Summary
finding standing but granting summary judgment to defendant on negligence and breach of fiduciary duty claims because New York would not likely recognize mitigation costs as damages without rational basis for plaintiffs fear of misuse of PII
Summary of this case from Galaria v. Nationwide Mut. Ins. Co.Opinion
No. 07 Civ. 2480 (PKC) (DFE).
August 28, 2008
John Michael Dillon, Caruso Dillon, P.C., Mamaroneck, NY, for plaintiff.
Christopher Wolf, Brendon M. Tavelli, Timothy Patrick Tobin, Proskauer Rose, LLP, Washington, DC, for defendant.
MEMORANDUM AND ORDER
Plaintiff Terrell Caudle, individually and on behalf of a class, seeks to recover the costs of multi-year credit monitoring and identity theft insurance because a laptop with his personal information, including his social security number, and that of thousands of other persons was stolen from the office of his employer's pension consultant, defendant Towers, Perrin, Forster Crosby, Inc. ("Towers"). Plaintiff alleges that defendant Towers was negligent and breached its contractual and fiduciary duties in allowing the theft to occur. The First Amended Complaint ("FAC") makes no claim that plaintiffs personal information or that of any other would-be class member has been misused or that plaintiff has suffered any other out-of-pocket loss.
This Court bifurcated discovery, setting a first phase of discovery to permit the parties to explore whether plaintiff has suffered a compensable injury. Now, following the conclusion of the first phase of discovery, defendant Towers moves for judgment in its favor pursuant to Rules 12(c) and 56, Fed.R.Civ.P. For the reasons outlined below, summary judgment is granted dismissing the claims for the negligence and breach of fiduciary duty. With respect to the claim that plaintiff is a third-party beneficiary of a contract between Towers and plaintiff's employer, the pleading meets the standards set forth in Rule 8(a). Accordingly, defendant's motion is denied as to the contract claims without prejudice to the making of a summary judgment motion after the close of all discovery.
I. The Facts
For almost twenty years, plaintiff Terrell Caudle has worked for Phillip Morris operating machinery that produces cigarette filters. (Caudle Dep. at 12.) In January 2007, he received a letter from Altria, the parent company of Phillip Morris, notifying him that several laptops had been stolen from the New York office of defendant Towers, a benefit and pension consultant to Altria. (Tobin Decl., Exh. 5.) One of the stolen laptops, according to the letter, contained Caudle's personal information including his social security number. ( Id.) Towers sent its own letter to Caudle around the same time and noted that, although all of the laptops were "password-protected," only "some" of the files contained on the hard drive of the laptop were protected by a separate and additional password. ( Id.) It also noted that it had arranged for Caudle to enroll in a credit monitoring service, specifically stating:
[W]e have arranged for you to enroll, at your option, in the Equifax Credit Watch Gold with 3-in-1 credit monitoring product at no cost to you for one year. The product will provide you with an early warning system for changes to your credit file and help you to understand the content of your credit file at the three credit reporting agencies.
( Id.) Both the Towers and the Altria letters stated that Towers had no knowledge of any misuse of Caudle's information. ( Id.)
The letters notifying Caudle of the security breach were not sent immediately after the theft — which occurred on or around November 27, 2006 — because the New York County District Attorney's Office requested that Towers delay notification while the theft was being investigated. (Tobin Decl., Exhs. 13, 15.) On December 28, 2006, a former Towers employee was arrested and charged with the theft of the laptops. ( Id., Exh. 13,) Nothing in the record sheds light on whether the laptops were stolen for their intrinsic value, for the value of the data or for both. There is no evidence in the record of what happened to the laptops after they were taken from Towers' offices.
Caudle declined Tower's offer for credit monitoring through Equifax and instead enrolled in "LifeLock," another credit monitoring program, because, among other reasons, LifeLock offered substantially more credit fraud insurance than the Equifax program. (Caudle Dep. at 79.) In addition, Caudle "couldn't trust" Towers and did not believe that one year of credit monitoring was adequate protection. ( Id.) Caudle was informed by Towers, his employer, all three credit reporting agencies and by LifeLock's marketing materials that, save for the credit fraud insurance, he could perform all the services performed by LifeLock for free. (Tobin Deck, Exhs. 5, 7, 9, 10, 11 and 12; Caudle Dep. at 68-76, 80-83.) Those services included placing a fraud alert on his credit file at all three credit reporting agencies. (Caudle Dep. at 70.)
Caudle instituted this lawsuit by filing a class action complaint on March 27, 2007. (Docket # 1.) The FAC was filed on June 8, 2007. (Docket # 9.) It alleges that plaintiff, and a putative class of approximately 300,000, were injured by the theft of the laptops because their personal information was exposed, creating the potential for identity theft and fraud leading plaintiff and the purported class to spend money on monitoring services. (FAC ¶¶ 6-8.) The FAC alleges that "[t]he moneys that Plaintiffs reasonably spend to reduce the danger of identity theft and mitigate their damages" would have to continue "beyond the one-year coverage offered by Towers Perrin." ( Id.) Other than the expense for credit monitoring ($8.25 per month incurred since January 2007), plaintiff has not alleged any direct financial loss. It is not alleged that plaintiff or any member of the putative class has been the victim of identity fraud or theft.
The FAC asserts causes of action for breach of contract, breach of the implied duty of good faith and fair dealing, negligence, misrepresentation, breach of fiduciary duty, and "breach of the duty of privacy." In his opposition papers, plaintiff abandoned his claims for misrepresentation and breach of privacy. (PL Mem. At 10-11.)
II. Standards
A. Motion for Judgment on the Pleadings
The applicable legal standard for a Rule 12(c) motion is the same as a Rule 12(b)(6) motion to dismiss for failure to state a claim. See King v. American Airlines, Inc., 284 F.3d 352, 356 (2d Cir. 2002). Rule 8(a)(2), Fed.R.Civ.P., requires only "a short and plain statement of the claim showing that the pleader is entitled to relief, in order to give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Bell Atl., Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1964, 167 L.Ed.2d 929 (2007) (internal quotations omitted). When a defendant tests the sufficiency of a complaint by motion, "[t]o survive dismissal, the plaintiff must provide the grounds upon which his claim rests through factual allegations sufficient `to raise a right to relief above the speculative level.'" ATSI Commc'ns, Inc. v. Shaar Fund. Ltd., 493 F.3d 87, 98 (2d Cir. 2007) (quoting Twombly, 127 S.Ct. at 1965). The complaint is measured against a "flexible plausibility standard," which obligates the "pleader to amplify a claim with some factual allegations in those contexts where such amplification is needed to render the claim plausible." Iqbal v. Hasty, 490 F.3d 143, 157-58 (2d Cir. 2007). This "does not require heightened fact pleading of specifics. . . ." In re Elevator Antitrust Litig., 502 F.3d 47, 50 (2d Cir. 2007); see Erickson v. Pardus, 551 U.S. 89, 127 S.Ct. 2197, 2200, 167 L.Ed.2d 1081 (2007). It does, however, "require enough facts to `nudge [plaintiffs'] claims across the line from conceivable to plausible.'" Elevator Antitrust Litig., 502 F.3d at 50 (quoting Twombly, 127 S.Ct. at 1974) (alteration in Elevator Antitrust Litig.).
The Court must accept the complaint's allegations as true and draw all reasonable inferences in favor of the nonmoving party. See United States v. City of New York, 359 F.3d 83, 91 (2d Cir. 2004). "[C]onclusory allegations or legal conclusions masquerading as factual conclusions" are not sufficient to defeat the motion. Smith v. Local 819 I.B.T. Pension Plan, 291 F.3d 236, 240 (2d Cir. 2002) (internal quotations omitted) (quoting Gebhardt v. Allspect, Inc., 96 F.Supp.2d 331, 333 (S.D.N.Y. 2000)). Although the Court is limited to facts as stated in the complaint, it may consider exhibits or documents incorporated by reference without converting the motion into one for summary judgment. Int'l Audio-text Network, Inc. v. Am. Telephone Telegraph Co., 62 F.3d 69, 72 (2d Cir. 1995).
B. Motion for Summary Judgment
Summary judgment "should be rendered if the pleadings, the discovery and disclosure materials on file, and any affidavits show that there is no genuine issue as to any material fact and that the movant is entitled to judgment as a matter of law." Rule 56(c), Fed.R.Civ.P. It is the initial burden of a movant on a summary judgment motion to come forward with evidence on each material element of his claim or defense, demonstrating that he or she is entitled to relief. A fact is material if it "might affect the outcome of the suit under the governing law. . . ." Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). The evidence on each material element must be sufficient to entitle the movant to relief in its favor as a matter of law. Vt. Teddy Bear Co. v. 1-800 Beargram Co., 373 F.3d 241, 244 (2d Cir. 2004).
When the moving party has met this initial burden and has asserted facts to demonstrate that the non-moving party's claim cannot be sustained, the opposing party must "set out specific facts showing a genuine issue for trial," and cannot rest "merely on allegations or denials" of the facts asserted by the movant. Rule 56(e)(2), Fed.R.Civ.P. In raising a triable issue of fact, the non-movant carries only "a limited burden of production," but nevertheless "must `demonstrate more than some metaphysical doubt as to the material facts,' and come forward with `specific facts showing that there is a genuine issue for trial.'" Powell v. Nat'l Bd. of Med. Exam'rs, 364 F.3d 79, 84 (2d Cir. 2004) (quoting Aslanidis v. U.S. Lines, Inc., 7 F.3d 1067, 1072 (2d Cir. 1993)).
An issue of fact is genuine "if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Anderson, 477 U.S. at 248, 106 S.Ct. 2505. The Court must "view the evidence in the light most favorable to the non-moving party and draw all reasonable inferences in its favor, and may grant summary judgment only when no reasonable trier of fact could find in favor of the nonmoving party." Allen v. Coughlin, 64 F.3d 77, 79 (2d Cir. 1995) (internal quotations and citations omitted); accord Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587-88, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986). In reviewing a motion for summary judgment, the court must scrutinize the record, and grant or deny summary judgment as the record warrants. Rule 56(c), Fed.R.Civ.P. In the absence of any disputed material fact, summary judgment is appropriate. Id.
III. Subject Matter Jurisdiction
A. Amount in Controversy
Plaintiff contends this Court has jurisdiction over his putative class action pursuant to 28 U.S.C. 1332(d), the Class Action Fairness Act of 2005 ("CAFA"). CAFA requires "the amount in controversy to exceed[] the sum or value of $5,000,000, exclusive of interest and costs" for the class in the aggregate or $75,000 for the named class action plaintiff. Id. Towers asserts that plaintiff cannot meet the amount in controversy requirement because even if plaintiff and 300,000 other class members are entitled to at least nominal damages on the breach of contract claims, the $5 million threshold cannot be met, However, plaintiff is seeking credit monitoring costs for himself and for the putative class for an indeterminate period beyond one year. The amount of this claim could readily exceed $5 million, exclusive of interest and costs.
B. Article III Standing
To satisfy the standing requirement of Article III of the Constitution, there must be, among other things, the "irreducible constitutional minimum" of an injury-in-fact. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). "To qualify as a constitutionally sufficient injury-in-fact, the asserted injury must be `concrete and particularized' as well as `actual or imminent,' not `conjectural or hypothetical,'" Baur v. Veneman, 352 F.3d 625, 632 (2d Cir. 2003) (quoting Lujan, 504 U.S. at 560, 112 S.Ct. 2130). The purpose of the injury-in-fact requirement is "to ensure that the court avoids deciding a hypothetical case in which the projected harm may ultimately fail to occur." Id. (citing Lujan at 564-65 n. 2, 112 S.Ct. 2130.).
Towers maintains that plaintiff has yet to suffer an injury capable of satisfying the standing requirement and therefore, this Court lacks subject matter jurisdiction to hear the case. Towers points to cases in other jurisdictions where the risk of future identity theft or fraud after a security breach was held not to satisfy the standing requirement of a present injury-in-fact. See Giordano v. Wachovia Securities, LLC, No. 06 Civ. 476, 2006 WL 2177036, at *5 (D.N.J. July 31, 2006) (credit monitoring costs resulting from lost financial information did not constitute an injury sufficient to give plaintiff standing); Bell v. Acxiom Corp., No. 4:06 Civ. 00485, 2006 WL 2850042, at *2, 2006 U.S. Dist. LEXIS 72477, at *8-10 (E.D.Ark. Oct. 3, 2006) (no standing where plaintiff pleads only increased risk of identity theft rather than "concrete damages."); Randolph v. ING Life Ins. and Annuity Co., 486 F.Supp.2d 1, 8-9 (D.D.C. 2007) (same).
The Seventh Circuit, however, has reached a different conclusion. In Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2007), the court concluded that a plaintiff had standing to bring negligence-based claims against the operator of a website which suffered a security breach exposing plaintiffs personal information to possible misuse. Id. at 634. The constitutional injury-in-fact requirement was satisfied by "a threat of future harm or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff would have otherwise faced, absence the defendants' actions." Id. The court concluded that "[o]nce the plaintiffs' allegations establish at least this level of injury," the standing requirement was satisfied. Id.
Although the Second Circuit has not decided whether the standing requirement can be satisfied by an increased future risk of identity theft, it has decided that standing may be conferred by future risk of personal injury based upon exposure to environmental toxins. See LaFleur v. Whitman, 300 F.3d 256, 270 (2d Cir. 2002) (exposure to sulfur dioxide emissions qualifies as an injury-in-fact sufficient to confer standing). In addition, the Second Circuit has concluded that standing exists when there is an allegation of increased future risk of harm from exposure to potentially unsafe food products. Baur, 352 F.3d at 634 (dismissing "overlapping jurisdictional doctrines that `cluster about Article III.'") (quoting Allen v. Wright, 468 U.S. 737, 750, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984)).
In Baur, the Court explained that in enhanced-risk cases, "credible threat[s] of harm" must be alleged and the "probability of harm which a plaintiff must demonstrate in order to allege a cognizable injury-in-fact logically varies with the severity of the probable harm." Id. at 637. Applying this standard, the Baur court found the potential risk of injury after consuming "downed livestock" (livestock that cannot remain standing or move unassisted — a symptom associated with mad cow disease) was enough of an injury-in-fact to confer standing on a citizen who filed suit against the United States Department of Agriculture. Id. at 643. "Like threatened environmental harm, the potential harm from exposure to dangerous food products or drugs `is by nature probabilistic,' yet an unreasonable exposure to risk may cause cognizable injury." Id. at 634 (citing Friends of the Earth, Inc. v. Gaston Copper Recycling, Corp., 204 F.3d 149, 160 (4th Cir. 2000) (en bane)). In limiting its holding, the Court in Baur noted that it
need not decide as a matter of law whether enhanced risk generally qualifies as sufficient injury to confer standing, nor do we purport to imply that we would adopt such a broad view. In the specific context of food and drug safety suits, however, we conclude that such injuries are cognizable for standing purposes, where the plaintiff alleges exposure to potentially harmful products.Id.
More recently, in Denney v. Deutsche Bank AG, 443 F.3d 253, 264-65 (2d Cir. 2006), the court observed:
An injury-in-fact may simply be the fear or anxiety of future harm. For example, exposure to toxic or harmful substances has been held sufficient to satisfy the Article III injury-in-fact requirement even without physical symptoms of injury caused by the exposure, and even though exposure alone may not provide sufficient ground for a claim under state tort law.Id. (dictum). The Denney court further observed that the risk of future harm may also involve "economic costs, such as medical monitoring and preventative steps; but aesthetic, emotional or psychological harms also suffice for standing purposes." Id. at 265 (citing Ass'n of Data Processing Serv. Orgs., Inc. v. Camp, 397 U.S. 150, 154, 90 S.Ct. 827, 25 L.Ed.2d 184 (1970)).
Against this backdrop, this Court concludes that plaintiff has alleged an adequate injury-in-fact for standing purposes. "[S]tanding simply means that the plaintiff is entitled to `walk through the courthouse door' and raise his grievance before a federal court." Wooden v. Bd. Of Regents of the Univ. Sys. of Ga., 247 F.3d 1262, 1280 (11th Cir. 2001).
IV. Discussion
A. Plaintiffs Negligence and Breach of Fiduciary Duty Claims
Plaintiff brings a claim for negligence and also asserts a claim for breach of fiduciary duty. The choice of law rules of the forum state, New York, govern in this diversity action. See Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487, 496-97, 61 S.Ct. 1020, 85 L.Ed. 1477 (1941). New York applies an "interest analysis" generally applying the law of the jurisdiction with the greatest interest in the specific issue under consideration. See Schultz v. Boy Scouts of Am., Inc., 65 N.Y.2d 189, 194-199, 491 N.Y.S.2d 90, 480 N.E.2d 679 (1985) (discussing the evolution of New York choice of law principles since Babcock v. Jackson, 12 N.Y.2d 473, 240 N.Y.S.2d 743, 191 N.E.2d 279 (1963)). New York generally focuses on the domicile of the parties and the place where the tort occurred. Id. at 197, 491 N.Y.S.2d 90, 480 N.E.2d 679. Plaintiff is a resident and domiciliary of North Carolina and defendant is a corporation organized under the laws of the state of Pennsylvania with its principle place of business in Connecticut. Defendant is authorized to do business in New York. The theft of the laptops occurred in defendant's New York office. A report was filed with the New York Police Department. Under these circumstances, New York would likely have the greatest interest in applying its laws to the circumstance of a theft of personal data from a New York location.
A claim of breach of fiduciary duty is analyzed under choice of law principles applicable to torts. Synovus Bank of Tampa Bay v. Valley Nat'l Bank, 487 F.Supp.2d 360, 371 (S.D.N.Y. 2007) (citing In re Bayou Hedge Fund Inv. Litig., 472 F.Supp.2d 534, 542 (S.D.N.Y. 2007)).
There is no controlling New York authority on a claim of a theft or conversion of personal data in analogous circumstances. In this case, the theft or conversion is inchoate in the sense that there is no proof that the thief or his accomplices has actually obtained or is capable of obtaining the personal information stored on the hard drive of the password-protected laptop computer. A federal court presiding over a diversity claim must predict how the highest court of the state would resolve an open question of state law. See Travelers Ins. Co. v. 633 Third Assocs., 14 F.3d 114, 119 (2d Cir. 1994).
Historically, New York, has required a high degree of probability that a future injury will occur before allowing a plaintiff to recover damages for the potential injury. "To entitle a plaintiff to recover present damages, for apprehended future consequences, there must be such a degree of probability of their occurring, as amounts to a reasonable certainty that they will result from the original injury." Strohm v. New York, L.E. W.R. Co., 96 N.Y. 305, 306 (1884). Modern precedents require an expense to be "reasonably certain to be incurred" to be recoverable. Schultz v. Harrison Radiator Div. General Motors Corp., 90 N.Y.2d 311, 321, 660 N.Y.S.2d 685, 683 N.E.2d 307 (1997). But this plaintiff does not seek damages measured by the present value of a future loss caused by misuse of personal information. Rather, he seeks the cost of purchasing a policy of insurance covering the risk of such misuse, as well as the cost of monitoring to detect a possible misuse.
As noted, defendant Towers, at or about the time plaintiff was informed of the theft of the laptop, offered to him, without cost, one-year of credit monitoring with an established vendor. (Tobin Decl., Exh. 5.) This was deemed unacceptable to plaintiff because of the one-year limitation (he seeks lifetime monitoring) and the absence of satisfactory insurance.
New York courts have addressed claims in tort for the costs of medical monitoring following exposure to a disease-causing toxic substance. New York has not foreclosed all such claims but requires proof of both actual exposure and a "rational basis" for the fear of disease. The case law has narrowly defined "rational basis" in this context to mean the demonstrable presence of the toxin in the plaintiffs body or a physical manifestation of the contamination. As summarized by one court:
In order to recover medical monitoring costs following exposure to a toxic substance . . ., a plaintiff must establish both that he or she was in fact exposed to the disease-causing agent and that there is a rational basis for his or her fear of contracting the disease. . . . This rational basis has been construed to mean the clinically demonstrable presence of [the toxic substance] in the plaintiffs body, or some indication of [toxin]-induced disease, i.e., some physical manifestation of [toxic] contamination.Allen v. General Elec. Co. 32 A.D.3d 1163, 1165, 821 N.Y.S.2d 692 (4th Dep't 2006) (alterations in original) (internal quotations omitted) (quoting Abusio v. Consolidated Edison Co. of N.Y., 238 A.D.2d 454, 454-455, 656 N.Y.S.2d 371 (2d Dep't 1997)); see DiStefano v. Nabisco. Inc., 2 A.D.3d, 484, 485, 767 N.Y.S.2d 891 (2d Dep't 2003).
New York's interest in protecting the health of its citizens is stronger than in the protection of property. Permitting an individual to recover medical monitoring costs may allow the individual to avoid the full consequences of a life-threatening disease. An exposure which, after a latency period, results in a serious disease is not fully remedied by a damage award to the victim. But an individual who fears that his personal information may be misused can be provided with a monetary remedy when and if the information is actually misused. Of course, there is the stress and anxiety of the very unpleasant experience.
If New York were to draw from its experience with toxic exposure, it would not likely recognize a claim in this case. By analogy, one would expect that, as a fundamental first element, New York would require proof that the plaintiffs personal data was stored electronically (such as on the hard drive of a laptop) and that the means of storage was lost or stolen. Here, it is undisputed that plaintiffs personal data was stored on the hard drive of one of the stolen laptops. But New York would likely require proof of a "rational basis" for the fear that the data would be misused. As in the case of medical monitoring, a fact finder would not be permitted to meander through a plaintiffs proffered inventory of circumstances amounting to a rational basis. A specific kind and quality of proof would be required, as it is in the case of medical monitoring.
An analogy to an item of property in a locked and stolen safe is much less apt. There, the owner of the property is deprived of possession and use of the property in the purloined safe, which is not the case with the theft of a laptop containing data. To resolve this motion, it is not necessary to probe the murky depths of the nature of personal information conveyed to a third-person and stored on the third-person's hard drive. Is it property or, rather, a means of access to property, e.g., bank and brokerage accounts? Has there been a theft of data if the data remains inaccessible to the thief? It is sufficient to conclude that the plaintiff has a protectable property interest in his personal data conveyed under an express or implied pledge of confidentiality.
Factors giving rise to a demonstrable basis for a serious concern over misuse may include evidence of the following: (1) the of lack any password-protection for use of the computer such that an unsophisticated user could boot the computer and immediately access the file; (2) that the person stealing the hard drive was motivated by a desire to access the data and had the capabilities to do so; or (3) actual access or misuse of information of the plaintiff or another person whose data was stored on the same hard drive. This Court cannot say with confidence that New York would recognize a claim if any or all of these elements were met. However, the Court can comfortably conclude that New York would not allow a claim to proceed where none of these elements are present.
The record on this motion, after an opportunity for full discovery on the subject, demonstrates that access to the hard drive of the laptop was password-protected. Thus, an individual possessing the laptop would have no immediate means of accessing any data on the hard drive. Despite a full and fair opportunity to conduct discovery, there is no evidence, direct or circumstantial, regarding the motive or capabilities of the thief. Finally, there is no evidence that this plaintiffs data has been accessed or used by anyone as a result of the theft nor is there any evidence that the data of any similarly situated person has been accesses or used. This Court concludes that New York would not allow a negligence to proceed on the facts of this case.
It does not appear that a second level of protection was uniformly in place such as an additional password for access to a specific file on the hard drive.
In addition to the claim in negligence, plaintiff also has asserted a claim for breach of fiduciary duty. For the purposes of this motion, this Court generously assumes (without deciding) that plaintiff would be able to establish the existence of a fiduciary relationship with defendant Towers. Under New York law, a claim for breach of fiduciary duty requires the plaintiff to prove that the breach "was a substantial factor in causing [the plaintiff] to sustain damages." N.Y. Pattern Jury Instructions-Civil PJI 3:59 (2008). However, once causation and fact of damage are proven, it is sufficient for the plaintiff on a breach of fiduciary duty claim to establish a fair approximation of the loss. Venizelos v. Oceania Maritime Agency. Inc., 268 A.D.2d 291, 292, 702 N.Y.S.2d 17 (1st Dep't 2000). Here, the plaintiff has not shown that he has yet suffered any damage caused by a breach of fiduciary duty. For the same reasons that he cannot recover in negligence, he may not recover on a breach of fiduciary duty theory.
The conclusions reached on the negligence and breach of fiduciary duty claims are consistent with those of other courts considering the issue. In Pisciotta, 499 F.3d at 639-40, the Seventh Circuit sought to apply Indiana law, but found no cases on point. After examining the reasoning of other courts applying the law of other jurisdictions, the court concluded:
Although some of these cases involve different types of information losses, all of the cases rely on the same basic premise: Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy. Plaintiffs have not come forward with a single case or statute, from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law. We decline to adopt a substantive innovation in state law or to invent what would be a truly novel tort claim on behalf of the state, absent some authority to suggest that the approval of the Supreme Court of Indiana is forthcoming.Id. (citations and internal quotation marks omitted). See Forbes v. Wells Fargo Bank, N.A., 420 F.Supp.2d 1018, 1021 (D.Minn. 2006) (granting summary judgment in defendant's favor on negligence and contract claims because time and money spent monitoring credit after computers containing sensitive information were stolen was not result of present injury); Kahle v. Litton Loan Servicing, LP, 486 F.Supp.2d 705, 712-13 (S.D.Ohio 2007) (granting defendant summary judgment because of plaintiffs failure to demonstrate injury as there was no evidence of identity fraud or that plaintiffs information was accessed); Guin v. Brazos Higher Educ. Serv. Corp., No. Civ. 05-668, 2006 WL 288483, at *6 (D.Minn. Feb. 7, 2006) (unpublished) (same); Hendricks v. DSW Shoe Warehouse, Inc., 444 F.Supp.2d 775, 782-83 (W.D.Mich. July 26, 2006) ("There is no existing Michigan statutory or case law authority to support plaintiffs position that the purchase of credit monitoring constitutes actual damages or a cognizable loss.").
In Shafran v. Harley Davidson, Inc., No. 07 Civ. 01365, 2008 WL 763177 (S.D.N.Y. Mar. 20, 2008), Judge Daniels granted a motion to dismiss a class action complaint based upon a lost laptop, finding that credit monitoring costs sought by plaintiff to protect against a yet-to-occur injury could not constitute an actual and legally cognizable injury. Id. at *2-3. In that case, the plaintiff sued the Harley Owners Group ("HOG") and Harley-Davidson, Inc. on seven causes of action seeking damages on his own behalf and on behalf of the putative class of HOG members. Id. at *1. There, like here, personal information of the plaintiff and approximately 60,000 others was on a laptop that went missing. Id. at *1.
In dismissing the complaint, Judge Daniels noted that "actual injury is, in fact, a required element of each of plaintiffs claims" and observed that New York courts had yet to decide whether "the time and money that could be spent to guard against identity theft constitutes an existing compensable injury" under New York law. Id. at *2. He further noted that every court that had decided the issue rejected claims for those types of damages:
Courts have uniformly ruled that the time and expense of credit monitoring to combat an increased risk of future identity theft is not, in itself, an injury that the law is prepared to remedy. Plaintiff has not presented any case law or statute, from any jurisdiction, indicating otherwise. Plaintiffs alleged injuries are solely the result of a perceived and speculative risk of future injury that may never occur.Id. at *3.
Summary judgment will be granted dismissing the claims for negligence and breach of fiduciary duty.
B. Plaintiffs Contract Claims
Plaintiff alleges that he is the third-party beneficiary of a contract between Towers and his employer, Altira. He asserts claims for breach of contract and breach of the implied covenant of good faith and fair dealing.
To succeed on a third-party beneficiary theory under New York law, the party "must establish (1) the existence of a valid and binding contract between other parties, (2) that the contract was intended for his or her benefit, and (3) that the benefit to him or her is sufficiently immediate, rather than incidental, to indicate the assumption by the contracting parties of a duty to compensate him if the benefit is lost." BDG Oceanside, LLC v. RAD Terminal Corp., 14 A.D.3d 472, 473, 787 N.Y.S.2d 388 (2d Dep't 2005). While the third-party beneficiary does not have to establish that it is explicitly mentioned in the contract, New York law requires that the parties' intent to benefit a third-party be shown on the face of the contract. See Strauss v. Belle Realty Co., 98 A.D.2d 424, 426, 469 N.Y.S.2d 948 (2d Dep't 1983); see also Port Chester Elec. Constr. Co. v. Atlas, 40 N.Y.2d 652, 652, 389 N.Y.S.2d 327, 357 N.E.2d 983 (1976); Synovus Bank of Tampa Bay v. Valley National Bank, 487 F.Supp.2d 360, 368 (S.D.N.Y. 2007).
As noted, discovery in this case has been bifurcated and limited to the issue of whether plaintiff can establish that he has suffered a compensable injury by reason of the theft of the laptops. Defendant's motion directed to the contract claims is more in the nature of a Rule 12(c) argument, that the plaintiff cannot demonstrate that the benefit to him under the contract was sufficiently immediate. The FAC is sufficient under the notice pleading standards of Rule 8(a). At this stage, this Court does not know the terms of the contract nor can it make an intelligent decision on the choice of law analysis. It remains to be decided whether the analysis that has been applied to the negligence and breach of fiduciary duty claims will also apply to the contract claims; the terms of the contract may have bearing on the outcome. The matter is better addressed in a subsequent summary judgment motion after discovery on the third-party beneficiary claim.
V. Conclusion
For all the foregoing reasons, defendant's motion is granted dismissing the claims for negligence and breach of fiduciary duty and denied as to the breach of contract claims. The claims for misrepresentation and breach of privacy are withdrawn on plaintiff's application.
SO ORDERED.