Lamie v. LendingTree, LLC

• Court: District Court, W.D. North Carolina
• Decided: February 9, 2023
• Docket: 3:22-cv-00307
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NORTH CAROLINA CHARLOTTE DIVISION DOCKET NO. 3:22-cv-00307-FDW-DCK CHRISTOPHER LAMIE AND AMABEL ) LIN, on behalf of themselves and others ) similarly situated, ) ) Plaintiff, ) ) ORDER vs. ) ) LENDINGTREE, LLC, ) ) Defendant. )

THIS MATTER is before the Court on Defendant’s Motion to Dismiss, (Doc. No. 14), which was filed before Plaintiffs amended their complaint, (Doc. No. 19), and Defendant’s Motion to Dismiss the First Amended Complaint, (Doc. No. 20). This motion has been fully briefed, (Doc. Nos. 21, 25, 26, 29, 30), and is ripe for ruling. For the reasons that follow, the Court DENIES AS MOOT Defendant’s original Motion to Dismiss and DENIES Defendant’s Motion to Dismiss the First Amended Complaint. I. BACKGROUND According to the Amended Complaint, Defendant is an online marketplace for loan services that acquires, collects, and stores private and sensitive personally identifiable information (“PII”) including full names, Social Security numbers, dates of birth, and street addresses provided by consumers and potential consumers as part of its business. (Doc. No. 19). Plaintiff Lin utilized Defendant’s services for financial borrowing needs, and—as part of the transaction—provided Defendant with her PII, which Defendant then stored on its servers. Plaintiff Lamie never utilized Defendant’s services, but alleges Defendant obtained his PII from third parties as part of a data 1 aggregation and marketing plan. Defendant also stored Lamie’s PII on its servers. Defendant sent both named Plaintiffs a Notice of Data Breach letter dated June 29, 2022, indicating that on June 3, 2022, Defendant determined that “a code vulnerability likely resulted in the unauthorized disclosure of . . . sensitive personal information” and that the “unauthorized disclosure began in mid-February 2022.” (Doc. No. 19, p. 6). Plaintiffs contend the data breach occurred in a “criminal cyberattack” when criminals “illegally accessed Defendant’s network for the specific purpose of targeting the PII,” which the criminals “accessed,” “exfiltrated,” “exposed,” and “posted the entire dataset” on a web forum. (Doc. No. 19, pp. 10, 25, 27). Plaintiffs allege various injuries arising out of the data breach. Among other things, Lin contends she suffered “multiple

identify theft and/or fraud attempts . . . including attempted loan applications, unknown funds being deposited into her bank account, and others.” (Doc. No. 19, p. 26). Similarly, Lamie contends that his injuries include “at least four instances of identify theft . . . [including] fraudulent charges on his personal credit card[;]” and, in May 2022, “someone attempted to open an account in his name with an online store, someone else changed his USPS home address, and another person tried to open financial accounts in his name with three different institutions.” (Doc. No. 19, p. 28). Plaintiffs, on behalf of themselves and purported classes of similarly situated individuals, filed suit against Defendant alleging various claims arising out of the 2022 data breach. Plaintiffs

assert claims in tort (negligence and negligence per se), breach of implied contract (including the related claim for unjust enrichment), and pursuant to statutory law (North Carolina’s Unfair and Deceptive Trade Practices Act). Defendant seeks dismissal of Plaintiffs’ claims.

2 II. APPLICABLE LAW As an initial matter, the parties disagree as to the law that governs this action. The named Plaintiffs Christopher Lamie and Amabel Lin are residents of Massachusetts and Hawaii respectively, and Defendant is a Delaware limited liability company with its headquarters and principal place of business in Charlotte, North Carolina. Plaintiffs contend North Carolina law applies, while Defendant contends the laws of Plaintiffs’ home states govern their claims. A federal court sitting in diversity jurisdiction, as it does here, must apply the substantive law and choice-of-law rules of the state in which it sits. Colgan Air, Inc. v. Raytheon Aircraft Co., 507 F.3d 270, 275 (4th Cir. 2007); see also Volvo Constr. Equip. N. Am., Inc. v. CLM Equip. Co.,

386 F.3d 581, 599–600 (4th Cir. 2004) (citing Erie R.R. Co. v. Tompkins, 304 U.S. 64, 79 (1938)). In determining the applicable law to govern these claims, the Court applies North Carolina’s choice of law rules. For tort claims, North Carolina uses the law of the situs, or “lex loci,” test to determine the choice of law. See Boudreau v. Baughman, 368 S.E.2d 849, 854 (N.C. 1988); Harco Nat'l Ins. Co. v. Grant Thornton LLP, 698 S.E.2d 719, 722 (N.C. Ct. App. 2010). “[T]he state where the injury occurred is considered the situs of the claim.” Boudreau, 368 S.E.2d at 854; see Harco, 698 S.E.2d at 722. The court must scrutinize the allegations in the amended complaint to determine “where the plaintiff has actually suffered harm.” Harco, 698 S.E.2d at 726. “The plaintiff's injury is

considered to be sustained in the state where the last act occurred giving rise to the injury.” Id. at 724. “The law of the place where the injury occurs controls tort claims, because an act has legal significance only if the jurisdiction where it occurs recognizes that legal rights and obligations ensue from it.” Terry v. Pullman Trailmobile, Div. of Pullman, Inc., 376 S.E.2d 47, 49 (N.C. Ct. 3 App. 1989); see also Quillen v. International Playtex, Inc., 789 F.2d 1041, 1044 (4th Cir. 1986) (“The place of the wrong for purposes of the lex loci delicti rule, however, is defined as the place where ‘the last event necessary to make an act liable for an alleged tort takes place.’” (quoting Miller v. Holiday Inns, Inc., 436 F. Supp. 460, 462 (E.D.Va.1977)). Defendant concedes, “Unjust enrichment is considered a tort for the purpose of North Carolina choice of law rules.” (Doc. No. 21, p. 19 (citing N.C. ex rel. Long v. Coastal States Life Ins. Co., 1994 U.S. Dist. LEXIS 21844, at *11 (E.D.N.C. Apr. 18, 1994)). Other authority supports the conclusion that the last act giving rise to a defendant’s liability occurs where the defendant received the alleged benefit for which it is unjustly enriched. See, e.g., SensorRx, Inc. v. Eli Lilly & Co., No. 3:19-CV-643-RJC-DCK,

2022 WL 4480701, at *4 (W.D.N.C. Sept. 26, 2022) (concluding under North Carolina choice of law principles that Indiana law governed the plaintiff’s unjust enrichment claim because the “last act triggering liability” occurred at the defendant’s principle place of business in Indiana and is also the place where the defendant received “any benefit from the information”). Plaintiff Lin alleges a claim for breach of implied contract based on Defendant’s “conduct and statements,” as well as her “reasonabl[e] belie[f]” and “meeting of the minds that Defendant would secure, protect, and keep the PII confidential.” (Doc. No. 19, p. 40). A contract implied in fact arises where the intention of the parties is not expressed, but an agreement in fact, creating an obligation is implied or presumed from their acts, or, as it has been otherwise stated, where there are circumstances which, according to the ordinary course of dealing and the common understanding of men, show a mutual intent to contract.

Snyder v. Freeman, 266 S.E.2d 593, 602 (N.C. 1980) (marks omitted). “Such an implied contract is as valid and enforceable as an express contract.” Creech v. Melnik, 495 S.E.2d 907, 911 (N.C. 1998). Under North Carolina’s choice-of-law principles, “the interpretation of a contract is 4 governed by the law of the place where the contract was made.” Schwarz v. St. Jude Med., Inc., 802 S.E.2d 783, 788 (N.C. Ct. App. 2017) (quoting Tanglewood Land Co. v. Byrd, 261 S.E.2d 655, 656 (N.C. 1980)). “[T]he place at which the last act was done by either of the parties essential to a meeting of the minds determines the place where the contract was made.” Nytco Leasing, Inc. v. Dan-Cleve Corp, 230 S.E.2d 559, 562–63 (N.C. Ct. App. 1976) (citing Fast v. Gulley, 155 S.E.2d 507 (N.C. 1967)). III. ANALYSIS In applying North Carolina choice of law principles to the claims at bar, the Court finds persuasive the decisions from colleagues in the District Court of South Carolina and the Middle

District of North Carolina, where the courts concluded during the early stages of litigation in data beach cases that the last act necessary in which the defendant could potentially be liable for the common law torts to be in the state in which the servers were located, noting that the injury occurs when the data is stolen. See Detrina Solomon, on behalf of herself & all others similarly situated, v. ECL Group, LLC, No. 1:22-CV-526, 2023 WL 1359662 (M.D.N.C. Jan. 31, 2023) (applying North Carolina law in reliance on the complaint’s allegations regarding the defendant’s operations in North Carolina); In re Blackbaud, Inc., Customer Data Breach Litig., 567 F. Supp. 3d 667, 675 (D.S.C. 2021) (applying South Carolina law because the place of the breach cannot be determined without further discovery and South Carolina is the only location for the defendant specifically

enumerated in the record) (hereinafter, “2021 Blackbaud”); see also In re Blackbaud, Inc., Customer Data Sec. Breach Litig., No. 3:20-MN-02972-JFA, 2022 WL 2314714 (D.S.C. June 28, 2022) (revisiting the prior decision following discovery regarding the location of the defendant’s servers and applying Massachusetts law because the last act necessary in which the defendant 5 could be liable occurred in Massachusetts, where the servers were located) (hereinafter, “2022 Blackbaud”). For purposes of the unjust claim, the Amended Complaint indicates the last act triggering Defendant’s liability for unjust enrichment occurred when it “wrongfully accepted and retained these benefits,” including Lin’s PII. (Doc. No. 19, p. 42). Following the reasoning in these cases, as well as the applicable law cited therein, the Court concludes that for purposes of the instant motion and at this stage in the litigation, North Carolina—as the situs of Defendant’s headquarters and principal place of business—law applies to Plaintiffs’ claims for negligence, negligence per se, and unfair and deceptive trade practices, as well as Lin’s claim for unjust enrichment. As the court anticipated in Solomon and the 2021

Blackbaud cases, and as the court did in the 2022 Blackbaud case, the decision here at this early stage of litigation leaves open the possibility to revisit the choice of law question should discovery uncover additional facts to alter this analysis. Solomon, 2023 WL 1359662, at *5 (“A more definitive resolution of the choice of law question is deferred until ‘after the parties have developed the factual evidence through the process of discovery,’ and with briefing that addresses more specifically where the injury ascribed to each cause of action arose.” (quoting Clean Earth of Md., Inc. v. Total Safety, Inc., No. 10-CV-119, 2011 WL 1627995, *4 (N.D.W. Va. Apr. 28, 2011); citing In re Blackbaud, Inc., 567 F. Supp. 3d at 675 n.5 (collecting cases supporting this approach)). Turning to Lin’s claim for breach of implied contract, the Amended Complaint suggests

the last act by either of the parties essential to a meeting of the minds occurred when “Plaintiff Lin and Class Members accepted Defendant’s offers and provided their PII to Defendant.” (Doc. No. 19, p. 40). For Lin, this occurred in Hawaii. Accordingly, Hawaiian law applies to this claim.

6 Applying North Carolina law, the Court concludes that both Plaintiffs have met the minimal standard of plausibility for their claims for negligence,1 negligence per se,2 and statutory unfair and deceptive trade practices,3 as well as Lin’s claim for unjust enrichment4. Additionally, under Hawaiian law, Plaintiff Lin has sufficiently alleged a claim for breach of implied contract.5

1 See e.g., Solomon, 2023 WL 1359662, at *5 (applying North Carolina law to summarily find negligence to be sufficiently pled); see also Williams v. AT&T Mobility, LLC, No. 5:19-CV-475-BO, 2020 WL 1492803, at *6 (E.D.N.C. Mar. 25, 2020) (denying motion to dismiss after hackers obtained PII from the defendant, noting inapplicability of economic loss rule; “Plaintiff . . . is seeking to recover for tortious conduct where the harms proliferated to every aspect of his life, well beyond his contractual relationship . . . ..”); Curry v. Schletter Inc., No. 1:17-CV-0001-MR-DLH, 2018 WL 1472485, at *4 (W.D.N.C. Mar. 26, 2018) (denying motion to dismiss because negligence claims sufficiently plead in data disclosure case between employees and employer; noting the court was leaving open the determination of whether a duty existed from “the facts and evidence to be presented” at a later stage in litigation). 2 See e.g., Solomon, 2023 WL 1359662, at *5 (applying North Carolina law to summarily find negligence per se to be sufficiently pled); but see In re Blackbaud, Inc., Customer Data Breach Litig., 567 F. Supp. 3d 667, 684 (D.S.C. 2021) (“Turning to the FTC Act as a potential basis for negligence per se, the court notes that courts outside of South Carolina appear to be split on whether the FTC Act can serve as the basis for a negligence per se claim in the data breach context.” (collecting cases)). 3 See e.g., Solomon, 2023 WL 1359662, at *5 (applying North Carolina law to find Chapter 75 unfair and deceptive trade practices claim to be sufficiently pled). 4 “In order to establish a claim for unjust enrichment in North Carolina, a plaintiff must show that (1) plaintiff conferred a measurable benefit to defendant, (2) defendant knowingly and voluntarily accepted the benefit, and (3) the benefit was not given gratuitously. Under the doctrine of quantum meruit, the measure of damages for unjust enrichment is the reasonable value of the goods and services to the defendant.” Anderson v. Lab’y Corp. of Am. Holdings, No. 1:17CV193, 2019 WL 3858320, at *3 (M.D.N.C. Aug. 16, 2019) (citations and omissions omitted); see, e.g., McCreary v. Filters Fast LLC, No. 3:20-CV-595-FDW-DCK, 2021 WL 3044228, at *8 (W.D.N.C. July 19, 2021) (denying without explanation motion to dismiss claim for unjust enrichment in data breach case); see also Bruin v. Bank of America, N.A., No. 3:22-CV-140-MOC-DSC, 2022 WL 4007273, at *5 (W.D.N.C. Sept. 1, 2022) (denying motion to dismiss unjust enrichment claim even though plaintiff-consumer received bargained-for benefit in transaction with defendant (citing Intercollegiate Women’s Lacrosse Coaches Ass’n v. Corrigan Sports Enters., Inc., 505 F. Supp. 3d 570, 587 (M.D.N.C. 2020) (declining to accept the defendant's argument that the plaintiff’s retention of benefit was not unjust at the pleading stage)). 5 Under Hawaiian law: [A]n implied contract exists “where the intention of the parties is not expressed, but an agreement in fact, creating an obligation, is implied or presumed from their acts.” Kemp v. Haw. Child Support Enforcement Agency, 141 P.3d 1014, 1038 (Haw. 2006). The Hawai'i Supreme Court has found such an obligation “in the case where a person performs services for another, who accepts the same, the services not being performed under such circumstances as to show that they were intended to be gratuitous, or where a person performs services for another on request.” Id. (quoting Durette v. Aloha Plastic Recycling, 100 P.3d 60, 74 (Haw. 2004) (internal citations and quotation marks omitted)). Dairy Rd. Partners v. Maui Gas Ventures LLC, No. CV 16-00611 DKW-KJM, 2018 WL 1244147, at *14 (D. Haw. Mar. 9, 2018). The Court notes these elements mirror the elements required under North Carolina for the claim of unjust enrichment. See Anderson, 2019 WL 3858320, at *3. Hawaii law also recognizes a claim for breach of implied contract where a plaintiff alleges: 7 Defendant cites to Patao v. Equifax, Inc., No. CV 19-00677 JMS-WRP, 2020 WL 5033561, at *6 (D. Haw. Aug. 25, 2020), to argue dismissal of this claim is appropriate. In that case, the court explained, “Plaintiff fails to identify or provide a copy of any applicable contract between the parties. The documents Plaintiff sent to Equifax do not constitute binding contracts because there is no indication that Equifax agreed to Plaintiff's terms.” Id. (citing Carson v. Saito, 53 Haw. 178, 182, 489 P.2d 636, 638 (1971) (recognizing that as a “fundamental principle of law[,] there must be mutual assent or a meeting of the minds on all essential elements or terms in order to form a binding contract”) (quoting Honolulu Rapid Transit Co. v. Paschoal, 51 Haw. 19, 26, 449 P.2d 123, 127 (1968)); see also In re Estate of Tahilan v. Friendly Care Home Health Servs., Inc., 731

F. Supp. 2d 1000, 1006 (D. Haw. 2010) (explaining that mutual assent must include “an offer, an acceptance, and consideration”) (citing Douglass v. Pflueger Haw., Inc., 110 Haw. 520, 525, 135 P.3d 129, 134 (2006)). Unlike the plaintiff in Patao, Plaintiff Lin here identifies an applicable agreement: Defendant’s privacy policy, including Defendant’s representations that it “maintain[s] physical, electronic, and procedural measures designed to safeguard your information from

[T]he breach of “an agreement in fact,” which is not express but “is implied or presumed” based upon the actions of the parties. Kemp v. State of Hawaii Child Support Enforcement Agency, 111 Hawai'i 367, 391, 141 P.3d 1014, 1038 (2006); see also Durette v. Aloha Plastic Recycling, Inc., 105 Hawai'i 490, 504, 100 P.3d 60, 74 (2004) (Under Hawaii law, an implied contract can be found where the intentions of the parties are not expressed, “but an agreement in fact, creating an obligation, is implied or presumed from their acts.”) (citation omitted); Davis v. Four Seasons Hotel Ltd., No. CIV. 08-00525-HG-LEK, 2010 WL 3946428, at *14 (D. Haw. Sept. 30, 2010). An implied contract, like an oral contract, may be enforceable upon proof of “an offer, an acceptance, and consideration,” as evidenced by the conduct of the parties. See In re Estate of Tahilan v. Friendly Care Home Health Servs., Inc., 731 F. Supp. 2d 1000, 1006 (D. Haw. 2010) (quoting Douglass v. Pflueger Haw., Inc., 135 P.3d 129, 134 (Haw. 2006); Evergreen Eng'g, Inc. v. Green Energy Team LLC, 884 F. Supp. 2d 1049, 1059 (D. Haw. 2012) (quoting In re Doe, 978 P.2d 166, 174 (Haw. 1999)) (stating elements of breach of contract claim). Cumis Insurance Society, Inc. v. Vallatini, No. CV 17-00538 DKW-KJM, 2018 WL 3430672, at *3 (D. Haw. July 16, 2018) (cleaned up). In short, the elements for proof of breach of an implied contract in Hawaii also mirror the elements in North Carolina. Compare Kemp, 141 P.3d 1014, 1038 (Haw. 2006) with Snyder, 266 S.E.2d at 602 (N.C. 1980). 8 unauthorized access and disclosure.” (Doc. No. 19, p. 8 (citation omitted)). In light of this distinction and construing the allegations as a whole in the light most favorable to Lin, she has sufficiently plead a breach of implied contract claim under Hawaiian law. The Court draws particular attention to the minimal sufficiency of Plaintiffs’ allegations under the choice of law analysis conducted at this preliminary stage in the pleadings. In other words, the Court’s rulings herein as to both choice of law and the sufficiency of Plaintiffs’ claims are without prejudice to any party to reassert their arguments, including those directed to Plaintiffs’ alleged injuries and damages, in dispositive motions based on a more developed factual record. IV. CONCLUSION IT IS THEREFORE ORDERED that Defendant’s Motion to Dismiss, (Doc. No. 14), is DENIED AS MOOT, and Defendant’s Motion to Dismiss the First Amended Complaint, (Doc. No. 20), is DENIED. IT IS SO ORDERED.

Signed: February 9, 2023

Frank D. Whitney United States District Judge * ey