On September 21, 2010, the Maine Supreme Judicial Court issued a long-awaited opinion relating to the Hannaford security breach litigation. As discussed in the December 2009 issue of Privacy In Focus (available at www.wileyrein.com/pif_1209), last year, the U.S. District Court for the District of Maine certified questions to the state's highest court regarding the extent of damages recoverable as compensation for victims' time spent dealing with the aftermath of a security breach. Considering the certified questions, the Maine Supreme Judicial Court ultimately ruled that "time and effort" alone spent in an effort to avoid or remediate reasonable foreseeable harm do not constitute "a cognizable injury for which damages may be recovered." In re Hannaford Bros. Co. Customer Data Security Breach Litigation, 4 A.3d 492 (Me. 2010).
The Hannaford case is the multi-district consolidation of class action complaints that were filed following the breach of the security of certain customer data located on Hannaford's computer system. The breach, which occurred between December 2007 and March 2008, involved more than 4.2 million consumer credit and debit account numbers, authorizations, security codes and expiration dates. Following the breach, customers whose financial information was compromised sued Hannaford seeking recovery of damages, including damages for the time and effort expended to identify and remediate fraudulent account charges.
In a May 2009 opinion, the U.S. District judge assigned to the Hannaford case ruled that the only plaintiffs who could proceed in the case were those who were not reimbursed for fraudulent charges following the breach. As a practical matter, this ruling ended the case, as only one plaintiff claimed to suffer from fraudulent charges that her bank would not reimburse, and after the court's ruling, the remaining plaintiff's bank fully reimbursed all contested charges. At the same time that the court delivered this blow, however, it indicated that it would consider certifying certain issues to the Maine Supreme Judicial Court, particularly questions related to the recoverability of damages for time and effort alone. The court ultimately certified two questions, with the key question being, "In the absence of physical harm or economic loss or identity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable injury for which damages may be recovered under Maine law of negligence and/or implied contract?"
Supreme Court Ruling
The Maine Supreme Judicial Court considered that question and answered it in the negative. (So ruling, the court declined to consider the second question, which was relevant only if the answer to the first question was affirmative.)
The court separately analyzed whether recovery is available under Maine law under negligence and implied contract theories. Under the tort of negligence, individuals are not compensated "for the typical annoyances or inconveniences that are a part of everyday life," and a person's time, alone, is not legally protected from the negligence of others. Although the court noted certain exceptions where loss of time without corresponding tangible damage was compensable-for example, for certain torts such as nuisance or false imprisonment-the court did not illuminate the distinction between those special torts and other torts for which such recovery is not available. The court explained that in general, Maine law recognizes compensation for loss of time only when personal injury or property damage is established. In such cases, "because the time in question could be assigned a value reflecting a loss of earnings or earning opportunities resulting from personal injury or property damage, loss of time [i]s a harm cognizable in negligence."
In concluding that time and effort alone did not constitute cognizable harm, the court rejected the plaintiffs' argument that their time should be compensable because it represented reasonable efforts to avoid reasonably foreseeable harm. Reasoning that it was not appropriate to attach significance to mitigation efforts, the court noted that under the mitigation doctrine and its corollaries, "it must still be established that the time and effort constitute a legal injury rather than an inconvenience or annoyance." Finally, the court analyzed cases advanced by the plaintiffs that appeared to allow recovery for lost time. The court found those cases to be inapposite, in many cases because they involved at least one intentional tort, and "liability is often more extensive in cases of intentional torts than those in negligence." Considering all factors, the court declined to expand recovery in negligence to cover the circumstances cited by plaintiffs.
Turning then to the ability to recover for time and effort in contract, the court observed that contract damages are generally more restricted than compensatory damages for a tort. In this case, the court determined that the time and effort expended by the breach victims represented "the ordinary frustrations and inconveniences that everyone confronts in daily life." Accordingly, the court found that such expenditures of time and effort did not represent a cognizable injury recoverable in implied contract. Having found that Maine law did not allow recovery of damages for time and effort alone under either tort or contract, the court answered the certified question in the negative.
Limited Hope for Breach Victims?
When it asked Maine's highest court to address whether time spent dealing with the aftereffects of a security breach constituted compensable harm under state law, the federal court in Hannaford provided an opportunity for a focused consideration of an issue that frequently arises in security breach cases. In considering the issue, however, the Supreme Judicial Court did not break new ground and instead fell within the well-established pattern of finding that security breach victims cannot recover damages in the absence of some tangible harm. This ruling is consistent with the majority of courts that have found, employing various rationales, that security breach victims who do not suffer any out-of-pocket losses fail to state a claim for recovery.
For companies, this is a welcome ruling, as an outlier decision on this issue by the Maine court could have created a large amount of cumulative exposure for "time and effort" damages. For breach victims, the ruling confirms that success is not likely for claims based only on potential future identity theft and losses, and that successful recovery generally must involve claims of financial harm or other direct injury from the breach.