Locke v. Wetzel

Opinion

UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF PENNSYLVANIA DARYL LOCKE, : : Civil No. 3:19-cv-0499 Plaintiff : : (Judge Mariani) V. : JOHN WETZEL, et al., : Defendants MEMORANDUM On March 20, 2019, Plaintiff Daryl Locke (“Plaintiff”), an inmate currently confined in the Smithfield State Correctional Institution, Huntingdon, Pennsylvania (“SClI-Smithfield”), filed the above-captioned action pursuant to 42 U.S.C. § 1983 and the Fair Credit Report Act (“FCRA’). The named Defendants are John Wetzel (“Wetzel”), Mr. Dribelbris (“Dreibelbis”), Mr. Swisher (“Swisher”), Debra Jadlocks (“Jadlocki’),' Ms. P. Luther (“Luther”), and Mr. Rupert (“Rupert”). (Doc. 1.) Presently before the Court is Defendants’ motion to dismiss Plaintiff's complaint. (Doc. 11.) The motion if fully briefed and is ripe for disposition. For the reasons set forth below, Defendants’ motion to dismiss will be denied.

1 Defendants’ filings clarify that the correct spelling of Defendants Dribelbris and Jadlocks’ last names is Dreibelbis and Jadlocki, respectively. The Court therefore will direct the Clerk of Court to amend the docket to reflect the correct spelling.

I. BACKGROUND Plaintiff alleges that at some unknown time, he “read in the newspaper that on April 3, 2018, a company named Accreditation Audit Risk-Management Security, LLC (AARMS) had suffered a data breach, while in possession of the private information of 13,100 inmates, 680 employees and 11 others within the State Department of Corrections (DOC).” (Doc. 1 at 7.) AARMS notified the DOC of the data breach on April 9, 2018. Id. Defendant Wetzel, however, did not mail notice of the data breach to Plaintiff until July 19, 2018, and Plaintiff received the notice on July 24, 2018. Id. Plaintiff maintains that the DOC “never informed [him] that they would be distributing his private information (Full Name, Home Address, Social Security Number and Medical Records) to a third party, which is contracted vendor of the DOC.” /d. He alleges that the DOC “failed to obtain a signed release form (DC-108 form) from [him] which would have authorized the release of his private information to a third party.” /d. Plaintiff asserts that Defendants, all of whom are supervisors of various departments within the DOC, disseminated his private information without his consent. /d. at 2-3, 8. He further maintains that Defendant Wetzel’s failure to promptly notify him of the data breach “gave ample amount of time for [his] private information to be sold/misused.” /d. at 8. Plaintiff alleges that because of the data breach and the delay in notification, “he is 9.5 times more likely than the public to suffer identity fraud or theft.” /d. Based on these allegations, Plaintiff asserts that Defendants violated his “civil rights to privacy,” his rights under the FCRA, and -2-

“numerous State [p]rivacy [I]Jaws and DOC policy.” /d. at 3, 9. He seeks declaratory and injunctive relief, as well as damages. /d. at 4, 10.

I. STANDARDS A. Motion to Dismiss Pursuant to Federal Rule of Civil Procedure 12(b)(1) Defendants move for the dismissal of Plaintiffs complaint pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, asserting that the Court lacks subject-matter jurisdiction over Plaintiff's claims because he lacks standing to pursue them. (Doc. 12 at 4- 7.) Amotion to dismiss a case for lack of standing is properly brought under Rule 12(b)(1) because standing is a jurisdictional matter. See Ballentine v. United States, 486 F.3d 806, 810 (3d Cir. 2007). When evaluating a motion brought under Rule 12(b)(1), a court must first determine whether the movant presents a facial or factual attack. See In re Schering Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 243 (3d Cir. 2012). A facial challenge contests the sufficiency of the pleadings, meaning a court must consider the allegations of the complaint in the light most favorable to the plaintiff. See Gould Elec., Inc.

v. United States, 220 F.3d 169, 176 (3d Cir. 2000). By contrast, when reviewing a factual attack, a court may consider evidence outside the pleadings. See id. The Court construes Defendants’ standing challenge to be a facial attack given that they provide no evidence outside the pleadings and that they maintain that Plaintiff has

-3-

“fail[ed] to allege an actual or imminent injury” to establish standing. (Doc. 12 at 6.) Pursuant to Rule 12(b)(1), the Court must accept as true all material allegations set forth in the complaint and must construe those facts in favor of the non-moving party. See Ballentine, 486 F.3d at 810. When evaluating whether a complaint adequately pleads the elements of standing, a court applies the same standard of review as on a Rule 12(b)(6) motion to dismiss for failure to state a claim. See In re Schering Plough, 678 F.3d at 243. Accordingly, a plaintiff must assert facts that affirmatively and plausibly suggest that the pleader has the rights he claims (here, the right to jurisdiction), rather than facts that are merely consistent with such a right. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 557 (2007). To establish standing, a plaintiff must first allege “an ‘injury in fact,’ or an ‘invasion of

a legally protected interest’ that is ‘concrete and particularized.” See In re Horizon Healthcare Servs. Inc. Data Breach Litig. (“In re Horizon”), 846 F.3d 625, 633 (3d Cir. 2017) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Second, the plaintiff must establish a “causal connection between the injury and the conduct complained of.” See Lujan, 504 U.S. at 560. Finally, the plaintiff must allege the likelihood “that the injury will be redressed by a favorable decision.” See id. at 561. “In the context of a motion to dismiss, [the United States Court of Appeals for the Third Circuit has] held that the [iJnjury-in-fact element is not Mount Everest. The contours of the injury-in-fact requirement, while not precisely defined, are very generous, requiring only that [the] claimant allege[] some -4-

specific, identifiable trifle of injury.” Blunt v. Lower Merion Sch. Dist., 767 F.3d 247, 278 (3d Cir. 2014). “At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion to dismiss [courts] presum[e] that general allegations embrace those specific facts that are necessary to support the claim.” Lujan, 504 U.S. at 561.

B. Motion to Dismiss Pursuant to Federal Rule of Civil Procedure 12(b)(6) Defendants also move for the dismissal of Plaintiff's complaint pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure for failure to state a claim. (Doc. 12 at 7-8.) Federal notice and pleading rules require the complaint to provide the defendant notice of the claim and the grounds upon which it rests. See Phillips v. Cty. of Allegheny, 515 F.3d 224, 232 (3d Cir. 2008). The plaintiff must present facts that, accepted as true, demonstrate

a plausible right to relief. See Fed. R. Civ. P. 8(a). Although Federal Rule of Civil Procedure 8(a)(2) requires “only a short and plain statement of the claim showing that the pleader is entitled to relief,” a complaint may nevertheless be dismissed under Federal Rule of Civil Procedure 12(b)(6) for its “failure to state a claim upon which relief can be granted.” See Fed. R. Civ. P. 12(b)(6). When ruling on a motion to dismiss under Rule 12(b)(6), the court accepts as true all factual allegations in the complaint and all reasonable inferences that can be drawn from them, viewed in the light most favorable to the plaintiff. See Ashcroft v. Iqbal, 556 U.S. 662,

-5-

679 (2009); In re Ins. Brokerage Antitrust Litig., 618 F.3d 300, 314 (3d Cir. 2010). To prevent dismissal, all civil complaints must set out “sufficient factual matter” to show that their claims are facially plausible. See Iqbal, 556 U.S. at 678; Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009). The plausibility standard requires more than a mere possibility that the defendant is liable for the alleged misconduct: “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged — but it has not ‘show(n] — ‘that the pleader is entitled to relief.” See Iqbal, 556 U.S. at 679 (citing Fed. R. Civ. P. 8(a)(2)). Accordingly, the Third Circuit has identified the following steps that a district court must take when reviewing a 12(b)(6) motion: (1) identify the elements that a plaintiff must plead to state a claim; (2) identify any conclusory allegations contained in the complaint that

are “not entitled” to the assumption of truth; and (3) determine whether any “well-pleaded factual allegations” contained in the complaint “plausibly give rise to an entitlement to relief.” See Santiago v. Warminster Twp., 629 F.3d 121, 130 (3d Cir. 2010) (internal citations and quotation marks omitted). The Third Circuit has specified that in ruling on a Rule 12(b)(6) motion to dismiss for failure to state a claim, “a court must consider only the complaint, exhibits attached to the complaint, matters of public record, as well as undisputedly authentic documents if the complainant's claims are based upon these documents.” See Mayer v. Belichick, 605 F.3d 223, 230 (3d Cir. 2010) (citing Pension Benefit Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993)). -6-

In the context of pro se prisoner litigation, the court must be mindful that a document filed pro se is “to be liberally construed.” See Estelle v. Gamble, 429 U.S. 97, 106 (1976). A pro se complaint, “however inartfully pleaded,” must be held to “less stringent standards than formal pleadings drafted by lawyers” and can be dismissed for failure to state a claim only if it appears beyond a doubt that the plaintiff can prove no set of facts in support of his claim that would entitle him to relief. See Haines v. Kerner, 404 U.S. 519, 520-21 (1972).

C. Section 1983 Standard Section 1983 is the vehicle by which private citizens may seek redress for violations of federal constitutional rights committed by state officials. See 42 U.S.C. § 1983. The statute states, in pertinent part: Every person who, under color of any statute, ordinance, regulation, custom, or usage, of any State or Territory or the District of Columbia, subjects, or causes to be subjected, any citizen of the United States or other person within the jurisdiction thereof to the deprivation of any rights, privileges, or immunities secured by the Constitution and laws, shall be liable to the party injured in an action at law, suit in equity, or other proper proceeding for redress. Id. “Section 1983 is not a source of substantive rights,” but is merely a means through which “to vindicate violations of federal law committed by state actors.” See Pappas v. City of Lebanon, 331 F. Supp. 2d 311, 315 (M.D. Pa. 2004) (quoting Gonzaga Univ. v. Doe, 536 U.S. 273, 284-85 (2002)). To state a cause of action under Section 1983, a plaintiff must allege that: (1) the conduct complained of was committed by persons acting under color of state law; and (2) the conduct violated a right, privilege, or immunity secured by the ,

-7-

Constitution or laws of the United States. See Harvey v. Plains Twp. Police Dep't, 421 F.3d 185, 189 (3d Cir. 2005) (quoting West v. Atkins, 487 U.S. 42, 48 (1988)).

lil. DISCUSSION

A. Standing Defendants first assert that Plaintiffs complaint is subject to dismissal pursuant to Rule 12(b)(1) because Plaintiff lacks standing to sue. (Doc. 12 at 5.) Defendants maintain that the Third Circuit “has held that in the event of a data breach, a plaintiff does not suffer a harm, and thus does not have standing to sue, unless plaintiff alleges actual ‘misuse’ of the information, or that such misuse is imminent.” /d. at 6, citing Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir. 2011)).) They argue that Plaintiff lacks standing because he “makes no claim or allegation that his personal information was used for any improper purpose, or that he has suffered any actual injury that rises above mere speculative harm.” /d. Plaintiff, however, suggests that the “unauthorized dissemination of personal information causes an injury in and of itself, whether or not the disclosure of that information increased the risk of identity theft or some other future harm.” (Doc. 17 at 3). As noted above, Plaintiff maintains that Defendants’ alleged unauthorized dissemination of his personal information violated his right to privacy under § 1983 and violated his rights under the FCRA. The Third Circuit has noted that “the violation of a

-8-

statute can cause an injury in fact and grant Article III standing.” See In re Horizon, 846 F.3d at 635. In In re Horizon, the Third Circuit concluded that the plaintiffs had standing to

sue based upon Horizon’s alleged violation of the FCRA, which placed the plaintiffs at an increased risk for identity fraud and theft. See id. at 634-641. The court recognized that the plaintiffs were alleging “the unauthorized dissemination of their own private information—the

very injury that FCRA is intended to prevent.” See id. at 640. Thus, the court noted, the plaintiffs had alleged “a de facto injury that satisfies the concreteness requirement for Article Ill standing.” See id. Here, like the plaintiffs in In re Horizon, Plaintiff alleges that Defendants violated his rights under § 1983 and the FCRA by disseminating his personal information to AARMS without obtaining his authorization to do so. He maintains that the resulting data breach places him at greater risk to suffer from identity fraud and theft. (Doc. 1 at 8.) Given Plaintiff's allegations, and in light of the Third Circuit's holding in In re Horizon, the Court concludes that Plaintiff has stated a cognizable injury for Article III standing purposes. Accordingly, the Court will deny Defendants’ motion to dismiss Plaintiff's complaint pursuant to Rule 12(b)(‘).

B. Failure to State a Claim Defendants also move for the dismissal of Plaintiffs complaint pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, arguing that his “claim that his private data

-9-

was unlawfully shared without his authorization or consent is unavailing.” (Doc. 12 at 8.) Defendants maintain that: (1) “Plaintiffs full name and home address are viewable on publicly available sentencing documents associated with his arrest, charges and conviction’, (2) his medical information was shared with AARMS, pursuant to 45 C.F.R. § 164.512(k)(5)(i)(F), for “American Correctional Association auditing purposes”; and (3) “Plaintiff identifies no statute, law or other authority that prohibits the [DOC] from providing [Plaintiff's Social Security number]’ to third parties. /d. at 7. As noted above, Plaintiff maintains that Defendants violated his rights under § 1983 and the FCRA by disseminating his personal information without his authorization and consent. Defendants, however, have not addressed whether Plaintiff has a right to privacy regarding such information under § 1983 and whether Plaintiff can maintain a claim for relief under the FCRA, and at this juncture, the Court cannot properly consider these issues absent briefing from the parties. Accordingly, the Court will deny Defendants’ motion to dismiss Plaintiffs complaint pursuant to Rule 12(b)(6) without prejudice to their right to file a renewed motion addressing Plaintiffs claims under § 1983 and the FCRA.

IV. CONCLUSION For the foregoing reasons, the Court will deny Defendants’ motion to dismiss (Doc. 12) without prejudice. Defendants will be permitted to file a renewed motion to dismiss that

-10-

addresses whether Plaintiff has stated plausible claims for relief pursuant to § 1983 and the FCRA. An appropriate Order follows.

[> / Date: December// 2019 bs) tbat Robert D: Mafiani United States District Judge

-11-