First Circuit Court of Appeals Finds Mitigation Costs as Basis for Standing in Internet Privacy Litigation

Originally published November 2011

Keywords: privacy, consumers, confidential personal information, internet, Anderson v. Hannaford Bros., mitigation costs, hackers,

Continuing the recent proliferation of cases brought by consumers claiming various statutory and common law violations by companies involved in collecting and storing confidential personal information, the First Circuit recently has had an opportunity to consider the issue of whether consumers' alleged damages were too speculative, and not reasonably foreseeable, to establish cognizable injuries. In Anderson v. Hannaford Bros., Co.,1 the court determined that plaintiffs could recover certain mitigation costs, such as the cost of procuring identity theft insurance, under negligence and implied contract claims under Maine law where there was evidence that data was misused to commit identity theft against at least some of the affected parties.

Anderson v. Hannaford Bros., Co.

In December of 2007, Internet hackers breached the electronic payment processing system of the Hannaford Brothers Company, a national grocer. Over a three month period, the hackers stole up to 4.2 million credit and debit card numbers, expiration dates, and security codes of Hannaford customers. By March 2008, Hannaford had received reports of approximately 1,800 cases of fraud resulting from the breach.

Twenty-six plaintiffs filed a consolidated lawsuit in the District of Maine alleging seven causes of action and various injuries, including the cost of replacement credit and debit cards, fees for overdrawn accounts, fees for altering pre-authorized payment arrangements, loss of accumulated reward points, inability to earn reward points, emotional distress, and time and effort spent monitoring accounts and reversing fraudulent transactions.

In response to a motion to dismiss, the district court dismissed four of the seven claims for failing to allege sufficient facts to state a basis for the claim. The remaining three claims—negligence, breach of an implied contract, and a violation of the Maine Unfair Trade Practices Act (UPTA)—were dismissed because the court determined that the plaintiffs' injuries were "too unforeseeable and speculative to be cognizable under Maine law."2

On appeal, the First Circuit affirmed the district court's dismissal of all plaintiffs' claims except those for negligence and breach of an implied contract. However, the most significant portion of the First Circuit's opinion is that...