[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT ________________________

No. 18-14959 ________________________

D.C. Docket No. 8:18-cv-01606-WFJ-SPF I TAN TSAO, individually and on behalf of all others similarly situated,

Plaintiff-Appellant, versus CAPTIVA MVP RESTAURANT PARTNERS, LLC, A Florida Limited Liability Company doing business as PDQ,

Defendant-Appellee. _______________________

Appeal from the United States District Court for the Middle District of Florida _______________________

(February 4, 2021) Before JORDAN, TJOFLAT, and TRAXLER,* Circuit Judges. TJOFLAT, Circuit Judge:

* The Honorable William B. Traxler, Senior United States Circuit Judge for the Fourth Circuit, sitting by designation. USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 2 of 28

I Tan Tsao seeks to bring a number of claims against PDQ—a restaurant he patroned—following a data breach that exposed PDQ customers’ personal financial information. Tsao’s appeal presents two questions. First, did Tsao have standing to sue based on the theory that he and a proposed class of PDQ customers are now exposed to a substantial risk of future identity theft, even though neither Tsao nor the class members have suffered any misuse of their information? Second, and alternatively, were Tsao’s efforts to mitigate the risk of future identity theft a present, concrete injury sufficient to confer standing? For both questions, we conclude the answer is no, and we accordingly affirm the District Court’s order dismissing the case without prejudice.

I.

PDQ is a group of fast casual restaurants that sells chicken tenders, chicken nuggets, salads, and sandwiches. Like most restaurants today, PDQ accepts payment through a point of sale system where customers can insert credit or debit cards to pay for their meal. When customers pay with a debit or credit card, PDQ collects some data from the cards, including the cardholder’s name, the account number, the card’s expiration date, the card verification value code (“CVV”), and PIN data for debit cards. PDQ then stores this data in its point of sale system and transmits the information to a third party for processing and for completion of the payment.

2 USCA11 Case: 18-14959 Date Filed: 02/04/2021 Page: 3 of 28

Beginning on May 19, 2017, a hacker exploited PDQ’s point of sale system and gained access to customers’ personal data—the credit and debit card information—through an outside vendor’s remote connection tool. PDQ later became aware of the breach, and on June 22, 2018, it posted a notice to customers that it had “been the target of a cyber-attack.” The notice stated that “[a]ll PDQ locations in operation” between May 19, 2017, and April 20, 2018, were affected by the attack, and the notice listed the customers’ personal information that “may have been accessed”: cardholder names, credit card numbers, card expiration dates, and CVVs. Because of the nature of the breach, PDQ stated that it “was not possible to determine the identity or exact number of credit card numbers or names that were accessed or acquired during” the cyber-attack. The notice repeatedly made clear that PDQ customers’ information “may” have been accessed.

In October 2017—during the data breach period—plaintiff Tsao made at least two food purchases at a PDQ restaurant in Pinellas