Heather Dieffenbach, et al v. Barnes & Noble
Filed opinion of the court by Judge Easterbrook. The judgment is VACATED, and the case is REMANDED for proceedings consistent with this opinion. Diane P. Wood, Chief Judge; Frank H. Easterbrook, Circuit Judge and David F. Hamilton, Circuit Judge. [6917133-1]  [17-2408]
United States Court of Appeals
For the Seventh Circuit
HEATHER DIEFFENBACH and SUSAN WINSTEAD,
BARNES & NOBLE, INC.,
Appeal from the United States District Court for the
Northern District of Illinois, Eastern Division.
No. 12 C 8617 — Andrea R. Wood, Judge.
ARGUED DECEMBER 6, 2017 — DECIDED APRIL 11, 2018
Before WOOD, Chief Judge, and EASTERBROOK and
HAMILTON, Circuit Judges.
EASTERBROOK, Circuit Judge. In 2012 Barnes & Noble discovered that scoundrels had compromised some of the machines, called PIN pads, that it used to verify payment information. They acquired details such as customers’ names,
card numbers and expiration dates, and PINs. Some customers temporarily lost the use of their funds while waiting for
banks to reverse unauthorized charges to their accounts.
Some spent money on credit-monitoring services to protect
their ﬁnancial interests. Some lost the value of their time devoted to acquiring new account numbers and notifying
businesses of these changes. Many people use credit or debit
cards to pay bills automatically; every time the account
number changes, these people must devote some of their
time and mental energy to notifying merchants that the old
numbers are invalid and new ones must be used. In this suit
under state law, plaintiﬀs seek to collect damages not from
the data thieves but from Barnes & Noble. Jurisdiction rests
on the Class Action Fairness Act, 28 U.S.C. §1332(d), because
the proposed class contains at least 100 members, the
amount in controversy exceeds $5 million, and minimal diversity of citizenship exists.
The district court initially held that the representative
plaintiﬀs had suﬀered no loss at all—that they did not even
have standing to sue. 2013 U.S. Dist. LEXIS 125730 (N.D. Ill.
Sept. 3, 2013). After this court held in Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015), and Lewert v. P.F.
Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), that
consumers who experience a theft of their data indeed have
standing, the district court (acting through a diﬀerent judge)
concluded that the complaint alleges injury. 2016 U.S. Dist.
LEXIS 137078 at *8–11 (N.D. Ill. Oct. 3, 2016). But the judge
nonetheless dismissed the complaint, ruling that it does not
adequately plead damages. Id. at *13–25. See also 2017 U.S.
Dist. LEXIS 97161 (N.D. Ill. June 13, 2017) (dismissing an
This seems to us a new label for an old error. To say that
the plaintiﬀs have standing is to say that they have alleged
injury in fact, and if they have suﬀered an injury then dam-
ages are available (if Barnes & Noble violated the statutes on
which the claims rest). The plaintiﬀs have standing because
the data theft may have led them to pay money for creditmonitoring services, because unauthorized withdrawals
from their accounts cause a loss (the time value of money)
even when banks later restore the principal, and because the
value of one’s own time needed to set things straight is a loss
from an opportunity-cost perspective. These injuries can justify money damages, just as they support standing.
Pleading is governed by Fed. R. Civ. P. 8 and 9. Rule
8(a)(3) requires the plaintiﬀ to identify the remedy sought,
but it does not require detail about the nature of the plaintiﬀ’s injury. See Lujan v. Defenders of Wildlife, 504 U.S. 555,
561 (1992). What’s more, Rule 54(c) provides that the prevailing party receives the relief to which it is entitled, whether or
not the pleadings have mentioned that relief. Rule 9(g), by
contrast, does require details, but only with respect to “special damages.” Barnes & Noble does not contend, and the
district judge did not ﬁnd, that any loss plaintiﬀs have identiﬁed is treated as “special damages.” As far as the federal
rules are concerned, then, all this complaint needed to do
was allege generally that plaintiﬀs have been injured.
The district court did not apply these rules, instead demanding that the complaint contain all speciﬁcs that would
have been required had this suit been in state court. 2016
U.S. Dist. LEXIS 137078 at *13–19, 22–25. But in federal court
it is the federal rules that determine what must be in a complaint. See, e.g., Walker v. Armco Steel Corp., 446 U.S. 740
(1980); Gasperini v. Center for Humanities, Inc., 518 U.S. 415
(1996); Shady Grove Orthopedic Associates, P.A. v. Allstate Insurance Co., 559 U.S. 393 (2010). The fact that the federal rules
do not require plaintiﬀs to identify items of loss (except for
special damages) means that this complaint cannot be faulted as insuﬃcient.
Still, a district court could grant judgment on the pleadings, see Fed. R. Civ. P. 12(c), if none of the plaintiﬀs’ injuries
is compensable, as a maoer of law, under the statutes on
which they rely. We therefore turn to state law.
Heather Dieﬀenbach dealt with Barnes & Noble in California and contends on appeal that she suﬀered four kinds
of injury: (1) her bank took three days to restore funds
someone else had used to make a fraudulent purchase; (2)
she had to spend time sorting things out with the police and
her bank; (3) she could not make purchases using her compromised account for three days; and (4) she did not receive
the beneﬁt of her bargain with Barnes & Noble. The fourth of
these is not a loss; it is the failure to obtain a gain from the
transaction. (Dieﬀenbach does not contend that any of the
items she purchased was defective or that Barnes & Noble
promised any particular level of security, for which she paid.
See Remijas, 794 F.3d at 694–95.) But the ﬁrst three are losses,
at least in economic terms.
Dieﬀenbach invokes two statutes: California’s Customer
Records Act and its Unfair Competition Law. The Records
Act provides that a “customer injured by a violation of [this
Act] may … recover damages.” Cal. Civ. Code §1798.84. The
statute does not deﬁne injury, nor does any state decision we
could ﬁnd. The district judge took this absence of a deﬁnition as equivalent to conditioning recovery on satisfaction of
the Unfair Competition Law, which provides that “lost money or property” supports recovery. Cal. Bus. & Prof. Code
§17204. That’s a problematic move; the statutes are distinct,
after all, as is their language. But this does not maoer, because the ﬁrst three losses that Dieﬀenbach identiﬁes ﬁt
within the phrase “lost money or property”.
California’s judiciary understands “lost money or property” to mean an economic injury and tells us that “[t]here
are innumerable ways in which economic injury … may be
shown.” Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 323
(2011). An “identiﬁable triﬂe of economic injury” suﬃces. Id.
at 330 n.15 (internal quotation marks and citation omioed).
We know from Marentes v. Impac Funding Corp., 2014 WL
2157539 (Cal. App. May 23, 2014), that the time value of
money meets the statutory deﬁnition. Although the loss of
use in Marentes was longer (six months there, three days for
Dieﬀenbach) the principle that the time value of money is
“money or property” controls. Cf. Burlington Northern & Santa Fe Ry. v. White, 548 U.S. 53 (2006), which holds that a
worker suﬀers a compensable injury even though the employer awards back pay to make up for salary lost during a
37-day suspension. Losing the use of money for three days
may be a triﬂe to some people (though to others it may be a
calamity), but a triﬂing loss suﬃces under California law.
And state courts have said that signiﬁcant time and paperwork costs incurred to rectify violations also can qualify as
economic losses. Compare Sarun v. Dignity Health, 232 Cal.
App. 4th 1159, 1169 (2014) (“The tangible burden of [providing tax return information and other personal ﬁnancial data]” satisﬁes the Law), with Lueras v. BAC Home Loans Servicing, LP, 221 Cal. App. 4th 49, 82 (2013) (ﬁnding time spent
“preparing and assembling materials” for a loan modiﬁcation application de minimis and insuﬃcient).
Now for Illinois. Susan Winstead, the second representative plaintiﬀ, alleges that (1) her bank contacted her about a
potentially fraudulent charge on her credit card statement
and deactivated her card for several days; and (2) the security breach at Barnes & Noble “was a decisive factor” when
she renewed a credit-monitoring service for $16.99 per
month. Her claim rests on the Illinois Consumer Fraud and
Deceptive Business Practices Act, 815 ILCS 505/2, and the
proposed class relies on materially identical laws in other
states. A person “who suﬀers actual damage as a result of a
violation of this Act” may recover. 815 ILCS 505/10a(a). A
monthly $17 out of pocket is a form of “actual damage”. It is
real and measurable; Illinois does not require more. See
Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill. 2d
100, 195–99 (2005). And, if the plaintiﬀ has suﬀered an economic loss, noneconomic injuries are compensable. See, e.g.,
Morris v. Harvey Cycle & Camper, Inc., 392 Ill. App. 3d 399,
An Illinois appellate court has held that a person who
purchases credit-monitoring services after a merchant discloses personal information has not suﬀered actual damages.
Cooney v. Chicago Public Schools, 407 Ill. App. 3d 358, 365–66
(2010). We think it unlikely that the Supreme Court of Illinois would agree with the “actual damages” portion of this
decision, given the breadth of the statutory language. Money
out of pocket is a standard understanding of actual damages
in contract law, antitrust law (Reiter v. Sonotone Corp., 442
U.S. 330 (1979)), the law of fraud, and elsewhere. To get
damages plaintiﬀs must show that a culpable data breach
caused the monthly payments, but the complaint cannot be
dismissed before giving the class an opportunity to do so.
Everything we have said about California and Illinois law
concerns injury. We have not considered whether Barnes &
Noble violated any of these three state laws by failing to
prevent villains from stealing plaintiﬀs’ names and account
data. Barnes & Noble was itself a victim. Its reputation took
a hit, it had to replace the compromised equipment plus other terminals that had been shown to be vulnerable, and it
lost business. None of the state laws expressly makes merchants liable for failure to crime-proof their point-of-sale systems. Plaintiﬀs may have a diﬃcult task showing an entitlement to collect damages from a fellow victim of the data
thieves. It is also far from clear that this suit should be certiﬁed as a class action; both the state laws and the potential
damages are disparate. These and other questions need consideration on remand. That the case has been pending for 5½
years without a decision by the district court whether the
proposed class can be certiﬁed is problematic under Fed. R.
Civ. P. 23(c)(1)(A), which requires the decision to be made
“[a]t an early practicable time after a person sues … as a
class representative”. All we hold today is that the complaint
cannot be dismissed on the ground that the plaintiﬀs do not
adequately allege compensable damages.
The judgment is vacated, and the case is remanded for
proceedings consistent with this opinion.
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?