Opinion
CASE NO. 1:16-CV-272-WKW [WO]
08-04-2016
MELISSA BOHANNAN, et al., Plaintiffs, v. INNOVAK INTERNATIONAL, INC., Defendant.
MEMORANDUM OPINION AND ORDER
Before the court is Defendant's motion to dismiss (Doc. # 8), which is construed as also containing a motion for a more definite statement (see Doc. # 8, at 10). The motions have been fully briefed (Docs. # 14 and 15). Upon careful consideration, both motions will be denied.
I. JURISDICTION AND VENUE
Subject-matter jurisdiction is exercised pursuant to the Class Action Fairness Act, 28 U.S.C. § 1332(d). Plaintiffs allege that they are all citizens of Alabama, that Defendant is a citizen of South Carolina, that they bring this action on behalf of a class that exceeds 100 individuals, and that the amount in controversy exceeds $5,000,000. The parties do not contest personal jurisdiction or venue.
II. STANDARD OF REVIEW
A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the sufficiency of the complaint against the legal standard articulated by Rule 8 of the Federal Rules of Civil Procedure. Rule 8 provides that the complaint must include "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). When evaluating a motion to dismiss pursuant to Rule 12(b)(6), the court must take the facts alleged in the complaint as true and construe them in the light most favorable to the plaintiff. Resnick v. AvMed, Inc., 693 F.3d 1317, 1321-22 (11th Cir. 2012).
To survive a Rule 12(b)(6) motion, the complaint "must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). The complaint is facially plausible when "the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 678.
A party may move for a more definite statement under Rule 12(e) of the Federal Rules of Civil Procedure when a pleading is "so vague or ambiguous that the party cannot reasonably prepare a response."
III. BACKGROUND
Plaintiffs brought this class action after learning that unknown individuals misappropriated their personal private information. The facts and procedural history will be briefly discussed.
Defendant Innovak International, Inc. ("Innovak") is an information technology company serving employers like schools, school systems, and other state agencies. Innovak's software allows its end users to access tax and payroll information remotely through its internet portal. The internet portal stores an array of employee personal private information ("PPI"), including social security numbers, addresses, telephone numbers, and dates of birth.
Plaintiffs, who are end users of Innovak's ledger software system, allege that Innovak suffered a security breach when hackers infiltrated the internet portal. They contend that Innovak was aware of its software's vulnerabilities as early as 2014, yet failed to take protective measures to ensure data security. They further contend that, in April of 2016, Innovak admitted to news media outlets that it suffered a data breach, but took no steps to directly inform its end users of the breach. Instead, Plaintiffs learned about the breach when they received letters from the Internal Revenue Service indicating that their PPI had been compromised.
Ten plaintiffs brought this action on behalf of themselves and a class of similarly situated individuals. The named plaintiffs, referred to collectively as "Plaintiffs," include Melissa Bohannan, Cherissa Hall, Jolie Hall, Summer Lisenby, Maryellen Prophet, Jennifer Matheny, Tiffany McCoy, Ashley McGhee, Sherrie Salem, and Crystal Shelley.
In their class action complaint, Plaintiffs assert claims for (1) negligence, (2) breach of implied contract, (3) gross negligence, recklessness and/or wantonness, (4) unjust enrichment, and (5) fraudulent suppression. Plaintiffs allege that they have suffered psychic injuries as a result of learning that their PPI had been compromised. Some Plaintiffs further allege that nefarious individuals used their misappropriated PPI to file false tax returns in their names. They also have incurred the costs of mitigating additional harm associated with the breach. They seek compensatory damages, punitive damages, restitution, attorneys' fees, and costs.
The complaint includes specific class action allegations. Plaintiffs define the putative nationwide class as "all persons whose PPI was compromised as a direct and proximate result of the Innovak data breach." (Doc. # 1, at 8.) They alternatively propose various statewide classes consisting of, for example, "[a]ll persons in Alabama whose PPI was compromised as a direct result of the Innovak data breach." (Doc. # 1, at 8.) With respect to the class action prerequisites set forth in Rule 23(a) of the Federal Rules of Civil Procedure, Plaintiffs contend that the class is so numerous that joinder is impracticable, that there are questions of law and fact common to putative class members, that Plaintiffs' claims are typical of the claims of the class members, and that Plaintiffs will adequately protect the interests of the putative class members. They further allege that the questions of law and fact common to the class members predominate over individual questions, and that class treatment is superior to individual adjudication. See Fed. R. Civ. P. 23(b)(3).
Innovak responded to Plaintiffs' complaint with a motion to dismiss for failure to state a claim upon which relief can be granted. (Doc. # 8.) Pursuant to the briefing order (Doc. # 12), Defendants filed a brief in support of their motion (Doc. # 14), and Plaintiffs filed a response (Doc. # 15). Defendants did not file a reply brief, and the matter is considered submitted on the briefing.
IV. DISCUSSION
In the motion now before the court, Innovak advances three arguments. First, it contends that Plaintiffs' class complaint should be dismissed for failure to satisfy Rule 23 of the Federal Rules of Civil Procedure. Second, it argues that the complaint should be dismissed for failure to state a claim upon which relief can be granted. Third, it maintains that the complaint is so vague or ambiguous that it cannot reasonably prepare a response. These arguments will be addressed in turn. A. The Complaint Will Not Be Dismissed for Failure to Satisfy Rule 23.
Innovak first argues that the class complaint should be dismissed because the class is not ascertainable, and thus fails to satisfy the requirements of Rule 23. The principles governing class certification will first be generally addressed. These principles will then be applied to Plaintiffs' proposed class.
Pursuant to Rule 23(a), plaintiffs may sue on behalf of a class only where: "(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law and fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class." Rule 23(b) further requires that the class fit within one of three enumerated categories. In addition to these explicit requirements, Rule 23 has been construed to include an implicit requirement that the purported class be ascertainable by reference to objective criteria. Bussey v. Macon Cty. Greyhound Park, 562 F. App'x 782, 787 (11th Cir. 2014). The objective criteria should allow class members to be identified in a manner that is administratively feasible, which means that identifying class members requires little, if any, individual inquiry. Id.
Where the proposed class definition requires the court to determine the merits of an individual class member's claims as a predicate to determining her membership in the class, the class is not ascertainable. See Likes v. DHL Express, 288 F.R.D. 524, 531-32 (N.D. Ala. 2012). These "fail-safe" classes, which are framed in terms of legal conclusions, are not administratively feasible. They inevitably require mini- trials to determine which individuals belong to the class. William H. Rubenstein, Newberg on Class Actions § 3:6 (5th ed.).
Innovak contends that Plaintiffs' proposed class constitutes a fail-safe class and is otherwise unascertainable under the controlling legal principles. Innovak acknowledges that class allegations generally are not dismissed at the pleading stage for failure to comply with Rule 23, but nonetheless maintains that it is appropriate to dismiss Plaintiffs' class complaint under Rule 12(b)(6). (Doc. # 14, at 5 (citing Schilling v. Kenton Cty., Civil Action No. 10-143-DLB, 2011 WL 293759 (E.D. Ky. Jan. 27, 2011).) Despite the early nature of this motion, nothing in Rule 23 precludes the consideration of class certification issues in the context of a motion to dismiss. It merely provides that issues of class certification should be decided "at an early practicable time." Fed. R. Civ. P. 23(c)(1)(A).
The relevant inquiry here is whether the allegations are sufficient to plausibly support the existence of an ascertainable class. See Iqbal, 556 U.S. at 678. Or, to borrow phrasing from the case on which Innovak chiefly relies for this motion, the moving party bears the burden of demonstrating that it will be "impossible to certify the class as alleged." Schilling, 2011 WL 293759, at * 4 (citing Bryant v. Food Lion, Inc., 774 F. Supp. 1484, 1495 (D.S.C. 1991)). The issue of whether Plaintiffs proposed a fail-safe class will be addressed first. It will then be determined whether the proposed class is otherwise ascertainable.
Based on the allegations in the complaint, it cannot be said that Plaintiffs have proposed an unascertainable fail-safe class. As noted above, a proposed class is deficient as fail-safe where it is defined in such a way that determining its membership requires a determination of the merits of the potential class members' claims. See Likes, 288 F.R.D. at 531-32. Innovak argues that Plaintiffs' proposed class definitions require findings "that [Innovak's] conduct was 'wrongful,' 'unlawful,' 'negligent,' 'wanton,' [or] 'reckless.'" (Doc. # 14, at 6.) Innovak also contends that the class definitions require the finding "that [Innovak] 'knew of the risks,' acted with a 'conscious disregard,' and 'refused to take adequate and reasonable precautions . . . to adequately protect [PPI].'" (Doc. # 14, at 6-7.)
None of the words or phrases Innovak quoted in this portion of its brief actually appears in the proposed class definitions. The proposed class definitions themselves do not mention that Innovak was negligent, reckless, or wanton in its behavior. Nor do the proposed class definitions make reference to Innovak's conscious disregard for a known risk. The proposed classes merely include those persons, either on a nationwide or statewide scale, "whose PPI was compromised as a direct and proximate result of the Innovak data breach." (Doc. # 1, at 8.) Innovak grafted this litany of legal conclusions onto the proposed class definitions without further explanation. They otherwise are only found in the portion of the complaint in which Plaintiffs lay out their causes of action.
The only aspect of the proposed class definitions that could arguably call for a legal conclusion is the requirement that class members' PPI be compromised as a "direct and proximate result" of the Innovak data breach. Whether some event proximately caused the harm of which a plaintiff complains is a question that requires a legal conclusion. But the definitions offered in Plaintiffs' complaint do not venture so far as to inquire whether, as a matter of law, the Innovak data breach proximately caused the ultimate harm the putative class member suffered. Instead, they ask whether the Innovak data breach caused the putative class member's PPI to be compromised, which is a question that can be answered without engaging in a final adjudication of the merits of the putative class member's claim for liability against Innovak. The definitions merely require the finding that the putative class member's data was rendered insecure as a result of the data breach. And Plaintiffs allege that Innovak's own records will confirm which end users were affected by the breach.
The class, as alleged, is otherwise sufficiently ascertainable to survive Rule 12(b)(6) scrutiny. Plaintiffs contend that Innovak maintains PPI in a centralized location, that its records will indicate which PPI was compromised as a result of the breach, that there is a finite number of end users whose data could have been compromised, and that all end users were affected by the breach. Taking these allegations as true, the complaint is sufficient to indicate that class members can be ascertained by administratively feasible objective criteria. See Karhu v. Vital Pharm., Inc., 621 F. App'x 945, 948 (11th Cir. 2015) (holding that the class is ascertainable where the proponent of class certification can establish that the class members can be identified by reference to records that are in the defendant's control and are useful for identification purposes). The discovery process will ultimately reveal whether Innovak's records provide a feasible means of identifying all end users whose PPI was compromised. And the parties can move for a final decision on the issue of class certification after this period for investigation.
For purposes of the instant motion to dismiss, however, it cannot be said that the alleged class is impossible to certify. Accordingly, to the extent Innovak seeks to dismiss the complaint for failure to comply with Rule 23, its motion is due to be denied. B. The Complaint Will Not Be Dismissed for Failure to State a Claim.
Innovak also argues generally that the complaint should be dismissed for failure to state a claim. See Fed. R. Civ. P. 12(b)(6). Innovak's only argument on this point is that Plaintiffs' complaint does not specify what measures or steps Innovak should have taken to prevent the data security breach. (Doc. # 14, at 12.) The complaint contains sufficient factual matter, however, to support a plausible claim for relief. See Iqbal, 556 U.S. at 678.
Plaintiffs allege that Innovak was aware of the vulnerabilities in its data storage system and that it failed to take reasonable steps to prevent a breach. They further allege that Innovak chose not to "lockdown its internet portal" or notify its end users that their PPI had been compromised. (Doc. # 1, at 11.) In its motion, Innovak offers no authority supporting the proposition that Plaintiffs must specifically allege which protective action Innovak should have taken to prevent the breach. Taken together, the allegations in the complaint constitute a plain statement showing that Plaintiffs are entitled to relief. See Fed. R. Civ. P. 8(a)(2). Applying the Rule 12(b)(6) standard, the factual allegations support the plausible inference that Innovak is liable for the claims asserted. See Iqbal, 556 U.S. at 678. Accordingly, to the extent Innovak seeks to dismiss the complaint pursuant to Rule 12(b)(6), its motion is due to be denied. C. Plaintiffs Will Not Be Ordered to Provide A More Definite Statement.
Innovak finally argues that Plaintiffs should be ordered to provide a more definite statement pursuant to Rule 12. It cannot be said, however, that the allegations are so vague or ambiguous that Innovak cannot prepare a response. See Fed. R. Civ. P. 12(e). The factual allegations are neither vague nor ambiguous. Plaintiffs specifically identify the grounds for their relief such that Innovak is in a position to prepare its answer. Innovak's motion for a more definite statement is thus due to be denied.
V. CONCLUSION
Accordingly, it is ORDERED that Defendant's motion to dismiss (Doc. # 8) is DENIED. It is further ORDERED that Defendant's motion for a more definite statement (Doc. # 8) is DENIED.
DONE this 4th day of August, 2016.
/s/ W. Keith Watkins
CHIEF UNITED STATES DISTRICT JUDGE