Case: Document: 13 Filed: 12/05/2014 Pages: 60. Case No UNITED STATES COURT OF APPEALS FOR THE SEVENTH CIRCUIT

Transcription

1 Case No UNITED STATES COURT OF APPEALS FOR THE SEVENTH CIRCUIT HILARY REMIJAS, on behalf of herself and all others similarly situated, et al., v. Plaintiffs-Appellants, THE NEIMAN MARCUS GROUP LLC, a Delaware limited liability company, Defendant-Appellee. Appeal from the United States District Court for the Northern District of Illinois, Case No. 1:14-cv-01735, Hon. James B. Zagel BRIEF OF DEFENDANT-APPELLEE THE NEIMAN MARCUS GROUP LLC David H. Hoffman Tacy F. Flint Daniel C. Craig SIDLEY AUSTIN LLP One South Dearborn Chicago, Illinois (312) Attorneys for Defendant-Appellee

2 Appellate Court No: Case: Document: 13 Filed: 12/05/2014 Pages: 60 CIRCUIT RULE 26.1 DISCLOSURE STATEMENT Short Caption: Remijas v. The Neiman Marcus Group, LLC To enable the judges to determine whether recusal is necessary or appropriate, an attorney for a non-governmental party or amicus curiae, or a private attorney representing a government party, must furnish a disclosure statement providing the following information in compliance with Circuit Rule 26.1 and Fed. R. App. P The Court prefers that the disclosure statement be filed immediately following docketing; but, the disclosure statement must be filed within 21 days of docketing or upon the filing of a motion, response, petition, or answer in this court, whichever occurs first. Attorneys are required to file an amended statement to reflect any material changes in the required information. The text of the statement must also be included in front of the table of contents of the party's main brief. Counsel is required to complete the entire statement and to use N/A for any information that is not applicable if this form is used. [ ] PLEASE CHECK HERE IF ANY INFORMATION ON THIS FORM IS NEW OR REVISED AND INDICATE WHICH INFORMATION IS NEW OR REVISED. (1) The full name of every party that the attorney represents in the case (if the party is a corporation, you must provide the corporate disclosure information required by Fed. R. App. P 26.1 by completing item #3): The Neiman Marcus Group LLC (2) The names of all law firms whose partners or associates have appeared for the party in the case (including proceedings in the district court or before an administrative agency) or are expected to appear for the party in this court: Sidley Austin LLP (3) If the party or amicus is a corporation: i) Identify all its parent corporations, if any; and Neiman Marcus Group LTD LLC ii) list any publicly held company that owns 10% or more of the party s or amicus stock: N/A Attorney's Signature: s/ David H. Hoffman 12/5/2014 Attorney's Printed Name: David H. Hoffman Date: Please indicate if you are Counsel of Record for the above listed parties pursuant to Circuit Rule 3(d). Yes No Address: Sidley Austin LLP One South Dearborn, Chicago, IL Phone Number: Address: Fax Number: david.hoffman@sidley.com rev. 01/08 AK

3 Appellate Court No: Case: Document: 13 Filed: 12/05/2014 Pages: 60 CIRCUIT RULE 26.1 DISCLOSURE STATEMENT Short Caption: Remijas v. The Neiman Marcus Group, LLC To enable the judges to determine whether recusal is necessary or appropriate, an attorney for a non-governmental party or amicus curiae, or a private attorney representing a government party, must furnish a disclosure statement providing the following information in compliance with Circuit Rule 26.1 and Fed. R. App. P The Court prefers that the disclosure statement be filed immediately following docketing; but, the disclosure statement must be filed within 21 days of docketing or upon the filing of a motion, response, petition, or answer in this court, whichever occurs first. Attorneys are required to file an amended statement to reflect any material changes in the required information. The text of the statement must also be included in front of the table of contents of the party's main brief. Counsel is required to complete the entire statement and to use N/A for any information that is not applicable if this form is used. [ ] PLEASE CHECK HERE IF ANY INFORMATION ON THIS FORM IS NEW OR REVISED AND INDICATE WHICH INFORMATION IS NEW OR REVISED. (1) The full name of every party that the attorney represents in the case (if the party is a corporation, you must provide the corporate disclosure information required by Fed. R. App. P 26.1 by completing item #3): The Neiman Marcus Group LLC (2) The names of all law firms whose partners or associates have appeared for the party in the case (including proceedings in the district court or before an administrative agency) or are expected to appear for the party in this court: Sidley Austin LLP (3) If the party or amicus is a corporation: i) Identify all its parent corporations, if any; and Neiman Marcus Group LTD LLC ii) list any publicly held company that owns 10% or more of the party s or amicus stock: N/A Attorney's Signature: Attorney's Printed Name: Tacy F. Flint s/ Tacy F. Flint 12/5/2014 Date: Please indicate if you are Counsel of Record for the above listed parties pursuant to Circuit Rule 3(d). Yes No Address: Sidley Austin LLP One South Dearborn, Chicago, IL Phone Number: Address: Fax Number: tflint@sidley.com rev. 01/08 AK

4 Appellate Court No: Case: Document: 13 Filed: 12/05/2014 Pages: 60 CIRCUIT RULE 26.1 DISCLOSURE STATEMENT Short Caption: Remijas v. The Neiman Marcus Group LLC To enable the judges to determine whether recusal is necessary or appropriate, an attorney for a non-governmental party or amicus curiae, or a private attorney representing a government party, must furnish a disclosure statement providing the following information in compliance with Circuit Rule 26.1 and Fed. R. App. P The Court prefers that the disclosure statement be filed immediately following docketing; but, the disclosure statement must be filed within 21 days of docketing or upon the filing of a motion, response, petition, or answer in this court, whichever occurs first. Attorneys are required to file an amended statement to reflect any material changes in the required information. The text of the statement must also be included in front of the table of contents of the party's main brief. Counsel is required to complete the entire statement and to use N/A for any information that is not applicable if this form is used. [ ] PLEASE CHECK HERE IF ANY INFORMATION ON THIS FORM IS NEW OR REVISED AND INDICATE WHICH INFORMATION IS NEW OR REVISED. (1) The full name of every party that the attorney represents in the case (if the party is a corporation, you must provide the corporate disclosure information required by Fed. R. App. P 26.1 by completing item #3): The Neiman Marcus Group LLC (2) The names of all law firms whose partners or associates have appeared for the party in the case (including proceedings in the district court or before an administrative agency) or are expected to appear for the party in this court: Sidley Austin LLP (3) If the party or amicus is a corporation: i) Identify all its parent corporations, if any; and Neiman Marcus Group LTD LLC ii) list any publicly held company that owns 10% or more of the party s or amicus stock: N/A Attorney's Signature: Attorney's Printed Name: Daniel C. Craig s/ Daniel C. Craig 12/5/2014 Date: Please indicate if you are Counsel of Record for the above listed parties pursuant to Circuit Rule 3(d). Yes No Address: Sidley Austin LLP One South Dearborn, Chicago, IL Phone Number: Address: Fax Number: dcraig@sidley.com rev. 01/08 AK

5 TABLE OF CONTENTS JURISDICTIONAL STATEMENT... 1 STATEMENT OF THE CASE... 2 I. Factual Background... 2 A. The Data Incursion... 2 B. Alleged Effects of the Data Incursion on Plaintiffs... 4 II. Procedural History... 6 SUMMARY OF ARGUMENT STANDARD OF REVIEW ARGUMENT I. THE COMPLAINT WAS CORRECTLY DISMISSED UNDER RULE 12(B)(1) BECAUSE PLAINTIFFS LACK ARTICLE III STANDING.. 14 A. Plaintiffs Have Alleged No Future Injury That Is Both Concrete and Imminent Plaintiffs Allegations of Future Fraudulent Charges Do Not Establish a Concrete Injury Plaintiffs Allegations of Future Identity Theft Do Not Establish an Imminent Injury a) The District Court Correctly Applied Clapper b) Pisciotta Does Not Support Standing Here c) The District Court Correctly Held That Plaintiffs Had Not Alleged That Any Identity Theft Was Certainly Impending B. Plaintiffs Have Alleged No Cognizable Present Injury Reimbursed Fraudulent Charges Do Not Constitute Present Injury i

6 2. Plaintiffs Overpayment Theory Finds No Support in the Law Allegations of loss of control and value of payment card data are insufficient to show injury Plaintiffs allegations that Neiman Marcus violated the California and Illinois data breach laws are insufficient to grant standing C. No Alleged Injury Can Be Fairly Traced to Action by Neiman Marcus II. IN THE ALTERNATIVE, THE COMPLAINT SHOULD BE DISMISSED UNDER RULE 12(B)(6) FOR FAILURE TO STATE A CLAIM CONCLUSION ii

7 TABLE OF AUTHORITIES CASES Page(s) Allison v. Aetna, Inc., 2010 WL (E.D. Pa. Mar. 9, 2010) Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046 (E.D. Mo. 2009) Apex Digital, Inc. v. Sears, Roebuck & Co., 572 F.3d 440 (7th Cir. 2009)... 13, 14 Ashcroft v. Iqbal, 556 U.S. 662 (2009) Askin v. Quaker Oats Co., 818 F.Supp.2d 1081 (N.D. Ill. 2011) Babbitt v. Farm Workers, 442 U.S. 289 (1979)... 16, 22 Bankers Trust Co. v. Mallis, 435 U.S. 381 (1978)... 1 Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007)... 42, 43 Boorstein v. CBS Interactive, Inc., 222 Cal. App. 4th 456 (2013) Bridenbaugh v. Freeman-Wilson, 227 F.3d 848 (7th Cir. 2000)... 33, 34 Camp v. TNT Logistics Corp., 553 F.3d 502 (7th Cir. 2009) Chicago Faucet Shoppe, Inc. v. Nestle Water N. Am. Inc., 2014 WL (N.D. Ill. Feb. 11, 2014) Clapper v. Amnesty Int l USA, 133 S. Ct (2013)... passim Cohen v. Facebook, Inc., 798 F.Supp.2d 1090 (N.D. Cal. 2011) iii

8 DaimlerChrysler Corp. v. Cuno, 547 U.S. 332 (2006) Federal Election Com n v. Akins, 524 U.S. 11 (1998) Frank v. Neiman Marcus Group, No.14-cv-233 (E.D.N.Y. Jan. 13, 2014) Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167 (2000)... 15, 16 Galaria v. Nationwide Mut. Ins. Co., 998 F. Supp. 2d 646, 2014 WL (S.D. Ohio Feb. 10, 2014) Goel v. Ramachandran, 975 N.Y.S.2d 428 (N.Y. App. Div. 2013) Hammond v. Bank of New York Mellon Corp., 2010 WL (S.D.N.Y. June 25, 2010)... passim Havens Realty Corp. v. Coleman 455 U.S. 363 (1982) HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 131 Ill.2d 145, 545 N.E.2d 672 (Ill. 1989) In re Adobe Sys., Inc. Privacy Litig., 2014 WL (N.D. Cal. Sept. 4, 2014)... 19, 28, 29 In re Aqua Dots Prods. Liab. Litig., 654 F.3d 748 (7th Cir. 2011) In re Barnes & Noble Pin Pad Litig., 2013 WL (N.D. Ill. Sept. 3, 2013)... 17, 30, 34, 35 In re Facebook Privacy Litig., 791 F.Supp.2d 705 (N.D. Cal. 2011), affirmed in part and reversed in part, 572 Fed. Appx. 494 (9th Cir. 2014)... 35, 36 In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518 (N.D. Ill. 2011) In re Sony Gaming Networks and Customer Data Sec. Breach Litig. F.Supp.2d, 2014 WL (S.D. Cal. Jan. 21, 2014) iv

9 Johnson v. Orr, 551 F.3d 564 (7th Cir. 2008) Kaplan v. Shure Bros., Inc., 153 F.3d 413 (7th Cir. 1998)... 1 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) Kwikset Corp. v. Super. Ct., 51 Cal.4th 310 (2011) Lipton v. Chattem, Inc., 2012 WL (N.D. Ill. Apr. 10, 2012) Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992)... 15, 16, 20, 36 Marbury v. Madison, 5 U.S. (1 Cranch) 137 (1803) Martis v. Pekin Mem l Hosp. Inc., 395 Ill. App. 3d 943 (2009) Maya v. Centex Corp., 658 F.3d 1060 (9th Cir. 2011) MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118 (2007) Minn-Chem, Inc. v. Agrium Inc., 683 F.3d 845 (7th Cir. 2012) Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139 (2010) Moyer v. Michaels Stores, Inc., 2014 WL (N.D. Ill. July 14, 2014)... 34, 36 Muir v. Playtex Prods. LLC, 983 F. Supp. 2d 980 (N.D. Ill. 2013) Navellier v. Sletten, 106 Cal. App. 4th 763 (2003) Pennell v. City of San Jose, 485 U.S. 1 (1988) v

10 People ex rel. Madigan v. United Const. of Am., 981 N.E.2d 404 (1st Dist. 2012) People To End Homelessness, Inc. v. Develco Singles Apartments Assocs., 339 F.3d 1 (1st Cir. 2003) Peterson v. Cellco P ship, 164 Cal.App.4th 1583 (Cal. Ct. App. 2008) Pisciotta v. Old Nat l Bancorp, 499 F.3d 629 (7th Cir. 2007)... 25, 26, 45, 46 Price v. Starbucks Corp., 192 Cal. App. 4th 1136 (2011)... 37, 38, 44 Reid L. v. Ill. St. Bd. Of Educ., 358 F.3d 511 (7th Cir. 2004) Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011)... 25, 30 Spencer v. Kemna, 523 U.S. 1 (1998)... 13, 14 Steel Co. v. Citizens for a Better Env t, 523 U.S. 83 (1998) Sterk v. Redbox Automated Retail LLC, 770 F.3d 618 (2014)... 36, 37 Storino v. Borough of Point Pleasant Beach, 322 F.3d 293 (3d Cir. 2003) Strautins v. Trustwave Holdings, Inc., 2014 WL (N.D. Ill. Mar. 12, 2014) Stutman v. Chem. Bank, 95 N.Y.2d 24 (2000) Summers v. Earth Island Inst., 555 U.S. 488 (2009) Susan B. Anthony List v. Driehaus, 134 S. Ct (2014)... passim United Phosphorus, Ltd. v. Angus Chem. Co., 322 F.3d 942 (7th Cir. 2003) vi

11 Vides v. Advocate Health & Hospitals Corp., No. 13-CH-2701 (9th Cir. May 27, 2014) Warth v. Seldin, 422 U.S. 490 (1975) Wesley-Jessen Inc. v. Reynolds, 1974 WL (N.D. Ill. May 23, 1974) Whitaker v. Ameritech Corp., 129 F.3d 952 (7th Cir. 1997) Whitmore v. Arkansas, 495 U.S. 149 (1990) Wilkins v. Williams, 991 N.E. 2d 308 (Ill. 2013) Yeftich v. Navistar, Inc., 722 F.3d 911 (7th Cir. 2013) STATUTES 28 U.S.C Cal. Civ. Code (d) Cal. Civ. Code (b) ILCS 505/ ILCS 530/ OTHER AUTHORITIES Fed. R. Civ. P. 12(b)(1)... passim Fed. R. Civ. P. 12(b)(6)... passim Fed. R. Civ. P U.S. Constitution, Article III... passim U.S. Constitution, 21st Amendment vii

12 JURISDICTIONAL STATEMENT Plaintiffs jurisdictional statement is not complete and correct. Plaintiffs correctly summarize their alleged grounds for federal subject matter jurisdiction in the district court, but the district court correctly held that it lacked subject matter jurisdiction and dismissed the action pursuant to Fed. R. Civ. P. 12(b)(1). Plaintiffs discussion of appellate jurisdiction in this Court is incomplete. Br Plaintiffs notice of appeal was filed on September 25, 2014 nine days after entry of the order dismissing plaintiff s First Amended Complaint ( FAC ) for lack of standing, but before the district court entered judgment in a separate document as required by Federal Rule of Civil Procedure 58. Despite the absence of a separate document entering judgment, this Court has appellate jurisdiction under 28 U.S.C See Bankers Trust Co. v. Mallis, 435 U.S. 381 (1978) (per curiam); Kaplan v. Shure Bros., Inc., 153 F.3d 413, 417 (7th Cir. 1998). First, the district court s order dismissing the FAC, from which plaintiffs appealed, clearly evidenced [that court s] intent that the opinion and order represented the final decision in the case. Id.; see also A10. Second, the clerk s docket indicated that the complaint was dismissed and stated that the case was terminated. A2. Finally, Defendant- Appellee The Neiman Marcus Group LLC ( Neiman Marcus ) did not object below, and does not object now, to plaintiffs taking this appeal in the absence of a separate judgment. Kaplan, 153 F.3d at 417. In these circumstances, appellate jurisdiction exists under 1291 notwithstanding the absence of a separate judgment. Id. 1

13 STATEMENT OF THE CASE I. FACTUAL BACKGROUND A. The Data Incursion This case stems from an attack on Neiman Marcus s information technology system. As the FAC discusses (FAC 30-32, R.27:11-12), 1 Neiman Marcus has described the data incursion in detail in communications to customers, postings to its website, and other public statements. 2 As those documents report, in mid- December 2013, Neiman Marcus received information that a relatively small number of cards used at Neiman Marcus subsequently had fraudulent charges placed on them. (Testimony of Michael Kingston before the Senate Judiciary Committee, at 2, 4-5, R.36-1:18, 20-21). Neiman Marcus immediately began an investigation and hired a leading forensic investigative firm, which first found evidence of potential malware in Neiman Marcus s system on January 1, (Id. at 2-3, R.36-1:18-19). In the next several days, Neiman Marcus took steps to discover, identify, analyze, and ultimately contain the cyber attack, which included disabling the malware that appeared capable of collecting or scraping information on payment cards used at certain Neiman Marcus stores. (Id. at 2-5, R.36-1:18-21). On January 10, the company made several public announcements regarding the 1 References to R. : refer to the docket number and page number of items filed as part of the district court record. 2 The FAC specifically identifies one of Neiman Marcus s two website postings (see FAC 32 33, 42, R.27:11 13) and relies on it as the source of certain allegations. The website postings are located at R.36-1:5 15. The testimony of Neiman Marcus s Chief Information Officer before the U.S. Senate Judiciary Committee on the subject of this cyber attack, which was made public prior to the initial filing of plaintiffs complaint, is located at R.36-1:

14 incursion and gave individual notification to those customers known to Neiman Marcus who had received fraudulent charges on their cards after the incursion. (Id. at 3, 7, R.36-1:19, 23). In postings to its website on January 16, January 22, and February 21, Neiman Marcus provided a detailed public update regarding its forensic investigation. (Id. at 7-8, R.36-1:23-24, see also Neiman Marcus Group, To our Loyal Neiman Marcus Group Customers, R36-1:11-15). Neiman Marcus confirmed that while some payment cards had been exposed to the malware, social security numbers and birth dates were not and PINs were never at risk because we do not use PIN pads in our stores. (See Neiman Marcus Group, To our Loyal Neiman Marcus Group Customers, R.36-1:5.) Neiman Marcus also identified the period during which the malware appeared to have been attempting to collect payment card data from July 16 to October 30, (Id.) It stated that 350,000 cards were potentially exposed to the malware, but did not state or suggest that any of the 350,000 cards were actually compromised. (See id., R.36-1:11). Neiman Marcus explained that approximately 9,200 payment cards potentially exposed to the malware were known to have been subsequently used fraudulently elsewhere. (Id.). Nothing in the company s statements, however, indicated that the payment card data from those 9,200 cards had actually been stolen from Neiman Marcus, or that the fraudulent charges occurred as a result of the Neiman Marcus data incursion. (Id.) Indeed, several other companies, including Target, had also suffered data incursions potentially impacting millions of 3

15 credit cards. (R.36:16 & n.10.) The company explained that, out of an abundance of caution, it was notifying ALL customers for whom [it has] addresses or who shopped with [the company] between January 2013 and January 2014, and offering one free year of credit monitoring and identity-theft protection. (R.36-1:5). Neiman Marcus also reminded customers that [t]he policies of the payment card brands such as Visa, MasterCard, American Express, Discover and the Neiman Marcus card provide that you have zero liability for any unauthorized charges if you report them in a timely manner. (Id.). On February 4, 2014, Michael Kingston, Senior Vice President and Chief Information Officer for the Neiman Marcus Group, testified along with representatives from Target and other groups before the United States Senate Judiciary Committee, and submitted written testimony that was made public. (Testimony of Michael Kingston before the Senate Judiciary Committee, R.36-1:17). In his written testimony he stated that the customer information that was potentially exposed to the malware was payment card account information and that there is no indication that social security numbers or other personal information were exposed in any way. (Id. at 3, R.36-1:19). B. Alleged Effects of the Data Incursion on Plaintiffs Plaintiffs allege that they made purchases at Neiman Marcus while the data incursion was in effect. Plaintiff Hilary Remijas alleged that she made purchases using a Neiman Marcus credit card at a Neiman Marcus store in August and December (FAC 3, R.27:3). She did not allege that any fraudulent charges were made using this card, or that any such charges were unreimbursed. (Id.). Ms. 4

16 Remijas did not allege that she provided any personally-identifiable information to Neiman Marcus other than her payment card information. (Id.). Plaintiff Melissa Frank alleged that she and her husband made purchases at a Neiman Marcus store and online in December 2013 using a debit card. (FAC 4, R.27:3). She further alleged that fraudulent charges appeared on her debit card on January 9, 2014 (Id.), but did not allege that this charge was unreimbursed. She alleged that her husband received a letter from Neiman Marcus regarding the incursion in January (Id.). On January 13, 2014, she filed a complaint against Neiman Marcus in the Eastern District of New York, in which she alleged that she experienced fraudulent charges on her debit card. (R.36:24). In the FAC, she alleged that in mid-march 2014, approximately two months after she filed her initial complaint, she received a telephone call in which a caller, aware that her debit card had been canceled, attempted to convince her to provide additional payment card information. (FAC 5, 51. R. 27:3, 15). She did not allege that she provided any such information to the caller. (Id.). She did not allege that she or her husband provided personally-identifiable information other than their payment card information to Neiman Marcus. (Id.). Plaintiff Debbie Farnoush alleged that she made a purchase using a payment card at a Neiman Marcus store in 2013, but did not specify a date. (FAC 5, R.27:3). She alleged that fraudulent charges appeared on her credit card but did not allege that these charges were unreimbursed. (Id.). She did not state whether or not she received any notice regarding the incursion from Neiman Marcus. (Id.). 5

17 She did not allege that she provided personally-identifiable information other than her payment card information to Neiman Marcus. (Id.). Plaintiff Joanne Kao alleged that she made several purchases at a Neiman Marcus store on several dates between February and December (FAC 6, R.27:3). She did not allege that she used a payment card to make any of these purchases. (Id.). She alleged that she received notice from her bank that her debit card had been compromised, but did not allege that she had used that debit card at a Neiman Marcus store. (Id.). She alleged that she received a letter from Neiman Marcus regarding the incursion. (Id.). She did not allege that she provided personally-identifiable information other than her payment card information to Neiman Marcus. II. PROCEDURAL HISTORY The FAC, which consolidated putative class action claims asserted by multiple named plaintiffs, was filed on June 2, (R.27). The FAC asserts six counts and seeks a variety of injunctive relief and damages, including actual damages, compensatory damages, statutory damages, and statutory penalties, as well as punitive damages. (FAC Prayer for Relief, R.27:36). Neiman Marcus moved to dismiss the FAC for lack of standing under Rule 12(b)(1), and for failure to state a claim under Rule 12(b)(6), on July 2, (R.35). Neiman Marcus submitted evidence in support of its arguments against standing, and plaintiffs opposition did not purport to contradict any of that evidence, relying solely on the allegations of the FAC. The district court granted Neiman Marcus s motion on September 16, 2014, holding that plaintiffs lacked standing because they 6

18 failed to establish injury-in-fact. (A3). The court first explained that plaintiffs had the burden to establish Article III standing, and were thus required to demonstrate, inter alia, an injury in fact that is concrete and particularized and either actual or imminent. (Id.). Here, [p]laintiffs assert[ed] four principal categories of injury : (1) an increased risk of future fraudulent credit card charges, and an increased risk of identity theft ; (2) present injuries, including the loss of time and money associated with resolving fraudulent charges and protecting against the risk of future identity theft ; (3) the financial loss they suffered from having purchased products that they wouldn t have purchased had they known of Defendant s misconduct ; and (4) loss of control over value of their private information. (Id.). Regarding plaintiffs alleged future harms, the court noted that [a]llegations of future potential harm may suffice to establish Article III standing, but the future harm must be certainly impending. (A3-4 (quoting Clapper v. Amnesty Int l USA, 133 S. Ct. 1138, 1147 (2013))). The court concluded that the FAC (1) permits the inference that [the 9,200 Neiman Marcus customers who experienced fraudulent charges on their credit cards] did indeed have their data stolen as a result of the cyber-attack on Defendant, and (2) permits a weaker, though in [the court s] view still plausible, inference that others among the 350,000 customers are at a certainly impending risk of seeing similar fraudulent charges appear on their credit cards as a result of the cyber-attack on Defendant. (A6). But, even if plaintiffs could be said to satisfy the imminence requirement of injury-in-fact, the fraudulent charges 7

19 on certain plaintiffs credit cards still did not support standing because the purported injury was not sufficiently concrete : Plaintiffs have not alleged that any of the fraudulent charges were unreimbursed. On these pleadings, I am not persuaded that unauthorized credit card charges for which none of the plaintiffs are financially responsible qualify as concrete injuries. (A7). The court also held that the other potential future harm alleged by plaintiffs identity theft was insufficient to establish standing, because the court was not persuaded that the 350,000 customers at issue are at a certainly impending risk of identity theft. (Id.). While the court declared itself willing to accept the inference that additional customers are at a certainly impending risk of future fraudulent charges on their credit cards, it concluded that to assert on this basis that either set of customers is also at a certainly impending risk of identity theft is a leap too far. (A7-8). Plaintiffs argument that injury-in-fact was established through the risk of future identity theft, therefore, failed to satisfy the requirement of imminence. (Id.). The court next turned to plaintiffs claim that the time and money allegedly spent toward mitigating the risk of future fraudulent charges and identity theft constitutes injury sufficient to confer standing. (A8). That argument failed. The court reiterated that [t]he fraudulent charge injury, absent unreimbursed charges or other allegations of some attendant hardship, is not in my view sufficiently concrete to establish standing, and explained that the complaint contains no meaningful allegations as to what precisely the costs incurred to mitigate the risk of 8

20 future fraudulent charges were. (Id.). And, because the complaint does not adequately allege that the risk of identity theft is sufficiently imminent to confer standing, the time and money spent to mitigate claim as to the risk of identity theft is not a cognizable Article III injury. (A8-9). The court then rejected plaintiffs argument that they were injured by paying a supposed premium for retail goods purchased at Defendant s stores, a portion of which Defendant was required to allocate to adequate data breach security measures. (A9). The court noted that this type of harm exists only when the product purchases possessed some sort of deficiency not when the deficiency complained of is extrinsic to the product being purchased. (Id.). The court cited the example of a store that allegedly had inadequate in-store security, which led to a customer being assaulted in the parking lot: even if no physical injury actually befell the customer, under Plaintiffs theory, the customer still suffered financial injury because he or she paid a premium for adequate store security, and the store security was not in fact adequate. (A9-10). The court deemed this theory of injury, which was unsupported by precedent, to be creative, but unpersuasive. (A9). Finally, the court rejected Plaintiffs claim to standing based on the loss of control over and value of their private information. Again, the injury as pled is not sufficiently concrete. A10. For all these reasons, Neiman Marcus s motion to dismiss for lack of Article III standing was granted. Id. Having determined that jurisdiction was lacking, the court did not address Neiman Marcus s argument that the complaint was equally 9

21 subject to dismissal for failure to state a claim. SUMMARY OF ARGUMENT Plaintiffs allege that they are among the 350,000 customers who purchased items at Neiman Marcus while Neiman Marcus was subject to an information security attack, in which certain customers payment card data was exposed. But plaintiffs have not met their burden to establish an injury that is both concrete and actual or imminent, not to mention an injury that is traceable to Neiman Marcus. The district court was thus correct to dismiss the FAC for lack of Article III standing. Plaintiffs principally argue that they have adequately shown future injuries. For one, they contend that some of them have experienced fraudulent charges on their credit and debit cards, and this shows they are at an increased risk of seeing fraudulent charges on their cards in the future. Even accepting for the moment that plaintiffs have established that any fraudulent charges occurred as a result of the Neiman Marcus data incursion (which they have not), plaintiffs cannot show how any fraudulent charge will injure them. That is because as plaintiffs do not dispute their fraudulent charges are uniformly and fully reimbursed. In other words, even if plaintiffs are subjected to such charges in the future, they will face zero out-of-pocket costs. As the district court correctly held, an effect that entails no loss whatsoever is not a concrete injury for purposes of Article III. Plaintiffs also contend that they have shown future injury by pointing to the specter of identity theft. But plaintiffs have failed to make any factual showing as to how the data incursion in which there is no indication that anything more than 10

22 payment card data was even potentially exposed will lead to imminent identity theft, as they are required to do. The only actual fact that plaintiffs point to i.e., that some Neiman Marcus customers saw fraudulent charges on their credit and debit cards at some point after the data incursion is at most consistent with the fact that the incident involved payment card data, and not the more sensitive personal identifying information that could be used to open an account or for other forms of identity theft. Indeed, unlike sensitive personal data, such as social security numbers, payment card data is routinely disclosed to waiters, websites, and many others. Yet plaintiffs have not even alleged that they provided personal identifying information beyond their payment card data to Neiman Marcus much less facts showing that their personal information was exposed, stolen, or misused. Simply put, the fact of fraudulent charges does not bear the weight plaintiffs place on it. Even if plaintiffs had alleged that their payment card data was actually obtained by fraudsters through the Neiman Marcus data incursion (which plaintiffs did not, in fact, allege), that would not support a conclusion that they suddenly face certainly impending identity theft, as the Supreme Court has held is necessary if standing is to be established solely by reliance on future injuries. See Clapper, 133 S. Ct. at Plaintiffs arguments of present or actual injuries likewise fail. First, plaintiffs contend that they have spent time and money to protect themselves against identity theft and to ensure that fraudulent charges are resolved. But, as the Supreme Court has held, plaintiffs cannot manufacture standing by spending 11

23 money to supposedly prevent potential injuries that do not create standing in their own right. Id. at And plaintiffs have alleged no facts regarding the supposed costs of resolving fraudulent charges. Second, plaintiffs contend that they were injured by overpaying to purchase items from Neiman Marcus when they were not aware that Neiman Marcus was susceptible to a data incursion. This theory which the district court called creative, but unpersuasive, A9 finds no support in the law, and simply makes no sense. Plaintiffs cannot contend that the products they purchased were in any way defective or worth less than the price they paid, which defeats any overpayment theory. Third, Plaintiffs contention that they were injured through the supposed loss of control over their personal data is simply a rehash of their other arguments, because plaintiffs cannot allege that their personal data had some monetary value that they were prevented from realizing. Finally, plaintiffs argument that they have statutory standing under California and Illinois state laws ignores both that injury-in-fact is a federal constitutional requirement that no state law could eliminate, and that, in any event, neither California nor Illinois state law purports to create statutory standing. Additionally, plaintiffs have equally failed to establish standing because they have alleged no facts to show that any effects on them are traceable to Neiman Marcus. All plaintiffs can say is that some of them have experienced reimbursed fraudulent charges, and one received an unsuccessful phishing call. But the only 12

24 fact that suggests these alleged events are traceable to Neiman Marcus is their timing i.e., that they occurred after the data incursion. But they also occurred after large-scale breaches of other retailers data, and the FAC is silent as to whether the plaintiffs gave payment card data to any such retailer. And the allegations regarding the phishing call to Ms. Frank actually make clear that the caller had access to data that could not have come from Neiman Marcus. For all of these reasons, plaintiffs lack Article III standing, and the FAC was properly dismissed under Rule 12(b)(1). Even if the Court were to disagree, however, the district court s judgment can be affirmed on the alternate ground, equally supported in the record, that plaintiffs have failed to state a claim under Rule 12(b)(6). Each legal theory that plaintiffs advance in their six counts requires them to establish compensable injury. The FAC fails to do that. Thus, whether it be under Rule 12(b)(1) or Rule 12(b)(6), the FAC was properly dismissed. STANDARD OF REVIEW This Court review[s] de novo a district court s dismissal for lack of subject matter jurisdiction. Apex Digital, Inc. v. Sears, Roebuck & Co., 572 F.3d 440, 443 (7th Cir. 2009). When judging a motion to dismiss for lack of standing under Rule 12(b)(1), the Court must accept as true all material allegations of the complaint... unless standing is challenged as a factual matter. Reid L. v. Ill. St. Bd. Of Educ., 358 F.3d 511, 515 (7th Cir. 2004). The plaintiff s standing may not, however, be inferred argumentatively from averments in the pleadings. Spencer v. Kemna, 523 U.S. 1, 10 (1998) (internal quotation marks omitted). [I]t is the burden of the party who seeks the exercise of jurisdiction in his favor, clearly to allege facts 13

25 demonstrating that he is a proper party to invoke judicial resolution of the dispute. Id. at 11 (internal quotation marks omitted). Where a party raises the issue of subject matter jurisdiction, a court need not simply rely on the facts alleged in the complaint, but also may consider extrinsic evidence to determine whether it can exercise jurisdiction. Johnson v. Orr, 551 F.3d 564, 567 (7th Cir. 2008). Once a defendant produces evidence calling plaintiff s standing into question, the presumption of correctness that [courts] accord to a complaint s allegations falls away, and the plaintiff bears the burden of coming forward with competent proof that standing exists. Apex Digital, 572 F.3d at 444 (internal citation and quotation marks omitted); see also United Phosphorus, Ltd. v. Angus Chem. Co., 322 F.3d 942, 946 (7th Cir. 2003) (where the contention is that there is in fact no subject matter jurisdiction, the movant may use affidavits and other material to support the motion ; the court is free to weigh th[at] evidence to determine whether jurisdiction has been established. ), overruled on other grounds by Minn-Chem, Inc. v. Agrium Inc., 683 F.3d 845 (7th Cir. 2012). ARGUMENT I. THE COMPLAINT WAS CORRECTLY DISMISSED UNDER RULE 12(B)(1) BECAUSE PLAINTIFFS LACK ARTICLE III STANDING. Plaintiffs lack Article III standing to bring their claims in federal court. As a jurisdictional requirement, the plaintiff bears the burden of establishing standing. Apex Digital, Inc., 572 F.3d at 443. To meet this burden, a plaintiff must show (1) it has suffered an injury in fact that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the 14

26 injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, (2000); accord Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334, 2341 (2014); Clapper, 133 S. Ct. at 1147; Lujan v. Defenders of Wildlife, 504 U.S. 555, (1992) (describing these elements as the irreducible constitutional minimum of standing ). Article III: The requirement that a plaintiff establish injury in fact lies at the heart of In limiting the judicial power to Cases and Controversies, Article III of the Constitution restricts it to the traditional role of Anglo-American courts, which is to redress or prevent actual or imminently threatened injury to persons caused by private or official violation of law. The doctrine of standing is one of several doctrines that reflect this fundamental limitation. It requires federal courts to satisfy themselves that the plaintiff has alleged such a personal stake in the outcome of the controversy as to warrant his invocation of federal-court jurisdiction. This requirement assures that there is a real need to exercise the power of judicial review in order to protect the interests of the complaining party. Summers v. Earth Island Inst., 555 U.S. 488, (2009) (citations and internal quotation marks omitted; emphasis in original); see also Warth v. Seldin, 422 U.S. 490, (1975) (to establish standing, a plaintiff must show such a personal stake in the outcome of the controversy as to warrant his invocation of federal-court jurisdiction and to justify exercise of the court s remedial powers on his behalf. The Art. III judicial power exists only to redress or otherwise to protect against injury to 15

27 the complaining party ) (citations and internal quotation marks omitted); Susan B. Anthony List, 134 S. Ct. at 2341 ( the injury-in-fact requirement helps to ensure that the plaintiff has a personal stake in the outcome of the controversy ). For that reason, the plaintiff cannot establish standing by merely theorizing about potential injuries. To the contrary, the plaintiff must establish that her claimed injury is concrete and particularized. Lujan, 504 U.S. at 560. If the plaintiff s claim of injury is insufficiently concrete, then standing does not lie. See, e.g., Whitaker v. Ameritech Corp., 129 F.3d 952, 959 (7th Cir. 1997) ( Whitaker wishes us to eradicate Ameritech s allegedly unlawful practices; yet, she alleges no facts to show how these practices have injured her. We cannot address Whitaker s grievance with Ameritech as she has received no injury, and therefore has no standing. ) (citation and internal quotation marks omitted). The alleged injury must also be actual or imminent, not conjectural or hypothetical. Lujan, 504 U.S. at 560 (citations and internal quotation marks omitted). This requirement has particular significance where the plaintiff claims future injury. The Supreme Court has repeatedly reiterated that threatened injury must be certainly impending to constitute injury in fact, and that [a]llegations of possible future injury are not sufficient. Clapper, 133 S. Ct. at 1147 (quoting Whitmore v. Arkansas, 495 U.S. 149, 158 (1990); citing Lujan, 504 U.S. at 565 n.2; DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 341 (2006); Laidlaw, 528 U.S. at 190; Babbitt v. Farm Workers, 442 U.S. 289, 298 (1979)) (brackets and emphases in original). A possible injury does not satisfy Article III even if there is 16

28 an objectively reasonable likelihood that it will occur: an objectively reasonable likelihood standard is inconsistent with [the] requirement that threatened injury must be certainly impending to constitute injury in fact. Clapper, 133 S. Ct. at Any potential injury that is premised on a speculative chain of possibilities does not satisfy Article III. Id. at Here, as set forth below, none of the forms of injury that plaintiffs allege satisfies Article III. For these reasons, plaintiffs have failed to establish the requisite injury in fact to show jurisdiction. A. Plaintiffs Have Alleged No Future Injury That Is Both Concrete and Imminent. 1. Plaintiffs Allegations of Future Fraudulent Charges Do Not Establish a Concrete Injury. Courts considering data incursion cases are united in determining that fraudulent charges that appear on a cardholder s account do not constitute injury if the cardholder is reimbursed for those charges. (A7 ( unauthorized credit card charges for which none of the plaintiffs are financially responsible [do not] qualify as concrete injuries ); In re Barnes & Noble Pin Pad Litig., No. 12-cv-8617, 2013 WL , at *6 (N.D. Ill. Sept. 3, 2013) (plaintiff claiming only reimbursed fraudulent charge has not pled that actual injury resulted and that she suffered any monetary loss due to the fraudulent charge ); In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 527 (N.D. Ill. 2011) ( Plaintiffs suffered no actual injury if Plaintiffs were reimbursed for all unauthorized withdrawals and bank fees and, thus, suffered no out-of-pocket losses ); Hammond v. The Bank of New York 17

29 Mellon Corp., No. 08 Civ. 6060(RMB)(RLE), 2010 WL , at *8 (S.D.N.Y. 2010) (no injury where plaintiffs were reimbursed for the unauthorized charges )). The reasoning in these cases is straightforward. When a fraudulent charge is assigned to a credit card account, but the cardholder is not required to pay or is reimbursed for the charge, the cardholder suffers no adverse effect and therefore no injury. This is particularly clear if one considers how such an injury could be redressed. It couldn t because the charge has already been reimbursed. There is no injury capable of redress. See People To End Homelessness, Inc. v. Develco Singles Apartments Assocs., 339 F.3d 1, 9 (1st Cir. 2003) (no standing where plaintiff s alleged injuries, to the extent they can be redressed, have already been remedied ). For that reason, the district court was right to conclude that no reimbursed fraudulent charge whether it has already occurred or may occur in the future can support standing. (A7). This principle has force in this case because the allegations and evidence here confirm that no plaintiff has suffered, or has any likelihood of suffering, unreimbursed fraudulent charges. One plaintiff, Remijas, has not alleged that she saw any unauthorized charges on any of her accounts, much less that she was held responsible for any such charges. The three other plaintiffs allege that they experienced unauthorized charges, but none alleges that such charges were unreimbursed. (See A7 ( as common experience might lead one to expect, Plaintiffs have not alleged that any of the fraudulent charges were unreimbursed )). Moreover, plaintiffs do not and cannot dispute that credit card issuers uniformly 18

30 have zero-liability policies for fraudulent charges. See, e.g., Chase Debit Cards Website, ( Chase reimburses you for any unauthorized card transaction made at stores, ATMs, on the phone or online when reported promptly. ). Thus, even if plaintiffs allegations permitted an inference that plaintiffs will be subject to fraudulent charges in the future, plaintiffs have offered no allegation or evidence to support the notion that any such charge would go unreimbursed. Plaintiffs offer no meaningful argument to the contrary. They contend that the District Court did not cite any authority for its requirement that plaintiffs in such cases allege unreimbursed fraudulent charges in order to have standing. Br. 16. That is false. (See A7 (citing cases for the proposition that reimbursed fraudulent charges are not concrete injuries )). To the contrary, it is plaintiffs who cite no authority for the proposition that reimbursed fraudulent charges do constitute concrete injuries. Plaintiffs also contend that the district court s requirement that charges be unreimbursed to constitute injury flies in the fact of established precedent that plaintiffs should not be require[d] to wait until they actually suffer identity theft or [unreimbursed] credit card fraud in order to have standing. Br. 16 (brackets in original) (quoting In re Adobe Sys., Inc. Privacy Litig., No. 13 CV LHK, 2014 WL , at *8 (N.D. Cal. Sept. 4, 2014)). Here, however, plaintiffs conflate two issues: concreteness and imminence. The district court accepted plaintiffs argument that the potential future fraudulent charges are 19

31 sufficiently imminent for purposes of standing. (A7). It held that standing was nonetheless not established because the only possible inference from the evidence and allegations was that those fraudulent charges would be reimbursed consistent with credit card issuers uniform policies, such that no concrete injuries would result. (Id.). Plaintiffs cite no allegation or evidence to the contrary here. Nor could they. Indeed, at least two of the plaintiffs have already eliminated any prospect of future charges by canceling the allegedly compromised payment cards (FAC 51, 54 R.27:15), and the others could just as easily do the same. 2. Plaintiffs Allegations of Future Identity Theft Do Not Establish an Imminent Injury. Plaintiffs again fail to confront both the district court s reasoning and binding law in arguing that they established standing by alleging future identity theft. While the district court was willing to entertain an inference Neiman Marcus customers faced an imminent risk of fraudulent charges on their payment cards, it held that inferring from that fact that plaintiffs would suffer identity theft was a leap too far. (A8). Nothing in plaintiffs brief is to the contrary. a) The District Court Correctly Applied Clapper. Plaintiffs principal argument is that the district court imposed too stringent of an imminence requirement because it supposedly misinterpreted Clapper. Br In Clapper, the Supreme Court explained: Although imminence is concededly a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that the alleged injury is not too speculative for Article III purposes that the injury is certainly 20

32 impending. [Lujan, 504 U.S.] at 565 n. 2 (internal quotation marks omitted). Thus, we have repeatedly reiterated that threatened injury must be certainly impending to constitute injury in fact, and that [a]llegations of possible future injury are not sufficient. 133 S. Ct. at 1147 (emphases in original). The district court followed Clapper here, holding that plaintiffs were required to show certainly impending identity theft a showing they could not make. See A7-8. Plaintiffs argue that the court should instead have asked whether there is a substantial risk of identity theft. Br Plaintiffs cite Susan B. Anthony List and footnote 5 of Clapper which acknowledged that [i]n some instances, [the Supreme Court has] found standing based on a substantial risk that the harm will occur. Clapper, 133 S. Ct. at 1150 n.5; see also Susan B. Anthony List, 134 S. Ct. at 2341 (citing footnote 5 of Clapper). Plaintiffs argue that the district court erred when it applied Clapper s clearly impending standard because it supposedly ignored footnote 5 of the Clapper decision and Susan B. Anthony List. Br. 10. Plaintiffs argument goes nowhere. Susan B. Anthony List and several other cases 3 that use the substantial risk formulation have addressed when standing exists to bring a pre-enforcement challenge to a law. See Susan B. Anthony List, 3 In Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139 (2010), the Court examined whether farmers of conventional and organic alfalfa had standing to challenge an agency action that had created a substantial risk that the genes of genetically modified alfalfa would infiltrate their plants. As the Court explained, the substantial risk of gene flow caused present, not future, injury to the farmers because, inter alia, it rendered them unable to market their product as nongenetically-engineered without testing confirming that fact. Thus, the Court did not have to assess whether gene flow was certainly impending or not: the plaintiffs would suffer the harm complained of even if their crops are not actually infected with the Roundup ready gene. Id. at