Smith v. Findlay Automotive, Inc.

Opinion

* * *

KARIN SMITH, et al., individually and on Case No. 2:24-cv-01226-RFB-EJY behalf of all others similarly situated,

Plaintiffs,

v.

Defendant.

Before the Court is Defendant Findlay Automotive, Inc.’s Motion to Dismiss (ECF No. 27) Plaintiffs’ Consolidated Class Complaint (ECF No. 21). For the reasons below, the Motion is granted in part and denied in part. The Court summarizes the procedural history relevant to the instant Motion. On June 12, 2024, Plaintiffs Karin Smith and Pholisith Bouphapraseuth, individually and on behalf of others similarly situated, filed their Class Action Complaint in the Eighth Judicial District Court for the State of Nevada (“Smith Action”). (ECF No. 1-1). On July 8, 2024, Defendant Findlay Automotive, Inc. filed a Petition for Removal and a Notice of Related Case Stevens v. Findlay Automotive, Inc., Case No. 2:24-cv-01227-APG-BNW (“Stevens Action”). (ECF Nos. 1-2). On July 12, 2024, Defendant filed a Motion to Consolidate the Smith and Stevens Actions. (ECF No. 7). On July 24, 2024, Defendant filed its Statement Regarding Removal, which identified the basis for removal as federal question jurisdiction, and an alternative basis for removal pursuant to the Class Action Fairness Act. (ECF No. 11). The same day the parties filed a Stipulation to Consolidate the Smith and Stevens Actions. (ECF No. 12). On August 1, 2024, the Court granted the Motion to Consolidate and ordered the Stevens Action consolidated under this Smith Action. (ECF No. 14). On August 9, 2024, Defendant filed its first Motion to Dismiss. (ECF No. 17). On August 16, 2024, Plaintiffs filed their operative Amended Consolidated Class Complaint (“Complaint”). (ECF No. 21). The Complaint brings claims under Nevada law for (1) Negligence and Negligence Per Se; (2) Breach of Express Contract; (3) Breach of Implied Contract; (4) Invasion of Privacy; (5) Unjust Enrichment; (6) Declaratory Judgment and Injunctive Relief. Id. On August 27, Defendants filed the instant Motion to Dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). (ECF No. 28). Defendant concurrently filed a Motion to Stay. (ECF No. 32). As of September 23, 2024, the Motion to Stay was fully briefed. (ECF No. 32-33). As of October 17, 2024, the Motion to Dismiss was fully briefed. (ECF Nos. 37-38). On October 24, 2024, the Honorable Magistrate Judge Elayna J. Youchah granted in part and denied in part the Motion to Stay. (ECF No. 39). Individual discovery was opened for a period of 90 days, while no class related discovery was allowed to proceed. Id. On February 10, 2025, the parties entered a Joint Status Report regarding discovery and sought an extension of time to submit a case schedule and proposed discovery plan. (ECF No. 47). On February 12, 2025, Judge Youchah granted the parties until seven days after resolution of the instant Motion to Dismiss. (ECF No. 48). The Courts Order on the pending Motion to Dismiss follows. The following allegations are taken from the Amended Consolidated Class Complaint. This action arises out of a targeted ransomware attack on Findlay Automotive, Inc.’s which Plaintiffs allege led to the unauthorized access and acquisition of their personally identifiable information (“PII”) including full names, addresses, driver’s license numbers, social security numbers, insurance policy numbers, credit and debit card numbers, and financial information. Plaintiffs allege that up to and through June 2024, Defendant obtained the PII of Plaintiffs and class members and stored it in an unencrypted, internet-accessible environment on its network from which unauthorized actors used an extraction tool to retrieve Plaintiffs’ PII. On information and belief, Defendant failed to properly monitor its computer network, IT systems and integrated services which housed the PII and failed to timely recognize malicious activity on its information system. Through the attack, a notorious cybercriminal group called “Scattered Spider” obtained Plaintiffs’ PII. The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency released a joint report identifying Scattered Spider as a cybercriminal group that targets large companies and their contracted information technology help desks. Per the report, Scattered Spider threat actors typically engage in data theft for extortion and publication to the dark web and for subsequently carrying out ransomware attacks to disrupt business operations. Defendant was unprepared for such an attack, which resulted in delays in customers being paid money Defendant owed to them, who were told the delay was due to a cyberattack. As a result, Defendant failed to timely remit payment of $2,500 owed to Plaintiff Farrell as compensation for a vehicle trade-in and failed to properly and timely register Plaintiff Sax’s vehicle, which cost him money, including his income as an Uber driver, and time. Defendants further failed to meet statutory requirements to provide affected persons with timely notice of the data breach. Plaintiffs allege they have suffered harms including lost time in responding to the data breach, in the form of valuable hours spent calling Defendant to investigate the harm and attempting to mitigate its effects and seeking payment of monies owed to them by Defendant (Plaintiffs Sax and Farrell). They also allege they “may” incur out-of-pocket expenses purchasing credit monitoring services, credit freezes, credit reports, and other protective measures to deter and detect identity theft. They further allege they suffered damage to and diminution in the value of their PII; violation of their privacy rights; and present, imminent, and impending injury arising from the theft of their PII. As a result of the data breach, Plaintiffs allege they suffered emotional distress, including anxiety about unauthorized parties viewing, selling, and/or using their PII for the purposes of identity theft and fraud. An initial pleading must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a). The court may dismiss a complaint for “failure to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). In ruling on a motion to dismiss, “[a]ll well-pleaded allegations of material fact in the complaint are accepted as true and are construed in the light most favorable to the non-moving party.” Faulkner v. ADT Sec. Servs., Inc., 706 F.3d 1017, 1019 (9th Cir. 2013) (citations omitted). To survive a motion to dismiss, a complaint need not contain “detailed factual allegations,” but it must do more than assert “labels and conclusions” or “a formulaic recitation of the elements of a cause of action . . . .” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl.Corp. v. Twombly, 550 U.S. 544, 555 (2007)). In other words, a claim will not be dismissed if it contains “sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face,” meaning that the court can reasonably infer “that the defendant is liable for the misconduct alleged.” Id. at 678 (internal quotation and citation omitted). The Ninth Circuit, in elaborating on the pleading standard described in Twombly and Iqbal, has held that for a complaint to survive dismissal, the plaintiff must allege non-conclusory facts that, together with reasonable inferences from those facts, are “plausibly suggestive of a claim entitling the plaintiff to relief.” Moss v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009). Defendant moves to dismiss all of Plaintiffs’ claims under Federal Rule of Civil Procedure 12(b)(6). A. Cognizable Damages Citing Pruchnicki v. Envision Healthcare Corp., 845 Fed. Appx. 613 (9th Cir. 2021), Defendants argue Plaintiffs fail to allege cognizable damages as elements of all of their tort and contract claims under Nevada law.1 As noted below, each of Plaintiffs’ claims require establishing

1 As the Ninth Circuit noted in Pruchnicki, plaintiffs in a data breach litigation may sufficiently allege an injury-in- fact to support standing, but nevertheless fail to sufficiently state a claim for compensable damages as required under Nevada law. Pruchnicki, 845 Fed. Appx. at 614 (citing Doe v. Chao, 540 U.S. 614, 624-25 (2004). Defendant does not move to dismiss Plaintiffs claims for lack of standing pursuant to FRCP 12(b)(1). The Court therefore does not cognizable damages. The Court addresses this general challenge to Plaintiffs’ claims before turning to the challenges specific to each claim. To this general damages argument, Plaintiffs respond that they allege the following compensable damages: (1) direct economic losses; (2) substantially increased risk of identity theft; (3) lost time and mitigation efforts; (4) violation of plaintiffs’ privacy rights; (5) diminution in value of PII; and (5) benefit of the bargain damages. The Court addresses each theory of damages in turn. 1. Direct Economic Losses Plaintiffs refer to their allegations that because of the data breach, Plaintiff Ferrell and Sax suffered economic losses as a result of the delay of Defendant remitting payment and registering a car due to “internet problems” from the data breach. The Court agrees with Defendant’s argument that these damages arise from Plaintiffs’ breach of contract claims, based on standard payment and related delivery terms express or implied within every automobile contract. The Court finds they are not sufficiently related to the data breach to permit recovery for these losses under Plaintiffs’ tort claims arising from the data breach. To the extent Defendants argue, citing Garcia v. Equifax Information Services, LLC, No. 2:17-cv-93123-JAD-VCF, 2019 WL 9160825, at *5 (D. Nev. March 3, 2020) that the allegations as to these damages arising should be stricken under Fed R. Civ. P. 12(f) and 23(d)(1)(D) because they are specific to only two of the class representative Plaintiffs, and thus do not present predominating common questions of law and fact for the putative class, the Court defers ruling on that argument to the class certification stage. The Court therefore denies dismissal as to Plaintiffs’ breach of express contract claims at this stage. 2. Substantially Increased Risk of Data Theft The Court finds that Plaintiffs have stated a compensable injury arising from the loss of control of their identity and the accompanying impairment in value of their PII. Smallman v. MGM Resorts Int'l, 638 F. Supp. 3d 1175, 1188 (D. Nev. 2022) (collecting cases wherein courts within address standing in detail but finds that Plaintiffs have sufficiently pled an injury-in-fact by alleging hackers have obtained their sensitive PII including social security numbers and credit card information. See In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018) (finding standing based on similar factual allegations). the Ninth Circuit have found that an individual's loss of control over PII constitutes a cognizable harm). Defendant attempt to distinguish Smallman because the plaintiffs in that case alleged their hacked information had already been “posted for sale on the dark web” and some plaintiffs alleged “criminals ha[d] attempted to make fraudulent purchases on their accounts.” Id. Here, Plaintiffs have not alleged their PII has been posted on the dark web or that there have been fraudulent purchases attempted, but that their information has been obtained by a cybercriminal group known for identity theft for purposes of extortion and selling PII on the dark web. That is sufficient at the pleading stage; Plaintiffs do “do not have to wait until hackers inevitably use their private information for nefarious purposes . . .” In re Eureka Casino Breach Litig., 2:23-CV-00276-CDS- BNW, 2024 WL 4253198, at *5 (D. Nev. Sept. 19, 2024) (citing Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015) as persuasive authority.) 3. Loss of Time Plaintiffs allege that they have lost time investigating and mitigating the harms of the data breach. They also state they “may” suffer out-of-pocket losses for credit monitoring services. This is not sufficient. Lost time alone is not a cognizable injury for the purpose of establishing compensable damages. And several district courts in this Circuit have declined to recognize such damages unless accompanied by out-of-pocket expenses. Pruchnicki v. Envision Healthcare Corp., 845 Fed. Appx. 613, 614 (9th Cir. 2021) (holding lost time is not a cognizable injury for the purpose of establishing cognizable damages under Nevada law, where unaccompanied by actual (not speculative) out-of-pocket losses). The Court therefore dismisses Plaintiffs’ theory of damages to the extent it alleges damages based on loss of time. However, because amendment could cure this deficiency if Plaintiffs can show actual out-of-pocket expenses incurred in combination with lost time mitigating the harm caused by the theft of their PII, dismissal is without prejudice and with leave to amend. 4. Emotional Distress Plaintiffs allege they suffered and continue to suffer emotional distress in the form of “anxiety about unauthorized parties viewing, selling, and/or using their PII for purposes of identity theft and fraud.” Under Nevada law, “in the absence of physical impact, proof of ‘serious emotional distress’ causing physical injury or illness must be presented.” Pruchnicki, 845 Fed. Appx. at 614 (citing Olivero v. Lowe, 995 P.2d 1023, 1026 (Nev. 2000)). Plaintiffs’ allegations regarding their anxiety do not suggest physical injury or illness. Plaintiffs must ultimately provide objective evidence of emotional distress such as treatment records for such damages to be available. The Court therefore dismisses Plaintiffs’ theory of damages without prejudice and with leave to amend. 5. Diminution in Value of PII Diminution in the value of personal information can be a viable theory of damages in a data breach case. Pruchnicki v. Envision Healthcare Corp., 439 F. Supp. 3d 1226, 1234 (D. Nev. 2020), aff'd, 845 Fed. Appx. 613 (9th Cir. 2021) (citing In re Facebook Privacy Litig., 572 Fed. App'x 494, 494 (9th Cir. 2014)). The Court finds Plaintiffs have stated a cognizable theory of damages based on the diminution in the value of their PII given the threat that it will be misused by a cybercriminal gang or sold on the dark web by that gang, who is in possession of their PII. Such potential future misuse of Plaintiffs’ PII “interferes with [Plaintiffs’] fiscal autonomy . . . [and] impairs their ability to participate in the economic marketplace.” Smallman, 638 F. Supp. 3d at 1191. Therefore, the court denies Defendant’s motion to the extent it seeks dismissal on the grounds that Plaintiffs’ diminution of value of their PII is not a cognizable harm. 6. Benefit of the Bargain Plaintiffs allege that they are entitled to benefit of the bargain damages based on Defendant’s breach of an implied contract. They allege they were required to provide their PII to Defendant as a condition of leasing or purchase a vehicle, or as a condition of receiving maintenance on their vehicles. They allege they reasonably understood that a portion of the funds they paid for their vehicles or other services would be used to ensure adequate cybersecurity would protect their PII, and that Defendant would provide them with prompt and adequate notice of all unauthorized access or theft of their PII, consistent with their duties under state and federal law, and their internal privacy policies. They claim they would not have entrusted their PII to Defendant in the absence of such an agreement. They allege Defendant breached this implied agreement by failing to safeguard their information and promptly notify them of the breach. “A significant body of case law” in the Ninth Circuit supports a benefit-of-the-bargain theory based on an implied contract that a defendant will safeguard PII when it is provided by a customer in exchange for goods and services. In Re Eureka Casino Breach Litig., 2:23-CV-00276- CDS-BNW, 2024 WL 4253198, at *20; (citing Smallman, 638 F. Supp. 3d at 1191 (collecting cases)). The Court is persuaded by this reasoning and finds that allegations that data security was a part of the bargain between Plaintiffs and Defendant, especially given the highly sensitive nature of the PII provided (e.g., social security numbers), are sufficient to state cognizable harm at the pleading stage. See Smallman, 638 F. Supp. 3d at 1190 (finding “the line of cases that accept at the pleading stage more general factual allegations about the plaintiff's expectations for data security and the contours of the parties’ bargain” persuasive and denying dismissal of benefit-of- the-bargain damages). B. Negligence To prevail on a common law negligence claim, a plaintiff must demonstrate that (1) the defendant owed the plaintiff a duty of care, (2) the defendant breached that duty, (3) the breach was the legal cause of the plaintiff’s injuries, and (4) the plaintiff suffered damages. See e.g., Foster v. Costco Wholesale Corp., P.3d 150, 153 (Nev. 2012). Defendant argues that in addition to the failure to allege cognizable damages as discussed above, the economic loss doctrine requires dismissal of Plaintiff’s negligence claim, as well as Plaintiffs’ failure to adequately allege a duty of care. The Court addresses both arguments in turn. 1. Economic Loss Doctrine The economic loss doctrine presents recovery for negligence in the absence of a claim of “personal injury or damage to other property.” Hi-Tech Aggregate, LLC v. Pavestone, LLC, 555 P.3d 1184, 1190 (Nev. 2024) (citations omitted). “The policy behind the economic loss doctrine is that when there is no personal injury or property damage, remedies are properly addressed through contract law.” Id. However, a plaintiff can recover for the economic consequences of a negligent act if there is accompanying personal injury or property damage. See Terracon Consultants W., Inc. v. Mandalay Resort Group, 206 P.3d 81, 86 (Nev. 2009). The Court finds that Plaintiffs have adequately alleged non-economic harms arising from the loss of control of their identity and the accompanying impairment in value of their PII. Smallman, 638 F. Supp. at 1175 (collecting cases within the Ninth Circuit finding an individual's loss of control over the use of their identity due to a data breach and the accompanying impairment in value of PII constitutes non-economic harm). The Court finds the economic loss doctrine does not require dismissal of Plaintiffs’ negligence claim. C. Duty of Care (Negligence Per Se) Under the doctrine of negligence per se, “a civil statute's violation establishes the duty and breach elements of negligence when the injured party is in the class of persons whom the statute is intended to protect, and the injury is of the type against which the statute is intended to protect.” Sanchez ex rel. Sanchez v. Wal-Mart Stores, Inc., 221 P.3d 1276, 1283 (Nev 2009). Defendants challenge Plaintiffs’ negligence per se claim arguing Plaintiffs cannot establish a duty based on standards set forth in Section 5 of the Federal Trade Commission Act (FTCA), 15 U.S.C. § 45, because there is no private right of action under the FTCA. However, a private right of action is not required, because “it is the tort of negligence, and not the violation of the statute itself, which entitles a plaintiff to recover civil damages.” In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1142 (C.D. Cal. 2021) (finding Section 5 of FTCA can establish duty and breach under doctrine of negligence per se in a data breach case). Moreover, Defendants concede that NRS 603A.210(1) can establish duty and breach, as alleged by Plaintiffs. They also do not contest that they owed Plaintiffs a common law duty of care to safeguard the PII Plaintiffs provided them. Therefore, the Court declines to dismiss Plaintiffs’ negligence and negligence per se claim for failure to plead that Defendant owed Plaintiffs a duty of care. D. Breach of Implied Contract To establish a breach of contract claim, a plaintiff must show: (1) the existence of a valid contract, (2) plaintiff’s performance (3) defendant’s material failure to perform; and (4) damages resulting from the failure to perform. Calloway v. City of Reno, 993 P.2d 1259, 1263 (2000). Although the terms of an implied contract are manifested by conduct rather than written words, both “are founded upon an ascertainable agreement.” Smith v. Recrion Corp., 541 P.2d 663, 664– 65 (Nev. 1975). The formation of an enforceable contract requires the following: (1) offer and acceptance, (2) meeting of the minds, and (3) consideration. May v. Anderson, 119 P.3d 1254, 1257 (Nev. 2005). As discussed above, the damages element has been sufficiently pled. Defendants argue Plaintiffs have failed to allege that they paid for cybersecurity measures from Defendant, and thus their implied contract claim fails for want of consideration. Plaintiff’s sole allegation is that they “reasonably understood that a portion of the funds they paid Defendant for their vehicles would be used to pay for adequate security measures.” In their Opposition, Plaintiffs cite to other data breach cases where an implied contract between a merchant and consumer was found but fail to directly address the issue of consideration. The Court finds that this theory actually sounds in tort negligence and not implied contract as Plaintiffs can point to nothing more than a vague understanding to establish a meeting of the minds and specific consideration for this ‘understanding.’ Accordingly, Plaintiffs implied contract claim is dismissed without prejudice due to failure to plead consideration and a proper meeting of the minds, without prejudice and with leave to amend. In Re Eureka Casino Breach Litig., 2:23-CV-00276-CDS- BNW, 2024 WL 4253198, at *14-15 (dismissing implied breach of contract claim without prejudice for failure to address the issue of consideration, where Plaintiffs did not allege that they paid for cybersecurity measures when they purchased the defendant’s services and products). 1. Breach of Covenant of Good Faith and Fair Dealing Plaintiffs allege Defendant breached the covenants of good faith and fair dealing in acting unreasonably in performing their implied contract to “implement reasonable, industry standard, or legally required safeguards” for their PII. A contractual breach of the covenants, or contractual bad faith claim, exists when “the terms of a contract are literally complied with but one party to the contract deliberately contravenes the intention and spirit of the contact . . .” Hilton Hotels Corp. v. Butch Lewis Prods., Inc., 808 P.2d 919, 923 (1991). Because the Court dismisses Plaintiffs implied contract claim, there can be no claim for a breach of the implied covenant of good faith and fair dealing. E. Invasion of Privacy Plaintiffs allege a claim for invasion of privacy. In their opposition to the Motion to Dismiss, they clarify that their claim is based on an “intrusion upon seclusion theory.” Under Nevada law such a claim requires (1) an intentional intrusion; (2) physically or otherwise; (3) upon the solitude or seclusion of another or his private affairs or concerns; (4) which would be highly offensive to a reasonable person. Hetter v. Eighth Judicial Dist. Court of State In & For Cnty. of Clark, 874 P.2d 762 (Nev. 1994). Defendant’s sole argument in their Motion to Dismiss the “intrusion upon seclusion” claim is that Plaintiffs fail to establish the fourth element because Plaintiffs’ “speculative allegations that their PII likely or will be published on the dark web” are not enough to show a highly offensive intrusion. A court considering whether a particular action is “highly offensive” should consider the following factors: “the degree of intrusion, the context, conduct and circumstances surrounding the intrusion as well as the intruder's motives and objectives, the setting into which he intrudes, and the expectations of those whose privacy is invaded.” People for Ethical Treatment of Animals v. Bobby Berosini, Ltd., 895 P.2d 1269, 1282 (Nev. 1995) holding modified on other grounds by City of Las Vegas Downtown Redevelopment Agency v. Hecht, 940 P.2d 134 (Nev. 1997). At the pleading stage, the Court finds based on the factors set forth under Nevada law that the allegation that Plaintiffs’ sensitive PII is in the hands of a notorious cybercriminal gang, known for identity theft, extortion, and selling PII on the dark web, is sufficient to plead the “highly offensive” element. F. Unjust Enrichment Defendant argues Plaintiff have failed to plead facts sufficient to state an unjust enrichment claim. “Unjust enrichment exists when the plaintiff confers a benefit on the defendant, the defendant appreciates such benefit, and there is acceptance and retention by the defendant of such benefit under circumstances such that it would be inequitable for him to retain the benefit without payment of the value thereof.” Certified Fire Prot. Inc. v. Precision Constr. Inc., 283 P.3d 250, 257 (Nev. 2012) (quotation marks and citations omitted). The Court finds that the Plaintiffs have not adequately pled an unjust enrichment claim under Nevada law. The Plaintiffs have not sufficiently pled that the sharing of their information or that their PII itself had a value for which they received no reciprocal consideration. The Court rejects the Plaintiffs’ theory of overpayment as essentially another theory of negligence. This claim is dismissed without prejudice. G. Injunctive Relief and Declaratory Judgment Plaintiffs plead a separate claim for injunctive and declaratory relief. Defendant moves to dismiss both claims. 1. Declaratory Judgement Plaintiffs seek a declaratory judgment that Defendant’s breached legal duties to them, including under the FTCA. The Court finds that such a judgment would be duplicative of Plaintiffs’ negligence per se claim, and that the relief sought will be obtained through resolution of that claim. “Where a claim for declaratory relief is merely duplicative of other causes of action asserted by a plaintiff, dismissal is proper.” Tyler v. Travelers Commercial Ins. Co., 499 F.Supp.3d 693, 702 (N.D. Cal. 2020) (citing Swartz v. KPMG LLP, 476 F.3d 756, 765–66 (9th Cir. 2007)). The Court therefore dismisses Plaintiffs cause of action for a declaratory judgment. 2. Injunctive Relief Plaintiffs allege that Defendant’s security measures regarding their PII, which is still in Defendant’s possession, “remain inadequate and unreasonable” and seek injunctive relief requiring Defendant to implement adequate security protocols consistent with industry standards, including encryption, regular audits, and employee training, to prevent future data breaches that would impact them. Defendant argues this claim should be dismissed because they have failed to establish an imminent or substantial risk. To the extent Plaintiffs seek a preliminary injunction, Plaintiffs must file a separate Motion. The Court finds the allegations “are sufficient to allege that a data breach is sufficiently likely to recur such that injunctive relief will redress Plaintiffs’ injuries” should the Plaintiffs prevail through class certification. In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1141 (C.D. Cal. 2021). The Court will allow Plaintiffs’ prayer for relief to proceed on behalf of Plaintiffs and the putative class. For the foregoing reasons, IT IS ORDERED that the Defendant’s Motion to Dismiss (ECF No. 39) is GRANTED in part and DENIED in part. The individual claims are addressed as 4] follows: (1) Defendant’s Motion to Dismiss Plaintiffs’ first cause of action for negligence is DENIED; (2) Defendant’s Motion to Dismiss Plaintiffs’ second cause of action for breach of express contract is DENIED: (3) Plaintiffs’ third cause of action for breach of implied contract is DISMISSED without prejudice; (4) Defendant’s Motion to Dismiss Plaintiffs’ fourth cause of action for invasion of privacy is DENIED; (5) Plaintiffs’ fifth cause of action for unjust enrichment is DISMISSED without prejudice; (6) Plaintiffs’ sixth cause of action for declaratory judgment and injunctive relief is DISMISSED with prejudice; Plaintiffs’ prayer for injunctive relief may proceed. IT IS FURTHER ORDERED that Plaintiffs are granted leave to amend to address the deficiencies outlined in this Order. If Plaintiffs intend on filing an amended complaint, it must be 19] titled “Second Amended Class Consolidated Class Complaint” and filed on or before April 18, 20] 2025. IT IS FURTHER ORDERED that, pursuant to the Court’s (ECF No. 48) Order, the Parties shall file a joint proposed discovery plan and scheduling order by April 15, 2025. DATED: March 31, 2025. 4 S RICHARD F. BOULWARE, II UNITED STATES DISTRICT JUDGE

-13-