On December 13, 2019, the U.S. District Court for the District of Maryland held that the City of Chicago has standing to seek relief pursuant to a local consumer protection ordinance “for harm and injuries arising from” Marriott’s data security incident announced on November 30, 2018. The opinion resolved Marriott’s motion to dismiss Chicago’s first amended complaint (the “Complaint”) in the multi-district litigation arising from Marriott’s data security incident.
Chicago’s Complaint alleges that Marriott violated a local consumer protection ordinance, MCC § 2-25-090(a), “because it failed to protect Chicago residents’ personal information, failed to detect the data breach promptly, inadequately responded to the breach, and failed to implement reasonable safeguards that would have prevented the breach and/or detected it sooner.” (Op. at 3.) Chicago also alleges that “Marriott misrepresented to Chicago residents that it had reasonable safeguards in place.” (Id.) Chicago further argues that it is empowered to sue on its citizens’ behalf because the alleged violations of the local consumer protection ordinance occurred in Chicago and affected Chicago residents. (Id.)
Marriott moved to dismiss on the grounds that Chicago lacks standing to sue under Article III of the U.S. Constitution and is attempting to apply a local ordinance to a national problem (i.e., the Marriott data security incident) in violation of the Illinois State Constitution. (Id. at 4.) The Court found for Chicago on both issues. First, the Court held that Chicago has standing to sue pursuant to the local consumer protection ordinance because Chicago “sufficiently alleged a concrete injury to its own proprietary interests,” including a loss of tax revenues due to a decline in the city’s tourism industry. (Id. at 7.) Second, the Court held that Chicago’s application of its consumer protection ordinance to the Marriott data security incident does not violate the Illinois Constitution’s “home rule” provisions and that relief could be fashioned to avoid giving extraterritorial effect to the ordinance. In finding that Chicago is not seeking to apply its local ordinance extraterritorially, the Court emphasized that the Complaint “was quite surgical” in alleging ordinance violations that occurred within Chicago. (Id. at 23.)