NOT FOR PUBLICATION
UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY
LISA BLACKMAN, on behalf of herself individually and on behalf of all others similarly situated,
Plaintiff, Civil Action No. 24-7022 (ZNQ) (JTQ)
v. OPINION
NORTHEAST SPINE & SPORTS MEDICINE, LLC,
Defendant.
QURAISHI, District Judge THIS MATTER comes before the Court upon a Motion to Dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) filed by Defendant Northeast Spine & Sports Medicine, LLC (“Defendant”). (“Motion,” ECF No. 4.) Defendant filed a Brief in support of its Motion. (“Moving Br.” at 4-1.) Plaintiff Lisa Blackman (“Plaintiff”), on behalf of herself and all others similarly situated (“the putative class”), filed a Brief in Opposition (“Opp’n Br.,” ECF No. 8), to which Defendant replied. (“Reply Br.,” ECF No. 9.) The Court has carefully considered the parties’ submissions and decides the Motion without oral argument pursuant to Federal Rule of Civil Procedure 78 and Local Civil Rule 78.1.1 For the reasons set forth below, the Court will GRANT-IN-PART and DENY-IN-PART the Motion.
1 Hereinafter, all references to Rules refer to the Federal Rules of Civil Procedure unless otherwise noted. I. BACKGROUND AND PROCEDURAL HISTORY A. FACTUAL BACKGROUND2 Plaintiff brings this putative class action3 against Defendant alleging negligence and breach of contract arising from a recent cyberattack and data breach. (Compl. ¶ 1, ECF No. 1-4.) Plaintiff seeks relief due to Defendant failing to (1) adequately protect Plaintiff’s private information, (2)
warn Plaintiff of its “inadequate” security practices, and (3) effectively secure hardware to protect Plaintiff’s information. (Id. ¶ 12.) Defendant is a “multi-specialty medical group in New Jersey specializing in orthopedic surgery, neurosurgery, pain management, sports medicine, chiropractic, physical [and] occupational therapy, acupuncture and massage.” (Id. ¶ 2.) On or about January 15, 2024, Defendant was victim to a cyber-attack in which a ransomware group obtained the private information of Plaintiff and the putative class. (Id. ¶ 3.) The compromised information included personally identifiable information (“PII”), health insurance information, and medical treatment information, and is alleged to be in the hands of “cyber-criminals.” (Id. ¶¶ 5, 6.)
The basis of the Complaint is that “Defendant failed to adequately protect Plaintiff’s . . . Private Information—and failed to even encrypt or redact this highly sensitive information.” (Id. ¶ 6.) As alleged, Plaintiff’s information was compromised because of Defendant’s “negligent and/or careless acts and omissions and its utter failure to protect patients’ sensitive data.” (Id. ¶ 9.) Plaintiff and the putative class have purportedly suffered injuries as a result of Defendant’s negligent and reckless conduct. (Id. ¶ 11.)
2 For the purposes of considering this Motion, the Court accepts all factual allegations in the Complaint as true. See Phillips v. County of Allegheny, 515 F.3d 224, 233 (3d Cir. 2008). 3 The proposed class is defined as: “All persons in the United States whose Private Information was maintained on Defendant’s computer systems that were compromised in the Data Breach that occurred at Defendant in January 2024.” (See Compl. ¶ 166.) B. PROCEDURAL HISTORY Plaintiff filed her initial Complaint on behalf of herself and all others similarly situated in the Superior Court of New Jersey on May 8, 2024. (See ECF No. 1-4; “Notice of Removal,” ECF No. 1.) On June 11, 2024, Defendant timely removed the case to this Court. (Notice of Removal.) Thereafter, on July 1, 2024, Defendant filed the instant Motion to Dismiss. (ECF No. 4.)
II. SUBJECT MATTER JURISDICTION The Court has original jurisdiction over this class action pursuant to the Class Acton Fairness Act (“CAFA”), 28 U.S.C. § 1332(d).4 While CAFA conveys subject matter jurisdiction, “[a]bsent Article III standing, a federal court does not have subject matter jurisdiction to address a plaintiff’s claims, and they must be dismissed.” Taliaferro v. Darby Twp. Zoning Bd., 458 F.3d 181, 188 (3d Cir. 2006). The Court will therefore consider Plaintiff’s Article III standing. See In re Samsung Data Security Breach Litig., Civ. No. 23-3055, 2025 WL 26688, at *3 (D.N.J. Jan. 3, 2025) (noting that “[w]hen a plaintiff fails to establish Article III standing, the court lacks subject matter jurisdiction,” and that
“courts may dismiss a suit sua sponte for lack of subject matter jurisdiction at any stage” of the proceedings. (internal citations omitted)). Article III of the United States Constitution confines the federal judicial power to the resolution of “Cases” and “Controversies.” U.S. Const. Art. III. For there to be a case or controversy under Article III, the plaintiff must have a “‘personal stake’ in the case—in other words, standing.” TransUnion v. Ramirez, 594 U.S. 413, 423 (2021) (quoting Raines v. Byrd, 521
4 CAFA provides federal courts with original jurisdiction over civil class actions if the removing party establishes that the: (1) parties are minimally diverse; (2) proposed class has more than 100 members; and (3) “matter in controversy exceeds the sum or value of $5 [million] exclusive of interest and costs.” Judon v. Travelers Prop. Cas. Co. of Am., 773 F.3d 495, 500 (3d Cir. 2014) (quoting 28 U.S.C. § 1332(d)(2), (d)(6)). “To determine whether the[se] . . . jurisdictional requirements are satisfied, a court evaluates allegations in the complaint and . . . [the] notice of removal.” Id. Having done so, the Court is satisfied that the elements of CAFA are met for purposes of jurisdiction. U.S. 811, 820 (1997)). To have standing, a plaintiff must show, (1) that he or she suffered an injury in fact that is concrete, non-hypothetical, particularized, and actual or imminent; (2) that the injury was likely caused by the defendant; and (3) that the injury would likely be redressed by judicial relief. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). In order “[t]o establish [an] injury-in-fact, a plaintiff must show that he or she suffered an invasion of a legally
protected interest.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (internal quotations omitted). “For an injury to be particularized, it must affect the plaintiff in a personal and individual way.” Id. The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements as to each claim. FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990).5 The Third Circuit has addressed standing in the specific context of data breaches. In Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir. 2011), the Circuit affirmed a district court’s dismissal for lack of standing because the plaintiffs’ contentions relied on “speculation that the hacker: (1) read, copied, and understood their personal information; (2) intend[ed] to commit future criminal acts by misusing the information; and (3) [was] able to use such information to the detriment of
[the plaintiffs] by making unauthorized transactions in [the plaintiffs’] names.” It added that “[u]nless and until these conjectures come true, [the plaintiffs] have not suffered any injury; there has been no misuse of the information, and thus, no harm.” Id. Years later, the Third Circuit held in Clemens v. ExecuPharm Inc., 48 F.4th 146, 155–56 (3d Cir. 2022), that “in the data breach context, where the asserted theory of injury is a substantial risk of identity theft or fraud, a plaintiff suing for damages can satisfy concreteness as long as he
5 “In the context of a class action, Article III must be satisfied by at least one named plaintiff.” Neale v. Volvo Cars of N. Am., 794 F.3d 353, 359 (3d Cir. 2015); see also O’Shea v. Littleton, 414 U.S. 488, 494 (1974) (“[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.”). alleges that the exposure to that substantial risk caused additional, currently felt concrete harms.” It explained that “if the plaintiff’s knowledge of the substantial risk of identity theft causes him to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has alleged a concrete injury.” Id. The Clemens Court explained that
the injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” That “actual or imminent” is disjunctive is critical: it indicates that a plaintiff need not wait until he or she has actually sustained the feared harm in order to seek judicial redress, but can file suit when the risk of harm becomes imminent. This is especially important in the data breach context, where the disclosure of the data may cause future harm as opposed to currently felt harm. In this way, depending on the nature of the data at issue, claims flowing from a data breach can differ from traditional tort claims like defamation or invasion of privacy. While a claim arising from a data breach may share some commonalities with such torts—e.g., in that it may involve the publication of information to a third party or unauthorized access to private information—the latter claims involve actual injury. A claim for defamation, for instance, rests on the “reputational harm” that flows from the publication of a statement “that would subject [the victim] to hatred, contempt, or ridicule.” And a claim for invasion of privacy contemplates that the exposure “cause[s] mental suffering, shame or humiliation” to the victim. By contrast, the type of data involved in a data breach may be such that mere access and publication do not cause inherent harm to the victim. Even then, however, it can still poise the victim to endure the kind of future harm that qualifies as “imminent.”
Id. at 152 (citations omitted). The Third Circuit expanded on these principles in a third decision in 2023, noting that “a plaintiff cannot establish an ongoing or imminent injury simply through allegations that an unknown hacker . . . potentially gained access to sensitive information in a large data breach.” Parker v. Governor of Pennsylvania, Civ. No. 22-2789, 2023 WL 5814603, at *3 (3d Cir. Sept. 8, 2023), cert. denied, 144 S. Ct. 813 (2024). Since Clemens, courts in this Circuit have analyzed standing in data breach cases using a three-factor non-dispositive test: (1) whether the data breach was intentional; (2) whether the data was misused; and (3) whether the nature of the information accessed through the data breach could subject a plaintiff to a risk of identity theft (i.e., disclosure of social security numbers, birth dates, and names—though, disclosure of financial information alone, without corresponding personal information, is insufficient). Clemens, 48 F.4th at 154; see, e.g., Alonzo v. Refresco Beverages US, Inc., Civ. No. 23-22695, 2024 WL 4349592, at *5 (D.N.J. Sept. 30, 2024).
Here, for the reasons set forth below, the Court finds that Plaintiff has standing. In relevant part, the Complaint alleges that Plaintiff (1) spent time mitigating the impact of the data breach (Compl. ¶ 156), (2) suffered actual injury (id. ¶ 157), including being victim to $45 in fraudulent charges, (id. ¶ 158), (3) received and continues to receive spam calls, (id. ¶ 159), and has anxiety, fear, and stress as a result of the data breach (id. ¶ 160.) These allegations are sufficient to confer Article III standing because they show that Plaintiff’s data was misused and that she suffered concrete injuries. See Clemens, 48 F.4th at 155–56 (explaining that “if the plaintiff’s knowledge of the substantial risk of identity theft causes him [or her] to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has
alleged a concrete injury”). Moreover, the Court finds that the factors for standing established in Clemens for data breach cases likewise support a finding that Plaintiff has standing. Generally, cyber-attacks involve some degree of intentional conduct just by the very nature of the attack. Alonzo, 2024 WL 4349592, at *5. Here, the Complaint alleges that a ransomware group took credit for the cyberattack, thus showing that the attack involved some degree of intentional conduct. (Compl. ¶¶ 3, 31.) Considering (1) the intentionality of the attack, (2) that the data was misused, and (3) the type of data accessed, the Court finds that Plaintiff has Article III standing. III. LEGAL STANDARD Rule 8(a)(2) “requires only ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’ in order to ‘give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.’” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (alteration in original) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957) (abrogated on other grounds)).
A district court conducts a three-part analysis when considering a motion to dismiss pursuant to Rule 12(b)(6). Malleus v. George, 641 F.3d 560, 563 (3d Cir. 2011). “First, the court must ‘tak[e] note of the elements a plaintiff must plead to state a claim.’” Id. (alteration in original) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 675 (2009)). Second, the court must accept as true all of the plaintiff’s well-pled factual allegations and “construe the complaint in the light most favorable to the plaintiff.” Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009) (citation omitted). The court, however, may ignore legal conclusions or factually unsupported accusations that merely state the defendant unlawfully harmed the plaintiff. Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 555). Finally, the court must determine whether “the facts alleged in the complaint are
sufficient to show that the plaintiff has a ‘plausible claim for relief.’” Fowler, 578 F.3d at 211 (quoting Iqbal, 556 U.S. at 679). A facially plausible claim “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 210 (quoting Iqbal, 556 U.S. at 663). On a Rule 12(b)(6) motion, the “defendant bears the burden of showing that no claim has been presented.” Hedges v. United States, 404 F.3d 744, 750 (3d Cir. 2005) (citing Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir. 1991)). IV. DISCUSSION Plaintiff asserts two causes of action in her Complaint: (1) negligence, (id. ¶¶ 181–218), and (2) breach of an implied contract, (id. ¶¶ 219–251).6 The Court will address whether to dismiss each count in turn. A. NEGLIGENCE
The Complaint alleges that Defendant had a duty to adopt reasonable measures to protect Plaintiff’s private information, in light of the obligations arising from the Federal Trade Commission Act (“FTC Act”) and the Health Insurance Portability and Accountability Act (“HIPAA”). (Id. ¶¶ 27–28.) Moreover, Plaintiff claims that Defendant did not use reasonable security procedures to protect Plaintiff’s personal information from hackers. (Id. ¶ 33.) Plaintiff provides examples in the Complaint of ways in which Defendant was negligent and could have implemented more secure measures. (See id. ¶¶ 41, 42.) As a result of Defendant’s negligence, the Complaint alleges that Plaintiff and the putative class suffered injuries “directly and proximately caused by Defendant’s failure to implement or maintain adequate data security.” (Id.
¶¶ 63, 116, 143–145, 148, 157, 159–160.) Defendant argues that the Court should dismiss Plaintiff’s negligence claim because the Complaint insufficiently alleges causation and damages. (Id. at 3.) Defendant claims that Plaintiff’s allegations of damages are “vague and speculative . . . and do not support Plaintiff’s
6 In its briefs, Defendant notes the Complaint’s passing references to the New Jersey Consumer Fraud Act (“NJCFA”) and unjust enrichment. (Moving Br. at 18; Reply Br. at 13.) Defendant asks that these unasserted counts be dismissed as inadequately pled. Plaintiff maintains in opposition that she does state claims for fraud under the NJCFA and for unjust enrichment. (Opp’n Br. at 11–12.) The Court has reviewed the Complaint. There is no ambiguity; it clearly does not assert discrete counts for fraud under the NJCFA or for unjust enrichment. The Third Circuit has held that it is “axiomatic” that a plaintiff cannot amend her complaint in an opposition brief on a motion to dismiss. Frederico v. Home Depot, 507 F.3d 188, 202 (3d Cir. 2007). Accordingly, the Court will deny as moot Defendant’s request to dismiss these unasserted claims. claim of negligence.” (Id. at 15–17.)7 Plaintiff, however, insists that the Third Circuit has stated that injuries caused by a data breach are “easily and precisely compensable with a monetary award,” and thus, Plaintiff has successfully pled damages. (Opp’n Br. at 7 (quoting Clemens, 48 F.4th at 158)). Plaintiff also refutes Defendant’s claim that she did not suffer injuries arising from lost privacy rights, a diminished value of personal information, fraudulent charges, and lost time.
(Id. at 8–11.) To state a claim for negligence under New Jersey law, a plaintiff must assert that: (1) the defendant owed plaintiff a duty; (2) there was a breach of that duty; (3) the breach proximately caused the injury, and (4) damages. Keith v. Truck Stops Corp. of Am., 909 F.2d 743, 745 (3d Cir. 1990); Lax v. City of Atl. City, Civ. No. 19-7036, 2019 WL 7207472, at *4 (D.N.J. Dec. 27, 2019). The question of whether a duty exists is a matter of law properly decided by the Court. Strachan v. John F. Kennedy Memorial Hosp., 538 A.2d 346, 349 (N.J. 1988). Determination of the existence of a duty “is largely a question of fairness or policy.” Id. “The inquiry involves a weighing of the relationship of the parties, the nature of the risk, and the public interest in the
proposed solution.” V.C. by Costello v. Target Corp., 454 F. Supp. 3d 415, 423 (D.N.J. 2020). Here, Plaintiff has thoroughly pled facts that state her claim for negligence. For example, she alleges that “Defendant had a duty to adopt reasonable measures to protect the Private Information of Plaintiff and Class Members from involuntary disclosure to third parties. Defendant has a legal duty to keep patients’ Private Information safe and confidential.” (Compl. ¶ 27.) Moreover, by “assuming the responsibility to collect and store this data . . . Defendant had a duty of care to use reasonable means to secure and safeguard its computer property—and Class
7 Many of these arguments overlap with whether there is an injury-in-fact for Article III standing. The Court has already addressed Defendant’s argument that Plaintiff’s allegations of damages are too speculative. Members’ Private Information held within it—. . . from theft. (Id. ¶ 185.) That duty included “a responsibility to implement processes by which it could detect a breach of its security systems in a reasonably expeditious period of time and to give prompt notice to those affected in the case of a data breach.” (Id.) Importantly, Plaintiff explains that “Defendant’s duty of care to use reasonable security measures arose as a result of the special relationship that existed between
Defendant and its patients. That special relationship arose because Plaintiff and the Class entrusted Defendant with their confidential Private Information, a necessary part of being patients at Defendant.” (Id. ¶ 190.) Regarding breach, Plaintiff alleges that (1) Defendant had obligations created by the FTC Act and HIPAA, which it violated, (id. ¶¶ 28, 186, 187), (2) Defendant “failed to adequately protect Plaintiff’s and Class Members’ Private Information . . . [by] Defendant’s negligent and/or careless acts and omissions and its utter failure to protect patients’ sensitive data, (id. ¶ 6), and (3) “[i]t was foreseeable that Defendant’s failure to use reasonable measures . . . would result in injury to Class Members.” (Id. ¶ 203.) To support her claim that the breach of security was foreseeable, Plaintiff
alleges that the “breach of security was reasonably foreseeable given the known high frequency of cyberattacks and data breaches in the healthcare industry.” (Id.) The Complaint also provides examples of how Defendant could have protected Plaintiff’s information, further supporting Plaintiff’s claim for breach. (Id. ¶ 112). Lastly, the Complaint states that “Defendant failed to properly implement basic data security practices,” (id. ¶ 95), and that Defendant failed to “employ reasonable and appropriate measures to protect against unauthorized access to its patients’ Private Information,” (id. ¶ 96). In addition to properly alleging duty and breach, the Complaint alleges that “[b]ut for Defendant’s wrongful and negligent breach of duties owed to Plaintiff and the Class, the Private Information of Plaintiff and the Class would not have been compromised,” (id. ¶ 211), and that “[a]s a direct and proximate result of Defendant’s negligence, Plaintiff and the Class have suffered and will continue to suffer other forms of injury and/or harm, including, but not limited to, anxiety, emotional distress, loss of privacy, and other economic and noneconomic losses,” (id. ¶ 214.) Finally, with respect to damages, the Court finds that Plaintiff has sufficiently alleged facts
to support relief as to past, present, and future harm for purposes of negligence. (See, e.g., ¶¶ 156– 160.) Defendant argues that the Court should dismiss Plaintiff’s negligence claim because Plaintiff lacks standing to assert future damages given that such allegations represent future and speculative claims. (Moving Br. at 15, 22–23.) Plaintiff argues in opposition that the Court has standing for the “present and continuing threat of identity theft and fraud.” (Opp’n Br. at 13–14.) Although it is true that an injury-in-fact for purposes of Article III standing must be imminent, materialized, and non-speculative, see TransUnion, 594 U.S. at 437 (noting that a “mere risk of future harm, without more” does not demonstrate Article III standing in a suit for damages), Defendant’s argument seems to conflate the requirements of Article III standing and negligence.
In addition to the allegations directly resulting in injury-in-fact to Plaintiff, the Complaint alleges that “Plaintiff and [the] Class Members now face years of constant surveillance of their financial and personal records, monitoring, and loss of rights. The Class is incurring and will continue to incur such damages in addition to any fraudulent use of their Private Information.” (Compl. ¶¶ 87, 143 (“Plaintiff and Class Members now face years of constant surveillance of their financial and personal records.”)) Moreover, the Complaint alleges that “the risk of identity theft to the Plaintiff and the Class Members has materialized and is imminent, and Plaintiff and Class Members have all sustained actual injuries and damages.” (Id. ¶ 116.) The Complaint also demonstrates that the type of PII that was stolen can lead to an imminent harm and alleges that “Plaintiff and Class Members have spent, and will spend additional time in the future, on a variety of prudent actions,” which amounts to standing. (Id. ¶¶ 130–133.) Plaintiff moreover emphasizes the importance of social security number theft in the context of data breaches. (See id. ¶ 67). These allegations satisfy the requirements for pleading both Article III standing and the damages element of a negligence claim at this stage of the proceedings.
In short, the Court finds that the Complaint alleges a plausible claim for negligence. Accordingly, Defendant’s Motion to Dismiss Plaintiff’s negligence claim will be DENIED. B. BREACH OF CONTRACT The Complaint alleges that Defendant “made promises and representations to its patients that the private information collected from them as a condition of obtaining medical services . . . would be kept safe [and] confidential . . . and that Defendant would delete any sensitive information after they were no longer required to maintain it.” (Id. ¶ 21.) That promise, however, was not kept in light of the data breach that took place. (Id.) Moreover, Plaintiff claims that there was a mutual understanding where Defendant would keep Plaintiff’s information secure. (Id. ¶
223.) And as a “direct and proximate result of Defendant’s breach of the implied contract,” the Complaint alleges that Plaintiff and the putative class sustained injuries and are entitled to damages. (Id. ¶¶ 236, 237.) Defendant argues that the Court should dismiss Plaintiff’s claim for breach of implied contract because the parties never entered into a contract, there are no reasonably definite terms alleged, there was no meeting of the minds, and there was no consideration. (Moving Br. at 1–2, 12–14.) Plaintiff maintains that she has properly pled mutual assent because there were express representations made in the privacy policies which are part of the course of conduct to create an implied contract. (Opp’n Br. at 1.) Plaintiff cites decisions from courts throughout the country that have held that implied contracts were properly pled in similar data breach cases. (Id. at 5.) Plaintiff moreover suggests there is an implied contract because Plaintiff was required to give Defendant her personal information in order to obtain services provided by Defendant, and that in doing so, Plaintiff intended and understood Defendant would safeguard that information. (Id. at 7.)
To plead a claim for breach of contract under New Jersey law, a plaintiff must allege “(1) a contract; (2) a breach of that contract; (3) damages flowing therefrom; and (4) that the party performed its own contractual duties.” Video Pipeline, Inc. v. Buena Vista Home Entm’t, Inc., 210 F. Supp. 2d 552, 561 (D.N.J. 2002); Globe Motor Co. v. Igdalev, 139 A.3d 57, 64 (N.J. 2016) (“Our law imposes on a plaintiff the burden to prove four elements: first, that ‘[t]he parties entered into a contract containing certain terms’; second, that ‘plaintiff[s] did what the contract required [them] to do’; third, that ‘defendant[s] did not do what the contract required [them] to do[,]’ defined as a ‘breach of the contract’; and fourth, that ‘defendant[s’] breach, or failure to do what the contract required, caused a loss to the plaintiff[s]’” (quoting N.J. Model Civil Instr. 4.10A (May
1998))). Moreover, an enforceable contract may occur once a party communicates an offer and another party demonstrates acceptance. Gordon v. Dailey, Civ. No. 14-7495, 2018 WL 1509080, at *8 (D.N.J. Mar. 27, 2018). Importantly, acceptance may be shown by words or conduct. See, e.g., Weichert Co. Realtors v. Ryan, 608 A.2d 280, 284 (N.J. 1992) (“An offeree may manifest assent to the terms of an offer through words, creating an express contract, or by conduct, creating a contract implied-in-fact”); N.J. Model Civil Instr. 4.10C. Implied-in-fact contracts “are formed by conditions manifested by words and inferred from circumstances, thus entailing consideration of factors such as oral representations, employee manuals, and party conduct.” Iliadis v. Wal-Mart Stores, Inc., 922 A.2d 710, 722 (N.J. 2007). To form an implied contract, a plaintiff must demonstrate “mutual assent” of the parties. See In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., Civ. No. 19-2904, 2021 WL 5937742, at *19 (D.N.J. Dec. 16, 2021) (“Mutual assent is an essential element of an implied contract claim . . . .”). In the context of data breaches, however, “the fact that a defendant required plaintiffs to
provide personal information does not alone support the inference that the parties agreed for the defendant to secure this information.” Id. Rather, a complaint “must allege some other conduct by the Defendant from which mutual assent for [the defendant] to safeguard Plaintiff’s PII arose.” In re Am. Fin. Res., Inc., 2023 WL 3963804, at *8; see Longenecker-Wells v. Benecard Services Inc., 658 F. App’x 659, 662 (3d Cir. 2016) (explaining that plaintiffs, who were required to provide PII to their employer as a condition of employment, failed to plead an implied contract where the plaintiffs “failed to plead any facts supporting their contention that an implied contract arose between the parties other than that [Defendant] required Plaintiffs’ personal information as a prerequisite to employment”); see also Brush v. Miami Beach Healthcare Group Ltd., 238 F. Supp.
3d 1359, 1365 (S.D. Fla. 2017) (similarly holding that “[n]othing in the Plaintiff’s Complaint g[ave] rise to a factual inference that the [d]efendants tacitly agreed to secure her personal data in exchange for remuneration. It is clear from the Plaintiff’s allegations that she transacted to receive healthcare services from the [d]efendants—not data security services beyond the privacy requirements already imposed on the [d]efendants by federal law. Accordingly, the Court cannot imply a contract to provide data security services based on the conduct of the parties.”). The Court finds that the Complaint fails to sufficiently plead breach of an implied contract. It is apparent from the Complaint that Plaintiff paid Defendants to perform medical services and she provided her PII as a pre-requisite to receiving Defendant’s services. This is similar to the plaintiff in In re Am. Med. Collection Agency, Inc., where the court held the complaint failed to plead an implied contract. 2021 WL 5937742, at *19. Importantly, and fatal to surviving the Motion, is that Plaintiff fails to allege sufficient facts regarding the parties’ mutual assent. The Complaint does not allege that Defendant agreed to safeguard the PII beyond complying with federal regulations. See id. Moreover, although the privacy notices on Defendant’s website
conveyed that Defendant was “sensitive to protecting [Plaintiff’s] privacy,” the website did not indicate that a contract existed or that Defendant was going to do something to protect that information. (See id. *22.) Instead, the Complaint alleges that “Plaintiff and Class Members were required [to] deliver their Private Information to Defendant as part of the process of becoming patients at Defendant. Plaintiff and Class Members paid money, or money was paid on their behalf, to Defendant in exchange for services.” (Id. ¶ 220.) The Complaint further states that “Plaintiff . . . accepted Defendant’s offers [to provide private information] . . . and provided their Private Information to Defendant,” thereby accepting the offer. (Id. ¶ 221.)
These allegations do not suffice to plead that terms were agreed upon or that there was mutual assent. There also does not seem to be an offer regarding the PII. Rather, the underlying offer seems to refer to health services offered by Defendant. (See id. ¶ 2.) The Complaint adds that Plaintiff and the Class entrusted their Private Information to Defendant. In so doing, Plaintiff and the Class entered into implied contracts with Defendant by which Defendant agreed to safeguard and protect such information, to keep such information secure and confidential, and to timely and accurately notify Plaintiff and the Class if their data had been breached and compromised or stolen.
(Id. ¶ 223). Even construing the Complaint in a light most favorable to Plaintiff, these allegations fail to support a claim for breach of an implied contract because they do not adequately plead that there was mutual assent.8 And as stated, in the context of data breaches, “the fact that a defendant require[s] plaintiffs to provide personal information does not alone support the inference that the parties agreed for the defendant to secure this information.” In re Am. Med. Collection Agency, Inc., 2021 WL 5937742, at *19. The Complaint attempts to allege that there was an implied-in-fact contract evidenced by
Defendant’s conduct. (See id. ¶ 226 (“[t]he mutual understanding and intent of Plaintiff and Class Members on the one hand, and Defendant, on the other, is demonstrated by their conduct and course of dealing.”)). However, the allegations as to Defendant’s conduct, even when liberally construed, do not plead a plausible basis to infer Defendant’s assent. For example, the Complaint provides: On information and belief, at all relevant times Defendant promulgated, adopted, and implemented written privacy policies whereby it expressly promised Plaintiff and Class Members that it would only disclose Private Information under certain circumstances, none of which relate to the Data Breach.
(Id. ¶ 227.) This allegation of an express promise is inconsistent with Plaintiff’s claim for breach of implied contract. It is also conclusory because while it states that Defendants “expressly promised” that it would keep Plaintiff’s information private, it asserts no facts to support that such an express agreement exists. The Complaint also alleges that “[o]n information and belief,
8 The Complaint alleges that “[o]n information and belief, at all relevant times Defendant promulgated, adopted, and implemented written privacy policies whereby it expressly promised Plaintiff and Class Members that it would only disclose Private Information under certain circumstances, none of which relate to the Data Breach. (Id. ¶ 227.) This allegation is conclusory and does not adequately plead facts to support a finding that a policy existed. Moreover, this allegation is different from the allegations in In re Am. Fin. Res., Inc. Data Breach Litig., Civ. No. 22-01757, 2023 WL 3963804, at *8–9 (D.N.J. Mar. 29, 2023), where the court held that the plaintiff adequately pled breach of an implied contract. In that case, the complaint provided that the defendant’s website stated “[social security numbers] are classified as ‘Confidential’ information under the [defendant’s] Information Security Policy . . . [and] are subject to physical, electronic, and procedural safeguards, and must be stored, transmitted, and disposed of in accordance with the provisions of the Information Security Policy applicable to Confidential information.” Id. Here, Plaintiff makes no such allegation that there was a promise that the information will be stored and that procedural safeguards existed; being sensitive to private information, as alleged, does not demonstrate there was a promise or offer that was accepted. Defendant further promised to comply with industry standards and to make sure that Plaintiffs and Class Members’ Private Information would remain protected.” (Id. ¶ 228). However, as set forth above, a promise to comply with industry standards does not create an implied-in-fact contract with Plaintiff. Thus, because the Complaint does not plead the existence of mutual assent, the Court will
GRANT the portion of the Motion seeking to dismiss Plaintiff’s claim for breach of an implied contract. Plaintiff’s breach of contract claim will therefore be dismissed without prejudice, and Plaintiff will be given leave to amend her Complaint. V. CONCLUSION For the reasons stated above, the Court will GRANT-IN-PART and DENY-IN-PART Defendant’s Motion. (ECF No. 4.) Plaintiff will be given thirty days to amend its Complaint. An appropriate Order will follow.
Date: January 13, 2025
s/ Zahid N. Quraishi ZAHID N. QURAISHI UNITED STATES DISTRICT JUDGE