Recent Standing Decision in Data Breach Context (SD Cal.)

|

Another federal court has weighed in on Article III standing in a data breach class action. In Dugas v. Starwood Hotels, plaintiff alleges that criminal hackers inflicted a series of attacks on the United States hospitality industry.  2016 WL 6523428 (S.D. Cal. Nov. 3, 2016).  Plaintiff claims the data breach affected hundreds of thousands of customers of the Starwood Hotel system.

When defendants moved to dismiss, the court focused on plaintiff’s alleged injury-in-fact for under Article III.  The court categorized the claimed injuries within four categories:

These claimed injuries can be summarized as (1) past financial costs associated with detecting and preventing identity theft or unauthorized use of credit cards; (2) future costs in terms of time, effort and money to prevent or repair identity theft or future unauthorized use of credit cards; (3) theft of personal identifying information and; (4) past loss of productivity from efforts to mitigate consequences of data theft.

The court then concluded that plaintiff lacked standing for the first three types of injuries.

First, the court held “Plaintiff merely alleges that he was ‘exposed’ to economic losses. Such indirect allegations do not demonstrate injury in fact.”

Second, the court emphasized that the theft of personal information had been relatively limited–it did not involve social security information or usernames, passwords, or emails, but rather names, addresses, billing information, and credit card numbers.  … Read more

Violations of California’s Invasion of Privacy Act Satisfy Spokeo

|

Judge Jeffrey T. Miller of the Southern DIstrict of California became the latest to hold that violations of CIPA give rise to concrete harms under the SCOTUS’s Spokeo decision.  The case is Romero v. Securus Techs., Inc., No. 16-cv-1283, 2016 WL 6157953, at *4 (S.D. Cal. Oct. 24, 2016).

CIPA prohibits unauthorized interceptions of communications in order to protect the right of privacy.  Plaintiffs in Romero allege that when they were inmates in California correctional facilities they used the defendant’s telephone system, and that the defendant recorded a number of calls between plaintiffs and their attorneys.

Defendants sought dismissal under Spokeo, arguing plaintiffs had only alleged procedural violations of CIPA, not enough to constitute concrete harm.  Judge Miller disagreed, relying heavily on a recent decision from Judge Koh in California’s Northern District:

A violation of CIPA involves much greater concrete and particularized harm than a technical violation of the Fair Credit Reporting Act (“FRCA”), the statute at issue in Spokeo. While “[a] violation of one of the FCRA’s procedural requirements may result in no harm,” such as reporting of “an incorrect zip code,” Spokeo, 136 S. Ct. at 1549, a violation of CIPA is a violation of privacy rights.

Read more

ND Cal. Refuses to Decertify Based on Spokeo, Supposed Over-Breadth of Class

|

Magistrate Judge Laurel Beeler recently examined the Supreme Court’s Spokeo decision in the context of a claim brought under the Fair Credit Reporting Act.  The decision also provides new clarity on when over-breadth is a deal-breaker for class definitions.  The case is Patel v. Trans Union, LLC, No. 14-CV-00522, 2016 WL 6143191 (N.D. Cal. Oct. 21, 2016).

In Patel, the plaintiff alleges defendants disseminated a consumer-information report that wrongly described him as a terrorist and as having a criminal record. Plaintiff further alleged that when he asked defendants for their file on him, they failed to send him his complete file.

The court had previously certified classes; defendants sought decertification under Spokeo, arguing plaintiff had not suffered “concrete” harm.  Judge Beeler disagreed as to both aspects of the plaintiff’s case.

First, regarding the inaccurate information, the court reasoned:

The court sees little difficulty in concluding that the alleged inaccuracies — being wrongly branded a potential terrorist, or wrongly ascribed a criminal record — are themselves concrete harms. This is fully in line with Spokeo’s express analysis. There, in describing cases in which the violation of a statutory right “can be sufficient…to constitute injury in fact,” the Court analogized to torts for which the law has “long permitted recovery” — picking out, specifically, the torts of “libel” and “slander per se.” Spokeo, 134 S.
Read more

Spokeo: State Legislature Can Confer Standing, Says ED Cal.

|

Judge Troy Nunley of the Eastern District of California is the latest to issue an important new opinion analyzing the Supreme Court’s Spokeo decision.   Courts around the country have grappled with Spokeo and whether various statutory violations confer Article III standing.

In Fraser v. Wal-Mart, Judge Nunley considered California’s Song-Beverly Credit Card Act of 1971; Wal-Mart allegedly violated the Act by requesting and recording its customers’ ZIP codes.  Notably, a recent decision from the District of Columbia found plaintiffs in a similar suit lacked standing. See Hancock v. Urban Outfitters, Inc., 2016 WL 3996710 (D.C. Cir. July 26, 2016).

Wal-Mart sought dismissal on a similar basis, arguing that plaintiffs had alleged only “a bare procedural violation” of the Act, which is not enough to constitute standing under Spokeo. Judge Nunley, however, wrote that “The Supreme Court explained that ‘the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact … [and] a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.’”  The court continued: “this Court finds that Plaintiffs adequately allege a procedural violation of Section 1747.08 sufficient to satisfy Article III standing requirements.”

Finally, the court noted that the Spokeo Court had also recognized that the risk of future harm can satisfy the requirement of concreteness for standing purposes.  … Read more

9th Cir: Remand (Not Dismissal) Proper If Plaintiff Lacks Standing

|

In Polo v. Innoventions International, the Ninth Circuit recently issue an opinion requiring district courts to remand, rather than dismiss, cases where the named plaintiff is deemed to lack standing.

The plaintiff had initiated the suit in California state court and alleged four class claims, including a CLRA claim. After removing the case, the defendant sought to “pick off” the named plaintiff by providing her with a full refund. The district court held that as a result, the plaintiff lacked Article III standing, granted summary judgment in defendant’s favor, and dismissed the case.

The Ninth Circuit did not address whether the district court was correct in holding that the refund deprived plaintiff of standing – though the court did drop a footnote suggesting the holding was “questionable.” (Compare Chen v. Allstate Insurance Co.). However, the Ninth Circuit did hold that “upon determining that it lacked jurisdiction, the district court should have remanded the case to state court pursuant to 28 U.S.C. § 1447(c)” rather than dismissing it. As the court explained:

the district court generally must remand the case to state court, rather than dismiss it. Bruns v. Nat’l Credit Union Admin., 122 F.3d 1251, 1257 (9th Cir.

Read more

SD FL Rejects Dismissal Attempt Under Spokeo

|

As we continue to track standing decisions following the Supreme Court’s Spokeo ruling, a new decision from the Southern District of Florida is noteworthy.

In Guarisma v. Microsoft Corporation, the plaintiff brought suit under the Fair and Accurate Credit Transactions Act (FACTA) after a Microsoft store issued him a printed receipt that bore the first six and last four digits of his credit card account number, along with his name.

Microsoft moved to dismiss on standing grounds, arguing the plaintiff did not suffer a concrete injury.  In response, plaintiff argued that Microsoft’s failure to comply with the FACTA constituted a concrete injury in and of itself.

Under Spokeo and Eleventh Circuit precedent, the court framed the question as “whether, in enacting the FACTA, Congress created a substantive right for consumers to have their personal credit card information truncated on printed receipts, or merely created a procedural requirement for credit card-using companies to follow.”  The answer:

The Court is persuaded Congress intended to create a substantive right.  Notably, other courts have found the FACTA endows consumers with a legal right to protect their credit identities, both pre- and post-Spokeo.

The FACTA’s legislative history supports the Court’s finding Congress desired to create a substantive legal right for consumers to utilize in protecting against identity theft.  

Read more

3rd Circuit Continues to Recognize “Pick-Off” Exception to Mootness

|

After the Supreme Court’s decision in Campbell-Ewald, courts around the country have been forced to reexamine not only when a plaintiff’s claims can be mooted, but also whether a defendant’s attempt to “pick off” the named plaintiff’s claim can moot the entire proposed class’s claims.

In Richardson v. Bledsoe, the Third Circuit became the most recent circuit court to hold that a defendant cannot moot class claims by picking off the named plaintiff — at least as long as the plaintiff did not unduly delay in bringing his or her motion for class certification:
.
While Campbell-Ewald, as mentioned above, does not actually address the picking off exception, we see in it some support for the principles animating the exception in the Court’s discussion of class action standing. Specifically, the Court noted that while a class does not become an independent entity until certification, “a would-be class representative with a live claim of her own must be accorded a fair opportunity to show that certification is warranted.” This statement seems to suggest a corollary: when a would-be class representative is not given a “fair opportunity” to show that certification is warranted (perhaps because her individual claim became moot before she could reasonably have been expected to file for class certification), she should be permitted to continue seeking class certification for some period of time after her claim has become moot.
Read more

SDNY: Defer Standing Until Class Certification

|

Awhile back, we wrote about the practice of named plaintiffs asserting state-law claims arising under the laws of states in which no named plaintiff resides. Our last post looked at a decision out of the Northern District of California.  More recently, a decision from the Southern District of New York has addressed the issue.

In Kaatz v. Hyland’s, 2016 WL 3676697 (S.D.N.Y. July 6, 2016), the court addressed a defense argument that the plaintiffs lacked standing to bring a putative nationwide class action under any state’s laws except their own.  The court disagreed:

Although standing is generally a threshold issue for an Article III court to determine at the outset of the case, the Supreme Court created an exception for courts to address class certification prior to standing when certification issues are logically antecedent to Article III concerns.

There is a growing consensus among district courts that class certification is logically antecedent, where its outcome will affect the Article III standing determination, and the weight of authority holds that in general class certification should come first.  In other words, when class certification is the source of the potential standing problems, class certification should precede the standing inquiry.

(Quotations and citations omitted.)

The court also noted that plaintiffs in a “consumer protection class action may assert claims under laws of states where they do not reside to preserve those claims in anticipation of eventually being joined by class members who do reside in the states for which claims have been asserted.”
 .… Read more

ND Cal. Finds Standing Allegations Sufficient Under Spokeo

|

As we continue to keep an eye on post-Spokeo standing decisions, Judge Alsup of the Northern District of California recently issued a decision on the topic in a ruling granting class certification in a Truth In Lending Act (TILA) suit.

In McLaughlin v. Wells Fargo Bank, 2016 WL 3418337 (N.D. Cal. June 22, 2016), the plaintiff alleged that Wells Fargo had breached its TILA obligation to provide her with an accurate payoff statement regarding her home mortgage.

Defendant contested certification on adequacy grounds, arguing the plaintiff lacked standing under Spokeo to pursue her claims.

Judge Alsup rejected the argument:

The bank argues that the harm alleged by plaintiff borrower is “akin to the no-harm procedural violations” detailed by the Supreme Court in Spokeo.  Not so.  In Spokeo, the Court acknowledged that not all inaccuracies cause harm or present material risk of harm. As an example, the Court explained that “[i]t is difficult to imagine how the dissemination of an incorrect zip code, without more, could work any concrete harm.” The inaccuracy here is in no way akin to an inaccurate zip code. The bank’s effort to downplay the harm done by an inaccurate payoff statement is unconvincing.
Read more

SDNY Finds Standing Well-Pleaded Post-Spokeo

|

As we’ve discussed previously, following the Supreme Court’s Spokeo decision, there is some question of how courts will analyze the “concrete” injury requirement for Article III standing.

In Boelter v. Hearst Communications, 2016 WL 3369541 (S.D.N.Y. June 17, 2016), the plaintiffs filed a class action complaint alleging violations of the Michigan Video Rental Privacy Act, among other things. Defendant sought dismissal, arguing that plaintiffs lacked standing because they had “not suffered an ‘injury-in-fact’—that is, that violation of the VRPA, as well as the other harms alleged in the amended complaint, do not constitute a particularized, concrete injury sufficient to confer standing.”

The court denied the motion to dismiss, based on allegations that

Defendant disclosed protected information about Plaintiffs in two ways: by selling it to third parties, and by providing it to “data mining” companies who then supplemented it with additional data to enhance the value of the information for Defendant.

By that conduct, the court reasoned, the defendant had

deprived Plaintiffs of their right to keep their information private, subjected them to unwanted solicitations and the risk of being victimized by “scammers,” and unjustly retained the economic benefit the value of that information conferred. Moreover, had Plaintiffs known that Defendant would disclose their information, they “would not have been willing to pay as much, if at all, for [their magazine] subscriptions.”

Accordingly, the court held plaintiffs had suffered a particularized, concrete injury-in-fact, sufficient to establish their standing to sue.  Read more