Opinion
1:20-CV-10834-ALC
03-18-2022
Ron Gilbert, et al., Plaintiffs, v. AFTRA Retirement Fund, Defendant.
ORDER DENYING MOTION TO DISMISS WITHOUT PREJUDICE
Hon. Andrew L. Carter, Jr. United States District Judge.
On February 25, 2020, Defendant AFTRA Retirement Fund (“AFTRA” or “Defendant”) issued a press release announcing a data breach (“Data Breach”) potentially implicating over 494, 069 individuals' personal identifiable information (“PII”) that occurred on or about October 28, 2019. AFTRA began disseminating notice of the Data Breach on or about December 17, 2020. As a retirement fund, AFTRA maintained members' PII. Plaintiffs A.A. (a minor, by and through his natural parent, Steve Altes), Sean Boozer, Paul Bright, Billy Choi, Ron Gilbert, Linnette Harrigan, and Maurice Tyson (collectively, “Plaintiffs”) bring this consolidated putative class action against AFTRA, alleging the unauthorized disclosure of their and putative class members' PII resulting from the Data Breach. Plaintiffs assert four claims on behalf of all Plaintiffs and the putative class for negligence, breach of implied contract, unjust enrichment/quasi-contract, and breach of confidence; one claim on behalf of Plaintiffs Harrigan and Tyson (together, the “New York Plaintiffs”) and the New York Sub-Class under N.Y. Gen. Bus. Law § 349 (Deceptive Practices); three claims on behalf of A.A., Boozer, Choi, and Gilbert (together, the “California Plaintiffs”) and the California Sub-Class under Cal. Civ. Code § 1750, et seq. (Consumer Legal Remedies Act), California Business & Professions Code § 17200, et seq. (Unfair Competition), and Cal. Civ. Code § 1798, et seq. (Customer Records Act); and a claim on behalf of Plaintiff Bright, an Oregon resident, and the Oregon Sub-Class under Or. Rev. Stat. §§ 646.608, et seq. Before the Court is AFTRA's motion to dismiss pursuant to Fed.R.Civ.P. 12(b)(1) for lack of standing and 12(b)(6) for failure to state a claim upon which relief can be granted.
AFTRA refers to the American Federation of Radio and Television Artists.
Plaintiffs commenced this action on December 22, 2020 against two defendants-AFTRA Retirement Fund and The SAG-AFTRA Health Plan. However, on March 26, 2021, Plaintiffs voluntarily dismissed former defendant The Sag-AFTRA Health Plan. ECF No. 24.
Plaintiffs agreed to withdraw their claim under N.Y. Gen. Bus. Law § 899-aa on behalf of New York Plaintiffs and the New York Sub-Class, acknowledging that it does not provide a private right of action. Pl.'s Mem. at 1 n.1.
The eighth and ninth causes of action appear to be duplicative. Compl. ¶ 267-77, 278-88.
Plaintiffs agreed to withdraw their cause of action under the California Consumer Privacy Act, Cal. Civ. Code § 1798.100, et seq. on behalf of California Plaintiffs and the California Sub-Class, indicating that the claim is “premature” and reserving rights to move to amend the Amended Complaint should discovery provide a basis to state a cognizable claim for relief. Pl.'s Opp. at 1 n.1.
On March 29, 2021, Plaintiffs filed the Consolidated Amended Class Action Complaint (“Am. Compl.” or “Amended Complaint”). ECF No. 25. Defendants moved to dismiss on June 7, 2021. ECF No. 37. Plaintiffs opposed on July 9, 2021. ECF No. 40. On July 23, 2021, Defendants replied. ECF No. 41.
Defendant's first ground for dismissal is for lack of Article III standing. It argues that this Court is deprived of subject matter jurisdiction because Plaintiffs have failed to sufficiently plead injury in fact that is also fairly traceable to the Data Breach. Plaintiffs respond that they have adequately alleged injury in fact, including, for instance, (1) monetary damages resulting from actual fraud, (2) increased risk of identity fraud and theft, (3) loss of time and money spent on mitigation, (4) loss of the benefit of their bargain with Defendant, and (5) diminution in value of their PII.
A party must have Article III standing-“the personal interest that must exist at the commencement of the litigation.” Carter v. HealthPort Techs., LLC, 822 F.3d 47, 55 (2d Cir. 2016) (citing Davis v. FEC, 554 U.S. 724, 732 (2008)). A standing issue may be raised at any stage in a litigation, see Id. (citing Arbaugh v. Y & H Corp., 546 U.S. 500, 506 (2006)), and “the party invoking federal jurisdiction bears the burden of establishing the elements.” Id. (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). Under the U.S. Constitution, the jurisdiction of the federal courts is limited to “cases” and “controversies.” U.S. Const., Art. III, § 2. “The doctrine of standing gives meaning to these constitutional limits by ‘identify[ing] those disputes which are appropriately resolved through the judicial process.'” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 156 (2014) (quoting Lujan, 504 U.S. at 560). “[A]bstract injury is not enough; rather the threat of injury must be both real and immediate, not conjectural or hypothetical.” Shain v. Ellison, 356 F.3d 211, 215 (2d Cir. 2004) (quoting O'Shea v. Littleton, 414 U.S. 488, 495-96 (1974)) (internal quotation marks omitted).
“Article III standing consists of three ‘irreducible' elements: (1) injury-in-fact, which is a ‘concrete and particularized' harm to a ‘legally protected interest'; (2) causation in the form of a ‘fairly traceable' connection between the asserted injury-in-fact and the alleged actions of the defendant; and (3) redressability, or a non-speculative likelihood that the injury can be remedied by the requested relief.” W.R.Huff Asset Mgmt. Co., LLC v. Deloitte & Touche LLP, 549 F.3d 100, 107 (2d Cir. 2008) (quoting Lujan, 504 U.S. at 560-61). “[T]he question of standing is whether the litigant is entitled to have the court decide the merits of the dispute or of particular issues . . . . [t]his inquiry involves both constitutional limitations on federal court jurisdiction and prudential limitations on its exercise.” Rajamin v. Deutsche Bank Nat'l Trust Co., 757 F.3d 79, 84 (2d Cir. 2014) (quoting Warth v. Seldin, 422 U.S. 490, 498 (1975)). “When standing is challenged on the basis of the pleadings, we ‘accept as true all material allegations of the complaint, and must construe the complaint in favor of the complaining party.'” United States v. Vasquez, 143 F.3d 74, 81 (2d Cir. 1998) (quoting Warth, 422 U.S. at 501).
To establish standing, a plaintiff must, at a minimum, allege “injury in fact that is concrete, particularized, and actual or imminent.” TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2203 (2021). Approximately two weeks after the Parties started briefing the motion to dismiss the Amended Complaint, the Supreme Court decided TransUnion, which elaborated upon the concrete-harm requirement for standing purposes. The Court instructed, among other things, that “[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation may sue that private defendant over that violation in federal court.” Id. at 2205 (emphasis original). The decision also stated that “in a suit for damages, the mere risk of future harm, standing alone, cannot qualify as a concrete harm-at least unless the exposure to the risk of future harm itself causes a separate concrete harm.” Id. at 2210-11 (emphasis original).
Guided by TransUnion, the Second Circuit recently held that plaintiffs lacked standing for failure to plead a concrete harm where it was undisputed that the defendant bank, BNY Mellon, had untimely filed a satisfaction of mortgage in violation of state recording statutes. See Maddox v. Bank of New York Mellon Tr. Co., N.A., 19 F.4th 58 (2d Cir. 2021). Because TransUnion “narrowed the grounds for asserting standing where the injury is primarily statutory, ” Faehner v. Webcollex, LLC, No. 21-1734-CV, 2022 WL 500454, at *1 (2d Cir. 2022) (summary order), this Court must be certain that each individual named plaintiff in this action has adequately alleged Article III injury-in-fact, with the requisite concreteness, regarding each of their statutory claims for damages.
Considering TransUnion and Maddox, and the fact that Plaintiffs have not had a meaningful opportunity to respond regarding this intervening authority, Defendant's motion to dismiss is denied without prejudice to re-filing a renewed motion. No. later than April 4, 2022, the Parties shall submit a joint status letter indicating how they would like to proceed with this case. For instance, Plaintiffs may intend to seek leave of court to amend. Alternatively, Defendant may intend to renew its motion to dismiss. If Defendant intends to do so, the renewed motion should, at a minimum, address TransUnion and Maddox, but it should also consider the impact of those cases, if any, on McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295 (2d Cir. 2021). The Clerk of Court is directed to terminate the motion at ECF No. 37.
Before the Supreme Court decided TransUnion, the Second Circuit Court of Appeals addressed the issue whether a person whose PII is stolen in the context of a data breach may establish Article III injury by showing a future risk of harm or threat of impending injury. The Circuit Court ultimately held “that courts confronted with allegations that plaintiffs are at an increased risk of identity theft or fraud based on an unauthorized data disclosure should consider the following non-exhaustive factors in determining whether those plaintiffs have adequately alleged an Article III injury in fact: (1) whether the plaintiffs' data has been exposed as the result of a targeted attempt to obtain that data; (2) whether any portion of the dataset has already been misused, even if the plaintiffs themselves have not yet experienced identity theft or fraud; and (3) whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.” McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 303 (2d Cir. 2021) (emphasis added).
SO ORDERED.