Another data breach class action dismissed by the Second Circuit for lack of standing

Second Circuit

The Second Circuit affirmed the dismissal of a data breach class action for failing to sufficiently allege an injury to support standing.

By way of background. Plaintiff made purchases via credit card at a Michaels store. Later on, Michaels issued a press release saying that there had been a possible data breach of its system, apparently involving theft of customers’ credit card and debit card data.

Plaintiff filed a class action for breach of an implied contract and for violation of New York General Business Law § 349. The District Court dismissed Plaintiff’s claims for lack of standing, concluding that she “failed to allege a cognizable injury from the exposure of her credit card information following a data breach at one of Michaels’ stores”. As a result, the allegations in the complaint did not suffice to establish Article III standing for Plaintiff to pursue her claims, “because Whalen neither alleged that she incurred any actual charges on her credit card, nor, with any specificity, that she had spent time or money monitoring her credit”.

The Second Circuit affirmed the judgment of the District Court finding that Plaintiff alleged “no injury that would satisfy the constitutional standing requirements of Article III”.

Whalen v. Michaels Stores, Inc., No. 16-260 (L) (2d Cir. May 2, 2017) is available at…

For more information on data breach class actions cases in 2013, 2014, and 2015, see here.

For more information on Privacy and data protection, contact Francesca Giannoni-Crystal and Federica Romanelli of Crystal & Giannoni-Crystal, LLC. ( From our offices of New York, NY, Washington, DC and Charleston, SC we can advise privacy and European data protection (GDPR, “right to be forgotten”) and Privacy Shield. Our law firm can also advise clients and attorneys on the privacy implications (and problems) of  e-discovery.



Follow us on& Like us on