Earlier this week, the United States District Court for the District of Maine issued its ruling on a motion to dismiss a class action complaint against a supermarket chain based on a massive data breach. The decision addressed the question of whether when a third party steals a customer’s credit and debit card information from a grocer, can the customer then recover from the grocer? In re Hannaford Bros. Co. Customer Data Security Breach Litigation, MDL Docket No. 2:08-MD-1954 (D. Me., May 12, 2009). The court’s decision preserved three of the plaintiffs’ seven causes of action, but dismissed the case as to all but one of the named plaintiffs, the only plaintiff who claimed actual fraudulent charges that she had to pay as a result of the theft.
According to the plaintiffs’ complaint as related by the court, between December 7, 2007 and March 10, 2008, third-party wrongdoers obtained access to the defendant’s information technology systems and stole confidential and private credit and debit card information of the defendant’s customers. The plaintiffs, a purported class of consumers who shopped at the defendant’s markets during the period in which the data was stolen, brought seven causes of action against the defendant in a consolidated complaint: (I) breach of implied contract; (II) breach of implied warranty; (III) breach of duty of a confidential relationship; (IV) breach of a duty to advise customers of the theft of their data; (V) strict liability; (VI) negligence; (VII) and violation of Maine’s Unfair Trade Practices Act. The defendant brought a motion to dismiss the entire complaint.
The court explained that its ruling was wholly dependent on state law (in this case, the law of Maine), which is undeveloped with respect to the issues before the court, and it noted that the role of federal courts is merely to apply state law, not to modify it to “accommodate the complex financial arrangements and risks that the parties portray.”
Four Causes of Action Dismissed
The court dismissed the causes of action for breach of implied warranty, breach of duty of a confidential relationship, breach of a duty to advise customers of the theft of their data, and strict liability. With respect to breach of implied warranty, the court reasoned that the implied warranty in a sale of goods applies to the goods themselves, not the payment mechanism. The court dismissed the cause of action for breach of duty of a confidential relationship, reasoning that the merchant/consumer relationship at issue did not entail the sort of “trust and confidence” that Maine requires to establish a confidential relationship. With regard to the plaintiffs’ duty to advise claim, the court found that without either a confidential relationship or active concealment of the truth, the defendant had no duty to disclose. Finally, the court dismissed the strict liability claim, finding that Maine courts had confined the tort to a limited range of circumstances, none of which was present in the case before it.
Three Causes of Action Preserved
The court ruled that the plaintiffs could proceed with three causes of action: breach of implied contract, negligence, and the Maine Unfair Trade Practices Act claim. With regard to the breach of implied contract claim, the court ruled that a jury could find an implied contractual term in a grocery purchase transaction that the merchant will use reasonable care in safeguarding its customers’ card data. Concerning negligence, the defendant did not argue that it owed no duty of care to its customers, but rather that the claimed losses were all related to a contract, and under the economic loss doctrine, parties to a contractual relationship cannot recover in tort for purely economic losses. However, the court explained that the doctrine, as developed in Maine’s courts, applies only to defective products, and allowed the negligence claim to proceed. Lastly, the court allowed the Maine Unfair Trade Practices Act count to proceed, finding that the statute instructs courts to be guided by the Federal Trade Commission’s interpretation of the similar federal statute, and that the FTC had brought over 20 complaints charging companies under the federal statute with security deficiencies in protecting sensitive consumer information.
All Claims Save Those of One Plaintiff Dismissed
Despite allowing three causes of action to proceed, the court ultimately held that only one named plaintiff had alleged a cognizable injury, and dismissed the complaint as to all other plaintiffs. The court explained that for a lawsuit to proceed, a plaintiff must have suffered an injury for which Maine courts will grant relief. As to consumers who did not have fraudulent charges posted to their accounts, the court found that they could not recover because they had only suffered emotional distress (as well as expenditures of their time and money to alleviate that distress, for example canceling their credit cards and paying for credit monitoring services). The court noted Maine law generally does not allow emotional damages for contract claims, and does not allow emotional damages for tort claims unless the plaintiff can recover some other damages.
As to consumers who had fraudulent charges posted that had since been reversed, the court found that the alleged consequential damages related to those charges – e.g., overdraft fees, loss of accumulated reward points, time spent reversing the charges, temporary lack of access to funds, and the cost of identity theft insurance – are all either too remote, not reasonably foreseeable, and/or speculative to allow recovery. As for the prayer for injunctive relief requiring the defendant to provide credit monitoring services, the court found that all of the named plaintiffs had cancelled their cards, so there was no need for such relief. However, the court found that one plaintiff, who alleged to have suffered a fraudulent charge that had not yet been removed and thus are charges the plaintiff had to pay herself, had alleged a cognizable injury, and allowed the case to proceed as to that plaintiff only.
