Summary
granting 12(b) motion on negligence claim where plaintiff alleged only increased risk of credit card fraud and identity theft, plus credit monitoring measures
Summary of this case from Bashaw v. JohnsonOpinion
CIVIL ACTION NO. 08-1568, SECTION "N", MAGISTRATE (3).
March 24, 2009
ORDER AND REASONS
Before the Court is a Motion To Dismiss and To Strike Class Allegations (Rec. Doc. 14) filed by the Defendant, Advanced Auto Parts, Inc. ("Advanced Auto"), on June 25, 2008. Advanced Auto moves to dismiss the complaint filed against it by Plaintiffs, Belle Chase Automotive Care, Inc., Delta Tire Automotive Service, LLC, and Bonnie S. May, for failure to state a claim upon which relief can be granted, pursuant to Federal Rule of Civil Procedure 12(b)(6), and for lack of subject matter jurisdiction, pursuant to Federal Rule of Civil Procedure 12(b)(1). In the alternative, Advanced Auto moves to strike the class allegations contained in the Complaint pursuant to Federal Rules of Civil Procedure 12(f) and 23(d)(1)(D). For the following reasons, IT IS ORDERED that Advanced Auto's motion to dismiss is GRANTED.
BACKGROUND
Advanced Auto, an automotive retailer, operates in several states, including Louisiana. In March 2008, Advanced Auto announced to its customers that a security breach had occurred within its network, and that as a result, some of its customers' financial information could have been affected. Advanced Auto took several measures to notify all of its customers about the breach, including sending out a national press release on March 31, 2008. Only fourteen of Advanced Auto's 3,000+ stores, however, actually were affected by the intrusion. One of the impacted stores is located in Gretna, Louisiana.Only nine days after the release, Plaintiffs filed suit in this Court, alleging that, as evidenced by the network security breach, Advanced Auto had negligently failed to adequately protect their financial information. Plaintiffs contend that, as a result, they now have increased risk for credit card fraud and identity theft, and need protective measures for credit monitoring. Lastly, Plaintiffs allege that they have suffered non-monetary damages, including inconvenience, mental anguish, stress, anxiety, fear and emotional distress. Advanced Auto argues that Plaintiffs' claims should be dismissed.
LAW AND ANALYSIS
I. Motion to Dismiss
In considering a motion to dismiss under Rule 12(b)(6), a court accepts all well-pleaded facts as true and draws all reasonable inferences in favor of the plaintiff. Baker v. Putnal, 75 F.3d 190, 196 (5th Cir. 1996). To avoid dismissal, however, the plaintiff must plead "enough facts to state a claim to relief that is plausible on its face." Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1974 (2007); In re Katrina Canal Breaches Litig., 495 F.3d 191, 205 (5th Cir. 2007). "Factual allegations must be enough to raise a right to relief above the speculative level on the assumption that all allegations in the complaint are true (even if doubtful in fact)." Twombly, 127 S.Ct. at 1965 (quotation marks, citations, and footnote omitted).
Negligence claims in Louisiana are governed by the broad language of Louisiana Civil Code Articles 2315 and 2316. When evaluating claims for negligence asserted under these articles, Louisiana courts employ a duty-risk analysis. Hence, a plaintiff asserting a negligence claim must show (and thus allege) that: (1) the defendant had a duty to conform his or her conduct to a specific standard of care; (2) the defendant failed to conform his or her conduct to the appropriate standard; (3) the defendant's substandard conduct was the cause-in-fact of the plaintiff's injuries; (4) the defendant's substandard conduct was a legal cause of the plaintiff's injuries; and (5) actual damages. See e.g., Roberts v. Benoit, 605 So.2d 1032, 1041-46 (La. 1991); Fowler v. Roberts, 556 So.2d 1, 4-9 (La. 1989). Advanced Auto contends that Plaintiffs have failed to state an actionable claim because the mere possibility that personal information may be at increased risk does not constitute actual injury sufficient to maintain a claim of negligence under Louisiana law.
Article 2315 provides: "Every act whatever of man that causes damage to another obliges him by whose fault it happened to repair it." La. Civ. Code art. 2315. Article 2316 provides: "Every person is responsible for the damage he occasions not merely by his act, but by his negligence, his imprudence, or his want of skill."
Advanced Auto is correct that, under Louisiana law, damages must be proved with legal certainty. F.D.I.C. v. Barton, 233 F.3d 859, 864 (5th Cir. 2000) (citing Craig v. Burch, 228 So.2d 723, 731 (La.Ct.App. 1969)). Speculative damages may not be recovered. Barton, 233 F.3d at 864-65 (citing Bourdette v. Sieward, 31 So. 630 (La. 1902)). Pertinent here, a number of courts in other jurisdictions have held that an allegation of increased risk of identity theft, without more, does not amount to actual damage. See Pisciotta v. Old Nat'l Bancorp., 499 F.3d 629, 639-40 (7th Cir. 2007) ("without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy"); Kahle v. Litton Loan Servicing LP, 486 F.Supp. 2d 705, 712 (S.D. Ohio 2007) (plaintiff cannot recover when "no unauthorized use of her personal information has occurred"); Key v. DSW, Inc., 454 F.Supp. 2d 684, 690 (S.D. Ohio 2006) ("[i]n the identity theft context, courts have embraced the general rule that an alleged increase in risk of future injury is not an 'actual or imminent' injury"); Hendricks v. DSW Shoe Warehouse, Inc., 444 F.Supp. 2d 775, 781-82 (W.D. Mich. 2006) (plaintiff cannot recover for "a potential future loss which has not actually occurred"); Forbes v. Wells Fargo Bank, N.A., 420 F.Supp. 2d 1018, 1021 (D.Minn. 2006) (plaintiff cannot recover for the "perceived risk of future harm").
Additionally, three recent decisions from Louisiana federal district courts applying Louisiana law offer significant guidance. In Ponder v. Pfizer, Inc., 522 F.Supp. 2d 793, 798 (M.D. La. 2007) (Brady, J.), an employee sued his employer, Pfizer, after files containing personal information, including social security numbers, were accessed and copied from a laptop computer. At issue were the plaintiff's claims for "fear and apprehension of fraud, loss of money, and identity theft; the burden and cost of credit monitoring; the burden and cost of closing compromised credit accounts and opening new accounts; the burden of scrutinizing credit card statements and other statements for unauthorized transactions; damage to credit; loss of privacy, and other economic damages." 522 F.Supp. 2d at 795. Because the plaintiff did not allege any legally recoverable damages, that is, "that someone actually used the disclosed information to his detriment," the court found that he had not stated a viable claim. Id. at 798.
Similarly, in Melancon v. Louisiana Office of Student Financial Assistance, 567 F.Supp. 2d 873 (E.D. La. 2008) (Barbier, J.), the plaintiffs brought class action claims after the Louisiana Office of Student Financial Assistance lost some of its backup electronic media. The electronic media contained the personal information of individuals who were participating in financial assistance and scholarship programs. Id. at 874. The court found that "the mere possibility that personal information may be at increased risk does not constitute actual injury sufficient to maintain a claim for negligence under the current state of Louisiana law." Id. at 876.
Lastly, Pinero v. Jackson Hewitt Tax Service Inc., Civil Action No. 08-3535, 2009 WL 43098 (E.D. La. 1/7/09) (Vance, J.), is directly on point here. In Pinero, the plaintiff brought an action against Jackson Hewitt alleging negligence in mishandling her confidential personal information and violations of the Louisiana Database Security Breach Notification Law (LDSBNA), LA.REV.STAT. 51:3071, et seq. The court held, however, that the plaintiff did not sustain the actual damages necessary to satisfy her Louisiana law negligence claim. See Pinero, 2009 WL 43098 at *3. Specifically, Judge Vance reasoned that merely alleging an increased risk of identity theft, without further allegations of concrete financial loss arising from any negligence, is not enough to support a claim under the governing law. Id.
Without a doubt, identity theft is presently a serious problem in Louisiana and elsewhere. Indeed, in 2005, the Louisiana legislature enacted the LDSBNA, in recognition of this growing problem theft. See LA.REV.STAT. 51:3071, et seq. Nevertheless, the Court agrees that Louisiana law does not recognize a negligence cause of action based on identity theft that does not yield actual harm.
First, the LDSBNA offers little assistance to Plaintiffs' position. Under that statute, persons can recover actual damages resulting from "the failure to disclose in a timely manner . . . that there has been a breach of the security system resulting in the disclosure of a person's personal information." LA.REV.STAT. 51:3075. On the other hand, however, the statute does not provide a similar remedy for any and all negligent handling of sensitive personal information. Id. Here, Plaintiffs do not allege in their complaint that Advanced Auto failed to promptly notify its customers that a security breach had occurred thereby leaving them at a risk of identity theft. Further, § 3075 refers to "actual damages."
Nor are the cases cited by Plaintiffs persuasive in this instance. As urged by Advanced Auto in its reply memorandum, Arcilla v. Adidas Promotional Retail Operations, Inc., 488 F.Supp.2d 965, 972 (C.D. Cal. 2007), is distinguishable given that it was decided under the Fair and Accurate Credit Transactions Act of 2003 (FACTA), which is part of the broader Fair Credit Reporting Act (FCRA), and authorizes an award of statutory damages. See 15 U.S.C. § 1681c(g).
Plaintiffs' reliance on Bourgeois v. A.P. Green Industries, Inc., 716 So.2d 355 (La. 1998)) likewise is unfounded. There, the Louisiana Supreme Court held that employees who had been exposed to asbestos materials could recover the costs of medical monitoring, despite the absence of an existing actual physical injury, under Louisiana Civil Code article 2315. Even assuming that credit monitoring should be treated the same as medical monitoring responsive to significant asbestos exposure, the Louisiana legislature, in 1999, amended article 2315 in reaction to Bourgeois, to expressly exclude "costs for future medical treatment, services, surveillance, or procedures of any kind unless such treatment, services, surveillance, or procedures are directly related to a manifest physical or mental injury or disease." La. Civ. Code art. 2315. According to the Louisiana First Circuit Court of Appeal, in Motorola, Inc. v. Associated Indemnity Corp., et al, 2002-0716 (La.App. 1 Cir. 6/25/04), 878 So.2d 824, 831, another case cited by Plaintiffs, this amendment was intended to recognize and implement the legislature's original intent of not allowing for these types of claims. 878 So.2d at 833-34. Although the amendment was not applied retroactively relative to the Bourgeois plaintiffs, it is now the current law. See La. Civ. Code art. 2315.
Beyond providing information regarding Bourgeois and the 1999 amendment to article 2315, Motorola is particularly helpful. Plaintiffs refer to language therein referring to Louisiana's "generous" policy on damages. 878 So.2d at 831. The decision itself, however, is inapposite. Rather, the Motorola court simply addressed whether an insurance provision regarding "damages because of bodily injury" could be interpreted to include claims for medical monitoring. It also said nothing about abrogating Louisiana's long-standing general requirement that actionable negligence rests upon actual damages.
Applying the aforementioned principles here, the Court finds that Plaintiffs have alleged only speculative damages for which Louisiana law provides no remedy. Plaintiffs have not alleged that any third party accessed their information and stole their identities, or that any other concrete financial loss resulted from the alleged negligence. Indeed, Plaintiffs have not alleged that any individuals have actually gained access to their personal information, or that this information was used in any unauthorized manner. Finally, given the 1999 amendment to article 2315, Plaintiffs' arguments seeking an expansion of Bourgeois are without merit. Accordingly, because Plaintiffs' damages are merely speculative, their claims for negligence must be dismissed.
In further support of this conclusion, the Court notes that in negligence cases, Louisiana law generally does not allow recovery for emotional damage absent physical injury. The Louisiana Supreme Court has stated that, "if the defendant's conduct is merely negligent and causes only mental disturbance, without accompanying physical injury, illness or other physical consequences, the defendant is not liable for such emotional disturbance." Moresi v. Dept. of Wildlife and Fisheries, 567 So.2d 1081, 1095 (La. 1990). Exceptions to this rule are recognized, however, when special circumstances "serve[] as a guarantee that the claim is not spurious." Id. at 1096; see also, e.g., Graham v. Western Union, 34 So. 91 (1903) (allowing recovery for emotional damages resulting from the failure to deliver a telegraph to a mother announcing the impending death of her son); Cooper v. Christensen, 212 So.2d 154 (La.Ct.App. 1968) (allowing recovery for mental disturbance after plaintiff witnessed an automobile crashing into her residence); French v. Ochsner Clinic, 200 So.2d 371 (La.Ct.App. 1967) (allowing recovery for mental anguish resulting from an unauthorized autopsy); Grather v. Tipery Studios, Inc., 334 So.2d 758 (La.Ct.App. 1976) (allowing recovery for photographer's negligence regarding wedding photographs). Louisiana courts also permit recovery for mental distress in certain breach of contract cases, or based upon a "separate tort such as assault, battery, false imprisonment, trespass to land, nuisance, or invasion of the right to privacy." Id. at 1095. None of the recognized exceptions to the general rule discussed in Moresi are implicated in this action. Thus, even if Plaintiffs otherwise stated valid negligence claims, they cannot recover damages for their alleged emotional injuries.
II. Motion to Strike Class Allegations
Given that this Court has dismissed Plaintiffs' underlying substantive claims, Advanced Auto's alternative request that Plaintiffs' class action allegations be stricken is moot.