William O. Bertelsman United States District Judge

MEMORANDUM OPINION AND ORDER

This class-action case involves a stolen flash drive containing the personal information of approximately 9,000 current and previous employees of Defendants. Defendants allowed an employee to take the flash drive home, where it was stolen during a home burglary. Plaintiffs are current or former employees of Defendants and allege that Defendants should have been more careful with their personal information.

The matter is before the Court on Defendants' motion to dismiss. (Doc. 33). The Court heard oral argument on the motion and took the matter under submission. (Doc. 40). The parties filed supplemental briefing relating to jurisdiction under the Class Action Fairness Act. (Doc. 41, Doc. 44, Doc. 46).

The Court now issues the following Memorandum Opinion and Order.

Factual and Procedural Background

Defendants allowed an employee to work from home with an unencrypted flash drive containing the personal information of approximately 9,000 current and previous employees. (Doc. 33-1 at 9). The information on the flash drive included social security numbers, names, dates of birth, and employee identification numbers. (Id.). The flash drive was stolen from the employee's home during a burglary and has not been recovered. (Id.).

Within thirty days of the theft, Defendants mailed notice to each potentially affected employee and set up a call center to answer questions about the data breach. (Id.). Defendants also offered one year of credit monitoring services. (Id.).

The seven named Plaintiffs seek damages for Defendants' alleged carelessness in allowing an employee to take home an unencrypted flash drive containing their personal information. Plaintiffs assert two claims under the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq., and six claims under state law: negligence, negligence per se, breach of fiduciary duty, negligent inflection of emotional distress, intentional infliction of emotional distress, and breach of express or implied-in-fact contract. (Id. at 9-10). Defendants filed a motion to dismiss, arguing the FCRA does not apply to them and the complaint inadequately pleads the state law claims.

An issue concerning subject-matter jurisdiction was raised at oral argument by the Court. The Court asked counsel whether jurisdiction would still exist if the FCRA claims were dismissed. (Doc. 47 at 15:21-23). Plaintiffs' counsel argued the Court would have jurisdiction under the Class Action Fairness Act of 2005 ("CAFA"), 28 U.S.C. § 1332(d) as alleged in the complaint, and pointed out that Defendants had not challenged jurisdiction in their motion to dismiss. (Doc. 47 at 15:24-25, 16:1-3). Defendants' counsel acknowledged they had not challenged CAFA jurisdiction. (Id. at 16:10-13). Nevertheless, Defendants' counsel advised that jurisdictional issues could arise if the FCRA claims were dismissed. (Id. at 16:14-21). Counsel for both sides admitted that "there may be a need for some discovery on [CAFA jurisdiction]". (Id. at 16:3-5, 16:16-18, 18:12-16).

A week after oral argument, Defendants filed a document entitled "Supplemental Statement Regarding Jurisdiction." (Doc. 41). The document identifies two exceptions to CAFA jurisdiction, which order a district court to "decline to exercise [CAFA] jurisdiction" if certain citizenship characteristics are present in the class. 28 U.S.C. § 1332(d)(4)(A)-(B). The "Supplemental Statement" also represents that Defendants' records show that 8,032 of the 9,727 individuals who received mail notice of the data breach "reside in Kentucky." (Doc. 41 at 4). Plaintiffs filed a response brief (Doc. 44) and argue that Defendants conceded or waived any challenge to CAFA jurisdiction, and alternatively argue that Defendants had not met their burden of proof under the exceptions. Defendants filed a reply brief (Doc. 46) and argue they did not waive or concede a challenge to CAFA jurisdiction under the exceptions. Additionally, Defendants filed a signed affidavit which attests to the veracity of the records showing where notification letters were sent. (Doc. 46-1).

Analysis

A. Standard of Review

To survive a motion to dismiss, the complaint must contain "sufficient factual matter, accepted as true, to state a claim to relief that is plausible upon its face." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation and internal quotation marks omitted). While the Court construes the complaint "in favor of the complaining party" and presumes the general allegations "encompass the specific facts necessary to support" the claim, the Court need not accept as true legal conclusions or unwarranted factual inferences. Kardules v. City of Columbus, 95 F.3d 1335, 1346 (6th Cir. 1996).

B. The FCRA does not apply to Defendants.

The Court finds the FCRA does not apply to Defendants. The FCRA creates a cause of action for willful or negligent noncompliance with its provisions. 15 U.S.C. §§ 1681n, 1681o. Plaintiffs allege Defendants failed to comply with § 1681e(a), which requires a "consumer reporting agency" to "maintain reasonable procedures designed . . . to limit the furnishing of consumer reports [for certain purposes]." However, § 1681e(a) is inapplicable here because Defendants are not "consumer reporting agencies" (CRAs), and stolen consumer information is not "furnished" for purposes of a § 1681e(a) violation.

i. Defendants are not CRAs because they do not assemble or evaluate consumer credit information for the purpose of furnishing consumer reports to third parties.

By its own terms, § 1681e(a) only applies to CRAs. A CRA is an entity that gathers consumer credit information for the purpose of furnishing "consumer reports" to third parties. § 1681a(f). Accordingly, an entity cannot be a CRA unless it furnishes "consumer reports." See Owner-Operator Indep. Drivers Ass'n, Inc. v. USIS Com. Services, Inc., 537 F.3d 1184, 1191 n.8 (10th Cir. 2008). A "consumer report" is a transfer of data that contains information about a consumer's credit worthiness, used to establish the consumer's eligibility for credit, insurance, or employment. § 1681a(d). However, the term "consumer report" does not include any "report containing information solely as to transactions or experiences between the consumer and the person making the report...". § 1681a(d)(2)(A)(i).

The complaint alleges that Defendants collect and transmit personal information for insurance and employment purposes. (Doc. 30 at ¶ 12). Nevertheless, the complaint alleges that Defendants garner this information by directly administering healthcare to Plaintiffs, and by functioning as Plaintiffs' employer. (Doc. 30 at 5-6). Information garnered from such direct and firsthand interaction falls within the "transactions and experiences" exclusion. See Tierney v. Advoc. Health and Hosps. Corp., 797 F.3d 449, 452 (7th Cir. 2015) (information concerning interactions between the healthcare provider and its patients fall within the exclusion).

Plaintiffs argue the "transactions or experiences" exception does not apply. First, they argue "when the communication is no longer coming directly from the entity with which the consumer had a transaction or experience, and the communication is not going to another entity related by common ownership or control, the 'transactions or experiences' exemption ceases to provide protection." Lewis v. Ohio Prof. Elec. Network LLC, 190 F. Supp. 2d 1049, 1060 (S.D. Ohio 2002). The complaint alleges that Defendants transfer information to "affiliates and partners across multiple platforms" and those affiliates and partners then transfer the information to third parties. (Doc. 30 at ¶ 13; Doc. 34 at 10). Plaintiffs point out only Defendants had the firsthand experiences; when Defendants' affiliates and partners send the information to third parties, "entities other than entity with which the consumer had a transaction or experience" are communicating the information. (Doc. 34 at 15).

However, this only means the affiliates and partners are not entitled to the exclusion. In Lewis, a police department regularly sent information regarding bookings and arrests to a third party, which would then compile and sell the information. 190 F. Supp. 2d at 1059. The court held the third party was not entitled to the exclusion, because it did not garner the booking and arrest information through firsthand experiences. Id. Rather, the "transactions and experiences" exclusion "rightfully belong[ed]" to the police department, because it only sent information garnered through arrests and bookings the police themselves performed, which were direct and firsthand experiences with "consumers." Id. at 1060-61.

In the current case, Defendants only send information garnered through firsthand experiences. While Defendants' partners and affiliates may subsequently send this information to other parties, this only shows the partners and affiliates are not entitled to the exclusion. What Defendants' partners and affiliates do with the information does not implicate Defendants' entitlement to the exclusion.

Additionally, Plaintiffs argue the "transactions or experiences" exclusion does not apply because certain categories of medical information described in § 1681a(d)(3) do not fall within the exclusion. However, the transmission of such medical information is not a consumer report if the information is disclosed for "any purpose permitted without authorization under the Standards for Individually Identifiable Health Information promulgated by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 [HIPAA]...". § 1681b(g)(3). Essentially, if medical information can be disclosed under HIPPA without authorization, a transfer of the information does not trigger § 1681a(d)(3).

HIPPA allows a health care provider to use or disclose protected health information without authorization if the use is for the health care provider's "own treatment, payment, or health care operations." 45 C.F.R. § 164.506(c). The complaint alleges that Defendants transmit the information to enroll employees in work benefits, to determine whether their employees are eligible for insurance coverage for medical treatments, and to obtain payment for providing healthcare services. (Doc. 30 at ¶ 12). Sending information to insurance companies and benefit providers is necessarily part of a hospital network's billing and employment practices and is done within the scope of Defendants' "health care operations."

In conclusion, the complaint only refers to data that Defendants compile while directly providing employment and healthcare to the members of the proposed class. Any subsequent transfers made by their affiliates and partners are not transfers by Defendants. While the data transfers may include personal medical information, the transfers are incidental to Defendants' primary business of operating healthcare facilities. Consequently Defendants do not furnish "consumer reports."

ii. Defendants are not CRAs because they do not transfer the information for fees or on a cooperative nonprofit basis.

Defendants are not CRAs for a second reason. A CRA must transfer consumer credit information to receive "monetary fees, dues, or on a cooperative nonprofit basis." § 1681a(f). Here, the complaint does not allege Defendants receive fees for assembling and transferring this information. While Defendants do receive payments after transfers of information occur, the payments are not for the information transferred; rather, the insurance company is reimbursing Defendants for healthcare services provided to the insured. See Tierney, 797 F.3d at 452. Courts have generally concluded that a transmission of consumer information for "business purposes" does not implicate the FCRA, as the FCRA only regulates "consumer purposes." Ippolito v. WNS, Inc., 864 F.2d 440, 452 (7th Cir. 1988); see also Matthews v. Worthen Bank & Trust Co., 741 F.2d 217, 219 (8th Cir. 1984).

Plaintiffs alternatively argue that Defendants share this information on a "nonprofit cooperative basis." (Doc. 34 at 14). Plaintiffs point to a "healthcare data collection and sharing partnership" that Defendants have with local high schools and sport medicine facilities. (Doc. 34-4). The FCRA does not regulate such partnerships. The referenced partnership is an injury prevention program that collects information about injuries sustained by high school athletes, broken down by school, team, sport, and gender. (Doc. 34-4 at 1). The information only concerns injuries suffered by high school athletes; it is wholly unrelated to consumer purposes, and is not used to establish eligibility for credit, employment, or insurance.

Plaintiffs also point to Defendants' "Billing and Collection Policy" (Doc. 34-5) which explains Defendants "sell" outstanding debt to collection agencies, and thus Defendants earn fees for the transfer of information which implicates the FCRA protections. (Doc. 34-5 at 14-15). To begin with, this likely falls within the "transactions and experiences" exclusion as detailed above. Furthermore, the money Defendants earn from such a transfer is not for the information itself. Rather, the collection agencies are paying for the collection rights on healthcare debts Defendants created by providing healthcare services. Neither does this qualify as a nonprofit venture. Defendants are selling the debt to generate immediate cash proceeds for services they have rendered, while collection agencies hope to collect more than what they paid for on the debt.

Defendants are simply not involved in the business of selling consumer credit information for consumer purposes. They are in the business of providing healthcare, and the alleged transfers of consumer credit information are incidental to that business. Defendants are not CRAs, and not subject to § 1681e(a).

iii. Stolen data is not "furnished."

Even if Defendants were CRAs, Plaintiffs' FCRA claims would be dismissed for a second reason. Section 1681e(a) only requires a "consumer reporting agency" to "maintain reasonable procedures designed . . . to limit the furnishing of consumer reports [for designated reasons]." If the alleged negligent act does not arise during a "furnishing" of a consumer report, the negligent act does not trigger a violation of § 1681e(a). Washington v. CSC Credit Services Inc., 199 F.3d 263, 267 (5th Cir. 2000).

The word "furnish" denotes an active transmission of data, rather than the failure to protect such data from the hands of criminals. Claims brought under the FCRA that involve stolen information have been routinely dismissed because such information is not "furnished" for purposes of § 1681e(a) violation. Holmes v. Countrywide Fin. Corp., No. 5:08-CV-00295-R, 2012 WL 2873892, at *16 (W.D. Ky. 2012) (a "common sense understanding of the word underscores" that stolen information is not furnished); see Washington, 199 F.3d at 267; In re Experian Data Breach Litig., No. SACV 15-1592 AG, 2016 WL 7973595, at *2 (C.D. Cal. 2016); Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2015 WL 292947, at *3 (N.D. Ill. 2015); Galaria v. Nationwide Mut. Ins. Co., No. 2:13-cv-118, 2017 WL 4987663, at *4 (S.D. Ohio 2017). Here, the information was stolen by unknown parties during a burglary. While arguably the information could have been better protected, § 1681e(a) only refers to procedures that aim to limit inappropriate "furnishings." The stolen information here was not "furnished" and thus the allegations of the complaint do not implicate § 1683e(a).

In conclusion, Plaintiffs' FCRA claims will be dismissed. The complaint does not sufficiently allege that Defendants are CRAs, and stolen information is not "furnished" for purposes of a FCRA violation. Certainly, the FCRA does not only apply to traditional credit reporting bureaus. See Adams v. Natl. Engr. Serv. Corp., 620 F. Supp. 2d 319, 322, 328 (D. Conn. 2009) (staffing agency selling background checks and employment screening services); Lewis, 190 F. Supp. 2d at 1059 (not-for-profit corporation selling access to arrest and booking information). However, such entities are primarily involved in the business of selling and providing information about consumers to third parties who intend to use that information in deciding whether to extend credit, offer employment, or provide insurance. Claims against healthcare companies and other businesses that transmit such information while providing other types of service have been routinely dismissed, as the FCRA was intended to regulate information used in a "consumer" context. See Ippolito, 864 F.2d at 452. The allegations currently before the Court do not trigger the FCRA's protections.

C. The Class Action Fairness Act and Exceptions

As Plaintiffs' FCRA claims have now been dismissed, the case no longer implicates a question of federal law. However, the complaint asserts as an alternative basis for subject-matter jurisdiction the Class Action Fairness Act of 2005 ("CAFA"), 28 U.S.C. § 1332(d). (Doc. 30 at ¶ 23). The issue of CAFA's applicability arose during oral argument, and both parties filed supplemental briefing on the matter. Plaintiffs argue that Defendants have conceded or waived any argument asserting an exception to CAFA jurisdiction, and alternatively argue that Defendants have not met the requisite burden of proof to invoke one of the exceptions.

For the Court to have original jurisdiction under CAFA, the complaint must only adequately allege each element in § 1332(d)(1). Defendants seem to admit the complaint does so. Instead, Defendants argue that several exceptions to CAFA jurisdiction apply. Found in § 1332(d)(4), these exceptions "do not deprive a court of jurisdiction"; rather, the Court must decline to exercise jurisdiction if certain citizenship characteristics exist within the proposed class. Clark v. Lender Processing Services, 562 Fed. Appx. 460, 465 (6th Cir. 2014).

At oral argument, Defendants' counsel stated that a jurisdictional issue may arise in the case that the FCRA claims were dismissed; all parties also agreed that some discovery may be needed to fully determine the applicability of CAFA. (Doc. 47 at 16:2-5, 14-21; 18:9-16). Consequently, Defendants have not conceded any argument with respect to CAFA's exceptions.

Plaintiffs next contend that Defendants have waived any argument concerning CAFA's exceptions. The applicability of CAFA's exceptions may be waived if the argument is not timely asserted, as the exceptions are not "jurisdictional." Clark, 562 Fed. Appx. at 465. In general, a moving party must raise the issue within a "reasonable time," which is usually the "earliest practicable time" such a motion could be made, depending on the facts of the case. Gold v. New York Life Ins. Co., 730 F.3d 137, 142 (2d Cir. 2013).

In analyzing the issue, courts generally examine the procedural posture of the case, and whether the argument could have been made at an earlier time. For example, the Sixth Circuit found the CAFA exceptions were waived because they were presented for the first time on appeal. Clark, 562 Fed. Appx. at 465. Additionally, in Martin v. Trott L., P.C., the defendant failed to raise the issue until the "second round of dispositive motions" after several depositions had been taken, even though the defendant had access to the relevant information for several years preceding the motion. 265 F. Supp. 3d 736, 744-45 (E.D. Mich. 2017). With no explanation for his delay, the court found he had waived the argument. Id. Other district courts have similarly focused on how long the case has been litigated. Bey v. SolarWorld Industries Am., Inc., 904 F. Supp. 2d 1103, 1109 (D. Or. 2012) (claim was not waived as the court raised the issue sua sponte less than a year after the complaint was filed, which was "relatively early in the case"); Barfield v. Sho-Me Power Elec. Co-op., 2:11-CV-04321-NKL, 2014 WL 1343092, at *4 (W.D. Mo. 2014) (twenty-six month delay was unreasonable given the "advanced state of the litigation, and the time and resources expended by the Court and Parties").

Plaintiffs point out the complaint's jurisdictional allegations have remained unchanged over the course of twice amending the complaint, and that the original complaint was filed long before Defendants filed their "Supplemental Statement." They highlight the fact that Defendants did not raise any challenge to CAFA in their motion to dismiss, and argue there is no justification for the delay to assert the argument as Defendants have access to the proposed class members' citizenship and residency information.

After examining the procedural posture of this case, the Court rejects the argument that Defendants have waived the CAFA exceptions. The issue of CAFA's applicability arose at oral argument on March 20, 2020, less than a year after Plaintiffs filed the first complaint. Additionally, only a week after oral argument where the issue was raised, Defendants filed the "Supplemental Statement" setting forth the exceptions to CAFA and describing the residency characteristics of the members of the proposed class. No depositions or discovery have occurred yet, and the Court has yet to rule on any dispositive motions. While the complaint has twice been amended, the amendments only included changes to the named Plaintiffs. (Doc. 44 at 3). This is far different from cases where the moving party waited to raise the issue until an appeal or after several years of litigation had already occurred.

Plaintiffs finally argue that the exceptions do not apply, at least at this juncture, because Defendants have not carried the requisite burden of proof. The party asserting an "exception to CAFA bears the burden of establishing each element of the exception by a preponderance of the evidence." Mason v. Lockwood, Andrews & Newnam, P.C., 842 F.3d 383, 388 (6th Cir. 2016). To analyze Plaintiffs' argument, a brief description of CAFA's exceptions is necessary.

Congress enacted CAFA in 2005, which supplies "federal district courts with 'original jurisdiction' to hear a 'class action' if the class has more than 100 members, the parties are minimally diverse, and the 'matter in controversy exceeds the sum or value of $5,000,000." Standard Fire Ins. Co. v. Knowles, 133 S.Ct. 1345, 1348 (2013) (quoting § 1332(d)(2)). However, § 1332(d)(4) states that a "district court shall decline to exercise [CAFA] jurisdiction" if one of two exceptions apply.

One of the exceptions is the "home state exception." A district court must decline to exercise CAFA jurisdiction when two-thirds or more of all members of the proposed class, and the primary defendants, are citizens in the state where the action was originally filed. § 1332(d)(4)(B). These exceptions "are designed to draw a delicate balance between making a federal forum available to genuinely national litigation and allowing the state courts to retain cases when the controversy is strongly linked to that state." Hart v. FedEx Ground Package Sys. Inc., 457 F.3d 675, 682 (7th Cir. 2006). The exceptions "keep purely local matters and issues of particular state concern in the state courts...". Lowery v. Alabama Power Co., 483 F.3d 1184, 1193-94 (11th Cir. 2007).

The main issue is the citizenship of Defendants and the citizenship of the members of the proposed class. The complaint states that Defendants are non-profit corporations headquartered in Kentucky. (Doc. 30 at ¶¶ 9-10). Accordingly, Defendants are citizens of Kentucky. § 1332(c)(1).

With respect to the members of the proposed class, citizenship depends on the members' "domicile." Von Dunser v. Aronoff, 915 F.2d 1071, 1072 (6th Cir. 1990); § 1332(d)(7). "Domicile" requires a person to (1) reside in the state (2) with the intention of staying there. Prime Rate Premium Fin. Corp., Inc. v. Larson, 930 F.3d 759, 765 (6th Cir. 2019). While domicile is a factual question, there is a "rebuttable presumption that a person's residence is his domicile." Mason, 842 F.3d at 390. This presumption "fits particularly well in the CAFA exception context, where the moving party is tasked with demonstrating a fact-centered proposition about a mass of individuals...". Id. at 392.

Here, the proposed class is "approximately 9,000 employees and former employees of St. Elizabeth" whose information was compromised when the flash drive was stolen. (Doc. 30 at ¶ 1). The complaint alleges that all the named Plaintiffs either reside in or are citizens of Kentucky. (Doc. 30 at ¶¶ 14-20). On the other hand, the complaint does not allege the residence or citizenship of the rest of the class. It only alleges that at "least one member of the putative class is a citizen of a state different from [Defendants]...". (Doc. 30 at ¶ 7).

The record now reflects information that indicates the citizenship of the proposed class members. After oral argument, Defendants filed a signed declaration, wherein their general counsel references a list of names used to mail notice of the data breach to the potentially affected parties. (Doc. 46-1). After consulting the list, Defendants found that 8,032 of the 9,727 total names "resided in Kentucky" and received the letter at a Kentucky address. (Doc. 46-1 at ¶ 4). The rest of the letters were sent out-of-state. Id. The letters were sent on March 7, 2019, about a month after the breach occurred. (Doc. 30 at ¶¶ 36, 38).

Defendants' declaration shows that over eighty percent of the individuals received the letter at an address in Kentucky. Plaintiffs have not presented any evidence as to why the presumption, that a person's domicile is their residence, should not apply here, other than to speculate that such parties may have moved out-of-state. As the presumption is especially strong in the CAFA context, and the list of letters sent shows over eighty percent of the proposed class members were Kentucky residents, Defendants' declaration sufficiently indicates that at least two-thirds of the proposed class are citizens of Kentucky.

The "home state exception" applies when two-thirds or more of all members of the proposed class, and the primary defendants, are citizens in the state where the action was originally filed. § 1332(d)(4)(B). Over eighty percent of the proposed class are presumed to be citizens of Kentucky, and all Defendants are citizens of Kentucky. The Court finds the "home state" exception applies and is compelled to "decline to exercise [CAFA] jurisdiction" over this case. § 1332(d)(4).

D. Remaining State Law Claims

The complaint alleged the Court had supplemental jurisdiction over Plaintiffs' state law claims pursuant to 28 U.S.C. § 1367. However, the Court may decline to exercise jurisdiction over such claims if the Court "has dismissed all claims over which it has original jurisdiction." 28 U.S.C. § 1367. As set forth above, the FCRA claims are dismissed, and the Court is required by § 1332(d)(4)(B) to decline to exercise CAFA jurisdiction over the matter. Consequently, the Court declines to exercise its supplemental jurisdiction over the state claims.

Therefore, having reviewed this matter, and the Court being advised,

IT IS ORDERED that:

(1) Defendants' motion to dismiss (Doc. 33) be, and is hereby, GRANTED IN PART with respect to Claims I and II of the complaint, dismissing the alleged violations of the FCRA;

(2) The Court declines to exercise supplemental jurisdiction over the remaining state law claims under 28 U.S.C. 1367(c)(3), and thus dismisses those claims.

Signed By:

William O . Bertelsman

United States District Judge