Cantinieri v. Verisk Analytics, Inc.

• Court: District Court, E.D. New York
• Decided: February 23, 2024
• Docket: 2:21-cv-06911
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK --------------------------------------------------------------X JILLIAN CANTINIERI, individually, and on behalf of herself and all others similarly situated,

Plaintiff, MEMORANDUM ORDER 21-cv-6911 (NJC) (JMW) -against-

VERISK ANALYTICS, INC., INSURANCE SERVICES OFFICE, INC., and ISO CLAIMS SERVICES INC.,

Defendants. --------------------------------------------------------------X

A P P E A R A N C E S:

Anthony P. Mastroianni, Esq. Locks Law Firm PLLC 622 Third Avenue 7th Floor New York, NY 10017

-and-

Raymond C Silverman, Esq. Jerrold S. Parker, Esq. Parker Waichman LLP 6 Harbor Park Drive Port Washington, NY 11050 Attorneys for Plaintiff

Jasmeet Ahuja, Esq. Caitlyn Anne Mancuso, Esq. Hogan Lovells US LLP 1735 Market Street 23rd Floor Philadelphia, PA 19103

-and- Allison M. Holt-Ryan, Esq. Joseph J. Cavanaugh, Esq. Hogan Lovells US LLP Columbia Square 555 Thirteenth Street, NW Washington, DC 20004 Attorneys for Defendants

WICKS, Magistrate Judge:

“It is clear that the courts of this country recognize a general right to inspect and copy public records and documents, including judicial records and documents. In contrast to the English practice, . . .American decisions generally do not condition enforcement of this right on a proprietary interest in the document or upon a need for it as evidence in a lawsuit.”1

Plaintiff, Jillian Cantinieri (“Plaintiff”), commenced this action on December 15, 2021 against Defendants Verisk Analytics, Inc., Insurance Services Office Inc., and ISO Claims Services Inc. (collectively, “Defendants”), for negligence, negligence per se, unjust enrichment, violations of the Information Security Breach and Notification Act, N.Y. Gen. Bus. Law § 899- aa, and violations of New York General Business Law (“GBL”) § 349, alleging Defendants failed to safeguard the personally identifiable information (“PII”) of Plaintiff and the members of the proposed classes from a targeted breach of their databases (“data breach”) by unauthorized entities or criminals. See generally ECF No. 1. Following Plaintiff’s commencement of the action, the parties served Interrogatories and Requests for Production and associated Responses to each other – with some of Defendants’ Responses being marked as “CONFIDENTIAL.” (ECF No. 76 at 1.) Defendants moved to dismiss the Complaint under the Federal Rules of Civil Procedure (“FRCP”) 12(b)(1) and 12(b)(6) on June 9, 2022 (ECF No. 26), which was denied without prejudice by the previously assigned District Judge, the Hon. Joan M. Azrack, on March

1 Nixon v. Warner Commc’ns. Inc., 435 U.S. 589, 597 (1978). 31, 2023 (ECF No. 49), who directed the parties to conduct limited jurisdictional discovery “to resolve the issue of Plaintiff’s Article III standing.” (ECF No. 49 at 4-5.) Judge Azrack noted that after jurisdictional discovery was complete, Defendants “would be permitted to renew under Rule 12(b)(1), supported by affidavits and exhibits, and Rule 12(b)(6).” (Id.) In the course of

jurisdictional discovery, Defendants produced “a number of CONFIDENTIAL” documents. (ECF No. 76 at 2.) On November 20, 2023, the parties agreed that jurisdictional discovery was complete (see Electronic Order dated November 20, 2023), and Plaintiff filed an Amended Complaint on December 15, 2023. (ECF No. 72.) Defendants served their renewed Motion to Dismiss Plaintiff’s Amended Complaint on January 12, 2024, Plaintiff served her Opposition on February 2, 2024, and Defendants served their Reply on February 16, 2024. (ECF No. 76 at 2.) Before the

Court, on referral from the Hon. Nusrat J. Choudhury (see Electronic Order dated February 20, 2024), is the parties’ Joint MOTION for Leave to Electronically File Document under Seal Motion to Dismiss Papers (ECF No. 76), which requests that certain exhibits attached to the moving papers be filed under seal, and that portions of the briefing relying on such exhibits be redacted, “because they are or rely on Interrogatory Responses, produced documents, or deposition testimony that have been designated CONFIDENTIAL pursuant to the Parties’ Confidentiality Stipulation and Order entered in this case” by the undersigned. (ECF No. 76 at 2; ECF No. 38.)2 For the following reasons, the parties’ Joint Motion to Seal (ECF No. 76) is GRANTED.

2 The Confidentiality Stipulation and Order in this case states that “[d]ocuments designated ‘Confidential’ shall be shown only to the attorneys, parties, experts, actual or proposed witnesses, court personnel, and other persons necessary to review the documents for the prosecution or defense of this lawsuit. No public disclosure of documents designated ‘Confidential’ shall be permitted unless such documents are not deemed Confidential after either being successfully challenged or after the designating party withdraws DISCUSSION The parties jointly seek to file under seal certain exhibits attached to the Parties’ briefing – and redact portions of the briefing relying on such exhibits – because these exhibits “contain extremely sensitive confidential business information, trade secrets, and data privacy and cybersecurity information about the security incident at issue in this case, and portions of the [p]arties’ briefing quotes and discusses such material.” (Id.) According to the parties, this material includes: (i) “material nonpublic information about Defendants’ security procedures and protocols, or [personal] information about Plaintiff[,]” and “the specific ways that Defendants collect, transmit, and store PII, as well as how Defendants became aware of the [data breach], what information the fraudulent actors were successful in obtaining, and the security actions Defendants took both before and following the incident.” (Id.)3 The parties agree that “[d]isclosing this information could provide a roadmap for bad actors to circumvent the security

systems and procedures that are in place to detect and prevent fraudulent access.” (Id.) Although the parties are moving jointly to seal these documents (ECF No. 76), and despite the existence of a court-approved protective order allowing the parties to designate materials as confidential and to request permission to file such documents under seal (ECF No. 38), this Court must—given the common law right of public access to judicial documents firmly

the Confidential designation.” (Id. at 2, ¶ (d).) None of the Parties’ confidentiality designations have been challenged by the other party. (ECF No. 76 at 3.) 3 The parties specifically request to seal: “Defendants’ Responses to Plaintiff’s Interrogatories 17 (see Mot. to Dismiss (“MTD”) at 2; MTD, Ex. 1-2; Opposition to Motion to Dismiss (“Opp’n”) at 12; Opp’n, Ex. 5) and 22 (Opp’n at 16; Opp’n, Ex. 6), ISO Claims’ investigation report stemming from the Security Incident (see MTD at 5; MTD, Ex. 8; Opp’n at 2, 12; Opp’n, Ex. 1; Reply at 2), excerpts from the deposition of Mr. Michael Snook (see Opp’n at 4, 16; Opp’n, Ex. 3), and Plaintiff’s Motor Vehicle Report (see MTD at 17; MTD, Ex. 5; Opp’n, Ex. 4).” (ECF No. 76 at 3.) rooted in our nation’s history—ensure that the requested sealing is narrowly tailored and “is necessary to preserve higher values” above the public’s right to transparency. Lugosch v. Pyramid Co. of Onondaga, 435 F.3d 110, 119, 124 (2d Cir. 2006).

Within the Second Circuit, there is a three-part analysis for determining whether documents relating to a lawsuit should be sealed. See King Pharm., Inc. v. Eon Labs, Inc., No. 04-cv-5540, 2010 WL 3924689, at *4 (E.D.N.Y. Sept. 28, 2010) (internal quotation marks and citation omitted); Lugosch, 435 F.3d at 119. Courts must first determine whether the documents are judicial documents, “to which the public has a presumptive right of access.” King Pharm., Inc., 2010 WL 3924689, at *4 (citation omitted). A judicial document is not simply a document filed with the court, but one that is “relevant to the performance of the judicial function and useful in the judicial process.” Lugosch, 435 F.3d at 119 (internal quotation marks and citation

omitted). A document is “relevant to the performance of the judicial function if it would reasonably have a tendency to influence a district court’s ruling on a motion . . . without regard to which way the court ultimately rules or whether the document ultimately in fact influences the court’s decision.” See Brown v. Maxwell, No. 16-cv-3945, 2019 WL 2814839, at *4–5 (2d Cir. July 3, 2019) (internal quotation marks and citation omitted) (emphasis in original). If the documents are judicial documents, the court must then determine the weight of the

public’s presumptive right of access. King Pharm., Inc., 2010 WL 3924689, at *4 (citation omitted). Finally, the court must balance competing considerations against the presumptive right to access, including “the danger of impairing judicial efficiency and the privacy interests of those resisting disclosure.” Id. (citation omitted). In so doing, courts must be cognizant that “the presumption of public access to court documents has the potential to exacerbate . . . harms to privacy and reputation by ensuring that damaging material irrevocably enters the public record.” See Brown, 2019 WL 2814839, at *3. The question of whether documents are sealed is ultimately left to the sound discretion of the district court, which should “be exercised in light of the relevant facts and circumstances of the particular case.” Nixon v. Warner Commc’ns, Inc., 435 U.S. 589, 599 (1978) (citations omitted).

In analyzing privacy interests as a competing consideration against the presumptive right to access, this Circuit has clearly enunciated “that the privacy interests of innocent third parties should weigh heavily in a court's balancing equation. Such interests, while not always fitting comfortably under the rubric ‘privacy,’ are a venerable common law exception to the presumption of access.” United States v. Amodeo, 71 F.3d 1044, 1050–51 (2d Cir. 1995). The Amodeo Court articulated three factors to consider in making sealing determination based on privacy interests. First, “courts should consider the degree to which the subject matter is

traditionally considered private rather than public. Financial records of a wholly owned business, family affairs, illness, embarrassing conduct with no public ramifications, and similar matters will weigh more heavily against access than conduct affecting a substantial portion of the public.” Id. at 1051. Next, courts should consider “[t]he nature and degree of injury . . . . This will entail consideration not only of the sensitivity of the information and the subject but also of how the person seeking access intends to use the information.” Id. Lastly, courts should consider the reliability of the information and err on the side of non-disclosure of unverified information. Id.

Preliminary, “[j]ust as with documents submitted in connection with a Motion for Summary Judgment, documents filed in connection to a Motion to Dismiss ‘are judicial documents to which a presumption of immediate public access attaches under both the common law and the First Amendment.’” Bernsten v. O'Reilly, 307 F. Supp. 3d 161, 166–67 (S.D.N.Y. 2018) (quoting Lugosch, 435 F.3d at 126). “Dispositive motions are adjudications, and ‘[a]n adjudication is a formal act of government, the basis of which should, absent exceptional circumstances, be subject to public scrutiny.’” Id. (quoting Joy v. North, 692 F.2d 880, 893 (2d Cir. 1982)). Thus, the presumption of access exists as to the documents at issue here, which must

be overcome to warrant sealing. See Olson v. Major League Baseball, 29 F.4th 59, 89–90 (2d Cir. 2022) (“[A] strong presumption [of public access] attaches to materials filed in connection with dispositive motions, such as a motion to dismiss.”). The parties contend that “the underlying rationale of the privilege [afforded to law enforcement techniques and procedures by the Second Circuit] compels protection of Defendants’ own techniques and procedures to deter cyber fraud and protect PII.” See ECF No. 76 at 4 (quoting United States v. Amodeo, 44 F.3d 141, 147 (2nd Cir. 1995)) (“The Second Circuit has previously recognized the ‘law enforcement privilege as an interest worthy of protection.’ This privilege ‘is designed to prevent disclosure of,’ among other things, ‘law enforcement techniques and procedures.’”). The parties further contend that “[p]ublic disclosure

of Defendants’ anti-fraud practices and procedures for protecting PII could alert wrongdoers to potential methods of avoiding them, thus undermining their efficacy . . . [and, that] [o]ther district courts, when considering nearly the same issue, have held that it was appropriate to seal judicial records that contained information about a private company’s antifraud practices.” See id (citing Federal Trade Commission v. The Western Union, No. 1:13-mc-00131-AKH (S.D.N.Y. Mar. 26, 2015) (“Western Union”) and Rinky Dink, Inc. v. Electronic Merchant Systems, No. C13-1347-JCC, 2015 WL 778065, at *3 (W.D. Wash. Feb. 24, 2015)).

With respect to the documents relating to Defendants’ anti-fraud practices and procedures for protecting PII (“the Procedure and Practice Documents”), the Court finds that “although [Defendants] are not law enforcement agenc[ies], [they] have a compelling interest in protecting the integrity and efficacy of [their] anti-fraud practices” and protecting clients from future data breaches. Western Union, 1:13-mc-00131-AKH, at ECF No. 76 at 2. “The parties have adequately explained that public disclosure of [the Procedure and Practice Documents] could

compromise the anti-fraud program by alerting potential offenders to its methodology.” Id; see also Averbach v. Cairo Amman Bank, No. 19-CV-0004-GHW-KHP, 2023 WL 4144758, at *2 (S.D.N.Y. June 23, 2023) (collecting cases) (“Regardless of the weight that must be accorded to the presumption [of public access], the court must make specific, on the record findings that sealing is necessary to preserve higher values . . . includ[ing] personal privacy interests, public safety, the preservation of attorney-client privilege, and the protection of competitively sensitive business information.”).

The Court finds here that the parties’ sealing request is “narrowly tailored[,]” as it seeks to seal only that information that must be sealed to preserve higher values. Susquehanna Int'l Grp. Ltd. v. Hibernia Express (Ir.) Ltd., 2021 WL 3540221, at *4 (S.D.N.Y. Aug. 11, 2021); CBF Industria de Gusa S/A v. AMCI Holdings, Inc., No. 13CV2581PKCJLC, 2021 WL 4135007, at *4 (S.D.N.Y. Sept. 10, 2021) (internal citations omitted) (collecting cases) (“[P]rotecting a company’s IT information fits comfortably within other higher values consistently recognized by courts in this Circuit, such as the protection of sensitive business information, the protection of proprietary business information, such as internal analyses, business strategies, or customer negotiations, and the prevention of potential fraud.”); see also

Kewazinga Corp. v. Microsoft Corp., No. 18-CV-4500 (GHW), 2021 WL 1222122, at *3 (S.D.N.Y. Mar. 31, 2021) (internal quotations omitted) (“Courts commonly find that documents that contain trade secrets, confidential research and development information, marketing plans, revenue information, pricing information, and the like satisfy the sealing standard.”); In re Am. Realty Cap. Properties, Inc. Litig., No. 15-CV-307 (AKH), 2019 WL 11863704, at *1 (S.D.N.Y. Mar. 25, 2019) (“Screenshots and any other information about ... software that could be used to copy the program's structure or functions are more deserving of protection.”).

With respect to the documents containing Plaintiff’s or other third-parties’ personal information (i.e., addresses, phone numbers, etc.), the Court finds this traditionally private information weighs heavily in the Court’s balancing against the presumption of access, see e.g, Amodeo, 71 F.3d at 1050–51, and otherwise has no bearing on the lawsuit, and therefore the public will not be prejudiced if denied access to this information. See Cohen v. Gerson Lehrman Grp. Inc., No. 09 Civ. 4352 (PKC), 2011 WL 4336679, at *2 (S.D.N.Y. Sept. 15, 2011) (holding that individual contact information, such as email addresses, home addresses, and phone

numbers, which were not at issue in the litigation, warranted redacted sealing because of the individual’s “countervailing privacy interest in their non-disclosure”). CONCLUSION

Accordingly, parties’ Joint Motion to Seal (ECF No. 76) is GRANTED, and the parties are directed to redact the information at issue in the Procedure and Practice Documents and Plaintiff’s personal documents, and once redacted, file those documents publicly. The unredacted copies of the documents may be filed under seal in accordance with this Court’s sealing rules and procedure. See E.D.N.Y., Steps for E-filing Sealed Documents – Civil Cases (2017), https://img.nyed.uscourts.gov/files/forms/EfilingSealedCV.pdf. Dated: Central Islip, New York February 23, 2024

S O O R D E R E D:

James M. Wicks /s/ JAMES M. WICKS United States Magistrate Judge