District Court Properly Granted Defense Motion for Judgment in Class Action Alleging Theft of Personal Information and Seeking Damages for Cost of Monitoring Credit Reports Because Class Action Complaint Failed to Allege Compensable Damages under Indiana Law Seventh Circuit Holds
Plaintiffs filed a putative class action against Old National Bancorp, which operates a website that permits people to complete applications online for loans and other banking services, alleging that the Bank had obtained personal information from consumers through its website but “failed to secure it adequately” thus permitting a hacker “to obtain access to the confidential information of tens of thousands of [Bank] site users.” Pisciotta v. Old National Bancorp, 499 F.3d 629, 631 (7th Cir. 2007). According to the class action allegations, the online application forms “differ depending on the service requested, but some forms require the customer or potential customer’s name, address, social security number, driver’s license number, date of birth, mother’s maiden name and credit card or other financial account numbers.” Id. The class action complaint sought relief in the form of “compensation for past and future credit monitoring services that they have obtained in response to the compromise of their personal data,” id. Notably, the class action did not allege that any class member had suffered “direct financial loss…as a result of the breach” or that any putative class member had suffered identity theft as a result of the breach, id., at 632. Defense attorneys attacked the class action with a motion for judgment on the pleadings, arguing that under Indiana law plaintiffs had failed to allege any cognizable injury, id. The district court agreed with the defense and dismissed the class action, id., at 631. The Seventh Circuit affirmed.
The class action complaint alleged that plaintiffs had entered personal information on the Bank’s website, and that in 2005 NCR, a website host, informed the Bank of a security breach that, in the words of the Seventh Circuit, “was sophisticated, intentional and malicious.” Pisciotta, at 631-32. Nonetheless, in granting the defense motion for judgment on the class action complaint, the district court held that plaintiffs failed to allege that the security breach “caused them cognizable injury” because “under Indiana law, damages must be more than speculative” so “plaintiffs’ allegations that they had suffered ‘substantial potential economic damages’ did not state a claim.” Id., at 632 (italics added). The Circuit Court affirmed.
Reviewing the district court’s order de novo, see Pisciotta, at 633, and after agreeing that federal court jurisdiction existed under the Class Action Fairness Act of 2005 (CAFA), see id., at 633-34, the Seventh Circuit turned to the issue of the availability of credit monitoring damages under Indiana law. And because no Indiana case law directly on point exists, the Circuit Court sought to anticipate the decision the Indiana Supreme Court would reach if confronted with this issue, id., at 634. According to the Circuit Court, “We must determine whether Indiana would consider that the harm caused by identity information exposure, coupled with the attendant costs to guard against identity theft, constitutes an existing compensable injury and consequent damages required to state a claim for negligence or for breach of contract.” Id., at 635 (italics in original). Moreover, the Court observed that “the plaintiffs must come forward with some authority to support their view that they have a right to the relief they seek because, as we have stated, we have ‘limited discretion…with respect to untested legal theories brought under the rubric of state law.’” Id., at 635 (italics in original) (citation omitted).
Based on its analysis of statutory and decisional law, the Seventh Circuit concluded that Indiana law “would not recognize the costs of credit monitoring that the plaintiffs seek to recover in this case as compensable damages.” Pisciotta, at 637. The Seventh Circuit also examined the decisions of other state courts that had addressed this issue and found that “several district courts, applying the laws of other jurisdictions, have rejected similar claims on their merits.” Id., at 639. The Circuit Court summarized the holdings of these cases as follows: “Although some of these cases involve different types of information losses, all of the cases rely on the same basic premise: Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy.” Id. Moreover, plaintiffs failed to cite “a single case or statute, from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law.” Id., at 639-40. Accordingly, the Seventh Circuit affirmed the district court order dismissing the class action complaint. Id., at 640.
NOTE: NCR filed a motion to dismiss the class action complaint under Rule 12(b)(6) for failure to state a claim; the district court granted NCR’s motion and that order was not appealed. Pisciotta, at 632.
Download PDF file of Pisciotta v. Old National Bancorp
Comments are closed.