Opinion
3:20-cv-516-MMH-MCR
03-22-2022
ROBIN ALLGOOD and DAVID COLLINS, on behalf of themselves and all others similarly situated, Plaintiffs, v. PAPERLESSPAY CORPORATION, Defendant.
ORDER
MARCIA MORALES HOWARD, UNITED STATES DISTRICT JUDGE
THIS CAUSE is before the Court on Defendant PaperlessPay Corporation's Motion to Dismiss Plaintiffs' Consolidated Class Action Complaint and Memorandum of Law in Support Thereof (Doc. 55; Motion) filed on May 21, 2021. In the Motion, PaperlessPay Corporation (PaperlessPay) seeks dismissal of the Consolidated Class Action Complaint (Doc. 41; Complaint), filed by Plaintiffs Robin Allgood and David Collins (Plaintiffs) on April 7, 2021, for lack of standing pursuant to Rule 12(b)(1), Federal Rules of Civil Procedure (Rule(s)), and for failure to state a claim under Rule 12(b)(6). See Motion at 7-9. Plaintiffs filed a response to the Motion on July 16, 2021. See Plaintiffs' Opposition to Defendant's Motion to Dismiss (Doc. 72; Response). With leave of Court, PaperlessPay filed a reply to the Response on August 16, 2021. See Defendant PaperlessPay Corporation's Reply in Support of Its Motion to Dismiss Plaintiffs' Consolidated Class Action Complaint (Doc. 73; Reply); see also Order (Doc. 71), entered on June 17, 2021 (recognizing that Plaintiffs Robin Allgood and David Collins agreed to permit PaperlessPay to file a reply brief, with the Court's approval). Accordingly, the Motion is ripe for review.
The Court notes that Defendant PaperlessPay Corporation also filed a request for oral argument on the Motion. See Request for Oral Argument (Doc. 56), filed May 21, 2021; see also Uniform Case Management Report (Doc. 70), filed on June 11, 2021 (“Plaintiffs do not object to Defendant's request for oral argument[.]”). However, upon review of the briefs, the Court does not find oral argument to be necessary to the resolution of the Motion.
For ease of reference, the Court's citations to page numbers in documents in the record refer to the CM-ECF-stamped page numbers located at the top of each page, rather than a document's internal page numbers, if any.
The Court granted Plaintiffs' motion for an extension of time to file a response to the Motion, thus Plaintiffs timely filed their Response. See Unopposed Motion for Extension of Time to Respond to Defendant's Motion to Dismiss (DE 55) and Memorandum of Law in Support Thereof (Doc. 66), filed by Plaintiffs on June 9, 2021; see also Order (Doc. 68), entered on June 10, 2021.
I. Procedural History
Between May and September of 2020, four separate actions were initiated against PaperlessPay in federal court. See Order (Doc. 40), entered on March 11, 2021; see also Notice to the Clerk of Court (Doc. 49), filed on May 6, 2021. Although initially assigned to different district judges, the cases were transferred to the undersigned pursuant to Local Rule 1.04(b), United States District Court, Middle District of Florida. See Order (Doc. 40) at 4. The plaintiffs in all four cases brought claims seeking class-wide relief against PaperlessPay, a company that provided payroll and human resources services to plaintiffs' employers. Id. Each case related to an alleged February 18, 2020 data breach on PaperlessPay's servers. Id. at 4-5.
All four actions were initiated in the Jacksonville Division of the United States District Court for the Middle District of Florida. See Order (Doc. 40), entered on March 11, 2021; Notice to the Clerk of Court (Doc. 49), filed on May 6, 2021. PaperlessPay is a Florida corporation with its principal place of business in Jacksonville, Florida. See Complaint ¶¶ 20-21.
The Court recently amended its Local Rules, and the new rules took effect February 1, 2021. The Court's citation here is to the previous version of the Local Rules, in effect at the relevant time, which permitted related cases to be transferred to the same judge with that judge's consent.
On October 9, 2020, the initial plaintiffs filed a Motion to Consolidate Actions and Appoint Interim Class Counsel (Doc. 34; Motion to Consolidate). Although PaperlessPay objected to the appointment of interim class counsel, it did not oppose consolidation. See Defendant PaperlessPay Corporation's Opposition to Plaintiffs' Motion to Consolidate Actions and Appoint Interim Class Counsel (Doc. 36), filed on October 23, 2020. On March 11, 2021, the Court granted the Motion to Consolidate in part and denied it in part. See generally Order (Doc. 40). The Court granted the Motion to Consolidate to the extent the plaintiffs requested for their cases to be consolidated and directed the plaintiffs to file a consolidated complaint in the lead case. See generally id. Shortly thereafter, on April 7, 2021, Plaintiffs filed their Consolidated Class Action Complaint, which is the operative pleading at this time, and in which Plaintiffs name only PaperlessPay as a defendant. See generally Complaint.
Due to ambiguities in the record after Plaintiffs filed their Complaint, the Court scheduled a status conference for April 19, 2021. See generally Notice of Hearing (Doc. 42), entered on April 8, 2021. At the status conference, the Court directed Plaintiffs to file a notice of dismissal identifying any originally named defendant that Plaintiffs no longer intended to pursue in the consolidated action. See generally Clerk's Minutes (Doc. 45), entered on April 19, 2021. Thereafter, the original plaintiffs filed notices of voluntary dismissal in their respective actions. See Case No. 3:20-cv-516 (McDonald Action), Doc. 48; Case No. 3:20-cv-864 (Thompson Action), Doc. 28; Case No. 3:20-cv-961 (Huss Action), Doc. 30; Case No. 3:20-cv-1005 (Spann Action), Doc. 34; see also Docs. 46-47, 50-53. Plaintiffs also filed a Notice to the Clerk of Court (Doc. 49; Notice) in this action, which explained that “Plaintiffs Allgood and Collins are now the only named plaintiffs in this matter, and Defendant PaperlessPay is now the only remaining defendant in this matter with claims pending against it.” See Notice ¶ 19.
On May 21, 2021, PaperlessPay filed the instant Motion seeking dismissal of Plaintiffs' claims under Rule 12(b)(1) for lack of standing and Rule 12(b)(6) for failure to state a claim. See generally Motion. In the parties' Uniform Case Management Report (Doc. 70; CMR), filed on June 11, 2021, Plaintiffs and PaperlessPay jointly requested that discovery, other than initial disclosures, be stayed pending a ruling on the Motion. See CMR at 7. On June 17, 2021, the Court stayed discovery. See Order (Doc. 71), entered on June 17, 2021 (finding that the parties had shown good cause for a stay of discovery until the Motion is resolved).
In considering the Motion, the Court must accept all factual allegations in Plaintiffs' Complaint as true, consider the allegations in the light most favorable to them, and accept all reasonable inferences that can be drawn from such allegations. Hill v. White, 321 F.3d 1334, 1335 (11th Cir. 2003); Jackson v. Okaloosa Cnty., Fla., 21 F.3d 1531, 1534 (11th Cir. 1994). As such, the facts recited here are drawn from the Complaint, and may well differ from those that ultimately can be proved.
PaperlessPay is a third-party payroll and human resources provider with approximately 1, 500 clients. See Complaint ¶¶ 1, 42. PaperlessPay's clients are various companies that employ more than two million PaperlessPay users. Id. ¶¶ 2, 42, 44, 60. PaperlessPay's clients provide it with sensitive employee information-including their employees' personally identifiable information (PII)-so that PaperlessPay can produce electronic paystubs and W-2 forms for the employees. Id. ¶¶ 2-3, 44-47.
Plaintiffs, as well as the class they seek to represent, are current and former employees of PaperlessPay's clients. Id. ¶¶ 22-24, 32-33. Plaintiffs are suing PaperlessPay in relation to an alleged cyberattack and data breach that occurred in February 2020 (the “Data Breach”). Id. ¶¶ 3-16, 53-58. Plaintiffs specifically allege:
On or about February 19, 2020, the Department of Homeland Security notified Defendant PaperlessPay that a dark web advertisement offered for sale “access” to Defendant PaperlessPay's SQL database server. The server contained Social Security numbers for current and former employees of those Employers serviced by PaperlessPay.
Over the following weeks, Defendant PaperlessPay cooperated with the joint investigation conducted by and [sic] the Federal Bureau of Investigation (“FBI”). Defendant PaperlessPay engaged the cybersecurity firm Ankura [Consulting Group, LLC] to investigate the incident. Ankura confirmed that, at a minimum, on February 18, 2020, an unauthorized individual entered the server that stored employee data for Employers, and possibly staged an exfiltration from the server.
The data and files exfiltrated from PaperlessPay's computer servers included the PII of Plaintiffs and Class Members, including first and last names, addresses, payroll and withholding information, bank account numbers, and Social Security numbers.
In March 2020, April 2020, May 2020, and in some cases as late as July 2020, PaperlessPay notified Employers . . . of the Data Breach. PaperlessPay advised Employers . . . that an unauthorized individual gained access to its server that hosts Employers' payroll data. PaperlessPay was unable to confirm the extent of the access, but it did confirm that an unauthorized individual gained access to it [sic] server at least once on February 18, 2020, and that the unauthorized individual had the ability to query any payroll data within the server.Id. ¶¶ 53-58.
Plaintiffs contend that they suffered substantial damages because of the Data Breach, including “concrete harm in the form of attempted identity theft[.]” Id. ¶¶ 82-110. Particularly, Plaintiff Allgood “was victim to a fraudulent unemployment insurance claim that included [her] Social Security number” in November 2020, approximately nine months after the cyberattack. Id. ¶¶ 100-101. Similarly, Plaintiff Collins was notified by his employer in February 2021-roughly one year after the Data Breach-that someone had attempted to a file a fraudulent unemployment insurance claim using his PII. Id. ¶ 107.
In their Complaint, Plaintiffs allege that PaperlessPay failed to adequately guard their sensitive information and to otherwise prevent the alleged cyberattack and Data Breach. Id. ¶ 11. As a result, Plaintiffs assert claims for: negligence (Count I); unjust enrichment (Count II); breach of express contract (Count III); breach of implied contract (Count IV); intrusion upon seclusion/invasion of privacy (Count V); breach of confidence (Count VI); violation of the Florida Deceptive and Unfair Trade Practices Act (FDUTPA) (Count VII); and declaratory relief. See generally id.
III. Standards of Review
In its Motion, PaperlessPay seeks dismissal of Plaintiffs' claims on two grounds. See generally Motion. First, PaperlessPay asserts that dismissal is warranted under Rule 12(b)(1) because Plaintiffs lack Article III standing. Id. at 18. Second, PaperlessPay contends that dismissal is proper pursuant to Rule 12(b)(6) because Plaintiffs have failed to plead plausible claims for relief. Id. at 23. Because PaperlessPay's standing argument implicates the Court's subject matter jurisdiction, the Court must address it before turning to the sufficiency of Plaintiffs' allegations under Rule 12(b)(6). See Trichell v. Midland Credit Mgmt., Inc., 964 F.3d 990, 996 (11th Cir. 2020) (“Before reaching the merits, we must consider our own jurisdiction and that of the district court.”) (citing, e.g., Lake Country Estates, Inc. v. Tahoe Reg'l Planning Agency, 440 U.S. 391, 398 (1979)); see also Sinochem Int'l Co. v. Malaysia Int'l Shipping Corp., 549 U.S. 422, 430-31 (2007) (determining whether subject matter jurisdiction existed over the action before turning to the merits of the plaintiffs' claims, noting that “a federal court generally may not rule on the merits of a case without first determining that it has jurisdiction over the category of claim in suit (subject-matter jurisdiction) . . .”).
A. 12(b)(1) - Subject Matter Jurisdiction
A motion to dismiss asserting a lack of standing is a challenge to the Court's subject matter jurisdiction properly considered under Rule 12(b)(1). Townsend v. U.S. Dep't of Agric., No. 2:05-cv-439-FtM-99DNF, 2007 WL 177857, at *1-2 (M.D. Fla. Jan. 19, 2007); Bochese v. Town of Ponce Inlet, 405 F.3d 964, 974 (11th Cir. 2005) (noting that standing “implicates [the Court's] subject matter jurisdiction”) (marks and citation omitted). Federal courts are courts of limited jurisdiction “‘empowered to hear only those cases within the judicial power of the United States as defined by Article III of the Constitution,' and which have been entrusted to them by a jurisdictional grant authorized by Congress.” See Univ. of S. Ala. v. Am. Tobacco Co., 168 F.3d 405, 409 (11th Cir. 1999) (quoting Taylor v. Appleton, 30 F.3d 1365, 1367 (11th Cir. 1994)). Article III of the Constitution, by its plain language, limits the jurisdiction of federal courts (the “judicial power” of the courts) to the consideration of Cases and Controversies. Kelly v. Harris, 331 F.3d 817, 819 (11th Cir. 2003) (citing U.S. Const. art. III, § 2, cl. 1; Ala. Power Co. v. U.S. Dep't of Energy, 307 F.3d 1300, 1308 (11th Cir. 2002)). The doctrine of standing “stems directly from Article III's ‘case or controversy' requirement, ” Bochese, 405 F.3d at 974 (quoting Nat'l Parks Conservation Ass'n v. Norton, 324 F.3d 1229, 1242 (11th Cir. 2003)), and ensures that “federal courts do not exceed their authority, ” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). Indeed, standing “is ‘perhaps the most important' jurisdictional doctrine.” Bochese, 405 F.3d at 974 (quoting Bischoff v. Osceola Cnty., Fla., 222 F.3d 874, 877-78 (11th Cir. 2000) (additional citations omitted). In the absence of standing, a federal court lacks subject matter jurisdiction and is “powerless to hear a case.” Id.; see also Univ. of S. Ala., 168 F.3d at 410 (“Simply put, once a federal court determines that it is without subject matter jurisdiction, the court is powerless to continue.”).
The Court notes that although decisions of other district courts are not binding, they may be cited as persuasive authority. See Stone v. First Union Corp., 371 F.3d 1305, 1310 (11th Cir. 2004) (noting that, “[a]lthough a district court would not be bound to follow any other district court's determination, the decision would have significant persuasive effects.”).
The Eleventh Circuit has unequivocally instructed that “[u]nder settled precedent, the ‘irreducible constitutional minimum' of standing consists of three elements: the plaintiff must have suffered an injury in fact, the defendant must have caused that injury, and a favorable decision must be likely to redress it.” See Trichell, 964 F.3d at 996 (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992)). “These requirements apply with full force in a class action”; however, “only one named plaintiff must have standing as to any particular claim in order for it to advance.” In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1261 (11th Cir. 2021) (citations omitted).
In this action, Plaintiffs, “as the part[ies] invoking federal jurisdiction, bear[ ] the burden of establishing” that they have standing to pursue the claims they allege in the Complaint. Spokeo, 578 U.S. at 338. To do so, Plaintiffs must establish each element of standing “‘in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.'” See Bischoff, 222 F.3d at 878 (quoting Lujan, 504 U.S. at 561). As such, “when standing becomes an issue on a motion to dismiss, general factual allegations of injury resulting from the defendant's conduct may be sufficient to show standing.” Id.; Kawa Orthodontics, LLP v. Sec'y, U.S. Dep't of the Treasury, 773 F.3d 243, 245 (11th Cir. 2014) (“[W]e presume the plaintiff's ‘general allegations embrace those specific facts that are necessary to support the claim.'”) (quoting Lujan, 504 U.S. at 561).
Attacks based on a lack of subject matter jurisdiction come in two forms: facial attacks and factual attacks. Lawrence v. Dunbar, 919 F.2d 1525, 1528- 29 (11th Cir. 1990) (internal quotations and alternations omitted); see also Jones v. Waffle House, Inc., Case No. 6:15-cv-1637-Orl-37DAB, 2016 WL 3231298, at *3 (M.D. Fla. June 13, 2016). “Facial attacks on the complaint require the court merely to look and see if the plaintiff has sufficiently alleged a basis of subject matter jurisdiction, and the allegations in his complaint are taken as true for the purposes of the motion.” Lawrence, 919 F.2d at 1529. “Factual attacks, on the other hand, challenge the existence of subject matter jurisdiction in fact, irrespective of the pleadings, and matters outside the pleadings, such as testimony and affidavits, are considered.” Id. Nevertheless, the Eleventh Circuit has cautioned that courts should only resolve a factual challenge to the existence of subject matter jurisdiction in ruling on a motion to dismiss pursuant to Rule 12(b)(1) “[i]f the facts necessary to sustain jurisdiction do not implicate the merits of plaintiff's cause of action.” See Morrison v. Amway Corp., 323 F.3d 920, 925 (11th Cir. 2003) (quoting Garcia v. Copenhaver, Bell & Assocs., M.D.'s, P.A., 104 F.3d 1256, 1261 (11th Cir. 1997)). When the facts necessary to sustain jurisdiction implicate the merits of a plaintiff's claim, “‘the proper course of action. . . is to find that jurisdiction exists and deal with the objection as a direct attack on the merits of the plaintiff's case.'” See Lawrence, 919 F.2d at 1529 (quoting Williamson v. Tucker, 645 F.2d 404, 412 (5th Cir. May 20, 1981)); see also Tokyo Gwinnett, LLC v. Gwinnett Cnty., Ga, 940 F.3d 1254 (11th Cir. 2019). In such cases, the court must “treat[ ] the motion as a motion for summary judgment under Rule 56 and refrain[ ] from deciding disputed factual issues.” Morrison, 323 F.3d at 925; see Tokyo Gwinnett, 940 F.3d at 1266; Barrett Computer Servs., Inc. v. PDA, Inc., 884 F.2d 214, 219 (5th Cir. 1989).
In Bonner v. City of Prichard, 661 F.2d 1206, 1209 (11th Cir. 1981) (en banc), the Eleventh Circuit adopted as binding precedent all the decisions of the former Fifth Circuit handed down prior to the close of business on September 30, 1981.
B. 12(b)(6) - Failure to State a Claim
In ruling on a motion to dismiss brought pursuant to Rule 12(b)(6), the Court must accept the factual allegations set forth in the complaint as true. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Swierkiewicz v. Sorema N.A., 534 U.S. 506, 508 n.1 (2002); see also Lotierzo v. Woman's World Med. Ctr., Inc., 278 F.3d 1180, 1182 (11th Cir. 2002). In addition, all reasonable inferences should be drawn in favor of the plaintiff. See Randall v. Scott, 610 F.3d 701, 705 (11th Cir. 2010). Nonetheless, the plaintiff must still meet some minimal pleading requirements. Jackson v. Bellsouth Telecomm., 372 F.3d 1250, 1262- 63 (11th Cir. 2004) (citations omitted). Indeed, while “[s]pecific facts are not necessary[, ]” the complaint should “‘give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.'” Erickson v. Pardus, 551 U.S. 89, 93 (2007) (per curiam) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007)). Further, the plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Twombly, 550 U.S. at 570. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556).
A “plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do[.]” Twombly, 550 U.S. at 555 (marks and citation omitted); see also Jackson, 372 F.3d at 1262 (explaining that “conclusory allegations, unwarranted deductions of facts or legal conclusions masquerading as facts will not prevent dismissal”) (marks and citations omitted). Indeed, “the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions[, ]” which simply “are not entitled to [an] assumption of truth.” See Iqbal, 556 U.S. at 678, 680. Thus, in ruling on a motion to dismiss, the Court must determine whether the complaint contains “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Id. at 678 (quoting Twombly, 550 U.S. at 570). The Court's consideration is limited to those facts contained in the complaint and the attached exhibits. Griffin Indus., Inc. v. Irvin, 496 F.3d 1189, 1199 (11th Cir. 2007).
Determining whether a complaint states a plausible claim for relief is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. Moreover, when the “well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged-but it has not ‘show[n]'- ‘that the pleader is entitled to relief.'” Id. (quoting Fed.R.Civ.P. 8(a)(2)).
IV. Discussion
A. 12(b)(1) - Subject Matter Jurisdiction
PaperlessPay contends that Plaintiffs lack standing to pursue the claims set forth in the Complaint. See Motion at 18-23; see also Reply at 5-8. To establish standing, “a plaintiff must have ‘(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.'” Tokyo Gwinnett, 940 F.3d at 1262 (quoting Spokeo, 578 U.S. at 338). At this stage in the proceedings, Plaintiffs “must clearly allege facts demonstrating each element” of their claims and “establish standing for each type of relief sought.” Id. (marks and citation omitted).
In the Motion, PaperlessPay argues that Plaintiffs' injury-in-fact and causation allegations are facially insufficient, although it primarily challenges these allegations through extrinsic materials. See Motion at 18-23, 31; see also Reply at 5-8, 11. In response, Plaintiffs assert that the allegations in their Complaint are sufficient and that Defendant's factual challenge is improper. See Response at 9-18, 25-26. The Court will address each of the parties' standing contentions in turn.
1. PaperlessPay's Facial Attack on Plaintiffs' Standing
a. Plaintiffs' Claims for Damages
Beginning with the first element of standing-injury in fact-Plaintiffs allege that they were injured when unidentified third parties attempted to file fraudulent unemployment insurance claims using their PII. See Complaint ¶¶ 28-29, 37, 101, 107. Plaintiffs specifically state: “After becoming aware of the fraudulent unemployment claim, Plaintiff Allgood spent time contacting her current employer, filing a claim with the Rhode Island unemployment office, and filing a police report with the Rhode Island State Police.” Id. ¶ 29.
“An injury in fact consists of ‘an invasion of a legally protected interest' that is both ‘concrete and particularized' and ‘actual or imminent, not conjectural or hypothetical.'” Trichell, 964 F.3d at 996 (quoting Lujan, 504 U.S. at 560); see In re Equifax, 999 F.3d at 1261. “An injury is concrete if the harm is ‘real.'” In re Equifax, 999 F.3d at 1262 (citing Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 926 (11th Cir. 2020) (en banc)). The Eleventh Circuit has found that economic injuries, identity theft and resulting damages, and wasted time can be concrete injuries. See id. It has also “recognized that ‘some allegations of actual misuse or actual access to personal data' support Article III standing for ‘a data breach based on an increased risk of theft or misuse.'” Id. at 1263 (citing Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1340 (11th Cir. 2021)) (additional citation omitted).
In this case, Plaintiffs allege that they were victims of attempted fraudulent unemployment insurance claims and, as a result, they “spent time, money, and effort trying to mitigate their injuries, including disputing fraudulent activity, filing police reports, and otherwise dealing” with the attempted identity theft. Moreover, PaperlessPay concedes that Plaintiffs allege they suffered actual harm. See Motion at 19 (“Plaintiffs' only allegation of actual harm - that they were ‘victim[s]' of attempted fraudulent unemployment insurance claims - due to the Data Incident cannot survive based on the investigations by DHS, FBI, and Ankura.”). Therefore, at this stage, Plaintiffs have sufficiently alleged an injury-in-fact. In re Equifax, 999 F.3d at 1262-63.
PaperlessPay also asserts that Plaintiffs' injuries are not fairly traceable to PaperlessPay's actions. See Motion at 18-20 (“[T]here is no link between PaperlessPay and Plaintiffs' alleged attempted fraudulent unemployment insurance claims.”). “A showing that an injury is ‘fairly traceable' requires less than a showing of ‘proximate cause.'” Resnick v. AvMed, Inc., 693 F.3d 1317, 1324 (11th Cir. 2012) (quoting Focus on the Fam. v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)). “[E]ven harms that flow indirectly from the action in question can be said to be ‘fairly traceable' to that action for standing purposes.” Focus on the Fam., 344 F.3d at 1273; see also Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1125-26 (11th Cir. 2019). “A plaintiff therefore need not show (or, as here, allege) that ‘the defendant's actions are the very last step in the chain of causation.'” Wilding, 941 F.3d at 1126 (quoting Bennett v. Spear, 520 U.S. 154, 168-69 (1997)).
In their Complaint, Plaintiffs allege: (1) that an unauthorized individual entered PaperlessPay's server, which stored employee data including first and last names, addresses, payroll and withholding information, bank account numbers, and Social Security numbers; (2) that a dark web advertisement offered for-sale “access” to PaperlessPay's server; and (3) that Plaintiffs were victims of attempted fraudulent unemployment insurance claims approximately nine months to one year after the data breach occurred. See generally Complaint. Notably, Plaintiffs do not allege that they “had previously guarded their sensitive personal data and had never suffered identity theft before.” Brush v. Mia. Beach Healthcare Grp. Ltd., 238 F.Supp.3d 1359, 1365 (M.D. Fla. 2017) (citing Smith v. Triad of Ala., LLC, No. 1:14-CV-324-WKW, 2015 WL 5793318, at *8-11 (M.D. Ala. Sept. 29, 2015) and Burrows v. Purchasing Power, LLC, No. 1:12-cv-22800-UU, 2012 WL 9391827, at *2 (S.D. Fla. Oct. 18, 2012)); Resnick, 693 F.3d at 1324. Whether Plaintiffs can establish traceability through these allegations is a close call. But, as “the ‘fairly traceable' standard is fairly lenient at this stage and less than is required to satisfy proximate cause, ” the Court is of the view that Plaintiffs have plausibly alleged injuries fairly traceable to PaperlessPay's alleged cyberattack and Data Breach. Stephens v. Availity, L.L.C., No. 5:19-cv-236-Oc-30PRL, 2019 WL 13041330, at *3 (M.D. Fla. Oct. 1, 2019). At this, the motion to dismiss stage of the proceedings, Plaintiffs have satisfied the irreducible constitutional minimum of standing as to their claims for damages.
This determination would not prejudice a renewed challenge to Plaintiffs' standing by PaperlessPay at a subsequent stage of the proceeding. See Bischoff, 222 F.3d at 878 (quoting Lujan, 504 U.S. at 561) (a plaintiff must establish each element of standing “‘in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of litigation.'”).
b. Plaintiffs' Claim for Declaratory Relief
As noted, Plaintiffs must establish standing for each claim and each form of relief they seek. Mack v. USAA Cas. Ins. Co., 994 F.3d 1353, 1356 (11th Cir. 2021). “In order to demonstrate that there is a case or controversy that satisfies Article III's standing requirement when a plaintiff is seeking declaratory relief-as opposed to seeking damages for past harm-the plaintiff must allege facts from which it appears that there is a ‘substantial likelihood that he will suffer injury in the future.'” A&M Gerber Chiropractic LLC v. GEICO Gen. Ins. Co., 925 F.3d 1205, 1210-11 (11th Cir. 2019) (quoting Malowney v. Fed. Collection Deposit Grp., 193 F.3d 1342, 1346 (11th Cir. 1999)) (additional citation omitted). Thus, for the Court “to have jurisdiction to issue a declaratory judgment, ” Plaintiffs “must assert a reasonable expectation that the injury they have suffered will continue or will be repeated in the future.” Id. (quoting Malowney, 193 F.3d at 1347) (marks and additional citation omitted).
“An allegation of future injury may suffice if the threatened injury is ‘certainly impending' or there is a ‘substantial risk that the harm will occur.'” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (quoting Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409 (2013)) (marks omitted); see also In re Brinker Data Incident Litig., No. 3:18-cv-686-J-32MCR, 2020 WL 4287270, at *2 (M.D. Fla. July 27, 2020). However, the “controversy between the parties cannot be ‘conjectural, hypothetical, or contingent; it must be real and immediate, and create a definite, rather than speculative threat of future injury.'” A&M Gerber Chiropractic, 925 F.3d at 1210 (quoting Emory v. Peeler, 756 F.2d 1547, 1552 (11th Cir. 1985)).
In their request for declaratory relief, Plaintiffs allege: “Upon information and belief, Defendant PaperlessPay is taking some steps to increase its data security, but there is nothing to prevent Defendant from reversing these changes once it has weathered the increased public attention resulting from this Data Breach, and to once again place profits above protection.” Complaint ¶ 218. Simply put, Plaintiffs' allegation is hypothetical, contingent, and speculative. See Emory, 756 F.2d at 1552 (“The remote possibility that a future injury may happen is not sufficient to satisfy the ‘actual controversy' requirement for declaratory judgments.” (citation omitted)). As such, Plaintiffs lack standing as to their claim for declaratory relief, and this claim is due to be dismissed without prejudice.
Plaintiffs also allege that PaperlessPay “has not satisfied its contractual obligations and legal duties to Plaintiffs and the Class members.” Complaint ¶ 217. To the extent Plaintiffs seek declaratory relief for past liability, their request is improper. See In re Brinker Data Incident Litig., No. 3:18-cv-686-J-32MCR, 2020 WL 691848, at *11 (M.D. Fla. Jan. 27, 2020); In re: The Home Depot, Inc., Customer Data Sec. Breach Litig., No. 1:14-md-2583-TWT, 2016 WL 2897520, at *4 (N.D.Ga. May 18, 2016).
2. PaperlessPay's Factual Attack on Plaintiffs' Standing
PaperlessPay primarily challenges Plaintiffs' standing through extrinsic materials, particularly three declarations. See Motion, Attachment 1: Declaration of W. Mark Broughton (Doc. 55-1; Broughton Decl.) & Attachment 2: Declaration of Michael Scattergood (Doc. 55-2; Scattergood Decl.); Declaration of Keith Wojcieszek (Doc. 67; Wojcieszek Decl.). In the first declaration, PaperlessPay's Founder and Chief Executive Officer, W. Mark Broughton, asserts that PaperlessPay never had Plaintiff Allgood's Social Security Number, did not find any evidence of data exfiltration, and has not been provided with any evidence of data exfiltration from the Department of Homeland Security, the FBI, or Ankura. See generally Broughton Decl. Similarly, in the second declaration, the Director of Data & Technology (Incident Response) at Ankura, Michael Scattergood, states that Ankura found no indication that data was exfiltrated from PaperlessPay's server. See Scattergood Decl. ¶ 5. The third declaration, submitted by Keith Wojcieszek, a managing director at the cybersecurity firm Kroll, Inc., is accompanied by a summary of both Plaintiffs' prior security incidents. See Wojcieszek Decl., Exhibit A (Doc. 67-1; Kroll Summary). The Kroll Summary concludes that, prior to the PaperlessPay incident, Plaintiff Allgood's data was impacted by thirty-three data exposure incidents and Plaintiff Collins's data was impacted by thirty-one data exposure incidents. See generally Kroll Summary; see also Motion at 19
In citing Reed, the Court recognizes that “[a]lthough an unpublished opinion is not binding . . ., it is persuasive authority.” United States v. Futrell, 209 F.3d 1286, 1289 (11th Cir. 2000) (per curiam); see generally Fed. R. App. P. 32.1; 11th Cir. R. 36-2 (“Unpublished opinions are not considered binding precedent, but they may be cited as persuasive authority.”). The Court notes that Plaintiffs cite to Cableview Communications of Jacksonville, Inc. v. Time Warner Cable Southeast, LLC, No. 3:13-cv-306-J-34JRK, 2016 WL 128561 (M.D. Fla. Jan. 12, 2016) in their Response. See Response at 5-6. However, Tokyo Gwinnett holds that “[e]ven at the motion to dismiss stage, a defendant may bring a ‘factual attack' on a plaintiff's standing, which ‘challenges the existence of subject matter jurisdiction using material extrinsic from the pleadings, such as affidavits or testimony.'” Tokyo Gwinnett, 940 F.3d at 1265 (quoting Stalley ex rel. United States v. Orlando Reg'l Healthcare Sys., Inc., 524 F.3d 1229, 1233 (11th Cir. 2008)); Reed v. Friedman, 859 Fed.Appx. 498, 499 (11th Cir. 2021) (“Factual attacks on standing brought under Federal Rule of Civil Procedure 12(b)(1) challenge the existence of subject matter jurisdiction in fact, irrespective of the pleadings, and matters outside the pleadings, such as testimony and affidavits, are considered. Extrinsic documents central to a plaintiff's claim and without dispute as to the authenticity may be considered on a motion to dismiss.” (marks and citations omitted)). Here, the Court must follow the precedent cited in Tokyo Gwinnett.
Relying on these declarations, PaperlessPay argues that “Plaintiffs could not have suffered, nor will they ever suffer, fraud or identity theft as a result of the [PaperlessPay] Data Incident.” See Motion at 12 (noting that “Plaintiffs' PII was also extensively compromised and in the public domain before the Data Incident.”). The problem with this argument is that it is “a direct attack on the merits of the case” as PaperlessPay challenges the veracity of Plaintiffs' causation and damages allegations. See MSP Recovery Claims, Series LLC v. OneBeacon Ins. Grp., Ltd., No. 6:20-cv-553-Orl-37EJK, 2021 WL 4935680, at *2 (M.D. Fla. Jan. 19, 2021); see also In re Blackbaud, Inc., Customer Data Breach Litig., No. 3:20-mn-02972-JMC, 2021 WL 2718439, at *8 (D.S.C. July 1, 2021) (quoting In re Zappos.com, Inc., 888 F.3d 1020, 1029 (9th Cir. 2018)) (“As the Ninth Circuit observed in another challenge to Article III standing in a data breach case, ‘[t]hat hackers might have stolen Plaintiffs' PII in unrelated breaches, and that Plaintiffs might suffer identity theft or fraud caused by the data stolen in those other breaches (rather than the data stolen from [defendant]), is less about standing and more about the merits of causation and damages.”). Because PaperlessPay's factual standing challenge implicates the merits of Plaintiffs' claims, the proper course of action for the Court is to “find that jurisdiction exists, ” treat the factual attack as a motion for summary judgment, and refrain “from deciding disputed factual issues.” Morrison, 323 F.3d at 925 (marks and citation omitted); see also Tokyo Gwinnett, 940 F.3d at 1262. But a summary judgment motion is premature at this stage of the proceeding. As such, the Court will deny, without prejudice, PaperlessPay's Motion to the extent it seeks dismissal of Plaintiffs' claims for damages for lack of standing.
B. 12(b)(6) - Failure to State a Claim
The Court turns next to PaperlessPay's arguments challenging the sufficiency of Plaintiffs' pleading pursuant to Rule 12(b)(6). In evaluating a Rule 12(b)(6) motion to dismiss, the Court's “task is to determine whether the pleadings contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Resnick, 693 F.3d at 1326 (quoting Ashcroft v. Iqbal, 556 U.S. 662, 681 (2009)) (marks omitted). “A claim is facially plausible when the court can draw ‘the reasonable inference that the defendant is liable for the misconduct alleged'” from the facts as pleaded. Id. (quoting Iqbal, 556 U.S. at 681). In the Motion, PaperlessPay urges the Court to dismiss all of Plaintiffs' claims for failure to state a claim under Florida law. See Motion at 23-55.
1. Plaintiffs' Negligence, Breach of Express Contract, Breach of Implied Contract, and FDUTPA Claims
To succeed on four of their claims - negligence, breach of express contract, breach of implied contract, and FDUTPA - Plaintiffs must demonstrate that PaperlessPay's actions caused Plaintiffs' harm. See Resnick, 693 F.3d at 1325. “A negligence claim requires a plaintiff to show that (1) defendants owe plaintiffs a duty, (2) defendants breached the duty, (3) defendants' breach injured plaintiffs, and ‘(4) [plaintiffs'] damage [was] caused by the injury to the plaintiff as a result of the defendant's breach of duty.'” Id. (quoting Delgado v. Laundromax, Inc., 65 So.3d 1087, 1089 (Fla. 3d DCA 2011)). In a similar way, “a breach of contract claim requires a party to show that damages resulted from the breach[, ]” id. (citing Rollins, Inc. v. Butland, 951 So.2d 860, 876 (Fla. 2d DCA 2006)), and the same analysis is used “to evaluate claims of breach of contract implied in fact, ” id. (citing Baron v. Osman, 39 So.3d 449, 451 (Fla. 5th DCA 2010) (per curiam)). Plaintiffs' FDUTPA claim also requires proof of causation as its elements are: “1) a deceptive act or unfair practice; 2) causation; and 3) actual damages.” Point Conversions, LLC v. WPB Hotel Partners, LLC, 324 So.3d 947, 957 (Fla. 4th DCA 2021) (quoting KC Leisure, Inc. v. Haber, 972 So.2d 1069, 1073 (Fla. 5th DCA 2008)) (emphasis added) (marks and additional citation omitted).
The Eleventh Circuit has explained that “[g]enerally, to prove that a data breach caused identity theft, the pleadings must include allegations of a nexus between the two instances beyond allegations of time and sequence.” Resnick, 693 F.3d at 1326 (emphasis added). As such, a “mere temporal connection is not sufficient; Plaintiffs' pleadings must indicate a logical connection between the two incidents.” Id. at 1327 (citing Stollenwerk v. Tri-West Health Care Alliance, 254 Fed.Appx. 664, 667-68 (9th Cir. 2007) (even with a close temporal connection of six weeks, a plaintiff must show not only a temporal but also a logical connection between the two events)).
As explained in Resnick, the Stollenwerk court found that a plaintiff plausibly alleged a “causal relationship where (1) [plaintiff] gave [the defendant] his personal information; (2) the identity fraud incidents began six weeks after the hard drives containing [defendant's] customers' personal information were stolen; and (3) [plaintiff had] previously not suffered any such incidents of identity theft.” Id. at 1326-27 (quoting Stollenwerk, 254 Fed.Appx. at 667) (emphasis in original).
In Resnick, a case involving similar issues, the Eleventh Circuit analyzed whether the plaintiffs had sufficiently alleged that the defendant caused their identity theft. The plaintiffs asserted that the defendant had stored their personal information on two unencrypted laptops which were stolen from the defendant's corporate office. Id. at 1322. The plaintiffs later became victims of identity theft despite the fact that they had been “careful in guarding their sensitive information and had never been victims of identity theft before the laptops were stolen.” Id. Although the plaintiffs alleged “gaps of ten and fourteen months” between the theft of the laptops and when their identities were stolen, the court concluded that the plaintiffs demonstrated “a nexus between the two events” which equated to “more than a coincidence of time and sequence: they allege[d] that the sensitive information on the stolen laptop was the same sensitive information used to steal [their] identity.” Id. at 1327. Ultimately the court found that the plaintiffs' causation allegations met the pleading standards; however, it cautioned: “Had [the plaintiffs] alleged fewer facts, we doubt whether the Complaint could have survived a motion to dismiss.” Id.
In this case, Plaintiffs have pled fewer facts and as a result the nexus between the alleged Data Breach and Plaintiffs' injuries is much more tenuous. In their Complaint, Plaintiffs allege: (1) an unauthorized individual entered PaperlessPay's server and “possibly staged an exfiltration”; (2) the unauthorized individual had the ability to query any payroll data within the server; (3) a dark web advertisement offered for sale “access” to PaperlessPay's server; and (4) Plaintiffs were the victims of attempted identity theft nine and twelve months after the breach occurred. See Complaint ¶¶ 53, 58, 101, 107 (emphasis added). While the gaps in time between the alleged Data Breach and Plaintiffs' injuries are similar to the timespans in Resnick, Plaintiffs present no additional factual allegations to suggest that the connection between the two events in this case amounts to more than a mere coincidence of time and sequence.
First, Plaintiffs do not allege enough facts to permit the Court to infer that their sensitive information actually was stolen when the unauthorized individual entered PaperlessPay's server on February 18, 2020. Unlike Resnick, where the plaintiffs alleged that the unencrypted laptops containing their personally identifiable information were actually stolen, and the laptops with this “readily accessible” information were sold to a person with a history of criminal activity, Resnick, 693 F.3d at 1322, here, Plaintiffs do not present factual allegations that their personally identifiable information was taken. Nor do they present allegations that the unauthorized actor was actually able to access their personally identifiable information. To the contrary, the Complaint in this case suggests that the unauthorized entrant was only able to access PaperlessPay's server for a small and finite amount of time. See Complaint ¶¶ 53-55, 58 (“Ankura confirmed that, at a minimum, on February 18, 2020, an unauthorized individual entered the server that stored employee data for Employers[.] . . . PaperlessPay was unable to confirm the extent of the access, but it did confirm that an unauthorized individual gained access to it [sic] server at least once on February 18, 2020[.]”).
Next, the Court observes that Plaintiffs do not allege that they carefully guarded their sensitive information, nor do they allege that they have never been victims of identity theft. In Resnick the plaintiffs affirmatively alleged that they carefully guarded their sensitive information and how they did so. Resnick, 693 F.3d at 1322. Additionally, they alleged that before the laptops were stolen, they had never been the victim of identity theft. Id. They also alleged that “the sensitive information on the stolen laptop was the same sensitive information used to steal plaintiffs' identity.” Id. at 1327. These additional allegations provided a basis to infer a nexus between the stolen laptops and the subsequent identity theft.
Here, the inferential leap required to conclude that the Data Breach caused the Plaintiffs' attempted identity theft is significant, and Plaintiffs have failed to present additional factual allegations sufficient to support an inference of “a logical connection between the two incidents.” Plaintiffs allege a temporal connection in time and sequence, although not a short one, and drawing all inferences in their favor, they allege that the attempted identity thieves used a social security number and personally identifiable information that would have been stored on PaperlessPay's server. But, under Resnick, without additional facts, these allegations are not enough to plausibly plead causation.
While Plaintiffs' allegations certainly raise the possibility that the PaperlessPay Data Breach could have caused their alleged damages, a possible claim is not the same thing as a plausible claim. It is possible that Plaintiffs' personal information was stolen in the Data Breach. It is also possible that the bad actor was unsuccessful in exfiltrating any data at all. And it is possible that the bad actors who attempted to file the false unemployment claims obtained the information they used as a result of the Data Breach. But, it is also possible that the bad actors obtained the information before, or after and wholly apart from, the Data Breach. Nothing in Plaintiffs' Complaint make one scenario more plausible than the other. Under Twombly and Iqbal, only plausible - not merely possible - claims survive a Rule 12(b)(6) motion to dismiss. See Almanza v. United Airlines, Inc., 851 F.3d 1060, 1074 (11th Cir. 2017); see also Chaparro v. Carnival Corp., 693 F.3d 1333, 1337 (11th Cir. 2012) (“A facially plausible claim must allege facts that are more than merely possible.”). The Court recognizes that the plausibility standard does not require probability, but it does require more than a mere possibility. Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 556). Indeed, “[w]here a complaint pleads facts that are ‘merely consistent with' a defendant's liability, it ‘stops short of the line between possibility and plausibility of ‘entitlement to relief.'” Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct. at 1955). That is the case here. Because Plaintiffs allege fewer facts than the plaintiffs in Resnick and their causation allegations do not cross the line from possible to plausible, Plaintiffs' negligence, breach of express contract, breach of implied contract, and FDUTPA claims are due to be dismissed. See Resnick, 693 F.3d at 1330-32 (Pryor, C.J., dissenting) (“The complaint fails to allege a plausible basis for inferring that the unknown identity thieves obtained the sensitive information of [the plaintiffs] from [the defendant].”).
2. Plaintiffs' Unjust Enrichment Claim
Plaintiffs' unjust enrichment claim also fails. “Under Florida law, a claim for unjust enrichment requires that: (1) the plaintiff has conferred a benefit on the defendant; (2) the defendant has knowledge of the benefit; (3) the defendant has accepted or retained the benefit conferred; and (4) the circumstances are such that it would be inequitable for the defendant to retain the benefit without paying fair value for it.” In re Brinker Data Incident Litig., No. 3:18-cv-686-J-32MCR, 2020 WL 691848, at *10 (M.D. Fla. Jan. 27, 2020) (quoting Resnick, 693 F.3d at 1328). “In Florida, the law of unjust enrichment requires a benefit to pass directly from the plaintiff to the defendant and that there be no available legal remedy at law.” Aceto Corp. v. TherapeuticsMD, Inc., 953 F.Supp.2d 1269, 1287 (S.D. Fla. 2013) (citing Virgilio v. Ryland Grp., Inc., 680 F.3d 1329, 1337 (11th Cir. 2012)) (additional citation omitted). However, some courts have allowed “an unjust enrichment claim to stand where the benefit is conferred through an intermediary, pointing out that direct contact, or privity, is not the equivalent of conferring a direct benefit.” Id. at 1288 (collecting cases).
Assuming without deciding that a benefit may be conferred through an intermediary, Plaintiffs, nevertheless, have failed to sufficiently plead the elements of an unjust enrichment claim. See Stephens v. Availity, L.L.C., No. 5:19-cv-236-Oc-30PRL, 2019 WL 13041330, at *6 (M.D. Fla. Oct. 1, 2019) (“There is some support for [the plaintiff's] argument that the direct benefit can be conferred through an intermediary, but there is no support for her argument that such a benefit was conferred here.” (citation omitted)). In their Complaint, Plaintiffs allege that they “conferred a monetary benefit on PaperlessPay in the form of monetary payments-directly or indirectly-for providing payroll services for the Employers.” See Complaint ¶ 136. This unadorned conclusory allegation, however, does not adequately identify such “monetary payments” or any other direct benefit conferred by Plaintiffs on PaperlessPay. See Vibo Corp. v. U.S. Flue-Cured Tobacco Growers, Inc., 762 Fed.Appx. 703, 705- 06 (11th Cir. 2019) (analyzing unjust enrichment claim under Florida law and concluding that the plaintiffs' failure to identify the monetary and economic benefits allegedly conferred is “the sort of element-related conclusion that Iqbal rejects.”). Additionally, Plaintiffs have not plausibly pleaded that PaperlessPay had knowledge of any direct benefit conferred by the Plaintiffs and accepted or retained by PaperlessPay. See Complaint ¶¶ 136-142. Thus, Plaintiffs' claim for unjust enrichment is due to be dismissed.
3. Plaintiffs' Intrusion Upon Seclusion/Invasion of Privacy Claim
In attempting to allege a claim for intrusion upon seclusion/invasion of privacy, Plaintiffs offer nothing more than legal conclusions. See Complaint ¶¶ 168-175. Under Florida law, invasion of privacy is an intentional tort, and the tort of intrusion upon seclusion falls “under the broader heading of invasion of privacy.” See Hammer v. Sorensen, 824 Fed.Appx. 689, 695 (11th Cir. 2020); Purrelli v. State Farm Fire & Cas. Co., 698 So.2d 618, 620 (Fla. 2d DCA 1997) (“Florida courts have recognized invasion of privacy to be an intentional tort.” (citation omitted)); see also Burrows v. Purchasing Power, LLC, No. 1:12-cv-22800-UU, 2012 WL 9391827, at *2 (S.D. Fla. Oct. 18, 2012). Here, Plaintiffs do not plead any facts suggesting that PaperlessPay intentionally shared or exposed Plaintiffs' information or intentionally caused the Data Breach. See Stephens, 2019 WL 13041330, at *6. As plead this claim appears to be “a thinly veiled attempt to transform a negligence claim into an intentional tort . . . .” Id. Viewed in that way, and lacking any factual allegations supporting a plausible intentional tort claim, Plaintiffs' intrusion upon seclusion/invasion of privacy claim is due to be dismissed.
4. Plaintiffs' Breach of Confidence Claim
Once again, assuming, without deciding, that Plaintiffs may bring a common-law breach of confidence claim, the Court recognizes that the Eleventh Circuit has defined this claim as “the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confidential relationship.” Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931-32 (11th Cir. 2020) (en banc) (citing Alan B. Vickery, Note, Breach of Confidence: An Emerging Tort, 82 Colum. L. Rev. 1426, 1455 (1982); Kamal v. J. Crew Grp., Inc., 918 F.3d 102, 114 (3d Cir. 2019); Vassiliades v. Garfinckel's, 492 A.2d 580, 591 (D.C. 1985)). Black's Law Dictionary defines “disclosure” as “[t]he act or process of making known something that was previously unknown[.]” Disclosure, Black's Law Dictionary (11th ed. 2019); see also In re Brinker, 2020 WL 691848, at *22. In this case, Plaintiffs present no allegations suggesting that PaperlessPay did any act to disclose or “make known” Plaintiffs' personally identifiable information. Indeed, based on Plaintiffs' allegations, PaperlessPay “did not do any act that made Plaintiffs' information known”; rather, Plaintiffs' sensitive information was allegedly stolen by an unauthorized third-party. Id. Because no disclosure by PaperlessPay is alleged to have occurred, Plaintiffs' breach of confidence claim must be dismissed. See id. (“Even assuming, arguendo, that [the defendant's] inadequate security facilitated the theft, such a claim would lie in negligence not breach of confidence.”).
In Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917 (11th Cir. 2020) (en banc), the parties disputed “whether a breach of confidence tort can fairly be said to have ‘traditionally been regarded as providing a basis for a lawsuit in English or American courts.'” Id. at 931 (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). However, the Eleventh Circuit chose not to resolve “whether breach of confidence is sufficiently ancient” and instead considered whether the plaintiff had sufficiently alleged a close relationship between his alleged harm and the common-law breach of confidence tort. Id. at 931-32. This Court similarly will leave that question for another day.
V. Conclusion
For the foregoing reasons, Plaintiffs' Complaint is due to be dismissed.
Accordingly, it is ORDERED:
1. Defendant PaperlessPay Corporation's Motion to Dismiss Plaintiffs' Consolidated Class Action Complaint and Memorandum of Law in Support Thereof (Doc. 55) is GRANTED, in part, and DENIED, in part.
A. The Motion is GRANTED to the extent:
a. Plaintiffs' claim for declaratory relief is DISMISSED without prejudice for lack of standing and b. Plaintiffs' claims for damages are DISMISSED.
B. The Motion is otherwise DENIED.
2. The Clerk of the Court is DIRECTED to terminate all pending motions and deadlines as moot and close the file.
DONE and ORDERED