Oral argument — Whalen v. Michael Stores Inc.

Our last case on the calendar for argument today is Walen v. Michael Stores. Good morning, Your Honors. May it please the Court, Joe Siprit on behalf of the Plaintiff and Appellant, that's the class below. I'd like to think that hopefully my job this morning is a little easier by the standards of data breach cases because as far as data breach cases go, we have about the strongest set of facts or allegations that you could possibly have or that we've seen in any of the cases out there. We have a breach on the Michael system that in fact compromised the information of 3 million people. Look, look, I'm going to be for your side, I'm going to assume that there is standing, we'll argue a question of standing together. I want to know why you survived 12b-6. Unfortunately, we have to deal with a standing issue because it's constitutional standing, so we have to deal with it. But why do you survive 12b-6? What is it that is under state of New York, anything that you can get anything for? There are two paths to surviving 12b-6, Your Honor. One is, well, under New York law technically, but more generally stated, implied contract. Implied contract of what? The implied contract that the other side had an absolutely safe program. That's an absurdity. Nobody would imply a contract of that sort. Nobody would make a contract, so we can't imply it. If it is implied that they would act reasonably, where have you pled anything that says that they did not act reasonably? Well, the reasonable standard, I'm not sure fits in quite with the implied contract claim. I think that that more fits in with the second of the two paths I alluded to, which is the statutory claim under New York law. GBL. Yes, Your Honor. But what is the implied contract? Well, as several courts have held in affirming the exact same implied contract claim, namely the Target Court in Minnesota, the Michaels Court, as it happens, in the Northern District of Illinois, that is the exact same defendant that we have here who had yet another data breach five years ago, had an implied contract claim survive and lead to a class settlement in that case. This is the same claim that we're pleading here. I'm not abound by them. Yes. I want to know what the implied contract that you have alleged in your complaint under New York is that was violated. An implied contract to do what? Never to breach? No. The answer is to collect the information for purposes of that transaction only. That is the answer to your question. So when I go to Michaels and I buy, what do they sell there, kites, arts and crafts, and I present my credit card at the transaction, at the point of sale, when they scan my information and it's processed on my credit card, my expectation as a consumer is that that information is not indefinitely retained in a database. The reason, it turns out, why everyone does that, although maybe less so in this— The breach of the implied contract. It's one of the express allegations in the implied contract count. The paragraph number in our complaint or the appendix site would be page 27, and the complaint allegations would be generally from 68— What is there that leads you to say that the other side would join such a contract? You know, to have implied contract, you have to have something that both sides would think that they are doing. Well, that is the fact question, I think. For example, if Michaels had put a sign, let's say, for example, that Michaels had a sign at the point of sale saying, Dear customers, just so you know, when you present your credit card for payment, we're going to keep all of your— The question is, what is it you start out implying, and why do you think any dealer would make—would imply a term like that in a contract, just as I don't see they would imply in a contract that there would never be a breach? Well, the distinction is, absent any representations to the contrary, our allegation is that a consumer has the right to—I don't want to say right, but the terms of the implied contract are that you present your credit card for payment. It's for purposes of that transaction only. That's it. You're done. Because there's no reason for a consumer—so I'll use the word reasonable. A reasonable consumer has no reason to believe the information is held indefinitely for marketing slash nefarious purposes unless the retailer says, Dear customer, we're going to hold your information for marketing and nefarious purposes. Why is marketing a nefarious purpose? Why wouldn't most consumers expect that when you give some information, the people you give the information to will use it? Well, some do and some don't. In other words, if you go into a store, and some stores do this. They say, Dear customer, we're going to send you information that we think you're going to love to get in the mail, and I hope I'm answering your question directly, Your Honor. So if you go into a store today, it is possible that they will say, Dear judge, when you present your credit card for payment, we're going to keep your information on file, and we're going to send you a bunch of stuff in the mail that we just know you're going to love. You may hear that and say, I don't think so. I need to opt out, or I'm not going to give you my business. I mean, this is how it works. But if they don't tell you anything, and they just take your credit card and swipe it, you have the right on that basis to believe that your information is not being held indefinitely Question? Yes. I'd like to turn back, if we could, before you sit down. We'll take a little extra time to help me understand what facts in the complaint about the data breach that Ms. Whalen herself experienced support a finding that she now faces a credible threat of identity theft. Yes. Her name, her credit card number were taken. The credit card was canceled. There was no additional information. How is she vulnerable to, and why is there an impending threat that's credible as to identity theft? Well, two reasons. One is, even if it were true that the harm has already been done, the very fact, and I didn't even really see any harm. There's been a disclosure, and there was a payment, a presentation made for payment, but she suffered no financial harm. Correct? And there's, well, I mean, we're talking really a very limited series of events here. Unlike in many other cases, her social security wasn't taken. Other identifying information wasn't taken. Her passwords weren't appropriated. We had her name and a credit card, and the credit card number was then canceled. Right? Not quite. What in addition was there that creates a credible threat of an impending danger that she's going to be subject to identity theft? Right. So the answer is, in this particular case with this actual plaintiff, there was attempted, there was actual unauthorized fraudulent usage of her card and attempted- The card was presented for payment, but she didn't have to pay anything. The card was canceled promptly. That is correct. Luckily, in her case, it came to light, so- Let me help you out, because it's my question to the other side. The moment her card was stolen, her data was stolen, she was liable to pay $50. That is true. The fact that the company might choose not to do it, but under the contract, she was liable to pay $50 when the card was stolen. That's precisely right. My own instinct is that that's enough for standing. That's exactly right, Your Honor, and thank you for- That's why I went directly to 12B6, that I think that standing here doesn't need to get us into complicated fake questions of future thing. There is $50 worth of exposure the moment the card is stolen. Yeah, that's right. Did you allege that in your complaint? Yes. That she was subject to this $50? Because a lot of cards have the zero liability clause. Did you allege that she at least had that exposure? When my adversary is up here, I will try to find the site and the record for that, but the answer is yes. I believe that we have that and several other allegations also pointing out that in this day and age, when someone has only, I use air quotes, only your name and your credit card information, it is astounding what they can reverse engineer from that. So to Your Honor's point about the threat of future harm, even though the card has been canceled, unfortunately that is of little consolation to someone who has gone through this because what they can do just from that information alone does in fact, as we have alleged, subject you to continuing threat of personal identity being stolen and it happens every day, which is- Every time that Bank America calls me and says, are you really buying a home in Buenos Aires? And I tell them no. Then I have standing, if I can find out where they got, what company they got that information from, they got it from Amazon, let's say. Do I have standing then to sue Amazon? No, not necessarily because there's two different situations that are distinguishable here. One is, suppose that on the way out of this courthouse, I dropped my card on the floor by accident and some guy finds it and tries to use it to buy a home in Buenos Aires and my bank calls me. Well, whose fault is that? I mean, there's no company to sue. And even if the transaction was at a company, the point of sale, maybe the reason why it happened is because I left my credit card on the counter on the way out of the store. So the mere fact that you get a phone call- If Amazon announces a data breach, I have a cause of action. Excuse me, not cause of action, I have standing. Now we get to the other end of the spectrum on my view, which is yes. If you have, by contrast to my first example, a situation where a data breach occurs, and not just any data breach, by the way, so we're not talking about like a stolen laptop situation or a lost laptop where someone leaves a laptop in a car and there's a bunch of important information on there and then someone brings a lawsuit and says, I'm very fearful of the fact that my information has been compromised. Well, they probably weren't after the laptop, they were probably after the car. So even that perhaps would not rise to the level of Article 3 standing. But to your honor's point, when Amazon has your credit card information and they say someone hacked into our database because of inadequate security measures. P.S. the reason they are hacking into it is precisely for the purpose of stealing your information. And then you get a phone call from your bank saying someone is trying to use your credit card to buy a house in Buenos Aires. Yes, you absolutely have standing. So says every circuit court of appeals to have addressed that issue so far. The seventh, twice, the sixth, just recently, and hopefully now the second. Counsel, when you go back and try to see whether you allege the $50, I want you to look for something else. And that is whether the card, whether you alleged it or not, in this case provided for a $50 possible loss. Because since the issue is constitutional standing, that is a question that we can decide and must decide for ourselves under Justice Scalia's opinion in Steele. So it doesn't really matter whether you alleged it. If there is constitutional standing, we then can, well, you might lose on that issue if you didn't change it. We then can assume standing and decide 12B6 if 12B6 is easier. So it's terribly important on this because whether you alleged it or not, if a card is a card that made her liable for $50, then we can avoid the very difficult standing issue if we can decide the case on other grounds. Otherwise, maybe we cannot. So you'll look for what your allegations were and whether the record reflects any charge of the type that you've referred to. Yes, Your Honor. Thank you. You have two minutes for rebuttal. We'll hear from Mr. Joyce. And by the way, if you can't find it in this time, that's something I would like to see given to us. Sir. Good morning, Judge Carney. May it please the court. Since this is a cross-appeal, may I reserve two minutes on the rebuttal side? Thank you. I want to start with Article III standing, and then, Judge Calabresi, I'll address your questions on the 12B6 side. I think it's important to start here. The Supreme Court has instructed that the standing inquiry requires careful judicial examination of a complaint's allegations. This court in Bauer v. Veneman said the same thing. Injury and fact analysis is highly case-specific. And that's what the district court did here. It adhered to those principles. What Ms. Whalen wants to do is talk about things that do not affect Hertel. She wants to lump this case in with data breach cases that are markedly different factually. Let's talk about the Sixth Circuit case. Galleria is a case where social security numbers and logins were stolen. It is categorically different in kind. The closest case is Chang at the Seventh Circuit because one of the parties didn't have anything charged. Let me help you, Judge Calabresi. Let me start with Ramihas, which my colleague Mr. Siprit pleaded. In Ramihas, in paragraphs 12 and 13, he pleaded, Neiman Marcus collects a wide variety of PII, including names, addresses, mobile telephone numbers, driver's license numbers. He goes on to say, in that same complaint, hackers had access both to the payment card data and the PII, defined that way. That case is different. Go on to the one... So, and then you get to Lewert, where a couple things. You have card members who do not have canceled cards. And again, the Seventh Circuit jumps on this notion that there was more than just a card breach. It said P.F. Chang warned about the need for credit monitoring, not account monitoring. If you look at S.A., Supplemental Appendix 4 and 6 in this record, Michaels warned about exactly the opposite. The only details compromised were the card numbers. And what's the icing on the cake is that's precisely what he pleaded here. Let's look at A11, Paragraph 7. He said credit card information and sensitive financial information. Occasionally, he tosses out the term PII, but when you finally turn to where PII is defined in this complaint, it's at A15, Paragraph 24, PII is defined as the credit card number and the name. This court... Do you concede that if her credit card made her liable for $50, she would have standing? Potentially, Your Honor, but not on these facts. And let me walk you through why, Judge Calabresi. Look, somebody steals my card and I don't hear of it for some time. My card has a statement that if I don't let the card company know I am liable for $50. As a matter of practice, the card companies don't charge me the $50, but that's a matter of practice, not of contract. Do I then have standing? No, not in a case against American Express. If you look at App 48, the district judge here found that American Express, the very card she pleaded, had a zero policy. She's got no plausible allegations in the record. Zero policy or a contract? I believe it's contractual, and I think the bigger... Ask the question. And Judge Calabresi, the bigger problem, I think, is both a pleading one and a spokio one. I think the provision you're pointing to is a provision in federal law. She hasn't pleaded that provision of federal law, one. She hasn't pleaded $50, two. Three, I think on these facts, it's inconceivable that there could ever be a $50, because she canceled the charge. And here we are three years on, and there's no other charge. Unless there are further questions on Article III standing, I'd like to turn to the implied contract briefly. I think this kind of implied contract, Judge Calabresi, would be remarkably sweeping. It would not just apply to data breaches. It's a completely unilateral, subjective expectation. It's the kind that I think this Court rejected on much stronger facts in the Doe v. Guthrie case. That's a case where a person went to a hospital and was treated, and an employee of the hospital disclosed that the person had a sexually transmitted disease. And this Court said, no implied contract claim under New York law there. Your remedy lies in tort. There's no facts here. And if anything, there's the opposite of facts. It's interesting that Ms. Whalen pleads regarding this PCI standard that she obliquely references, that Michaels and the card companies had an express contract to make that binding on them. It strikes me as inconceivable that my client, or really the way this complaint paints, every merchant, from the smallest bodega to the largest company, has guaranteed sub silencio to every consumer who uses a credit card that they're going to protect their data from any occurrence that occurs. And here it's worse yet, because there's no real allegation that Michaels did anything wrong. It's notable here. This complaint, when originally filed, had a negligence claim. They got rid of that negligence claim on time three, because there's no negligence here. All you have is an allegation on, I think it's app- The claim of negligence is res ipsa, which is a rather remarkable claim to make in contract. Right. Res ipsa is a torts doctrine, and I've never seen it applied in contract. Right. And then on the GBL claim, I think you've got it right. GBL isn't a negligence standard. It's a consumer protection claim. And here, this would be a pretty remarkable consumer protection claim, where the plaintiff identifies no representations to plaintiffs, neither representations on which material was omitted, or representations that had misrepresentations. So really what you end up with is a plaintiff essentially implying a duty of disclosure, precisely the kind of duty of disclosure that this court rejects in any range of context, securities law, GBL, so on and so forth. And it would be a pretty remarkable expansion of New York law. Thank you, Your Honors. Thank you. Mr. Ciprut. Following up, Judge, on your point about the $50 limit, in our complaint, actually, as counsel correctly points out, we don't expressly plead that our named plaintiff herself incurred $50 of losses for that reason. And the reason why she did not is because, in fact, she stopped the charges, or the bank was able to stop the charges before they posted to her account. So in her case, she didn't have only a $50 charge out of $1,000. It was more like zero out of zero. What we do plead, however, is that across the spectrum of the class members who had their information- She has to have standing. That's right. The rest of the class members. That's right. So therefore, in her case, the reason she has standing is because, well, first of all, under the Seventh Circuit's rationale, not that we're bound by that here, but even if there was no fraudulent charge in the first place, she would have already had standing by virtue of the fact that the breach occurred. She was one of the $3 million. That's the end of the analysis, according to the Seventh Circuit. If you go further- What? Because she was- a breach occurred. She was one of the $3 million. And on that basis, there's an imminent- She has standing. Is that what you're saying? I'm saying that the Seventh Circuit, in P.F. Chang's, said that is what leads to the imminent apprehension of harm. Data- Also, in Chang, didn't she spend money on credit monitoring? Yeah, that's- It didn't happen here? That's- no, that's exactly what did happen here. That's the other reason why she has standing is- I'm sort of trying to layer this for the court. So if you'll- Do you have an allegation that this plaintiff spent money on credit monitoring? Yes. Mitigation expenses. Yes, we do. And the point I'm trying to make, just to be crystal clear on this, is that under the Seventh Circuit's rule, should that be adopted here, we wouldn't even need the expenditure of mitigation expenses to have standing. I want to go back to my question. And that is, even though, in this case, she did not actually lose $50, at the time the card was stolen, the bank list, was she in danger of losing $50? Yes, she was. And more under the no-fault policy, which are policies that the cards have, because of which, on the facts of the case that happened after, she didn't lose it. But the question is, in terms of the breach, at the time of the breach, was she in imminent danger of losing $50? Yes, she was. And you rely on what for that proposition? That her card made her liable for- Are there terms in the record, terms of her contract with American Express? Because I understood also that there are cards that guarantee you that you will not have a deductible of some kind, a $50- Some do and some don't. I mean, it's a matter of- So is it in the record what the terms of this card were? We allege that as a matter of policy, American Express may have chosen to reimburse her, but as a matter of law, they were not required to do so. So you are saying that the policy of American Express would keep her from being in danger, but that is a policy that is not contractual? That's precisely correct. ...policy. The card, as far as American Express, they could be liable for $1,000 or $1,000,000. What limits it to $50 is the law, and the reason we have a law is that we don't rely on the policy. Yeah, that's correct. I'd still like to understand where in the record or in your allegations you say that the contract she had with American Express made her liable for $50, regardless of whether there was a policy later. Sure. What I'd like to do if I might on the citation points is because these are very specific questions for which I want to give the exact citation, not just paragraphs X through Y. With the court's indulgence, I'd like to submit a letter directing the court to the specific language in our pleadings in the record and the specific sites. What I must say, if I may, is that not only, following, Judge, your point, not only did we have this instance where the fraudulent transaction occurred, and at that moment it was not clear whether she'd be liable or not, that was the genesis of her decision to then spend money, actual out-of-pocket dollars, on mitigation expenses. Now, there has never been a data breach case to come up to a circuit court of appeals on those facts and then find the plaintiff did not have standing. Why don't you give us a letter, a two-page letter, I think you can do it very briefly, since this is just citations, on today's Tuesday. Can you do that by the end of the week? I certainly can. And then your opponent will have a couple of days to respond with a similar letter. I would like to have addressed both what the contract, what the card, whether the card had a 50, but also whether there is a policy by the card issuer and whether that policy is contractually valid or whether what limits the loss is the statute, which limits it to $50. So why don't we give you five pages? We will, thank you, Your Honor, we will address that. And I know I'm well past my time. May I have 10 seconds to just address one final point that my opponent brought up on rebuttal here? In response to the idea that Michael's never promised anything or never said to these people, we'll take certain precautions with your information. That's just flatly contrary to the allegations of the complaint. So sort of bringing us full circle today to Judge Calabresi's first point, under GBL 349, we expressly pled that there were specific misrepresentations and omissions made about the nature and full extent of the data breach after it closed, the failure to timely disclose the fact- What are you referring to or reading right now? Pardon? What are you reading from right now? My own notes, but I can give you a cite on this. It's appendix 10 to 11 and also page 31. Appendix 11 to 12, 28 to 31. These are the series of misrepresentations that we allege were in fact made by Michael's concerning the data breach. Now, counsel may get up here and say it's all wrong, but that's a fact question. We've pled it, and on that basis, we survived 12B6 at this stage. Thank you very much. I think we have your arguments. Mr. Joyce, you have reserved two minutes. I'll indulge the court on supplemental letters, but I'm not sure that's necessary here. $50 in losses isn't pleaded anywhere. We put in the record, and the district judge found, that Amex, as a policy or as a contract, however you want to call it, gives full reimbursement. And that's the end of the story for certainly impending imminence. The Seventh Circuit has held, said, whether it's holding or dicta, said that the fact of a policy does not counter the imminent danger to the other side. They said that. Prespokeo, Your Honor. I think the best that would come out of that is there would be this amorphous statutory claim that doesn't affect plaintiff here. Do you really want us to write an opinion that can look as if it is in conflict with the Seventh Circuit? No, Judge Calabresi. The facts are completely different from those before the Seventh Circuit. All you have here is a canceled credit card. And that's why all the parade of horribles about what could have happened just doesn't come to pass here. In both of those Seventh Circuit cases, you had plaintiffs without canceled credit cards. And in both of those Seventh Circuit cases, the court understood in the record that a broader set of data had been breached. Both cases talk about central data storage systems. This is almost as if not the POS system in the lower level downstairs had been breached, but your chambers' system, the way Second Circuit data is floating around and draft opinions are... I'm nervous. And so there's no allegation like that here. The only allegations, time and time again, are credit card numbers and names. And this is old technology going back to... I found cases going back to 1995 that you wrote, Your Honor, Judge Calabresi, United States v. Greenfield, one of your first cases on this court. You recognized in a... I forget the statutory provision. I'm sure you've seen more of these in 18 U.S.C. than anyone, Judge Amman. But all you need to breach a credit card number is to take it... To breach a credit card account is to take that magnetic strip data. You had a case where there was a phony ATM machine set up, and you recognized in that case people made new cards from it. That's what we've got here. But when you cancel the credit card, the bleeding has stopped. You can't do anything else. I can't... After the credit card is canceled... And here, Your Honor, the facts she pleaded were that she canceled it immediately. And that takes to the next point I'd like to make. This notion that there's some... Excuse me. What does immediately mean? Ms. Whalen pleads that there were charges, attempted charges on... No, no. She canceled it immediately when she learned that there had been a breach. No, before she had learned there had been a breach. She was asked, this is a good, I believe, month before a breach was announced. So let's... I want to get the timing straight on that. There was a breach. There was an attempt to charge. That's correct. And that was blocked because the attempt was so large and so on. And at that point, she canceled. That's correct. So that there was a period of time between the time that there was a breach and the time that she canceled, where if she was liable for any amount of a card, if she was, before she told... Before she told or canceled that she would have been liable for something. Yes, but I don't think those facts apply to Whalen. She didn't bring the claim in this interim period where there wasn't a canceled card. I'm not asking the question of whether she brought the claim. I am asking the narrower question of whether there is constitutional standing so that we can assume standing despite Chief Justice Scalia's opinion and go to 12b-6, which I hope I've indicated, I think is a very easy question. That's my only point. Not whether she pled it, not whether, but whether there was a time in which she was in danger of losing money, which is enough to constitute constitutional standing, the equivalent of jurisdiction, and therefore allows us to do something which we used to do all of the time until that unfortunate decision. And I think the answer, Judge Calabresi, is no under the particularization standards set forth in Spokio. I think what you're positing is that a different plaintiff existed and maybe there's some plaintiff out there who was at risk for some amount of time, but this plaintiff was not. At the very first opportunity to use her information, American Express caught it. So no, there was no risk. And even if Amex hadn't caught it, Amex had essentially absolved her of any risk through the policies that they had. I think the debit card cases are different. I think the cases... Yeah, the debit card cases are different. But let's assume that somebody had taken this card and bought peanuts for 37 cents. And American Express did not stop it because American Express wouldn't think of stopping it on that. And American Express chose, despite its policy, to charge her 37 cents. That's my question. I think that's standing. But the question at this point in time, on these facts was, was there any certainly impending possibility that Amex would do that, even if a charge had gone through? And I think that answer is no. If I could briefly just address the last point that I was starting to address before that dialogue with Judge Calabresi. There is nothing in the two paragraphs about Ms. Whalen, paragraph seven and eight, about mitigation expenses. There is a throwaway paragraph here to your question, on Act 23, paragraph 54, plaintiff and the class suffered additional damages based on the opportunity cost and value of time that plaintiff and the class have been forced to expend to monitor their financial and bank accounts as a result of the security breach. Such damages also include the cost of obtaining replacement credit and debit cards. There's no allegation that Ms. Whalen spent any of that money. This is an easy case on Iqbal Twombly grounds. And this is complaint three. She brought one before, I believe, Judge Spat dismissed that one. She brought one in Illinois, and now here we are again. And there's still no allegation as to Ms. Whalen. Thank you, Your Honor. We have the arguments. Thank you both. I just want to clarify. So we'll have, and we'll enter an order to this effect by end of the day Friday, five pages, or up to five pages, double-spaced from you on the allegations with regard to the $50. And we're in the record, the terms of that relationship are established. And then by the following, say, Wednesday. So Friday, Wednesday, is that okay? Any response you care to file at the same length. All right. Very good. Thank you very much. Very well argued. Our final case for today, United States v. Corley is on submission. The clerk will adjourn court.