Opinion
Civil Action 4:20-cv-04139
06-14-2021
DEREK ALLEN, et al., Plaintiffs. v. VERTAFORE, INC., Defendant.
MEMORANDUM AND RECOMMENDATION
ANDREW M. EDISON UNITED STATES MAGISTRATE JUDGE
Before me is Defendant's Motion to Dismiss Pursuant to Rule 12(b)(1) and 12(b)(6). Dkt. 38. After carefully reviewing the legal briefing, analyzing the relevant case law, and hearing oral argument, I recommend that Defendant's Motion to Dismiss be GRANTED.
BACKGROUND
This putative class action is brought by Plaintiffs Derek Allen, Leandre Bishop, and John Burns on behalf of themselves and approximately 27.7 million other individuals who were issued Texas driver's licenses prior to February 2019 (collectively, “Plaintiffs”). Defendant Vertafore, Inc. (“Vertafore”) is an insurance software company that provides enterprise software solutions, specifically management systems, content management and workflow, sales tools, compliance, rating, and comprehensive agency solutions for the insurance industry.
The facts underlying this suit began in early 2020. Between March and August 2020, Vertafore determined that because of human error, three data files containing driver information for Texas driver's licenses issued before February 2019 had been inadvertently stored in an unsecured external storage service that appeared to have been accessed without authorization (the “data breach”). The files contained Texas driver license numbers, as well as names, dates of birth, addresses, and vehicle registration histories. The files did not contain any Social Security numbers or financial account information. Vertafore publicly disclosed the data breach via press release dated November 2020 (the “Press Release”). See Dkt. 38-1.
On December 4, 2020, shortly after Vertafore disclosed the data breach, Plaintiffs filed this suit. Plaintiffs contend that Vertafore is liable for violating the Driver's Privacy Protection Act of 1994 (“DPPA”). Vertafore has moved to dismiss for lack of Article III standing and failure to state a claim. I address each argument in turn.
On January 21, 2021, I held a Pre-Motion Conference with all parties. I extended an invitation to Plaintiffs to re-plead their claims before I entertained this motion to dismiss. Plaintiffs declined that invitation.
SUBJECT-MATTER JURISDICTION
Vertafore first argues that the Complaint should be dismissed because Plaintiffs fail to allege Article III standing.
A. Legal Standard
Federal Rule of Civil Procedure Rule 12(b)(1) allows a defendant to move to dismiss a case before filing an answer “when the court lacks the statutory or constitutional power to adjudicate the claim.” In re FEMA Trailer Formaldehyde Prods. Liab. Litig., 668 F.3d 281, 286 (5th Cir. 2012) (quotation omitted). District courts may grant a motion to dismiss for lack of subject-matter jurisdiction based on: “(1) the complaint alone; (2) the complaint supplemented by undisputed facts in the record; or (3) the complaint supplemented by undisputed facts plus the court's resolution of disputed facts.” Clark v. Tarrant Cnty., 798 F.2d 736, 741 (5th Cir. 1986).
To determine whether there is jurisdiction to hear a case, “federal courts must look to the sources of their power, Article III of the United States Constitution and congressional statutory grants of jurisdiction.” Tercero v. Tex. Southmost Coll. Dist., 989 F.3d 291, 298 (5th Cir. 2021). Article III of the Constitution empowers federal courts to hear “cases” or “controversies” arising under the Constitution or federal law. U.S. Const. art. III, § 2. There is no case or controversy if the plaintiff has no standing to sue. See Lujan v. Defs. Of Wildlife, 504 U.S. 555 (1992). (“[T]he core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III.”).
The party invoking federal jurisdiction has the burden of establishing subject-matter jurisdiction. Palacios v. Dep't of Homeland Sec., 434 F.Supp.3d 500, 505 (S.D. Tex. 2020). To avoid dismissal under Rule 12(b)(1), Plaintiffs must show “(1) an injury in fact, (2) a sufficient causal connection between the injury and the conduct complained of, and (3) a likelihood that the injury will be redressed by a favorable decision.” Soniat v. Tex. Real Est. Comm'n, 721 Fed.Appx. 398, 399 (5th Cir. 2018) (cleaned up).
B. Discussion
The Fifth Circuit has addressed Article III standing in a DPPA suit before. The unanimous majority in Taylor v. Acxiom Corp. explained the Article III standing issue as follows:
Article III standing . . . is present. It is undisputed that the DPPA protects from certain uses or disclosures personal information of plaintiffs and creates a federal cause of action for same, and that such personal information of plaintiffs was actually included in the challenged bulk distributions by Texas DPS. Moreover, plaintiffs' claim that such bulk distributions (including the personal information of these plaintiffs) are prohibited, and constitute a disclosure or use made illegal, by the DPPA which affords plaintiffs a federal cause of action for such disclosure or use of their personal information, though clearly without merit, is nevertheless not wholly insubstantial and frivolous, and hence gives the district court jurisdiction to decide whether or not the DPPA does preclude such distributions or uses.612 F.3d 325, 340 n.15 (5th Cir. 2010). Similarly, if not more succinctly, Judge Dennis wrote a concurrence describing the Article III standing issue as follows:
The plaintiffs in this case have Article III standing for the reason stated in footnote 15 of the majority opinion: they allege that the defendants have used their personal information in a manner that is
prohibited by the DPPA. Thus, their allegations fulfill the three requirements of the irreducible constitutional minimum of standing: an injury in fact (i.e., the invasion of an interest which the plaintiffs argue is legally protected), which was caused by the defendants and which would be redressed by a judgment against the defendants. It is firmly established that the absence of a valid (as opposed to arguable) cause of action does not implicate subject-matter jurisdiction. Thus, our holding that the plaintiffs have failed to state a valid claim under the DPPA does not alter the fact that the plaintiffs have Article III standing.Id. at 340-41 (Dennis, J., concurring) (cleaned up).
In this case, Plaintiffs have alleged that they were issued driver's licenses before February 2019 and the data breach affected Texas driver's licenses issued before February 2019. Plaintiffs contend that Vertafore inadvertently storing sensitive data files on the wrong servers amounts to a disclosure prohibited by the DPPA, which may be redressed by a judgment against Vertafore. While it is true that there are strong arguments against Plaintiffs' claim, which I address in the context of Rule 12(b)(6), the allegations presented here are sufficient to establish Article III standing. Consequently, Taylor compels me to conclude that Article III standing exists in this case. See also Sistrunk, 2016 WL 9450445, at *4-6 (explaining that an allegation of the specific type of harm sought to be remedied by Congress in enacting the DPPA is sufficiently concrete to provide Article III standing under Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016)).
Vertafore attacks Taylor's discussion of Article III standing as mere dicta. While it is true the Taylor court discussed Article III standing in an abundance of caution, I nonetheless find the appellate court's discussion instructive and worthy of consideration. See Sistrunk v. TitleMax, Inc., No. SA-14-CA-628-RP(HJB), 2016 WL 9450445, at *9 (W.D. Tex. Aug. 26, 2016) (“Even dicta from a non-precedential decision may be persuasive, . . . especially decisions from the appellate court.” (emphasis omitted)).
FAILURETOSTATEACLAIM
Vertafore next argues that even if Plaintiffs have Article III standing, they have failed to state a claim.
A. Legal Standard
When evaluating a motion to dismiss for failure to state a claim, a court must accept “all well-pleaded facts as true and view[] those facts in the light most favorable to the plaintiff.” Cummings v. Premier Rehab Keller, P.L.L.C., 948 F.3d 673, 675 (5th Cir. 2020) (quotation omitted). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Id. (quotation omitted). Under this standard, a court must demand “more than a sheer possibility that a defendant has acted unlawfully. Where a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief.” Id. (quotation omitted). In ruling on a motion to dismiss, “[t]he court's review is limited to the complaint, any documents attached to the complaint, and any documents attached to the motion to dismiss that are central to the claim and referenced by the complaint.” Lone Star Fund V (U.S.), L.P. v. Barclays Bank PLC, 594 F.3d 383, 387 (5th Cir. 2010).
B. Discussion
Boiled down, Vertafore argues that “to adequately allege a DPPA violation there must be well-pled allegations that [it obtained, disclosed, or used personal information from a motor vehicle record] (1) knowingly and (2) for an improper purpose-neither of which is present here.” Dkt. 38 at 20 (emphases omitted).
Plaintiffs disagree, arguing that by inadvertently storing sensitive data files on the wrong servers, Vertafore knowingly disclosed their personal information for an impermissible purpose. I agree with Vertafore's understanding of the factual allegations required to adequately state a DPPA claim:
The DPPA creates liability when three elements are met: (1) the defendant knowingly obtains, discloses[, ] or uses personal information; (2) from a motor vehicle record; and (3) for a purpose not permitted. 18 U.S.C. § 2724(a). The plain meaning of the third
factor is that it is only satisfied if shown that obtainment, disclosure, or use was not for a purpose enumerated under § 2721(b).Taylor, 612 F.3d at 335 (cleaned up). Vertafore's argument attacks elements one and three.
While § 2721(a) states a general prohibition on the release and use of certain personal information from State motor vehicle records, § 2721(b) expressly lists fourteen permissible uses of the same information. See 18 U.S.C. § 2721.
I have closely reviewed the Class Action Complaint for specific factual allegations demonstrating or suggesting that Vertafore knowingly disclosed Plaintiffs' personal information for an improper purpose. I see no such facts. In a single sentence of the Complaint, Plaintiffs state that “Vertafore knowingly disclosed the Driver's License Information of Plaintiffs and approximately 27.7 million other Class members by storing that information on unsecured external servers.” Dkt. 1 at 6-7. Plaintiffs then go on to declare that “[i]n response to the commands of unauthorized individuals and consistent with the [way] they were programmed and configured by Vertafore, the unsecure servers disclosed Plaintiffs' and Class members' Driver's License Information to the unauthorized Individuals.” Id. at 7. Notably absent from this assertion is any factual allegation describing how this purported mismanagement of information amounts to a knowing disclosure of personal information for an improper purpose.
To be clear, the facts alleged in the Complaint describe Vertafore as having stored the data on servers under Vertafore's control, meaning the data was never actually knowingly disclosed to anyone outside of Vertafore. The factual allegations also plainly state that anyone that may have obtained the data did so in an unauthorized manner, which undercuts the notion that Vertafore knowingly disclosed the data to those unauthorized individuals for any specific purpose. Moreover, I see no factual allegation explaining the improper purpose of the purported impermissible disclosure. Plaintiffs clearly detail that “Vertafore is an insurance software company that provides enterprise software solutions” for the insurance industry. Dkt. 1 at 3. Thus, Vertafore's purpose of managing the affected data files is a covered permissible use under 18 U.S.C. § 2721(b)(6), which covers uses by “any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.” As if all these deficiencies are not enough, the Press Release on which Plaintiffs exclusively base their claim, outright states that the affected data files had been “inadvertently stored in an unsecured external storage service” and describes Vertafore's efforts to remediate the problem. Dkt. 38-1 at 2. Importantly, Plaintiffs have not offered any factual enhancement disputing the facts as stated in the Press Release.
I am free to reference the Press Release because it is central to Plaintiffs' claim, Plaintiffs specifically reference the Press Release in the Complaint, and Vertafore attached the Press Release to its motion to dismiss. See Lone Star Fund, 594 F.3d at 387.
In sum, I find that Plaintiffs' allegation that Vertafore knowingly disclosed their personal information for an improper purpose is nothing more than a conclusory allegation or legal conclusion masquerading as a factual conclusion. See ABC Arbitrage Plaintiffs Grp. v. Tchuruk, 291 F.3d 336, 348 (5th Cir. 2002). As explained by the Fifth Circuit, this “will not suffice to prevent dismissal under Rule 12(b)(6).” Id.
CONCLUSION
For the reasons stated above, I recommend that Vertafore's Motion to Dismiss (Dkt. 38) be GRANTED.
The Clerk shall provide copies of this Memorandum and Recommendation to the respective parties who have fourteen days from the receipt to file written objections pursuant to Federal Rule of Civil Procedure 72(b) and General Order 2002-13. Failure to file written objections within the time period mentioned shall bar an aggrieved party from attacking the factual findings and legal conclusions on appeal.