Don't Trifle With Trifling Damages in Florida Data Breach Cases
A significant roadblock for plaintiffs in data breach cases in Florida is the threshold issue of Article III standing. Plaintiffs must show an actual or imminent injury.
February 15, 2019 at 11:20 AM
6 minute read
A significant roadblock for plaintiffs in data breach cases in Florida is the threshold issue of Article III standing. Plaintiffs must show an actual or imminent injury. Eleventh Circuit courts do not clearly articulate a rule as to the type of actual harm required to survive a motion to dismiss. Plaintiffs and defendants must therefore navigate the case law to determine the degree of harm that must be alleged in the growing canon of data breach litigation.
Under Article III, Section 2 of the U.S. Constitution, the plaintiff bears the burden of proving standing, which requires a three-part showing: the plaintiff must have suffered an injury-in-fact; the plaintiff's injury must be fairly traceable to the defendant's actions; and the relief requested must redress the plaintiff's injury, see Lujan v. Defenders of Wildlife, 504 U.S. 555, 559–560 (1992).
To establish injury-in-fact, the plaintiff must demonstrate she has “a legally cognizable interest that has been or is imminently at risk of being invaded,” see Mulhall v. UNITE HERE Local 355, 618 F.3d 1279, 1286 (11th Cir. 2010). At the pleading stage, this requirement is satisfied by “general factual allegations of injury resulting from [the defendant's] conduct.” How much of an injury is required to show an injury-in-fact in a data breach case? Possibly, a mere trifle.
In I Tan Tsao v. Captiva MVP Restaurant Partners, 2018 WL 5717479 (M.D. Fla. Nov. 1, 2018), the court rejected nominal damages as sufficient to establish standing. The plaintiff was a customer in one of the defendant's restaurants. He filed a data breach action after a cyberattack by a third-party hacker on the restaurant's computer system.
In his class action complaint, the plaintiff alleged he purchased food at an affected restaurant using two different reward payment credit cards. When he contacted the bank, the cards were cancelled, causing him to lose the opportunity to accrue rewards. The plaintiff sought damages for impending injury flowing from potential fraud and identity theft and the loss of cash-back rewards. For damages, the plaintiff included in his claim the loss of his cash-back reward accrual from the time he cancelled his cards to the time they were reissued. This category of damages could have been a concrete, quantifiable loss. But the court sweepingly dismissed all the allegations as “speculation of future, potential injury at best” and cited the Latin phrase de minimus non curat lex, meaning “the law does not concern itself with trifles.”
Tsao concluded that the plaintiff's failure to include any factual specificity as to, among other things, the monetary value associated with any purported misuse of the information, compelled a finding that no concrete injury-in-fact occurred. The court dismissed the complaint without prejudice, allowing the plaintiff to amend the complaint to allege, potentially, the lost value of his cash-back rewards.
Case v. Miami Beach Healthcare Group, 166 F.Supp.3d 1315 (S.D. Fla. 2016) also dismissed a data breach claim for lack of standing based on nominal damages. The plaintiff was a patient whose personal data, along with that of 85,000 other patients, was stolen by the health care provider's employee after she received hospital treatment. As a result of the breach, she claimed she did not receive the entirety of the services for which she paid. In reviewing the plaintiff's itemized bill and statement of account, the court was not persuaded that the defendants' charges explicitly or implicitly included the cost of data protection, such that an employee's access to sensitive information, without more, would necessarily diminish the value of the services that she received. The court also stated that those documents revealed that the plaintiff only paid a de minimis amount of her total bill for healthcare services toward protection of her sensitive information., thus rendering negligible any purported injury she sustained or damages she incurred. The court did not indicate whether the plaintiff could show standing by amending her complaint to allege the value of the portion of her bill attributed to protecting her sensitive information.
While Tsao and Case suggest that nominal damages will not establish standing, Torres v. Wendy's International, 2017 WL 8780453 (M.D. Fla. Mar. 21, 2017) found “trifling” damages sufficient to establish a concrete injury in data breach cases. In Torres, the plaintiff, after dismissal of his initial complaint for lack of standing, alleged in his amended complaint that due to a data breach at a Wendy's restaurant, during which hackers stole his payment card data and personal identity information, he was unable to make a timely payment for a utility bill. His delay caused him to incur a $3 late fee. He also alleged that he and six other plaintiffs experienced credit or debit card fraud and were required to use alternative sources of funds to make purchases while awaiting their replacement cards, thereby foregoing credit card reward points and/or cash-back rewards and experiencing actual damages.
The court denied the motion to dismiss the amended complaint because the plaintiff suffered a concrete injury of a $3 late fee as a result of the data breach. The court stated that this $3 loss alone was sufficient to show standing. As an added basis for finding standing, the court pointed to the plaintiffs' allegations that they lost credit card reward points and cash-back rewards. The court did not, unlike in Tsao, require the plaintiffs to allege the lost value of the cash-back rewards, possibly because the $3 loss had already been pleaded.
Plaintiffs will argue under Torres that injury can be negligible, as little as $3 in damages, a position which Torres noted is supported by the purpose of class actions, which is to provide meaningful redress to plaintiffs with claims too small to justify individual litigation. Defendants will cite Tsao and Case to argue that the injury alleged cannot be de minimus, though no threshold value is spelled out by the courts. These standards bode well for plaintiffs who can allege even the smallest concrete financial injury, but also for defendants who can show no actual loss has occurred.
Nicole Rekant is an attorney and Stevan Pardo is a partner at Pardo Jackson Gainsburg in Miami. The litigators represent clients on a wide range of matters including complex litigation and class actions before federal and state courts.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllDon’t Forget the Owner’s Manual: A Guide to Proving Liability Through Manufacturers’ Warnings and Instructions
5 minute readLeveraging the Power of Local Chambers of Commerce: A Second-Career Lawyer’s Guide to Building a Thriving Practice
5 minute readTrending Stories
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250