OPINION OF THE COURT
Raymond J. Elliott, III, J.
Defendant, Pioneer Savings Bank, moves to dismiss the verified complaint, with prejudice, based upon a defense of documentary evidence pursuant to CPLR 3211 (a) (1), or for failure to state a cause of action pursuant to CPLR 3211 (a) (7), or in the alternative, to strike scandalous and irrelevant allegations from this or future corrective pleadings pursuant to CPLR 3024 (b). Plaintiffs have opposed the motion to dismiss.
On January 26, 2015, a Pioneer Bank employee carried a Pioneer owned laptop from his office to his vehicle. A thief broke into his vehicle and stole the laptop which contained certain customers’ names, Social Security numbers, street addresses, and some account and debit card numbers. On February 23, 2015, defendant began mailing notice letters to affected individuals and each named plaintiff received a notice letter. The letter recommended that affected individuals take specific proactive steps to protect themselves from identity theft and/or fraud.
Plaintiffs commenced this action on October 9, 2015. The two named plaintiffs seek to represent a putative class comprised of all citizens of the State of New York who were customers of Pioneer Savings Bank on January 26, 2015. The verified complaint alleges causes of action in: negligence, breach of implied contract and/or unjust enrichment, breach of contract, breach of fiduciary duty and violation of General Business Law § 349 (a).
Defendant argues that plaintiffs do not allege individual standing to pursue their claims against defendant because they do not allege any actual harm. Defendant states that plaintiffs can only bring a class action if they have individual standing to bring the claim. Defendant asserts that to establish standing, plaintiffs must allege an injury-in-fact that falls within their zone of interest. Defendant states that plaintiffs [792]*792have not claimed that they have suffered any identity theft nor have they alleged that there has been any attempted identity theft. All they have alleged is potential exposure of personal information that has increased their risk of identity theft. Defendant argues that plaintiffs lack standing because the threat of future identity theft constitutes nothing more than hypothetical speculation concerning the possibility of future injury that does not constitute injury-in-fact. Defendant asserts that plaintiffs’ conclusory allegations that they have suffered and/or are reasonably likely to suffer alleged injuries are insufficient and the complaint should be dismissed.
Defendant asserts that plaintiffs’ cause of action for negligence should be dismissed as a matter of law as it fails to set forth a prima facie case of negligence. Defendant states that it owed plaintiffs no cognizable common-law duty, that plaintiffs fail to allege actual harm, that the economic loss doctrine defeats plaintiffs’ negligence claim as a matter of law and that the negligence claim is impermissibly duplicative of plaintiffs’ cause of action for breach of contract.
Defendant argues that plaintiffs’ cause of action for breach of implied contract and/or unjust enrichment also fails as a matter of law. Defendant states that the complaint fails to allege a meeting of the minds as to the terms of an implied contract or allege any actual damages. Defendant refers to the language found in defendant’s published privacy disclosure which indicates how defendant protects a client’s personal information by using security measures that comply with federal law. Defendant argues that plaintiffs’ allegation that defendant promised to safeguard in any other fashion is a fabrication and does not give rise to an implied contract. Defendant further asserts that the plaintiffs fail to allege actual damages stemming from a purported breach of implied contract and the complaint fails to allege a plausible theory of unjust enrichment.
Defendant asserts that plaintiffs’ third cause of action for breach of contract fails as a matter of law as it fails to plead two elements of the claim: breach of an enforceable contract and actual damages arising from the breach. Defendant states that plaintiffs fail to state any federal law governing defendant’s security obligation or any violation of a law, so no breach is stated. Defendant states that plaintiffs further fail to state any actual nonspeculative damages arising from the breach.
Defendant states that plaintiffs’ cause of action for bailment fails as a matter of law. Defendant recognizes that New York [793]*793courts have not yet considered whether bailment is a viable cause of action in the wake of a data breach but cites other jurisdictions which have held it is not. Defendant asserts that: plaintiffs did not deliver personal property to defendant as the customers’ personally identifiable information is not property; plaintiffs did not have an understanding that defendant would return their personally identifiable information at a later time; and at no time did defendant maintain exclusive possession, control and dominion over the plaintiffs’ personally identifiable information.
Defendant argues that plaintiffs’ cause of action for breach of fiduciary duty warrants dismissal as a matter of law as it fails to allege a fiduciary relationship between the parties. Defendant asserts that the complaint does not allege that defendant breached a fiduciary duty to plaintiffs with sufficient particularity under CPLR 3016 (b); that plaintiffs failed to plead actual damages sufficient to support the cause of action; and that it is duplicative to the breach of contract claim.
Defendant further asserts that plaintiffs’ cause of action alleging a violation of General Business Law § 349 (a) fails because the complaint fails to set forth any allegation demonstrating an impact on consumers at large, it did not mislead plaintiffs in a material way, or constitute a deceptive business practice resulting in actual harm.
In the alternative, defendant states that if the court does not dismiss the complaint, it should strike all scandalous, irrelevant material from the complaint pursuant to CPLR 3024 (b). Defendant specifically requests that the court strike paragraphs 14, 22-25 and 61 of the complaint. Defendant asserts that the allegations contained in those paragraphs are utterly irrelevant to plaintiffs’ claims and prejudicial and unnecessary.
Plaintiffs first assert that the motion to dismiss for lack of standing should be denied as it is procedurally improper as defendant did not bring the motion pursuant to CPLR 3211 (a) (3). Plaintiffs argue that they do have standing to bring this suit. Plaintiffs assert that the complaint states that they have suffered and will continue to suffer and sets forth the injuries and losses incurred by plaintiffs. Plaintiffs further allege that their private personal and financial information has been stolen and/or exposed and this constitutes injury-in-fact. Plaintiffs state that the class also has sufficiently alleged an increased risk of harm as a direct result of defendant’s negligence, and this contention satisfies the standing inquiry. [794]*794Plaintiffs argue that the stress and fear of future injury which is related to the incident and likely to cause future harm satisfies standing.
Plaintiffs consent to dismissal of the claims for breach of fiduciary duty and violation of General Business Law § 349 without prejudice. (See plaintiffs’ mem in opposition at n 2.)
Free access — add to your briefcase to read the full text and ask questions with AI
OPINION OF THE COURT
Raymond J. Elliott, III, J.
Defendant, Pioneer Savings Bank, moves to dismiss the verified complaint, with prejudice, based upon a defense of documentary evidence pursuant to CPLR 3211 (a) (1), or for failure to state a cause of action pursuant to CPLR 3211 (a) (7), or in the alternative, to strike scandalous and irrelevant allegations from this or future corrective pleadings pursuant to CPLR 3024 (b). Plaintiffs have opposed the motion to dismiss.
On January 26, 2015, a Pioneer Bank employee carried a Pioneer owned laptop from his office to his vehicle. A thief broke into his vehicle and stole the laptop which contained certain customers’ names, Social Security numbers, street addresses, and some account and debit card numbers. On February 23, 2015, defendant began mailing notice letters to affected individuals and each named plaintiff received a notice letter. The letter recommended that affected individuals take specific proactive steps to protect themselves from identity theft and/or fraud.
Plaintiffs commenced this action on October 9, 2015. The two named plaintiffs seek to represent a putative class comprised of all citizens of the State of New York who were customers of Pioneer Savings Bank on January 26, 2015. The verified complaint alleges causes of action in: negligence, breach of implied contract and/or unjust enrichment, breach of contract, breach of fiduciary duty and violation of General Business Law § 349 (a).
Defendant argues that plaintiffs do not allege individual standing to pursue their claims against defendant because they do not allege any actual harm. Defendant states that plaintiffs can only bring a class action if they have individual standing to bring the claim. Defendant asserts that to establish standing, plaintiffs must allege an injury-in-fact that falls within their zone of interest. Defendant states that plaintiffs [792]*792have not claimed that they have suffered any identity theft nor have they alleged that there has been any attempted identity theft. All they have alleged is potential exposure of personal information that has increased their risk of identity theft. Defendant argues that plaintiffs lack standing because the threat of future identity theft constitutes nothing more than hypothetical speculation concerning the possibility of future injury that does not constitute injury-in-fact. Defendant asserts that plaintiffs’ conclusory allegations that they have suffered and/or are reasonably likely to suffer alleged injuries are insufficient and the complaint should be dismissed.
Defendant asserts that plaintiffs’ cause of action for negligence should be dismissed as a matter of law as it fails to set forth a prima facie case of negligence. Defendant states that it owed plaintiffs no cognizable common-law duty, that plaintiffs fail to allege actual harm, that the economic loss doctrine defeats plaintiffs’ negligence claim as a matter of law and that the negligence claim is impermissibly duplicative of plaintiffs’ cause of action for breach of contract.
Defendant argues that plaintiffs’ cause of action for breach of implied contract and/or unjust enrichment also fails as a matter of law. Defendant states that the complaint fails to allege a meeting of the minds as to the terms of an implied contract or allege any actual damages. Defendant refers to the language found in defendant’s published privacy disclosure which indicates how defendant protects a client’s personal information by using security measures that comply with federal law. Defendant argues that plaintiffs’ allegation that defendant promised to safeguard in any other fashion is a fabrication and does not give rise to an implied contract. Defendant further asserts that the plaintiffs fail to allege actual damages stemming from a purported breach of implied contract and the complaint fails to allege a plausible theory of unjust enrichment.
Defendant asserts that plaintiffs’ third cause of action for breach of contract fails as a matter of law as it fails to plead two elements of the claim: breach of an enforceable contract and actual damages arising from the breach. Defendant states that plaintiffs fail to state any federal law governing defendant’s security obligation or any violation of a law, so no breach is stated. Defendant states that plaintiffs further fail to state any actual nonspeculative damages arising from the breach.
Defendant states that plaintiffs’ cause of action for bailment fails as a matter of law. Defendant recognizes that New York [793]*793courts have not yet considered whether bailment is a viable cause of action in the wake of a data breach but cites other jurisdictions which have held it is not. Defendant asserts that: plaintiffs did not deliver personal property to defendant as the customers’ personally identifiable information is not property; plaintiffs did not have an understanding that defendant would return their personally identifiable information at a later time; and at no time did defendant maintain exclusive possession, control and dominion over the plaintiffs’ personally identifiable information.
Defendant argues that plaintiffs’ cause of action for breach of fiduciary duty warrants dismissal as a matter of law as it fails to allege a fiduciary relationship between the parties. Defendant asserts that the complaint does not allege that defendant breached a fiduciary duty to plaintiffs with sufficient particularity under CPLR 3016 (b); that plaintiffs failed to plead actual damages sufficient to support the cause of action; and that it is duplicative to the breach of contract claim.
Defendant further asserts that plaintiffs’ cause of action alleging a violation of General Business Law § 349 (a) fails because the complaint fails to set forth any allegation demonstrating an impact on consumers at large, it did not mislead plaintiffs in a material way, or constitute a deceptive business practice resulting in actual harm.
In the alternative, defendant states that if the court does not dismiss the complaint, it should strike all scandalous, irrelevant material from the complaint pursuant to CPLR 3024 (b). Defendant specifically requests that the court strike paragraphs 14, 22-25 and 61 of the complaint. Defendant asserts that the allegations contained in those paragraphs are utterly irrelevant to plaintiffs’ claims and prejudicial and unnecessary.
Plaintiffs first assert that the motion to dismiss for lack of standing should be denied as it is procedurally improper as defendant did not bring the motion pursuant to CPLR 3211 (a) (3). Plaintiffs argue that they do have standing to bring this suit. Plaintiffs assert that the complaint states that they have suffered and will continue to suffer and sets forth the injuries and losses incurred by plaintiffs. Plaintiffs further allege that their private personal and financial information has been stolen and/or exposed and this constitutes injury-in-fact. Plaintiffs state that the class also has sufficiently alleged an increased risk of harm as a direct result of defendant’s negligence, and this contention satisfies the standing inquiry. [794]*794Plaintiffs argue that the stress and fear of future injury which is related to the incident and likely to cause future harm satisfies standing.
Plaintiffs consent to dismissal of the claims for breach of fiduciary duty and violation of General Business Law § 349 without prejudice. (See plaintiffs’ mem in opposition at n 2.)
Plaintiffs argue that they and the class have asserted valid causes of action for negligence, breach of implied contract and/or unjust enrichment and breach of contract and set forth how the elements of each cause of action have been alleged.
Plaintiffs assert that the court should not strike any alleged scandalous or irrelevant material from the complaint pursuant to CPLR 3024 (b) as the motion is without merit. Plaintiffs state that the paragraphs defendant seeks to have stricken are highly relevant to plaintiffs’ allegations and describe the class of victims in this action. Plaintiffs further state that they should be permitted to develop the factual record before the court strikes any of the allegations.
Plaintiffs request that if the court concludes that they have insufficiently pleaded any of the claims, they have permission to amend the claims consistent with the court’s ruling on the motion to dismiss.
In reply, defendant acknowledges plaintiffs’ consent to dismissal of the causes of action for breach of fiduciary duty and General Business Law § 349 without prejudice. Defendant requests that if the court does not dismiss these causes of action with prejudice, defendant reserves its right to move to dismiss them pursuant to CPLR 3211 (a) in the event plaintiffs later attempt to assert them.
Defendant further reiterates its arguments for dismissal of the remaining causes of action as a matter of law. If it is not dismissed, defendant requests that the court consider striking the scandalous, irrelevant material in the complaint. Defendant states that the material in paragraphs 14, 22-25 and 61 is irrelevant and prejudicial and does not serve to satisfy the pleading standard in the CPLR.
“Standing to sue is critical to the proper functioning of the judicial system. It is a threshold issue. If standing is denied, the pathway to the courthouse is blocked. The plaintiff who has standing, however, may cross the threshold and seek judicial redress. It is difficult to draw an exquisitely sharp line separating the worthy litigant from one who would
[795]*795generate a lawsuit to advance someone else’s cause. The rules governing standing help courts separate the tangible from the abstract or speculative injury, and the genuinely aggrieved from the judicial dilettante or amorphous claimant” (Saratoga County Chamber of Commerce v Pataki, 100 NY2d 801, 812 [2003]).
“In New York, ‘a plaintiff may not proceed with an action in the absence of standing’ ” (Raske v Next Mgt., LLC, 40 Misc 3d 1240[A], 2013 NY Slip Op 51514[U], *7 [Sup Ct, NY County 2013], quoting Ryan, Inc. v New York State Dept. of Taxation & Fin., 26 Misc 3d 563, 567 [Sup Ct, NY County 2009]). “The plaintiff must have an injury in fact in order to bring a cause of action against a particular defendant” (id., citing Silver v Pataki, 96 NY2d 532, 539 [2001]).
“The existence of an injury in fact—an actual legal stake in the matter being adjudicated—ensures that the party seeking review has some concrete interest in prosecuting the action which casts the dispute in a form traditionally capable of judicial resolution. Under the injury in fact analysis standing exists when the plaintiff has sustained actual injury, meaning that he/she has an actual legal stake in the in the [sic] matter being litigated” (Collateral Loanbrokers Assn. of N.Y., Inc. v City of New York, 47 Misc 3d 1225[A], 2015 NY Slip Op 50847 [U], *5 [Sup Ct, Bronx County 2015] [internal quotation marks and parenthetical omitted], quoting Society of Plastics Indus. v County of Suffolk, 77 NY2d 761, 773 [1991]).
“In the class action context, plaintiffs ‘must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.’ ” (Whalen v Michael Stores Inc., 153 F Supp 3d 577, 580 [ED NY 2015] [emphasis omitted], quoting Warth v Seldin, 422 US 490, 503 [1975].) “Thus, ‘if none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of [herself] or any other member of the class.’ ” (Id., quoting O’Shea v Littleton, 414 US 488, 494 [1974].)
“ ‘To succeed on a motion under CPLR 3211 (a) (1), a defendant must show that the documentary evidence upon which the motion is predicated resolves all factual issues as a matter of [796]*796law and definitively disposes of the plaintiff’s claim’ ” (Morrow v MVP Health Plan, 307 AD2d 627, 627 [3d Dept 2003], quoting Unadilla Silo Co. v Ernst & Young, 234 AD2d 754 [3d Dept 1996]).
In determining a motion to dismiss a complaint pursuant to CPLR 3211 (a) (7), the court’s role is ordinarily limited to determining whether the complaint states a cause of action (Frank v Daimler Chrysler Corp., 292 AD2d 118 [1st Dept 2002]). When considering a motion to dismiss pursuant to CPLR 3211 (a) (7) for failure to state a cause of action, the court must “accept the facts as alleged in the complaint as true, accord plaintiffs the benefit of every possible favorable inference, and determine only whether the facts as alleged fit within any cognizable legal theory” (Nonnon v City of New York, 9 NY3d 825, 827 [2007]). “The sole criterion on a motion to dismiss is whether the pleading states a cause of action, and if, from its four corners, factual allegations are discerned which taken together manifest any cognizable action at law, a motion for dismissal will fail” (Harris v IG Greenpoint Corp., 72 AD3d 608, 609 [1st Dept 2010]). “A motion pursuant to CPLR 3211 (a) (7) must be decided without regard to evidence submitted by defendants, unless that evidence ‘conclusively establishes the falsity of an alleged fact’ ” (ARB Upstate Communications LLC v R.J. Reuter, L.L.C., 93 AD3d 929, 930 [3d Dept 2012], citing Gray v Schenectady City School Dist., 86 AD3d 771, 772 [3d Dept 2011]).
CPLR 3013 requires that “[statements in a pleading shall be sufficiently particular to give the court and parties notice of the transactions, occurrences, or series of transactions or occurrences, intended to be proved and the material elements of each cause of action or defense.”
The court notes that plaintiffs have consented to dismissal of the causes of action for breach of fiduciary duty and General Business Law § 349 without prejudice and that defendant has acknowledged this consent. The court will dismiss the causes of action for breach of fiduciary duty and General Business Law § 349 without prejudice. The court notes and accepts defendant’s reservation of its right to move to dismiss these causes of action pursuant to CPLR 3211 (a) in the event plaintiffs later attempt to assert them.
Plaintiffs contend that the defendant’s claim of lack of standing has no merit. Standing under Federal Constitution article III is stronger than under New York statute. New York courts [797]*797do not have the same standing concerns as state statutes do not contain the case or controversy standard. The standing requirement in federal actions has been grounded in the federal constitutional requirement of a case or controversy (US Const, art III, § 2, cl 1), a requirement that has no analogue in the State Constitution. (See Society of Plastics Indus. v County of Suffolk, 77 NY2d 761, 772 [1991].) “For generations, New York courts have treated standing as a common-law concept, requiring that the litigant have something truly at stake in a genuine controversy. In contrast to our approach, standing in federal courts rests on both constitutional (see US Const, art III, § 2 [1]) and prudential grounds” (Saratoga County Chamber of Commerce v Pataki at 812 and n 6).
The court finds that plaintiffs do not have individual standing and must dismiss the complaint for lack of standing. Plaintiffs fail to set forth any actual injury that they have suffered as a result of the data breach. The court does not find that plaintiffs have alleged an injury-in-fact following the alleged data breach as neither named plaintiff specifically identifies an actual or attempted identity theft or indicates any fraudulent charges. The complaint contains allegations of injuries based on speculative future risks that plaintiffs will be victims of identity theft. The complaint further contains hypothetical issues that may arise for plaintiffs. All that plaintiffs have alleged is potential exposure of their personal information that has increased their risk of identity theft, not actual fraudulent charges. These allegations are too remote and not sufficient enough to confer standing on plaintiffs as they do not constitute an injury-in-fact. As neither named plaintiff has alleged and shown that they personally have been injured, they cannot seek relief on behalf of themselves or any other member of the class which they purportedly represent.
Accordingly, defendant’s motion to dismiss is granted and the complaint is dismissed without prejudice.