Pierce Atwood’s Cliff Ruprecht received a great ruling on a certified question to the Maine SJC this week in In re Hannaford Bros. Data Breach Security Litigation, 2010 ME 93 [http://www.courts.state.me.us/court_info/opinions/2010%20documents/10me93ha.pdf]. It’s an important decision on a number of levels – not only is it one of the first decisions from a state’s highest court in the area of data breach liability, but it relates to perhaps the most fundamental tort concept there is: what is actionable and what is just life?
As many know, a few years ago there was a data breach at Hannaford. While reportedly over 4 million credit and debit card numbers were at risk, the vast majority of cardholders apparently never had their numbers misused. A class action was filed in the name of the card holders against the store. Judge Hornby in the federal district court disposed of all of the causes of action on a motion to dismiss on various grounds, but at Plaintiffs’ request sent a certified question to the SJC as follows:
“In the absence of physical harm or economic loss or identity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable injury for which damages may be recovered under Maine law of negligence and/or implied contract?”
The SJC’s answer was no. To get to this result, you must navigate the basics of tort law, and Justice Jabar’s decision is an exemplar of how to do that clearly and concisely.
If you assert an intentional tort, or certain other special torts, then under certain circumstances, you can sue when you have no harm to person or property. When you have harm to person or property, you can also obtain a recovery that includes a time component if it is a measure of a recognized loss, like earnings. And when you have a physical injury, you can recover for harms such as pain and suffering as part of the compensation for that injury. But in a normal negligence or contract action, if your only harm is time and effort, then that’s life – these aggravations are non-actionable “typical annoyances or inconveniences that are a part of everyday life.” (¶ 9.)
This has to be the answer, because otherwise everyone would be constantly suing everyone else (in class actions, given the small size of the individual damages). How many times have you been delayed on a highway because of someone’s negligent driving resulting in an accident? As the SJC focused on in the oral argument in this action, how many times has there been a screw-up in a bill that you’ve had to get corrected? If you’ve ever even read a medical bill, you know that the probability of an incorrect entry somewhere is not negligible. The line has to be drawn somewhere, and traditional common law negligence and contract law, as the SJC explained, says that one line is clear: when you have no out-of-pocket costs, just your time and effort to fix the problem is not compensable.
There is no doubt that some customers who had to call up their credit card providers to get new cards and/or charges off their bills were annoyed. But the charges were all taken off after such communications. With such a system, in which you can avoid all loss through such alerts to your credit card provider, imposing a class action cost for making that call would, as the amicus Maine Merchant Association pointed out, impose yet another cost of doing business that would likely impinge most on smaller store owners.
Living with other people, in a society, means some bumps and bruises and aggravations. Yes, people should do what they can to prevent these inconveniences. But the answer isn’t always to sue.
