UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ---------------------------------------------------------------------- X : NEVILLE MCFARLANE et al., individually and on : behalf of all others similarly situated, : : Plaintiffs, : 20-CV-1297 (JMF) : -v- : OPINION AND ORDER : ALTICE USA, INC., : : Defendant. : : ---------------------------------------------------------------------- X JESSE M. FURMAN, United States District Judge: This putative class action arises from a November 2019 data breach at Altice USA, Inc. (“Altice”), one of the largest television and communications providers in the United States. The nine named Plaintiffs are current or former employees of Altice whose personal identifying information, including Social Security numbers, was stolen in the breach. They bring various claims — for negligence, negligence per se, breach of implied contract, violation of the New York Labor Law, and violation of the Cable Communications Act of 1984 — against Altice for allegedly failing to take adequate measures to protect their data. Now pending are three motions filed by Altice. First, Altice moves, pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, to dismiss for lack of subject-matter jurisdiction, on the ground that Plaintiffs fail to allege injury sufficient to give them Article III standing. Second, Altice moves, pursuant to the Federal Arbitration Act (“FAA”), 9 U.S.C. § 1 et seq., to compel seven of the nine named Plaintiffs to arbitrate their claims based on a clause in the General Terms and Conditions to which they allegedly agreed as subscribers of Altice’s cable services. And third, Altice moves, pursuant to Rule 12(b)(6), to dismiss Plaintiffs’ claims under the New York Labor Law (and related claims for negligence per se) as well as their claims for breach of an implied contract. Altice’s motions to dismiss are relatively easily resolved. For the reasons discussed below, the Court concludes that Plaintiffs — three of whom have already experienced identity theft since the data breach — plainly allege the kind of injury sufficient to give them Article III
standing; that their New York Labor Law claims (and related negligence per se claims) fail as a matter of law; and that they state plausible claims for breach of an implied contract. Altice’s motion to compel arbitration requires more extensive discussion as it is based on a relatively new species of arbitration clause that one scholar has dubbed an “infinite arbitration clause” for its striking breadth: It effectively requires arbitration of any dispute between a subscriber and Altice, as well Altice’s parents, subsidiaries, affiliates, successors, employees, agents, and the like, whether arising now or in the future, and without regard for whether it arises from or relates to the cable services agreement of which it is part. For the reasons discussed below, the Court concludes that, as a matter of either contract formation or unconscionability, the arbitration
clause at issue does not require arbitration of claims that lack a nexus to the cable services agreement. Because the record is unclear with respect to whether or to what extent Plaintiffs’ claims arise from or relate to their status as cable service subscribers, the Court ultimately defers decision on the motion to compel arbitration pending supplemental submissions from the parties. BACKGROUND The Court is technically permitted to consider materials beyond the four corners of the Amended Complaint in deciding Altice’s motions to dismiss for lack of subject-matter jurisdiction and to compel arbitration. See, e.g., Nicosia v. Amazon.com, Inc., 834 F.3d 220, 229 (2d Cir. 2016) (arbitration); Cortlandt St. Recovery Corp. v. Hellas Telecomms., S.À.R.L., 790 F.3d 411, 417 (2d Cir. 2015) (jurisdiction). Nevertheless, the following facts are drawn from the Amended Complaint and documents that it incorporates by reference. See DiFolco v. MSNBC Cable L.L.C., 622 F.3d 104, 110-11 (2d Cir. 2010). Altice is one of the largest cable television and communications providers in the United States. See ECF No. 42 (“Am. Compl.”), ¶ 1. In November 2019, cyber criminals targeted
Altice with a phishing attack, and an “undisclosed number” of the company’s employees inadvertently divulged the log-in credentials for their corporate email accounts. See id. ¶¶ 5, 99. The cyber criminals then “used the stolen credentials to remotely access and, in some instances, download the employees’ mailbox contents.” Id. ¶ 96; see ECF Nos. 42-1 (“Breach Notice”), 42-2, 42-3.1 A forensic investigation revealed that one of the downloaded email inboxes contained a password-protected, but unencrypted, document with the names, employment information, dates of birth, social security numbers, and, in some instances, driver’s license numbers of 52,846 current and former Altice employees. See Am. Compl. ¶¶ 6-7, 101-02, 154, 161. In February 2020, Altice sent notices to those whose data was affected stating that, “[a]s a
former [or current] employee, your personal information was included in this report.” See id. ¶¶ 96-97; Breach Notice. “[I]n an abundance of caution,” the notices offered recipients free identity and credit monitoring services for one year and recommended resources for monitoring and fraud protection. Breach Notice (emphasis omitted). The named Plaintiffs in this putative class action are nine former employees of Altice or its subsidiaries or predecessor companies who received the Breach Notice. See Am. Compl. ¶¶ 14, 17, 22, 24, 30, 32, 38, 40, 46, 48, 54, 56, 62, 64, 70, 72, 81, 83. All but one — namely, DeAnna Cottrell — are also current or former cable subscribers through Altice or one of its
1 ECF Nos. 42-1, 42-2, and 42-3 are substantively identical in all material respects. subsidiaries. See id. ¶¶ 15, 31, 39, 47, 55, 63, 71, 82. Plaintiffs were required to provide the personal identifying data that was compromised in the breach as “a condition of their employment.” Id. ¶ 104. All Plaintiffs have already spent time responding to the breach, such as by regularly monitoring their accounts and credit reports, changing passwords, and implementing credit freezes. See id. ¶¶ 18, 26, 34, 43, 50, 59, 66, 75, 85. Because their Social Security
numbers were compromised, Plaintiffs anticipate needing to monitor their identity and credit and needing to pay for identity theft protection and credit monitoring services “for the rest of [their] li[ves].” Id. ¶¶ 18, 26, 34-35, 43, 50-51, 59, 66-67, 76, 86. Additionally, three of the named Plaintiffs — Neville McFarlane, Shariq Mehfooz, and Steven Paniccia — were the victims of identity theft in the months following the breach. All three allege that between December 2019 and March 2020, they discovered that identity thieves had used their personal identifying information to fraudulently open credit cards in their names. See id. ¶¶ 16, 73-74, 84. In March 2020, an identity thief also “attempted to change [McFarlane’s] home address.” Id. ¶ 16. Mehfooz discovered the fraudulent credit card
application when he was applying to refinance his home mortgage. See id. ¶ 73. The fraudulent application harmed his credit score and interrupted the refinancing process, which may have prevented him from taking advantage of “historically low interest rates.” Id. ¶¶ 73-74. All three allege that, to their knowledge, they had not been the victim of any data breach other than the breach of Altice. Id. ¶¶ 20, 79, 88. The other six allege that they are “at imminent and substantial risk of identity theft that is continuous and ongoing.” Id. ¶¶ 25, 33, 42, 49, 58, 65. The named Plaintiffs bring claims on behalf of a nationwide class of “[a]ll persons whose personally identifiable information was compromised as a result of the Data Breach at Altice USA, Inc. in November 2019.” Id. ¶ 170. They bring claims for negligence, see id. ¶¶ 181-95; negligence per se for violation of the New York Labor Law, § 203-d, see Am. Compl. ¶¶ 196- 204; negligence per se for violation of the Cable Communications Act of 1984, 47 U.S.C. § 551, see Am. Compl. ¶¶ 205-14; direct violation of the New York Labor Law, § 203-d, see Am. Compl. ¶¶ 215-22; direct violation of the Cable Communications Act of 1984, 47 U.S.C. § 551, see Am. Compl. ¶¶ 223-33; and breach of implied contract, see id. ¶¶ 234-39.2 In addition, they
seek a declaration that Altice’s existing cybersecurity measures are inadequate and an injunction requiring certain improvements. See Am. Compl. ¶¶ 240-46. Now pending before the Court are Altice’s motion to dismiss the Amended Complaint pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, ECF No. 45, and Altice’s motion to compel seven of the named Plaintiffs — McFarlane, Edward Hellyer, Carrie Mason-Draffen, Haseeb Raja, John Frontera, Mehfooz, and Paniccia — to submit their claims to arbitration, ECF No. 47. SUBJECT-MATTER JURISDICTION The Court begins, as it must, with Altice’s motion to dismiss for lack of subject-matter jurisdiction. See, e.g., Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94 (1998). In
particular, Altice moves to dismiss on the ground that Plaintiffs lack standing, see ECF No. 46 (“Def.’s Mem.”), at 5-13, which is an “essential aspect” of Article III’s limitation on the “judicial Power” of the federal courts to “Cases” and “Controversies,” Hollingsworth v. Perry, 570 U.S. 693, 704 (2013); see U.S. Const. art. III, § 2. It is well established that “the irreducible constitutional minimum of standing contains three elements”: (1) injury in fact, (2) causation, and (3) redressability. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992). An injury in fact is “an invasion of a legally protected interest which is (a) concrete and particularized, and (b)
2 Plaintiff Cottrell, who never subscribed to cable service through Altice or any of its subsidiaries, see ECF No. 48 (“Def.’s Mot. to Compel Mem.”), at 1 n.1, does not join in the two claims pursuant to the Cable Communications Act of 1984, see Am. Compl. ¶¶ 205-13, 223-33. actual or imminent, not conjectural or hypothetical.” Id. at 560 (cleaned up). The element of causation requires that the injury be “fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court.” Id. (cleaned up). Finally, to establish redressability, “it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.” Id. at 561 (internal
quotation marks omitted). Here, the standing inquiry turns primarily (if not entirely) on whether the threat of future identity theft that Plaintiffs allegedly face and the costs of monitoring that they have incurred in light of that threat constitute injuries in fact. Significantly, an injury “need not be actualized” to satisfy Article III. Davis v. Fed. Election Comm’n, 554 U.S. 724, 734 (2008). Instead, a “future injury” can suffice, so long as it is “certainly impending, or there is a substantial risk that the harm will occur.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158 (2014) (emphasis added) (internal quotation marks omitted); see also Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 n.5 (2013) (noting that plaintiffs need not “demonstrate that it is literally certain that the
harms they identify will come about”). Additionally, a substantial risk of harm “may prompt plaintiffs to reasonably incur costs to mitigate or avoid that harm,” which costs can themselves constitute an injury in fact. Clapper, 568 U.S. at 414 n.5. Ultimately, the injury-in-fact requirement is meant to “ensure that the plaintiff has a personal stake in the outcome of the controversy.” Susan B. Anthony List, 573 U.S. at 158 (internal quotation marks omitted). Applying these principles, many courts have held that plaintiffs alleging the theft of personal identifying information in a “data breach,” as Plaintiffs do here, have standing to bring claims against the entity that had held their data based on an increased risk of future identity theft. See, e.g., Am. Fed’n of Gov’t Emps. v. Office of Pers. Mgmt (In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig.), 928 F.3d 42, 55-61 (D.C. Cir. 2019) (per curiam); Attias v. Carefirst, Inc., 865 F.3d 620, 628-29 (D.C. Cir. 2017); Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 387-89 (6th Cir. 2016) (unpublished); Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 967-68 (7th Cir. 2016); Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692- 94 (7th Cir. 2015); Fero v. Excellus Health Plan, Inc., 304 F. Supp. 3d 333, 338-41 (W.D.N.Y.
2018); Sackin v. TransPerfect Glob., Inc., 278 F. Supp. 3d 739, 746 (S.D.N.Y. 2017). The Second Circuit has not yet ruled on the issue, but it did cite some of these cases, arguably with approval, in a summary order. See Whalen v. Michaels Stores, Inc., 689 F. App’x 89, 91 & n.1 (2d Cir. 2017) (summary order). On that basis, some courts within the Circuit have predicted that the Second Circuit would adopt the same approach. See, e.g., Fero, 304 F. Supp. 3d at 339 (“Whalen’s favorable citations to Galaria, Remijas, and Lewert suggest that the Second Circuit would follow the approach to the standing issue adopted by the Sixth and Seventh Circuits, which have both found standing based on increased risk of identity theft.”); accord Sackin, 278 F. Supp. 3d at 746.
In light of these cases, the Court has little difficulty concluding that all nine Plaintiffs plausibly allege injury in fact. Three — McFarlane, Mehfooz, and Paniccia — have already suffered concrete injury in the form of identity theft. And as for the other six, “experience and common sense” teach that they “face a substantial risk of identity theft” given that “their social security and credit card numbers were accessed by a network intruder.” Attias, 865 F.3d at 628 (internal quotation marks omitted). Indeed, for at least two reasons, the risk of future identity theft is particularly substantial here. First, the fact that fraudulent credit cards have already been opened in the names of three Plaintiffs strongly suggests that the cyber criminals responsible for the breach will use the others’ data for criminal purposes or sell it to others for such use. See Am. Compl. ¶¶ 16, 73, 84, 110. Thus, this case is easily distinguished from, for example, Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017), in which the Fourth Circuit held that the risk of future harm was too speculative to support Article III standing where a laptop containing the plaintiffs’ personal identifying information was stolen from a hospital and, after extensive discovery, there was “no evidence . . . that the thief stole the laptop with the intent to steal their
private information.” Id. at 267, 274; see also Reilly v. Ceridian Corp., 664 F.3d 38, 44 (3d Cir. 2011) (finding no standing where “all that [wa]s known [wa]s that a firewall was penetrated,” and there was no reason to believe “that the intrusion was intentional or malicious”); Steven v. Carlos Lopez & Assocs., 422 F. Supp. 3d 801, 803 (S.D.N.Y. 2019) (finding no standing where an email containing employees’ personal information was inadvertently distributed within the company, but “there [wa]s no evidence” that the information “was shared with anyone outside of [the company], let alone misused”). Second, the stolen report contained Plaintiffs’ Social Security numbers, which is arguably “the most dangerous type of personal information in the hands of identity thieves” because it is
immutable and can be used to “impersonat[e] [the victim] to get medical services, government benefits, . . . tax refunds, [and] employment.” Am. Compl. ¶ 108 (emphasis omitted). Unlike a credit card number, which can be changed to eliminate the risk of harm following a data breach, “[a] social security number derives its value in that it is immutable,” and when it is stolen it can “forever be wielded to identify [the victim] and target him in fraudulent schemes and identity theft attacks.” Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1034 (N.D. Cal. 2019); see also Portier v. NEO Tech. Sols., No. 3:17-CV-30111 (TSH), 2019 WL 7946103, at *12 (D. Mass. Dec. 31, 2019) (“Because Social Security numbers are the gold standard for identity theft, their theft is significant. . . . Access to Social Security numbers causes long-lasting jeopardy because the Social Security Administration does not normally replace Social Security numbers.”), report and recommendation adopted, No. 3:17-CV-30111 (TSH), 2020 WL 877035 (D. Mass. Jan. 30, 2020); cf. Alleruzzo v. SuperValu, Inc. (In re SuperValu, Inc.), 870 F.3d 763, 770 (8th Cir. 2017) (holding that the risk of future harm resulting from the theft of credit card data — as opposed to more sensitive “personally identifying information, such as social security numbers” — is
insufficient to confer standing); Whalen, 689 F. App’x at 90 (holding that a plaintiff whose credit card information was stolen, but promptly canceled, and who did not allege that “other personally identifying information — such as her birth date or Social Security number” was stolen, lacked standing (emphasis added)). In sum, based on the great weight of authority, all nine Plaintiffs easily establish that they have suffered an injury in fact within the meaning of Article III. They also adequately allege that their injuries are fairly traceable to Altice because the company “failed to take the necessary precautions required to safeguard and protect” their data. Am. Compl. ¶ 103; see Stevens v. Zappos.com, Inc. (In re Zappos.com, Inc.), 888 F.3d 1020, 1029-1030 (9th Cir. 2018); Attias,
865 F.3d at 629; Remijas, 794 F.3d at 696. And finally, if Plaintiffs succeed on the merits of their claims, the Court can redress their injuries by awarding damages for the “reasonabl[e]” costs of “mitigat[ing] or avoid[ing]” future identity theft, among other things. Clapper, 568 U.S. at 414 n.5. Thus, Plaintiffs meet their burden to establish Article III standing. MOTION TO COMPEL ARBITRATION Next, Altice moves to compel seven of the nine named Plaintiffs — namely, McFarlane, Hellyer, Mason-Draffen, Raja, Frontera, Mehfooz, and Paniccia — to arbitrate their claims. Significantly, Altice does so not based on an arbitration provision contained in any employment agreements with these Plaintiffs, but based on arbitration provisions contained in the General Terms and Conditions of Service (the “Terms and Conditions”) pertaining to the company’s cable service. See Mot. to Compel Mem. 3-8. A representative version of these provisions (referred to, together, as the “Arbitration Provision”) states: Any and all disputes arising between You and Altice, including its respective parents, subsidiaries, affiliates, officers, directors, employees, agents, predecessors, and successors, shall be resolved by binding arbitration on an individual basis . . . . This agreement to arbitrate is intended to be broadly interpreted. It includes, but is not limited to: • Claims arising out of or relating to any aspect of the relationship between us, whether based in contract, tort, statute, fraud, misrepresentation or any other legal theory; • Claims that arose before this or any prior Agreement; and • Claims that may arise after the termination of this Agreement. ECF No. 49-6, § 24.3 Six of the seven Plaintiffs at issue signed work orders (when cable technicians were visiting their homes for installation or maintenance of cable service) indicating that they agreed to the Terms and Conditions containing such a provision. See ECF Nos. 49-22, 49-23, 49-24, 49-25, 49-26, 49-27, 49-28, 49-29, 49-30, 49-31, 49-32, 49-33, 49-34, 49-35, 49- 36, 49-37. The seventh (Frontera) has not signed any such document, but “continued to use Altice’s services despite repeated notices regarding the General Terms applicable to such services” and thus, according to Altice, “unambiguously manifested his assent to the Arbitration Provision.” Def.’s Mot. to Compel Mem. 7 n.6. Notably, Altice does not move to compel Cottrell and Gill to arbitrate as there is no plausible claim that they agreed to the Arbitration
3 The language of the Arbitration Provision has changed a few times since it was introduced in 2011, but the changes are minor and immaterial for present purposes. See ECF No. 49-1, § 18; ECF No. 49-2, § 18; ECF No. 49-3, § 18; ECF No. 49-4, § 20; ECF No. 49-5, § 22; see also ECF No. 49, ¶¶ 5-19. Provision; Cottrell was never an Altice subscriber and Gill terminated her Altice cable service before the arbitration provision was added to the Terms and Conditions. See id. at 1 n.1. Section 2 of the FAA provides, in relevant part, as follows: A written provision in . . . a contract evidencing a transaction involving commerce to settle by arbitration a controversy thereafter arising out of such contract or transaction, or the refusal to perform the whole or any part thereof, or an agreement in writing to submit to arbitration an existing controversy arising out of such a contract, transaction, or refusal, shall be valid, irrevocable, and enforceable, save upon such grounds as exist at law or in equity for the revocation of any contract. 9 U.S.C. § 2. Under Section 4 of the Act, a party to “a written agreement for arbitration” may petition a district court “for an order directing that such arbitration proceed in the manner provided for in such agreement.” Id. § 4. To decide “whether the parties agreed to arbitrate,” a court must then apply “ordinary state-law principles that govern the formation of contracts.” First Options of Chi., Inc. v. Kaplan, 514 U.S. 938, 944 (1995). Significantly, the FAA was intended “to make arbitration agreements as enforceable as other contracts, but not more so.” Volt Info. Scis., Inc. v. Bd. of Trs. of Leland Stanford Junior Univ., 489 U.S. 468, 478 (1989) (emphasis added) (internal quotation marks omitted). Thus, “the FAA does not require parties to arbitrate when they have not agreed to do so.” Id. Nor does it require arbitration when, under generally applicable principles of state law, the agreement would be unenforceable. See, e.g., Perry v. Thomas, 482 U.S. 483, 492 n.9 (1987); Mitsubishi Motors Corp. v. Soler Chrylser- Plymouth, Inc., 473 U.S. 614, 627 (1985); see also Doctor’s Assocs. Inc. v. Cassarotto, 517 U.S. 681, 687 (1996). More specifically, the Second Circuit instructs that, when confronted with a motion to compel arbitration, “a court should undertake a three-part inquiry.” Louis Dreyfus Negoce S.A. v. Blystad Shipping & Trading Inc., 252 F.3d 218, 224 (2d Cir. 2001). (As will be seen, the inquiry, in reality, has only two parts, with the second part taking two possible forms and depending on the outcome of the first part.) “First, recognizing there is some range in the breadth of arbitration clauses, a court should classify the particular clause as either broad or narrow.” Id. The Second Circuit has described a “clause submitting to arbitration ‘any claim or controversy arising out of or relating to the agreement’” as the “paradigm of a broad [arbitration] clause.” Hatemi v. M & T Bank, 633 F. App’x 47, 49 (2d Cir. 2016) (summary order) (quoting
Collins & Aikman Prods. Co. v. Bldg. Sys., Inc., 58 F.3d 16, 20 (2d Cir. 1995)). “Next, if reviewing a narrow clause, the court must determine whether the dispute is over an issue that is on its face within the purview of the clause, or over a collateral issue that is somehow connected to the main agreement that contains the arbitration clause.” Louis Dreyfus Negoce S.A., 252 F.3d at 224 (internal quotation marks omitted). In general, “[w]here the arbitration clause is narrow, a collateral matter will . . . be ruled beyond its purview.” Id. By contrast, “[w]here the arbitration clause is broad, there arises a presumption of arbitrability and arbitration of even a collateral matter will be ordered if the claim alleged implicates issues of contract construction or the parties’ rights and obligations under it.” Id. (internal quotation marks omitted). “When parties
use expansive language in drafting an arbitration clause,” the Circuit has explained, “presumably they intend all issues that ‘touch matters’ within the main agreement to be arbitrated.” Id. at 225 (internal quotation marks omitted). Altice describes the Arbitration Provision as “extremely broad,” Def.’s Mot. to Compel Mem. 4, but, by any reasonable measure, “that term is inadequate to capture the true breadth of its substantive and temporal scope,” Hearn v. Comcast Cable Commc’ns, LLC, 415 F. Supp. 3d 1155, 1161 (N.D. Ga. 2019). Indeed, the Arbitration Provision is significantly broader even than the paradigmatic broad arbitration clause identified by the Second Circuit. It is not limited to claims “arising out of” or “relating to” the cable service agreement. Instead, it purports to cover “[a]ny and all disputes arising between” the customer and Altice — not to mention, Altice’s parents, subsidiaries, affiliates, agents, successors, and so on — without meaningful exception and for all eternity. That is, it is “limited” only by the requirement that the dispute involve Altice (or an associated entity or person), which, “is, of course, no limit at all.” Id. at 1162. The Arbitration Provision is thus an example of a “relatively new and untested” species of arbitration
clause, Mey v. DIRECTTV, LLC, 971 F.3d 284, 302 (4th Cir. 2020) (Harris, J., dissenting), which one scholar has aptly dubbed an “infinite arbitration clause,” David Horton, Infinite Arbitration Clauses, 168 U. Pa. L. Rev. 633, 639-40 (2020). If enforced according to its terms, such a clause would seem to mandate arbitration of any claim between the parties, including those without any nexus whatsoever to the agreement containing the clause. Underscoring the relative novelty of “infinite arbitration clauses,” there is relatively little case law addressing them. Most of what there is, however, has taken a jaundiced view of the argument that they should be enforced according to their terms. See id. at 641-42; see also Hearn, 415 F. Supp. 3d at 1162. That view is traceable to Smith v. Steinkamp, 318 F.3d 775 (7th
Cir. 2003), in which Judge Posner described the “absurd results” that would “ensue” if a payday lender’s arbitration agreement purporting to cover “all claims asserted by you . . . against us” were “read as standing free from any loan agreement.” Id. at 776-77 (internal quotation marks omitted). For example, if Instant Cash murdered Smith in order to discourage defaults and her survivors brought a wrongful death suit against Instant Cash . . . , Instant Cash could insist that the wrongful death claim be submitted to arbitration. For that matter, if an employee of Instant Cash picked Smith’s pocket when she came in to pay back the loan, and Smith sued the employee for conversion, he would be entitled to arbitration of her claim. It would make no difference that the conversion had occurred in Smith’s home 20 years after her last transaction with Instant Cash. Id. at 777. Judge Posner mused that such an agreement “might be thought unconscionable,” noting that “[t]he applicability of the doctrine of unconscionability to arbitration clauses governed by the Federal Arbitration Act was confirmed” by the Supreme Court in Doctor’s Associates, 517 U.S. at 687. Smith, 318 F.3d at 778. Following Smith, the Ninth Circuit and a handful of district courts around the country have declined to compel arbitration of claims based on “infinite arbitration clauses” where the claims at issue lack any nexus whatsoever to the agreement containing the clause. See Revitch v.
DIRECTV, LLC, 977 F.3d 713, 717-21 (9th Cir. 2020); Hearn, 415 F. Supp. 3d at 1161-65; Wexler v. AT & T Corp., 211 F. Supp. 3d 500, 503-05 (E.D.N.Y. 2016); In re Jiffy Lube Int’l, Inc., Text Spam Litig., 847 F. Supp. 2d 1253, 1262-63 (S.D. Cal. 2012). But these courts have taken different paths to reach that result. Jiffy Lube, which involved facts much like those here, is representative of one path. It involved a putative class action against a Jiffy Lube franchisee, Heartland Automotive Services, Inc. (“Heartland”), alleging that the franchisee had sent unauthorized text messages offering discounts on Jiffy Lube services in violation of the Telephone Consumer Protection Act (“TCPA”), 47 U.S.C. § 227. 847 F. Supp. 3d at 1255. Heartland moved to compel arbitration of one named plaintiff’s claims because he had signed an
agreement when he visited a Heartland location providing that “any and all disputes, controversies or claims between Jiffy Lube® and you (including breach of warranty, contract, tort or any other claim) will be resolved by mandatory arbitration.” Id. at 1262. The district court held that the agreement could not “truly encompass ‘any and all disputes’ between the parties” because such a “clause would clearly be unconscionable” if applied, for example, to “a tort action arising from a completely separate incident.” Id. at 1262-63. Hearn illustrates the second path. The plaintiff in that case alleged that Comcast Cable Communications had violated the Fair Credit Reporting Act when it checked his credit during a call on March 5, 2019. See 415 F. Supp. 3d at 1157. He was not a Comcast customer at the time of the call, but he had contracted for cable services from December 2016 to August 2017 and, in that window, had signed a work order acknowledging receipt of a “Comcast Welcome Kit” containing a service agreement with an arbitration clause much like the one at issue here. See id. at 1157-58. Comcast moved to compel arbitration, and the district court denied the motion, decrying the “absurd results” that “would inevitably ensue if federal courts began compelling
arbitration of claims that are substantively and temporally unmoored from the agreements containing the arbitration provisions.” Id. at 1164. In the Hearn Court’s view, however, the problem was not one of unconscionability, but rather “one of contract formation.” Id. Under Georgia law, the court explained, “[a] contract must be given a reasonable construction which will uphold and enforce the instrument, if possible, rather than a construction which would . . . lead to an absurd result.” Id. at 1165 (quoting Tudor v. Am. Emp’rs Ins. Co., 173 S.E.2d 403, 405-06 (Ga. Ct. App. 1970)). And “no reasonable customer would have understood himself to be signing over his right to pursue any claim against the [d]efendant in perpetuity simply by signing a work order acknowledging receipt of the 2016 Service Agreement.” Id. at 1165. So
too, no “reasonable company in the [d]efendant’s position could understand the customer’s ‘manifestation[] of assent’ to affect [sic] an absolute waiver of the customer’s right to sue the [d]efendant in state or federal court with respect to claims unrelated to the 2016 Service Agreement.” Id.; see also Revitch, 977 F.3d at 717-18 (reaching the same result under California law); Wexler, 211 F. Supp. 3d at 504-05 (reaching the same result under New York law).4
4 Mey, 971 F.3d 284, involved the same arbitration clause and analogous legal claims to those in Revitch, but the Fourth Circuit held — over a dissent by Judge Harris — that the parties had validly agreed to arbitration. See Revitch, 977 F. 3d at 719-20 (“[W]e are aware that the Fourth Circuit . . . arrived at the opposite conclusion . . . [and that] we are opening a circuit split . . . .”). Mey appears to be an outlier; indeed, the Fourth Circuit seems to be the only court to have held that an “infinite arbitration clause” applies to claims completely unrelated to the agreement containing the clause. This Court declines to follow the Fourth Circuit’s decision, The Court agrees with these cases and concludes that it need not choose a single path because both ultimately lead to the same destination: a conclusion that, under New York law, the Arbitration Provision cannot be applied to claims lacking a nexus to the Altice cable service agreement. First, as a matter of contract formation, New York law, like Georgia law, provides that “a contract should not be interpreted to produce a result that is absurd, commercially
unreasonable or contrary to the reasonable expectations of the parties.” Greenwich Capital Fin. Prods., Inc. v. Negrin, 903 N.Y.S.2d 346, 348 (1st Dep’t 2010) (internal quotation marks omitted). “[W]here some absurdity has been identified or the contract would otherwise be unenforceable either in whole or in part,” courts “may as a matter of interpretation carry out the intention of [the] contract by transposing, rejecting, or supplying words to make the meaning of the contract more clear.” Jade Realty LLC v. Citigroup Commercial Mortg. Tr. 2005-EMG, 980 N.E.2d 945, 947 (N.Y. 2012) (internal quotation marks omitted). Applying these principles here, the Court reaches the same conclusion that the Hearn, Revitch, and Wexler Courts reached: “Notwithstanding the literal meaning of the clause’s language, no reasonable person would think
that” agreeing to Altice’s Terms and Conditions “would obligate them to arbitrate literally every possible dispute he or she might have with the service provider, let alone all of [its] affiliates . . . — including those who provide services unrelated to [cable television]. Rather, a reasonable person would be expressing, at most, an intent to agree to arbitrate disputes connected in some way to the service agreement with [Altice].” Wexler, 211 F. Supp. 3d at 504. In the alternative, and for similar reasons, the Court concludes that it would be unconscionable to enforce the Arbitration Provision with respect to claims untethered to the
substantially for the reasons set forth in Judge Harris’s compelling dissent and for the reasons that the Ninth Circuit expressly rejected it. See Mey, 971 F.3d at 295-308 (Harris, J., dissenting); Revitch, 977 F.3d at 719-21. Altice cable service agreement. Under New York law, “[a]n unconscionable contract has been defined as one which is so grossly unreasonable or unconscionable in the light of the mores and business practices of the time and place as to be unenforceable according to its literal terms.” Gillman v. Chase Manhattan Bank, N.A., 534 N.E.2d 824, 828 (N.Y. 1988) (internal quotation marks omitted). To enforce the Arbitration Provision “according to its literal terms” would cross
this line. Indeed, it takes little imagination to come up with hypotheticals that make plain the outrageous results that would follow were that not the case. For example, if a subscriber purchased the stock of Altice’s affiliate and the price of that stock dropped due to corporate malfeasance, her securities fraud claim would be forced into arbitration. Or to borrow from Judge Posner: If an Altice employee murdered someone who happened to have subscribed to Altice’s cable service, it would mandate arbitration of a wrongful death claim brought by the subscriber’s survivors (even if the murder occurred years after the cable service had been canceled). See Smith, 318 F.3d at 777. The list goes on. See, e.g., Mey, 971 F.3d at 303 (Harris, J., dissenting) (describing two absurd hypothetical situations in which an “infinite arbitration
clause” would, if enforced according to its literal terms, require arbitration); Hearn, 415 F. Supp. 3d at 1162 (“[I]f the Plaintiff was run over by a Comcast truck, he would be required to submit his personal injury claim to arbitration.”). The list compels the Court to conclude that, as a matter of general unconscionability doctrine, the Arbitration Provision must be construed to apply only to claims that have some nexus to the contract of which it is part.5
5 Notably, although the Second Circuit has not yet addressed “infinite arbitration clauses,” it recently adopted a narrow reading of an arbitration clause that did expressly limit its scope to “claims arising out of or relating to employment,” in part to avoid “an unnecessary reading” that would “cast[] [the clause’s] enforceability into doubt.” Cooper v. Ruane Cunniff & Goldfarb Inc., — F.3d —, 2021 WL 821390, at *4, 8 (2d Cir. Mar. 4, 2021) (internal quotation marks omitted). That said, the Court’s concerns about enforceability related to ERISA, not the absurdity canon or unconscionability doctrine. In Wexler, the court opted for the contract-formation path over the unconscionability path based in part on a concern that application of the unconscionability doctrine would run afoul of AT&T Mobility LLC v. Concepcion, 563 U.S. 333, 339 (2011), in which the Supreme Court held that the FAA preempts state-law “defenses that apply only to arbitration or that derive their meaning from the fact that an agreement to arbitrate is at issue.” See Wexler, 211 F. Supp. 3d at
504. To the extent it matters, the Court concludes that that concern is misplaced. In Concepcion, the Court explicitly reaffirmed that the savings clause in Section 2 of the FAA, which “permits arbitration agreements to be declared unenforceable ‘upon such grounds as exist at law or in equity for the revocation of any contract,’” allows “agreements to arbitrate to be invalidated by ‘generally applicable contract defenses, such as fraud, duress, or unconscionability.’” Concepcion, 563 U.S. at 339 (emphasis added) (first quoting 9 U.S.C. § 2; then quoting Doctor’s Associates, 517 U.S. at 687); accord Kindred Nursing Ctrs. Ltd. P’ship v. Clark, 137 S. Ct. 1421, 1426 (2017); see Smith, 318 F.3d at 778 (noting that “[t]he applicability of the doctrine of unconscionability to arbitration clauses governed by the Federal Arbitration
Act was confirmed” by the Supreme Court in Doctor’s Associates). Applying the unconscionability doctrine to limit a clause that purports to apply in any case between a subscriber and Altice, without limitation, does not “single[] out” arbitration for “disfavored treatment.” Kindred Nursing Centers Ltd. P’ship, 137 S. Ct. at 1425. To the contrary, it would apply equally to an “infinite forum selection clause” or an “infinite liability limitation clause.” Moreover, to the extent that the Arbitration Provision purports to require arbitration of claims wholly unrelated to the contract in which it is contained, it is arguably not even subject to the FAA and its policy favoring arbitration. After all, the statute applies only to “[a] written provision in any . . . contract evidencing a transaction involving commerce to settle by arbitration a controversy thereafter arising out of such a contract or transaction.” 9 U.S.C. § 2 (emphasis added); see Revitch, 977 F.3d at 721-24 (O’Scannlain, J., concurring) (concluding that Section 2, “at a minimum, must exclude claims that are completely unrelated to the underlying contract or transaction”); Hearn, 415 F. Supp. 3d at 1165; Horton, Infinite Arbitration Clauses, supra, at 678-82.
In short, whether as a matter of contract formation or unconscionability, the Court holds that the Arbitration Provision does not apply to Plaintiffs’ claims to the extent that they lack any nexus to the cable service agreement — that is, to the extent that they are not brought by Plaintiffs in their capacities as current or former Altice subscribers. That does not settle the matter, however, because it is far from clear whether or to what extent Plaintiffs’ claims are brought in their capacities as subscribers versus their capacities as employees. On the one hand, Plaintiffs explicitly purport to bring some claims on behalf of a “Subscriber Subclass” composed of “[a]ll current and former Altice . . . cable subscribers whose personally identifiable information was compromised as a result of the Data Breach,” Am. Compl. ¶ 171; they allege
that, in order to subscribe to cable service, they were required to provide “some of the information compromised in the Data Breach,” Am. Compl. ¶¶ 15, 31, 39, 47, 55, 63, 71, 82 (emphasis added); and they plead claims pursuant to the Cable Communications Act of 1984, which governs a cable operator’s treatment of “personally identifiable information concerning any subscriber,” 47 U.S.C. § 551(c)(1); see Am. Compl. ¶¶ 205-14, 223-33. On the other hand, Plaintiffs expressly disavow any claims brought in their capacities as subscribers in their opposition memorandum of law, stating unequivocally that “Plaintiffs’ claims arise from their employment at Altice and not their cable service.” ECF No. 54 (“Pls.’ Opp’n”), at 23. And there are good reasons to infer that the breached data related to current and former Altice employees and not to Altice subscribers. After all, Cottrell was a victim of the data breach even though she had never subscribed to Altice’s cable service. See Def.’s Mot. to Compel Mem. 1 n.1. And Altice — which is surely in a better position than Plaintiffs to know whose data was compromised, see Am. Compl. ¶ 171 n.63 — sent two versions of the Breach Notice, one stating, “As a current employee, your personal information was included in this report,” and the
other stating, “As a former employee, your personal information was included in this report.” Am. Compl. ¶¶ 96-97 (emphases added); see id. ¶¶ 98-99. Neither version of the Breach Notice suggested that subscriber data was included in the breached report. Given the schizophrenic nature of Plaintiffs’ submissions, the Court concludes that it is prudent to defer judgment on Altice’s motion to compel arbitration and to give Plaintiffs an opportunity to amend their Complaint to conform to their memorandum of law — that is, to make clear that their “claims arise from their employment at Altice and not their cable service,” Pls.’ Opp’n 23, and to remove any allegations and claims suggesting otherwise. Plaintiffs shall file any such amended complaint within twenty-one days of the date of this Opinion and
Order, accompanied by a memorandum of law, not to exceed seven pages, addressing whether or to what extent the claims in that amended complaint are subject to the Arbitration Provision in light of this Opinion and Order. If Plaintiffs do so, Defendants shall file any response, in the form of a memorandum of law not to exceed seven pages, within two weeks of the filing of the amended complaint. Alternatively — that is, if Plaintiffs choose not to amend — they shall, within twenty-one days of the date of this Opinion and Order, file a supplemental memorandum of law, not to exceed ten pages, addressing whether or to what extent the claims in the Complaint are subject to the Arbitration Provision in light of this Opinion and Order. If Plaintiffs elect that option, Defendants shall file any response, in the form of a memorandum of law not to exceed ten pages, within two weeks of Plaintiffs’ submission. Whatever option Plaintiffs choose, no reply may be filed absent leave of Court. MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM That leaves Altice’s Rule 12(b)(6) motion to dismiss two of Plaintiffs’ claims.6 A Rule 12(b)(6) motion tests the legal sufficiency of the complaint and requires the court to determine
whether the facts alleged in the complaint are sufficient to state a claim for relief that is plausible on its face. See Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009). In reviewing such a motion, “the [c]ourt must accept the factual allegations set forth in the complaint as true and draw all reasonable inferences in favor of the plaintiff.” Cohen v. Avanade, Inc., 874 F. Supp. 2d 315, 319-20 (S.D.N.Y. 2012) (citing Holmes v. Grubman, 568 F.3d 329, 335 (2d Cir. 2009)). A claim is facially plausible if it contains “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. More specifically, a plaintiff must allege facts showing “more than a sheer possibility that a defendant has acted unlawfully.” Id. A complaint that offers only “labels and conclusions” or “a formulaic
recitation of the elements of a cause of action will not do,” and any claim that the plaintiff has not “nudged . . . across the line from conceivable to plausible . . . must be dismissed.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 570 (2007). A. New York Labor Law Claims and Related Negligence Per Se Claims First, Altice moves to dismiss Plaintiffs’ claims under the New York Labor Law and related claims of negligence per se. Section 203-d(1) of the New York Labor Law prohibits
6 There is no reason to defer consideration of Altice’s Rule 12(b)(6) motion until after the Court resolves the motion to compel arbitration given that the latter motion is made with respect to only seven of the nine named Plaintiffs. That is, the Court would have to address Altice’s Rule 12(b)(6) motion to dismiss even if it granted the motion to compel arbitration in its entirety. employers from disclosing its employees’ personal identifying information in certain ways. Specifically, to the extent relevant here, it provides that an employer “shall not . . . (a) Publicly post or display an employee’s social security number; (b) Visibly print a social security number on any identification badge or card . . .; (c) Place a social security number in files with unrestricted access; or (d) Communicate an employee’s personal identifying information to the
general public.” N.Y. Lab. Law § 203-d(1). “[P]ersonal identifying information” is defined, in turn, to include Social Security numbers and driver’s license numbers. Id. § 203-d(1)(d). Plaintiffs allege that Altice violated subsections (c) and (d), Am. Compl. ¶¶ 215-22; see Pls.’ Opp’n 19, and that this statutory violation constitutes negligence per se, Am. Compl. ¶¶ 196-204. Applying the plain language of the New York statute, the Court easily concludes that these claims fail as a matter of law. First, any claim under subsection (c) fails because the stolen report was “password protected.” Id. ¶ 161. Whatever the merits of Plaintiffs’ contention that Altice should have encrypted the document, id. ¶ 154, a password-protected document contained within a password-protected email account does not qualify as a “file[] with unrestricted access,”
N.Y. Lab. Law § 203-d(1)(c) (emphasis added). And second, any claim under subsection (d) fails because Altice did not “[c]ommunicate” Plaintiffs’ data to anyone, let alone “to the general public”; it was stolen and then used (or communicated) by others. Sackin v. TransPerfect Global, Inc., 278 F. Supp. 3d 739 (S.D.N.Y. 2017), upon which Plaintiffs rely, see Pls.’ Opp’n 18-19, does not suggest otherwise. Sackin, like this case, involved a phishing attack. See 278 F. Supp. 3d at 744. But there, unlike here, an employee from the targeted company sent — that is, communicated — the plaintiff employees’ personal identifying information directly to the perpetrators of the attack. See id. at 744; see also id. at 748-49, 752-53. Plaintiffs do not cite, and the Court has not found, any authority supporting the proposition that a New York Labor Law claim lies where, as here, the employer did not “communicate” personal identifying information to anyone, but instead is alleged to have not taken adequate steps to prevent criminals from gaining information that, in turn, they used to gain access to the relevant information — much less where the relevant information was itself password-protected. The Court therefore grants Altice’s motion to dismiss Plaintiffs’ claims for direct violation of the
New York Labor Law and for negligence per se based on that statute. B. Breach of Implied Contract Claim Second, Altice moves to dismiss Plaintiffs’ claims for breach of an implied contract. Under New York law, an implied-in-fact contract may be inferred “from the facts and circumstances of the case, although not formally stated in words.” Leibowitz v. Cornell Univ., 584 F.3d 487, 506-07 (2d Cir. 2009) (quoting Jemzura v. Jemzura, 330 N.E.2d 414, 420 (N.Y. 1975)), superseded by statute on other grounds as recognized in Vogel v. CA, Inc., 662 F. App’x 72, 75 (2d Cir. 2016) (summary order). Such a contract “is derived from the presumed intention of the parties as indicated by their conduct.” Id. at 507 (internal quotation marks omitted). “A
contract implied in fact is as binding as one that is express,” and its formation requires the same elements, including “consideration, mutual assent, legal capacity and legal subject matter.” Id. (internal quotation marks omitted). Here, Plaintiffs allege that when they provided personal identifying information to Altice as a “condition of their employment,” they “entered into implied contracts in which [Altice] agreed . . . to protect” this data “through the use of reasonable industry standards,” which Altice failed to do. Am. Compl. ¶¶ 104, 236-38. Plaintiffs plead specific examples of Altice’s failure to perform its implied contractual duties, including inadequate email filtering software and cybersecurity training for employees who deal with sensitive data; a failure to encrypt the stolen document; and retention of personal identifying information pertaining to former employees who had left the company years earlier. Am. Compl. ¶¶ 152-55. Federal courts have largely upheld claims of this nature. See, e.g., Resnick v. AvMed, Inc., 693 F.3d 1317, 1327-28 (11th Cir. 2012); Anderson v. Hannaford Bros., 659 F.3d 151, 158- 59 (1st Cir. 2011); In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., — F.
Supp. 3d —, No. 3:19-CV-2284 (H) (KSC), 2020 WL 2214152, at *5 (S.D. Cal. May 7, 2020); Rudolph v. Hudson’s Bay Co., No. 18-CV-8472 (PKC), 2019 WL 2023713, at *10-11 (S.D.N.Y. May 7, 2019); Gordon v. Chipotle Mexican Grill, Inc., 344 F. Supp. 3d 1231, 1246-48 (D. Colo. 2018); In re Arby’s Rest. Grp. Inc. Litig., Nos. 1:17-CV-0514 (AT) et al., 2018 WL 2128441, at *15-17 (N.D. Ga. Mar. 5, 2018); Castillo v. Seagate Tech., LLC, No. 16-CV-1958 (RS), 2016 WL 9280242, at *8-9 (N.D. Cal. Sept. 14, 2016); In re Target Corp. Customer Data Sec. Breach Litig., 66 F. Supp. 3d 1154, 1176-77 (D. Minn. 2014); In re Michaels Stores PIN Pad Litig., 830 F. Supp. 2d 518, 531-32 (N.D. Ill. 2011). But see, e.g., SuperValu, 870 F.3d at 771 n.6; Longenecker-Wells v. Benecard Servs. Inc, 658 F. App’x 659, 662-63 (3d Cir. 2016)
(unpublished); Krottner v. Starbucks Corp., 406 F. App’x 129, 131 (9th Cir. 2010) (unpublished). Castillo is particularly instructive here. There, cyber criminals conducted a successful phishing attack against Seagate Technology, LLC (“Seagate”), resulting in the theft of Seagate employees’ W-2 data. 2016 WL 9280242, at *1. A group of employees sued, claiming that Seagate had breached an implied “agree[ment] to take adequate measures and make reasonable efforts to properly safeguard the personal information of employees.” Id. at *9. (internal quotation marks and brackets omitted). Like Altice here, Seagate moved to dismiss on the ground that the plaintiffs “alleged no conduct evincing mutual assent or offer and acceptance.” Id.; see Def.’s Mem. 17. The court denied the motion, reasoning that an implied- in-fact contract resulted from the employees’ provision of “their personal information for tax purposes and to receive employment and benefits, with the understanding that Seagate, while it held the information, would take adequate measures to protect it.” Castillo, 2016 WL 9280242, at *9. Indeed, the court declared, “it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of Social Security numbers or other sensitive personal
information would not imply the recipient’s assent to protect the information sufficiently.” Id. The Court agrees with Castillo and, on that basis, easily concludes that Plaintiffs allege a plausible claim for breach of an implied contract. Like the plaintiffs in Castillo, Plaintiffs here allege that they were required to provide personal identifying information in exchange for employment. See Am. Compl. ¶ 104. And like the defendant in Castillo, Altice allowed that information to fall into the hands of cyber criminals. See Am. Compl. ¶¶ 5-7. In fact, if anything, Plaintiffs’ implied contract claim is stronger than their counterparts’ claim was in Castillo, as they plead specific ways in which Altice’s cybersecurity measures allegedly fell short of its contractual obligations to protect their personal data. Compare Am. Compl. ¶¶ 152-
55, with Castillo, 2016 WL 9280242, at *9-10. Accordingly, Altice’s motion to dismiss Plaintiffs’ breach of implied contract claim must be and is denied. CONCLUSION For the foregoing reasons, Altice’s motion to dismiss for lack of subject-matter jurisdiction is DENIED, and Altice’s motion to dismiss for failure to state a claim is GRANTED as to Plaintiffs’ claims under the New York Labor Law and their related claims of negligence per se and is DENIED with respect to Plaintiffs’ breach of implied contract claim. The Court defers judgment on Altice’s motion to compel arbitration pending the supplemental submissions discussed above. Altice is granted an extension of the deadline to answer until three weeks after the Court resolves the motion to compel arbitration. Finally, Plaintiffs’ pro forma request notwithstanding, see Pls.’ Opp’n 35, the Court declines to grant them leave to amend their claims under the New York Labor Law and their related claims of negligence per se because the flaws in those claims are substantive and any amendment would be futile, see, e.g., City of Philadelphia v. Bank of Am. Corp., — F. Supp. 3d
—, Nos. 19-CV-1608 (JMF) et al., 2020 WL 6430307, at *14 (S.D.N.Y. Nov. 2, 2020). The Clerk of Court is directed to terminate ECF Nos. 45 and 47. SO ORDERED.
Dated: March 8, 2021 ( G New York, New York JESSEW FURMAN nited States District Judge