IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION
MICHAEL BRIGGS, on behalf of himself and all others similarly situated, CIVIL ACTION FILE NO.
1:22-CV-03640-SCJ Plaintiff,
v.
THE NORTH HIGHLAND COMPANY,
Defendant.
ORDER This matter appears before the Court on the Motion to Dismiss Plaintiff’s First Amended Class Action Complaint filed by Defendant North Highland Company (Doc. No. [33]). The basis of the Motion concerns standing and failure to state a claim for the causes of action in the Amended Complaint arising from a data breach of an employer’s database. Id.1
1 All citations are to the electronic docket unless otherwise noted, and all page numbers are those imprinted by the Court’s docketing software. I. BACKGROUND On June 20, 2023, Plaintiff Michael Briggs filed a First Amended Class Action Complaint in which he asserts that he was a victim of a data breach caused by the negligence of Defendant, North Highland Company (“North Highland”).
Doc. No. [32]. The factual allegations of the Amended Complaint are that Plaintiff was employed by North Highland as an associate Vice President from October 2018
until September 2019. Doc. No. [32], ¶ 5. Plaintiff further alleges that hackers executed a ransomware attack, which North Highland discovered on June 6, 2022 and that “the hackers exfiltrated files containing personal information of current and former North Highland employees.” Id. ¶¶ 13–14. “The information that the
hackers exfiltrated includes: names, national insurance numbers, social security numbers, tax numbers, addresses, bank account numbers and other payroll information, personal phone and email addresses, dates of birth, benefits
information, background check and employment screening information, performance related records, health-related information, and other employment- related information.” Id. ¶ 14.
2 Plaintiff alleges that it is “likely” criminals are creating “Fullz” packages2 of his (and the proposed class members’) stolen personal identification information (PII)3 and selling those packages to unscrupulous operators or criminals (such as illegal and scam telemarketers). Doc. No. [32], ¶ 55. Plaintiff
also states that “[a]ccording to experts, one out of four data breach notification recipients become a victim of identity fraud.” Id. ¶ 49. Plaintiff states that “it is reasonable for any trier of fact, including this Court or a jury, to find that
Plaintiff’s and other members of the proposed Class’s stolen PII is being misused, and that such misuse is fairly traceable to the data breach.” Id. at 55. Plaintiff alleges that he has suffered a loss of time as he has “spent significant time monitoring his accounts and credit score.” Id. ¶ 41. He alleges
actual injury “in the form of damages to, and diminution in, the value of his PII.” Id. ¶ 42. Plaintiff also alleges inter alia that he “has suffered imminent and
2 As stated in the Amended Complaint, “Fullz” “is fraudster speak for data that includes the information of the victim, including, but not limited to, the name, address, credit card information, social security number, date of birth, and more.” Doc. No. [32], ¶ 53. 3 At times the Amended Complaint utilizes both the abbreviation “PII” and the abbreviation “PHI,” to refer to the personal identification information at issue. For purposes of this Order, the Court utilizes the abbreviation, PII, to refer to the personal identification information at issue. 3 impending injury arising from the substantially increased risk of fraud, identity theft, and misuse resulting from his PII, especially his Social Security number, being placed in the hands of criminals.” Id. ¶ 44. Plaintiff also states that he has “suffered . . . annoyance, interference, and inconvenience as a result of the data
breach and has anxiety and increased concerns for the loss of his privacy.” Id. ¶ 43. In the Amended Complaint, Plaintiff asserts the following causes of action:
(1) negligence (Count 1); negligence per se (Count 2); breach of contract (Count 3 and in the alternative to Counts 1 and 2). Id. ¶¶ 78–102. On June 30, 2023, Defendant filed its Motion to Dismiss Plaintiff’s Amended Class Action Complaint (“Complaint,” Doc. No. [33]). The Motion has
been fully briefed (Doc. Nos. [36]; [37]) and is now ripe for review. II. LEGAL STANDARD A. Motion to Dismiss Under Fed. R. Civ. P. 12(b)(1)
“Subject matter jurisdiction defines the court’s authority to hear a given type of case; it represents the extent to which a court can rule on the conduct of persons or the status of things.” Carlsbad Tech., Inc. v. HIF Bio, Inc., 556 U.S. 635, 639 (2009) (internal quotations and citations omitted). A party may therefore
4 challenge the Court’s subject matter jurisdiction by filing a motion pursuant to Federal Rule of Civil Procedure 12(b)(1). See Fed. R. Civ. P. 12(b)(1). A motion to dismiss for lack of subject matter jurisdiction may be either a “facial” or “factual” attack. Morrison v. Amway Corp., 323 F.3d 920, 924 n.5 (11th
Cir. 2003) (citation omitted). “Facial attacks challenge subject matter jurisdiction based on the allegations in the complaint, and the district court takes the allegations as true in deciding whether to grant the motion.” Id. “Factual attacks
challenge subject matter jurisdiction in fact, irrespective of the pleadings.” Id. When resolving a factual challenge to subject matter jurisdiction, the Court may consider extrinsic evidence such as testimony and affidavits. Id. In the case sub judice, it appears that Defendant is bringing a facial attack.
B. Motion to Dismiss Under Fed. R. Civ. P. 12(b)(6) Federal Rule of Civil Procedure 8(a) requires a complaint to contain a “short and plain statement of the claim showing that the pleader is entitled to
relief.” Fed. R. Civ. P. 8(a)(2). Pleadings do not require any particular technical form and must be construed “so as to do justice.” Fed. R. Civ. P. 8(d)(1), (e). Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss a complaint for failure to state a claim upon which relief may be granted.
5 See Fed. R. Civ. P. 12(b)(6). When considering a Rule 12(b)(6) motion to dismiss for failure to state a claim, the Court accepts the factual allegations made in the complaint as true and construes them in the light most favorable to the plaintiff. Speaker v. U.S. Dep’t. of Health & Human Servs. Ctrs. for Disease Control &
Prevention, 623 F.3d 1371, 1379 (11th Cir. 2010). As the purpose of Rule 8(a) is simply to provide notice to the defendants of the nature of the claims and the grounds on which those claims rest, pleadings
are generally given a liberal reading when addressing a motion to dismiss. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555-56 (2007). A complaint will be dismissed for failure to state a claim only if the facts as pled do not state a claim that is plausible on its face. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Twombly, 550 U.S.
at 555–56. In order to state a plausible claim, a plaintiff need only plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “[W]hile notice
pleading may not require that the pleader allege a specific fact to cover every element or allege with precision each element of a claim, it is still necessary that a complaint contain either direct or inferential allegations respecting all the
material elements necessary to sustain a recovery under some viable legal 6 theory.” Fin. Sec. Assur., Inc. v. Stephens, Inc., 500 F.3d 1276, 1282–83 (11th Cir. 2007) (quotations omitted). As long as the facts alleged create a reasonable expectation that discovery will reveal evidence of the necessary elements, a plaintiff’s suit should be allowed to continue. Twombly, 550 U.S. at 556; Watts v.
Fla. Int’l Univ., 495 F.3d 1289, 1295–96 (11th Cir. 2007). III. ANALYSIS The Court will begin its analysis by focusing on the standing arguments,4
followed by consideration of the failure to state a claim arguments of the Parties. A. Standing In its Motion, Defendant argues that Plaintiff cannot establish Article III standing. Doc. No. [33-1]. More specifically, Defendant argues that Plaintiff’s
allegations are legally insufficient to establish an injury-in-fact as Plaintiff “has not alleged that he or any class member has been the victim of identity theft as a result of North Highland’s data incident.” Doc. No. [33-1], 14. Defendant argues
that Plaintiff’s alleged risk of future harm (i.e., Plaintiff’s allegations of lost time
4 Because it is jurisdictional and implicates the authority of a federal court to decide a case, this Court must consider standing first. Rojas v. City of Ocala, 40 F. 4th 1347, 1350 (11th Cir. 2022). 7 and expended efforts, diminished value in his PII, and alleged “severe privacy injury”) do not constitute injuries in fact. Id. at 6–14. In support of its argument, Defendant relies upon the Supreme Court’s recent opinion in TransUnion LLC v. Ramirez, --- U.S. ----, 141 S. Ct. 2190 (2021),
Doc. No. [33-1], 14, which “drilled down on what a plaintiff must show to establish that an alleged intangible harm is a concrete injury.” Hunstein v. Preferred Collection & Mgmt. Servs., Inc., 48 F.4th 1236, 1241 (11th Cir. 2022) (en
banc). Defendant argues that “TransUnion’s holding regarding claims of future harm means that a plaintiff’s claims of an increased risk of identity theft in the future in a data breach suit do not constitute injuries-in-fact.” Doc. No. [33-1], 15. Defendant argues in the alternative that “[e]ven if a risk of future harm
could constitute an injury-in-fact and confer Article III standing in the wake of TransUnion, Plaintiff has failed to plead facts to ‘establish a sufficient risk of future harm.’” Id. at 16 (citing TransUnion, 141 S. Ct. at 2211–12) (emphasis
omitted). Defendant argues that Plaintiff’s resort to generic reports in the Amended Complaint “about the dangers of data breaches to consumers does nothing to clarify the risks to Plaintiff in this case and, therefore, does not rise to
the level of an injury-in-fact.” Doc. No. [33-1], 17 (citations omitted). Defendant 8 relies on the data breach case of Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332 (11th Cir. 2021) in support of this argument.5 In response, Plaintiff argues that a plaintiff always has standing to bring a traditional recognized common-law claim. Doc. No. [36], 12. Plaintiff also asserts
that he has standing because his common-law claims are traditionally recognized causes of action. Doc. No. [36], 11. Plaintiff argues that this is true regardless of whether he also satisfies the test articulated in TransUnion LLC, 141 S. Ct. at 2190,
because of the Eleventh Circuit’s recent clarification of the inapplicability of the TransUnion test to common law causes of action in Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 890 n.9 (11th Cir. 2023).6 Plaintiff asserts that “injuries to rights
5 The plaintiff in Tsao “alleged that hackers may have accessed and stolen customer credit card data ‘including the cardholder name, the account number, expiration date, card verification value (‘CVV’), and PIN data for debit cards.’” Tsao, 986 F.3d at 1343. The Eleventh Circuit held that the plaintiff, who had not suffered any misuse of his information, “lack[ed] Article III standing because he [could not] demonstrate that there [was] a substantial risk of future identity theft—or that identity theft [was] certainly impending—and because he [could not] manufacture standing by incurring costs in anticipation of non-imminent harm.” Id. at 1345. 6 In note 9 of the Green-Cooper case, the Eleventh Circuit stated: We decided Tsao before TransUnion was published, but we see the two as consistent. TransUnion established that a common-law analogue analysis is required when plaintiffs allege a statutory violation. We did not conduct that analysis in Tsao in the context of a state common-law negligence
9 recognized at common law—property, contracts, and torts—have always been sufficient for standing purposes.” Doc. No. [36], 14 (cleaned up) (citations omitted). Plaintiff also argues that “the Supreme Court has never purported to eliminate the traditional understanding that parties have standing to litigate
common law claims in federal court.” Id. at 15. Plaintiff also clarifies that he suffered two concrete injuries-in-fact: “(1) a privacy injury, which has already
claim. See TransUnion, 141 S. Ct. at 2208. But we think that the common-law analogue analysis is sui generis to legislature-made statutory violations because the Supreme Court has not applied it to any other kind of intangible harm. For instance, constitutional harms, reputational harms, informational harms, and stigmatic harms are all intangible injuries that give rise to Article III standing, and the Supreme Court has never conducted the common-law analogue analysis in determining whether these kinds of harms establish Article III standing. See Church of the Lukumi Babalu Aye, Inc. v. City of Hialeah, 508 U.S. 520, 531, 113 S. Ct. 2217, 2225, 124 L.Ed.2d 472 (1993) (infringement of free exercise); Meese v. Keene, 481 U.S. 465, 473, 107 S. Ct. 1862, 1867, 95 L.Ed.2d 415 (1987) (reputational harms); TransUnion, 141 S. Ct. at 2214 (identifying informational injuries as intangible harms); Laufer, 29 F.4th at 1272–73 (recognizing that under Supreme Court precedent both stigmatic and emotional harms have sufficed to establish Article III standing). So, we adhere to the reasoning of Tsao today. See United States v. Gillis, 938 F.3d 1181, 1198 (11th Cir. 2019) (explaining the prior panel precedent rule).
Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 890 n.9 (11th Cir. 2023). 10 occurred, and stems from the improper disclosure of sensitive information; and (2) a substantial risk of identity theft.” Id. at 11. Plaintiff further argues that the Eleventh Circuit has clarified since the Tsao opinion that actual identity theft is not required. Doc. No. [36], 25 (citing In re Equifax Inc. Customer Data Sec.
Breach Litig., 999 F.3d 1247, 1262–63 (11th Cir. 2021)). In reply, Defendant asserts that Plaintiff has made “law review-like pontifications of what the law out to be,” as opposed to relying upon Supreme
Court precedent. Doc. No. [37], 7. While Plaintiff’s argument regarding standing and traditionally recognized common-law claims has a basis in the Green-Cooper case, in the interest of caution, the Court will apply the modern standing jurisprudence, as
follows. “Standing ‘is the threshold question in every federal case, determining the power of the court to entertain the suit.’” CAMP Legal Def. Fund, Inc. v. City of
Atlanta, 451 F.3d 1257, 1269 (11th Cir. 2006) (quoting Warth v. Seldin, 422 U.S. 490, 499 (1975)). Article III of the United States Constitution limits the courts to hearing actual “Cases” and “Controversies.” U.S. Const. Art. III § 2; see also
Lujan v. Defs. of Wildlife, 504 U.S. 555, 559–60 (1992). Standing is typically 11 determined by analyzing the plaintiff’s situation as of the time the complaint is filed, and subsequent events do not alter standing. Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1275 (11th Cir. 2003) (collecting authorities); Johnson v. Bd. of Regents of Univ. of Ga., 263 F.3d 1234, 1267 (11th
Cir. 2001); Charles H. Wesley Educ. Found., Inc. v. Cox, 408 F.3d 1349, 1352 n.3 (11th Cir. 2005). To establish standing, a plaintiff must show three things:
First, the plaintiff must have suffered an “injury in fact”—an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical. Second, there must be a causal connection between the injury and the conduct complained of—the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court. Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.
Lujan, 504 U.S. at 560–61 (internal quotations, citations, and alterations omitted).7
7 “These principles apply with no less force in the class-action context . . . ‘Thus, it is well-settled that prior to the certification of a class . . . . . the district court must determine that at least one named class representative has Article III standing to raise each class subclaim.’” Williams v. Reckitt Benckiser LLC, 65 F.4th 1243, 1253 (11th Cir. 2023) (citing Prado-Steiman ex rel. Prado v. Bush, 221 F.3d 1266, 1279 (11th Cir. 2000)). 12 “The party invoking federal jurisdiction bears the burden of establishing these elements.” Id. at 561. The burden by which a plaintiff must show these elements depends upon the stage of litigation at which it is challenged. Id.; see also CAMP Legal Def. Fund, 451 F.3d at 1269.8 At the motion-to-dismiss stage,
“general factual allegations of injury resulting from the defendant’s conduct may suffice” as there is a presumption that such general allegations are based on specific facts necessary to support the claim. Lujan, 504 U.S. at 561; see also
Hunstein, 48 F.4th at 1241 (“[A]t the motion-to-dismiss stage, a plaintiff must allege facts that, taken as true, ‘plausibly’ state that the elements of standing are met.”); Tsao, 986 F.3d at 1337 (“A plaintiff at the pleading stage, as the party invoking federal jurisdiction, bears the burden of establishing these elements [of
standing] by alleging facts that ‘plausibly’ demonstrate each element.”). The Court begins with injury in fact, as said element is the focus of Defendant’s pending motion. As held by the Eleventh Circuit, “[a]t the pleading
stage, ‘general factual allegations of injury’ are enough.” Tsao, 986 F.3d at 1337.
8 “Plaintiffs ‘must demonstrate standing for each claim that they press and for each form of relief that they seek.’” Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 371–72 (1st Cir. 2023) (citations omitted). 13 “[A] plaintiff must set forth general factual allegations that ‘plausibly and clearly allege a concrete injury,’ and that injury must be ‘actual or imminent, not conjectural or hypothetical.” Tsao, 986 F.3d at 1337–38 (Thole v. U. S. Bank N.A, ––– U.S. ––––, 140 S. Ct. 1615, 1621 (2020)).
The injury-in-fact requirement ensures that persons involved in the litigation have a direct stake in its outcome. Arcia v. Fla. Sec’y of State, 772 F.3d 1335, 1340 (11th Cir. 2014). Therefore, the injury must be particularized (affecting
the plaintiff in a personal way) and concrete (actual as opposed to abstract). Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016). “An injury is ‘particularized’ if it ‘affect[s] the plaintiff in a personal and individual way.’” Pedro v. Equifax, Inc., 868 F.3d 1275, 1279 (11th Cir. 2017) (quoting Spokeo, 578 U.S. at 339). “An injury
is concrete if it actually exists—that is, if it is ‘real, and not abstract.’” Hunstein, 48 F.4th at 1242. Harms can be tangible or intangible and meet the “concrete and particularized” criteria. Id. at 1549. Likewise, harms can be direct or indirect.
Focus on the Family, 344 F.3d at 1273 (citing Vill. of Arlington Heights v. Metro. Hous. Dev. Corp., 429 U.S. 252, 260–61 (1977)).
14 Under the holding in TransUnion, “[i]n a suit premised on the ‘mere risk of future harm’—that is, where the alleged injury-in-fact is ‘imminent’ rather than ‘actual’—[the Court] must also consider the type of relief sought.” Clemens v. ExecuPharm Inc., 48 F.4th 146, 155 (3d Cir. 2022) (citing TransUnion LLC, 141 S.
Ct. at 2210-11). “Where the plaintiff seeks injunctive relief, the allegation of a risk of future harm alone can qualify as concrete as long as it ‘is sufficiently imminent and substantial.’” Id. 9 “However, where the plaintiff seeks only damages,
something more is required. Specifically, that plaintiff can satisfy concreteness where ‘the exposure to the risk of future harm itself causes a separate concrete
9 The concept of imminence is “somewhat elastic,” and only requires “that the anticipated injury occur with[in] some fixed period of time in the future.” Fla. State Conf. of NAACP v. Browning, 522 F.3d 1153, 1161 (11th Cir. 2008). Therefore, “probabilistic harm is ‘enough injury in fact to confer . . . standing in the undemanding Article III sense.’” 522 F.3d at 1163 (quoting Tenn. Valley Auth. v. U.S. Envtl. Protection Agency, 278 F.3d 1184, 1207 (11th Cir. 2002)). “While this standard does not require a plaintiff to show that it is ‘literally certain that the harms they identify will come about,’ it, at the very least, requires a showing that there is a ‘substantial risk’ that the harm will occur.” Tsao, 986 F.3d at 1338–39 (quoting Clapper, 568 U.S. at 414 n.5). The Eleventh Circuit has also distilled the following two legal principles from a review of standing jurisprudence: (1) “a plaintiff alleging a threat of harm does not have Article III standing unless the hypothetical harm alleged is either ‘certainly impending’ or there is a ‘substantial risk’ of such harm;” (2) “if the hypothetical harm alleged is not ‘certainly impending,’ or if there is not a substantial risk of the harm, a plaintiff cannot conjure standing by inflicting some direct harm on itself to mitigate a perceived risk.” Tsao, 986 F.3d at 1339 (quoting Clapper, 568 U.S. at 409, 414 n.5; Muransky, 979 F.3d at 931).
15 harm.’” Id. “The Supreme Court did not reach the question of what separate harms might qualify as concrete to support a substantial-risk theory of future harm in an action for damages, but it did indicate that ‘a plaintiff’s knowledge that he or she is exposed to a risk of future . . . . harm could cause its own current
emotional or psychological harm,’ which could be sufficiently analogous to the tort of intentional infliction of emotional distress.” Id. (citing TransUnion LLC, 141 S. Ct. at 2221 n.7).
In the case sub judice, Plaintiff seeks both injunctive relief and damages. See Doc. No. [32], ¶¶ 4, 77. Here, the Court assumes without deciding the matter of actual privacy injury, 10 as Plaintiff has plausibly alleged imminent injury—which is enough to
move this case past the pending motion to dismiss. More specifically, Plaintiff has plausibly alleged that the hack and the nature of the information alleged to have been stolen (i.e., names, national insurance numbers, social security
numbers, tax numbers, addresses, bank account numbers and other payroll information, personal phone and email addresses, dates of birth, benefits
10 Said arguments can be re-raised (and briefed more fully) at the dispositive motions phase of the case. 16 information, background check and employment screening information, performance related records, health-related information, and other employment- related information) raises a substantial risk of identity theft. See In re Equifax, 999 F.3d at 1262 (“Given the colossal amount of sensitive data stolen, including
Social Security numbers, names, and dates of birth, and the unequivocal damage that can be done with this type of data, we have no hesitation in holding that [p]laintiffs adequately alleged that they face a ‘material’ and ‘substantial’ risk of
identity theft that satisfies the concreteness and actual-or-imminent elements.”). And Plaintiff has pointed to expert opinion that “one out of four data breach notification recipients become a victim of identity fraud.” Doc. No. [32], ¶ 49. This rate supports the conclusion that the breach here presents a substantial risk that
Plaintiff will suffer unauthorized use of his PII as the Eleventh Circuit has recognized that “it is possible that some breaches may present a greater risk of identity theft than others.” Tsao, 986 F.3d at 1343.
In sum, Plaintiff has plausibly pled (for purposes of the injunctive relief that he seeks) that the risk of future harm is sufficiently imminent and substantial. As for the portion of the Amended Complaint in which he seeks damages, the
Court finds that Plaintiff’s allegations that his knowledge of the substantial risk 17 of identity theft causes him to presently experience emotional distress satisfies the standing inquiry. See Clemens, 48 F.4th at 156 (“[I]f the plaintiff’s knowledge of the substantial risk of identity theft causes him to presently experience emotional distress or spend money on mitigation measures like credit monitoring
services, the plaintiff has alleged a concrete injury.”); see also Doc. No. [32], ¶ 43. Without more, the Court is unable to uphold Defendant’s arguments that the Supreme Court’s holding in the TransUnion case regarding claims of future
harm “means that a plaintiff’s claims of an increased risk of identity theft in the future in a data breach suit do not constitute injuries-in-fact.” Doc. No. [33-1], 15. The Court does so because the Eleventh Circuit has specifically held that “evidence of actual misuse is not necessary for a plaintiff to establish standing
following a data breach.” Tsao, 986 F.3d at 1343. And the Court remains bound by this Eleventh Circuit holding, post-TransUnion, absent clear indication that the Supreme Court and the Eleventh Circuit have struck down this holding. See
McGinley v. Houston, 361 F.3d 1328, 1331 (11th Cir. 2004) (“A circuit court’s decision binds the district courts sitting within its jurisdiction while a decision by the Supreme Court binds all circuit and district courts.”) (citations omitted). And
18 the Eleventh Circuit has recently stated that it views the TransUnion and Tsao cases as consistent. Green-Cooper, 73 F.4th at 890 n.9. Plaintiff having plausibly pled that he faces a substantial risk of future harm, the steps Plaintiff alleges to have taken to monitor his credit for fraudulent
activity also plausibly establish an injury in fact. See In re Mednax Servs., Inc., Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183, 1201 (S.D. Fla. 2022) (“In other words, any steps plaintiffs take to monitor their credit or financial
statements for fraudulent activity establish an injury in fact only if plaintiffs have shown that they face a substantial or certainly impending threat of future harm.”). The Eleventh Circuit has held that concrete injuries include “not only straightforward economic injuries, like lost money, but also more nebulous ones,
like wasted time, missed credit opportunities, and emotional distress.” Walters v. Fast AC, LLC, 60 F.4th 642, 648 (11th Cir. 2023) (cleaned up) (quoting Tsao, 986 F.3d at 1338); see also Losch v. Nationstar Mortg. LLC, 995 F.3d 937, 943 (11th Cir.
2021) (“[T]here is no question that wasted time is a concrete harm . . . .”). 11
11 The Court recognizes that Plaintiff’s Amended Complaint also contains a diminution in value injury allegation. The Court aligns with the persuasive authority that rejects the plausibility of such an allegation as establishing injury. See Legg v. Leaders Life Ins. Co., 574 F. Supp. 3d 985, 994 (W.D. Okla. 2021) (“Plaintiff also asserts that he has suffered an
19 Next, the Court considers causation and redressability. At the pleading stage, the causation and redressability requirements are easily satisfied where the facts alleged indicate a “fairly traceable” link to the defendants’ conduct and the potential for redress of the injury. See Ga. Latino All. for Hum. Rights v.
Governor, 691 F.3d 1250, 1260 (11th Cir. 2012). In evaluating Article III causation, something less than proximate cause is required. Focus on the Family, 344 F.3d at 1272. “[E]ven harms that flow indirectly from the action in question can be said
to be ‘fairly traceable’ to that action for standing purposes.” Id. Finally, a plaintiff must properly plead that it is likely as opposed to merely speculative that a favorable court decision will redress the injury. Lujan, 504 U.S. at 561. Here, the Amended Complaint contains facts that indicate a fairly traceable link to
Defendant’s conduct and the potential for redress of the injury. Attias v. Carefirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017) (“Because we assume, for purposes of the standing analysis, that plaintiffs will prevail on the merits of their claim that
[defendant] failed to properly secure [plaintiffs’] data and thereby subjected
injury in the form of diminution in value of his personal identifying information because of the data breach. Assuming personal identifying information has a monetary value, [p]laintiff fails to allege that he attempted to sell his personal information and was forced to accept a decreased price.”). 20 them to a substantial risk of identity theft, we have little difficulty concluding that their injury in fact is fairly traceable to [plaintiff].”). B. Failure to State a Claim Having found standing to be plausibly pled, the Court now considers the
failure to state a claim arguments. In its Motion, Defendant argues that Plaintiff fails to state a claim upon which relief can be granted as to the negligence, negligence per se, and breach of contract counts. Doc. No. [33-1].
1. Negligence In Count I of Plaintiff’s Amended Complaint, he alleges a cause of action for negligence. Doc. No. [32], 21. Plaintiff alleges that Defendant owed a duty to reasonably safeguard data that Plaintiff and the Class entrusted to it in the scope
of their employment and breached that duty. Id. Defendant argues that Plaintiff’s negligence claim fails for the following reasons: (1) “Plaintiff has alleged zero facts suggesting there was a breach of any
duty that North Highland purportedly owed Plaintiff—instead, Plaintiff appears to assert that a data breach by cybercriminals is ipso facto evidence of negligence;” and (2) Plaintiff has not suffered any cognizable injury or damage. Doc. No. [33-1], 23.
21 “It is well established that to recover for injuries caused by another’s negligence, a plaintiff must show four elements: a duty, a breach of that duty, causation and damages.” Goldstein, Garber & Salama, LLC v. J.B., 300 Ga. 840, 841, 797 S.E.2d 87, 89 (2017) (citations omitted). 12
As indicated above, Defendant argues that “Plaintiff has failed to supply factual allegations showing how North Highland breached any duty that might have been owing.” Doc. No. [33-1], 24. Defendant argues that Plaintiff has only
generally speculated and provided “a laundry list of generalized ways in which North Highland might have breached its duty to provide reasonable data security.” Id. at 25. Defendant argues that Plaintiff’s Amended Complaint contains “threadbare allegations” that “are conclusory and too general to provide
the Court with meaningful guidance.” Id. In response, Plaintiff points to paragraphs 23–31 of the Amended Complaint, which contains allegations that Defendant failed to implement
cybersecurity protocols that it recommended to its clients and paragraphs 32–33
12 In their briefing, the parties applied Georgia law. This Court will as well. See Frank v. Drury Hotels Co., LLC, No. 21-13166, 2022 WL 4007805, at *1 (11th Cir. Sept. 2, 2022) (“A federal court sitting in diversity will apply the conflict-of laws rules of the forum state.”); Dowis v. Mud Slingers, Inc., 279 Ga. 808, 816, 621 S.E.2d 413, 419 (2005) (“The rule of lex loci delicti remains the law of Georgia.”). 22 of the Amended Complaint, which contains data security safeguards identified by Federal Trade Commission. Doc. No. [36], 25–26. Plaintiff also relies (by analogy) upon the foreseeability language from the Eleventh Circuit’s Ramirez holding in which the Court stated that the court “cannot expect a plaintiff . . . to
plead with exacting detail every aspect of [a defendant’s] security history and procedures that might make a data breach foreseeable.” Ramirez, 69 F.4th at 1220. Plaintiff also relies upon persuasive authority discussing the asymmetrical access
to information in data breach cases. Doc. No. [36], 27 (citing Flores-Mendez v. Zoosk, Inc., No. C 20-04929 WHA, 2021 WL 308543, at *4 (N.D. Cal. Jan. 30, 2021)). After review of the entirety of the briefing and relevant authority, the Court upholds Plaintiff’s arguments and citation of authority and concludes that
Plaintiff has sufficiently pled the breach of duty element of his negligence claim. While the Court recognizes Defendant’s arguments to the contrary (Doc. Nos. [33]; [37]), without more, the Court declines to uphold them, as a review of the
data breach complaint that the Eleventh Circuit considered (and allowed to go forward in part) in Ramirez shows that said complaint contained similar breach allegations to the Amended Complaint in the case sub judice. And while the Court
is keenly aware, that it cannot base its ruling on what was not specifically argued 23 and decided in the Ramirez case, this Court is reluctant to ignore some of the guiding language in the Ramirez case, especially the language where the Eleventh Circuit recognized that “data breach cases present unique challenges for plaintiffs at the pleading stage.” Ramirez, 69 F.4th at 1220. The Eleventh
Circuit further stated: “[a] plaintiff may know only what the company has disclosed in its notice of a data breach. Even if some plaintiffs can find more information about a specific data breach, there are good reasons for a company
to keep the details of its security procedures and vulnerabilities private from the public and other cybercriminal groups.” Id. Accordingly, in light of this guidance and the Eleventh Circuit’s recognition of the “unique challenges” of data breach cases, for purposes of the pending Motion to Dismiss, the Court finds that
Plaintiff has pled enough on the breach element to survive dismissal. Next, Defendant argues that Plaintiff has failed to allege that he has suffered any cognizable damages. More specifically, Defendant argues that
“Plaintiff has not suffered an injury because he does not allege any loss or monetary harm associated with North Highland’s data incident that could sustain a negligence action.” Doc. No. [33-1], 28.
24 In response, Plaintiff asserts that he has suffered cognizable injuries in that he has “suffered a privacy injury and is at a substantially increased risk of identity theft.” Doc. No. [36], 27. Plaintiff asserts that these injuries are “sufficient to seek damages under Georgia law, just as they are sufficient for Article III
standing.” Id. As with the standing analysis, the Court assumes without deciding matter of privacy injury,13 but does uphold Plaintiff’s arguments and citation of
authority on damages based on substantially increased risk of identity theft. The Court is unable to uphold Defendant’s arguments to the contrary. Doc. Nos. [33]; [37]. 2. Negligence Per Se
In its Motion to Dismiss, Defendant argues that “section 5 of the Federal Trade Commission Act (“FTCA”) . . . . cannot supply the requisite duty to support Plaintiff’s negligence per se claim.” Doc. No. [33-1], 23.
After review, the Court continues to align with other decisions from this district that conclude that negligence per se in Georgia applies to the FTCA. See
13 Said arguments can be re-raised (and briefed more fully) at the dispositive motions phase of the case. 25 In re Equifax, Inc., 362 F. Supp. 3d at 1327; Purvis, 563 F. Supp. 3d at 1373; Covington v. Gifted Nurses, LLC, No. 1:22-CV-4000-VMC, 2023 WL 5167366, at *9 (N.D. Ga. July 19, 2023); see also Grable & Sons Metal Prod., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308, 318 (2005) (quoting Restatement (Third) of Torts § 14,
Reporters’ Note, Comment a, p. 195 (Tent. Draft No. 1, Mar. 28, 2001)) (“The violation of federal statutes and regulations is commonly given negligence per se effect in state tort proceedings.”).
Accordingly, the Court finds that Plaintiff has adequately pled sufficient injury or causation to make a claim for negligence per se under the FTCA. 3. Breach of Contract Lastly, the Court considers the plausibility of Plaintiff’s breach of contract
cause of action. Doc. No. [30], 25. In paragraph 95 of the Amended Complaint, Plaintiff alleges that he entered into an employment contract with Defendant in which he provided
services in exchange for consideration. Doc. No. [32], ¶ 95. Plaintiff alleges that “[a]s a condition of those contracts, North Highland required Plaintiff and the Class to provide it with their PII.” Id. ¶ 96. Plaintiff alleges that “[i]mplicit in this
26 agreement was the understanding that North Highland would exercise reasonable care to safeguard Plaintiff and the Class’s PII.” Id. ¶ 97. O.C.G.A. § 13–1–1 defines a contract as “‘an agreement between two or more parties for the doing or not doing of some specified thing.’” O.C.G.A.
§ 13-1-1.14 In addition, “[t]o constitute a valid contract, there must be parties able to contract, a consideration moving to the contract, the assent of the parties to the terms of the contract, and a subject matter upon which the contract can operate.”
O.C.G.A. § 13-3-1. “A contract is unenforceable where there is no meeting of the minds between the parties regarding a material element thereof.” Graham v. HHC St. Simons, Inc., 322 Ga. App. 693, 695, 746 S.E.2d 157, 160 (2013) (citations omitted).
“The elements for a breach of contract claim [under Georgia law] . . . are the (1) breach and the (2) resultant damages (3) to the party who has the right to
14 “[I]n determining whether a binding agreement arose between the parties, courts apply the contract law of the particular state that governs the formation of contracts.” Caley v. Gulfstream Aerospace Corp., 428 F.3d 1359, 1368 (11th Cir. 2005). In this diversity case, the Court therefore looks to Georgia law. 27 complain about the contract being broken.” Norton v. Budget Rent A Car Sys., 307 Ga. App. 501, 502, 705 S.E.2d 305 (2010) (citation omitted).15 The Supreme Court of Georgia has cited the following authority when discussing implied contracts: William Blackstone, Commentaries of the Laws on
England 899 n.19 (William Draper Lewis ed., 1902) (“[A]n implied contract only differs from an express contract in the mode of proof; both equally proceed upon the mutual agreement of the parties, and cannot exist without it.”). See Grange
Mut. Cas. Co. v. Woodard, 300 Ga. 848, 853, 797 S.E.2d 814, 819 (2017). Here, the Court aligns with the prior cases from this Circuit16 and concludes that Plaintiff has failed to plausibly state an implied contract claim. In essence, while Plaintiff has alleged an express employment contract, as correctly
noted by Defendant, he has not identified a provision, term, or contractual
15 “To recover in a suit on a contract, the complaining party must establish both a breach of the contract and resulting damages.” Graphics Prods. Distribs., Inc. v. MPL Leasing Corp., 170 Ga. App. 555, 555, 317 S.E.2d 623, 624 (1984). “A contract is breached by a party to it who is bound by its provisions to perform some act toward its consummation and who, without legal excuse on his part and through no fault of the opposite party, declines to do so.” CCE Fed. Credit Union v. Chesser, 150 Ga. App. 328, 330, 258 S.E.2d 2, 4 (1979).
16 The Court recognizes that there is a split of the persuasive authority on this issue, as demonstrated by the non-binding cases cited in Plaintiff’s brief. 28 language to state a breach of express contract claim. Doc. No. [37], 21. He has also not pointed to any “document, expression, or action of the employer which indicated an intention to protect the employee’s personal information.” In re Arthur J. Gallagher Data Breach Litig., 631 F. Supp. 3d 573, 591 (N.D. Ill. 2022).
The Eleventh Circuit’s opinion in Ramirez, while not exactly on point, still provides guidance as like the plaintiff in Ramirez, here, Plaintiff has failed to allege non-conclusory facts from which this Court could infer Defendant agreed
to be bound by any data retention or protection policy. Ramirez, 69 F.4th at 1221. IV. CONCLUSION The Motion to Dismiss Plaintiff’s First Amended Class Action Complaint filed by Defendant North Highland Company (Doc. No. [33]) is GRANTED IN
PART AND DENIED IN PART. The Motion is GRANTED as to the breach of contract claim (Count III of the Amended Complaint) and DENIED on all other grounds and claims.
The instructions in the Scheduling Order at Doc. No. [35] control the remaining proceedings. It is further ORDERED that in the interest of caution and for purposes of the Court’s sua sponte jurisdictional considerations, within TEN DAYS of the
29 entry of this Order, the Parties file a joint factual statement of their contentions about the state in which North Highland Company is incorporated as the Amended Complaint is unclear. See, e.g., Doc. No. [32], J 6.17 IT IS SO ORDERED this 9th day of February, 2024. / f f
$$ HONORABLE STEVE C. JONES UNITED STATES DISTRICT JUDGE
17 See Holston Invs., Inc. B.V_I. v. LanLogistics Corp., 677 F.3d 1068, 1070 (11th Cir. 2012) (“Diversity jurisdiction is determined at the time the complaint was filed. To meet the jurisdictional requirements of § 1332(a), the citizenship of each plaintiff must be different from that of each defendant. ‘[A] corporation shall be deemed to be a citizen of every State and foreign state by which it has been incorporated and of the State or foreign state where it has its principal place of business .....”) (citations omitted). 30