Opinion issued January 7, 2014
In The
Court of Appeals For The
First District of Texas ———————————— NO. 01-12-01177-CV ——————————— BLISS & GLENNON INC., Appellant V. EUGENE LYLE ASHLEY AND ASHLEY GENERAL AGENCY, LLC, Appellees
On Appeal from the 164th District Court Harris County, Texas Trial Court Case No. 2011-32520
OPINION
Appellant brings this interlocutory appeal from the trial court’s order
certifying a nationwide class. We reverse. BACKGROUND
A. The Parties
Plaintiff/appellant Bliss & Glennon, Inc. (B&G) is an insurance broker.
Essentially, it serves as the middle-man in the residual insurance market, i.e., it
brokers hard-to-place policies that cannot be purchased in the standard insurance
market. B&G’s customers are insurance agents that represent insureds, and B&G’s
suppliers are various insurance companies.
Defendant/appellee Lyle Ashley worked for B&G until June 2008. He then
founded defendant/appellee Ashley General Agency, LLC. Ashley is also a part
owner of the commercial building that housed B&G’s Conroe office until March
2011. B&G and Ashley have been involved in prior litigation involving
allegations by B&G that Ashley misappropriated trade secrets and violated various
agreements when he left B&G.
B. Bliss & Glennon’s claims
In the underlying suit, B&G sued Ashley and Ashley General seeking a
temporary restraining order and injunctive relief.
B&G’s petition alleged that when Ashley left B&G’s employment and
formed competing business Ashley General, he solicited B&G’s employees to join
him. On May 20, 2011, Ashley’s attorney contacted B&G’s attorney to notify
2 B&G that one of Ashley General’s employees, later identified as Justin Langston,1
had removed several of B&G’s CDs, hard drives, and other business information
from the dumpster that was onsite when B&G moved out of its Conroe office in
March 2001. B&G had moved out of the offices on March 18, Ashley noticed
items in the dumpster on March 19, and Langston went and retrieved the items
from the dumpster on March 20. Ashley’s counsel indicated to B&G that the CDs
and computer drives contained business information that B&G had claimed was
confidential in prior litigation between the parties, and sensitive third-party data,
including the social security numbers of various employees and other individuals.
Although B&G maintained that it did not discard confidential or sensitive
information in the trash, it requested the immediate return of any such items.
Ashley refused to return them. Shortly thereafter, B&G received a call from a
senior executive with one of its largest customers explaining that Ashley had called
him to report that B&G disclosed that customer’s confidential information, failed
to inform that customer, and had taken no protective steps to safeguard the
information. Ashley also told that customer that Ashley had a recent fraudulent
charge on his credit card that he believed was related to B&G’s data breach.
In response, B&G filed its petition in the underlying cause stating,
1 Langston was the IT department head for B&G’s Conroe office before he left to work for Ashley General. 3 B&G seeks a Temporary Restraining Order prohibiting the use or disclosure to anyone other than B&G of all B&G information Defendants found in B&G’s trash, or which Defendants have represented was found in B&G’s trash, as well as the immediate return of such information to B&G. B&G needs to know what information Mr. Ashley has allegedly found for many reasons, not the least of which is its duty to advise persons whose information has been disclosed, if that is the case. B&G also seeks damages for Mr. Ashley's use of B&G confidential information, his tortious interference with B&G customer relationships, and defamation.
In addition to injunctive relief, B&G sought damages for conversion,
misappropriation of trade secrets and confidential information, unfair competition,
business disparagement, and defamation.
C. The Temporary Restraining Order
On May 31, 2011, the trial court granted a TRO ordering Ashley and Ashley
Agency to “[i]mmediately cease and desist from using, communicating, disclosing,
divulging or making available to any person or entity, directly or indirectly, the
contends of any information found in the trash.” Two weeks later, the court signed
an Agreed TRO containing the same provision, and B&G was finally provided a
copy of the items allegedly found in the dumpster. The trial court’s order, which it
entered without hearing evidence or making any “determination as to the substance
or validity of either parties’ claims,” but only to maintain the parties’ “interest in
the subject property” until trial, provided,
1. The property making the basis for the claims in this suit is to remain in the care, custody, and control of the Counsel for Defendants. Counsel is to ensure that said property is not
4 accessed by either party for any reason. Counsel for Defendants is to preserve said property in its current form and disallow any access to said property until further order of this Court. 2. Counsel for Defendants is to obtain affidavits, within thirty (30) days, from any person who has had direct access to said property that indicate no additional copies of the subject property are in existence. Counsel is not required to obtain such affidavits from anyone who has already testified to such information. 3. Should Counsel for Defendants learn of anyone in possession of copies of the subject property, they are to take possession of the copies, immediately. In the event of such a discovery, Counsel for Defendants is to notify Counsel for Plaintiffs and Court, with the identity and contact information of the person in possession of a copy.
D. Ashley’s and Ashley General’s Counterclaims
On May 30, 2012, Ashley and Ashley General filed counterclaims against
B&G, asserting, and seeking damages for, negligent protection of personal and
other sensitive information, invasion of privacy by public disclosure of private
information, business disparagement, and defamation. Ashley asserted that, after
the discovery of B&G’s information in the dumpster, he was “told of a fraud alert
on his personal credit card.” Ashley and Ashley General also sought sanctions and
attorneys’ fees, based on the contention that B&G’s claims were frivolous and
brought in bad faith for the purpose of harassment.
E. Ashley’s Class-Action Claims
On October 22, 2012, defendants/counter-plaintiffs Ashley and Ashley
General amended their counterclaim petition to add class-action claims. Their 5 petition asserted that Ashley had already appeared in the suit “as an individual and
in his capacity as representative of a class of similarly situated persons.” The
petition alleged that defendants’ claims satisfy the applicable standards for
certifying a class,
Ashley brings this class action pursuant to Rule 42 of the Texas Rules of Civil Procedure because (1) the class is so numerous (in this case, likely to exceed 7000 individuals) that joinder of all members is impracticable, (2) there are questions of law or fact common to the class, (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class, and (4) Ashley, as class representative, will fairly and adequately protect the interests of the class. Ashley, individually and as representative of the class, seeks certification of the following class (the “Class”):
All individuals whose personal, sensitive information was stored on electronic mediums, including hard drives, that Defendants placed in the dumpster and cannot either account for and/or did not have proper control, custody, or possession for a period of time.
The class-action petition requested, on behalf of the class, all damages arising from
B&G’s actions, including “expenses for credit monitoring and identity theft
insurance, out-of-pocket expenses, anxiety, emotional distress, loss of privacy, and
other economic and non-economic harm—for which they are entitled to
compensation.” Defendants also sought attorneys’ fees, sanctions, and an
injunction “compelling B&G to issue notices to all members of the Class regarding
the breaches of duty regarding their personal information.”
6 F. The Class Certification
In addition to its petition, Ashley filed three documents in support of
certification: (1) a Motion for Class Certification with three exhibits (deposition
excerpt from B&G employee, B&G’s original petition, and an email from
American Express to Ashley), (2) a Brief in Support of Class Certification, and (3)
a proposed order and trial plan. B&G objected to Ashley’s motion for certification
as being untimely, and filed a response challenging Ashley’s standing and ability
to satisfy the requirements for class certification with two exhibits (deposition
excerpt from B&G employee and deposition excerpt from Ashley).
The materials allegedly found in the dumpster are not in the record, and the
record does not contain a very good description of the data involved. Ashley has
pleaded that the “information placed in the dumpster contains personal and
business information—including names, account numbers, tax numbers, e-mail
addresses, billing addresses, phone numbers, and social security numbers—
belonging to countless (Ashley believes the number of such individuals is over
7,000) persons and businesses.”
The parties’ trial-court briefing on class certification and the evidence
attached, however, reveal that the crux of the parties’ dispute revolves around a
hard drive Ashley alleges was found in the dumpster, and around the existence of
7 another potentially missing duplicate hard drive.2 B&G’s corporate representative,
Ms. Bowers, testified in her deposition that—at some point when Langford was
still employed by B&G—another company named “Willis” (also referred to
elsewhere as “H.R.H.”) erroneously sent a computer file to B&G containing a list
of social security numbers and other personal information. That email was
received by Langford. Bowers testified that although Langford knew that the
information was sent to him in error, he now claims that he backed up the
information onto two different hard drives. Langford claims that he retrieved one
of those hard drives from the dumpster two days after B&G moved out of its
office. Bowers testified that B&G does not know anything about a second hard
drive existing; nor does it possess such a hard drive.
According to Bowers, B&G conducted an immediate investigation when it
was contacted by Ashley about the materials allegedly found in the dumpster.
B&G disputes that any hard drive was thrown away (as its IT personal deny
discarding such items), and B&G had a data disposal company on hand with its
move that shredded paper and drilled holes in hard drives before taking them off-
2 The parties do not appear to dispute that the CDs found in the dumpster did not contain confidential information, but instead contain software updates. There were some paper copies of insurance policies in dumpster that would usually be shredded instead of thrown away under B&G’s internal policies, but the parties also appear to agree that these papers do not contain confidential personal or business information. The class was thus defined in terms of individuals with personal or sensitive information stored on “electronic mediums.” 8 site to discard. B&G’s thus believes that Ashley and/or Langford wrongfully
obtained the materials at issue from its office (rather than from a dumpster, as
claimed) and are skeptical of Langford’s claim that a duplicate hard drive exists
and is missing.
Over B&G’s objections, and following an unrecorded hearing, the trial court
certified the requested class with Ashley as the class representative, and ordered
B&G to give notice to class members at its own expense. B&G timely brought this
interlocutory appeal.
ISSUES ON APPEAL
B&G brings forth the following issues here:
1. Whether the Trial Court erred in failing to dismiss the Class Claims for want of jurisdiction based on Lyle Ashley’s failure to carry his burden to establish standing since: (1) Ashley and his counsel have had custody and control of the confidential information at issue since Ashley and his colleague allegedly removed it from a trash dumpster two years ago; and (2) Ashley failed to establish the required causal connection between his alleged injury of fraudulent charges on his personal credit card and B&G’s alleged conduct, especially given the lack of evidence that the credit card information was included in the confidential information?
2. Whether the Trial Court erred in certifying a nationwide class action asserting common law claims where Ashley failed to carry his burden of proving the predominance and superiority aspects of Rule 42(b)(3), as well as the requirements of commonality (Rule 42(a)(2)), typicality (Rule 42(a)(3)), and adequacy (Rule 42(a)(4))?
9 RULE 42 – CLASS ACTIONS Class action suits are governed by Rule 42 of the Texas Rules of Civil
Procedure.
Rule 42. Class Actions
(a) Prerequisites to a Class Action. One or more members of a class may sue or be sued as representative parties on behalf of all only if (1) the class is so numerous that joinder of all members is impracticable, (2) there are questions of law, or fact common to the class, (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class, and (4) the representative parties will fairly and adequately protect the interests of the class. (b) Class Actions Maintainable. An action may be maintained as a class action if the prerequisites of subdivision (a) are satisfied, and in addition: (1) the prosecution of separate actions by or against individual members of the class would create a risk of (A) inconsistent or varying adjudications with respect to individual members of the class which would establish incompatible standards of conduct for the party opposing the class, or (B) adjudications with respect to individual members of the class which would as a practical matter be dispositive of the interests of the other members not parties to the adjudications or substantially impair or impede their ability to protect their interests; or (2) the party opposing the class has acted or refused to act on grounds generally applicable to the class, thereby making appropriate final injunctive relief or corresponding declaratory relief with respect to the class as a whole; or (3) the questions of law or fact common to the members of the class predominate over any questions affecting only individual members, and a class action is superior to other available
10 methods for the fair and efficient adjudication of the controversy. The matters pertinent to these issues include: (A) the interest of members of the class in individually controlling the prosecution or defense of separate actions; (B) the extent and nature of any litigation concerning the controversy already commenced by or against members of the class; (C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (D) the difficulties likely to be encountered in the management of a class action. (c) Determining by Order Whether to Certify a Class Action; Notice and Membership in Class. (1)(A) When a person sues or is sued as a representative of a class, the court must—at an early practicable time—determine by order whether to certify the action as a class action. (B) An order certifying a class action must define the class and the class claims, issues, or defenses, and must appoint class counsel under Rule 42 (g). (C) An order under Rule 42(c)(1) may be altered or amended before final judgment. The court may order the naming of additional parties in order to insure the adequacy of representation. (D) An order granting or denying certification under Rule 42(b)(3) must state: (i) the elements of each claim or defense asserted in the pleadings; (ii) any issues of law or fact common to the class members; (iii) any issues of law or fact affecting only individual class members; (iv) the issues that will be the object of most of the efforts of the litigants and the court; (v) other available methods of adjudication that exist for the controversy; 11 (vi) why the issues common to the members of the class do or do not predominate over individual issues; (vii) why a class action is or is not superior to other available methods for the fair and efficient adjudication of the controversy; and (viii) if a class is certified, how the class claims and any issues affecting only individual members, raised by the claims or defenses asserted in the pleadings, will be tried in a manageable, time efficient manner. (2)(A) For any class certified under Rule 42(b)(1) or (2), the court may direct appropriate notice to the class. (B) For any class certified under Rule 42(b)(3), the court must direct to class members the best notice practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort. The notice must concisely and clearly state in plain, easily understood language: (i) the nature of the action; (ii) the definition of the class certified; (iii) the class claims, issues, or defenses; (iv) that a class member may enter an appearance through counsel if the member so desires; (v) that the court will exclude from the class any member who requests exclusion, stating when and how members may elect to be excluded; and (vi) the binding effect of a class judgment on class members under Rule 42 (c)(3). ....
TEX. R. CIV. P. 42.
“Courts must perform a rigorous analysis before ruling on class certification
to determine whether all prerequisites to certification have been met.” Sw. Ref. Co.
v. Bernal, 22 S.W.3d 425, 435 (Tex. 2000) (citation and internal quotation marks 12 omitted). In so doing, courts “may look beyond the pleadings.” Intratex Gas Co.
v. Beeson, 22 S.W.3d 398, 404 (Tex. 2000). “Because class determinations
generally involve considerations that are enmeshed in the factual and legal issues
comprising the plaintiff’s cause of action, the trial court must be able to make a
reasoned determination of the certification issues.” Exxon Mobil Corp. v. Gill,
299 S.W.3d 124, 126 (Tex. 2009) (quoting Beeson, 22 S.W.3d at 404). And while
“[d]eciding the merits of the suit in order to determine . . . its maintainability as a
class action is not appropriate,” Beeson, 22 S.W.3d at 404, “the substantive law . . .
must be taken into consideration in determining whether the purported class can
meet the certification prerequisites under Rule 42,” Union Pac. Res. Grp., Inc. v.
Hankins, 111 S.W.3d 69, 72–73 (Tex. 2003).
Our review of an interlocutory appeal from a class certification order is
limited to determining whether the trial court’s order constituted an abuse of
discretion. Ford Motor Co. v. Ocanas, 138 S.W.3d 447, 451 (Tex. App.—Corpus
Christi 2004, no pet.); see also Henry Schein, Inc. v. Stromboe, 102 S.W.3d 675,
690–91 (Tex. 2003). Typically, under this standard of review, the appellate court
must indulge every presumption favorable to the trial court’s ruling. See
Graebel/Houston Movers, Inc. v. Chastain, 26 S.W.3d 24, 29 (Tex. App.—
Houston [1st Dist.] 2000, pet dism’d w.o.j.). On certification issues, however, the
appellate court is not bound by this presumption and must independently determine
13 whether the requirements of rule 42 have been fully satisfied. See Ford Motor Co.,
138 S.W.3d at 451; see also Stonebridge Life Ins. Co. v. Pitts, 236 S.W.3d 201,
205 (Tex. 2007) (“Actual conformance with Rule 42 is indispensable, and
compliance with the rule must be demonstrated, not presumed.”); Bernal, 22
S.W.3d at 435 (actual compliance with rule 42 “must be demonstrated; it cannot be
presumed”).
Applying these standards, we conclude that the trial court accepted disputed
facts as agreed and thus failed to hold Ashley to his burden of affirmatively
establishing each prerequisite to class certification. Accordingly, while we reject
B&G’s argument that Ashley has failed to establish individual standing, we
nonetheless reverse the trial court’s class certification order.
I. Standing
Preliminarily B&G argues that Ashley has failed to demonstrate standing to
represent a class because, it asserts, Ashley lacks individual standing.3 It points to
3 We begin with an individual standing inquiry, because “before Rule 42’s requirements are considered, a named plaintiff must first satisfy the threshold requirement of individual standing at the time suit is filed, without regard to class claims.” Sw. Bell Tel. Co. v. Mktg. on Hold Inc., 308 S.W.3d 909, 915 (Tex. 2010) (holding, on interlocutory appeal of class certification order, that plaintiff had standing, but nonetheless had not established that it could adequately represent the class); see also Solotko v. LegalZoom.com, Inc., No. 03-10-00755-CV, 2013 WL 3724770, at *2 (Tex. App.—Austin July 11, 2013, pet. filed) (mem. op.) (noting that named representative’s individual standing was “threshold matter” in interlocutory appeal of order denying class certification); Magic Valley Elec. Co- op. v. City of Edcouch, No. 13-05-202-CV, 2006 WL 733960, at *1 (Tex. App.— Corpus Christi March 23, 2006, pet. dism’d) (mem. op) (examining proposed class 14 the supreme court’s holding that “a named plaintiff’s lack of individual standing at
the time suit is filed deprives the court of subject matter jurisdiction over the
plaintiff’s individual claims and claims on behalf of a class.” M.D. Anderson
Cancer Ctr. v. Novak, 52 S.W.3d 704, 711 (Tex. 2001). Citing recent Texas
Supreme Court precedent, B&G contends that “Ashley was required to prove three
essential elements for standing: injury, causation, and redressability”:
First, “a plaintiff must be personally aggrieved, his alleged injury must be concrete and particularized, actual or imminent, not hypothetical.” Daimler Chrysler Cor. v. Inman, 252 S.W.3d 299, 304–05 (Tex. 2008); accord Heckman [v. Williamson Cnty.], 369 S.W.3d [137,] 154 [(Tex. 2012)]. Second, “there must be a causal connection between the injury and the conduct complained of – the injury has to be fairly . . . trace[able] to the challenged action of the defendant, and not . . . th[e] result [of] the independent action of some third party not before the court.” Heckman, 369 S.W.3d at 154 (internal quotations and citations omitted). Third, “it must be ‘likely,’ as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a favorable decision.’” Id. at 154–55. If the named class representative lacks standing, then the purported class action must be dismissed for want of jurisdiction. M.D. Anderson, 52 S.W.3d at 711. According to B&G, Ashley failed to satisfy these standing requirements for
four reasons: (1) Ashley and his counsel have had custody of the materials at issue
since they were allegedly removed from the dumpster, (2) Ashley has not
presented evidence that data fell into the hands of someone who intends to misuse
it, (3) Ashley has not presented evidence that his credit card information was
representative’s individual standing on interlocutory appeal from class certification order because plaintiff’s individual standing is a “prerequisite to class certification”). 15 contained in the property allegedly discarded by B&G, and (4) Ashley has not
shown that the fraudulent charges on his credit card were caused by B&G’s
actions.
Ashley responds that this case is different than the data-breach cases in
which the pleaded risk of harm is purely hypothetical. In this case, Ashley points
out, he has alleged that fraudulent activity occurred on his American Express
account because of B&G’s alleged breach, and that he has already incurred
mitigation expenses. Ashley contends that B&G is attempting to “substitute[e] a
sufficiency of the evidence argument for one challenging standing by asking this
Court to reweigh evidence of ‘causal connection’ similar to a merits-based appeal.”
Ashley asserts that this is inappropriate, as a “plaintiff does not lack standing
simply because he cannot prevail on the merits of his claim; he lacks standing
because his claim of injury is too slight for a court to afford redress.” Daimler
Chrysler Corp. v. Inman, 252 S.W.3d 299, 305 (Tex. 2008).
We agree with Ashley that he has alleged a particularized harm that satisfies
the requirement that he must “be personally aggrieved [and] his alleged injury
must be concrete and particularized, actual or imminent, not hypothetical.” Id. at
304–05. Ashley pleaded that B&G voluntarily discarded his private information,
his American Express account has since been compromised as a result, and that he
has suffered “expenses for credit monitoring and identity theft insurance, out-of-
16 pocket expenses, anxiety, emotional distress, loss of privacy, and other economic
and non-economic harm.”
For the reasons B&G articulates, it may ultimately be determined at the
summary-judgment or trial stage that Ashley cannot present sufficient evidence of
a data breach, causation, or damages.4 But for purposes of our standing inquiry
here, we are not conducting a sufficiency review; rather, we look to see whether
Ashley, as an individual plaintiff, has articulated a sufficient harm that is subject to
redress. Heckman, 369 S.W.3d at 155 (plaintiff “must plead facts demonstrating
that he, himself (rather than a third party or the public at large), suffered the injury”
(emphasis added)). Because Ashley pleads a specific, redressable harm, the cases
relied upon by B&G concluding that the persons seeking class certification had not
alleged a sufficient and particularized harm to demonstrate individual standing are
inopposite. See Novak, 52 S.W.3d at 706 (plaintiff complaining of allegedly
misleading letter soliciting donations did not have standing because he did not
contribute money so he was not harmed); DaimlerChrysler Corp., 252 S.W.3d at
307 (plaintiffs lacked standing because allegations of risk of harm from alleged
4 Similarly, we note that “whether the named plaintiff is a proper class representative is not part of the standing inquiry,” Southwestern Bell Tel. Co., 308 S.W.3d at 919, and the corollary that determination that a particular plaintiff has standing to bring an individual claim is not a determination that plaintiff is a proper class representative. 17 manufacturing defect was so “extremely remote” that plaintiffs “cannot show more
than the merest possibility of injury to themselves”).
B&G also contends that “the fear of future fraudulent use of personal
information” is not a cognizable harm, and that “[f]ederal courts have rejected this
speculative alleged harm as being insufficient to confer standing because there is
no actual or imminent injury.” In support, it cites the following excerpt from a
Third Circuit case,
In this increasingly digitized world, a number of courts have had occasion to decide whether the “risk of future harm” posed by data security breaches confers standing on persons whose information may have been accessed. Most courts have held that such plaintiffs lack standing because the harm is too speculative. See Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046, 1051–1053 (E.D. Mo. 2009); see also Key v. DSW Inc., 454 F. Supp. 2d 684, 690 (S.D. Ohio 2006). We agree with the holdings in those cases. Here, no evidence suggests that the data has been—or will ever be—misused. The present test is actuality, not hypothetical speculations concerning the possibility of future injury. Appellants’ allegations of an increased risk of identity theft resulting from a security breach are therefore insufficient to secure standing. See Whitmore, 495 U.S. at 158, 110 S.Ct. 1717 (“[A]llegations of possible future injury do not satisfy the requirements of Art. III.”).
Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir. 2011).
Reilly involved allegations that an unknown hacker infiltrated Ceridian’s
payroll system and “potentially gained access to personal and financial information
belonging to [plaintiffs] and approximately 27,000 employees at 1,900
companies.” Id. at 40. It was “not known whether the hacker read, copied, or
18 understood the data.” Id. Ceridian sent notice of the breach to potential victims.
Id. Plaintiffs then sued, seeking class status and alleging that “they: (1) have an
increased risk of identity theft, (2) incurred costs to monitor their credit activity,
and (3) suffered from emotional distress.” Id. Before a motion to certify the class
was heard, the court granted Ceridian’s motion to dismiss for failure to state a
claim. Affirming that dismissal, the Third Circuit emphasized that the plaintiffs’
“contentions rely on speculation that the hacker: (1) read, copied, and understood
their personal information; (2) intends to commit future criminal acts by misusing
the information; and (3) is able to use such information to the detriment of
[plaintiffs] by making unauthorized transactions in [plaintiffs’] names.” Id.; see
also Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1053 (E.D. Mo. 2009)
(“Assuming plaintiff’s allegation of security breach to be true, plaintiff alleges that
he would be injured ‘if’ his personal information was compromised, and ‘if’ such
information was obtained by an unauthorized third party, and ‘if’ his identity was
stolen as a result, and ‘if’ the use of his stolen identity caused him harm. These
multiple ‘if’s’ squarely place plaintiff’s claimed injury in the realm of the
hypothetical.”).
Although B&G accurately quotes Reilly, the question of what a plaintiff
must allege to establish standing in data-breach cases is far from settled under
federal law. See, e.g., Amburgy, 671 F. Supp. 2d at 1051 (“Subsequent to the
19 Seventh Circuit’s decision in Pisciotta [v. Old Nat’l Bancorp, 499 F.3d 629 (7th
Cir. 2007) (holding plaintiffs’ allegation of increased risk of identity theft
conferred standing)], district courts have consistently determined that claims of
increased risk of identity theft resulting from security breaches sufficiently allege
an injury-in-fact to confer Article III standing to those persons bringing such
claims.”); see also Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012)
(recognizing that the federal “courts of appeals have evidenced some disarray
about the applicability of this sort of ‘increased risk’ theory in data privacy cases”
as it relates to standing).
In any event, unlike the plaintiff in Reilly, Ashley has alleged that his data
was actually misused.5 Compare Reilly, 664 F.3d at 44 (“Appellants have alleged
no misuse, and therefore, no injury”). We thus conclude that—even if Reilly’s
analysis concluding that the hypothetical threat of a data breach and identity theft
is insufficient to convey standing were applicable—the facts here are
distinguishable.
5 The Reilly court distinguished its facts from Krottner v. Starbucks Corp., 628 F.3d 1139, 1142 (9th Cir. 2010), a case in which a laptop containing encrypted employees’ information was stolen, and the plaintiff alleged that someone later unsuccessfully tried to open a bank account in the employee’s name with his social security number. Reilly, 664 F.3d at 44 (“[In] Krottner, the threatened harms were significantly more ‘imminent’ and ‘certainly impending’ than the alleged harm here.”). 20 Because we have concluded that Ashley pleadings are sufficient to establish
his individual standing, we overrule B&G’s first issue and turn to the question of
whether Ashley’s proposed class claims satisfy Rule 42.
II. Class Certification
Ashley’s request for class certification was premised on its repeated
assertion that “B&G has judicially admitted its legal obligations to give notice to
Class members of their actual and potential harms relating to the loss of personal
information, including social security numbers.” It contends that the “B&G has
judicially admitted all aspects of class treatment,” and that “the identity of the
Class Members, the theory of liability, and the relief sought here are all eminently
suitable for class treatment.” Alternatively, he argues that the trial court correctly
determined that his pleadings establish each element of class certification.
B&G contends that Ashley has not demonstrated commonality among
claims, and that the trial court erred in determining that commonality was
judicially admitted by B&G. B&G argues that Ashley presented no evidence in
support of its conclusory claim of commonality, and notes recent precedent under
Federal Rule of Civil Procedure 23 rejecting the premise that commonality of
claims can be decided on pleadings rather than evidence. Stukenberg v. Perry, 675
F.3d 832, 841 (5th Cir. 2012) (holding that district court erred in finding
commonality, where court’s discussion “contained no reference to any of the three
21 causes of action advanced on behalf of the proposed class, nor did the district court
‘look beyond the pleadings to understand the claims, defenses, relevant facts, and
applicable substantive law in order to make a meaningful determination” about
commonality). Finally, B&G argues that the trial court erred in not examining
possible dissimilarities within the proposed class. Wal-Mart v. Dukes, 131 S. Ct.
2541, 2551 (2011).
Relatedly, B&G contends that Ashley failed to demonstrate that his
individual claims are typical of the purported class, or that he can adequately
represent the class. See TEX. R. CIV. P. 42(a). “Typicality and adequacy of
representation are closely related, for demanding typicality on the part of the
representative helps insure her adequacy of representation.” Supportkids, Inc. v.
Morris, 167 S.W.3d 422, 425 (Tex. App.—Houston [14th Dist.] 2005, pet. dism’d
w.o.j.) (citing Horton v. Goose Creek Indep. Sch. Dist., 690 F.2d 470, 486 n.27
(5th Cir. 1982)). Just as circumstances unique to a particular plaintiff can destroy
commonality, “[o]rdinarily, the presence of even an arguable defense peculiar to
the named plaintiff destroys the typicality of the class.” Id. at 425–26 (citing Spera
v. Fleming, Hovenkamp & Grayson, P.C., 4 S.W.3d 805, 812 (Tex. App.—
Houston [14th Dist.] 1999, no pet.)).
22 A. Judicial Admission
We begin by examining Ashley’s contention, accepted by the trial court, that
B&G judicially admitted the facts necessary to render class certification
appropriate. Ashley contends that the “commonality prerequisite is easily met
here,” as “B&G itself has already admitted the legal question, namely its legal
duties under statutory (e.g. Chapter 521 of the Texas Business and Commerce
Code) and common law.”6 Specifically, Ashley cites section 521.053 of the Texas
Business and Commerce Code, entitled “Notification Required Following Breach
of Security of Computerized Data,” as the source of B&G’s duty to give such
notice, which it claims B&G has “judicially admitted”:
(a) In this section, “breach of system security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data . . . . (b) A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person . . . .
TEX. BUS. & COM. CODE ANN. § 521.053 (West Supp. 2013). This section is part
of the Texas’ Identity Theft Enforcement and Protection Act.
6 Ashley likewise contends that B&G’s own “petition acknowledges the typicality of the class members.” 23 According to Ashley, “B&G’s sworn pleading, supported by two affidavits,
one by its very own general counsel, admits that regardless of how its information
found its way into the dumpster, B&G had a legal duty to notify all those who
were impacted by the loss of data.” Thus, it argues, the “trial court class
certification order must be affirmed because (1) of the uncontroverted proof of
harm to the class representative (Ashley); (2) no dispute exists about B&G’s legal
obligations; and (3) B&G did not follow through with those legal obligations.”
Ashley cites the following statements as B&G’s “admissions”:
B&G’s Original Petition & Application for TRO:
“Although B&G believes that it did not discard any documents or CDs containing confidential information as alleged by Mr. Ashley, it determined it should assume that Mr. Ashley’s allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information.” “B&G sent Mr. Ashley a letter through his legal counsel requesting the immediate return of ‘all Bliss & Glennon CDs and other information that was found in the trash.’ B&G also requested ‘a list of people to whom the information referenced above was disclosed so that we can take action with respect to any information that has been disclosed.” “Mr. Ashley has refused to return the alleged CDs and purported confidential information to B&G so that B&G can ascertain the extent of the supposed data release and next course of action to protect further disclosure of such information.” “B&G also seeks the return of the information at issue, so that it can comply with the duties mandated by Texas’ Identity Theft Enforcement and Protection Act. The Act requires B&G to take ‘appropriate corrective action, to protect from unlawful use or
24 disclosure any sensitive personal information collected or maintained by the business in the regular course of business.’” “To date, Defendants have refused to permit B&G to comply with this law while at the same time complaining to B&G’s customers that B&G is doing nothing to comply. Unless the court enters the requested Temporary Restraining Order, B&G will be unable to take ‘appropriate corrective action’ as required by the Identity Theft Enforcement and Protection Act. In addition, B&G may be required to provide notice to all those who many have been harmed by the disclosure of the information at issue.” Affidavit in Support of Application for TRO (Vice-President, General Counsel, and Secretary of B&G’s Parent Company) “Although B&G believes it did not discard any documents or CDs containing confidential information, we determined we should assume that Mr. Ashley’s allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information. As a result we demanded return of the information allegedly found by Mr. Ashley in B&G’s trash.” Affidavit in Support of Application for TRO (B&G’s Regional Vice President) “Although B&G believes it did not discard any documents or CDs containing confidential information, it has determined it was ethically required to assume that Mr. Ashley’s allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information.” “A judicial admission is a formal waiver of proof that dispenses with the
production of evidence on an issue and bars the admitting party from disputing it.”
Sherman v. Merit Office Portfolio, Ltd., 106 S.W.3d 135, 140 (Tex. App.—Dallas
2003, pet. denied). As long as the statement stands unretracted, it must be taken as
true by the court and jury; it is binding on the declarant, and the declarant cannot
introduce evidence to contradict it. Lee v. Lee, 43 S.W.3d 636, 641 (Tex. App.—
25 Fort Worth 2001, no pet.). “Elements required for a judicial admission are: (1) a
statement made during the course of a judicial proceeding; (2) that is contrary to an
essential fact or defense asserted by the person making the admission; (3) that is
deliberate, clear, and unequivocal; (4) that, if given conclusive effect, would be
consistent with public policy; and (5) that is not destructive of the opposing party’s
theory of recovery.” Sherman, 106 S.W.3d at 140 (citing Lee, 43 S.W.3d at 641–
42; United States Fid. & Guar. Co. v. Carr, 242 S.W.2d 224, 229 (Tex. Civ.
App.—San Antonio 1951, writ ref’d)). It is the nature of an admission that by
intention it be an act of waiver, and not merely a statement of assertion or
concession, made for some independent purpose. United States Fid., 242 S.W.2d at
228.
“A judicial admission must be clear, deliberate, and unequivocal.” In re
Spooner, 333 S.W.3d 759, 764 (Tex. App.—Houston [1st Dist.] 2010, orig.
proceeding [mand. denied]) (citing Regency Advantage Ltd. P’ship v. Bingo Idea–
Watauga, Inc., 936 S.W.2d 275, 278 (Tex. 1996)). To determine whether a
statement is a judicial admission, it must be evaluated in context. Id.
Here, the petition and supporting affidavits containing what Ashley claims
are judicial admissions of B&G’s notification duties under Chapter 521 contain
additional statements making clear that B&G disputes Ashley’s entire version of
26 events and does not “disavow or otherwise abandon [its] general denial of
liability.” Id.
“Although B&G denied that such information could have been found as represented, B&G nonetheless requested the immediate return of such information; however, Mr. Ashley, through his legal counsel, refused to return the information.” “B&G makes a great effort to protect the integrity of all information in its possession. In addition, when B&G vacated the property owned by Mr. Ashley, it had a document disposal company waiting on-site to properly destroy copies of confidential information, if necessary, during the move.” “After conducting a thorough investigation regarding Mr. Ashley’s dumpster diving story, B&G determined that such confidential information could not have been disclosed as represented by Mr. Ashley, especially since: (1) B&G operates a virtually paperless workplace, (2) B&G’s policies prohibit confidential information from being stored onto portable storage devices, including CDs, (3) B&G did not burn confidential information onto CDs in the normal courts eo fits operations, (4) the kind of information reported was not the kind of information that would have been available or used by employees in their normal business operations, and (5) B&G disabled the CD drives of employee computers as soon as they were installed.” Among other things, the Texas Identity Theft Enforcement and Protection
Act (1) defines “personal identifying information” and “sensitive personal
information,” (2) imposed duties on certain types of businesses to implement and
maintain reasonable procedures for protecting certain information and, (3) requires
that notice be given to individuals if certain types of data are acquired by
unauthorized persons. TEX. BUS. & COM. CODE Ann. § 521.002–.053 (West 2009
& West Supp. 2013). B&G’s petition was filed after Ashley announced that it had
27 found items containing sensitive and/or confidential information belonging to
B&G in the dumpster and steadfastly refused to identify for B&G what the
materials were or return them. Given this fact, and taking all of the above
statements in context, B&G’s petition reveals nothing more than its desire to take a
prudent approach to ascertaining what data had been compromised, if any, and
protect and notify those impacted if necessary. B&G was not in a position to know
what materials, if any, would be covered by Chapter 521, much less unequivocally
commit to a legal duty to give anyone notice under that statute. Accordingly, we
conclude that—taking B&G’s statements in context—B&G did not judicially
admit that it committed a data breach, or that it is required to give a particular form
of notice.
The trial court accepted Ashley’s characterization of B&G’s acquiescence,
relying heavily on B&G’s “admissions” in deeming class certification appropriate.
For example, the court’s order states,
“B&G’s sworn Original Petition acknowledged its legal obligations to give notice to the Class Members. See, e.g., Shepherd v. Ledford, 962 S.W.2d 28, 33 (Tex. 1998) (stating by stipulating to the existence of a legal effect of acts the parties judicially admitted that conclusion).” “Any monetary relief . . . is incidental to the injunctive relief, which B&G has acknowledged it is obligated to perform.” “All Class claims for relief rest on the same elements: (a) B&G was in possession of the personal and other sensitive information belonging to Ashley and the Class; and (b) B&G failed to protect that information from disclosure and/or loss. Neither of the contentions is challenged by B&G. Indeed, the lynchpin of this case is that B&G has judicially 28 admitted both the fact of the disclosure and/or loss and its legal obligations to the Class.” “[T]his Court has reviewed B&G’s opposition to the Motion for Certification, which rested on a number of generalities, many of which rely on the merits-based allegation that Ashley is responsible for the data being found in the dumpster. Of course, B&G’s own sworn petition claims that for the purpose of its legal obligation to provide notice to hose individuals and business whose data was thrown away, it has assumed that Ashley did not take the information wrongfully, so B&G’s allegation is a non-starter. . . . . B&G’s erroneous challenge to the typicality requirement under Rule 42 rests on the same faulty reasoning.” “[B]eyond not raising the issue of [choice-of-law] in any meaningful way, B&G’s Original Petition presumed its obligation to give notice to those impacted by the data breach, without regard to whether the substantive law of multiple jurisdictions applied.” “No issues of law or fact would affect only individual Class Members due to the fact all Class members are entitled to receive notice of the data breach and B&G has acknowledged that fact.” “The issue that will be the object of most of the efforts of the litigants and the Court will be determination of the measures required to protect the Class Members from future harm from the data breach.” “This matter can be resolved in a unitary proceeding and in the following manner: As noted earlier, B&G has acknowledged its obligation to give notice to the Class members and an order is appropriate to compel B&G to give notice of the data breach and the remedies afforded the Class members. Accordingly, and pursuant to Texas Rule of Procedure 42(b)(2), this Court exercises its discretion and orders that within 60 days of the date of this Order, that B&G issue, at its own expense, a Class Notice, as approved by this Court.” There are two primary flaws in the trial court’s reliance on what it
characterizes as B&G’s admissions. First, as explained above, B&G did not
judicially admit its duty to give notice under Chapter 521. Second, even if B&G
were required to give notice under Chapter 521 (an issue not before us), the court’s
29 order erroneously conflates section 521 notice with the class notice provided under
Rule 42 of the of the Texas Rules of Civil Procedure.
Chapter 521 imposes a notice obligation, under certain circumstances, on a
person or business responsible for disclosure of particular types of third-party
sensitive information to an unauthorized person. TEX. BUS. & COM. CODE ANN. §
521.053. In contrast, Rule 42 imposes an obligation on the party seeking class
treatment for its claims to provide individual notice and certain information about
the claims and class to each identifiable member of that class at the expense of the
party seeking class certification. Am. Express Travel Related Servs. Co., Inc. v.
Walton, 883 S.W.2d 703, 709 (Tex. App.—Dallas 1994, no pet.) (“[R]ule 42’s
plain language requires the party claiming the class to provide notice to class
members. TEX. R. CIV. P. 42(c)(2). We interpret this directive to include paying
the costs of notice.”).
The person responsible for notice under section 521.053 and rule 42 is
different, the contents and purpose of the notice under section 521.053 and rule 42
is different, the stage in the proceedings for giving notice under section 521.053
and rule 42 is different, and the appropriate person to bear the cost of notice under
section 521.053 and rule 42 is different. The trial court’s determination that an
obligation to give notice under section 521.053 equates to an obligation to give
Class Notice under rule 42 was thus erroneous.
30 B. Evidence of Commonality, Typicality and Adequacy of Representation
Having rejected the argument that Ashley was excused from meeting his
burden to satisfy the requisite prerequisites to class certification by B&G’s alleged
judicial admission, we examine the record and the trial court’s class certification
order to determine if the evidence demonstrates that class certification was
appropriate. See Riemer v. State, 392 S.W.3d 635, 639 (Tex. 2012) (court must
“apply a rigorous analysis to determine” if class certification requirements have
been satisfied). Because the evidence does not affirmatively demonstrate
commonality or typicality of claims, and because the unique relationship and
background between B&G and Ashley renders him inadequate to represent a class,
we conclude that the trial court erred in certifying a class and appointing Ashley as
class representative.
The parties’ briefing contains various and conflicting characterizations about
the data allegedly found in the dumpster, but there is no evidence about the actual
data in the record from which commonality could be assessed. Ashley’s motion
contains one sentence in support of commonality—i.e., “The vast majority of the
Class members are made up of employees of B&G and its predecessors, hence the
confidential and fiduciary relationship between the Class and B&G is beyond
dispute.” The court’s order likewise does not cite evidence, but refers only to
Ashley’s allegations regarding commonality, stating: “Ashley alleged facts that
31 give rise to common questions of both fact and law that are central to the Class
members’ claims. These include B&G’s failure to adequately protect their
information and the resulting harm.”
The trial court was required to look beyond Ashley’s pleaded facts in
assessing commonality. E.g., Wal-Mart Stores, 131 S. Ct. at 2551 (interpreting
federal Rule 23 governing class actions).7 It could not do so on this record, as
there is no evidence about the members of the proposed class, or about their
circumstances, their information compromised, or their possible injury. Moreover,
the trial court is required to assess potential dissimilarities within the class in
determining commonality. Id. B&G cites potential dissimilarities that both
demonstration a potential lack of commonality, and exemplify why, even if the
record were more developed, Ashley cannot establish typicality or adequacy of
representation.
B&G notes potential dissimilarities that include “(1) class members residing
in different states with different laws, (2) class members who have not suffered the
sort of consequential damages that Ashley seeks, such as out-of-pocket damages
and/or emotional distress; (3) class members who want to file claims against
Ashley and Langston for their actions; and (4) class members who, in contrast to
7 “Because Rule 42 is patterned after Federal Rule of Civil Procedure 23, federal decisions and authorities interpreting current federal class action requirements are instructive.” Riemer, 392 S.W.3d at 640. 32 Ashley’s allegations, have not experienced any actual fraudulent activity with their
accounts or identity.” B&G cites similar consideration in asserting that typicality
of claims is lacking, and that Ashley cannot adequately represent the class: “(1)
Ashley is subject to a unique defense; (2) Ashley has a bitter and litigious history
with B&G; and (3) Ashley has conflicts with the class members that go to the heart
of this litigation.”
Ashley is a former employee who has been accused of poaching employees
from B&G, including Langston (the former B&G employee who allegedly found
the data at issue in the dumpster). The parties have been in prior litigation over the
use and control of business data. Ashley now runs a business in direct competition
with B&G. B&G’s contends that, by his own admission, Ashley violated laws in
having Langston allegedly retrieve items from the trash dumpster, and that Ashley
is in fact the one responsible for the information falling into third parties’ hands.
B&G has pending claims against Ashley claiming that he wrongfully used B&G’s
confidential information to interfere with its relationships with customers.
Ashley’s claims cannot be typical, given that one of the issues to be resolved
by the factfinder is how the alleged missing data came to be in Ashley’s hands.
For the same reasons, he cannot be said to “fairly and adequately protect the
interests of the class” members (who would have claims against Ashley under
B&G’s theory of the case). Emp’rs Cas. Co. v. Tex. Ass’n of Sch. Bds. Workers’
33 Comp. Self-Ins. Fund, 886 S.W.2d 470, 475 (Tex. App—Austin 1994, writ dim’s
w.o.j.) (“[T]he interests of the class representatives must not be antagonistic to
those of the rest of the class. In this sense, this issue is often collapsed into the
typicality analysis.”); see also E&V Slack, Inc. v. Shell Oil Co., 969 S.W.2d 565,
568 (Tex. App.—Austin 1998, no pet.) (in suit against Shell Oil Co., named
representatives—who were former Shell dealers that currently own stations that
compete with Shell—could not adequately represent current Shell dealers).
CONCLUSION
The trial court certified a nationwide class action, relying in large part on
what it deemed a judicial admission by B&G of liability and duty to give class
notice. We reject the argument that B&G judicially admitted liability, and hold
that Ashley has not presented any evidence demonstrating commonality or
typicality, or that Ashley could fairly and adequately protect the interest of the
class. We sustain B&G’s second issue, reverse the trial court’s class certification
order, and remand for further proceedings.
Sherry Radack Chief Justice
Panel consists of Chief Justice Radack and Justices Bland and Huddle. 34