explaining the issue. The judge noticed a (incorrect) similarity to another case, and thought she should rule in a similar way.
Remember judges are elected, and sometimes they can be really, really dumb.
"First they came for the slanderers and i said nothing."
If your data is exposed into the wild, you will need to take insurance for identity theft. That is a mesureable damage.
Also, if you are hit, your credit rate is in the sewer (but the insurance normally will cover that - hopefully).
It's a real pain in the ass when a data breach allows credit card fraud to occur. Anyone who's had it happen to them know that. So the credit card company doesn't make you pay (oh, they don't eat it, ever, they don't pay the vendor), that's great. But you still have to catch the fraudulent charges (in time), call, make a claim, change your account number, remember all the subscribed accounts that use that number (netflix etc...), wait & see, worry.
But the company that can't keep their shit secure has no liability.
SLOWER TRAFFIC KEEP RIGHT
They can show actual damages from the breech, Then again, they might be insured against losses from fraud, so it would have to be the insurance company that sues. Does it stop there? I don't know.
At this point merchants are starting to give me the stink-eye for not having a C&P card as they now have to pick up the tab for fraudulent transactions.
They don't have to pick it up......if the bank hasn't sent you a C&P card, but the merchant has a C&P card reader, then it's up to the bank to pay for fraud.
A little more detail might be good: This is what's known as the "liability shift rule". It was enacted by all of the major credit card associations and individual issuers in the US last year. What it means is that when a transaction is found to be fraudulent, the chain of participants in the transaction is examined, and the first one in the chain that doesn't support the chip technology is liable for the fraud. The chain includes: The bank who issued the card, the merchant who accepted the card, the acquiring bank who processed the transaction, the clearinghouse who routed the transaction and the bank who processed the payment (almost always the same as the card issuer, though it's worth calling out twice because a bank could issue chip cards but not implement the backend system changes needed to process and validate them correctly).
What a stupid comment. A long long time ago some stuffed shirts with dandy wigs sniffed the air and declared that they will only award damages if the exact amount can be proven and so precedent was set. That doesn't mean that damage has not been done and for identity theft that damage can be considerable and haunt a victim for life. Unfortunately fraudsters do not present the victims with a schedule of planned fraud over the next 15 years. Making this even more stupid is that for libel judges award damages without any idea of concrete damages. They could have done it here. They didn't. The courts just make up shit as they go.
And criminal negligence? Do you have any idea what you're talking about? And did you realize that question is rhetorical?
The cost of a credit protection service enrolled in as a precaution is damage enough. This is a forseeable injury regardless of actual fraud. The class representatives could have subscribed to some service and pled the class as existing of all persons that incurred this expense. The result is the negligent company is held accountable and other companies are on notice that they will be held accountable. If there was actual fraud for some persons, it would destroy the commonality requirement for class certification; the persons suffering fraud would all have had different levels and types of damages.
Why have 1 person driving a backhoe when you could employ 20 with shovels?
It sounds like the judge did the right thing but dismissing without prejudice. That will allow it to come back when or if they get enough information to prove the case. Will we base the outcome of cases like this on how the data was used by the folks who stole it? How long do we have to wait to determine the cost? What about the impact of ambiguity resulting from multiple large breaches, how do we attribute loss? ... I would be concerned about the second aspect; if a company avoids doing the right thing because they choose to lawyer up and aggressively go after claims from customers, customers may loose confidence in that company and will move their business elsewhere since they feel they were treated inappropriately and "the company got away with it." This could be more damaging in the long run - especially in light of the supposed "no proven losses."
What if the same had to be proven by companies who get people for piracy? Isn't this basically the same thing? We are talking about stolen information that has value in slightly different ways but causes harm to the "victim" in similar ways. Resonable fines should be paid by anyone who commits piracy and the same rules should apply to companies who can't keep their customers private information secure.
I know this is technically how the law is supposed to work but the likely consequence of this is that companies will put more effort into covering up the damages than they put into securing their data. It's a lot more expensive to develop a system that is difficult to penetrate than it is to roll the dice and hope that you don't get hacked and if you do, cover up the evidence.
I'm annoyed by people like you who do not (carefully) read TFA but rather make a comment from summary. Even worse, these people pick and choose only a section of the whole to make a dubious comment on.
Whalen essentially alleges five different types of injuries:
(1) actual damages including monetary losses arising from unauthorized bank account withdrawals, fraudulent card payments, and/or related bank fees charged to their accounts, (Compl. 49);
(2) the loss of time and money associated with credit monitoring and obtaining replacement cards, (Compl. 54);
(3) overpayment of Michaels' services because Whalen would not have shopped at Michaels had she known that Michaels did not properly safeguard her personal identified information (PII), (Compl. 24, 70-71);
(4) the lost value of Whalen's credit card information, (Compl. 35-37) and
(5) a statutory violation of GBL 349, (Compl. 74-98)
By laws, you cannot assume damage before there are real damages. If laws permit to do so, there will be tons of law suits attempting to get money before a real issue happens! Also if you actually READ the PDF file from Bloomsburg Law site, you will see how the judge counters her claims and should be able to understand exactly why.
Anyway, this does not mean she cannot sue Michael again. The case is dismissed without prejudice which means she can take Michael to court again IF there is real damage later on.
PS: Where is in the court ruling said that she "paid" for credit monitoring? On the other hand "Michaels offered free credit monitoring for twelve months." You need to look at #2 above and read on what the judge commented on the item...
Remember judges are elected, and sometimes they can be really, really dumb.
Federal District Court judges are not elected, they are nominated by the President and confirmed by the Senate. Judge Joanna Seybert was nominated by Clinton in 1993.
good point
"First they came for the slanderers and i said nothing."
Thanks for the detailed breakdown of liability chain... very interesting.
Still don't know why more C&P hasn't been adopted yet from a retailer standpoint... if they're liable and the hardware exists - why do I still see swipe machines everywhere with no chip readers alongside?
Make sure everyone's vote counts: Verified Voting
What I find odd is that they've issued the chips, but as far as I can tell aren't demanding PINs. I have a couple of chipped cards, and I see no feature allowing me to establish a PIN even if I want to.
I guess that makes it harder to counterfeit the cards, which is nice, but it's still easy for the cards themselves to be stolen, and the numbers alone are still cheerfully accepted by most online merchants (along with the ultra-weak 3-digit code).
Any idea why they're not rolling out PINs at the same time as the chips? Are they planning to?
to show harm. I've had my credit card info stolen a couple of times, I consider the hours needed to straighten things out, get new cards, redo all of the automatic charges, and general hassle to be significant enough.
She's still an idiot. I can only assume that she has never had to deal with the hassle of having your CC info stolen. Especially if you are traveling at the time.
She's still an idiot. I can only assume that she has never had to deal with the hassle of having your CC info stolen. Especially if you are traveling at the time.
Why do so many people feel a need to call people idiots just because they have different opinions? Why do they believe their opinion is the only correct and true one? Makes me wonder who the idiot is!
saying that there was no evidence of any form of concrete damages when anyone that has had this info stolen knows that there is is quite stupid, hence she is an idiot.