PORTLAND, Maine — Whether Hannaford Bros. customers may recover damages for the time and trouble it took them to straighten out their bank or credit card accounts after the Scarborough-based firm’s computer system was breached in late 2007 and early 2008 now is up to the Maine Supreme Judicial Court.
The justices have never considered what constitutes damages for lost time and effort in cases of data theft.
U.S. District Judge D. Brock Hornby last week sent two specific questions to the state’s high court. In essence, the federal judge wants to know if Maine consumers who have been reimbursed by their banks and credit card companies for losses due to stolen data have the right to seek damages for the time they spent and the effort it took them to straighten out their accounts.
Oral arguments in the case are not expected to be scheduled until after the first of the year. It could take several months after oral arguments for the justices to issue a decision.
Hornby ruled in October that he would send the questions to the state supreme court but did not formally submit them until Nov. 24. His decision came after lawyers for the plaintiffs asked him to reconsider his earlier ruling to dismiss the class-action lawsuit.
This spring, the federal judge found that consumers could not seek compensation under Maine law for the inconvenience caused by the data breach.
“Those are ordinary frustrations and inconveniences that everyone confronts in daily life with or without fraud or negligence,” he wrote in his ruling dated May 12. “Maine law requires that there be a way to attach a monetary value to a claimed loss. These [claims] fail that requirement.”
If the state supreme court agrees with Hornby, the case most likely would be dismissed. If the justices, however, find Maine consumers have the right to sue for lost time and effort, the plaintiffs would seek class certification and the lawsuit would go forward.
Peter Murray, the Portland lawyer representing the plaintiffs in the case, told the Portland Press Herald in October that a ruling in his clients’ favor “would be a major advance in the law.” Hannaford and other merchants, Murray has argued, must be held accountable for data breaches, even when banks reimburse customers whose accounts were used fraudulently.
Attorneys for Hannaford have argued that a federal law, which requires banks to reverse fraudulent charges, along with existing contracts between merchants, banks and consumers, provide adequate protection. Another layer of liability is not necessary, attorneys representing the grocer have said.
Computer hackers stole credit and debit card numbers between Dec. 7, 2007, and March 10, 2008, from Hannaford shoppers. More than 4 million card numbers were exposed. About 1,800 fraudulent charges had been made by the time Hannaford announced the breach on March 17, 2008.
The grocery store chain operates more than 200 supermarkets in New England, New York state and Florida. Consumers from every state where Hannaford operates are potential plaintiffs in the class-action lawsuit.
Questions to the court
U.S. District Judge D. Brock Hornby has asked the Maine Supreme Judicial Court to answer the following questions in the federal lawsuit pending against Hannaford Bros. over an electronic data theft in late 2007 and early 2008:
“1. In the absence of physical harm or economic loss or identity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable* injury for which damages may be recovered under Maine law of negligence and/or implied contract?”
“2. If the answer to question #1 is yes under a negligence claim and no under an implied contract claim, can a plaintiff suing for negligence recover damages under Maine law for purely economic harm absent personal injury, physical harm to property, or misrepresentation?”
* Cognizable means “capable of being known or recognized” and “within the court’s jurisdiction,” according to Black’s Law Dictionary.