Compensable Damages – Class Action Fairness Act

Listen to this article

7^th Circuit Court of Appeals

Case Name: Heather Dieffenbach, et al. v. Barnes & Noble, Inc.,

Case No.: 17-2408

Officials: WOOD, Chief Judge, and EASTERBROOK and HAMILTON, Circuit Judges.

Focus: Compensable Damages – Class Action Fairness Act

In 2012 Barnes & Noble discovered that scoundrels had compromised some of the machines, called PIN pads, that it used to verify payment information. They acquired details such as customers’ names, card numbers and expiration dates, and PINs. Some customers temporarily lost the use of their funds while waiting for banks to reverse unauthorized charges to their accounts.

Some spent money on credit-monitoring services to protect their financial interests. Some lost the value of their time devoted to acquiring new account numbers and notifying businesses of these changes. Many people use credit or debit cards to pay bills automatically; every time the account number changes, these people must devote some of their time and mental energy to notifying merchants that the old numbers are invalid and new ones must be used. In this suit under state law, plaintiffs seek to collect damages not from the data thieves but from Barnes & Noble. Jurisdiction rests on the Class Action Fairness Act, 28 U.S.C. §1332(d), because the proposed class contains at least 100 members, the amount in controversy exceeds $5 million, and minimal diversity of citizenship exists.

Dieffenbach invokes two statutes: California’s Customer Records Act and its Unfair Competition Law. The Records Act provides that a “customer injured by a violation of [this Act] may … recover damages.” Cal. Civ. Code §1798.84. The statute does not define injury, nor does any state decision we could find. The district judge took this absence of a definition as equivalent to conditioning recovery on satisfaction of the Unfair Competition Law, which provides that “lost money or property” supports recovery. Cal. Bus. & Prof. Code §17204. That’s a problematic move; the statutes are distinct, after all, as is their language. But this does not maoer, because the first three losses that Dieffenbach identifies fit within the phrase “lost money or property.”

Now for Illinois. Susan Winstead, the second representative plaintiff, alleges that (1) her bank contacted her about a potentially fraudulent charge on her credit card statement and deactivated her card for several days; and (2) the security breach at Barnes & Noble “was a decisive factor” when she renewed a credit-monitoring service for $16.99 per month. Her claim rests on the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505/2, and the proposed class relies on materially identical laws in other states. A person “who suffers actual damage as a result of a violation of this Act” may recover. 815 ILCS 505/10a(a). A monthly $17 out of pocket is a form of “actual damage”. It is real and measurable; Illinois does not require more. See Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill. 2d 100, 195–99 (2005). And, if the plaintiff has suffered an economic loss, noneconomic injuries are compensable. See, e.g., Morris v. Harvey Cycle & Camper, Inc., 392 Ill. App. 3d 399, 402–03 (2009).

An Illinois appellate court has held that a person who purchases credit-monitoring services after a merchant discloses personal information has not suffered actual damages. Cooney v. Chicago Public Schools, 407 Ill. App. 3d 358, 365–66 (2010). We think it unlikely that the Supreme Court of Illinois would agree with the “actual damages” portion of this decision, given the breadth of the statutory language. Money out of pocket is a standard understanding of actual damages in contract law, antitrust law (Reiter v. Sonotone Corp., 442 U.S. 330 (1979)), the law of fraud, and elsewhere. To get damages plaintiffs must show that a culpable data breach caused the monthly payments, but the complaint cannot be dismissed before giving the class an opportunity to do so.

Everything we have said about California and Illinois law concerns injury. We have not considered whether Barnes & Noble violated any of these three state laws by failing to prevent villains from stealing plaintiffs’ names and account data. Barnes & Noble was itself a victim. Its reputation took a hit, it had to replace the compromised equipment plus other terminals that had been shown to be vulnerable, and it lost business. None of the state laws expressly makes merchants liable for failure to crime-proof their point-of-sale systems. Plaintiffs may have a difficult task showing an entitlement to collect damages from a fellow victim of the data thieves. It is also far from clear that this suit should be certified as a class action; both the state laws and the potential damages are disparate. These and other questions need consideration on remand. That the case has been pending for 5½ years without a decision by the district court whether the proposed class can be certified is problematic under Fed. R. Civ. P. 23(c)(1)(A), which requires the decision to be made “[a]t an early practicable time after a person sues … as a class representative”. All we hold today is that the complaint cannot be dismissed on the ground that the plaintiffs do not adequately allege compensable damages. The judgment is vacated, and the case is remanded for proceedings consistent with this opinion.

Vacated and Remanded

Full Text

Attorney Derek A. Hawkins is the managing partner at Hawkins Law Offices LLC, where he heads up the firm’s startup law practice. He specializes in business formation, corporate governance, intellectual property protection, private equity and venture capital funding and mergers & acquisitions. Check out the website at www.hawkins-lawoffices.com or contact them at 262-737-8825.