Opinion
MASTER FILE NO. 15-CV-222-KOB
09-12-2016
IN RE: COMMUNITY HEALTH SYSTEMS, INC., CUSTOMER SECURITY DATA BREACH LITIGATION (MDL 2595)
This document relates to all cases. MEMORANDUM OPINION ON MOTIONS TO DISMISS
The Consolidated Amended Class Action Complaint ("Consolidated Amended Complaint" doc. 53 as amended by doc. 130) in this Multi-District Litigation lists forty Named Plaintiffs hailing from twenty-four different states. Plaintiffs seek to represent a class comprised of millions of people whose personal information was affected by a data breach in 2014 involving the computer network for Community Health Systems.
Two dispositive motions are pending before this court: (1) "Community Health Systems, Inc. [CHSI]'s Motion to Dismiss for Lack of Personal Jurisdiction, Lack of Subject Matter Jurisdiction, and Failure to State a Claim" (doc. 67); and (2) Community Health Systems Professional Services Corporation [PSC]'s "Motion to Dismiss" (doc. 69). The court held two extended hearings on these motions, one on February 10, 2016 and a second on April 15, 2016. After the first hearing, the court entered its "Partial Order on Motions to Dismiss" (doc. 125) to state, confirm, and clarify the oral rulings the court had made prior to the second hearing.
The instant Memorandum Opinion is meant to be a comprehensive compendium and clarification of rulings on the two motions to dismiss, including not only those rulings already stated in the Partial Order but also those addressed at the second hearing; the instant document also includes a summary of the reasons for those rulings. The transcripts of the two hearings contain a more extensive discussion of those reasons.
The court WILL GRANT IN PART and DENY IN PART both motions to dismiss, as more specifically stated below and for the reasons explained on the record and summarized below.
I. Personal Jurisdiction over CHSI - Rule 12(b)(2)
Defendant CHSI challenges the court's exercise of personal jurisdiction over it. The Due Process Clause of the Fourteenth Amendment requires that a court have personal jurisdiction over a defendant before it may render a judgment against it. See World-Wide Volkswagen v. Woodson, 444 U.S. 286, 291 (1980). To obtain personal jurisdiction over a nonresident defendant in a diversity action, plaintiffs must show that jurisdiction exists under the laws of the forum state where the case was filed and also that"sufficient minimum contacts [exist] between the forum state and the defendant[ ] such that satisfy the Fourteenth Amendment Due Process Clause's notions of fair play and substantial justice." Lockard v. Equifax, Inc., 163 F.3d 1259, 1265 (11th Cir. 1998).
Some of the claims in this case were originally filed in this court and in other federal courts in Alabama, but many of the claims were transferred to this court from other fora to be consolidated into this MDL. The undersigned, as the transferee judge in an MDL, possesses "'all the jurisdiction and powers over pretrial proceedings in the actions transferred to [her] that the transferor judge would have had in the absence of transfer.'" See In re Agent Orange Prod. Liab. Litig MDL No. 381, 818 F.2d 145, 163 (2d Cir. 1987) (quoting In re FMC Corp Patent Litig., 422 F. Supp. 1163, 1165 (J.P.M.D.L. 1976)).
The long-arm statutes of the transferor jurisdictions in this MDL vary; however, finding sufficient minimum contacts provides a necessary step in any personal jurisdiction analysis, and CHSI argued that Plaintiffs are unable to establish such minimum contacts in any transferor forum except Tennessee. To determine whether the Plaintiffs had in fact done so, the court analyzed whether Plaintiffs had established this court's general and/or specific personal jurisdiction over CHSI in each transferor forum and in Alabama.
A. Tennessee Claims
This court FINDS that it has personal jurisdiction over Defendant CHSI, a publicly-traded Delaware holding company with its principal place of business in Tennessee, for the claims asserted in the Consolidated Amended Complaint by the Plaintiffs who filed one of the three cases transferred to and consolidated with this MDL from a district court sitting in Tennessee: Ellzey v. Cmty. Health Sys., Inc., No. 2:15-CV-1640 (N.D. Ala.) [No: 3:15-CV-00832 (M.D. Tenn.)]; Murphy v. Cmty. Health Sys., Inc., No: 2:15-CV-281 (N.D. Ala.) [ No. 3:15-CV-00031 (M.D. Tenn.)]; and McNutt v. Cmty. Health Sys., Inc., No. 2:16-CV-602 (N.D. Ala.) [ No. 3:16-CV-698 (M.D. Tenn.)].
The McNutt case, originally filed in the Middle District of Tennessee on March 31, 2016 and transferred to this MDL, will be designated as "McNutt II," given that another case bearing the name of McNutt v. Cmty. Health Sys., Inc., No. 4:15-CV-221 (N.D. Ala.) ("McNutt I") was originally filed in the Northern District of Alabama on February 5, 2015, and reassigned to the undersigned to be part of this MDL.
The parties had previously acknowledged in CHSI's motion to dismiss, in briefs supporting and opposing that motion, and at the hearings, that this court has general personal jurisdiction over the claims against CHSI originally brought in Tennessee transferor courts because CHSI's principal place of business and office are in Tennessee. No dispute exists on this issue, and CHSI's motion to dismiss excluded claims that were filed in a Tennessee transferor court. The McNutt II case was filed in Tennessee and transferred to this court after the court ruled that it had personal jurisdiction over CHSI only for Plaintiffs' claims that were originally filed in Tennessee; at the time of the partial order regarding challenges to personal jurisdiction over CHSI, the MDL encompassed only the Ellzey and Murphy cases. This court's finding that it has personal jurisdiction over the claims asserted against CHSI in cases originally filed in Tennessee courts applies to and encompasses the claims in McNutt II.
The Plaintiffs agreed through counsel, after the recent filing of the McNutt II action in Tennessee, that the Consolidated Amended Complaint (doc. 53) remains the operative Complaint in this MDL; and that the rulings regarding the Consolidated Amended Complaint remain in effect and apply to the McNutt II action, including the ruling that this court has personal jurisdiction over CHSI for the claims—such as those in McNutt II—filed in Tennessee and transferred to this court. (Doc. 126).
The Plaintiffs' agreement that the court's ruling regarding personal jurisdiction applies to McNutt II does not mean that they agree with the ruling itself.
B. Claims Brought in Other Jurisdictions
As to the claims against CHSI that were not originally brought in Tennessee, CHSI challenged this court's personal and subject matter jurisdiction over it via the declaration of Ben Fordham. (Doc. 68-1). In response to that challenge, Plaintiffs argued that the establishment of jurisdiction over CHSI in one transferor forum meant that this court has jurisdiction not only over the Tennessee claims transferred to it but also over all claims consolidated in this MDL with those Tennessee claims. However, the court FINDS that the establishment of personal jurisdiction over CHSI in one transferor forum of this MDL—here, Tennessee—does not confer to this transferee court personal jurisdiction over CHSI for all other claims asserted against CHSI by all other Plaintiffs in the MDL's Consolidated Amended Complaint where the other transferor jurisdictions could not establish jurisdiction over CHSI. See In re Showa Denko K.K. L-Tryptophan Prods. Liab. Litig.-II, 953 F.2d 162, 165 (4th Cir. 1992) ("The authority for consolidating cases on the order of the judicial panel on multi-district litigation, however, is merely procedural and does not expand the jurisdiction of the district court to which the cases are transferred."); see also In re Genetically Modified Rice Litig., 764 F.3d 864, 873-74 (8th Cir. 2014) (quoting with approval above language from the Showa decision); In re Avandia Mktg., Sales Practices & Prod. Litig., 617 F. App'x 136, 141 (3d Cir. 2015) (same). The court further FINDS that the filing in this MDL of the Consolidated Amended Complaint, which supercedes other complaints for purposes of the pretrial proceedings in this MDL, does not expand the court's jurisdiction over CHSI.
Given this court's rulings that neither the MDL consolidation process nor the filing of a Consolidated Amended Complaint automatically expands this court's personal jurisdiction over CHSI beyond the Tennessee claims, the Plaintiffs attempted to establish jurisdiction over CHSI in transferor jurisdictions other than Tennessee by pointing to CHSI's affiliates and subsidiaries that do business in other states. The Plaintiffs alleged in the Consolidated Amended Complaint that "[t]hrough a network of affiliates, CHS[I] owns or leases 199 hospitals in 29 states . . . and provides outpatient and physician services through a variety of facilities . . . ." (Doc. 53, at 23 ¶ 54). The Plaintiffs argued in their briefs that CHSI is not legally distinct for purposes of personal jurisdiction from PSC and/or the affiliated facilities referenced in the Consolidated Amended Complaint that allegedly provided healthcare services to Plaintiffs.
However, CHSI presented evidence establishing that CHSI is a holding company with no employees, a corporate entity separate and distinct from PSC and the referenced affiliated facilities. Fordham's declaration stated that CHSI is a parent company that does not directly own PSC or any of those healthcare providers referenced in the Consolidated Amended Complaint whose acts in the relevant states allegedly confer jurisdiction over CHSI in this MDL. The general rule, which all relevant jurisdictions in this MDL follow, is that "[j]udicial jurisdiction over a subsidiary corporation does not of itself give a state judicial jurisdiction over the parent corporation . . . even though the parent owns all of the subsidiary's stock." Restatement (Second) of Conflicts § 52 cmt. b (Am. Law Inst. 1971); see Cannon Mtg. Co. v. Cudahy Packing Co., 267 U.S. 333, 337 (1925) (affirming dismissal of the action for lack of jurisdiction, finding that a Maine parent corporation did not do business in North Carolina and rejecting the argument that its wholly owned subsidiary, a separate and distinct Alabama corporate entity with an office in North Carolina, was the parent's agent for jurisdictional purposes). Therefore, the relationship of parent and subsidiary alone does not confer personal jurisdiction upon this court over CHSI itself based on acts allegedly committed by its subsidiaries.
Where, as here, a motion to dismiss presents a factual challenge to the court's jurisdiction, "'the trial court is free to weigh the evidence and satisfy itself as to the existence of its power to hear the case.'" Lawrence v. Dunbar, 919 F.2d 1525, 1529 (11th Cir. 1990) (quoting Williamson v. Tucker, 645 F.2d 404, 412 (5th Cir.), cert. denied, 454 U.S. 396 (1981)).
The following cases are decisions in Alabama, where this transferee court sits and where other cases in this MDL were filed, as well as in states in which other transferor courts sit: Alabama (Alverson, Barr, Jones, McNutt I): Ex parte British Steel Corp., 426 So. 2d 409, 412 (Ala. 1982) ("[I]t is the rule that the parent's use of the subsidiary in the forum does not necessarily subject the parent to the jurisdiction [of the forum] . . . ." (internal quotation marks and cites omitted)); Florida (Veciana): Gadea v. Star Cruises, Ltd., 949 So. 2d 1143, 1146 (Fla. 3d Dist. Ct.App. 2007) (quoting with approval the following language from Enic, PLC v. F.F. South & Co., 870 So. 2d 888, 891-92 (5th Cir. 2004):"'It is well settled in Florida that the mere presence of a subsidiary in Florida, without more, does not subject a non-Florida corporate parent to long-arm jurisdiction.'" ); Indiana (Watson): LinkAmerica Corp. v. Cox, 857 N.E. 2d 961, 964 (Ind. 2006) ("We also hold that the actions of a subsidiary corporation do not ordinarily establish personal jurisdiction over its parent and find that principle controlling in this case."); Mississippi (Lawson): Hogrobrooks v. Progressive Direct, 858 So. 2d 913, 921 (Miss. Ct. App. 2003) (addressing the parent-subsidiary relationship in the context of jurisdiction, and stating that the corporate veil can only be pierced when the corporations do not recognize their separation; citing with approval Gammill v. Lincoln Life & Annuity Distrib., Inc., 200 F. Supp. 2d 632, 635 (S.D. Miss. 2001) (analyzing Mississippi's long-arm statute and stating: "[t]he assertion that LNC is a parent company of another defendant properly before this court is not a sufficient reason standing alone for asserting in personam jurisdiction over a non-resident parent corporation."); New Mexico (Brito and Maes): Weisler v. Cmty. Health Sys., Inc., No. 12-CV-0079, 2012 WL 4498919, at *11 (D.N.M. Sept. 27, 2012) (finding that the plaintiff was unsuccessful in his "attempts to use Defendant CHSI's indirect ownership of its subsidiary the Hospital as a means of establishing general jurisdiction over Defendant CHSI by contending that CHSI conducted business in New Mexico through its subsidiary" and finding that no exceptions to the general rule applied there, such as agency or alter-ego theories, based on the parent's control of the subsidiary); Ohio (Keen): Rucker v. Pers. Fin. Co., 90 N.E. 2d 428, 430-31 (Ohio. Ct. App. 1948) (holding that the "fact that the stock of the subsidiary was held by the foreign corporation and that the foreign corporation exercised control over the subsidiary through ownership of the stock, the corporate identity being formally preserved, is not sufficient to subject such foreign corporation to the jurisdiction of the state court"); Pennsylvania (Lutz, Roman & Smith): Botwinick v. Credit Exch., Inc., 213 A. 2d 349, 354 (Pa. 1965) (finding "that the Pennsylvania corporation, even though a subsidiary of the New York corporation, was not a mere instrumentality of the latter," and thus, that the Pennsylvania courts did not have jurisdiction over the New York corporation based on the Pennsylvania subsidiary); Washington (Adams): Williams v. Canadian Fishing Co., 509 P. 2d 64, 67 (Wash. Ct. App. 1973) ("We agree with respondent that ownership of a subsidiary by a parent, with nothing more, is not sufficient to constitute 'doing business,' for jurisdictional purposes . . . . Although in the case at bar the parent and subsidiary corporations share a common director, there is no showing in the record that the officers of the subsidiary do not act independently of the parent corporation or that the subsidiary is otherwise a 'mere instrumentality' of the parent."); and West Virginia (Glah): Norfolk S. Ry. Co. v. Maynard, 437 S.E. 2d 277, 281 (W. Va. Sup. Ct. App. 1993) ("A parent-subsidiary relationship between corporations, one of which is 'doing business' in West Virginia, does not without showing of additional factors subject the nonresident corporation to this state's jurisdiction.").
Plaintiffs argued that personal jurisdiction should attach to CHSI based on the business activities and actions of its subsidiaries because those subsidiaries function as agents of CHSI. They based that argument in part upon allegations that CHSI chose to control the storing and protection of Plaintiffs' confidential data in a collective fashion. However, Fordham's declaration specifically stated that CHSI "does not control or otherwise participate in any way in data operations at the Facilities or [PSC], including collection, protection, storage or handling of personal information obtained from patients who receive medical care at the Facilities," and that CHSI "has never possessed any personal information of any patients referenced in the Amended Consolidated Class Action Complaint." (Doc. 68-1, at 9, ¶ 30). Plaintiffs bear the burden of rebutting that evidence from the declaration, and the court FINDS that they have failed to do so.
Plaintiffs also based their agency argument upon language on the www.chs.net website that uses inclusive terms, such as "we," "us," "our" and "the Company"; the Plaintiffs read those terms as acknowledging that CHSI and its subsidiaries function as one collective and integrated entity. However, Fordham's declaration also stated that PSC—not CHSI— owns and operates the website. Plaintiffs bear the burden of rebutting that evidence from the declaration, but they have failed to do so.
This court FINDS that Plaintiffs' evidence of language in a website owned and operated by PSC, a separate entity from CHSI, fails to support a finding that CHSI has purposefully availed itself of the privilege of conducting activities with any forum state other than Tennessee. See Asahi Metal Indus. Co. v. Sup. Ct. of Cal., Solano Cty., 480 U.S. 102, 112 (1987) (explaining that the "substantial connection . . . between the defendant and the forum state necessary for a finding of minimum contacts must come about by an action of the defendant purposefully directed toward the forum State") (emphasis in original). Alternatively, the court FINDS that the language on the website owned and operated by PSC, including but not limited to the language in the section "Legal Information," fails to establish an agency relationship between CHSI and PSC, and otherwise fails to establish CHSI's minimum contacts with states represented in this MDL other than Tennessee.
The Legal Information section specifies that CHSI "is a holding company and does not engage in any business other than those activities associated with being a publicly traded (NYSE: CYH) stock company, such as listing agreements with the New York Stock Exchange ('NYSE') and registration and compliance with the U.S. Securities and Exchange Commission ('SEC') . . . .[The NYSE and SEC] require that public companies maintain information on an internet website that is accessible to shareholders [and] [i]ntegral to those requirements is that information be presented in a consolidated fashion and include statements and operating results for Community Health Systems, Inc. and its subsidiaries taken as a whole. Statements that include the words 'we,' 'us,' 'our,' 'the Company,' and similar inclusive words are intended to be summary information about the consolidation of Community Health Systems, Inc. and its subsidiaries taken as a whole, and are not intended to bind or imply that the actions of one legal entity should be attributed to the actions of another legal entity (such as Community Health Systems, Inc.). In its registered filings with the SEC, Community Health Systems, Inc. is required to adhere to the SEC's principles of 'plain English' and avoid the use of defined terms, jargon, and parenthetical exculpatory statements; for ease of reading, Community Health Systems, Inc. and [PSC] adhere to those principles throughout this website. Each hospital affiliated with Community Health Systems, Inc. and [PSC] is owned (or leased) and operated by a separate and distinct legal entity. Each such legal entity is responsible for the healthcare services delivered at its respective facility, employs its own management and other personnel, and grants medical staff privileges and credentials to its own, separate medical staff." (Doc. 68-2, at 1).
The Plaintiffs also relied on similar inclusive, collective language in Form 8-K and Form 10-K filings with the United States Securities and Exchange Commission ("SEC"). However, the Form 10-K and the www.chs.net website posting SEC filings, such as Forms 8-K and 10-K, clarify the use of that inclusive, collective phrasing by explaining that such phrasing is meant to adhere to the SEC's principles of plain English for ease of reading, but is not meant to indicate that CHSI operates the health providing facilities or to attribute to CHSI the acts of its subsidiaries. The court FINDS that the language in these SEC filings fails to establish an agency relationship between CHSI and PSC; that such language fails to establish an agency relationship between CHSI and the facilities referenced in the Consolidated Amended Complaint; and that such language otherwise fails to establish CHSI's minimum contacts with jurisdictions in this MDL other than Tennessee.
Form 8-K is an SEC form that notifies investors of a current event and is filed by public companies with the SEC.
Form 10-K is an annual report that the SEC requires companies to file and that gives a comprehensive summary of a company's financial performance. The Form 10-K upon which the Plaintiffs rely contains the following language: "Throughout this Form 10-K, we refer to Community Health Systems, Inc., or the Parent Company, and its consolidated subsidiaries in a simplified manner and on a collective basis, using words like 'we,' 'our,' 'us' and the 'Company.' This drafting style is suggested by the Securities and Exchange Commission, or SEC, and is not meant to indicate that the publicly-traded Parent Company or any particular subsidiary of the Parent Company owns or operates any asset, business or property. The hospitals, operations and businesses described in this filing are owned and operated, and management services provided, by distinct and indirect subsidiaries of Community Health Systems, Inc." (Fordham Decl., Doc. 68-1, at 15 ¶ 42 (quoting www.chs.net under Investor Relations, SEC Filings, Form 10-K posted 2-25-2015, pp. 3-4)).
Further, the Plaintiffs pointed to sealed insurance documents to support their claim of agency. They alleged, without focusing on any particular policy provision and without additional explanation, that "[i]f CHSI did not have any control of 'data operations at the Facilities or [PSC, LLC],' these documents would not exist." (Pls.' Resp., doc. 80, at 26). The court must presume, as CHSI has done, that the Plaintiffs were simply arguing that CHSI's purchase of an insurance policy that covers certain types of liability in certain amounts necessarily requires the court to conclude that CHSI controlled PSC and the Facilities referenced in the Consolidated Amended Complaint. The court finds no support for the Plaintiffs' argument in the sealed documents and no support in the law.
CHSI presented facts in Fordham's declaration establishing that it is a separate corporate entity from PSC and from the other facilities whose actions are challenged in the Consolidated Amended Complaint; that PSC and such facilities are not agents of CHSI and that CHSI does not otherwise control them; that CHSI does not control or participate in the collection, protection, storage or handling of personal information from patients at the facilities referenced in the Consolidated Amended Complaint; and that CHSI does not have the minimum contacts with jurisdictions other than Tennessee necessary to satisfy due process guarantees of the United States Constitution (Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Plaintiffs bear the burden of rebutting those facts and establishing jurisdiction over CHSI in each transferor court and Alabama; however, Plaintiffs have failed to do so except for establishing jurisdiction over CHSI for the claims filed against it in Tennessee.
Therefore, the court FINDS that the Plaintiffs have failed to establish that PSC and those affiliated facilities are agents of CHSI for the purposes of establishing CHSI's minimum contacts with Alabama and with transferor jurisdictions. The court FINDS that the Plaintiffs have established neither general personal jurisdiction nor specific personal jurisdiction over CHSI in states other than Tennessee. Accordingly, the court further FINDS that CHSI's motion to dismiss for lack of personal jurisdiction is due to be GRANTED to the extent that it requests dismissal of claims asserted in the Consolidated Amended Complaint against CHSI by Named Plaintiffs who were not part of the Ellzey, Murphy or McNutt II cases that were transferred to this court. The court WILL DISMISS WITHOUT PREJUDICE all such claims asserted against CHSI in the Consolidated Amended Complaint pursuant to Rule 12(b)(2).
The dismissal without prejudice is a recognition that this court lacks personal jurisdiction over Defendant CHSI for these Plaintiffs' claims, but it is not an invitation to re-file claims in Tennessee. The Plaintiffs have had ample opportunity to do so, as the McNutt II case demonstrates.
To the extent that CHSI requests the dismissal of all claims against it in the underlying cases that were not filed in Tennessee, the court WILL DENY WITHOUT PREJUDICE that request at this time. The court addresses in this Memorandum Opinion and accompanying Order only the claims in the Consolidated Amended Complaint and its Named Plaintiffs; while these rulings affect the viability of underlying suits or certain claims in them, the parties have not yet provided the court with the information required to address the effect of these rulings on all underlying cases for all issues, and the court chooses not to address this issue in a piecemeal fashion.
II. Subject Matter Jurisdiction - Rule 12(b)(1)
The court must address questions about its jurisdiction prior to making an adjudication on the merits. Resnick v. AvMed, Inc., 693 F.3d 1317, 1323 (11th Cir. 2012). Therefore, the court determined to first examine the Defendants' challenge as to the Plaintiffs' standing, "an aspect of this case or controversy requirement." See Cone Corp. v. Fla. Dep't of Transp., 921 F.2d 1190, 1203 (11th Cir. 1991) (using quoted language). For matters of federal law, such as subject matter jurisdiction, the MDL transferee court will apply the law of the circuit in which the transferee court sits. In re Methyl Tertiary Butyl Ether (MTBE) Prods. Liab. Litig., 241 F.R.D. 435, 439 (S.D.N.Y. 2007) (stating "courts have held that the law of the transferee circuit controls pretrial issues such as whether the court has subject matter . . . jurisdiction over the action . . . ."); In re Silica Prods. Liab. Litig., 398 F. Supp. 2d 563, 644 n.128 (S.D. Tex. 2005) (same); see Murphy v. F.D.I.C., 208 F.3d 959, 965 (11th Cir. 2000) (finding that 11th Cir. law and not D.C. Cir. law should apply to the federal law questions in a case transferred from D.C. Cir. to a court sitting in the 11th Cir., and citing In re Temporomandibular Joint Implants Prods. Liab. Litig., 97 F.3d 1050, 1055 (8th Cir. 1996)).
A. Facial Attack on Article III Case or Controversy Standing
To establish standing in federal court, a plaintiff must plead sufficient facts to show the following elements:
First, the plaintiff must have suffered an "injury in fact"—an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical[.] Second, there must be a causal connection between the injury and the conduct complained of—the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court. Third, it must be "likely," as opposed to merely "speculative," that the injury will be redressed by a favorable decision.Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992) (internal quotations and citations omitted); see also Sprint Commc'ns Co., L.P. v. APCC Servs., Inc., 554 U.S. 269, 273 (2008) (quoting Lujan with approval and listing the three elements of standing).
In its recent decision of Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S. Ct. 1540 (2016), the Supreme Court emphasized the injury-in-fact requirement of concreteness means that the injury "must be 'de facto'; that is, it must actually exist[,]"; and the requirement of particularization means that the injury "must affect the plaintiff in a personal and individual way." Id. at 1548. Both are distinct from one another in a standing analysis. Both must be met. The party or parties invoking federal jurisdiction bear the burden of establishing standing. See Susan B. Anthony List v. Driehaus, ___ U.S. ___, 134 S. Ct. 2334, 2342 (2014). Defendants challenge the existence of the first two elements: injury-in-fact and causation.
As a preface to the analysis of the Defendants' facial attack on standing, the court notes that it had previously provisionally granted the Defendants' motions to dismiss as to the non-statutory claims asserted by Named Plaintiffs Kathy Ellzey and William Lutz, but had allowed those Plaintiffs to re-plead to add additional facts. (Doc. 125, at 8). With this court's permission, the Plaintiffs supplemented the Consolidated Amended Complaint to replace two paragraphs: paragraph 14 regarding Kathy Ellzey, to add additional information regarding hacking Ms. Ellzey's email account; and paragraph 44 regarding William Lutz, to add more specific treatment dates for Mr. Lutz that occurred prior to the data breach in question. See Pls.' Supp. to the Consol. Amend. Class Action Compl., doc. 130. The court FINDS in this Memorandum Opinion that, considering the information in replacement paragraphs 14 and 44, Kathy Ellzey and William Lutz have met the required standing elements. Thus, the court changes the provisional granting of PSC's motion as to their claims based on lack of standing to a finding that Named Plaintiffs Ellzey and Lutz have pled sufficient facts to meet all three elements of Article III case or controversy standing. The rulings in this Memorandum Opinion address the motions to dismiss as encompassing Plaintiffs' Supplement with the supplemental allegations of Named Plaintiffs Ellzey and Lutz.
1. Injury-in-Fact Element of Standing
a. Overpayment
As to the first element of standing, injury-in-fact, the court FINDS that no injury-in-fact exists for the purposes of Article III case or controversy standing based on the allegations of "overpayment." Plaintiffs base their general theory of "overpayment" on allegations that an indeterminate portion of Plaintiffs' payments to health providers "was made for the protection of confidential patient data in Defendants' allegedly secure computer network [and that the failure of Defendants] to secure and protect Plaintiffs' . . . confidential patient data" means that the "Defendants' retention of fees paid for that security and protection . . . represents an overpayment for which Plaintiffs . . . should be compensated." (Doc. 53, at 3 ¶ 10).
The Plaintiffs did not allege that they paid anything specific for the protection; that patients who did not pay for services received a different level of protection from those who did pay; that Plaintiffs paid a premium for data protection or otherwise bargained for the protection; or that Plaintiffs received any information about data protection other than a HIPAA Notice. The Plaintiffs provided this court with no case law in which any federal court specifically addressed and accepted "overpayment" as an injury-in-fact for standing purposes in an analogous context, and this court is aware of none.
Although Plaintiffs state in their brief that they "bargained for and paid for protection of their CPD when they sought healthcare" (doc. 73, at 24), ¶ 10 of the Consolidated Amended Complaint, which they cite as support in their brief, does not state facts showing that they bargained for protection of the confidential patient data. See doc. 53, at 3, ¶ 10.
The court notes that the case upon which Plaintiffs relied at the hearing, Weinberg v. Advanced Data Processing, Inc., 147 F. Supp. 3d 1359 (S.D. Fla. 2015), did not address standing at all, and certainly did not address whether an overpayment theory stated an injury-in-fact for purposes of standing.
However, a number of courts have rejected an "overpayment" theory of damages as an injury-in-fact for standing purposes. See Carlsen v. GameStop, Inc., 112 F. Supp. 3d 855, 861 (D. Minn. 2015) (finding that the plaintiffs had failed to establish Article III standing based on a general theory of overpayment and stating: "Courts have generally found 'overpayment' theories insufficient to establish injury, even in situations involving highly sensitive [personal information]." (collecting cases)); In re Zappos.com, Inc., 108 F. Supp. 3d 949, 962 n. 5 (D. Nev. 2015) (granting motion to dismiss for lack of standing based on "diminished value of the services provided by Zappos" and stating that plaintiffs failed to "allege facts showing how the price they paid for [Zappos's] goods incorporated some particular sum that was understood by both parties to be allocated towards the protection of customer data"); In re Science Applications Int'l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 30 (D.D.C. 2014) (rejecting plaintiffs' claims of standing based on an argument that they were cheated out of a portion of their premiums for health and dental insurance when their data was not protected and a data breach occurred: "To the extent that Plaintiffs claim that some indeterminate part of their premiums went toward paying for security measures, such a claim is too flimsy to support standing."); see Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016) (acknowledging in dicta the court's skepticism regarding plaintiffs' argument that the "cost of [plaintiffs'] meal is an injury [-in-fact for standing purposes] because they would not have dined at P.F. Chang's had they known of its poor data security," and noting that courts have adopted such overpayment arguments only when "the product itself purchased was defective or dangerous ...."); see also Resnick v. AvMed, 693 F.3d 1317, 1323 & n.1 (11th Cir. 2012) (finding, after plaintiffs alleged monetary damages from misuse of their identities and also alleged overpayment based on defendant company's failure to protect their confidential data from thieves,standing based on allegations that the plaintiffs suffered monetary loss as a result of actual identity theft, but not addressing whether overpayment represented an injury-in-fact for standing purposes); Remijas v. Neiman Marcus Group, 794 F.3d 688, 696 (7th Cir. 2015) (stating that "we refrain from deciding whether the overpayment for Neiman Marcus products . . . might suffice as injuries under Article III" and acknowledging that "we are dubious" about whether the overpayment theory alone would have sufficed to establish standing).
For all of these reasons, the court rejects the allegations of "overpayment" as sufficient to establish an injury-in-fact for purposes of Article III case or controversy standing.
b. Loss of Intrinsic Value
As to the Plaintiffs' argument that they suffered an injury-in-fact based on loss of intrinsic value of their confidential personal information, the court FINDS that the facts alleged do not support this theory of damages sufficient to establish Article III case or controversy standing. The Consolidated Amended Complaint contains no facts showing that the Plaintiffs' personal information was rendered less intrinsically valuable to the Plaintiffs because of the data breach and/or that Plaintiffs attempted to sell or use their personal information and were unable to use it or were unable to sell it for the appropriate price because the data breach negatively impacted its value.
The Plaintiffs cited three non-controlling cases, the first two of which were unpublished and regarded dissemination of personal information by the defendant company, not through data theft. The two unpublished cases were: a Ninth Circuit case, In re Facebook Privacy Litig., 572 F. App'x 494 (9th Cir. 2014), that did not specifically address standing; and Svenson v. Google, Inc., No. 13-CV-4080, 2015 WL 1503429, at *2-3 (N.D. Cal. Apr. 1, 2015), which incorrectly equated injury-in-fact for Article III standing purposes with damages sufficient to state a claim under California law, and which relied on In re Facebook as recognizing "diminution of value of personal information" as a plausible theory of damage for breach of contract under California law. In the third opinion, Claridge v. RockYou, Inc., a data breach case, the court acknowledged that it was addressing "a novel theory of damages for which supporting case law is scarce" and "not yet settled." 785 F. Supp. 2d 855, 861 (N.D. Cal 2011). Focusing on that uncertainty, the court found the allegations sufficient for standing at the motion to dismiss stage; nevertheless, the court promised that "[i]f it becomes apparent, through discovery, that no basis exists upon which plaintiff could legally demonstrate tangible harm via the unauthorized disclosure of personal information, the court will dismiss plaintiff's claims for lack of standing at the dispositive motion stage."
This court finds more persuasive the reasoning in the following 2014 and 2015 published, albeit non-controlling, decisions addressing similar theories in data breach cases and finding no injury-in-fact for standing purposes. In In re Zappos, the court addressed plaintiffs' theory of standing that the data breach resulted in a devaluation of their personal information. It stated, "[t]he court does not buy this argument" and noted that the plaintiffs alleged no facts "explaining how their personal information became less valuable as a result of the breach or that they attempted to sell their information and were rebuffed because of a lower price-point attributable to the security breach." 108 F. Supp. 3d at 954.
The court in Galaria v. Nationwide Mutual Insurance Company rejected a similar theory of standing because plaintiffs "have failed to allege any facts explaining how their PII [personally identifiable information] became less valuable to them (or lost all value) by the data breach," and because they did not allege that the data breach prevented them from selling their personal information at the price they alleged it was worth. 998 F. Supp. 2d 646, 659-60 (S.D. Ohio 2014).
And the court in In re SAIC rejected as "unsuccessful" a theory based on "loss of value" of personal information as injury-in-fact to establish standing: "Even if the [plaintiffs] did intend to sell their own data—something no one alleges—it is unclear whether or how the data has been devalued by the breach." 45 F. Supp. 3d at 30.
This court joins those courts in rejecting the loss of intrinsic value theory to establish standing.
c. Increased Risk of Harm
The Plaintiffs also argued that an injury-in-fact exists based on the increased risk of harm after the data breach occurred. Some—but not all—Named Plaintiffs alleged accompanying misuse of their data resulting from the data breach.
1. Risk of Harm Unaccompanied by Misuse
This court recognizes that a split exists in the Circuit Courts of Appeal regarding whether an increased risk of harm after a data breach unaccompanied by misuse of the stolen data constitutes an injury-in-fact. See, e.g., decisions in the Ninth and Seventh Circuit Courts of Appeals holding that standing exists even when no misuse had yet occurred: Lewert, 2016 WL 1459226, at *2-4; Remijas, 794 F.3d at 692-93; Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010); Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007); but see, e.g., a decision from the Third Circuit, Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir. 2011) (affirming the district court's dismissal for lack of standing based on an increased risk of harm when unaccompanied by misuse, and criticizing Pisciotta and Krottner for using "skimpy rationale"; for failing to discuss "constitutional standing requirements and how they apply to generalized data theft situations"; and for using failed analogies between data breach cases, on the one hand, and cases involving medical devices, toxic torts, or environmental injury, on the other). The Eleventh Circuit has not chosen a side in this fray. See Resnick, 693 F.3d at 1323 n. 1 ("As Plaintiffs have alleged only actual—not speculative—identify theft, we need not address the issue of whether speculative identity theft would be sufficient to confer standing." (emphasis added)).
Although the Supreme Court of the United States has not yet addressed this issue of standing based on increased risk of harm in the data breach context, it has spoken fairly recently to the issue in other contexts in the following decisions: Susan B. Anthony List v. Driehaus, ___ U.S. ___, 134 S. Ct. 2334 (2014) and Clapper v. Amnesty Intern., USA, ___ U.S. ___, 133 S. Ct. 1138 (2013). In Susan B. Anthony List, the Court reversed the dismissal of an action by advocacy organizations challenging an Ohio statute criminalizing false statements about candidates during political campaigns. In so ruling, the Court noted the history of past enforcement and the allegations of an intent to engage in the same speech that was the subject of a prior enforcement. Given that history and alleged intent, the Supreme Court found that the organizations adequately alleged a substantial threat of both future administrative and criminal enforcement to satisfy standing and also found that "an actual arrest, prosecution, or other enforcement action is not a prerequisite to challenging the law." 134 S. Ct. at 2342-46.
In Clapper, the Supreme Court found that no standing existed in a suit seeking a declaration that a provision of the Foreign Intelligence Surveillance Act of 1978 ("FISA") allowing surveillance of certain individuals was unconstitutional because the respondents had failed to demonstrate that the feared future injury was "certainly impending." The Court explained that the plaintiffs' theory rested on speculation regarding the Government's future actions and "a highly attenuated chain of possibilities," such as whether the Government would decide to target the specific non-U.S. persons with whom respondents communicated; whether the Government would invoke its surveillance authority under FISA rather than using another method of surveillance; whether the judges who serve on the Foreign Intelligence Surveillance Court would approve the surveillance; whether the Government would intercept successfully the communications of respondents' contacts; and whether the respondents would also be parties to those intercepted communications. 133 S. Ct. at 1147-49. The Court rejected the Second Circuit's "objectively reasonable likelihood" standard, as beinginconsistent with the "certainly impending" standard. Id. at 1147-48. In a footnote, the Court also referred to the "substantial risk" standard: "to the extent that the 'substantial risk' standard is relevant and distinct from the 'clearly impending' requirement, respondents fall short of even that standard, in light of the attenuated chain of inferences necessary to find harm here." Id. at 1150 n.5.
In the instant case, this court FINDS that no injury-in-fact exists for the purposes of Article III case or controversy standing under either the "certainly impending" standard or the "substantial risk" of harm standard, based on the allegations that Plaintiffs have an "increased risk" of becoming victims of identity theft crimes, fraud and abuse, and based on the specific factual circumstances alleged here, where that risk is not accompanied by misuse of the stolen data. This court does not find that an increased risk of harm unaccompanied by actual harm cannot, under any circumstances, constitute an injury-in-fact.
However, for the Plaintiffs in the instant case who did not have allegations of misuse accompanying their claims of an increased risk of harm, the facts pled here do not meet the definition of injury-in-fact; the alleged injuries are "conjectural and hypothetical" and are not "concrete," nor are they "actual or imminent." See Lujan, 504 U.S. at 560-61. Rather, the alleged injuries here are based on a future threat "which relies on a highly attenuated chain of possibilities." See Clapper, 133 S. Ct. at 1148. Actual harm may occur only if the hacker is able to decrypt and convert the information hacked to some understandable and usable form; if the hacker intends to commit future criminal acts by misusing the information or selling it to another who so intends; and if the hacker or those who may obtain the personal information are indeed able to successfully make unauthorized use of it. This chain of possibilities, involving "speculation about the decisions of independent actors," would place the Plaintiffs' standing theory into the category that the Supreme Court declined to accept as injury-in-fact. See Clapper, 133 S. Ct. at 1150 ("We decline to abandon our usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors.").
2. Mitigation of Risk of Harm Unaccompanied by Misuse
The court further FINDS that no injury-in-fact exists for the purposes of Article III case or controversy standing based on the allegations of time and money spent to investigate and/or mitigate the increased risk of harm when that risk was not accompanied by misuse of the stolen data. When, as here, increased risk of harm is not substantial and the hypothetical future harm is not certainly impending, Plaintiffs cannot "manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending." See Clapper, 133 S. Ct. at 1151 (using quoted language). The court notes that the Supreme Court in Clapper rejected the Second Circuit's previous standard of allowing mitigation costs to establish standing when the fear was not "fanciful, paranoid, or otherwise unreasonable," because that standard "improperly water[ed] down the fundamental requirements of Article III." The Supreme Court explained that the key focus is not upon the reasonableness of the fears but upon the imminence of the future harm and whether it is certainly impending or the risk of harm is substantial. Id.
Having found that, in the instant case, the risk of harm unaccompanied by misuse does not fit the two standards that the Supreme Court has accepted when the harm has not yet occurred, this court must similarly find that the mitigation costs associated with that risk cannot be an injury-in-fact and cannot be fairly traceable to the data breach.
d. Misuse and Mitigation of Risk Accompanied by Misuse
The court FINDS that injury-in-fact does exist for the purposes of Article III case or controversy standing based on allegations that misuse of the stolen data has occurred. Only where such misuse has already occurred can allegations regarding mitigation costs—such as time and money spent to investigate and/or mitigate the misuse itself and the increased risk of future harm—form part of the alleged injury-in-fact. See Clapper, 133 S. Ct. at 1151. Defendants did not challenge the "injury-in-fact" element or the costs of mitigation of the risk for the Named Plaintiffs who had already suffered misuse of their data after the breach; rather, the Defendants only challenged costs of mitigation for those who had not yet suffered data misuse after the breach. See doc. 70, at 4 (listing 26 Plaintiffs as alleging no injury, and omitting paragraphs describing those Plaintiffs who alleged misuse) & 17 (challenging as an injury-in-fact mitigation costs of Plaintiffs Bubel and Mendoza, who did not allege misuse, but not challenging such costs for those who alleged misuse, such as Plaintiffs Matus and Brown).
Specifically, the court FINDS that the claims of the following fourteen Named Plaintiffs alleged an injury-in-fact—which is both concrete and particularized as well as actual or imminent, not conjectural or hypothetical—to support Article III case or controversy standing based on misuse of stolen data subsequent to the data breach: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Daniel Watson (Watson case); 6. Joel Lovelace (Alverson case); 7. Melissa Cooper (Lawson/McNutt II cases); 8. Johannes Nhete (Alverson case); 9. Joan Crespin (Maes/McNutt II cases); 10. John Sanchez (Ellzey case); 11. William Lutz (Lutz/McNutt II cases); 12. Christopher Brown (Alverson case); 13. Tara June Moore (Ellzey case); and 14. Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah (Glah/McNutt II cases). As the claims of these fourteen Named Plaintiffs meet the first element of standing, the court will subsequently analyze whether they meet the other two elements of causation and redressability.
e. Dismissals Based on Lack of Injury-in-Fact
The court FINDS that PSC's motion to dismiss for lack of subject matter jurisdiction based on lack of Article III case or controversy standing (doc. 69) is due to be GRANTED as to the non-statutory claims of all other Named Plaintiffs not listed in the immediately preceding paragraph, because they did not allege an injury-in-fact. Thus, those Named Plaintiffs have no Article III case or controversy standing to sue for any of their claims, and the court does not have subject matter jurisdiction over their non-statutory claims; the court WILL DISMISS WITHOUT PREJUDICE the non-statutory claims of those Named Plaintiffs asserted against PSC. As to their statutory claims, the Named Plaintiffs not listed in the immediately preceding paragraph have no Article III standing to sue unless conferred by statute, and in a subsequent part of this Memorandum Opinion, the court will address their standing to sue in federal court under the FCRA claims and state statutory claims.
Although CHSI did not present a facial challenge to standing, the court FINDS that the same standing requirement applies to claims asserted against CHSI. Accordingly, to the extent the non-statutory claims dismissed against PSC were also asserted against CHSI by Named Plaintiffs who were part of the Ellzey, Murphy or McNutt II cases, the court WILL sua sponte DISMISS WITHOUT PREJUDICE those claims asserted against CHSI.
2. Causation/Fairly Traceable Element of Standing
Even when a plaintiff has sufficiently alleged an injury-in-fact, he must also plead sufficient facts to show a causal connection between the injury and the challenged conduct of the defendant; the injury must be fairly traceable to that conduct. See Lujan, 504 U.S. at 560-61 (listing elements of standing).
The Consolidated Amended Complaint alleges that the data breach involved "names, addresses, birthdates, telephone numbers, Social Security numbers, employer names, and guarantor names, as well as protected health information." (Doc. 53, at 2). The Plaintiffs do not allege that the data breach involved specific financial information, such as credit card or bank account information.
The court FINDS that the "fairly traceable" element exists for purposes of Article III case or controversy standing when at least one instance of misuse was pled that would have a logical connection to the data stolen. Such misuse would be at least one of the following specific allegations in the Consolidated Amended Complaint: opening without authorization of new credit card account(s), new financial account(s), and/or new foreign exchange account(s) in the Plaintiff's identity; renting/attempting to rent an apartment using a Plaintiff's identity without authorization; using a Plaintiff's identity without authorization to purchase a new cell phone and/or open new cell phone account; hacking a Plaintiff's existing phone and existing email accounts; using a Plaintiff's social security number and personal identifiers to file a federal tax return or anything else without authorization.
Given these rulings, the court FINDS specifically that the allegations of the following remaining Named Plaintiffs meet the "fairly traceable" element for purposes of Article III case or controversy standing: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Melissa Cooper (Lawson/McNutt II cases); 6. Johannes Nhete (Alverson case); 7. John Sanchez (Ellzey case); 8. William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case); and 10. Tara June Moore (Ellzey case). Because the court also FINDS that the allegations of these Named Plaintiffs meet the last element of case or controversy standing, the redressability element, the court WILL DENY PSC's motion to dismiss to the extent that it challenges the Article III case or controversy standing of these Plaintiffs and subject matter jurisdiction over the claims of these ten Named Plaintiffs.
Conversely, the court WILL GRANT PSC's motion to dismiss as to the non-statutory claims of the following remaining Named Plaintiffs who did allege an injury-in-fact, but whose injury-in-fact is not fairly traceable to the Defendants' alleged wrongful conduct: 1. Daniel Watson (Watson case-alleged unauthorized access to his checking account and attempted theft of funds from his checking account, but the data breach did not include financial information such as bank account numbers); 2. Joel Lovelace (Alverson case-alleged unauthorized charges had been placed on his credit card account, but the data breach did not include financial information such as credit card numbers); 3. Joan Crespin (Maes/McNutt II cases-alleged that unauthorized charges had been placed on her credit card accounts); and 4. Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah (Glah/McNutt II cases-alleged that unauthorized charges had been placed on Ms. Glah's credit card accounts). As these four Named Plaintiffs have no Article III case or controversy standing to sue, the court does not have subject matter jurisdiction over any of their claims, unless a statute confers Article III statutory standing for those statutory claims alone. Therefore, the court WILL DISMISS WITHOUT PREJUDICE the non-statutory claims those four Named Plaintiffs asserted against PSC.
The court notes that only eight of those ten remaining Named Plaintiffs filed their claims in Tennessee, and thus, only eight may pursue non-statutory claims against CHSI: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (McNutt II cases); 4. Ashley Veciana (McNutt II cases); 5. Melissa Cooper (McNutt II case); 6. John Sanchez (Ellzey case); 7. William Lutz (McNutt II cases); and 8. Tara June Moore (Ellzey case). Because Daniel Watson, Joel Lovelace, Joan Crespin, and Mary Glah did not file their claims in Tennessee, the court reiterates that no personal jurisdiction exists over CHSI for their claims; as discussed earlier in this Memorandum Opinion, the court will dismiss such claims asserted against CHSI for lack of personal jurisdiction, not lack of subject matter jurisdiction.
While the court will allow the ten Named Plaintiffs with standing to proceed to the next step and will address the sufficiency of the pleadings, the court does so without prejudice to revisiting the "fairly traceable" element and the standing determinations as to those ten Named Plaintiffs if evidence or lack of evidence warrants. The court does so recognizing that evidence disclosed during discovery may reflect that the misuse emanated from a cause other than the data breach at issue here. However, these Named Plaintiffs have pled sufficient facts to establish jurisdiction and standing, and can proceed to the next step of addressing the sufficiency of their claims pursuant to a Rule 12(b)(6) challenge.
3. Redressable Element of Standing
The parties do not challenge this element of standing, and, as referenced earlier, the court FINDS that this element exists for the remaining Named Plaintiffs' non-statutory claims.
B. Factual Attack on "Fairly Traceable" Element of Article III Case or Controversy Standing
In its motion to dismiss and supporting briefs, CHSI asserted a factual challenge to the "fairly traceable" element, based on the declaration of Ben Fordham. The court FINDS that the jurisdictional basis of this claim is intertwined with the merits of the federal and state claims. Thus, the court further FINDS that, as to claims remaining after the court's rulings on personal jurisdiction and the facial challenge to standing, jurisdiction exists at this point; the court will deal with this issue as a direct attack on the merits at a later stage, if appropriate. Accordingly, the court WILL DENY CHSI's motion to dismiss to the extent that it asserts a factual attack on standing as to the remaining Plaintiffs.
C. Statutory Standing
In addition to the common law claims brought under state law, the Plaintiffs have asserted a federal statutory claim under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et. seq., as well as claims under various state statutes. The court has determined previously in this opinion that ten of the Named Plaintiffs have Article III case or controversy standing to sue; therefore, they may proceed to argue the sufficiency of their claims, both statutory and non-statutory, pursuant to a Rule 12(b)(6) challenge. The court will address the sufficiency of their claims, including their statutory claims, pursuant to Rule 12(b)(6) later in this opinion. Eight of those ten Plaintiffs may pursue claims against CHSI in this MDL. However, this court must determine whether the Plaintiffs who have no Article III case or controversy standing and cannot pursue state common law claims nevertheless have Article III standing to pursue their federal and state statutory claims. Put another way, this court must determine whether those statutes somehow confer standing in federal court where standing would not otherwise exist.
1. Standing under the FCRA
At the hearing on April 15, 2016, the court first addressed standing to sue based on the FCRA. Given the court's rulings as to case or controversy standing, which found only ten Named Plaintiffs had such standing, the issue before the court at the hearing in April was whether the provisions of the FCRA granted standing to sue under the FCRA to Named Plaintiffs in addition to those ten by establishing statutory liability through a procedural violation of the statute where no actual injury existed. Because the FCRA provides no liability for a negligent breach without actual damages, the standing issue focused on willful breach, which provides for liability to the consumer even when the consumer sustains no actual damages resulting from that willful breach.
At the time the court held a hearing on the FCRA standing issue, the Supreme Court of the United States had not yet issued its opinion in Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S. Ct. 1540 (2016). That case involved alleged willful violations of the FCRA when Spokeo, Inc. generated an incorrect personal profile of plaintiff Robins. One issue presented in Spokeo was whether Robins could satisfy the injury-in-fact requirement of Article III standing by alleging a bare procedural violation of the FCRA. The Supreme Court has now issued that opinion; Spokeo was decided on May 16, 2016, and the opinion was revised as of May 24, 2016.
The Spokeo facts differ from those here: they did not involve a data breach, but rather, involved the defendant operator of a website that intentionally disseminated information regarding the plaintiff to a third party in response to that third party's inquiry about the plaintiff. Robins's complaint was not that the website provided accurate information without his permission, but that it gathered and provided inaccurate information in response to that third party inquiry about him. The inaccurate information did not display Robins in a bad light; it "described Robins as holding a graduate degree and as wealthy," but "Robins, who [was] unemployed, described the information as 'caus[ing] actual harm to [his] employment prospects.'" The Ninth Circuit characterized Robins's allegations of injury as "sparse"; the district court had boiled down those allegations as follows: "that he has been unsuccessful in seeking employment, and that he is concerned that the inaccuracies in his report will affect his ability to obtain credit, employment, insurance, and the like." Spokeo, Inc. contended that Robins did not have standing to sue under the FCRA, even for a willful violation, without showing actual harm. Robins v. Spokeo, Inc., 742 F.3d 409, 410 & 413 (9th Cir. 2014), vacated & remanded by Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
The Ninth Circuit framed the issue as "whether violations of statutory rights created by the FCRA are 'concrete, de facto injuries' that Congress can so elevate." Because the statutory cause of action did not require proof of actual damage, the Court of Appeals determined that plaintiff Robins had suffered a violation of that statutory right without suffering actual damages. Further, the Court of Appeals decided that the alleged violations of Robins's statutory rights were sufficient to satisfy Article III's injury-in-fact requirement, because his allegations showed that "'Spokeo violated his statutory rights, not just the statutory rights of other people,' and because 'his personal interests in the handling of his credit information are individualized rather than collective.'" Id. at 413. Spokeo, Inc. appealed.
In addressing the issue of Robins's standing, the Supreme Court determined that "Article III standing requires a concrete injury even in the context of a [federal] statutory violation." 136 S. Ct. at 1549. The Court acknowledged that "because Congress is well positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important" in determining whether an intangible harm constitutes an injury-in-fact. Further acknowledging that certain violations of a procedural requirement of the FCRA—e.g, the dissemination of an incorrect zip code—may result in no harm, the Court explained that "Congress' role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Id. The Supreme Court concluded that "Robins cannot satisfy the demands of Article III by alleging a bare procedural violation." Id. at 1550.
The Supreme Court emphasized that the injury-in-fact inquiry requires a plaintiff to show that his harm is not only particularized but also concrete, but the Court of Appeals had not specifically analyzed both; the Ninth Circuit had found that Robins's injury was particularized as it was a violation of his statutory rights, but the Court of Appeals had not specifically addressed concreteness. Vacating the judgment and remanding the case for further proceedings, the Supreme Court issued the following explanation and direction:
Because the Ninth Circuit failed to fully appreciate the distinction between concreteness and particularization, its standing analysis was incomplete. It did not address the question framed by our discussion, namely, whether the particular procedural violations alleged in this case entail a degree of risk sufficient to meet the concreteness requirement.136 S. Ct. at 1550.
With that guidance in mind, the court addresses the standing issue in the context of Plaintiffs' claims under the FCRA: in Count VIII, they asserted a negligent violation; and in Count VII, they asserted a willful violation.
a. Negligent Violation
In Count VIII, the Plaintiffs asserted a claim for negligent breach of the FCRA; Title 15 U.S.C. § 1681o establishes liability for negligent violation for "any actual damages sustained . . . as a result of the failure." The statute does not impose liability for a negligent breach as to those who have not sustained actual damages.
This court has already determined, in its Article III case or controversy standing analysis, that only the following ten Named Plaintiffs have alleged actual harm traceable to the data breach: 1. Kathy Ellzey (Ellzey/McNutt II cases); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Melissa Cooper (Lawson/McNutt II case); 6. Johannes Nhete (Alverson case); 7. John Sanchez (Ellzey case); 8. William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case); and 10. Tara June Moore (Ellzey case). The court FINDS that the FCRA confers legal rights on these same ten Named Plaintiffs to sue for negligent violation of the FCRA, and that they have alleged a concrete, particularized, and personal injury as a result of the violation of their own individual rights created by the FCRA, and not merely collective harm. Thus, the court FINDS that these Plaintiffs have standing to assert the claim in Count VIII. Further, they have alleged harm that is actual or imminent, not conjectural or hypothetical, and they have alleged a causal connection between the injury and Defendant's conduct.
The court WILL DENY PSC's motion to dismiss pursuant to Rule 12(b)(1) as to the FCRA negligence claims of those ten Named Plaintiffs. The court further FINDS that the FCRA does not confer on the other Plaintiffs legal rights for a negligent violation in the absence of actual injury; the court WILL DISMISS WITHOUT PREJUDICE the claim in Count VIII asserted against PSC by all Named Plaintiffs except the ten listed above.
As to CHSI's Rule 12(b)(1) motion to dismiss the claim in Count VIII, the court WILL DENY the motion as to the claims of the Named Plaintiffs listed in the preceding paragraph who filed their claims in Tennessee: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (McNutt II case); 4. Ashley Veciana (McNutt II case); 5. Melissa Cooper (McNutt II case); 6. John Sanchez (Ellzey case); 7. William Lutz (McNutt II case); and 8. Tara June Moore (Ellzey case). The court WILL GRANT CHSI's Rule 12(b)(1) motion as to all claims in Count VIII remaining against CHSI after the Rule 12(b)(2) ruling that were brought by Named Plaintiffs other than the eight listed in this paragraph; the court WILL DISMISS such claims WITHOUT PREJUDICE.
b. Willful Breach
The FCRA treats willful violations differently from negligent violations. In Count VII, the Plaintiffs assert a claim for willful breach of the FCRA. Title 15 U.S.C. § 1681n provides for liability to the consumer "in an amount equal to the sum of . . . any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000 . . . ." 15 U.S.C. § 1681n (emphasis added). Put another way, the FCRA provides for liability for a willful breach even absent actual damages, and the question before this court is whether the allegations of those Plaintiffs who alleged a willful FCRA violation without resulting actual damage have Article III standing to present that FCRA claim.
In Spokeo, the Supreme Court answered one of the issues raised here by stating that Article III standing does require a concrete injury in the context of a statutory violation; allegations of fact that, if true, show a defendant willfully violated the FCRA do not alone meet the injury-in-fact standing requirement. Therefore, this court cannot end the standing inquiry by automatically accepting a bald allegation of a willful FCRA injury as injury-in-fact, but must determine whether the injury meets the requirements of particularization and concreteness, as well as the requirement that it be "actual or imminent, not conjectural or hypothetical." See Spokeo, 136 S. Ct. at 1548 (quoting Lujan, 504 U.S. at 560). To satisfy the demands of Article III standing, then, a plaintiff bringing claims under a federal statute such as the FCRA must allege facts showing that he suffered concrete and particularized harm from the statute's violation, and that the harm was actual or imminent.
In the instant case, the particularization requirement is not a difficult one: a particularized injury "'must affect the plaintiff in a personal and individual way.'" Spokeo, 136 S. Ct. at 1548. Plaintiffs have alleged that the Defendant violated each of their statutory rights by allowing thieves to steal their data, and each of their interests in keeping their data private is individualized rather than collective. The court FINDS that they have alleged a particularized injury.
As to the separate concreteness requirement, the Supreme Court elaborated as follows:
A "concrete" injury must be "de facto"; that is, it must actually exist. When we have
used the adjective "concrete," we have meant to convey the usual meaning of the term—"real," and not abstract." Concreteness, therefore, is quite different from particularization. "Concrete" is not, however, necessarily synonymous with "tangible." Although tangible injuries are perhaps easier to recognize, we have confirmed in many of our previous cases that intangible injuries can nevertheless be concrete.Spokeo, 136 S. Ct. at 1548-49 (internal citations omitted). The Supreme Court also noted that the risk of real harm can sometimes satisfy the requirement of concreteness, citing its Clapper decision. Id. at 1549.
This court has previously found that the ten Named Plaintiffs who alleged facts showing that the subsequent misuse of their personal data corresponded to the type of data stolen had indeed alleged a loss that was "concrete" and "actual"; the court found that those Plaintiffs had alleged a loss that was not conjectural or hypothetical. Accordingly, the court WILL DENY PSC's motion to dismiss pursuant to Rule 12(b)(1) as to the claims in the Consolidated Amended Complaint for willful violation of the FRCA set out in Count VII asserted by the following Named Plaintiffs: 1. Kathy Ellzey (Ellzey/McNutt II cases); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Melissa Cooper (Lawson/McNutt II case); 6. Johannes Nhete (Alverson case); 7. John Sanchez (Ellzey case); 8. William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case); and 10. Tara June Moore (Ellzey case). This court has also found that "for the Plaintiffs in the instant case who did not have allegations of misuse accompanying their claims of an increased risk of harm . . . the alleged injuries are 'conjectural and hypothetical' and are not 'concrete,' nor are they 'actual and imminent.'" Accordingly, for all but the ten Plaintiffs listed in this paragraph, injury-in-fact does not exist for their claim in Count VII for a willful violation of the FCRA; the court WILL GRANT PSC's motion to dismiss their claims in Count VII.
As to CHSI's Rule 12(b)(1) motion to dismiss the claim in Count VII, the court WILL DENY the motion as to the claims of the eight Named Plaintiffs listed in the preceding paragraph who filed their claims in Tennessee: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (McNutt II case); 4. Ashley Veciana (McNutt II case); 5. Melissa Cooper (McNutt II case); 6. John Sanchez (Ellzey case); 7. William Lutz (McNutt II case); and 8. Tara June Moore (Ellzey case). The court WILL GRANT CHSI's Rule 12(b)(1) motion as to all claims in Count VII remaining against CHSI after the Rule 12(b)(2) ruling that were brought by Named Plaintiffs other than the eight listed in this paragraph; the court WILL DISMISS such claims WITHOUT PREJUDICE.
The court recognizes that these Rule 12(b)(1) rulings on the claims in Count VII differ from its rulings at the April hearing, which occurred before the Supreme Court's guidance in Spokeo.
At the April hearing, the court ruled that 15 U.S.C. § 1681n confers Article III standing for all of the Plaintiffs as to the willful violation of the FCRA, relying on Palm Beach Golf Center v. John G. Sarris, DDS, PA, 781 F.3d 1245 (11th Cir. 2015).
2. State Statutory Claims
In their brief addressing standing under the state statutory claims, the Plaintiffs stated: "Assuming the Court's continued application of its previous ruling that Plaintiffs who have not alleged 'misuse of the stolen data,' id. at 5, have not suffered Article III injury-in-fact for purposes of their common-law claims, Plaintiffs agree that there is no independent statutory basis for jurisdiction over the state statutory claims of any Named Plaintiff whose state common-law claims were dismissed on standing grounds." (Doc. 129, at 4). Perhaps Plaintiffs recognized that, on this issue, the Supreme Court has spoken: "[T]he fact that a State thinks a private party should have standing to seek relief for a generalized grievance cannot override our settled law to the contrary . . . . States cannot alter that [limited] role simply by issuing to private parties who otherwise lack standing a ticket to the federal courthouse." Hollingsworth v. Perry, ___ U.S. ___, 133 S. Ct. 2652, 2667 (2013); see also Ross v. AXA Equitable Life Ins. Co., 115 F. Supp. 3d 424, 434 (S.D.N.Y. 2015) ["And the Court is not aware of (and Plaintiffs do not cite) any authority suggesting that a state legislature can confer Article III standing upon a plaintiff who suffers no concrete harm merely by authorizing a private right of action based on a bare violation of a state statute."] (emphasis in original).
Accordingly, the court FINDS that the state statutes under which Plaintiffs bring claims do not provide a separate basis for Article III standing. The court further FINDS that only the following ten Named Plaintiffs who have Article III case or controversy standing may also pursue any state statutory claims, and that the only potentially relevant states as to the state statutory claims are listed below next to each name: 1. Kathy Ellzey (Ellzey case: Alabama); 2. Lynda Matus (Ellzey case: Alabama); 3. Dallas Richard (Alverson/McNutt II cases: Alabama); 4. Ashley Veciana (Veciana/McNutt II cases: Florida); 5. Melissa Cooper (Lawson/McNutt II cases: Mississippi); 6. Johannes Nhete (Alverson case: potentially relevant states are Nebraska, his state of residence; Virginia, the state of treatment; and Ohio, the state of one alleged injury); 7. John Sanchez (Ellzey case: New Mexico); 8. William Lutz (Lutz/McNutt II cases: Pennsylvania); 9. Christopher Brown (Alverson case: the potentially relevant states are Tennessee, the state of his residence and where he received some treatment; and Texas, where he also received treatment); and 10. Tara June Moore (Ellzey case: Tennessee).
To the extent that the Consolidated Amended Complaint contains any ambiguity about the states where the Plaintiffs received treatment, the briefing confirms the parties' agreement that Dallas Richard, Melissa Cooper, and Tara June Moore received treatment from CHS-affiliated facilities during the relevant period in their own states of residence, which are Alabama for Mr. Richard, Mississippi for Ms. Cooper, and Tennessee for Ms. Moore; and that Christopher Brown claimed to have received treatment during the relevant period from such facilities both in his home state of Tennessee as well as in Texas. See Doc. 103, at 13 n.1.
The court notes that two of the Named Plaintiffs with standing, Johannes Nhete and Christopher Brown, implicate more than one state whose statutory laws may apply, because they received treatment and/or injury in a state different than their state of residence. The parties did not address choice of law for state statutes in their briefs. As to Plaintiffs Nhete and Brown, the court does not make a determination at this time as to which of the states' statutes listed above apply or whether those Plaintiffs may bring statutory claims based on multiple states' statutes, but instead considers all possibilities in examining the state law claims.
In Count IX (asserting a violation of state consumer laws for unfair or deceptive trade practices) and Count X (asserting a violation of state data breach notification statutes), the Plaintiffs do not list or specifically refer to any state statutes of Alabama or Mississippi. The Consolidated Amended Complaint as supplemented does not contain any facts indicating that Named Plaintiffs Ellzey, Matus, Richard, and Cooper have any meaningful connection with states other than Alabama or Mississippi that would provide them standing to sue under those state statutes listed in the pleading; thus, the facts fail to establish a concrete, particularized, and personal injury to these Plaintiffs as a result of the alleged violation of statutes of other states. See Palm Beach, 781 F.3d at 1251. Therefore, the court FINDS that Named Plaintiffs Ellzey, Matus, Richard, and Cooper have no standing to assert claims based on violations of statutes in states with which they have alleged no connection. The court WILL DISMISS the state statutory claims of Named Plaintiffs Ellzey, Matus, Richard, and Cooper.
To the extent that the Plaintiffs attempted or intended to assert claims in Counts IX and X that Defendants violated any statutes under Alabama and Mississippi statutes, the court FINDS that they have failed to do so. To the extent that the Plaintiffs attempted or intended to assert any non-statutory common law claims in Counts IX and X, or to assert any state statutory claims not listed in ¶ 214 of Count IX or in ¶ 226 of Count X, the court FINDS that they have failed to do so.
Thus, the court FINDS that the only possible state statutes under which remaining claims arise are the following asserted in Counts IX and X:
Count IX
• (¶ 214c) the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq.;
• (¶ 214h) the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et seq.;
• (¶ 214 j) the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
• (¶ 214k) the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.;
• (¶ 214 n) the Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
• (¶ 214o) the Texas Deceptive Trade Practices Consumer Protection Act, V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7).
Count X
• (¶ 226h) Tenn. Code Ann. § 47-18-2107(b), et seq.;
• (¶ 226i) Va. Code Ann. § 18.2-186.6(B), et seq.
In light of this court's rulings above on standing for the state statutory claims and the relevant remaining statutes, the court FINDS that it has subject matter jurisdiction over the following state statutory claims asserted against PSC:
1. The claim in Count IX asserted by Ashley Veciana (Veciana/McNutt II cases) alleging a violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
2. The claims asserted by Johannes Nhete (Alverson case) in Count IX alleging violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.; and in Count X alleging violations of Va. Code Ann. § 18.2-186.6(B), et seq.;The court WILL DENY PSC's Rule 12(b)(1) motion to dismiss as to those six claims listed above in this paragraph and asserted against PSC. As to all other state statutory claims asserted against PSC, the court WILL GRANT PSC's Rule 12(b)(1) motion; the court WILL DISMISS such claims WITHOUT PREJUDICE.
3. The claim asserted by John Sanchez (Ellzey case) in Count IX alleging a violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. § § 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
4. The claim asserted by William Lutz (Lutz/McNutt II cases) in Count IX alleging a violation of the Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. § § 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
5. The claims asserted by Christopher Brown (Alverson case) in Count IX alleging a violation of the Texas Deceptive Trade Practices Consumer Protection Act, V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7); and in Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.; and
6. The claim asserted by Tara June Moore (Ellzey case) in Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
Further, the court FINDS that it has subject matter jurisdiction over the following state statutory claims asserted against CHSI:
1. The claim in Count IX asserted by Ashley Veciana (McNutt II case) alleging a violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et. seq;The court WILL DENY CHSI's Rule 12(b)(1) motion to dismiss as to the four claims listed above in this paragraph and asserted against CHSI. As to all other state statutory claims asserted against CHSI that remain after the court's Rule 12(b)(2) rulings, the court WILL GRANT CHSI's Rule 12(b)(1) motion; the court WILL DISMISS such claims WITHOUT PREJUDICE.
2. The claim asserted by John Sanchez (Ellzey case) in Count IX alleging a violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. § § 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
3. The claim asserted by William Lutz (McNutt II case) in Count IX alleging a violation of Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. § § 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.; and
4. The claim asserted by Tara June Moore (Ellzey case) in Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
The court notes, as before, that the dismissal of the claims without prejudice pursuant to Rule 12(b)(1) is not an invitation to re-plead, but is simply a recognition that this dismissal is based on lack of subject matter jurisdiction.
III. Rule 12(b)(6) Motion
At the hearing on April 15, 2016, the court next addressed the motions to dismiss the remaining claims pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. As the Supreme Court has explained, "[t]o survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting and explaining its decision in Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). To be plausible on its face, the claim must contain enough facts to "allow[ ] the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Iqbal, 556 U.S. at 678.
The Supreme Court has identified "two working principles" for the district court to use in applying the facial plausibility standard for motions to dismiss. The first principle is that the court must assume the veracity of well-pleaded factual allegations; however, the court does not have to accept legal conclusions as true even when "couched as [] factual allegation[s]" or "threadbare recitals of the elements of a cause of action, supported by mere conclusory statements." Iqbal, 556 U.S. at 678-79. The second principle is that "only a complaint that states a plausible claim for relief survives a motion to dismiss." Id.
Thus, under prong one, the court determines which factual allegations are well-pleaded and assumes their veracity, and then proceeds, under prong two, to determine the claim's plausibility given the well-pleaded facts. That task is "context-specific" and, to survive the motion, the allegations must permit the court based on its "judicial experience and common sense . . . to infer more than the mere possibility of misconduct." Iqbal, 556 U.S. at 679. If the court determines that well-pleaded facts, accepted as true, do not state a claim that is plausible, the court must dismiss the claim.
In a motion brought pursuant to Rule 12(b)(6), the movant bears the burden of showing that the complaint should be dismissed for failure to state a claim upon which relief may be granted. E.g., Beck v. Deloitte & Touche, 144 F.3d 732, 734-35 (11th Cir. 1998) (placing the burden on defendant to prove that a complaint should be dismissed); Cont'l Motors, Inc. v. Jewell Aircraft, Inc., 882 F. Supp. 2d 1296, 1302 n. 26 (S.D. Ala. 2012) (stating that the Rule 12(b)(6) movant bears the burden). "Rule 12(b)(6) is a low threshold for a plaintiff to overcome. [A district court] cannot . . . dismiss a claim merely because recovery on the merits at trial appears doubtful or dubious." Cont'l Motors, 882 F. Supp. 2d at 1302 (citing Speaker v. U.S. Dep't of Health & Human Servs. Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1380 (11th Cir. 2010) (stating that "a well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof of these facts is improbable, and that a recovery is very remote and unlikely") (citation omitted)).
A. Federal Claims under the FCRA: Counts VII (Willful) and VIII (Negligent)
In Counts VII and VIII, the Plaintiffs asserted that Defendants' disclosure of their confidential patient data constituted a willful or negligent violation of the Fair Credit Reporting Act. The FCRA requires every "consumer reporting agency" to "maintain reasonable procedures" to ensure that the agency does not "furnish[ ] . . . consumer reports" to unauthorized third parties or for impermissible purposes. 15 U.S.C. § 1681e(a).
To state a claim that the requirement of maintaining reasonable procedures applies to Defendants, the Consolidated Amended Complaint must properly plead that Defendants are consumer reporting agencies. Defendants argued that they are not consumer reporting agencies within the FCRA's definition of that term, that they do not furnish consumer reports within the FCRA's definition of that term, and that the Plaintiffs have not properly pleaded these elements. Thus, the resolution of this issue hinges on whether the Defendants fall within the FCRA's definition of "consumer reporting agency" and whether Defendants' reports fall within the FCRA's definition of "consumer reports."
The definition of "consumer reporting agency" states in relevant part:
any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties . . . .15 U.S.C § 1681a(f).
The definition of "consumer reports" in the FCRA is, in relevant part, as follows:
(d) Consumer report.
(1) In general.
The term "consumer report" means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or
expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for —15 U.S.C. § 1681a.
(A) credit or insurance to be used primarily for personal, family, or household purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 1681b of this title.
(2) Exclusions.
Except as provided in paragraph (3), the term "consumer report" does not include—
(A) subject to section 1681s-3 of this title, any —
(i) report containing information solely as to transactions or experiences between the consumer and the person making the report;
Therefore, to be subject to the FCRA, the Defendants must be credit reporting agencies - they must regularly engage in assembling or evaluating consumer information for the purpose of furnishing consumer reports to third parties; they must receive payment for providing the report(s); and the report(s) cannot contain information solely as to the transactions between the Defendants and the consumers who are the subject of the report(s).
This court FINDS that ¶ 194 in the Consolidated Amended Complaint is merely a formulaic recitation of the elements under the FCRA and does not constitute well-pleaded facts. See Simpson v. Sanderson Farms, 744 F.3d 702, 708 (11th Cir. 2014) (quoting Iqbal, 556 U.S. at 678 ("'Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.'")). Ignoring the conclusory language and formulaic recitations in ¶ 194 of the Consolidated Amended Complaint and elsewhere, and considering only the well-pleaded facts, the court FINDS that neither Defendant is a consumer reporting agency as defined by the FCRA: the well-pleaded facts reflect that the fees collected were for healthcare services, not for assembling or evaluating information on consumers; and further, the well-pleaded facts reflect that the information Defendants provided to third parties was not a credit report as defined and subject to exclusion (A)(i). Accordingly, the court FINDS that the Plaintiffs fail to state plausible FCRA claims against Defendants.
Therefore, the court WILL GRANT the Rule 12(b)(6) motions as to ALL Plaintiffs' FCRA claims in Counts VII and VIII that remained against both PSC and CHSI after the court's Rule 12(b)(1) and (2) rulings. The court WILL DISMISS Count VII and Count VIII from the Consolidated Amended Complaint as to all remaining Plaintiffs. This ruling operates as an alternative finding as to FCRA claims over which the court previously found it had no subject matter jurisdiction; to the extent that the court has jurisdiction over those claims, they are subject to dismissal pursuant to Rule 12(b)(6) for failure to state a plausible claim.
B. State Common Law Claims
Contrary to the lawyers' arguments in the briefs, choice of laws issues matter in this MDL. Because the Plaintiffs have invoked diversity jurisdiction pursuant to 28 U.S.C. § 1332(d)(2) and are asserting state law claims, the court must apply the common law from various states and from multiple transferor jurisdictions. The due process rights of the individual Plaintiffs are at stake. The court must determine which states' laws are in play based on the choice of law rules of the transferor courts so it may identify which law governs and whether the various state laws conflict. See Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 821-23 (1985) (explaining that the parties in a nationwide class action have a due process right to have the applicable state law govern their disputes: the "constitutional limitations on choice of law . . . [are] not altered by the fact that it may be more difficult or burdensome to comply . . . because of the large number of transactions which the [trial court] proposes to adjudicate and which have little connection with the forum.").
To determine which state common law applies to which Plaintiff's claims, the court must first consider the choice-of-law rules each transferor court would use. "In federal multidistrict proceedings, the transferee court applies the substantive law of the transferor courts." In re Silicone Gel Breast Implants Prods. Liab. Litig., 887 F. Supp. 1455, 1457 (N.D. Ala. 1995); MULTI-DISTRICT LITIG. MANUAL, FOURTH § 9:18 (2014) (In the section entitled "Choice of law in the transferee court," the manual states: "The Panel has recognized that the transferee court will be obligated to apply the law the transferor forum would apply," and the manual proceeds to focus on the In re Korean Air Lines case.). The parties provided the court with very little guidance as to this complex issue.
1. Count I (Breach of Contract); Count II (Breach of Implied Contract) and Count III (Unjust Enrichment)
Without much assistance from the parties, the court used choice of law rules of the transferor jurisdictions of Florida, Mississippi, Pennsylvania, and Tennessee, as well as Alabama where this court sits, for the remaining non-statutory claims to determine which states' laws were relevant. As a result, the court examined the common law regarding unjust enrichment and breach of contract—express and implied—from the states of Alabama, Florida, Mississippi, New Mexico, Pennsylvania, Tennessee, Texas, and Virginia.
Alabama was the jurisdiction where the claims of Christopher Brown (Alverson case), Dallas Richard (Alverson case), and Johannes Nhete (Alverson case) were first filed; Florida was the jurisdiction where the claims of Ashley Veciana were first filed and transferred (Veciana case); Mississippi was the jurisdiction where the claims of Melissa Cooper were first filed and transferred (Lawson case); Pennsylvania was the jurisdiction where the claims of William Lutz were first filed and transferred; and Tennessee was the transferor jurisdiction for the claims of Kathy Ellzey, Lynda Matus, John Sanchez and Tara June Moore in the Ellzey case with Richard, Veciana, Cooper and Lutz listed as Named Plaintiffs in the later-filed McNutt II case. The court has previously determined in this Memorandum Opinion that it does not have jurisdiction over the non-statutory claims asserted in cases from the other transferor jurisdictions (New Mexico, Ohio, Washington and West Virginia).
The court FINDS that the remaining Named Plaintiffs' allegations meet the bare minimum standards for asserting these claims in those states. See, e.g., Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012) (applying Florida law and reversing the trial court's dismissal for failure to state a claim on breach of contract, breach of implied contract and unjust enrichment, among others); Givens v. Mullikin, 75 S.W. 3d 383, 407-08 (Tenn. 2002) (recognizing that, under Tennessee law, an implied covenant of confidentiality of medical records can arise from the original contract of patient treatment); see generally Kennedy v. Boles Invs., Inc., 53 So. 3d 60, 74 (Ala. 2010) ("The law generally allows for the recovery of all damages, including incidental and consequential, caused by the breach of contract or the commission of a tort." (internal quotation and citation omitted)); Aetna Cas. & Sur. Co. v. Doleac Elec. Co., Inc., 471 So. 2d 325, 330 (Miss. 1985) (stating that a plaintiff in a breach of contract action "is entitled to recover any damages directly attributable to the defendant's breach.").
In the breach of contract claims, the Plaintiffs alleged that Defendants breached their contractual promises to comply with the requirements of HIPAA and to act reasonably to protect Plaintiffs' confidential patient data, and that their breach resulted in harm to the Plaintiffs. As to those claims, the court acknowledges the Defendants' argument that the Plaintiffs have not adequately alleged the element of causation for these breach of contract and other claims: the mere fact that misuse occurred after the data breach, standing alone, does not establish a sufficient nexus between the breach and misuse. See, e.g., Resnick, 693 F.3d at 1326-27 ("Generally, to prove that a data breach caused identity theft, the pleadings must include allegations of a nexus between the two instances beyond allegations of time and sequence . . . . Had Plaintiffs alleged fewer facts [about the substantial precautions they took to protect against data theft], we doubt whether the Complaint could have survived a motion to dismiss.").
The court further acknowledges that all Named Plaintiffs, except Ms. Ellzey and Mr. Lutz, who re-pleaded after briefing, failed to allege a lack of history of misuse of their data and/or to state that they took precautions prior to the data breach to protect themselves from identity theft. Such allegations would render more likely a nexus between the misuse and the data breach in question.
The court agrees that the alleged facts supporting causation are indeed thin. However, the claims of the remaining Named Plaintiffs recite allegations about misuse occurring subsequent to the breach that would be consistent with the type of data stolen. The court FINDS that, while this decision on the sufficiency of the pleading of causation in Counts I and II is a very close one, the remaining Named Plaintiffs have sufficiently alleged a nexus between the data theft and the identity theft, and they have stated plausible claims in Counts I and II under the laws of Alabama, Florida, Mississippi, New Mexico, Pennsylvania, Tennessee, Texas, and Virginia. The court WILL DENY the motions to dismiss pursuant to Rule 12(b)(6) regarding the remaining Named Plaintiffs' claims asserted in Counts I and II.
See Resnick, 693 F.3d at 1326-27 (applying Fla. law on the elements of a breach of contract claim); Brooks v. Franklin Primary Health Ctr., Inc., 53 So. 3d 932, 935-36 (Ala. Ct. Civ. App. 2010) (listing elements of a breach of contract claim, including "resulting damages"); Favre Prop. Mgmt., LLC v. Cinque Bambini, 863 So. 2d 1037, 1044 (Miss. Ct. App. 2004) (listing elements of a breach of contract claim); Shaeffer v. Kelton, 619 P. 2d 1226, 1230-31 (N.M. 1980) (discussing requirements of a breach of contract action under the law of New Mexico, including "damages naturally flowing from the breach"); CoreStates Bank v. Cutillo, 723 A.2d 1053, 1058 (Pa. Super. 1999) (listing elements for breach of contract that must be in a pleading); Ingram v. Cendant Mobility Fin. Corp., 215 S.W. 3d 367, 374 (Tenn. Ct. App. 2006) (discussing the essential elements of a breach of contract claim); Velvet Snout, LLC v. Sharp, 441 S.W. 3d 448, 451 (Tex. Ct. App. 2014) (listing elements of a breach of contract claims); Squire v. Va. Housing Dev. Auth., 758 S.E. 2d 55, 60 (Va. 2014) (listing elements of a breach of contract action). For breach of implied contract, see: Ellis v. City of Birmingham, 576 So. 2d 156, 157 (Ala. 1991) ("A contract implied in fact requires the same elements as an express contract, and differs only in the method of expressing mutual assent."); Baron v. Osman, 39 So. 3d 449, 451 (Fla. Dist. Ct. App. 2010) (stating that "[t]he only distinction between an express and implied-in-fact contract is the manner in which the parties' assent is manifested or proven"); Franklin v. Franklin ex. rel. Phillips, 858 So. 2d 110, 120 (Miss. 2003); Orion Tech. Res., LLC v. Los Alamos Nat'l Sec., LLC, 287 P. 3d 967, 971 (N.M. Ct. App. 2012) (interior quotations omitted) ("The distinction between an express and implied contract involves no difference in legal effect, but lies merely in the mode of manifesting assent."); Elias v. Elias, 237 A. 2d 215, 217 (Pa. 1968); River Park Hosp., Inc. v. Blue Cross Blue Shield of Tenn., Inc., 173 S.W. 3d 43, 57 (Tenn. Ct. App. 2002) (explaining the difference in contracts implied in fact, which result from a meeting of the minds of the parties, and contracts implied in law, which do not have the assent of the parties bound, and are "discussed in terms of unjust enrichment, quasi contract and justice"); Mann Frankfort Stein & Lipp Advisors, Inc. v. Fielding, 289 S.W. 3d 844, 850 (Tex. 2009) (explaining that the difference between express and implied contracts is the mode of expressing assent); Nossen v. Hoy, 750 F. Supp. 740, 744 (E.D. Va. 1990) (applying the laws of Virginia. and Washington and explaining the distinction between implied-in-fact contracts and quasi-contracts).
As an alternative ruling to the dismissals based on the lack of the "fairly traceable" element on standing, discussed above, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson, Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah, may have met the "fairly traceable" element of standing, they have not sufficiently alleged a nexus between the data theft and the identity theft because the type of misuse occurring subsequent to the breach is inconsistent with the type of data stolen; their claims fail to state a claim under their respective state's law for breach of contract. Therefore, the motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the claims in Counts I and II of the Consolidated Amended Complaint on that alternative ground as to Named Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.
In the unjust enrichment claim, which is an alternative claims to the breach of contract claims, the Plaintiffs alleged that the Defendants received payment from Plaintiffs that encompassed services for protecting Plaintiffs' confidential patient data, and that Defendants' retention of the benefits of those payments was unjust in light of their failure to protect the data and of the subsequent data breach. As to the unjust enrichment claim, the court acknowledges PSC's dispute of fact that Plaintiffs paid local clinics but not Defendants, as Plaintiffs alleged, so Defendants could not have been unjustly enriched. However, that argument is for another stage of this litigation. PSC also cited cases from jurisdictions that are not controlling on this court and would not be controlling on the transferor courts, and this court chooses not to follow them to the extent that they are contrary to this ruling. The court FINDS that the unjust enrichment claim asserted in Count III states a plausible claim under the laws of Alabama, Florida, Mississippi, New Mexico, Pennsylvania, Tennessee, Texas, and Virginia. The court WILL DENY the motions to dismiss regarding the unjust enrichment claim of the remaining Named Plaintiffs, asserted in Count III of the Consolidated Amended Complaint.
See, e.g., Resnick, 693 F.3d at 1328-29 (reversing the district court's dismissal on the unjust enrichment claim); see generally Avis Rent a Car Inc. v. Heilman, 876 So. 2d 1111, 1123 (Ala. 2003); Fla. Power Corp. v. Winter Park, 887 So. 2d 1237, 1241 n. 4 (Fla. 2004); Willis v. Rehab Sols., PLLC, 82 So. 3d 583, 588 (Miss. 2012); City of Rio Rancho v. Amrep Southwest, Inc., 260 P. 3d 414, 428-29 (N.M. 2011) (listing elements of an unjust enrichment claim); Limbach Co., LLC v. City of Philadelphia, 905 A. 2d 567, 575 (Pa. Comm. Ct. 2006) (listing elements); Am & Foreign Ins. Co v. Jerry's Sport Ctr., Inc., 2 A. 3d 526, 545 (Pa. 2010); Freeman Indus., LLC v. Eastman Chem. Co., 172 S.W.3d 512, 525 (Tenn. 2005); Pepi Corp. v. Galliford, 254 S.W. 3d 457, 465 (Texas Ct. App. 2007) (addressing a claim for quantum meruit "[f]ounded on unjust enrichment"); Rosetta Stone Ltd. v. Google Inc., 676 F.3d 144, 165 (4th Cir. 2012) (applying Virginia law).
2. Count VI (Bailment)
In Count VI, the Plaintiffs allege that they delivered their confidential patient data to the Defendants as a bailment arrangement to receive healthcare with the understanding that Defendants would adequately safeguard it, and that the Defendants breached their obligations under the bailment arrangement when they failed to adequately protect the data from data theft. Recognizing that bailment can sound in contract or tort, depending upon the choice of law of the forum, the court examined the state law on bailment in Alabama, Florida, Mississippi, Nebraska, New Mexico, Ohio, Pennsylvania, Tennessee, Texas, and Virginia. The court FINDS that, under the law of all applicable states, the Plaintiffs have failed to allege facts that meet the definition of bailment and the elements of a bailment claim. The laws of the states at issue all generally include the concept of placing property into the exclusive possession of the bailee with the return of that property anticipated after the special purpose of the bailment is accomplished. The allegations of the Consolidated Amended Complaint do not so plead.
See Garrett v. Nelson & Affiliates, 794 F. Supp. 2d 1253, 1261 (M.D. Ala. 2011) (applying Alabama law and stating that bailment contemplates that the property be returned or reclaimed after the special purpose of the bailment is accomplished, and if it is not returned, an accounting is required); Monroe Systs. for Bus., Inc. v. Intertrans. Corp., 650 So. 2d 72, 75-76 (Fla. 1994) (defining bailment to include redelivery after the bailment purpose has been fulfilled); Hamm v. F.B. Walker & Sons, Inc., 198 So. 2d 817, 818 (Miss. 1967) (discussing bailment in terms of delivery of personal property to bailee contemplating its eventual return to the bailor); Gerdes v. Klindt, 253 Neb. 260, 570 N.W. 2d 336, 342-43 (1997) (defining bailment as requiring redelivery after the bailment purpose has been fulfilled); Fernandez v. Ford Motor Co., 879 P.2d 101, 107 (N.M. 1994) (refusing to find a bailment where the pleadings indicated that although a construction company had physical possession of the tractor-trailer, the owner of the tractor-trailer retained some control over it, so no exclusive control and no bailment existed); Tomas v. Nationwide Mut. Ins. Co., 607 N.E. 2d 944, 946 (Ohio 1992) (definition of bailment requires that the property be returned or reclaimed by the bailor after the special purpose for the bailment is accomplished, or, if the property is not returned, an accounting will occur); Lear Inc. v. Eddy, 749 A. 2d 971, 973 (Pa. 2000) (same); Jackson v. Metro. Gov't. of Nashville & Davidson Cnty., 483 S.W. 2d 92, 94-95 (Tenn. 1972) (same); Hoye v Like, 958 S.W. 2d 234, 237-38 (Tex. 1997) ("[T]he creation of a bailment requires that possession and control over an object pass from the bailor to the bailee . . . ."); Anchor Cas. Co v. Robertson Transport Co., 389 S.W. 2d 135, 138 (Tex. 1965) (damage for bailment occurs when chattel is not returned or is returned damaged because of the negligence of the bailee); K-B Corp v. Gallagher, 237 S.E. 2d 183, 185 (Va. 1977) (focusing on the bailee's having sole custody and control of physical property).
Accordingly, as to the remaining Named Plaintiffs over whose bailment claims this court has jurisdiction, the court WILL GRANT the motion to dismiss, WILL DISMISS such claims, and WILL DISMISS Count VI from the Consolidated Amended Complaint. As an alternative ruling covering those Plaintiffs over whose non-statutory claims the court found it had no jurisdiction, the court FINDS that they have failed to state a claim upon which relief can be granted, and that their bailment claim is due to be dismissed pursuant to Rule 12(b)(6).
3. Tort Claims: Count IV (Negligence), Count V (Negligence Per Se), & Count XI (Wantonness)
In addressing these tort claims based on choice of law directives of the transferor jurisdictions and Alabama, the court examined the state law for such claims in Alabama, Florida, Mississippi, Nebraska, New Mexico, Ohio, Pennsylvania, Tennessee, Texas, and Virginia.
a. Negligence
In Count IV, the Plaintiffs alleged that Defendants breached the duty to use reasonable care in safeguarding the Plaintiffs' confidential patient data, and that they were damaged when the data breach occurred and some Plaintiffs' data was misused. Defendants challenged whether the Plaintiffs adequately alleged proximate cause, arguing that the facts alleged did not sufficiently support the claim that any alleged negligence on Defendnats' part proximately caused the misuse of Plaintiffs' data. As the court acknowledged previously in this Memorandum Opinion, the facts supporting causation are indeed thin. The Plaintiffs cannot rest merely upon time and sequence that the alleged fact of misuse occurred after the data breach. See, e.g., Resnick, 693 F.3d at 1326-27 (In addressing allegations that the defendant's negligent failure to secure plaintiff's data proximately caused the identity theft, the court explained: "Generally, to prove that a data breach caused identity theft, the pleadings must include allegations of a nexus between the two instances beyond allegations of time and sequence.").
In the instant case, however, the claims of the remaining Named Plaintiffs allege misuse occurring subsequent to the breach that would be consistent with the type of data stolen. The court FINDS that, while this decision as to the sufficiency of proximate cause allegations is a very close one, the remaining Named Plaintiffs have met the pleading standards, albeit barely; the court WILL DENY the motions to dismiss as to their negligence claims under the laws of Alabama, Florida, Mississippi, Nebraska, Ohio, Pennsylvania, Tennessee, Texas, and Virginia.
Resnick, 693 F.3d at 1326-27 (applying Florida law); Martin v. Arnold, 643 So. 2d 564, 567 (Ala. 1994); Gulledge v. Shaw, 880 So. 2d 288, 292-93 (Miss. 2004); Willet v. Cnty. of Lancaster, 713 N.W.2d 483, 487 (Neb. 2006); Dawson v. Wilheit, 105 N.M. 734, 736 (N.M. Ct. App. 1987); Whiting v. Ohio Dep't of Mental Health, 750 N.E. 2d 644, 647 (Ohio Ct. App. 2001); Lux v. Gerald E. Ort Trucking, Inc., 887 A. 2d 1281, 1286 (Pa. Super. Ct. 2005); Kilpatrick v. Bryant, 868 S.W.2d 594, 598 (Tenn. 1993); Works v. Arlington Mem'l Hosp., 782 S.W.2d 309, 314 (Tex. Ct. App. 1989); McGuire v. Hodges, 639 S.E. 2d 284, 288 (Va. 2007).
As an alternative ruling to the dismissals based on the lack of the "fairly traceable" element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson, Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah, may have met the "fairly traceable" element of standing, they have not sufficiently alleged proximate cause (an element of their cause of action), because the type of misuse occurring subsequent to the negligence is inconsistent with the type of data stolen. Therefore, the motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the negligence claim in Count IV of the Consolidated Amended Complaint on that alternative ground as to Named Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.
b. Negligence Per Se
In Count V, the Plaintiffs allege that Defendants were negligent per se, asserting that the standard of care that the Defendants breached is based on the requirement to protect data that was set out in two statutes: HIPAA and § 5 of the Federal Trade Commission Act. Neither statute provides litigants with a private right of action. See, e.g., Bans Pasta, LLC v. Mirko Franchising LLC, 2014 WL 637762, at *12 (W.D. Va. Feb. 12, 2014) ("[N]either the FTC Act nor the FTC Franchise Rule give[ ] rise to a private right of action."); Sheldon v. Kettering Health Network, 40 N.E. 3d 661, 674 (Ohio Ct. App. Aug. 14, 2015) (stating that "HIPAA universally has been held not to authorize a private right of action"). Although the briefs did not discuss this claim in the FTC Act context, the Plaintiffs confirmed at the April hearing that they are traveling under not only HIPAA but also the FTC Act as defining Defendants' per se duties, and argued that the Defendants' alleged violation of both statutes supports their negligence per se claim.
The elements of the cause of action of negligence per se vary from state to state, but the elements generally include: "(1) that the statute the defendant is charged with violating was enacted to protect a class of persons to which the plaintiff belonged; (2) that the plaintiff's injury was the kind of injury contemplated by the statute; (3) that the defendant violated the statute; and (4) that the defendant's violation of the statute proximately caused the plaintiff's injury." Cook's Pest Control, Inc. v. Rebar, 28 So. 3d 716, 726 (Ala. 2009).
See Resnick, 693 F.3d at 1325 (applying Florida law); Dooley v. Byrd, 64 So. 3d 951, 960 (Miss. 2011) (listing similar elements); Archibeque v. Homrich, 543 P. 2d 820, 825 (N.M. 1975) (setting out a similar test of negligence per se); Doe v. Liberator, 478 F. Supp. 2d 742, 763 (M.D. Pa. 2007) (applying Pa. law); Whaley v. Perkins, 197 S.W. 3d 665, 672 (Tenn. 2006) (discussing the doctrine of negligence per se under Tennessee law and stating that, while not every violation of a statute creates a private negligence cause of action, the court considers two "threshold questions" in every negligence per se case: "whether the plaintiff belongs to the class of persons the statute was designed to protect and whether the plaintiff's injury is the type that the statute was designed to prevent"); Collett v. Cordovana, 772 S.E. 2d 584, 588 (Va. 2015) (listing elements). See also Webster v. Shaw, ___ N.E. 3d ___, 2016 WL 1403822, at *3 (Ohio Ct. App. Apr. 11, 2016) (internal quotations and cites omitted) ("The concept of negligence per se allows the plaintiffs to prove the first two prongs of the negligence test, duty and breach of duty, by merely showing that the defendant committed or omitted a specific act prohibited or required by statute....But the plaintiff in a negligence per se action still has to prove proximate cause and damages.").
A conflict exists among the states regarding whether a plaintiff may pursue a negligence per se claim based on an alleged violation of a federal statute that does not provide a private right of action. PSC's briefs do not address this issue, and CHSI's initial brief mentioned the issue but did not provide the court with a state-by-state analysis for all relevant states.
CHSI's initial brief in support of its motion to dismiss did cite three cases for the proposition that HIPAA and the FTC do not provide a private right of action: Sheldon v. Kettering Health Network, 40 N.E. 3d 661 (Ohio Ct. App. 2015) (HIPAA); Clark v. Nashville Gen. Hosp.,Case No. 3:14-1048, 2014 WL 2560505 (M.D. Tenn.) (Memo. Op. entered June 6, 2014 addressing a claim for violation of HIPAA, not a claim for negligence per se based on HIPAA) & 2014 WL 3722881 (Order dismissing HIPAA claims, entered July 24, 2014); and Haun v. Don Mealy Imports, Inc., 285 F. Supp. 2d 1297, 1306 (M.D. Fla. 2003) (addressing a claim for a violation of the FTC Act, not a claim for negligence per se based on that Act). But that proposition is different from finding that a statute such as HIPAA that does not create a private right of action cannot form the basis of a duty or standard of care for a negligence per se claim. Of those cases, only Sheldon addressed a negligence per se claim, as discussed subsequently in the body of this opinion.
Some of the relevant states allow a negligence per se action to proceed even where it is based on statutes that provide no private right of action. See, e.g., Allen v. Delchamps, Inc., 624 So. 2d 1065, 1067-68 (Ala. 1993) (rejecting the argument that summary judgment was due to be granted on the negligence per se claim because the FDCA provides no private right of action for damages: "However, the plaintiffs in this case are not suing directly under the F.D.C.A or its accompanying regulations. Rather, they are relying on the regulations to establish a duty or standard of care."); Harden v. Danek Med., Inc., 985 S.W. 2d 449, 452 (Tenn. 1998) (assuming violations of FDCA statute that did not provide for a private right of action could be the basis of negligence per se action but finding that summary judgment was appropriate because the violation was not the proximate cause of plaintiff's injuries).
In contrast, the laws of Florida prohibit plaintiffs from pursuing negligence per se claims based on statutes that provide no private right of action. At the April 2015 hearing, the parties and the court discussed the decision of Weinberg v. Advanced Data Processing, Inc., 147 F. Supp. 3d 1359 (S.D. Fla. Nov. 17, 2015. In that case, the Florida district court refused to allow a negligence per se action based on HIPAA to proceed: "Florida courts have refused to recognize a private right of action for negligence per se based on an alleged violation of a federal statute that does not provide for a private right of action." Id. at 1365-66 (citing Jupiter Inlet Corp. v. Brocard, 546 So. 2d 1, 2-3 (Fla. 4th Dist. Ct. App. 1998) (addressing OSHA)).
Applying choice of law rules, the court FINDS that Florida law applies to the negligence per se claim of Plaintiff Veciana, and further FINDS that the Defendants' motion to dismiss is due to be GRANTED as to Plaintiff Veciana's negligence per se claim.
The only other relevant case to which Defendants have pointed this court regarding whether a plaintiff can bring a negligence per se case using a standard of care based on a federal statute with no private right of action is Sheldon v. Kettering Health Network, 40 N.E. 3d 661 (Ohio Ct. App. 2015). In Sheldon, the Ohio Court of Appeals specifically found that "that federal regulations . . . cannot be used as a basis for negligence per se under Ohio law" and also that "utilization of HIPAA as an ordinary negligence 'standard of care' is tantamount to authorizing a prohibited private right of action for violation of HIPAA itself . . . ." 40 N.E.3d at 673. The court notes that such a holding may prevent the only remaining Plaintiff with a tie to Ohio, Johannes Nhete, from pursuing a claim for negligence per se pursuant to Ohio law with a standard of care based on a violation of HIPAA and/or the FTC Act. However, Mr. Nhete lives in Nebraska and was treated in Virginia, so under choice of law rules, his claim may be governed by the law of those states. The Defendants have cited the court to no law in Nebraska or Virginia prohibiting a claim for negligence per se using a standard of care based on a statute that does not provide a private right of action. Accordingly, the court will not dismiss Plaintiff Nhete's negligence per se claims.
The court acknowledges PSC's argument that many states do not recognize negligence per se as a claim independent from negligence. The first of the two cases PSC cited from relevant jurisdictions—Ward v. Cnty. of Cuyahoga, 721 F. Supp. 2d 677, 694 (N.D. Ohio 2010)—is inapposite. The second—Rains v. Bend of the River, 124 S.W. 3d 580, 589-591 (Tenn. Ct. App. 2003)—does recognize a claim for negligence with the standard of care set out by statute as long as other elements of the negligence cause of action are present, such as causation and "whether the plaintiff belongs to the class of persons the statute was designed to protect and whether the plaintiff's injury is of the type that the statute was designed to prevent." See also Scheele v. Rains, 874 N.W. 2d 867, 872-73 (Neb. 2016) ("This court has concluded on various occasions that the violation of a regulation or statute is not negligence per se, but may be evidence of negligence to be considered with all the other evidence in the case."); Zavala v. Trujillo, 883 S.W. 2d 242, 246 (Tex. Ct. App. - El Paso 1994) (emphasis in original, footnote omitted) (stating that "negligence per se is not a cause of action separate and independent from a common law negligence cause of action [but is] merely one method of proving, through proof of an unexcused violation of a penal statute designed to protect the class of persons to which the injured party belongs, the breach of duty required in any negligence cause of action . . . .").
The court FINDS no reason to dismiss the claim on this theory of negligence, whether it be denominated negligence per se in some states or negligence based on a standard of care set by statute in others.
As the Defendants bear the burden on these motions, the court FINDS that, except for the negligence per se claims of Named Plaintiff Veciana under Florida law, Defendants have failed to meet their burden to establish that the negligence per se claims of the other remaining Named Plaintiffs are due to be dismissed. The court WILL GRANT the motions to dismiss as to Named Plaintiff Veciana's claim of negligence per se, but WILL DENY the motions to dismiss as to the negligence per se claims of the other remaining Named Plaintiffs over whom this court has jurisdiction.
As an alternative ruling to the dismissals based on the lack of the "fairly traceable" element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson, Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah, may have met the "fairly traceable" element of standing, they have not sufficiently alleged proximate cause, an element of their cause of action, because the type of misuse occurring subsequent to the conduct forming the basis of the negligence per se claim is inconsistent with the type of data stolen. Therefore, the motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the negligence per se claim in Count V of the Consolidated Amended Complaint on that alternative ground as to Named Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.
c. Wantonness
In Count XI, the Plaintiffs allege that the Defendants' failure to protect their confidential data was wanton, and that their wanton conduct injured the Plaintiffs. PSC argued rather cursorily that "many states" do not recognize the claim of wantonness, but PSC makes no attempt to provide case law from each of the relevant states. It did provide case law from two of the ten potentially relevant states, but the gist of the argument appears to be that wantonness is a level of intent as opposed to a cause of action separate from negligence. One of those cases from a relevant jurisdiction, Ward v. Cnty. of Cuyahoga, is an opinion from the Northern District of Ohio that cites as support for its view of Ohio law one reversed case and an unreported one. 721 F. Supp. 2d 677, 694 (N.D. Ohio 2010).
One of the cases PSC cited for Tennessee law, Littlefield v. Rock-Tenn S. Container, LLC, actually is an unpublished Alabama district court decision applying Tennessee law, with a footnote acknowledging that "neither party addressed the wantonness claim separately in their briefs" and citing a reversed case and an incorrectly cited case to support its view of wantonness under Tennessee law. No. 2:12-CV-578, 2014 WL 3653911, *3 & n.3 (M.D. Ala. July 23, 2014). Another case PSC cited as support is a decision of a district court in Tennessee that was reversed on other grounds and that granted summary judgment on the wantonness claim because it "is typically a negligence inquiry, and Plaintiffs are no longer pursuing a negligence claim." Payne v. Novartis Pharm. Corp., 967 F. Supp. 2d 1223, 1228 n.3 (E.D. Tenn. 2013), rev'd 767 F.3d 526 (6th Cir. 2014). CHSI also cited the Payne case in a footnote as its only support for the perfunctory argument that wantonness is not a cause of action under Tennessee law. (Doc. 68, at 32 n.17).
This court must reiterate that Defendants, as movants, bear the burden on these motions to dismiss to show the insufficiency of the Plaintiffs' pleadings as a matter of law, and such cursory arguments—that do not cover the case law of the relevant jurisdictions and that are based in part upon decisions that are not controlling and that are less than confidence inspiring—do not meet that burden. As to the remaining Plaintiffs over whose claims for wantonness this court has jurisdiction, the court FINDS that the motions to dismiss the wantonness claims in Count XI are due to be DENIED.
As an alternative ruling to the dismissals based on the lack of the "fairly traceable" element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson, Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah, may have met the "fairly traceable" element of standing, they have not sufficiently alleged proximate cause, an element of their cause of action, because the type of misuse occurring subsequent to the conduct forming the basis of the wantonness claim is inconsistent with the type of data stolen. Therefore, the motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the wantonness claim in Count XI of the Consolidated Amended Complaint on that alternative ground as to Named Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.
4. State Statutory Claims in Counts IX and X
In Counts IX and X, Plaintiffs assert that Defendants violated certain state statutes: they allege in Count IX that Defendants violated state statutes prohibiting unfair or deceptive trade practices; and they allege in Count X that Defendants violated state data breach notification statutes. The court had previously determined that, given the rulings on jurisdiction, the only remaining state statutory claims are as follows:
1. The claim in Count IX asserted by Ashley Veciana (Veciana/McNutt II cases) against PSC and CHSI, alleging a violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
2. The claims asserted by Johannes Nhete (Alverson case) against PSC in Count IX alleging violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.; and in Count X alleging violations of Va. Code Ann. §§ 18.2-186.6(B), et seq.;
3. The claim asserted by John Sanchez (Ellzey case) against PSC and CHSI in Count IX alleging a violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
4. The claim asserted by William Lutz (Lutz/McNutt II cases) against PSC and CHSI in Count IX alleging a violation of Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
5. The claims asserted by Christopher Brown (Alverson case) against PSC in Count IX alleging a violation of the Texas Deceptive Trade Practices Consumer Protection Act, V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7); and in Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.; and
6. The claim asserted by Tara June Moore (Ellzey case) against PSC and CHSI in Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
Thus, the only state statutory claims over which this court possibly has jurisdiction are brought under statutes from Florida, Nebraska, New Mexico, Ohio, Pennsylvania, Tennessee, Texas, and Virginia. In briefing, PSC noted that "some of these statutes include no private right of action" and raised other potential problems, such as the lack of reliance. (Doc. 70, at 38-39). However, Defendants failed to provide the court with meaningful information to address each of the statutes, such as the relevant texts of the statutes and relevant case law addressing whether a private right of action exists for each statute, and the requirements of a successful suit under each of these statutes. Defendants bear the burden on these motions.
The list of these statutes is on page 38 of this Memorandum Opinion.
The court FINDS that Defendants have failed to meet their burden to establish the insufficiency of the remaining state statutory claims listed above as stated in the Consolidated Amended Complaint. Thus, as to those specific claims of the remaining Named Plaintiffs's claims over which this court has jurisdiction, the motions to dismiss are due to be DENIED. V. Remaining Claims after Rulings on Rule 12(b)(1) , 12(b)(2), and 12(b)(6) Motions
After the rulings on the Rule 12(b)(1), 12(b)(2), and 12(b)(6) motions, no federal statutory claims remain, and the remaining state law claims are listed below. The court recognizes that these Named Plaintiff purport to represent a class. The court has not yet addressed class certification, and these rulings do not foreclose potential class claims brought by the remaining Named Plaintiffs on behalf of those similarly situated.
A. Remaining Claims against CHSI
1. Non-Statutory Claims
The following non-statutory claims remain against CHSI:
a. Count I (Breach of Contract): the claims of Named Plaintiffs Kathy Ellzey, Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore;
b. Count II (Breach of Implied Contract): the claims of Named Plaintiffs Kathy Ellzey, Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore;
c. Count III (Unjust Enrichment): the claims of Named Plaintiffs Kathy Ellzey, Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore;
d. Count IV (Negligence): the claims of Named Plaintiffs Kathy Ellzey, Lynda
Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore;
e. Count V (Negligence per se): the claims of Named Plaintiffs Kathy Ellzey, Lynda Matus, Dallas Richard, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore;
f. Count XI (Wantonness): the claims of Named Plaintiffs Kathy Ellzey, Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez, William Lutz, and Tara June Moore.
2. State Statutory Claims
The following state statutory claims asserted against CHSI in Count IX of the Consolidated Amended Complaint remain:
1. The claim in Count IX asserted by Named Plaintiff Ashley Veciana (McNutt II case), alleging a violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
2. The claim asserted by Named Plaintiff John Sanchez (Ellzey case), alleging a violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.; and
3. The claim asserted by Named Plaintiff William Lutz (McNutt II case), alleging a violation of the Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.
The following state statutory claim asserted against CHSI in Count X of the Consolidated Amended Complaint remains: the claim asserted by Named Plaintiff Tara June Moore (Ellzey case) in Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
B. Remaining Claims against PSC
1. Non-Statutory Claims
The following non-statutory claims remain against PSC:
a. Count I (Breach of Contract): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
b. Count II (Breach of Implied Contract): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
c. Count III (Unjust Enrichment): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
d. Count IV (Negligence): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
e. Count V (Negligence per se): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
f. Count XI (Wantonness): the claims of Named Plaintiffs Kathy Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June Moore.
2. State Statutory Claims
The following state statutory claims asserted against PSC in Count IX of the Consolidated Amended Complaint remain:
a. The claim in Count IX asserted by Named Plaintiff Ashley Veciana (Veciana/McNutt II cases), alleging a violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
b. The claims asserted by Named Plaintiff Johannes Nhete (Alverson case), alleging violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.;
c. The claim asserted by Named Plaintiff John Sanchez (Ellzey case), alleging a violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
d. The claim asserted by Named Plaintiff William Lutz (Lutz/McNutt II cases), alleging a violation of the Pennsylvania Unfair Trade Practices and Consumer Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
e. The claims asserted by Named Plaintiff Christopher Brown (Alverson case), alleging a violation of the Texas Deceptive Trade Practices Consumer Protection Act, V.T.C.A., Bus. & C. §§ 17.46(a), (b)(5) and (7).
The following state statutory claims asserted against PSC in Count X of the Consolidated Amended Complaint remain:
a. The claim asserted by Named Plaintiff Johannes Nhete (Alverson case) in Count X, alleging violations of Va. Code Ann. § 18.2-186.6(B), et seq.;
b. The claim asserted by Named Plaintiff Christopher Brown (Alverson case) in Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.; and
c. The claim asserted by Named Plaintiff Tara June Moore (Ellzey case) in Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
The court will enter a separate Order consistent with this Memorandum Opinion. Dated this 12th day of September, 2016
/s/_________
KARON OWEN BOWDRE
CHIEF UNITED STATES DISTRICT JUDGE