UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
CHANTAL ATTIAS, et al., Plaintiffs,
v. Case No. 15-cv-882 (CRC)
CAREFIRST, INC., et al., Defendants.
OPINION AND ORDER
In April 2014, hackers gained unauthorized access to the internal computer systems of health insurance company CareFirst, Inc. Plaintiffs, a group of CareFirst’s customers whose information was exposed in the breach, filed this class action lawsuit alleging claims for breach of contract and violations of the consumer protection laws of Maryland and Virginia. Post- summary judgment, only their breach-of-contract claim remains. And in its most recent opinion, the Court certified a contract class whose recovery is likely limited to nominal damages because, as the Court held in another prior opinion, mitigation expenses associated with a data breach are not considered actual damages under D.C. law.
Plaintiffs now ask the Court to permit them to pursue an interlocutory appeal to clarify whether mitigation expenses are actual damages for their breach-of-contract claim. In the alternative, Plaintiffs request reconsideration of the Court’s holding that they may not recover those expenses.
For the reasons detailed in this opinion, the Court will deny Plaintiffs’ request for immediate appeal under 28 U.S.C. § 1292(b). The Court will also deny Plaintiffs’ motion for reconsideration.
I. Background The Court presumes familiarity with its six prior opinions describing the procedural and legal background of this case, so it provides only a summary of the relevant details here. See Attias v. CareFirst, Inc. (Attias I), 199 F. Supp. 3d 193 (D.D.C. 2016); Attias v. CareFirst, Inc. (Attias II), 365 F. Supp. 3d 1 (D.D.C. 2019); Attias v. CareFirst, Inc. (Attias III), 518 F. Supp. 3d 43 (D.D.C. 2021); Attias v. CareFirst, Inc. (Attias IV), 344 F.R.D. 38 (D.D.C. 2023); Attias v. CareFirst, Inc. (Attias V), No. 15-cv-882 (CRC), 2023 WL 5952052 (D.D.C. Sept. 13, 2023); Attias v. CareFirst, Inc. (Attias VI), 346 F.R.D. 1 (D.D.C. 2024).
Plaintiffs are District of Columbia, Maryland, and Virginia residents whose health insurance was provided by Defendant CareFirst, Inc. during the time relevant to this lawsuit. Attias VI, 346 F.R.D. at 3. In April 2014, hackers infiltrated CareFirst’s computer system through an email-based spear phishing campaign and gained access to the following information from individual CareFirst customers: first and last (and sometimes middle) names, subscriber ID numbers, dates of birth, email addresses, and usernames used to log into CareFirst’s online member portal. Id. CareFirst did not learn the extent of the data breach until May 2015. Id. At that point, CareFirst sent letters to the affected customers notifying them of the breach and offering them two years of free credit monitoring and identity-theft protection through a third- party service. Id.
In June 2015, Plaintiffs brought this class action lawsuit, originally consisting of eleven claims including breach of contract, negligence, violation of D.C., Maryland, and Virginia consumer protection laws, violation of the D.C. Data Breach Notification Act, negligence per se, unjust enrichment, breach of duty of confidentiality, fraud, and constructive fraud. Attias V,
3
2023 WL 5952052, at *2. The Court initially dismissed the case for lack of standing, but the D.C. Circuit reversed in Attias v. Carefirst, Inc., 865 F.3d 620 (D.C. Cir. 2017).
On remand, the Court found that only Plaintiffs Curt and Connie Tringler had adequately alleged actual damages as required for most of Plaintiffs’ claims. Attias II, 365 F. Supp. 3d at 5– 6. So, the Court dismissed for failure to state a claim all causes of action but for the breach of contract and Maryland consumer protection claims brought by the Tringlers. Id. at 6. As relevant here, the Court held that under the D.C. Court of Appeals’ decision in Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C. 2009), “time and money spent protecting against future identity theft cannot constitute damage in their own right” for any of Plaintiffs’ claims. Attias II, 365 F. Supp. 3d at 14.
On Plaintiffs’ motion for reconsideration, the Court reinstated the breach-of-contract claim as to all Plaintiffs. Attias III, 518 F. Supp. 3d at 51–57. In doing so, the Court observed that although some D.C. Court of Appeals authority suggests that damages are required to state a contract claim, other authority holds that “‘[e]ven where monetary damages cannot be proved’ the prevailing party may be entitled to nominal damages, specific performance, or declaratory relief.” Id. at 52 (quoting Wright v. Allen, 60 A.3d 749, 753 & n.3 (D.C. 2013)). The Court also rejected Plaintiffs’ argument that intervening D.C. Circuit precedent In re: U.S. Office of Personnel Management Data Security Breach Litigation, 928 F.3d 42 (D.C. Cir. 2019) (“OPM”), had displaced its prior holding that mitigation costs are not actual damages under D.C. law. Id. at 54–55. To the contrary, OPM could not overturn D.C. Court of Appeals’ precedent holding that ““actual damages’ exclude a data-breach plaintiff’s mitigation costs absent any actual misuse of the plaintiff’s data.’” Id. at 54. The Court also revived all Plaintiffs’ Maryland and Virginia statutory claims under those states’ consumer protection laws. Id. at 55–57.
4
Next, Plaintiffs moved to certify three classes under Federal Rule of Civil Procedure 23 corresponding to their breach-of-contract claims, Maryland statutory claims, and Virginia statutory claims. See Attias IV, 344 F.R.D. at 43. The Court denied the motion for class certification because it had “serious concerns about whether common issues [would] predominate over individual inquires in this case . . . in light of the Supreme Court’s recent decision in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).” Id. at 42. The Court then moved ahead with Defendants’ summary judgment motion. In September 2023, the Court granted summary judgment to CareFirst on Plaintiffs’ two statutory claims. Attias V, 2023 WL 5952052, at *15–21.
Plaintiffs’ breach-of-contract claim, however, survived summary judgment. “Although the evidence on which Plaintiffs rely is thin,” the Court found that “a reasonable jury could conclude that CareFirst breached an implied promise to take reasonable steps to safeguard their personal information.” Id. at *1; see id. at *4–15. In so holding, the Court recognized that “recovery is almost certainly limited to nominal damages.” Id. at *15. But the Court reiterated its holding in Attias III that, under D.C. law, Plaintiffs are entitled to pursue their contract claim to recover nominal damages alone. Id. at 13.
In its most recent opinion, the Court took up Plaintiffs’ renewed motion for class certification. The Court first held that the alleged breach of contract supplied all class members with Article III standing because “the breach of a contractual obligation to perform some duty has always been understood as a concrete injury” enabling parties to bring suit “regardless of whether they have suffered actual damages as a result.” Attias VI, 346 F.R.D. at 9–10.
The Court then considered whether to certify the contract class “when nominal damages are likely the only form of recompense on the table.” Id. at 11. The Court observed that
5
“[c]ertification of classes for nominal damages is routine in the constitutional-tort sphere,” adding that the limitation to nominal damages “will streamline proceedings by dispensing with the need for individualized damage calculations.” Id. at 11–12. It further noted that notification protocols, opt-out provisions, and the creation of subclasses were available if any class member wished to pursue actual damages other than mitigation expenses. Id. at 12. Having assured itself that the nominal-damages limitation was no barrier, the Court certified the contract class. Id. at 12–13.
Now, after explicitly asking the Court to certify a contract class whose recovery is limited to nominal damages, Plaintiffs request the Court to certify for immediate appeal the question of whether mitigation expenses associated with the breach also may be recovered. Pl.’s Mot. Certify Interlocutory Appeal (“MCIA”). In the alternative, they ask the Court, for the second time, to reconsider its 2019 holding that mitigation costs are not recoverable in a breach-of- contract action under D.C. law. Id. at 13–14. Plaintiffs have also filed a Rule 23(f) motion in the D.C. Circuit, which the Circuit has held in abeyance pending this Court’s resolution of Plaintiffs’ present motions before it.
For the reasons explained in this opinion, the Court declines to permit Plaintiffs to pursue an interlocutory appeal and will also deny Plaintiffs’ motion for reconsideration. II. Legal Standards The Court may permit a party to pursue an interlocutory appeal if, in its discretion, it determines that a non-final order “[1] involves a controlling question of law [2] as to which there is substantial ground for difference of opinion and that [3] an immediate appeal from the order may materially advance the ultimate termination of the litigation.” 28 U.S.C. § 1292(b). “The party seeking interlocutory review has the burden of persuading the Court that the
6
‘circumstances justify a departure from the basic policy of postponing appellate review until after the entry of a final judgment.’” APCC Servs., Inc. v. Sprint Commc’ns Co., 297 F. Supp. 2d 90, 95 (D.D.C. 2003) (quoting In re Vitamins Antitrust Litig., No. 99–197 (TFH), 2000 WL 33142129, at *1 (D.D.C. Nov. 22, 2000)). Even after the district court “confirm[s] that the moving party has satisfied all of the elements of [S]ection 1292(b) . . . , it must also conclude that certification is appropriate as a discretionary matter.” Azima v. RAK Inv. Auth., 325 F. Supp. 3d 30, 35 (D.D.C. 2018). Interlocutory appeals are “infrequently allowed,” for the movant must demonstrate “exceptional circumstances” justifying piecemeal appeal. Graham v. Mukasey, 608 F. Supp. 2d 56, 57 (D.D.C. 2009).
Plaintiffs have moved, in the alternative, for reconsideration of the Court’s prior holding that mitigation damages are unavailable to them. Pl.’s MCIA 13–15. Under Federal Rule of Civil Procedure 54(b), any order or decision that is not a final judgment “may be revised at any time before the entry of a judgment adjudicating all the claims and all the parties’ rights and liabilities.” Courts grant motions for reconsideration of interlocutory orders only “as justice requires.” Shea v. Clinton, 850 F. Supp. 2d 153, 157 (D.D.C. 2012) (quoting Hoffman v. Dist. of Columbia, 681 F. Supp. 2d 86, 90 (D.D.C. 2010)) (internal quotation marks omitted). While courts enjoy significant discretion under Rule 54(b), “in order to promote finality, predictability and economy of judicial resources,” they generally should not revisit prior interlocutory decisions “in the absence of extraordinary circumstances such as where the initial decision was clearly erroneous and would work a manifest injustice.” Id. at 157–58 (quoting Pueschel v. Nat’l Air Traffic Controllers’ Ass’n, 606 F. Supp. 2d 82, 85 (D.D.C. 2009)) (internal quotation marks omitted). In deciding whether “justice requires” reversal of its prior interlocutory order, a court considers whether it
7
[1] “patently misunderstood a party,” [2] “has made a decision outside the adversarial issues presented to the Court by the parties,” [3] “has made an error not of reasoning but of apprehension,” or [4] whether “a controlling or significant change in the law or facts [has occurred] since the submission of the issue to the Court.”
United States v. Slough, 61 F. Supp. 3d 103, 108 (D.D.C. 2014) (alteration in original) (quoting Singh v. George Washington Univ., 383 F. Supp. 2d 99, 101 (D.D.C. 2005)). A motion for reconsideration should therefore be denied “when it merely asserts ‘arguments for reconsideration [that] the court has already rejected on the merits.’” BEG Invs., LLC v. Alberti, 85 F. Supp. 3d 54, 58 (D.D.C. 2015) (alteration in original) (quoting McLaughlin v. Holder, 864 F. Supp. 2d 134, 141 (D.D.C. 2012)). III. Analysis A. Interlocutory Appeal The Court begins by declining to certify the question of whether data-breach mitigation costs are recoverable as actual damages under D.C. law. Plaintiffs have satisfied only two of the three elements required under Section 1292(b). Even if Plaintiffs had satisfied all three elements, the Court would exercise its discretion to decline certification.
As an initial matter, CareFirst suggests that Plaintiffs have not identified which order they would like the Court to certify for interlocutory appeal. Def.’s Opp’n 6–7. Although Plaintiffs’ briefing is not a model of clarity, they request certification of the question “whether future mitigation expenses and time lost . . . are actual damages that are cognizable in a breach of contract action in the District of Columbia.” Pl.’s MCIA 15. In their reply brief, Plaintiffs suggest they are requesting certification of “every opinion this Court has issued” indicating that the class’s recovery is limited to nominal damages. Pl.’s Reply 1. From this, the Court
8
concludes that Plaintiffs request certification of the class certification order, which relies on the Court’s prior orders to hold that only nominal damages are available to the class.
With that, the Court turns to the elements of Section 1292(b). Plaintiffs have satisfied the first element: The question they seek to certify is a controlling question of law. “A question of law is an abstract legal issue or what might be called one of ‘pure’ law, matters the court of appeals can decide quickly and cleanly without having to study the record.” United States v. Honeywell Int’l Inc., No. 08-cv-0961 (PLF), 2021 WL 2493382, at *3 (D.D.C. June 18, 2021) (citation and quotation marks omitted). Whether the rule set forth in Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C. 2009), precludes recovery of Plaintiffs’ mitigation expenses presents a question of pure law that does not depend on facts specific to the record. That the Court first rendered the holding at issue to resolve CareFirst’s motion to dismiss confirms the point. Attias II, 365 F. Supp. 3d at 14–15.
And the question is controlling. It “would require reversal if decided incorrectly.”
Honeywell, 2021 WL 2493382, at *5 (citation omitted). Resolving whether mitigation expenses are available as damages would “significantly impact the action,” id. at *3 (quoting Air Transp. Ass’n v. U.S. Dep’t of Agric., 317 F. Supp. 3d 385, 394 (D.D.C. 2018)), because, as the Court has observed previously, Plaintiffs are otherwise almost certainly limited to recovering nominal damages. Attias VI, 346 F.R.D. at 11. Indeed, several judges within this district have treated issues relating to the measure of damages as controlling for certification purposes. See Honeywell, 2021 WL 2493382, at *5 (listing cases).
Second, the Court considers whether there is a “substantial ground for difference of opinion” on the disputed legal question. 28 U.S.C. § 1292(b). In doing so, the Court emphasizes that the disputed question here is whether data-breach mitigation expenses are recoverable in a
9
breach-of-contract action under D.C. law, not under the law of any other jurisdiction. And as the Court has explained in several prior opinions, the D.C. Court of Appeals has squarely held that absent actual misuse of the plaintiff’s data, mitigation expenses cannot be recovered as actual damages. Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C. 2009). Those costs are “an injury that is ‘not the result of any present injury, but rather the [result of] the anticipation of future injury that has not materialized.’” Id. (citation omitted) (alteration in original). So, such costs are not compensable.
To be sure, some courts in other jurisdictions have moved toward permitting the recovery of mitigation expenses in data-breach cases. See, e.g., Johnson v. Nice Pak Prods., Inc., No. 23- CV-01734-JMS-CSW, 2024 WL 2845928, at *4 (S.D. Ind. June 5, 2024) (holding that time and effort spent monitoring accounts after a data breach are compensable damages); Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 918 (S.D. Cal. 2020) (“In data breach cases involving negligence claims, district courts have found it sufficient to allege out-of-pocket expenses in purchasing identity theft protection services to show damages.”). But no out-of-state precedent can displace Randolph’s holding. Nor can, as the Court has said before, the D.C. Circuit’s holding in OPM. The Court reiterates: “Randolph remains binding D.C. law and continues to govern plaintiffs’ D.C. law claims.” Attias III, 518 F. Supp. 3d at 55.
Plaintiffs’ most persuasive argument is that Randolph’s rule for negligence and breach-
of-fiduciary-duty claims should not extend to breach-of-contract claims. Pl.’s MCIA 10–11. At first glance, Plaintiffs’ argument has some force. Randolph held that money spent on “credit monitoring or other security measures” is “not the result of any present injury, but rather the [result of] the anticipation of future injury that has not materialized.” 973 A.2d at 708 (citation omitted) (alteration in original). Thus, mitigation expenses alone could not satisfy the injury
10
element of the plaintiffs’ negligence or breach-of-fiduciary duty claims. Here, in contrast, the Court has already held that “the breach of a contractual obligation to perform some duty has always been understood as a concrete injury that enables the aggrieved contracting party to proceed in an American court.” Attias VI, 346 F.R.D. at 9.
Randolph holds that mitigation expenses alone may not create an injury when one does not otherwise exist. But the question here is whether a plaintiff who has already demonstrated an injury sufficient to seek nominal contract damages may also recover reasonable mitigation expenses. The Court concludes that Randolph dictates the same result regardless of whether the plaintiff relies entirely on mitigation expenses to establish his injury. Randolph made clear that mitigation expenses are not a harm attributable to the initial data breach. They stem only from the risk of future harm. By that logic, credit monitoring does not “compensate a party for the loss incurred by the other’s breach,” as all contract damages are intended to do. See Bay Gen. Indus., Inc. v. Johnson, 418 A.2d 1050, 1057 n.19 (D.C. 1980). Instead, mitigation services seek to prevent loss before it happens. Until that harm is realized, it cannot be compensated.
None of this is to say that Randolph’s holding is unassailable. Some courts have reached the same conclusion. See, e.g., Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13, 19 (2018), judgment rev’d in part, 307 Ga. 555 (2019); Doe v. Henry Ford Health Sys., 865 N.W. 2d 915, 921–22 (Mich. App. 2014). Others—a majority perhaps—have come out the other way. See, e.g., Moore v. Centrelake Med. Grp., Inc., 299 Cal. Rptr. 3d 544, 560 (2022); In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *26 (N.D. Cal. May 27, 2016). Were it writing on a blank slate and having (just barely) green lit Plaintiffs’ implied breach claim, this Court might have landed in the latter camp. The question before the Court, however, is not whether there’s a substantial ground for a difference of opinion over the wisdom
11
of Randolph’s rule. It is whether there’s a substantial ground for a difference of opinion on whether the D.C. Court of Appeals would extend Randolph to a breach of contract claim. The Court has already answered that question in the negative. See Attias II, 365 F. Supp. 3d at 14 (“there is no reason to believe the D.C. Court of Appeals would treat plaintiffs’ other D.C. law claims any differently”). And it does so again now. Accordingly, the Court finds no substantial ground for difference of opinion.
Third, certification would not “materially advance the ultimate termination of the litigation.” 28 U.S.C. § 1292(b). This long-running case dates to 2016, and “[a]ny appeal will almost certainly prolong . . . the resolution of the litigation.” Arias v. DynCorp, 856 F. Supp. 2d 46, 54 (D.D.C. 2012). And as the Court has observed elsewhere, the third factor “requires a showing that the decision below might well be reversed on appeal, as evidenced by ‘substantial ground for difference of opinion’ on the disputed legal question.” Kennedy v. D.C., 145 F. Supp. 3d 46, 52 (D.D.C. 2015) ) (Cooper, J.). As just explained, Plaintiffs have not made that showing. Moreover, a reversal would create problems of its own by implicating the same predominance concerns the Court identified previously and require the parties to return to the drawing board on class certification. See Attias IV, 344 F.R.D. at 53–54.
Even if Plaintiffs had satisfied all three elements, the Court would exercise its discretion to decline certification. The Court first held that Plaintiffs could not recover mitigation expenses under Randolph in 2019, over five years ago. Attias II, 365 F. Supp. 3d at 13–16. Plaintiffs moved for reconsideration, making many of the same arguments made here. Compare Pl.’s Memo., ECF No. 66, at 2–4, 6–8, with Pl.’s MCIA 8–9. The Court rejected those arguments and reaffirmed its holding that mitigation damages are not recoverable under D.C. law. Attias III, 518 F. Supp. 3d at 52–55.
12
Then, in opposing CareFirst’s motion for summary judgment, Plaintiffs once again attempted to distinguish Randolph and argued that mitigation expenses constitute actual damages. Pl.’s Opp’n, ECF 98, at 24. Once more, the Court reiterated its holding that mitigation expenses do not constitute actual damages under D.C. law. Attias V, 2023 WL 5952052, at *15. The Court then explicitly asked Plaintiffs at the class certification hearing following summary judgment if they were “still pursuing class certification even if the Court holds that . . . they would only be entitled to nominal damages[.]” Opp’n, Ex. A (Jan. 30, 2024 Hrg. Transcript), at 7:4-7. Plaintiffs responded: “We are pursuing the class.” Id. at 7:8. Relying on that representation, the Court took up their renewed certification motion and ultimately certified a contract class for which “nominal damages are likely the only form of recompense.” Attias VI, 346 F.R.D. at 11. Plaintiffs may not wait until after class certification to seek interlocutory appeal on an issue that has been the law of the case since 2019 and has been reaffirmed by the Court in three subsequent opinions.
This exercise of the Court’s discretion is informed by its view of the merits of Plaintiffs’
claim. See Attias V, 2023 WL 5952052, at *1 (observing that “the evidence on which Plaintiffs rely is thin”). The Court finds relevant, as well, the relatively minimal mitigation measures (on top of the two years of free credit monitoring and identity-theft protection CareFirst gave to all affected customers) that would have been appropriate under the circumstances. No Social Security or credit card numbers were leaked in the breach. Attias IV, 344 F.R.D. at 54. Thus, as the Court observed before, it is not clear that most standard mitigation measures like credit monitoring or freezing “would relate to combatting the much narrower form of medical identity theft potentially implicated here.” Id. at 54–55.
13
For all these reasons, the Court will not permit Plaintiffs to pursue an interlocutory appeal under Section 1292(b).
B. Motion for Reconsideration In the alternative, Plaintiffs ask the Court to reconsider its holding that mitigation expenses do not constitute actual damages under D.C. law. As just explained, that holding has been the law of the case since 2019. The Court therefore denies Plaintiffs’ motion because it “merely asserts ‘arguments for reconsideration [that] the court has already rejected on the merits.’” BEG Invs., LLC v. Alberti, 85 F. Supp. 3d 54, 58 (D.D.C. 2015) (alteration in original). And “‘where litigants have once battled for the court’s decision,’ they should not be permitted, ‘without good reason[,] . . . to battle for it again.’” Kennedy v. D.C., 145 F. Supp. 3d 46, 51 (D.D.C. 2015) (Cooper, J.) (quoting Casey v. Ward, 67 F. Supp. 3d 54, 57 (D.D.C. 2015)).
Plaintiffs also request clarification of whether they may recover mitigation expenses as actual damages. Pl.’s MCIA 13-14. True, the Court said in its summary-judgment opinion that recovery will “likely be limited to nominal damages.” Attias VI, 346 F.R.D. at 12 (emphasis added). But that is so because the Court “cannot entirely rule out the possibility that there may be some class members who believe they suffered financial harms (other than mitigation expenses) stemming from the CareFirst data breach.” Id. (emphasis added). As to mitigation expenses, the Court has been crystal clear: the class members cannot recover them under D.C. law. IV. Conclusion For these reasons, it is hereby
14
ORDERED that [Dkt. No. 112] Plaintiffs’ Motion for Reconsideration and Motion for Leave to Bring an Interlocutory Appeal is DENIED.
SO ORDERED.
CHRISTOPHER R. COOPER
United States District Judge
Date: August 20, 2024