8th Circuit Finds Standing for Data Breach under Breach of Contract Theory— Dismisses Class Action Nonetheless for Failure to State a Claim

On August 21, 2017, the Eighth Circuit dismissed class claims of breach of contract, breach of implied contract, unjust enrichment, declaratory judgment, and violation of the Missouri Merchandising Practices Act (“MMPA”) for failure to state a claim upon which relief could be granted, despite finding that Plaintiffs had standing under a breach of contract theory regarding a data breach that involved their personal information.

The claims arose when a securities brokerage firm was hacked.  Hackers accessed the internal database of the brokerage firm and acquired personal identifying information (“PII”) of over 4.6 million of the firm’s customers.  They exploited the PII to operate a stock price manipulation scheme, illegal gambling websites, and a Bitcoin exchange.  Following the hack, one of the affected consumers (“plaintiff”), along with three other people affected by the data breach brought a putative class action complaint against the brokerage firm in the eastern district of Missouri.

The plaintiff asserted that the brokerage firm provided deficient cybersecurity in violation of its “contractual and other obligations,” which resulted in the data breach.  The plaintiff further alleged that he faced an immediate and continuing risk of identity theft and identity fraud, incurred financial costs of monitoring his credit and financial accounts to mitigate against that risk, received brokerage services that diminished in value due to the hack and therefore that he overpaid for those services, that he suffered economic damage from the decline in value of his PII, and that he suffered invasion of privacy and breach of confidentiality.

The brokerage firm filed a Motion to Dismiss for lack of subject matter jurisdiction, arguing the plaintiff lacked Article III standing because he had not suffered an injury-in-fact.  The district court agreed and granted the motion to dismiss.  The plaintiffs appealed the district court’s holding to the Eighth circuit, and the brokerage firm filed a cross-appeal, contending that even if there was standing, the plaintiff failed to state a claim upon which relief can be granted.

Citing Spokeo, the Eighth Circuit opined that Article III standing extends judicial power to “cases” and “controversies” only, and therefore imposes a constitutional minimum burden that a plaintiff must establish in order to have proper standing.  The minimum that must be established is that the plaintiff (1) suffered an injury in fact, (2) that the injury is fairly traceable to the challenged conduct of the defendant, and (3) that the injury is likely to be redressed by a favorable judicial decision.  The court further stated that the injury suffered by the plaintiffs must have been concrete and particularized rather than conjectural or hypothetical.

Relying on prior controlling precedent, the Court explained that a party to a breached contract has a judicially cognizable interest for standing purposes, regardless of the merits of the breach alleged.  Hence, the court held that the plaintiff did have Article III standing because he alleged that he bargained for and expected protection of his PII, that the brokerage firm breached the contract when it failed to provide safeguards to ensure the protection, and that he suffered actual injury in the diminished value of his bargain because of the breach.

Despite this, the court pointed out that in order to survive a motion to dismiss for failure to state a claim, a complaint must allege sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.  It looked closely at the contract between the brokerage company and the plaintiff, and ultimately held that the plaintiff failed to allege a specific breach of contract and also failed to plausibly allege the actual damage that was an element of any breach of contract.  Therefore, the judgment of the district court dismissing the consolidated class action complaint was affirmed.

For more information, the opinion can be found here: http://media.ca8.uscourts.gov/opndir/17/08/163426P.pdf.