1 2
3 4 EASTERN DISTRICT OF WASHINGTON 6
a Washington corporation, NIKOS NO. 4:24-CV-5045-TOR 8 DANAKOS, and NICOLE DANAKOS, ORDER GRANTING IN PART AND 9 Plaintiffs, DENYING IN PART DEFENDANT NEWCOURSE’S MOTION TO 10 v. DISMISS
11 YOURPEOPLE, INC., a foreign profit corporation, and COMMUNICATIONS, INC., a 13 foreign profit corporation,
14 Defendants. 15
16 BEFORE THE COURT is Defendant Newcourse’s Motion to Dismiss (ECF 17 No. 53). This matter was submitted for consideration without oral argument. The 18 Court has reviewed the record and files herein and is fully informed. For the 19 reasons discussed below, Defendant Newcourse’s Motion to Dismiss (ECF No. 53) 20 is GRANTED in part and DENIED in part. 2 This matter arises out of alleged identity theft resulting in the loss of
3 $432,500 from Plaintiffs’ business bank account. Plaintiff Greek Islands Cuisine 4 (“Greek Islands”) is a restaurant located in Richland, Washington and owned in 5 part by Plaintiffs Nikos and Nicole Danakos. ECF No. 52 at 2, 5 ¶¶ 2.1, 4.1.
6 Greek Islands maintains a business bank account at KeyBank National Association 7 (“KeyBank”), at its branch in Kennewick, Washington. Id. at 6, ¶ 4.2. Mr. and 8 Mrs. Danakos held a personal checking account at HomeStreet Bank, 9 headquartered in Seattle, Washington. Id. at 21‒22, ¶ 4.28. HomeStreet bank
10 utilizes Defendant Newcourse Communications, Inc. (“Newcourse”) in its business 11 providing mailing services to financial institutions. Id. 12 The Court incorporates by reference the factual summary in its Order
13 Granting Defendant Newcourse Communication Inc.’s Motion to Dismiss, ECF 14 No. 51. In that Order, the Court permitted Plaintiffs to amend their Complaint with 15 respect to claims against Newcourse. The Third Amended Complaint contains 16 much of the same factual background as the previously dismissed Complaint but
17 includes the addition of a relevant fact for this dispute: Plaintiffs allege that in 18 communication with KeyBank, the thieves used the last four digits of Mr. 19 Danakos’ Social Security number to answer a security question to gain access to
20 Greek Island’s checking account. ECF No. 52 at 15, ¶ 4.18. Plaintiffs assert that 1 the only place Mr. Danakos’ partial social security number could have been 2 obtained was in a Newcourse’s April-May 2022 data breach, and then used in
3 answering that security question. Id. at 22, 25 ¶¶ 4.29, 4.33. Plaintiffs renew their 4 negligence, negligence per se, and violation of the Washington Consumer 5 Protection Act claims against Defendant Newcourse.
6 Defendant Newcourse renews its Motion to Dismiss, arguing this Court 7 should dismiss Plaintiffs’ claims either for lack of standing or for failure to state a 8 claim. ECF No. 53. Plaintiffs argue that they have successfully shown both 9 standing and stated each of their claims. ECF No. 57.
11 I. Standing 12 As was previously discussed, Article III of the United States Constitution
13 vests in federal courts the power to entertain disputes over “cases” or 14 “controversies.” U.S. CONST. art. III, § 2. To satisfy the case or controversy 15 requirement, and thereby show standing, a plaintiff must demonstrate that 16 throughout the litigation, they suffered, or will be threatened with, an actual injury
17 traceable to the defendant which will likely be redressed by a favorable judicial 18 decision. Spencer v. Kemna, 523 U.S. 1, 7 (1998) (quoting Lewis v. Cont’l Bank 19 Corp., 494 U.S. 472, 477 (1990)); see also Deakins v. Monaghan, 484 U.S. 193,
20 199 (1988) (“Article III of the Constitution limits federal courts to the adjudication 1 of actual, ongoing cases or controversies between litigants.”). Three elements 2 must be shown in order to establish Article III standing: (1) the plaintiff must have
3 suffered an “injury in fact” which is both concrete and particularized and not 4 “conjectural” or “hypothetical”; (2) there must be a causal connection between the 5 injury and the conduct complained of; and (3) it must be “likely” as opposed to
6 “speculative” that the injury will be “redressed by a favorable decision.” Lujan v. 7 Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (internal citations and quotations 8 omitted). The party invoking federal jurisdiction bears the burden of establishing 9 the elements. Id. at 561 (citing FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990)).
10 However, “[a]t the pleading stage, general factual allegations of injury resulting 11 from the defendant’s conduct may suffice.” Id. 12 Defendant Newcourse argues that the Third Amended Complaint is still
13 deficient, as the only particularized injury was to Greek Island’s bank account, and 14 thus the Danakoses cannot assert a claim for damages sustained by their business. 15 ECF No. 53 at 7. Plaintiffs argue that they have been injured by the conduct of 16 Defendant Newcourse because they allege the last four digits of Mr. Danakos’s
17 social security number were taken in the data breach and then used to answer a 18 security question with Greek Island’s Keybank Account. ECF No. 52 at 23, ¶ 4.30. 19 A. Injury in Fact
20 Defendant Newcourse first argues that the Danakoses have not alleged an 1 injury in fact that is particularized to them. ECF No. 53 at 7. Specifically, it 2 asserts that the only cognizable injury in this lawsuit is the theft of the $432,500
3 from Greek Island’s bank account, an entity wholly separate from them. Id. 4 Plaintiffs argue that the compromised partial Social Security number resulted in 5 theft from their family-owned business demonstrates a cognizable injury. ECF No.
6 57 at 6‒7. 7 An injury in fact must be concrete, and absent this demonstration, a plaintiff 8 does not have standing. TransUnion LLC v. Ramirez, 594 U.S. 413, 417 (2021). 9 Concrete injuries can be tangible, like monetary loss or physical harms, or they
10 may be intangible, which the Supreme Court has coined as those which have a 11 “close relationship to a harm that has traditionally been regarded as providing a 12 basis for a lawsuit in English or American courts.” Spokeo, Inc. v. Robins, 578
13 U.S. 330, 341 (2016). The Court has described these traditional bases as causes of 14 action for things like intrusion upon seclusion, public disclosure of private fact, 15 and reputational damage. TransUnion LLC, 594 U.S. at 425. However, future 16 harms cannot form the basis of a concrete injury “unless the exposure to the risk of
17 future harm itself causes a separate concrete harm.” Id. at 436. 18 In their Third Amended Complaint, Plaintiffs allege that the last four digits 19 of Mr. Danakos’s Social Security number was among the information obtained
20 from the data breach, and that it was used in the effort to commandeer the Greek 1 Island’s Keybank account. Other Courts have held that attempts to use stolen 2 information to establish other bank accounts are sufficient allegations to establish
3 an injury in fact, though the injury of attempting to gain entry or establish another 4 account may be intangible. See Krefting v. Kaye-Smith Enterprises Inc., No. 2:23- 5 CV-220, 2023 WL 4846850, at *3 (W.D. Wash. July 28, 2023); Gaddy v. Long &
6 Foster Companies, Inc., No. CV 21-2396 (RBK)(EAP), 2023 WL 1926654, at *8 7 (D.N.J. Feb. 10, 2023) (“Misuse of financial information is a cognizable, intangible 8 injury that, even without financial loss, is sufficient to confer standing. A party’s 9 financial loss may affect the amount of its damages, but financial loss is not always
10 required for an injury in fact.”); Leonard v. McMenamins, Inc., No. 2:22-CV- 11 00094-BJR, 2022 WL 4017674, at *5 (W.D. Wash. Sept. 2, 2022). And so too 12 here, Mr. Danakos currently has alleged an injury in fact, as the last four digits of
13 his Social Security number were allegedly used to gain access to Greek Island’s 14 bank account. While true that this harm may not be pervasive, as it seems wholly 15 unlikely that any criminals could use the information stolen to open a new bank 16 account or credit card, the information is alleged to have accessed an existing bank
17 account and could seemingly be used to do so again. Thus, for that injury alone, 18 Mr. Danakos has established standing. 19 Defendant Newcourse also argues that the Danakoses may not state a claim
20 for the actual monetary amount lost from the Greek Island account as their own 1 personal injury for the purpose of standing, both because they have no right to 2 assert it as owners and because it is not a distinct claim from that of Greek Islands.
3 On the one hand, Greek Islands is an incorporated entity, and thus as owners, the 4 Danakoses normally do not have an interest in the damage done by a third-party 5 criminal to Greek Islands. United States v. Stonehill, 83 F.3d 1156, 1160 (9th Cir.
6 1996) (collecting cases); see also Sabey v. Howard Johnson & Co., 101 Wash. 7 App. 575, 584 (2000) (“Even a shareholder who owns all or most of the stock, but 8 who suffers damages only indirectly as a shareholder, cannot sue as an 9 individual.”); Woods View II, LLC v. Kitsap Cnty., 188 Wash. App. 1, 24 (2015)
10 (finding that the sole owner of a corporation was unable to assert “an injury 11 distinct from that of other shareholders” to recover financial damage sustained by 12 her construction company). Even a sole shareholder cannot establish standing by
13 claiming diminution in value of the corporation. Sparling v. Hoffman Constr. Co., 14 864 F.2d 635, 640 (9th Cir.1988). Thus, the Danakoses’ claim for their interest in 15 the money stolen from their family business is not enough to confer onto them a 16 separate injury for the purposes of standing.
17 However, a shareholder may assert an injury in fact for standing if they can 18 demonstrate a direct injury that is independent of that to the corporation. Shell 19 Petroleum, N.V. v. Graves, 709 F.2d 593, 595 (9th Cir. 1983). Further, there are
20 two instances recognized in Washington State law in which an individual 1 shareholder may assert an injury sustained by a corporation as their own for the 2 purpose of establishing standing: “(1) where there is a special duty, such as a
3 contractual duty, between the wrongdoer and the shareholder; and (2) where the 4 shareholder suffered an injury separate and distinct from that suffered by other 5 shareholders.” Sabey, 101 Wash. App. at 584–85. Defendant Newcourse argues
6 that the only claims advanced by the Danakoses are those which are shared with 7 Greek Islands, and thus they cannot establish standing. ECF No. 60 at 3. 8 However, as discussed above, Mr. Danakos alleges that his Social Security number 9 was used to gain access to the Greek Islands account. While the corporation is a
10 separate entity, it does not have its own Social Security number, demonstrating that 11 Mr. Danakos has a claim separate and apart from other shareholders. See Von 12 Brimer v. Whirlpool Corp., 536 F.2d 838, 846 (9th Cir. 1976) (holding that a
13 shareholder must assert more than economic injury suffered by the corporation to 14 have standing). Additionally, as is discussed more fully below, Greek Islands has 15 no independent connection to Defendant Newcourse, and it is alleged that the 16 corporation only came into contact with the mailing service through the misuse of
17 Mr. Danakos’ information. 18 Next, Defendant Newcourse argues that Plaintiffs still do not allege an 19 injury in fact because none of the information taken was personally identifiable,
20 and therefore not sensitive. ECF No. 53 at 10. The Washington law on security 1 breaches defines personal information in part as: 2 An individual’s first name or first initial and last name in combination with one or more of the following data elements: (A) Social security 3 number; (B) Driver's license number or Washington identification card number; (C) Account number or credit or debit card number, in 4 combination with any required security code, access code, or password that would permit access to an individual's financial account, or any 5 other numbers or information that can be used to access a person's financial account; (D) Full date of birth; (E) Private key that is unique 6 to an individual and that is used to authenticate or sign an electronic record; (F) Student, military, or passport identification number; (G) 7 Health insurance policy number or health insurance identification number; (H) Any information about a consumer's medical history or 8 mental or physical condition or about a health care professional's medical diagnosis or treatment of the consume. 9
10 RCW 19.255.005(2)(a). 11 The statute goes on to state that personal information “does not include 12 publicly available information that is lawfully made available to the public from 13 federal, state, or local government records.” RCW 19.255.005(2)(b). Here, 14 Plaintiffs allege that their full names, HomeStreet Bank account numbers, and the 15 last four digits of their Social Security numbers were compromised. ECF No. 52 at 16 22, ¶ 4.29. They maintain that they do not publicize any part of their Social 17 Security numbers, and that they are for all intents and purposes, private data points. 18 Defendant Newcourse insists that this information could not be used to achieve any 19 identity theft, and as such, Plaintiffs will be unable to maintain claims for time and 20 expense on preventive measures, diminution of value of the information, delay in 1 receipts of tax funds, and emotional harm. ECF No. 53 at 10‒11. 2 Given that the Court must take all Plaintiffs’ allegations as true and draw all
3 reasonable inferences in their favor, in this instance, the last four digits of a Social 4 Security number, in conjunction with a full name, is sensitive information. See 5 Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). Defendant points to
6 Federal Rule of Civil Procedure 5.2 as evidence that the last four digits of a Social 7 Security number can be substituted for the full number set in court filings, and 8 therefore do not function as inherently private pieces of identifiable information. 9 However, in accepting the Third Amended Complaint as true, there is more than a
10 remote possibility that a third-party may use the combination of Plaintiffs’ name 11 and partial social security numbers to gain access again to other financial accounts 12 that they already hold. In re Zappos.com, Inc., 888 F.3d 1020, 1027–28 (9th Cir.
13 2018). Moreover, a note to Rule 5.2 advises that “[w]hile providing for the public 14 filing of some information, such as the last four digits of an account number, the 15 rule does not intend to establish a presumption that this information never could or 16 should be protected.” In keeping in mind the In re Zappos, the Court finds that
17 Plaintiffs’ have alleged injuries in future harms such as preventative measures, 18 diminution in value of their personal identifying information, and emotional 19 distress, given they allege the information has already been used to assume Mr.
20 Danakos’s identity. See also Krefting, 2023 WL 4846850, at *3 (finding injury in 1 fact for investigating and mitigating breach, as well as the related emotional 2 stress).
3 However, the Court finds that the Third Amended Complaint does not 4 adequately plead an injury in fact regarding delay in receipt of tax refunds as 5 Plaintiffs do not explain how a breach of the last four digits of their social security
6 numbers impacted their tax refund. 7 B. Causal Connection 8 Under factor two, causation must be fairly traceable in connection between 9 the injury a plaintiff complains of and the conduct of the defendant. Steel Co. v.
10 Citizens for a Better Env’t, 523 U.S. 83, 103 (1998) (citing Simon v. E. Ky. Welfare 11 Rts. Org., 426 U.S. 26, 41–42 (1976)). A plaintiff may not rely on “a bare legal 12 conclusion to assert injury-in-fact,” or engage in an “ingenious academic exercise
13 in the conceivable” to establish the cause of the injury. Maya v. Centex Corp., 658 14 F.3d 1060, 1068 (9th Cir. 2011) (internal citation and quotations omitted). “A 15 causation chain does not fail simply because it has several ‘links,’ provided those 16 links are not hypothetical or tenuous and remain plausible.” Id. at 1070 (internal
17 quotations and citations omitted). Given the early stage of this case, Plaintiffs’ 18 burden to establish causation is relatively modest. Bennett v. Spear, 520 U.S. 154, 19 171 (1997).
20 Here, Plaintiffs allege that their claim survives a standing challenge because 1 they can demonstrate monetary injury, as well as the impending or substantial risk 2 of harm associated with the stolen information from the Newcourse data breach.
3 The last four digits of Mr. Danakos’s Social Security Number, as alleged to only 4 derive from the Newcourse data breach, was used to authenticate a security 5 question with KeyBank. ECF No. 52 at 25, ¶ 4.33. If proven true, this claim is a
6 contributing factor to the ultimate theft of the $432,500 from Greek Islands’ bank 7 account, serving as a causal link. 8 The Court also seeks to clarify its prior Order regarding which claims may 9 be asserted by the Danakoses with respect to standing. The current thread linking
10 Defendant Newcourse to this action is the allegation that it is the only entity from 11 which the third-party criminals could have received Mr. Danakos’s partial social 12 security number. ECF No. 52 at 25, ¶ 4.33. Should that thread become severed,
13 the claim will cease to arise out of the same conduct upon which this lawsuit is 14 based, Defendant Newcourse will be completely unrelated to all other defendants, 15 and dismissal will be proper. Fed. R. Civ. P. 20(2); see also Visendi v. Bank of 16 Am., N.A., 733 F.3d 863, 871 (9th Cir. 2013); Coleman v. Quaker Oats Co., 232
17 F.3d 1271, 1296 (9th Cir. 2000) (“Under Rule 20(b), the district court may sever 18 the trial in order to avoid prejudice.”). Because there is currently a tie between 19 Plaintiffs and Defendant Newcourse, the Court will retain claims related to their
20 identity theft more generally for the purposes of judicial economy. Coughlin v. 1 Rogers, 130 F.3d 1348, 1351 (9th Cir. 1997) (“Rule 20 is designed to promote 2 judicial economy, and reduce inconvenience, delay, and added expense.”).
3 C. Redressability 4 Finally, though not challenged by Defendant Newcourse, the Court notes 5 that if Plaintiffs are successful on the merits, the injury inflicted by the data breach
6 and threat of future harms is redressable by damages. See Lujan, 504 U.S. at 561. 7 II. Failure to State a Claim 8 Defendant next argues that, even if Plaintiffs’ have established standing, 9 they have failed to state a claim with respect to negligence, negligence per se, and
10 a violation of the Washington Consumer Protection Act, and are not entitled to 11 injunctive relief. ECF No. 53. 12 Federal Rule of Civil Procedure 12(b)(6) provides that a defendant may
13 move to dismiss the complaint for “failure to state a claim upon which relief can be 14 granted.” A 12(b)(6) motion will be denied if the plaintiff alleges “sufficient 15 factual matter, accepted as true, to ‘state a claim to relief that is plausible on its 16 face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
17 Twombly, 550 U.S. 544, 570 (2007)). A motion to dismiss for failure to state a 18 claim “tests the legal sufficiency” of the plaintiff’s claims. Navarro v. Block, 250 19 F.3d 729, 732 (9th Cir. 2001). While the plaintiff's “allegations of material fact are
20 taken as true and construed in the light most favorable to the plaintiff” the plaintiff 1 cannot rely on “conclusory allegations of law and unwarranted inferences ... to 2 defeat a motion to dismiss for failure to state a claim.” In re Stac Elecs. Sec. Litig.,
3 89 F.3d 1399, 1403 (9th Cir. 1996) (citation and brackets omitted). That is, the 4 plaintiff must provide “more than labels and conclusions, and a formulaic 5 recitation of the elements.” Twombly, 550 U.S. at 555. Instead, a plaintiff must
6 show “factual content that allows the court to draw the reasonable inference that 7 the defendant is liable for the alleged misconduct.” Iqbal, 556 U.S. 662. A claim 8 may be dismissed only if “it appears beyond doubt that the plaintiff can prove no 9 set of facts in support of his claim which would entitle him to relief.” Navarro,
10 250 F.3d at 732. 11 This matter is before this Court on the basis of its diversity jurisdiction 12 pursuant to 28 U.S.C. § 1332(a)(1); Plaintiffs are citizens of Washington State and
13 Defendant Newcourse is incorporated and has a principal place of business in 14 Tennessee. ECF No. 52 at 3, ¶¶ 2.2, 2.3, 2.6. As a federal court sitting in diversity 15 in Washington, this Court applies Washington’s choice-of-law rules. See Patton v. 16 Cox, 276 F.3d 493, 495 (9th Cir. 2001). Washington courts will only engage in a
17 choice-of-law analysis if there is actual conflict between Washington law and the 18 laws or interests of another state. FutureSelect Portfolio Mgmt., Inc. Tremont Grp. 19 Holdings, Inc., 180 Wash. 2d 954, 967 (2014). Here, both parties are seemingly in
20 agreement that Washington law applies. 1 2 A. Negligence
3 Defendant Newcourse first argues that Plaintiffs are unable to establish that 4 the printing company owed them any sort of duty, as they had no “special 5 relationship,” nor can they allege that Newcourse took any affirmative action
6 which led to the data breach. ECF No. 60 at 6‒7. Further, Defendant Newcourse 7 argues that Plaintiffs will be unable to demonstrate both injury and proximate 8 cause. ECF No. 53 at 16. 9 The elements of the tort of negligence are duty, breach, causation, and
10 damage or injury. Hartley v. State, 103 Wash. 2d 768, 777 (1985). Washington 11 law requires that the breach be the proximate cause of the injury, meaning that it is 12 both the cause in fact and the legal cause. Id. (internal citation omitted).
13 i. Duty 14 “The existence of a duty is a question of law and depends on mixed 15 considerations of logic, common sense, justice, policy, and precedent.” Snyder v. 16 Med. Serv. Corp. of E. Washington, 145 Wash. 2d 233, 243 (2001) (internal
17 quotation marks omitted). Duty may be “predicated on violation of statute or 18 common law principles of negligence.” Jackson v. City of Seattle, 158 Wash. App. 19 647, 651 (2010) (citation omitted).
20 Plaintiffs allege that Newcourse breached a duty to provide reasonable 1 cybersecurity measures, which is an unfair act under Section 5 of the Federal Trade 2 Commission Act. ECF No. 57 at 15. Defendant Newcourse argues that courts
3 have rejected the premise that a statutory duty can be based on a violation of 4 Section 5 of the Federal Trade Commission Act with respect to cybersecurity 5 measures. ECF No. 57 at 15.
6 Washington courts follow Restatement (Second) of Torts § 286 (1965) to 7 determine whether a statute imposes a legal duty. Hansen v. Friend, 118 Wn.2d 8 476, 480–81 (1992) (citation omitted). Under the Restatement, the statute that is 9 asserted to convey a duty must have a purpose that, “is found to be exclusively or
10 in part:” 11 (a) to protect a class of persons which includes the one whose interest is invaded, and 12 (b) to protect the particular interest which is invaded, and 13 (c) to protect that interest against the kind of harm which has resulted, 14 and
15 (d) to protect that interest against the particular hazard from which the harm results. 16 17 Restatement (Second) of Torts § 286 (1965). 18 Section 5 of the Federal Trade Commission Act prohibits unfair and 19 deceptive acts or practices in commerce. 15 U.S.C. § 45(a). “The paramount aim 20 of [the FTC Act] is the protection of the public from the evils likely to result from 1 the destruction of competition or the restriction of it in a substantial degree.” FTC 2 v. Raladam Co., 283 U.S. 643, 647–48 (1931). Courts outside of Washington have
3 interpreted this language to convey a duty to defend consumers from data hacking 4 and require adequate cybersecurity. See F.T.C. v. Wyndham Worldwide Corp., 799 5 F.3d 236, 240 (3d Cir. 2015); In re Cap. One Consumer Data Sec. Breach Litig.,
6 488 F. Supp. 3d 374, 407 (E.D. Va. 2020); In re Marriott Int'l, Inc., Customer 7 Data Sec. Breach Litig., 440 F. Supp. 3d 447, 479 (D. Md. 2020). However, courts 8 in Washington have acknowledged cases from other circuits, including Wyndham, 9 and roundly rejected the reasoning that the requirement of cybersecurity may be
10 read into the FTC Act to create a statutory-based duty. See Guy v. Convergent 11 Outsourcing, Inc., No. C22-1558 MJP, 2023 WL 4637318, at *4 (W.D. Wash. July 12 20, 2023); Veridian Credit Union v. Eddie Bauer, LLC, 295 F. Supp. 3d 1140,
13 1159 (W.D. Wash. 2017) (“Veridian alleges no harm from ‘the destruction of 14 competition,’ and it alleges neither that it is a customer nor a competitor of Eddie 15 Bauer.”); In re MCG Health Data Sec. Issue Litig. No. 2:22-CV-849-RSM-DWC, 16 2023 WL 4131746 (W.D. Wash. June 22, 2023). The Court declines to break with
17 the norm established by other courts in Washington, and thus does not find that the 18 FTC Act gives rise to a duty to protect from data breaches. Plaintiffs point to no 19 Washington case in which a court has recognized a legal duty arising out of the
20 FTC Act involving cybersecurity or data breaches, nor do they satisfy the 1 requirements of the Restatement. 2 However, Plaintiffs argue that nevertheless, they may maintain a negligence
3 claim under a common law theory of duty. In general, common law does not 4 impose a duty onto a private person to protect others from the criminal activity of a 5 third party. Nivens v. 7–11 Hoagy's Corner, 133 Wash.2d 192, 199 (1997)
6 (quoting Hutchins v. 1001 Fourth Ave. Assocs., 116 Wash.2d 217, 223 (1991)). 7 However, Washington law has recognized the duty to protect from third party 8 criminal activity in two situations: where there is a special relationship with the 9 victim or where there is a special relationship with the criminal. Tae Kim v.
10 Budget Rent A Car Sys., Inc., 143 Wash.2d 190, 195 (2001). 11 Plaintiffs allege that Defendant Newcourse created a high risk of harm 12 through its failure to safely retain Plaintiffs’ stored information. ECF No. 57 at 16.
13 This failure was an affirmative act, Plaintiffs argue, through their maintenance of 14 insufficient and inadequate security systems. Id. However, the Court finds that 15 Defendant Newcourse did not commit misfeasance, and instead is guilty of 16 nonfeasance. See Veridian Credit Union, 295 F. Supp. 3d at 1158 (determining
17 that a plaintiff’s allegation that the defendant failed to employ adequate data 18 security measures are omissions, and therefore nonfeasance rather than 19 misfeasance). Plaintiffs insist that the factual background of their case is
20 analogous to the findings of Krefting v. Kaye-Smith Enterprises Inc., No. 2:23-CV- 1 220, 2023 WL 4846850, at *4–5 (W.D. Wash. July 28, 2023), in which the 2 Western District of Washington found that a credit union had a duty to safeguard
3 the personal information of customers when it transferred such information to a 4 mailing service. Plaintiffs conclude, incorrectly, that baked into the decision was a 5 finding of an affirmative action by the mailing service. ECF No. 57 at 17.
6 However, the court in Krefting explicitly said that of the allegations that were 7 made in that case, the only affirmative act of the credit union was providing the 8 mailing service with its customers’ personal information.1 Krefting, 2023 WL 9 4846850, at *4–5. The court was silent as to the duty of the mailing service to
10 maintain the safety of the data transferred to it, and here the Court does not find 11 that Defendant Newcourse took any affirmative step giving rise to misfeasance. 12 In the matter at hand, the Court finds Plaintiffs’ arguments regarding a duty
1 “Plaintiff alleges BECU knew that ‘cybercriminals routinely target corporations 14 ... in an attempt to steal the[ir] collected Private Information,’ that Kaye-Smith 15 ‘failed to maintain many reasonable and necessary industry standards necessary to 16 prevent data breaches,’ that BECU failed to ensure that Kaye-Smith had proper 17 safeguards in place, and that BECU provided its customers’ PII to Kaye-Smith 18 nevertheless. Dkt. No. 1 at 6, 15, 17, 26. This last step, as alleged, is the 19 affirmative act by BECU that subjected Plaintiff to harm.” 20 1 arising through a third-party contract unavailing. First, the Third Amended 2 Complaint is silent as to a claim centering from a third-party beneficiary contract.
3 However, the Court is doubtful that Plaintiffs would be able to successfully carry a 4 claim of a duty arising out of a third-party contract, even if amendment was 5 granted.
6 Under Washington law, a third-party contract exists if performance under a 7 contract necessarily and directly benefits a third party. Warner v. Design & Build 8 Homes, Inc., 128 Wash. App. 34, 43 (2005). A benefit to a third party that is 9 incidental, indirect, or inconsequential is insufficient to demonstrate an intent to
10 create a contract directly obligating the promisor to perform a duty to a third party. 11 Del Guzzi Constr. Co. v. Global Northwest Ltd., 105 Wash.2d 878, 886 (1986). 12 Whatever contract Newcourse and HomeStreet Bank entered into was for the
13 benefit of Newcourse to provide mailing services for HomeStreet Bank. ECF No. 14 52 at 22, ¶ 4.28. And Plaintiffs’ Response does not assert anything except a 15 conclusory allegation, as they baldly claim that they were the beneficiary of the 16 contract between HomeStreet Bank and Newcourse. ECF No. 57 at 17. Any
17 benefit they may have been intended to receive from this contract was, at best, 18 indirect. 19 As Plaintiffs have failed to develop a theory of duty, the Court declines to
20 consider their arguments under injury and proximate cause, and dismisses their 1 negligence claim against Defendant Newcourse. 2 B. Negligence Per Se
3 Washington courts do not recognize a separate cause of action under 4 negligence per se. Veridian Credit Union, 295 F. Supp. 3d at 1155 (“[I]n 5 Washington, the violation of a statute or the breach of a statutory duty is not
6 considered negligence per se, but may be considered by the trier of fact as 7 evidence of negligence.”) As such, the Court dismissed Plaintiffs’ negligence per 8 se claim against Newcourse. 9 C. Washington Consumer Protection Act
10 The Washington's Consumer Protection Act (“CPA”) prohibits “[u]nfair 11 methods of competition and unfair or deceptive acts or practices in the conduct of 12 any trade or commerce.” RCW 19.86.020. “To prevail in a private CPA claim, the
13 plaintiff must prove (1) an unfair or deceptive act or practice, (2) occurring in trade 14 or commerce, (3) affecting the public interest, (4) injury to a person's business or 15 property, and (5) causation.” Panag v. Farmers Ins. Co. of Washington, 166 16 Wash. 2d 27, 37 (2009). All elements of the CPA must be satisfied in order to
17 bring a claim. Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 18 Wash.2d 778, 784 (1986). The CPA “shall be liberally construed [so] that its 19 beneficial purposes may be served.” RCW 19.86.920.
20 Defendant Newcourse argues that Plaintiffs are unable to satisfy the first 1 three elements of the CPA. ECF No. 53 at 21. The CPA does not define unfair or 2 deceptive, and Washington courts have “allowed the definitions to evolve through
3 a gradual process of judicial inclusion and exclusion.” Veridian Credit Union, 295 4 F. Supp. 3d at 1161. “An unfair act is established by evidence that it (1) causes or 5 is likely to cause substantial injury, which (2) consumers cannot avoid, and (3) is
6 not ‘outweighed by countervailing benefits.” Merriman v. Am. Guarantee & Liab. 7 Ins. Co., 198 Wash.App. 594, 368 (2017). 8 Given the liberal construction of the CPA, the Court finds that Plaintiffs’ 9 allegations that Newcourse failure to take appropriate cybersecurity measures and
10 secure their personal data constitutes an unfair practice. See Veridian Credit 11 Union, 295 F. Supp. 3d at 1162; Convergent Outsourcing, Inc., 2023 WL 4637318, 12 at *8 (“Plaintiffs’ allegations of Convergent's failure to secure their PII sufficiently
13 identifies an unfair act that satisfies this element of the CPA.”). Moreover, the 14 CPA does not require a direct or implied business or consumer relationship 15 between a plaintiff and a defendant. Panag v. Farmers Ins. Co. of Washington, 16 166 Wn.2d 27, 40 (2009). Plaintiffs argue they are two of 13,214 residents in
17 Washington affected by the data breach, which they allege ultimately contributed 18 to a $432,500 loss from their business. ECF No. 52 at 22‒23, ¶ 4.30. 19 Defendant Newcourse finally argues that Plaintiffs are unable to demonstrate
20 causation, as no action taken or not taken by the mailing service impacted the 1 Plaintiffs’ behavior with respect to the damage to the KeyBank account. ECF No. 2 60 at 10. Washington courts recognize a rebuttable presumption of reliance when
3 the unfair or deceptive act is premised on an omission, such as a failure to disclose 4 cybersecurity safety practices. Eng. v. Specialized Loan Servicing, 500 P.3d 171, 5 181 (Wash. Ct. App. 2021) (Remanding in part because the trial court erroneously
6 dismissed a CPA claim where borrower was entitled to rebuttable presumption of 7 reliance). Even in a situation where the parties are not in privity with one another, 8 there is still a requirement that the defendant’s violation caused the injury to 9 plaintiff, creating the necessary “link” of causation. Panag, 166 Wn.2d 27, 39–40
10 (2009) (“[W]hile RCW 19.86.090 requires such injury, and thus a connection 11 between the wrongdoing (the wrongdoer) and the plaintiff, it does not require that 12 the plaintiff be in a consumer or other business relationship with the actor.”).
13 In essence, Plaintiffs’ claim is that Defendant Newcourse does not disclose, 14 either directly or indirectly, its substandard security measure, and such failure to 15 safeguard their information damaged their business by assisting hackers in 16 accessing the KeyBank account. ECF No. 52 at 22‒25. The Court finds the link to
17 be flimsy, but for consideration under the standard required for a Rule 12(b)(6) 18 motion, the Court denies dismissal at this stage. See Mendiondo v. Centinela 19 Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). Though admittedly with
20 little discussion of the issue of causation, the court in Guy v. Convergent 1 Outsourcing, Inc., denied dismissal of a CPA claim with a similar factual 2 background. There, the court maintained a CPA claim against a third-party
3 consumer debt collector that experienced a data breach impacting the personally 4 identifiable information for 640,906 individuals who were not customers of the 5 collection service. Convergent Outsourcing, Inc., 2023 WL 4637318, at *1. In its
6 reasoning for denying dismissal of the claim, the court stated, “[p]laintiffs have 7 alleged an injury from the lost value of the PII and this satisfies both the CPA 8 element and Article III standing, given that it is a concrete injury fairly traceable to 9 Convergent's alleged misconduct.” Id. at *8. Here, the allegations are similar in
10 that the Court has found that Plaintiffs have alleged a concrete harm resulting from 11 the data breach. Given the relatively minimal showing required to overcome a 12 Motion to Dismiss, and the rebuttable nature of the presumption, the Court finds
13 that Plaintiffs have made an adequate showing to maintain their CPA claim. 14 Given this finding, the Court determines that it is premature to dismiss 15 Plaintiffs’ claim for injunctive relief as permitted by the CPA. See RCW 16 19.86.090; In re Zappos.com, Inc., 888 F.3d at 1030 (“And at least some of their
17 requested injunctive relief would limit the extent of the threatened injury by 18 helping Plaintiffs to monitor their credit and the like.”); Hockley v. Hargitt, 82 19 Wn.2d 337, 351 (1973) (“We hold that under RCW 19.86.090 an individual may
20 seek and obtain an injunction that would, besides protecting his own interests, protect the public interest.’’). 2|| ACCORDINGLY, IT IS HEREBY ORDERED: 3 1. Defendant’s Motion to Dismiss (ECF No. 53) is GRANTED in part and 4 DENIED in part. 5 2. Plaintiffs’ claims for negligence, negligence per se, and for damage 6 arising out of delayed tax returns against Defendant Newcourse are 7 DISMISSED with prejudice. 8 The District Court Executive is directed to enter this Order and furnish 9|| copies to counsel. 10 DATED December 26, 2024.
Sa gp STG, 0 ee 12 On Ke THOMAS O. RICE <> United States District Judge 13 14 15 16 17 18 19 20
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT