On May 23, 2017, in Whalen v. Michaels Stores, Inc., the United States Court of Appeals for the Second Circuit issued a summary order affirming the district court’s dismissal of a putative data breach class action based on lack of Article III standing.

As background, the named plaintiff Mary Jane Whalen made credit card purchases at a Michaels stores in 2013.  In 2014, Michaels suffered a data breach of its systems.  Whalen’s credit card was thereafter allegedly presented for a payment to a gym in Ecuador. Whalen did not allege that any fraudulent charges were actually incurred on the card, or that she was in any way liable for the fraudulent presentations.

The United States District Court for the Eastern District of New York originally dismissed the putative class action complaint, holding that Whalen did not allege facts sufficient to establish Article III standing “because Whalen neither alleged that she incurred any actual charges on her credit card, nor, with any specificity, that she had spent time or money monitoring her credit.”  The Second Circuit agreed.

“Whalen does not allege a particularized and concrete injury suffered from the attempted fraudulent purchases,” held the Second Circuit.  For instance, Whalen was never “asked to pay, nor did pay, any fraudulent charge.  And she does not allege how she can plausibly face a threat of future fraud, because her stolen credit card was promptly canceled after the breach and no other personally identifying information . . . is alleged to have been stolen.”  Whalen’s Complaint also did not allege any “specifics about any time or effort that she herself has spent monitoring her credit.”  Without any such allegations, the Second Circuit found that Whalen “has alleged no injury that would satisfy the constitutional standing requirements of Article III, and her claims were properly dismissed.”