Opinion
CIVIL ACTION NO. 21-367
06-22-2021
DONALD F BROWNE, JR. ON BEHALF OF HIMSELF AND ALL OTHERS SIMILAR SITUATED v. US FERTILITY, LLC, ET AL.
McHUGH, J. MEMORANDUM
This putative class action arises out of a data breach that resulted in the theft of patient personal information ("PPI") from Shady Grove Fertility clinics in Pennsylvania, Maryland, and New Jersey. See First Am. Compl. ¶¶ 1, 3, ECF No. 8. Named Plaintiff Donald F. Browne, Jr., a New Jersey resident and former Shady Grove Fertility patient, contends that his Social Security number and other demographic information were exposed to unknown hackers following a ransomware attack in the summer of 2020. Id. ¶¶ 18, 19. Browne claims that because of the breach he was forced to expend $181.27 for the "LifeLock" service to monitor usage of his personal information by unauthorized third parties. Id. ¶ 58. He also alleges injuries in the form of an increased risk of identity theft, id. ¶ 54; the diminished value of the services he paid Defendant to provide, id. ¶¶ 59, 60; and the lost or diminished value of his PPI, id. ¶ 63.
Plaintiff argues that these injuries arose from Defendants' failure to implement adequate cybersecurity procedures and brings claims for negligence and breach of implied contract under Pennsylvania, Maryland, and New Jersey law. Defendants have moved pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) to dismiss the Amended Class Action Complaint. See Defs.' Mem. L. Supp. Mot. Dismiss 3, ECF No. 10-1. Because Plaintiff's injuries do not confer standing under binding Third Circuit precedent, I must grant Defendants' motion and dismiss this action.
Plaintiff has voluntarily consented to the dismissal of his claim under the Maryland Personal Information Protection Act. See Pl.'s Resp. Opp'n Mot. Dismiss 28, ECF No. 11.
I. Standard of Review
Slightly different standards of review apply for motions to dismiss claims pursuant to Federal Rules 12(b)(1) and (6). Within the Third Circuit, motions to dismiss under Fed. R. Civ. P. 12(b)(6) are governed by the well-established standard set forth in Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009).
To decide a motion to dismiss under 12(b)(1), "a court must first determine whether the movant presents a facial or factual attack." In re Schering Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 243 (3d Cir. 2012). A facial attack is one that "attack[s] the sufficiency of the consolidated complaint on the grounds that the pleaded facts d[id] not establish constitutional standing." In Re Horizon Healthcare Services Inc. Data Breach Litigation, 846 F.3d 625, 632 (3d Cir. 2017). A factual challenge, by contrast, contests that validity of Plaintiff's factual claims. Id. Defendants raise a facial challenge; they do not directly attack Plaintiff's pleaded facts but instead argue that none of Plaintiff's alleged harms confer standing. See Defs.' Mem. L. Supp. Mot. Dismiss 3. Considering this facial attack, I must "accept Plaintiff's well-pleaded factual allegations as true and draw all reasonable inferences from those allegations in Plaintiff's favor." In Re Horizon, 845 F.3d at 633.
II. Discussion
Article III of the Constitution limits federal courts' jurisdiction to certain "Cases" and "Controversies." At its core, "the question of standing is whether the litigant is entitled to have the court decide the merits of the dispute or of particular issues." Warth v. Seldin, 422 U.S. 490, 498 (1975). To demonstrate standing to file suit, Plaintiff must show (1) an "injury in fact" or an "invasion of a legally protected interest" that is "concrete and particularized," (2) a "causal connection between the injury and the conduct complained of," and (3) a likelihood "that the injury will be redressed by a favorable decision." Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992).
These standing requirements also apply in the class action context. "[N]amed plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent." Lewis v. Casey, 518 U.S. 343, 357 (1996) (citation and internal quotation marks omitted). "[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class." O'Shea v. Littleton, 414 U.S. 488, 494 (1974). Accordingly, Browne must have Article III standing to maintain this class action. See Neale v. Volvo Cars of North America, LLC, 794 F.3d 353, 364 (3d Cir. 2015).
A. Injury-In-Fact
Browne details four potential injuries-in-fact: 1) the expenditure of $181.27 to purchase the "LifeLock" service, First Am. Compl. ¶ 58; 2) an increased risk of identity theft, id. ¶ 54; 3) the diminished value of the services he paid Defendant to provide, id. ¶¶ 59, 60; and 4) the lost or diminished value of his PPI, id. ¶ 63. Browne notably has not alleged any actual misuse of his information and acknowledges that the risk may not be imminent. Id. ¶ 70 (stating that "[t]here is no guarantee that the stolen PPI and Master Patient Index information will be used by the miscreants in the next 12 months"). Because these injuries are either speculative or manufactured, Plaintiff's claims are precluded by the Third Circuit's precedential opinion in Reilly v. Ceridian Corp, 664 F.3d 38 (3d Cir. 2011).
First, Browne's claims of injury based on increased risk of identity theft do not confer standing under Reilly, where the Third Circuit outlined the contours of the "injury-in-fact" requirement in the data breach context. 664 F.3d at 42. As an initial matter, it is important to recognize that Plaintiff sues under the common law of Pennsylvania, Maryland, and New Jersey. Where Congress has deemed certain conduct unlawful, standing can be conferred by alleging an injury recognized by statute. For example, because the Fair Credit Reporting Act confers certain protections on consumer data, it transforms what might otherwise be viewed as intangible harms into injuries-in fact. See In Re Horizon, 846 F.3d at 639. Despite Plaintiff's repeated analogies to In re Horizon, his common law suit cannot rely upon any such Congressional judgment as the basis for claiming injury. See Gennock v. Kirkland's Inc., No. 17-454, 2017 WL 6883933, at *5 (W.D. Pa. Nov. 29, 2017) (distinguishing between Horizon and Reilly "on the basis that [Reilly] involved common law claims, whereas in Horizon the plaintiffs cited an act in which Congress elevated the unauthorized disclosure of information into a tort"). Plaintiff must therefore meet the requirements of Reilly.
Plaintiff's analogies to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") are unpersuasive, as his suit arises under common law, not HIPAA. See Pl.'s Resp. Opp'n Mot. Dismiss 22.
The Reilly plaintiffs alleged that a hacker successfully infiltrated the defendant's database and obtained the information of 27,000 employees. 664 F.3d at 40. The Third Circuit concluded that plaintiffs' allegations, which included claims of increased risk, amounted to "hypothetical future injuries" that depended on the court assuming that the "hacker (1) read, copied, and understood their personal information; (2) intend[ed] to commit future criminal acts by misusing the information; and (3) is able to use such information to the detriment of Appellants by making unauthorized transactions in Appellants' names." Id. at 42. The court further stated that, "unless and until these conjectures come true, Appellants have not suffered any injury; there has been no misuse of the information, and thus, no harm." Id.
As in Reilly, Browne's risk of identity theft and allegations regarding the value of his PPI are "dependent on entirely speculative, future actions of an unknown third-party." 664 F.3d at 42. Plaintiff has admitted this directly, pleading that "[t]here is no guarantee that the stolen PPI and Master Patient Index information will be used by the miscreants in the next 12 months." First Am. Compl. ¶ 70. Because Plaintiff has pleaded that he faces an indefinite risk of future harm, his claim cannot survive under the Reilly standard. 664 F.3d at 42. See also In Re Rutter's Inc. Data Breach Litigation, No. 20-cv-382, 2021 WL 29054, at *5 (M.D. Pa. Jan. 5, 2021) (holding that plaintiffs lacked standing where they "had not alleged actual 'misuse' of their information"). Plaintiff's claim regarding the diminished value of his PPI is similarly speculative, as he has not alleged actual or imminent misuse of his information. See Clemons v. ExecuPharm, Inc., 20-3383, 2021 WL 735728, at *4 (E.D. Pa. Feb. 25, 2021).
Similarly, Browne's expenditure of $181.27 to purchase the "LifeLock" service does not establish injury-in-fact. The Reilly court rejected the theory that plaintiffs' expenditures to safeguard their information following a data breach conferred standing. 664 F.3d at 46. It reasoned that "costs incurred to watch for a speculative chain of future events based on hypothetical future criminal acts are no more 'actual' injuries than the alleged 'increased risk of injury.'" Id. The circumstances are nearly identical here, where Browne's costs similarly consist of monitoring for criminality that has not occurred yet. Id. at 44; accord Clemens, 2021 WL 735728, at *5. Considering this controlling authority from the Court of Appeals, Plaintiff's citations to other circuits that take a far broader view of injury carry no weight.
And finally, without more, Browne may not achieve standing on the allegation that Defendants breached an implied contract or were unjustly enriched. See First Am Compl. ¶ 61. A review of the district court record in Reilly reveals that the plaintiff there also asserted breach of contract, No. 10-5142, 2011 WL 735512, at *2 (D.N.J. Feb. 22, 2011), and that this claim did not prevent the Court of Appeals from affirming dismissal for lack of standing. Courts have similarly dismissed unjust enrichment claims where the plaintiffs did not allege that their personal information was misused. See In Re Rutter's Inc. Data Breach Litigation, 2021 WL 29054, at *4-7. Moreover, even assuming a contractual undertaking by Defendants to protect the data, any damages flowing from the breach would remain problematic under Reilly. See also Clemens, 2021 WL 735728, at *5 (noting that the Third Circuit has yet to hold that a contractual breach categorically creates an Article III injury).
III. Conclusion
For the reasons set forth above, Defendants' Motion to Dismiss Plaintiff's First Amended Complaint will be granted. An appropriate order follows.
/s/ Gerald Austin McHugh
United States District Judge