As we previously reported, Plaintiff Jonathan Torres filed a putative class action against Wendy’s in the wake of a data breach that the fast-food company suffered earlier this year.  Wendy’s subsequently filed a motion to dismiss Torres’ complaint, which the U.S. District Court for the Middle District of Florida granted on July 15. 

In its Order dismissing the Complaint, the Florida federal court focused its analysis on “when, exactly, the loss or theft of an individual’s data becomes a concrete injury for purposes of establishing standing.”  As a result of the data breach, Torres allegedly experienced two fraudulent charges on his debit card, which he did not contend went unreimbursed.  Wendy’s thus argued that Torres suffered no out-of-pocket losses.  Torres, on the other hand, argued that his injuries amount to actual identity theft, which he contended was sufficient to confer standing. 

The Court recognized that the Eleventh Circuit has not yet directly addressed the extent of injury that a purported data breach victim must allege to survive a motion to dismiss.  The Court ultimately held that because Torres did not allege any monetary harm stemming from the two fraudulent charges, he failed to allege actual harm sufficient to establish injury-in-fact.   

Additionally, the Court addressed Torres’ claim that he has standing based on the imminent threat of future harm flowing from potential fraud and identity theft.  Wendy’s countered that speculative future harm cannot confer standing on a plaintiff.  The Court agreed with Wendy’s, holding that “Plaintiff’s alleged harm is highly speculative based on the facts and the asserted injuries do not appear ‘certainly impending.’” 

The Court ultimately dismissed Torres’ complaint for lack of subject matter jurisdiction.  However, Torres was granted leave to file an Amended Class Action Complaint to cure the deficiencies identified in the Court’s Order, if possible.   

Troutman Sanders will continue to monitor the developments in this case.