Frechette v. Health Recovery Services, Inc.

• Court: District Court, S.D. Ohio
• Decided: March 31, 2022
• Docket: 2:19-cv-04453
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF OHIO EASTERN DIVISION

TIANA FRECHETTE, et al., : : Case No. 2:19-cv-4453 individually, and on behalf of : all others similarly situated, : Chief Judge Algenon L. Marbley : Plaintiffs, : Magistrate Judge Kimberly A. Jolson : v. : : HEALTH RECOVERY SERVICES, INC., : : Defendant. :

OPINION & ORDER This matter is before the Court on Defendant’s Motion to Dismiss (ECF No. 39), brought under Federal Rule of Civil Procedure 12(b)(6) and relating to Plaintiffs’ Second Amended Complaint (ECF No. 38). In a previous Opinion (ECF No. 23) concerning the First Amended Complaint, the Court granted in part and denied in part Defendant’s Motion to Dismiss. The Second Amended Complaint preserves only those counts that survived the Court’s prior ruling. For the reasons that follow, Defendant’s Motion to Dismiss (ECF No. 39) is GRANTED IN PART and DENIED IN PART. I. BACKGROUND Defendant Health Recovery Services (“HRS”) is a non-profit that provides services to those suffering from mental illness or substance abuse issues, including Plaintiffs and their putative class. (ECF No. 38 ¶¶ 2–5). This case stems from unauthorized third-party access to Defendant’s computer storage systems, which contained Plaintiffs’ personal and medical information. (Id. ¶ 1). As noted, Defendant’s Motion to Dismiss relates to the Second Amended Complaint, filed on February 17, 2021. The original Complaint (ECF No. 1) was filed on October 6, 2019. It was superseded on January 6, 2020, by the First Amended Complaint (ECF No. 6), which Defendant moved to dismiss (ECF No. 9). The Court issued an Opinion, granting dismissal on six of ten counts in the First Amended Complaint for failure to state a claim—but preserving four counts for breach of implied contract, unjust enrichment, and willful and negligent violations of the Fair Credit Reporting Act (“FCRA”). (ECF No. 23). Those are the only counts alleged in the Second

Amended Complaint. But for a substitution of the representative Plaintiffs,1 the factual allegations largely track those in the First Amended Complaint. On February 5, 2019, HRS discovered an unauthorized IP address remotely had accessed its computer network since November 14, 2018. (ECF No. 38 ¶¶ 1, 30). On the network, HRS stored the personal and medical information of its clients, including Plaintiffs and the class they seek to represent. (Id. ¶¶ 1, 6). Defendant sent notice of this data breach on April 5, 2019, two months after it was discovered. (Id. ¶ 30). Plaintiffs allege that Defendant failed “to maintain reasonable and adequate procedures to protect and secure the Personal Information,” “to timely discover the unauthorized access,” and “to provide Plaintiffs and the Data

Breach Class members with timely information regarding the unauthorized access.” (Id. ¶ 33). Plaintiffs state that their personal and medical information was “compromised,” “misappropriated,” “access[ed],” and “stolen” through the breach. (Id. ¶¶ 30, 31, 39, 40). Defendant’s alleged failures “resulted in financial injuries to Plaintiffs and [the class] and has placed [them] at grave risk of identity theft and other possible fraud and abuse.” (Id. ¶ 33). Those alleged injuries stem from invasion of privacy, out-of-pocket costs for protective and reactive

1 Plaintiff Tiana Frechette and Plaintiff Jane Doe, as guardian and mother of minors J.F. and C.F., have substituted for Plaintiff Troy Foster. The Court has directed the Clerk to update the case name officially from Foster v. Health Recovery Services, Inc., to Frechette v. Health Recovery Services, Inc. measures such as credit monitoring, and mental and emotional distress from having highly sensitive health information disclosed. (Id. ¶¶ 40–46, 49–52). HRS now moves to dismiss the Second Amended Complaint under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted. (ECF No. 39). II. STANDARD OF REVIEW

A motion to dismiss under Rule 12(b)(6) “is a test of the plaintiff’s cause of action as stated in the complaint, not a challenge to the plaintiff’s factual allegations.” Golden v. City of Columbus, 404 F.3d 950, 958–59 (6th Cir. 2005). When evaluating a motion to dismiss under Rule 12(b)(6), “[a]ll factual allegations in the complaint must be presumed to be true, and reasonable inferences must be made in favor of the non-moving party.” Total Benefits Planning Agency, Inc. v. Anthem Blue Cross & Blue Shield, 552 F.3d 430, 434 (6th Cir. 2008). But the court “need not . . . accept unwarranted factual inferences.” Id. Complaints must state “more than a bare assertion of legal conclusions to survive a motion to dismiss.” Horn v. Husqvarna Consumer Outdoor Products N.A., Inc., 2013 WL 693119, at *1 (S.D. Ohio Feb. 26, 2013) (citing Allard v. Weitzman, 991 F.2d

1236, 1240 (6th Cir. 1993)). Rather, a plaintiff’s “[f]actual allegations must be enough to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The claim to relief must be “‘plausible on its face,’” with “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). III. LAW AND ANALYSIS A. Law of the Case A threshold dispute between the parties is the extent to which the Court’s Opinion on the first Motion to Dismiss controls its analysis here. Because each of the four counts brought in the Second Amended Complaint survived dismissal in the Court’s prior Opinion (ECF No. 23), Plaintiffs argue that the prior Opinion governs under the “law of the case” doctrine and should not be reconsidered absent exceptional circumstances. (ECF No. 42 at 2, 4). The doctrine “provides that the courts should not ‘reconsider a matter once resolved in a continuing proceeding.’” Howe v. City of Akron, 801 F.3d 718, 739 (6th Cir. 2015) (quoting 18B Charles A. Wright, Arthur R.

Miller & Edward H. Cooper, Federal Practice and Procedure: Jurisdiction and Related Matters § 4478 (4th ed. 2015)). Although a court “has the power to revisit prior decisions of its own or of a coordinate court in any circumstance, . . . as a rule courts should be loathe to do so in the absence of extraordinary circumstances such as where the initial decision was ‘clearly erroneous and would work a manifest injustice.’” Christianson v. Colt Indus. Operating Corp., 486 U.S. 800, 817 (1988) (quoting Arizona v. California, 460 U.S. 605, 618 n. 8 (1983)). The doctrine ensures that “the same issue presented a second time in the same case in the same court should lead to the same result.” LaShawn A. v. Barry, 87 F.3d 1389, 1393 (D.C. Cir. 1996) (emphasis original). Defendant counters with two points. First, Defendant argues that the doctrine does not

apply because “entirely new plaintiffs have been substituted to replace Mr. Foster and a new operative complaint has been filed asserting new factual allegations against HRS.” (ECF No. 43 at 4). The Court rejects this line of reasoning. As Plaintiffs note, little changed in their Second Amended Complaint, save for the substitution of representative Plaintiffs2 and the removal of previously dismissed claims. (ECF No. 42 at 5). These changes do not differentiate the Second and First Amended Complaints such that the Court would analyze all arguments de novo. After

2 The stated purpose for the substitution was not to raise new facts, but rather “to avoid the potential distraction to the putative class stemming from a dispute about the scope of [Plaintiff Foster’s] treatment and payment history with Defendant.” (ECF No. 42 at 2). all, this is a putative class action, so the claims of representative Plaintiffs necessarily are “typical of the claims or defenses of the class.” Fed. R. Civ. P. 23(a)(3). Second, Defendant states that it is seeking dismissal “on new and different grounds” from the last Motion to Dismiss. (ECF No. 43 at 4). This argument has merit. The “law of the case” doctrine “applies only to issues that have been decided explicitly (or by necessary implication) by

a court.” Bowles v. Russell, 432 F.3d 668, 676–77 (6th Cir. 2005); see also Taylor v. J. C. Penney Co., 2017 WL 1908786, at *7 (E.D. Mich. May 10, 2017) (where new arguments presented on second motion to dismiss, “[t]he law-of-the-case doctrine does not prevent the Court from addressing the new legal question that [Defendant] has advanced”). Accordingly, the “law of the case” doctrine will apply to issues determined in the prior Opinion (ECF No. 23). The Court’s conclusions will not be reexamined absent extraordinary circumstances—which Defendant has not sought to identify. Issues raised for the first time in the instant Motion will receive a full analysis. The Court now turns to the four causes of action in the Second Amended Complaint.

B. Breach of Implied Contract (Count One) When the Court last considered Plaintiffs’ claim for breach of implied contract, it held as follows: Here, Plaintiff alleges that he and class members entered into an implied agreement with Defendant HRS which required them to provide their personal information in exchange for treatment services. Plaintiff further alleges that Defendant HRS represented that it would keep this information secure, and that HRS breached this obligation. (ECF No. 6 at 16-17). These allegations are sufficient at this stage to state a claim for breach of implied contract since they specifically identify a contractual undertaking that Defendant allegedly breached. (ECF No. 23 at 23). In reaching this conclusion, the Court rejected Defendant’s argument that Plaintiff failed to plead “facts regarding the circumstances of the transaction that make it reasonably certain that HRS and Plaintiff entered into an agreement.” (Id. at 22; ECF No. 9 at 16). Defendant raises two points in the instant Motion: first, that Plaintiffs have not adequately alleged the consideration necessary to support an implied contract; and second, that Plaintiffs’

emotional distress damages are not recoverable in contract. (ECF No. 39 at 3–6). The Court will address these issues in turn. Consideration is a required element of any express or implied contract claim. Randleman v. Fid. Nat. Title Ins. Co., 465 F. Supp. 2d 812, 818 (N.D. Ohio 2006) (citing Danko v. MBIS, Inc., 1995 WL 572021, at *3 (Ohio Ct. App. Sept. 28, 1995)). It is defined as “the bargained-for legal benefit or detriment.” Lake Land Emp. Grp. of Akron, LLC v. Columber, 804 N.E.2d 27, 31 (Ohio 2004). Defendant contends that the Second Amended Complaint fails to establish “that Plaintiffs provided HRS with any consideration . . . in exchange for HRS’ purported obligation to safeguard Plaintiffs’ information.” (ECF No. 39 at 4 (emphasis original)). In response, Plaintiffs cite to the

“law of the case” doctrine. (ECF No. 42 at 5–6). This citation is appropriate. The Court analyzed the consideration element, at least by necessary implication, when it discussed “the circumstances of the transaction” in its prior Opinion. (ECF No. 23 at 22–23). There, the Court defined the bargained-for exchange as follows: “Defendant HRS . . . required [Plaintiffs] to provide their personal information in exchange for treatment services.” (Id. at 23). These allegations were deemed “sufficient” and permitted to proceed. (Id.). The Second Amended Complaint alleges the same bargained-for exchange (ECF No. 38 ¶ 65), so the same outcome should result. Thus, Defendant’s consideration argument is rejected under the “law of the case.” Moving to damages, Defendant contends that “[g]enerally, emotional distress damages are not compensable damages for a breach of contract claim under Ohio law.” (ECF No. 39 at 5, citing Nuovo v. Ohio State Univ., 726 F. Supp. 2d 829, 841 (S.D. Ohio 2010)). Plaintiffs again rely on the “law of the case” (ECF No. 42 at 5–6); but in this instance, the Court’s first Opinion does not control because it did not consider the recoverability of emotional distress damages under the

implied contract count. The Court did discuss emotional distress damages as providing a valid basis for standing (ECF No. 23 at 9), but that was a general finding not linked to specific causes of action. Accordingly, the “law of the case” does not preclude Defendant’s argument on damages. Still, this new issue of damages will not lead to dismissal. As a threshold matter, the Court notes that Plaintiffs have not confined their damages theory to emotional distress (ECF No. 38 ¶ 69), so foreclosing this specific type of damages would not defeat the claim. For instance, if discovery shows “evidence of data theft or that the intruder accessed Plaintiff’s specific information” (ECF No. 23 at 9), then reasonably incurred mitigation costs may be recoverable, consistent with the Court’s prior discussion of Galaria v. Nationwide Mutual Insurance Co., 663 F. App’x 384 (6th Cir. 2016).3

More to the point, though, Plaintiffs need not cede their emotional distress damages because Defendant’s statement of Ohio law is incomplete. Emotional distress damages can be

3 The Court must acknowledge that its prior Opinion contained inconsistent language on this point. The Court first declined to find standing on the basis of mitigation costs, writing that “the mere allegation of a risk of harm based on a data breach, without evidence of data theft or that the intruder accessed Plaintiff’s specific information, is insufficient to state an ‘imminent’ injury for purposes of Article III standing.” (ECF No. 23 at 9). Later, though, the Court found Plaintiffs had stated a valid standing theory for invasion of privacy, reasoning that Plaintiffs’ health information allegedly was disclosed to a third party (the hackers) and that Defendant was “‘unable to definitively rule out’ the possibility that patient information was accessed or stolen.” (Id. at 11, quoting ECF No. 9-1 at 2 (notice of breach)). Then, in dismissing the negligence count in the First Amended Complaint, the Court found that “monetary damages for expenditures on credit monitoring” must be pursued as a contract claim, without suggesting those damages were pled deficiently. (Id. at 19–21). The Court takes this opportunity to clarify that it does not intend to foreclose the possibility of mitigation damages under Galaria before any evidence is received regarding the scope of the breach. The Second Amended Complaint contains numerous references to theft, access, or misappropriation of Plaintiffs’ information (ECF No. 38 ¶¶ 30, 31, 39, 40), and thus pleads more than a mere allegation of risk stemming from access to the network generally. If those claims are proven, Plaintiffs’ case will be analogous to Galaria. recoverable under a breach of contract theory where “‘the contract or the breach is of such a kind that serious emotional disturbance was a particularly likely result.’” Kishmarton v. William Bailey Constr., Inc., 754 N.E.2d 785, 788 (Ohio 2001) (quoting 3 Restatement of the Law 2d, Contracts (1981) 149, Section 353). While the Ohio Supreme Court “expressly limited” that holding to “contract cases involving transactions between vendees and builder-vendors,” Brainard v. Am.

Skandia Life Assur. Corp., 432 F.3d 655, 665 (6th Cir. 2005) (citing Kishmarton, 754 N.E.2d at 788), other cases have extended the same principle to different factual settings. See, e.g., Clay v. Shriver Allison Courtley Co., 118 N.E.3d 1027, 1040–41 (Ohio Ct. App. 2018) (contract for funeral home services); Stockdale v. Baba, 795 N.E.2d 727, 743–44 (Ohio Ct. App. 2003) (settlement agreement based on stalking charges). Clay read Kishmarton as stating a general principle, with support in the Restatement of Contracts and the Ohio Constitution: Comment a to Section 353 of the Restatement explains that, although damages for emotional disturbance are not ordinarily allowed, and difficult to prove even when they are foreseeable, there are two exceptional situations where such damages are recoverable: (1) when an emotional disturbance accompanies a bodily injury, and (2) when the contract or the breach is of such a kind that serious emotional disturbance was a particularly likely result. Kishmarton at 230, 754 N.E.2d 785, citing 3 Restatement of the Law 2d Contracts (1981), 149, Section 353. . . .

In adopting the Restatement, the Ohio Supreme Court cited Section 16, Article I of the Ohio Constitution, which reads, in pertinent part, “every person, for an injury done him * * * shall have remedy by due course of law.” Kishmarton at 229, 754 N.E.2d 785. Because emotional distress injuries are injuries for which the Ohio Constitution guarantees a right to a remedy, the Court recognized that it is reasonable to allow emotional distress damages caused by a breach of contract.

118 N.E.3d at 1040–41. Here, Plaintiffs plausibly do allege the type of contract where a breach was particularly likely to result in severe emotional distress. “The Breach involved the most sensitive health information related to [HRS] patients’ mental health history, substance abuse history, [and] Sexually Transmitted Infection (STI) history . . . [which] combined with other personal information including social security numbers result[ed] in an unusually dangerous and damaging combination of disclosed personal and health information.” (ECF No. 38 ¶¶ 50–51). “Though proof of emotional distress damages in these cases will be difficult,” Kishmarton, 754 N.E.2d at 788, the Court will not foreclose them on a Motion to Dismiss. Having rejected each of Defendant’s arguments, the Court again determines that the

implied contract claim may proceed. C. Unjust Enrichment (Count Two) Plaintiffs’ next cause of action is for unjust enrichment. The Court previously ruled as follows: Here, Plaintiff has alleged all of the elements of an unjust enrichment claim. Plaintiff alleges that he conferred a benefit on Defendant by paying Defendant for health care services pursuant to an implied contract which required Defendant to safeguard Plaintiff’s sensitive medical information. Plaintiff alleges that Defendant failed to safeguard this information but has retained the payment made by Plaintiff for those services. Accordingly, Plaintiff has stated a claim for unjust enrichment.

(ECF No. 23 at 24). The Court rejected Defendant’s arguments that Plaintiff received the services at issue and that those services were not defective. (Id.; ECF No. 9 at 18). Defendant now contests the unjust enrichment claim on three grounds: first, that Plaintiffs have not alleged they personally and directly conferred a benefit on Defendant; second, that Defendant could not have known of any such benefit insofar as it was not conferred directly; and third, that Plaintiffs have not shown circumstances where retention of the benefit would be unjust since Plaintiffs would not be entitled to restitution for a benefit they themselves did not confer. (ECF No. 39 at 6–8). All of these arguments proceed from the same phrase—“on behalf of”— which was added to the Second Amended Complaint. See ECF No. 38 ¶¶ 15–17 (alleging “consideration paid on behalf of” named Plaintiffs). Because this language is new to the Second Amended Complaint, these issues were not determined by the Court in its prior Opinion, and the “law of the case” doctrine does not apply. Specifically, Defendant argues that the new language undercuts an “‘essential element’” of Plaintiffs’ unjust enrichment claim: that “‘they have directly conferred any benefit upon the Defendant[].’” (ECF No. 39 at 7, quoting Eisenberg v. Anheuser-Busch, Inc., 2006 WL 290308,

at *12 (N.D. Ohio Feb. 2, 2006)). In their response brief, Plaintiffs clarify that the “on behalf of” language was added to the Second Amended Complaint due to the inclusion of minor children as new named Plaintiffs. (ECF No. 42 at 7). Since “their guardians were actually responsible for their payments” (Id.), this was a proper clarification that does not change appreciably the legal theory. The purpose of the “on behalf of” addition was clear in the context of the Second Amended Complaint, as it appears in the factual allegations of named Plaintiffs and is jettisoned in the class- wide allegations. See ECF No. 38 ¶ 72 (“Plaintiffs and the Data Breach Class members conferred a benefit to Defendant HRS when they entered into an agreement with Defendant HRS and provided payment for Defendant HRS’ services.”). Therefore, the Second Amended Complaint

still alleges a direct benefit conferred on Defendant, whether by a paying adult patient or a minor’s paying legal guardian. Defendant’s arguments to the contrary are rejected, and the unjust enrichment claim may proceed. D. Violations of Fair Credit Reporting Act (Counts Three and Four) Last are Plaintiffs’ claims for willful and negligent violation of the FCRA, which the Court analyzes together. The Court previously held as follows: Here, Plaintiff has alleged facts that would permit it to pursue a cause of action for willful and negligent violations of the FCRA because Plaintiff has alleged that Defendant, in the regular course of its business, is paid a fee—separate and apart from the fee paid for the provision of its health care services—to transmit reports containing consumers’ personal information. (ECF No. 15 at 17). This is sufficient to state a claim for violations of the FCRA. (ECF No. 23 at 28). The Court reached this conclusion over Defendant’s objections that it is not a “consumer reporting agency,” as defined in the FCRA, because it does not assemble or evaluate consumer information in exchange for fees. (Id. at 26; ECF No. 9 at 20). In the instant Motion to Dismiss, Defendant raises two points: first, that Defendant did not “furnish” any information to the alleged bad actors; and second, that Plaintiffs’ personal information did not constitute a “consumer report” within the meaning of the FCRA. (ECF No. 39 at 8–11). The latter argument can be resolved quickly; as Plaintiffs note in their response brief, it is “a variation of a prior argument addressed by this Court” in its first Opinion. (ECF No. 42 at 9). Previously, the Court rejected Defendant’s argument that it is not a “consumer reporting agency,”

which the FCRA defines as “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties . . . .” 15 U.S.C. § 1681a(f) (emphasis added). To find that Defendant meets this definition, the Court had to determine at least by necessary implication that the assembly of Plaintiffs’ personal information, as alleged, constitutes a consumer report. Defendant’s argument on this point is rejected under the “law of the case” doctrine. Defendant’s other argument, that it did not “furnish” information to the alleged bad actors, is a new one that will receive a full analysis. In the Second Amended Complaint, Plaintiffs plead that “Defendant failed to adopt and maintain . . . reasonable procedures designed to limit the

furnishing of consumer reports to the purposes listed under 15 U.S.C. § 1681b.” (ECF No. 38 ¶ 85 (emphasis added)). Defendant argues that the theft of consumer information does not amount to “furnishing” and thus does not trigger a violation of the FCRA, citing the district court in Galaria. (ECF No. 39 at 8). There, the court stated: Although the FCRA does not define the term “furnish,” this term requires an affirmative act on the part of the consumer reporting agency. See Willingham v. Global Payments, Inc., No. 1:12-CV-1157-RWS, 2013 WL 440702, at *13 (N.D. Ga. Feb. 5, 2013) (citing Holmes v. Countrywide Fin. Corp., No. 5:08-CV-205-R, 2012 WL 2873892, at *16 (W.D. Ky. July 12, 2012)). Named Plaintiffs do not plead any facts to suggest that Defendant made an affirmative act to “furnish” the consumer . . . information. Rather, they allege the information was stolen from Defendant. When consumer information is stolen from a consumer reporting agency, “[n]o coherent understanding of the words ‘furnished’ or ‘transmitted’ would implicate [the consumer reporting agency]’s action under the FCRA.” Holmes, 2012 WL 2873892, at *16; see also Willingham, 2013 WL 440702, at *13 (“[t]he relevant fact is that the data was stolen, not furnished”).

Galaria v. Nationwide Mut. Ins. Co., 2017 WL 4987663, at *4 (S.D. Ohio Aug. 16, 2017) (ellipsis added, other alterations original). Several other decisions are in accord. See, e.g., In re Experian Data Breach Litig., 2016 WL 7973595, at *2 (C.D. Cal. Dec. 29, 2016) (“‘courts generally use the term [“furnish”] to describe the active transmission of information to a third-party rather than a failure to safeguard the data’” (quoting Dolmage v. Combined Ins. Co. of Am., 2015 WL 292947, at *3 (N.D. Ill. Jan. 21, 2015))); In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1313 (N.D. Ga. 2019) (“In such a case, the data is stolen by a third party, and not furnished to the third party.”); Christensen v. Saint Elizabeth Med. Ctr., Inc., 2020 WL 3491371, at *4 (E.D. Ky. June 26, 2020) (“The word ‘furnish’ denotes an active transmission of data, rather than the failure to protect such data from the hands of criminals. Claims brought under the FCRA that involve stolen information have been routinely dismissed because such information is not ‘furnished’ . . . .”). Here, the theory underlying Plaintiffs’ FCRA claims is that Defendant’s willful or negligent “failure to protect and safeguard the PII/PHI [personally identifiable information / personal health information] of Plaintiffs and Class Members resulted in the disclosure of such information to one or more third-parties in violation of FCRA . . . .” (ECF No. 38 ¶¶ 92, 100–101). Plaintiffs’ theory thus aligns with the theft cases discussed above because the information was not affirmatively furnished or disclosed, but rather was protected inadequately and stolen by a bad actor. Plaintiffs offer only a brief response to this argument. Citing the prior Opinion and the Sixth Circuit decision Pittman v. Experian Information Solutions, Inc., 901 F.3d 619 (6th Cir. 2018), Plaintiffs emphasize that “‘the FCRA creates a cause of action for willful or negligent

violations of its provisions.’” (ECF No. 42 at 10, quoting ECF No. 23 at 26). Pittman, however, concerned willful or negligent reporting of inaccurate credit information—an affirmative act in line with the “furnishing” definition above. 901 F.3d at 629–30. And as explained in the “law of the case” discussion, the theft line of cases was not raised in this Court’s prior Opinion. Thus, neither Pittman nor the prior Opinion in this case holds that a willful or negligent failure to safeguard information against third-party theft will amount to a “furnishing” of consumer reports beyond statutory limits. Accordingly, Defendant’s argument is well taken. Because the FCRA does not impose liability in passive cases of third-party theft, Plaintiffs cannot show a willful or negligent violation

of that statute. Counts Three and Four must be dismissed. IV. CONCLUSION For the reasons stated above, Defendant’s Motion to Dismiss (ECF No. 39) is GRANTED IN PART as to the FCRA claims (Counts Three and Four), which are DISMISSED. The Motion is DENIED IN PART as to the implied contract claim (Count One) and the unjust enrichment claim (Count Two). Because Plaintiffs have had two opportunities to amend their Complaint, the dismissal of the FCRA claims is with prejudice and without further leave to amend. This case may proceed on the implied contract and unjust enrichment claims only. IT IS SO ORDERED. Lf 5 eh a CHIEF UNITED STATES DISTRICT JUDGE DATED: March 31, 2022