Opinion
Civil Action No. 22-cv-11168-ADB Civil Action No. 22-cv-30096-ADB Civil Action No. 22-cv-40082-ADB
2023-09-15
Elizabeth TAYLOR, on behalf of herself and all others similarly situated, Plaintiffs, v. UKG, INC., and Beth Israel Deaconess Hospital - Plymouth, Inc., Defendants. Audrey Arpie, on behalf of herself and all others similarly situated, Plaintiffs, v. UKG, Inc., Mercy Medical Group, Inc., and Trinity Health of New England Corporation, Inc., Defendants. Kimberly Fuller and Paula Robichaud, on behalf of themselves and others similarly situated, Plaintiffs, v. UKG, Inc., Heywood Healthcare, Inc., Defendants.
D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, Jack J. Canzoneri, McDonald Lamond Canzoneri LLC, Southborough, MA, for Plaintiff Elizabeth Taylor in No. 22-cv-11168, Kimberly Fuller in No. 22-cv-40082. D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, for Plaintiff Paula Robichaud in No. 22-cv-40082. Jeremiah Frei-Pearson, Pro Hac Vice, D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, Jack J. Canzoneri, McDonald Lamond Canzoneri LLC, Southborough, MA, for Plaintiffs in No. 22-cv-30096. Alan Y. Wong, Emyr T. Remy, Shook Hardy & Bacon LLP, Boston, MA, Alfred John Saikali, Shook, Hardy & Bacon L. L. P., Miami, FL, Elisabeth Ann Hutchinson, Morrison Foerster, Denver, CO, Maveric Ray Searle, Shook, Hardy & Bacon L.L.P., Chicago, IL, for Defendant UKG, Inc. in Nos. 22-cv-11168, 22-cv-30096, 22-cv-40082. Anthony D. Rizzotti, Melissa L. McDonagh, Shea A. Miller, Littler Mendelson, P.C., Boston, MA, for Defendant Beth Israel Deaconess Hospital - Plymouth, Inc. in No. 22-cv-11168. Robert William Pritchard, Sarah J. Miley, Sean P. Dawson, Littler Mendelson, Pittsburgh, PA, Shea A. Miller, Littler Mendelson P.C., Boston, MA, for Defendants Mercy Medical Group, Inc., Trinity Health of New England Corporation, Inc. in No. 22-cv-30096. Christopher B. Kaczmarek, Matthew J. Lynch, Littler Mendelson, Boston, MA, for Defendant Heywood Healthcare, Inc. in No. 22-cv-40082.
D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, Jack J. Canzoneri, McDonald Lamond Canzoneri LLC, Southborough, MA, for Plaintiff Elizabeth Taylor in No. 22-cv-11168, Kimberly Fuller in No. 22-cv-40082. D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, for Plaintiff Paula Robichaud in No. 22-cv-40082. Jeremiah Frei-Pearson, Pro Hac Vice, D. Greg Blankinship, Finkelstein, Blankinship, Frei-Pearson & Garber, LLP, White Plains, NY, Jack J. Canzoneri, McDonald Lamond Canzoneri LLC, Southborough, MA, for Plaintiffs in No. 22-cv-30096. Alan Y. Wong, Emyr T. Remy, Shook Hardy & Bacon LLP, Boston, MA, Alfred John Saikali, Shook, Hardy & Bacon L. L. P., Miami, FL, Elisabeth Ann Hutchinson, Morrison Foerster, Denver, CO, Maveric Ray Searle, Shook, Hardy & Bacon L.L.P., Chicago, IL, for Defendant UKG, Inc. in Nos. 22-cv-11168, 22-cv-30096, 22-cv-40082. Anthony D. Rizzotti, Melissa L. McDonagh, Shea A. Miller, Littler Mendelson, P.C., Boston, MA, for Defendant Beth Israel Deaconess Hospital - Plymouth, Inc. in No. 22-cv-11168. Robert William Pritchard, Sarah J. Miley, Sean P. Dawson, Littler Mendelson, Pittsburgh, PA, Shea A. Miller, Littler Mendelson P.C., Boston, MA, for Defendants Mercy Medical Group, Inc., Trinity Health of New England Corporation, Inc. in No. 22-cv-30096. Christopher B. Kaczmarek, Matthew J. Lynch, Littler Mendelson, Boston, MA, for Defendant Heywood Healthcare, Inc. in No. 22-cv-40082. MEMORANDUM AND ORDER BURROUGHS, UNITED STATES DISTRICT JUDGE
Elizabeth Taylor, Aubrey Arpie, and Kimberly Fuller and Paula Robichaud (collectively, the "Fuller Plaintiffs") (collectively, "Plaintiffs") filed related, putative class actions against their employers: Taylor against Beth Israel Deaconess Hospital - Plymouth, Inc. ("BID-Plymouth"); Arpie against Mercy Medical Group, Inc. ("Mercy") and Trinity Health of New England Corporation, Inc. ("Trinity Health of New England"); and the Fuller Plaintiffs against Heywood Healthcare, Inc. ("Heywood") (collectively, "Defendants"). See [Taylor ECF No. 1 ("Taylor Compl."); Arpie ECF No. 1 ("Arpie Compl."); Fuller ECF No. 1 ("Fuller Compl.")]. Plaintiffs bring state statutory and common law tort claims, alleging that as a result of a data breach affecting Kronos Private Cloud, a third-party "workforce and management software" system used by all Defendants, Defendants failed to pay Plaintiffs' full wages, failed to pay Plaintiffs' wages on a timely basis, and exposed Plaintiffs' personal information. See generally [Taylor Compl.; Arpie Compl.; Fuller Compl.]. Presently before the Court are Defendants' motions to dismiss, pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). [Taylor ECF No. 19; Arpie ECF No. 16; Fuller ECF No. 15]. For the reasons discussed herein, Defendants' motions, [Taylor ECF No. 19; Arpie ECF No. 16; Fuller ECF No. 15], are GRANTED.
Although the Complaint states that plaintiff's name is "Audrey Arpie," Defendants Mercy Medical Group, Inc. and Trinity Health of New England Corporation, Inc. indicate that they have "no record of employing an Audrey Arpie—only Aubrey Arpie" and "[f]or purposes of [their] motion, . . . [they] assume that Plaintiff was incorrectly named in the Complaint, and the correct plaintiff in this action is Aubrey Arpie." [Arpie ECF No. 17 at 1]. Arpie's opposition does not directly respond to this point but refers to plaintiff as "Aubrey Arpie." [Arpie ECF No. 34 at 8].
Plaintiffs also brought claims against UKG, Inc., the company that owns and operates Kronos Private Cloud, which the Court does not address in this Order.
I. BACKGROUND
The following facts are taken primarily from the Complaints, which the Court assumes to be true when considering a motion to dismiss. Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As discussed further below, facts are also drawn from applicable collective bargaining agreements, entered into by Plaintiffs' unions and Defendants, which the Court may consider in reviewing a Rule 12(b)(6) motion, because "the[ir] authenticity . . . [is] not disputed by the parties" and they are "central to plaintiffs' claim[s]." Watterson v. Page, 987 F.2d 1, 3 (1st Cir. 1993).
Plaintiffs, registered nurses, were employed by Defendants to do work which included, but was not limited to, providing care for patients. [Taylor Compl. ¶ 17]. The applicable collective bargaining agreements ("CBAs") include provisions related to wages, including for shift differentials and holidays, timing of payment, and other terms and conditions of their employment. See [Taylor ECF No. 20-3; Arpie ECF No. 17-5; Fuller ECF No. 17-1].
Where each Complaint contains the same assertions, the Court cites to the Taylor Complaint, but unless otherwise indicated the same verbatim allegations appear in the Arpie and Fuller Complaints at different paragraph numbers. For example, the same allegation included at Paragraph 17 of the Taylor Complaint is included at Paragraph 19 of the Arpie Complaint and Paragraph 18 of the Fuller Complaint. See [Arpie Compl. ¶ 19; Fuller Compl. ¶ 18]. Where the Complaints differ, the Court cites to each individually.
Defendants all used Kronos Private Cloud ("Kronos"), owned and operated by UKG, Inc. ("UKG"), to "manage work schedules, track hours, and calculate paychecks," as well as to store the personally identifiable information ("PII") of their employees. [Taylor Compl. ¶¶ 28, 32-33]. The PII, which Plaintiffs (and proposed class members) provided to Defendants at Defendants' request, could include names, addresses, employee IDs, and Social Security numbers. [Id. ¶¶ 2, 33].
Due to what Plaintiffs allege were inadequate security measures, on or around December 11, 2021, UKG was the subject of a data breach, also referred to by Plaintiffs as a "ransomware attack." See, e.g., [Taylor Compl. ¶¶ 3, 31]. As a result, "criminals obtained access to [Plaintiffs'] and [c]lass [m]embers' PII and [Kronos] was rendered unusable." [Id. ¶ 31]. Defendants were also unable to use Kronos to conduct their payroll services, and Plaintiffs were not paid in full for their work from approximately December 11, 2021 onward. [Id. ¶¶ 37, 41]. Plaintiffs made numerous requests for payment, but these requests were denied. [Id. ¶ 24].
Further, by failing to prevent the disclosure of their PII to cybercriminals, Defendants put Plaintiffs and all class members at a "risk of identity theft, financial fraud, and other serious harms." [Taylor Compl. ¶ 35]. Plaintiffs also assert that because of the exposure of their PII, they have incurred costs associated with protecting their credit and have suffered a loss of privacy. [Id. ¶ 54]. Finally, Plaintiffs allege that "[t]he cybercriminals who obtained [c]lass [m]embers' PII may also exploit the PII they obtained by selling the data in the so-called 'dark markets,' " for an average price of $180 per customer per PII record, thereby depriving Plaintiffs and class members of the value of their PII. [Id. ¶¶ 51, 57-58].
B. Procedural Background
Plaintiffs all filed their putative class actions on July 20, 2022, raising claims for violations of the Massachusetts Wage Act, Massachusetts General Law Chapter 149 (First Cause of Action ("COA")), negligence (Second COA), intrusion upon seclusion/invasion of privacy (Third COA), breach of fiduciary duty (Fourth COA), and declaratory and injunctive relief related to Defendants' alleged negligence (Fifth COA). See [Taylor Compl. ¶¶ 75-128; Arpie Compl. ¶¶ 77-130; Fuller Compl. ¶¶ 76-129]. Defendants Mercy and Trinity Health of New England filed their instant motion to dismiss on September 26, 2022; Defendant BID-Plymouth, on October 17, 2022; and Defendant Heywood, on October 19, 2022. [Arpie ECF No. 16; Taylor ECF No. 19; Fuller ECF No. 15]. Arpie opposed Mercy and Trinity Health of New England's motion on November 3, 2022. [Arpie ECF No. 34]. Taylor and the Fuller Plaintiffs opposed BID-Plymouth's and Heywood's motions on December 12, 2022. [Taylor ECF No. 31; Fuller ECF No. 27].
II. LEGAL STANDARD
To evaluate a motion to dismiss for failure to state a claim under Rule 12(b)(6), the Court must "accept as true all well-pleaded facts alleged in the complaint and draw all reasonable inferences therefrom in the pleader's favor." A.G. ex rel. Maddox v. Elsevier, Inc., 732 F.3d 77, 80 (1st Cir. 2013) (quoting Santiago v. Puerto Rico, 655 F.3d 61, 72 (1st Cir. 2011)). The complaint must set forth "a short and plain statement of the claim showing that the pleader is entitled to relief," id. (quoting Fed. R. Civ. P. 8(a)(2)), and should "contain 'enough facts to state a claim to relief that is plausible on its face,' " id. (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)).
"To cross the plausibility threshold a claim does not need to be probable, but it must give rise to more than a mere possibility of liability." Grajales v. P.R. Ports Auth., 682 F.3d 40, 44-45 (1st Cir. 2012) (citing Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009)). "A determination of plausibility is 'a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.' " Id. at 44 (quoting Iqbal, 556 U.S. at 679, 129 S.Ct. 1937). "[T]he complaint should be read as a whole, not parsed piece by piece to determine whether each allegation, in isolation, is plausible." Hernandez-Cuevas v. Taylor, 723 F.3d 91, 103 (1st Cir. 2013) (quoting Ocasio-Hernández v. Fortuño-Burset, 640 F.3d 1, 7 (1st Cir. 2011)). "The plausibility standard invites a two-step pavane." Maddox, 732 F.3d at 80. First, the Court "must separate the complaint's factual allegations (which must be accepted as true) from its conclusory legal allegations (which need not be credited)." Id. (quoting Morales-Cruz v. Univ. of P.R., 676 F.3d 220, 224 (1st Cir. 2012)). Second, the Court "must determine whether the remaining factual content allows a 'reasonable inference that the defendant is liable for the misconduct alleged.' " Id. (quoting Morales-Cruz, 676 F.3d at 224).
"Ordinarily . . . any consideration of documents not attached to the complaint, or not expressly incorporated therein, is forbidden, unless the proceeding is properly converted into one for summary judgment under Rule 56. However, courts have made narrow exceptions for documents the authenticity of which are not disputed by the parties; for official public records; for documents central to plaintiffs' claim; or for documents sufficiently referred to in the complaint." Watterson, 987 F.2d at 3 (citing Fed. R. Civ. P. 12(b)(6)). Courts may consider such documents "even when[, as here,] the documents are incorporated into the movant[s'] pleadings," rather than the complaints. Curran v. Cousins, 509 F.3d 36, 44 (1st Cir. 2007); see also Barry v. UMass Mem'l Med. Ctr., Inc., 245 F. Supp. 3d 323, 324 (D. Mass. 2017) (considering CBA attached to employer's motion to dismiss, where, as here, employer argued Plaintiff's claims were preempted by the Labor Management Relations Act) (citing Curran, 509 F.3d at 44).
When evaluating a motion to dismiss under Rule 12(b)(1), the Court must determine whether the facts alleged in the complaint, "taken at face value," support subject matter jurisdiction. Gordo-González v. United States, 873 F.3d 32, 35 (1st Cir. 2017). In addition, "the Court should apply a standard of review 'similar to that accorded a dismissal for failure to state a claim' under subsection 12(b)(6)." Rodriguez v. Mass. Parole Bd., No. 16-cv-11113, 2017 WL 706597, at *2 (D. Mass. Feb. 22, 2017) (quoting Menge v. N. Am. Specialty Ins. Co., 905 F. Supp. 2d 414, 416 (D.R.I. 2012)).
III. DISCUSSION
A. Wage Act Claims
"[S]ection 301 of the [Labor Management Relations Act ('LMRA')], [ ] 29 U.S.C. § 185(a), completely preempts any state-law cause of action 'founded directly on rights created by collective-bargaining agreements' or 'substantially dependent on analysis of a collective-bargaining agreement.' " Rose v. RTN Fed. Credit Union, 1 F.4th 56, 60 (1st Cir. 2021) (quoting Caterpillar Inc. v. Williams, 482 U.S. 386, 394, 107 S.Ct. 2425, 96 L.Ed.2d 318 (1987); and then citing Franchise Tax Bd. of Cal. v. Constr. Laborers Vacation Tr. for S. Cal., 463 U.S. 1, 23, 103 S.Ct. 2841, 77 L.Ed.2d 420 (1983)). That is, "LMRA preemption of a given state-law claim depends upon whether the claim's adjudication appears to be 'inextricably intertwined with consideration of the terms of [a] labor contract.' " Rose, 1 F.4th at 61 (quoting Allis-Chalmers Corp. v. Lueck, 471 U.S. 202, 213, 105 S.Ct. 1904, 85 L.Ed.2d 206 (1985)). "[W]hen the meaning of contract terms is not the subject of dispute, the bare fact that a collective-bargaining agreement will be consulted in the course of state-law litigation plainly does not require the claim to be extinguished." Livadas v. Bradshaw, 512 U.S. 107, 124, 114 S.Ct. 2068, 129 L.Ed.2d 93 (1994) (citing Lingle v. Norge Div. of Magic Chef, Inc., 486 U.S. 399, 412 n.12, 108 S.Ct. 1877, 100 L.Ed.2d 410 (1988)). Further, "[p]reemption does not reach . . . 'purely factual questions about an employee's conduct or an employer's conduct and motives' that 'do not require a court to interpret any term of a collective-bargaining agreement.' " Hamilton v. Partners Healthcare Sys., Inc., 209 F. Supp. 3d 397, 406-07 (D. Mass. 2016) (quoting Flibotte v. Pa. Truck Lines, Inc., 131 F.3d 21, 26 (1st Cir. 1997)). Nevertheless, "if [a state-law claim] 'plausibly can be said to depend upon the meaning of' or 'arguably hinges upon an interpretation of' the CBA" it will be deemed preempted. Cavallaro v. UMass Mem'l Healthcare, Inc., 678 F.3d 1, 8 (1st Cir. 2012) (quoting Flibotte, 131 F.3d at 26).
Defendants argue that Plaintiffs' Wage Act claims, based on both unpaid and untimely wages, are preempted by the LMRA, because they depend on and require interpretation of the Plaintiffs' CBAs. [Taylor ECF No. 20 at 6-8; Arpie ECF No. 17 at 14-15; Fuller ECF No. 16 at 5-6]. Plaintiffs respond that their claims are not preempted because, at this early stage of the proceedings, the record does not show that they "are 'inextricably intertwined with consideration of the terms of a labor contract.' " [Taylor ECF No. 31 at 12 (quoting Lueck, 471 U.S. at 213, 105 S.Ct. 1904)]; see also [Arpie ECF No. 34 at 19; Fuller ECF No. 27 at 12]. According to Plaintiffs, the fact that their claims may implicate "some of the terms or phrases" in the relevant CBAs, does "not establish that any contract language requires interpretation that would implicate the LMRA." [Taylor ECF No. 31 at 12]; see also [Arpie ECF No. 34 at 19; Fuller ECF No. 27 at 12].
"To prevail on a Weekly Wage Act claim, a plaintiff must 'prove there are wages owed,' though the Act itself provides no substantive standard for determining what wages are owed." Rueli v. Baystate Health, Inc., 835 F.3d 53, 60 (1st Cir. 2016) (quoting Cavallaro, 678 F.3d at 8). Claims for which "no dispute exist[s] about the amount of wages owed," are not preempted. Cavallaro, 678 F.3d at 8; see Livadas, 512 U.S. at 124-25, 114 S.Ct. 2068 (no preemption where wages paid and claims concern only whether wages were timely paid). On the other hand, "any claim that entails a court 'determining what (if anything) is owed' to an employee who is within a bargaining unit will almost always 'depend[ ] at least arguably on interpretations and applications of the CBA at issue,' " Rose, 1 F.4th at 62 (quoting Cavallaro, 678 F.3d at 8), and is thus preempted. In Cavallaro v. UMass Memorial Healthcare, Inc., for example, the First Circuit held that plaintiffs' Wage Act claims for unpaid wages "for time spent working through meal breaks, before and after work, and during training sessions," were preempted by the LMRA, because "some provisions of the [plaintiffs'] CBA . . . [would] likely need to be interpreted." 678 F.3d at 8. In rejecting plaintiffs' argument that their claims only raise "a factual dispute as to whether plaintiffs were paid for time spent working," the First Circuit held that whether compensation was owed for various activities would depend on the interpretation of various terms in the CBA, including, as relevant to training, whether "the employee . . . made a ' timely ' request to attend" and, as relevant to mealtimes, "whether a nurse remained in the ' patient care area ,' " Id. (emphasis added). Further, as some Defendants point out, [Taylor ECF No. 20 at 7; Fuller ECF No. 16 at 5], the First Circuit has held that "any claim for compensation above the state minima must be entirely dependent on the CBA," Cavallaro, 678 F.3d at 8.
Here, Plaintiffs allege that Defendants failed to pay them "the full amount of wages to which [they] [were] entitled for all of [their] work time in a timely fashion," [Taylor Compl. ¶ 23]. It is the applicable CBAs that provide for what work is compensated and which rate of pay applies to such work (e.g., whether work qualifies for a shift differential), such that the amount of wages owed may turn on specific provisions in the CBAs. See generally [Taylor ECF No. 20-3; Fuller ECF No. 17-1]. As such, Plaintiffs' claims will, at least arguably, depend on the applicable CBAs and/or require interpretation of various provisions in the CBAs to determine the amount of wages owed. The Court therefore finds that, as alleged, these claims are "inextricably intertwined," Rose, 1 F.4th at 61, with the CBAs, and are therefore preempted.
Having found that dismissal is appropriate based on preemption, the Court does not address Defendants' argument that Plaintiffs, as employees of hospitals that receive contributions from the Commonwealth and/or are conducted as public charities who have not requested to be paid weekly, are exempted from the Wage Act's protections. See, e.g., [Taylor ECF No. 20 at 4-6].
B. Plaintiffs' Standing as to Other Claims
The doctrine of standing is rooted in Article III of the Constitution, which confines federal courts to the adjudication of actual "cases" and "controversies." See U.S. Const. art. III, § 2, cl. 1; Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992); TransUnion LLC v. Ramirez, 594 U.S. 413, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021) ("[A] federal court may resolve only 'a real controversy with real impact on real persons.' ") (quoting Am. Legion v. Am. Humanist Assn., 588 U.S. 29, 139 S. Ct. 2067, 2103, 204 L.Ed.2d 452 (2019)). Standing consists of three elements: "[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016) (quoting Lujan, 504 U.S. at 560-61, 112 S.Ct. 2130), as revised (May 24, 2016). Where, as here, the question of standing is based on the pleadings, Plaintiffs "bear[ ] the burden of establishing sufficient factual matter to plausibly demonstrate [its] standing to bring the action," Hochendoner v. Genzyme Corp., 823 F.3d 724, 731 (1st Cir. 2016), taking all of the facts (and any inferences that follow) in the plaintiff's favor, Gustavsen v. Alcon Lab'ys, Inc., 903 F.3d 1, 7 (1st Cir. 2018) (quoting Katz v. Pershing, LLC, 672 F.3d 64, 70-71 (1st Cir. 2012)).
"That a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class 'must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong.' " Spokeo, 578 U.S. at 338 n.6, 136 S.Ct. 1540 (quoting Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 40 n.20, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976)).
Defendants argue that Plaintiffs do not have standing to pursue their remaining claims because they have failed to allege an injury in fact. [Taylor ECF No. 20 at 10-16; Arpie ECF No. 17 at 5-9; Fuller ECF No. 16 at 6-9]. Plaintiffs respond that their allegations "that a vast amount of particularly sensitive information was compromised (names, addresses, Social Security numbers, dates of birth, and employee IDs)[,] . . . [are] sufficient at the pleading stage" to establish injury in fact and, in turn, standing. [Taylor ECF No. 31 at 20; Fuller ECF No. 27 at 17]; see also [Arpie ECF No. 34 at 14 (nearly verbatim assertion)].
To establish injury in fact, a plaintiff must demonstrate "an invasion of a legally protected interest" that is "concrete and particularized" and "actual or imminent, not conjectural or hypothetical." Lujan, 504 U.S. at 560, 112 S.Ct. 2130. "Various intangible harms can . . . be concrete[,] includ[ing] . . . disclosure of private information[ ] and intrusion upon seclusion." TransUnion, 141 S. Ct. at 2204 (citations omitted). As to imminence, " '[a]llegations of possible future injury' are not sufficient." Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) (emphasis added) (quoting Whitmore v. Arkansas, 495 U.S. 149, 158, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990)). That said, "an allegation of future injury may suffice if the threatened injury is certainly impending, or [if] there is a substantial risk that the harm will occur." Reddy v. Foster, 845 F.3d 493, 500 (1st Cir. 2017) (quoting Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158, 134 S.Ct. 2334, 189 L.Ed.2d 246 (2014)).
1. Risk of Identity Theft
The Complaints allege various injuries resulting from the data breach, see [Taylor Compl. ¶¶ 53-59, 90], but Plaintiffs' oppositions primarily focus on an increased risk of future identity theft, [Taylor ECF No. 31 at 15-20; Arpie ECF No. 34 at 9-14; Fuller ECF No. 27 at 13-17].
The First Circuit has addressed injury in fact, and the risk of future harm, in the context of data breaches on several occasions, including recently in Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023). Webb involved allegations of "a data breach [in which] . . . [h]ackers infiltrated . . . [a home-delivery pharmacy service's] patient records systems, gain[ed] access to the PII of over 75,000 . . . patients, and stole PII including patient names and Social Security numbers." Id. at 370. Further, one of two named plaintiffs alleged the "actual misuse of [her] stolen PII to file a fraudulent tax return." Id. at 373. As to this plaintiff, the First Circuit affirmed that the "actual misuse of PII may constitute an injury in fact," rejected the District Court's conclusion that she had failed to "plausibly allege a connection between the data breach and the filing of the false tax return," and concluded that she had alleged an injury in fact. Id. at 373.
Standing as to the other named plaintiff, who did not allege actual misuse of his PII, was, according to the First Circuit, "more difficult," because this plaintiff was claiming an injury in fact based only on a risk of potential future harm. Webb, 72 F.4th at 374. The First Circuit explained that " 'a material risk of future harm can satisfy the concrete-harm requirement,' at least as to injunctive relief, when 'the risk of harm is sufficiently imminent and substantial.' " Id. at 375 (quoting TransUnion, 141 S. Ct. at 2210). Further, "[t]o establish standing to pursue damages [based on a future risk], the complaint must also plausibly allege a separate concrete, present harm caused 'by [the plaintiffs'] exposure to [this] risk [of future harm].' " Id. at 376 (quoting TransUnion, 141 S. Ct. at 2211). The Court ultimately held that "in light of the plausible allegations of some actual misuse, the complaint plausibly alleges a concrete injury in fact based on the material risk of future misuse of [this plaintiff's] PII and a concrete harm caused by exposure to this risk." Id. at 374.
In determining that this plaintiff had alleged a sufficiently imminent and substantial risk of harm, the First Circuit explained that it considered "[m]any of the same factors [it] ha[d] considered in other data breach cases[, including that] . . . [1] Plaintiffs face a real risk of misuse of their information following a data breach when their information is deliberately taken by thieves intending to use the information to their financial advantage -- i.e., exposed in a targeted attack rather than inadvertently[;] . . . [2] the actual misuse of a portion of the stolen information increases the risk that other information will be misused in the future"; and [3] "the risk of future misuse may be heightened where the compromised data is particularly sensitive." Webb, 72 F.4th at 374. The Court "stress[ed] that [such] . . . considerations are neither exclusive nor necessarily determinative, but they do provide guidance." Id. at 375. Further, in finding that this plaintiff had established injury in fact, it cautioned that it was not "hold[ing] that individuals face an imminent and substantial future risk in every case in which their information is compromised in a data breach[,] [b]ut on the facts alleged . . . , the complaint has plausibly demonstrated such a risk." Id. at 376.
The First Circuit noted that "[t]hese considerations accord with other circuits' approach to determining when the risk of future misuse of PII following a data breach is imminent and substantial." Webb, 72 F.4th at 375 (citing McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 300-03 (2d Cir. 2021) ("collecting cases and synthesizing principles"); Clemens v. ExecuPharm Inc., 48 F.4th 146, 153-54, 157 (3d Cir. 2022)).
Here, Plaintiffs have alleged that their information, including, potentially, their Social Security numbers, was exposed to hackers, but have not alleged any misuse of their or others' information resulting from the alleged data breach. Although, in Webb, the First Circuit explained that this factor, like the others, is not necessarily "determinative," 72 F.4th at 375, Plaintiffs have not identified any First Circuit caselaw in which a court has found plaintiffs had established standing in a similar context, without allegations of actual misuse. See Rivera-Marrero v. Banco Popular de Puerto Rico, No. 22-cv-01217, 2023 WL 2744683, at *11 (D.P.R. Mar. 31, 2023) ("To this Court's knowledge, no court in this circuit has found standing in a case premised on an allegation of an increased risk of future injury due a data breach of PII where the plaintiff does not allege any actual misuse of their PII."). Portier v. NEO Tech. Sols., cited by Plaintiffs in their oppositions as providing the appropriate factors to consider in evaluating standing in this context, see [Taylor ECF No. 31 at 17-18; Arpie ECF No. 34 at 11-12; Fuller ECF No. 27 at 14-16], is distinguishable on this ground—there, plaintiffs made "allegations of . . . fraudulent filing of tax returns under the names of [several named plaintiffs] and . . . credit card fraud perpetrated on [several other named plaintiffs]." No. 17-cv-30111, 2019 WL 7946103, at *8 (D. Mass. Dec. 31, 2019), R. & R. adopted, No. 17-cv-30111, 2020 WL 877035 (D. Mass. Jan. 30, 2020). Judge Robertson found these allegations established that plaintiffs faced an imminent risk of future harm "[because they] show that the stolen W-2 data was actually accessed and used." Id. Accordingly, the Court finds that without any allegations of actual misuse of information from the Kronos data breach, Plaintiffs' alleged risk of future misuse is not sufficiently imminent or substantial to support standing. See Rivera-Marrero, 2023 WL 2744683, at *11 ("[T]he Court is reluctant to find standing in a data breach case where actual misuse of PII is not alleged. If the Court must draw a line, it will do so here: mere allegations that PII was accessed and exfiltrated in a data breach, without more, are insufficient to constitute a concrete or imminent injury for standing purposes."); Quintero v. Metro Santurce, Inc., No. 20-cv-01075, 2021 WL 5855752, at *7 (D.P.R. Dec. 9, 2021) (alleging that hackers accessed and "encrypted" data stolen from a hospital's server, to hold it for ransom, "equals acquisition and misuse -- is a bridge too far, mere speculation, and is not in accord with the modern trend in this area of the law." (citing Hartigan v. Macy's, Inc., 501 F. Supp. 3d 1, 5 (D. Mass. 2020); Portier, 2019 WL 7946103, at *8; Khan v. Children's Nat'l Health Sys., 188 F. Supp. 3d 524, 531 (D. Md. 2016); In re Zappos.com, Inc., 108 F. Supp. 3d 949, 955 (D. Nev. 2015)).
It is not clear whether the Complaints allege that Plaintiffs or only other class members provided Defendants with particularly sensitive information, like their Social Security numbers. See e.g., [Taylor Compl. ¶ 2 ("Plaintiff and Class Members provided their personally identifiable information ('PII') to Defendants at their request, including names, addresses, employee IDs, and social security numbers."); id. ¶ 12 ("On approximately December 11, 2021, Plaintiff's PII was exposed in the Data Breach."); id. ¶ 33 ("Defendants store employees' PII in Kronos Private Cloud, which can include, inter alia, employee names, addresses, employee ID numbers, and social security numbers"); id. ¶ 51 ("The cybercriminals who obtained Class Members' PII may also exploit the PII they obtained by selling the data in the so-called 'dark markets.' Having obtained these names, addresses, and Social Security numbers, cybercriminals can pair the data with other available information to commit a broad range of fraud in a Class Member's name."); id. ¶ 53 (". . . Class Members provided Defendants with sensitive personal information, including their Social Security numbers.")]. The Court assumes that Plaintiffs did provide this and other highly sensitive information to Defendants for purposes of this Order.
2. Other Potential Injuries
Plaintiffs additionally argue that they have adequately alleged damages based on the costs of taking steps to protect their credit, their loss of privacy, and the lost value of their PII. [Taylor ECF No. 31 at 20-22; Arpie ECF No. 34 at 14-16; Fuller ECF No. 27 at 17-19]. To the extent that Plaintiffs raise these alleged damages to demonstrate that "the complaint . . . plausibly allege[s] a separate concrete, present harm caused 'by . . . exposure to a risk of future harm,' " to, in turn, "establish standing to pursue damages" based on that future risk, Webb, 72 F.4th at 376 (quoting TransUnion, 141 S. Ct. at 2211) (alterations omitted), as discussed supra, this is also unavailing. Plaintiffs "cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending." Clapper, 568 U.S. 398, 416, 133 S.Ct. 1138 (2013); Katz, 672 F.3d at 79 (rejecting costs associated with "purchase[ ] [of] identity theft insurance and credit monitoring services to guard against a possibility, remote at best, that her nonpublic personal information might someday be pilfered" as an injury in fact because "[w]hen an individual alleges that her injury is having to take or forebear from some action, that choice must be premised on a reasonably impending threat."). Where, as here, Plaintiffs have not shown an imminent risk of identity theft, prophylactic costs to mitigate such a risk do not constitute an independent injury sufficient to support standing. See Hartigan, 501 F. Supp. 3d at 6 ("[A]lthough a data breach occurred, [plaintiff] alleges no misuse of his or any class member's data. [Plaintiff's] purchase of credit monitoring services thus was not 'premised on a reasonably impending threat' and does not constitute injury-in-fact." (quoting Katz, 672 F.3d at 79)).
Likewise, to the extent that Plaintiffs assert that their alleged loss of privacy resulting from the exposure of their PII constitutes a standalone injury in fact, the Court again finds that Plaintiffs' allegations are inadequate. "Disclosure is an 'essential element of the cause of action' for an invasion of privacy." Casey v. United Parcel Serv., Inc., No. 21-cv-40133, 2022 WL 2834258, at *5 (D. Mass. July 20, 2022) (citing Dasey v. Anderson, 304 F.3d 148, 153 (1st Cir. 2002); Tobin v. Fed. Exp. Corp., 775 F.3d 448, 451 (1st Cir. 2014) ("stating that '[d]isclosure (that is, proof that [a defendant] disclosed [private information] to a third party) is an essential element of the plaintiff's privacy claim.' ")).
For a person's privacy to be invaded, their personal information must, at a minimum, be disclosed to a third party. Existing case law and legislation support that common-sense intuition: If no one has viewed your private information (or is about to view it imminently), then your privacy has not been violated.Fernandez v. Leidos, Inc., 127 F. Supp. 3d 1078, 1088 (E.D. Cal. 2015) (quoting In re Sci. Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 28 (D.D.C. 2014)). Although Plaintiffs allege that their PII was exposed and that "[t]he PII of millions of individuals may have been exposed" to hackers, [Taylor Compl. ¶¶ 12, 34], they have failed to provide factual support that any third parties actually viewed or will imminently view their data. This is insufficient, even at this early stage of litigation, to establish that their privacy has been invaded. See Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871, 880 (N.D. Ill. 2014) (holding plaintiff failed to establish standing to raise invasion of privacy and other claims because "the fact that hackers gained some access to a [government agency] database [containing plaintiff's information] does not necessarily mean, or even plausibly suggest, that they obtained access to all of the data in [the government agency's] possession . . . [and] provides no basis to infer that the hacker (or hackers) obtained [plaintiff's] data."); Fernandez, 127 F. Supp. 3d at 1088 ("Plaintiff has not alleged facts from which a plausible inference could be drawn that anyone has viewed his PII/PHI as a result of the Data Breach. Therefore, Plaintiff has not shown he has standing to bring his claims based on his allegations of invasion of privacy or breach of confidentiality.").
Finally, the Court declines to find that Plaintiffs have standing based on the alleged lost value of their PII. "[C]ourts have consistently 'rejected allegations that the diminution in value of personal information can support standing,' particularly where [as here] the plaintiffs 'have not alleged that they attempted to sell their personal information or that, if they have, the data breach forced them to accept a decreased price for that information,' " Cooper v. Bonobos, Inc., No. 21-cv-00854, 2022 WL 170622, at *5 (S.D.N.Y. Jan. 19, 2022) (quoting Fero v. Excellus Health Plan, Inc., 304 F. Supp. 3d 333, 341, 755 (W.D.N.Y. 2018) (collecting cases); then citing Whalen v. Michaels Stores, Inc., 689 F. App'x 89, 581-82 (2d Cir. 2017); and then quoting Chambliss v. Carefirst, Inc., 189 F. Supp. 3d 564, 572 (D. Md. 2016)).
Plaintiffs also reference the non-payment of wages as damages resulting from the exposure of their PII, but do not explain how unpaid wages would establish standing for these claims.
The Court thus concludes that Plaintiffs have failed to allege an imminent risk of future harm or any present injuries sufficient to support standing for Plaintiffs' remaining claims.
Defendants raise several other arguments as to why these claims should be dismissed, including that Plaintiffs failed to allege that Defendants have a fiduciary duty to safeguard Plaintiffs' PII, and as such failed to allege a breach of fiduciary duty (Fourth COA), see, e.g., [Fuller ECF No. 16 at 9]; and that, where Plaintiffs do not allege any plausible injuries, they have failed to allege standing and also failed to state a claim upon which relief may be granted, see, e.g., [Arpie ECF No. 17 at 9-11]. Having found that dismissal is appropriate based on standing, the Court does not address these other arguments.
IV. CONCLUSION
Accordingly, Defendants' motions to dismiss, [Taylor ECF No. 19; Arpie ECF No. 16; Fuller ECF No. 15], are GRANTED.
SO ORDERED.