"When a customer uses a credit card in a commercial transaction, she intends to provide that data to the merchant only," the court wrote in its opinion.

"Ordinarily, a customer does not expect -- and certainly does not intend -- the merchant to allow unauthorized third-parties to access that data. A jury could reasonably conclude, therefore, that an implicit agreement to safeguard the data is necessary to effectuate the contract."

While the ruling is important, it only addresses the actual out of pocket costs that some consumers experience as a result of the breach, Vernick said.

Many consumer class-action lawsuits in such situations have sought compensation for the alleged time and effort consumers needed to spend on getting their cards reissued, changing bank accounts, or in signing up for credit monitoring services.

The appellate court's decision does not allow consumers to pursue damages such as those which are largely speculative, Vernick said. "If you are the victim of a data breach, and there is a general threat of financial fraud or ID theft, you will still have a hard time recovering" damages from the breached entity, he said.