UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY
IN RE U.S. VISION DATA BREACH No. 1:22-cv-06558 LITIGATION
OPINION
APPEARANCES: Janine L. Pollack GEORGE FELDMAN MCDONALD, PLLC 745 Fifth Avenue Suite 500 New York, NY 10151
Vicki Maniatis MILBERG COLEMAN BRYSON PHILLIPS GROSSMAN, LLC 100 Garden City Plaza Suite 500 Garden City, NY 11530
Gamaliel B. Delgado MORGAN & MORGAN 199 Water Street Suite 6705 New York, NY 10038
On behalf of Plaintiffs.
Rebecca Lynne Rakoski XPAN LAW PARTNERS LLP 4 North Maple Avenue Marlton, NJ 08053
On behalf of USV Defendants. O’HEARN, District Judge. This matter comes before the Court on Defendants U.S. Vision, Inc. and USV Optical, Inc.’s Second Motion to Dismiss, (ECF No. 80), the Second Amended Consolidated Class Action Complaint (“SAC”) filed by Plaintiffs. (ECF No. 79). The Court did not hear oral argument
pursuant to Local Rule 78.1. For the reasons that follow, Defendants’ Motion is GRANTED. I. BACKGROUND The Court incorporates the background set forth in its prior opinion, (ECF No. 71), except to add the following pertinent to the instant Motion. In their Second Amended Complaint, Plaintiffs allege that Defendants U.S. Vision, Inc., and USV Optical, Inc. (collectively, “USV” or “USV Defendants”), in conjunction with Defendant Nationwide Optometry, P.C. (“Nationwide”), acquired and failed to adequately protect the personally identifiable information (“PII”) and protected health information (“PHI”) of over 711,000 individuals. (SAC, ECF No. 79 at ¶ 1). According to Plaintiffs, Nationwide, a wholly owned subsidiary of USV until its sale in 2019, allegedly functioned as USV’s alter ego. (Id. at ¶
54). Despite the sale, Plaintiffs assert that USV retained and continued to maintain the PII and PHI of Nationwide’s patients, including those of the named Plaintiffs. (Id. at ¶ 60). Between April 20, 2021, and May 17, 2021, USV experienced a data breach in which cybercriminals allegedly gained unauthorized access to Plaintiffs’ PII and PHI. (Id. at ¶ 69). The compromised data included, among other things, names, dates of birth, addresses, Social Security numbers, taxpayer identification numbers, driver’s license and state identification numbers, financial account information, medical and treatment records, health insurance details, billing and claims data, biometric information, email addresses, and usernames with associated passwords. (Id. at ¶ 71).
2 As a result of the breach, Plaintiffs claim they have suffered various harms, including identity theft, an increased and imminent risk of fraud and identity theft, costs associated with mitigation efforts, and a loss of privacy. (Id. ¶¶ 14–20, 25–29, 34–41, 93). In their Amended Complaint, Plaintiffs bring the following causes of action against USV:
(1) negligence (Count One); (2) negligence per se (Count Three); (3) breach of fiduciary duty (Count Five); (4) breach of implied contract (Count Seven); (5) breach of contract (third party beneficiary) (Count Nine); (6) unjust enrichment (Count Ten); (7) violations of the Arizona Consumer Fraud Act, A.R.S. §§ 44-1521 et seq. (“ACFA”) (Count Twelve); and (8) violations of the New Jersey Consumer Fraud Act, N.J.S.A. §§ 56:8-1 et seq. (Count Fourteen). II. PROCEDURAL HISTORY The Court incorporates the recitation of the matter’s procedural history in its prior opinion, (ECF No. 71), except to add the following subsequent pertinent events. On April 30, 2024, the Court issued its decision on USV’s Motion to Dismiss, which was granted in part and denied in part, and dismissed Plaintiffs’ breach of fiduciary duty, breach of
implied contract, and unjust enrichment claims without prejudice. (ECF No. 71). The Order gave Plaintiffs leave to file an amended complaint “if, in good faith, they c[ould] allege further facts to sufficiently state a claim,” and ordered a status conference to discuss the remaining claims and the Court’s questions as to the applicable law. (ECF No. 70). Following the status conference, on June 5, 2024, the parties advised the Court that they had agreed that “the Court should apply New Jersey law to Plaintiffs’ common law claims” and proposed a schedule for the filing of an amended complaint and responsive pleading. (ECF No. 77). On June 19, 2024, Plaintiffs filed the SAC. (ECF No. 79). On July 29, 2024, USV filed the Second Motion to Dismiss. (ECF No. 80). Plaintiffs filed opposition to the Motion on August 19,
3 2024, (ECF No. 82), to which USV filed a reply on September 6, 2024. (ECF No. 83). III. LEGAL STANDARD To state a claim, a complaint needs only to provide a “short and plain statement of the claim showing that the pleader is entitled to relief.” FED. R. CIV. P. 8(a)(2). Although “short and
plain,” this statement must “give the defendant fair notice of what the claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 545 (2007) (quotations, alterations, and citation omitted). “[A] plaintiff’s obligation to provide the ‘grounds’ of his ‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of a cause of action’s elements will not do.” Id. (citations omitted). Rather, a complaint must contain sufficient factual allegations “to state a claim to relief that is plausible on its face.” Id. at 547. When considering a motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), a court must accept the complaint’s well-pleaded allegations as true and view them in the light most favorable to the plaintiff. Evancho v. Fisher, 423 F.3d 347, 350 (3d Cir. 2005). Through this lens, the court then conducts a three-step analysis. Malleus v. George,
641 F.3d 560, 563 (3d Cir. 2011). “First, the court must ‘tak[e] note of the elements a plaintiff must plead to state a claim.’” Id. (quoting Ashcroft v. Iqbal, 556 U.S. 662, 675 (2009)). Next, the court should identify and disregard those allegations that, because they are no more than conclusions, are not entitled to the assumption of truth. Id. Finally, the court must determine whether “the facts alleged in the complaint are sufficient to show that the plaintiff has a ‘plausible claim for relief.’” Fowler v. UPMC Shadyside, 578 F.3d 203, 211 (3d Cir. 2009) (quoting Iqbal, 556 U.S. at 679). A facially plausible claim “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 210 (quoting Iqbal, 556 U.S. at 678). On a Federal Rule of Civil Procedure 12(b)(6) motion, the “defendant bears the burden of
4 showing that no claim has been presented.” Hedges v. United States, 404 F.3d 744, 750 (3d Cir. 2005). The court may only consider the facts alleged in the pleadings, any attached exhibits, and any matters of judicial notice. S. Cross Overseas Agencies, Inc. v. Kwong Shipping Grp. Ltd., 181 F.3d 410, 426 (3d Cir. 1999).
IV. DISCUSSION A. Plaintiffs have again failed to establish a direct relationship with USV and as such, Plaintiffs’ claims for breach of fiduciary duty, breach of implied contract, and unjust enrichment must be dismissed.
Defendants argue that Plaintiffs are improperly invoking the alter ego doctrine as a means to impose liability on USV, despite the absence of any facts warranting the disregard of the corporate form. (Def. Br., ECF No. 80 at 10–14). According to the USV Defendants, Plaintiffs’ allegations regarding the relationship between USV and Nationwide rely on conclusory assertions of corporate “co-mingling,” with insufficient factual support. (Id.). USV Defendants assert that Plaintiffs’ primary basis for their alter ego theory—a single employee allegedly working for both entities—is insufficient to pierce the corporate veil. (Id.). It maintains that corporate separateness should be preserved absent compelling evidence of misuse, and that issues of veil piercing are generally reserved for the factfinder unless the record is devoid of facts supporting such a claim, which they claim is the case here. (Id.). In turn, Plaintiffs assert that USV, through its control over Nationwide, collected their PII and PHI and was directly involved in the provision of medical services. (Pls.’ Br., ECF No. 82 at 9). They contend that USV exercised pervasive control over Nationwide’s operations, including its interactions with patients, and that Nationwide functioned as USV’s alter ego or, at the very least, its agent until the time of its sale in 2019. (Id.). The Court agrees with USV—Plaintiffs fail to allege sufficient facts to state a claim against 5 USV under an alter ego legal theory and, therefore, without a direct relationship between Plaintiffs and USV, Plaintiffs’ claims for breach of fiduciary duty, breach of implied contract, and unjust enrichment necessarily fail as well. i. Alter Ego
The purpose of alter ego liability and piercing the corporate veil “is to prevent an independent corporation from being used to defeat the ends of justice, to perpetrate fraud, to accomplish a crime, or otherwise to evade the law . . . .” Bd. of Trustees of Teamsters Loc. 863 Pension Fund v. Foodtown, Inc., 296 F.3d 164, 171–72 (3d Cir. 2002) (quoting State Dep’t of Envtl. Protect. v. Ventron Corp., 468 A.2d 150, 164 (N.J. 1983) (internal citations omitted). Indeed, piercing the corporate veil is a “remedy that is involved when [a subservient] corporation is acting as an alter ego of [a dominant corporation.]” Id. (internal citation and quotation marks omitted). To state a claim for piercing the corporate veil under New Jersey law, a plaintiff must show: “(1) one corporation is organized and operated as to make it a mere instrumentality of another
corporation, and (2) the dominant corporation is using the subservient corporation to perpetrate fraud, to accomplish injustice, or to circumvent the law.” Id. (citation omitted). Courts evaluate the following factors in deciding whether to pierce the corporate veil: gross undercapitalization . . . failure to observe corporate formalities, non-payment of dividends, the insolvency of the debtor corporation at the time, siphoning of funds of the corporation by the dominant stockholder, non-functioning of other officers or directors, absence of corporate records, and the fact that the corporation is merely a facade for the operations of the dominant stockholder or stockholders.
Id. (citing Craig v. Lake Asbestos of Quebec, Ltd., 843 F.2d 145, 149 (3d Cir. 1988)). To be sure, a plaintiff must make more than “bare-boned allegations of undercapitalization and common control and/or management” to state an alter ego claim. Holzli v. Deluca Enters., No. 6 11-6148, 2012 WL 983693, at *2–3 (D.N.J. Mar. 21, 2012) (quoting Wrist Worldwide Trading GMBH v. MV Auto Banner, No. 10–2326, 2011 WL 5414307, at *5–6 (D.N.J. Nov. 4, 2011)). The issue of piercing the corporate veil is typically a juhry question unless the complaint is wholly devoid of evidence to justify disregarding the corporate form. See In re G-I Holdings, Inc., 380 F.
Supp. 2d 469, 477–78 (D.N.J. 2005). Here, Plaintiffs assert that Nationwide was a wholly owned subsidiary of USV, that both companies shared the same financial director until Nationwide’s sale in 2019, and that Nationwide’s patient data was stored on a shared computer network controlled by USV. (SAC, ECF No. 79 at ¶¶ 54–56, 59). Plaintiffs argue that these allegations, if proven, could support a finding that Nationwide lacked meaningful corporate independence and functioned as an extension of USV. (Pls.’ Br., ECF No. 82 at 10–11). Plaintiffs contend that at this procedural stage they have sufficiently alleged facts that, if accepted as true, plausibly support that USV exercised dominion over Nationwide to such an extent to maintain an alter ego theory of liability. (Id.). While the Teamsters factors “are non-binding and need not all be satisfied to succeed on
an alter ego claim,” Wrist Worldwide Trading GMBH, 2011 WL 5414307, at *5, Plaintiffs, here, have merely alleged bare-boned allegations of common control for their alter ego theory, without any supporting facts, which do not rise to the level of plausibility required to survive a 12(b)(6) motion. To be sure, lacking such facts, Plaintiffs’ Complaint essentially presumes the legal conclusion that Nationwide is the alter ego of USV and fails to provide sufficient factual allegations for any of the factors that the Third Circuit has identified in analyzing whether a subsidiary is an alter ego of the parent corporation. Here, at most, and prior to the sale in 2019 and nearly two years prior to the data breach, Plaintiffs merely plead one shared common officer and a shared computer system between USV
7 and Nationwide. After the sale in 2019, and at the relevant time of the data breach in 2021, Plaintiffs merely allege USV continued to store their PII/PHI. These facts are nowhere near enough to suggest that USV dominated Nationwide. Indeed, there are no facts alleged whatsoever regarding Nationwide’s gross undercapitalization, failure to observe corporate formalities, non-
payment of dividends, or any of the other factors considered in deciding whether a subsidiary is an alter ego of the parent corporation. As this Court has explained when a “Plaintiff do[es] not allege that [Company A] was grossly undercapitalized, failed to observe corporate formalities, had non-functioning directors, or that it commingled funds with [Company B],” they “fail[ ] to allege sufficient facts outlined by the Third Circuit to support an alter ego claim.” Wrist Worldwide Trading GMBH v. MV Auto Banner, No. 10-2326, 2011 WL 1321794, at *6 (D.N.J. Mar. 30, 2011); see also Richmond v. Lumisol Elec. Ltd., No. 13-1944, 2014 WL 1405159, at *4 (D.N.J. Apr. 10, 2014) (quoting Holzli v. DeLuca Enters., No. 11-06148, 2012 WL 983693, at *3 (D.N.J. Mar. 21, 2012) (dismissing claims that were “strikingly different from cases in which the claim for corporate veil piercing was properly plead[ed] because the claim was ‘supported by factual
allegations illustrating why or how the defendants, for example, failed to observe corporate formalities and commingled funds’”). Indeed, this Court has previously found that alleging partial common ownership and potentially intertwined business operations, like Plaintiffs have do so here, is insufficient to state a claim under an alter ego theory under Third Circuit precedent. See Benjamin Moore & Co. v. B.M. Mediterranean S.A., No. 21-04328, 2023 WL 7110582, at *4 (D.N.J. Oct. 27, 2023) (“Though Plaintiff’s amended complaint alleges partial common ownership and potentially intertwined business operations, such allegations, without more, are insufficient to proceed on an alter ego theory under Third Circuit precedent.”); see also Mills v. Ethicon, Inc., 406 F. Supp. 3d 363, 395 (D.N.J. 2019) (finding alter ego theory not established despite the parent
8 and subsidiary sharing the same “brand”); Horowitz v. AT&T Inc., No. 17-4827, 2018 WL 1942525, at *9 (D.N.J. Apr. 25, 2018) (explaining the Court may not “extend the alter ego doctrine, such that entities utilizing the same brand, website, and policies would be imputed as alter egos,” without also showing that the subsidiaries “ignored corporate formalities in day-to-day activities”
or any of the other relevant factors). Moreover, Plaintiffs rely on distinguishable case law. First, in arguing that USV is liable, Plaintiffs rely on a labor case discussing direct liability, which not only is “rarely used independently to hold parents liable for their subsidiary’s actions,” but still requires a showing that the parent corporation has “interfered with the subsidiary’s operations in a way that surpasses the control exercised by a parent as an incident of ownership,” which Plaintiffs have not shown here in any way. See Pearson v. Component Tech. Corp., 247 F.3d 471, 486–87 (3d Cir. 2001). Additionally, this Court’s decision in Parkin v. Avis Rent a Car Sys. LLC, No. 22-05481, 2023 WL 4045049, at *3 (D.N.J. June 16, 2023), is distinguishable for two primary reasons. First, Parkin dealt with agency liability—not an alter ego theory—and direct corporate liability. And as
to direct corporate liability, the factual allegations in the complaint in Parkin were vastly different than those pled by Plaintiffs here. In Parkin, this Court found the allegations sufficient to survive a motion to dismiss because the Complaint pled “a complicated and intertwined relationship between Defendants,” specifically that “[ABG] directed and controlled the daily activities of Avis and Budget and totally dominated [them],” the defendants “share[d] the same operational and administrative infrastructure,” acted “in concert with each other,” and “were integrated and each actively participated in the business practices about which [the] [p]laintiffs complain.” Parkin, 2023 WL 4045049, at *3. While acknowledging the case was a close call, the Court noted that the specificity of the integrated conduct among the corporations was specific to the fraudulent conduct
9 underlying the plaintiffs’ claims. Plaintiffs’ allegations here rise nowhere near this showing of an intertwined relationship and certainly nothing that relates to the activities related to the data breach or the specific underlying claims. In short, Plaintiffs merely state conclusively in their opposition that “the facts alleged make
it more than plausible that Nationwide operated as USV’s alter ego, or at the very least its agent, in its dealings with patients like Plaintiffs until the time of its sale in 2019.” (Pls.’ Br., ECF No. 82 at 9). Yet, Plaintiffs’ Complaint is devoid of any allegations of agency liability. Moreover, neither party briefed agency liability as a basis for liability to be imposed upon USV. And critically, Plaintiffs’ Complaint provides no factual support to suggest agency liability other than the same general allegations which support their direct corporate liability and alter ego theories. Nevertheless, the factual allegations pled here do not rise to the level which this Court found sufficient to plead agency liability in Parkin. Again, there, the Complaint pled “a complicated and intertwined relationship between [the] [d]efendants, specifically alleging they were integrated and each actively participated in the business practices about which [the]
[p]laintiffs complain.” Parkin, 2023 WL 404504, at *4 (internal quotation marks and citation omitted). And even in Parkin, this Court noted that it was “aware of other cases in which agency claims were dismissed for failure to explain the effect of the alleged inter-related relationship as to the contractual transaction at issue in the case,” but permitted the case to continue because the plaintiffs had pled enough facts to warrant discovery. Id. at *4 n.7. Plaintiffs thus fail yet again to establish a direct relationship between themselves and USV, which was the precise reason this Court previously dismissed Counts V (Breach of Fiduciary Duty), VII (Breach of Implied Contract), and Count X (Unjust Enrichment), because as the Court previously explained at length, see (ECF No. 71 at 4–10), and incorporates here by reference, these
10 three counts all require a direct relationship between the parties. As such, Counts V, VII, and X are dismissed with prejudice as this is now the third iteration of the Complaint. Indeed, where a “plaintiff had already amended plaintiff’s complaint and yet failed to allege sufficient facts, the courts may find that ‘[t]hree bites at the apple is enough,’ and conclude that it is proper to deny
leave to replead.” In re Intelligroup Sec. Litig., 527 F. Supp. 2d 262, 379 (D.N.J. 2007) (citing Salinger v. Projectavision, Inc., 972 F. Supp. 222, 236 (S.D.N.Y. 1997)). B. Breach of Contract Under New Jersey law,1 “[t]o determine whether a person qualifies as a third-party beneficiary, the test is whether the contracting parties intended that a third party should receive a benefit which might be enforced in the courts.” Werrmann v. Aratusa, Ltd., 630 A.2d 302, 305 (N.J. App. Div. 1993) (quoting Rieder Communities, Inc. v. North Brunswick Tp., 546 A.2d 563, 566 (N.J. 1988)) (internal quotations omitted). “The contractual intent to recognize a right to performance in the third person is the key. If that intent does not exist, then the third person is only an incidental beneficiary, having no contractual standing.” Broadway Maintenance Corp. v.
Rutgers, State University, 447 A.2d 906, 909 (N.J. 1982) (citing Restatement (Second) of Contracts § 302 (1979)). Though Plaintiffs allege that there was a contract between USV and Nationwide to provide data storage and data security services for Nationwide, the contract is not attached to the Complaint nor was it provided by USV. (Am. Compl., ECF No. 79 at ¶ 193). And while Plaintiffs claim that they were the intended third-party beneficiaries of the contract, and are therefore entitled to enforce the contract, this is another entirely conclusory allegation. Indeed, where a plaintiff has not
1 The Court applies New Jersey law as the parties have agreed that New Jersey law applies. (ECF No. 77).
11 provided any supporting facts “other than his conclusory allegation that he is an intended third- party beneficiary,” their third-party beneficiary claim should be dismissed. Atlas Communications Tech., Inc. v. DXC Tech. Servs., No. 19-19033, 2020 WL 5105197, at *3 (D.N.J. Aug. 31, 2020) (dismissing plaintiff’s third-party beneficiary claim where plaintiff’s allegations of third-party
beneficiary status were conclusory). Here, Plaintiffs fail to set forth any facts to support their conclusory allegations that USV and Nationwide entered into a contract with the intention to benefit Plaintiffs and intended to provide Plaintiffs with a right they could enforce. As USV argues, here Plaintiffs’ allegations support an argument that the Court should conclude as a matter of law that they should be third-party beneficiaries versus an explicit intention by USV and Nationwide for Plaintiffs to in fact be third-party beneficiaries. And in New Jersey, the contracting parties must expressly state as much in the contract. See Marina Group LLC. v. Shirley May International, No. 21-18733, 2022 WL 17622679, *5 (D.N.J. Dec. 13, 2022); see also Broadway Maintenance Corp. v. Rutgers, State Univ., 447 A.2d 906, 915 (N.J. 1989) (“[A] third party beneficiary may sue on a contract when it is an intended and not an incidental beneficiary.”).
However, the Court acknowledges that without the parties’ agreement, it is difficult to fully evaluate the intent of the parties. See Doe v. Boys & Girls Club of Clifton, No. 20-03008, 2021 WL 3400862, at *4 (D.N.J. Aug. 4, 2021) (denying motion to dismiss on breach of claim because the parties failed to provide the agreement). It is unclear to the Court why neither party submitted the contract related to this Motion as it seems important, if not determinative, of Plaintiffs’ breach
12 of contract claim.2 As such, the Court dismisses Count IX without prejudice, though with hesitation and caution to Plaintiffs to meet and confer before attempting to proceed further on this claim unless it can, in good faith, allege sufficient factual allegations to show that Plaintiffs were actually intended to be third-party beneficiaries to the agreement between USV and Nationwide.
(Defs.’ Reply Br., ECF No. 83 at 14). C. Consumer Fraud Act Claims i. Arizona “Under the ACFA, it is unlawful for any person to use or employ ‘any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise.’” James Erickson Fam. P’ship LLLP v. Transamerica Life Ins. Co., No. 18-4566, 2019 WL 1755858, at *4 (D. Ariz. Apr. 19, 2019) (quoting A.R.S. § 44-1522(A)). To state a claim, Plaintiffs must show “(1) a false promise or misrepresentation made in connection with the sale or advertisement of
‘merchandise,’ and (2) consequent and proximate injury resulting from the misrepresentation.” Id. (quoting Watts v. Medicis Pharm. Corp., 365 P.3d 944, 953 (Ariz. 2016)). In their Complaint, Plaintiffs allege that the USV Defendants “themselves and through their alter egos, represented publicly that they were committed to privacy and the security of personal and confidential data that they collected and stored.” (SAC, ECF No. 79 at ¶ 229).
2 “To decide a motion to dismiss, courts generally consider only the allegations contained in the complaint, exhibits attached to the complaint and matters of public record.” Pension Benefit Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993). Moreover, “document[s] integral to or explicitly relied upon in the complaint may be considered without converting the motion to dismiss into one for summary judgment.” Schmidt v. Skolas, 770 F.3d 241, 249 (3d Cir. 2014) (internal quotation marks and citation omitted).
13 Plaintiffs also allege that USV failed to implement and maintain reasonable security measures to protect and secure their PII/PHI. (Id. at ¶ 230). However, Plaintiffs also allege that USV’s privacy policy states that it applies “technical, administrative and organizational security to protect the data [it] collect[s]. . . .” (Id. at ¶ 57). Thus, not only does the policy not make any specific
representations about the data it stores but Plaintiffs have now unequivocally alleged that they were patients of Nationwide. (Id. at ¶¶ 10, 22, 31). Plaintiffs do not allege that they relied on USV’s privacy policy, or were even aware of it, before providing their information to Nationwide so there is no factual or causal link between Plaintiffs’ providing their information to Nationwide and any alleged unfair practice from USV. See e.g., Quinalty v. FocusIT LLC, No. 23-0207, 2024 WL 342454, at *6 (D. Ariz. Jan. 30, 2024) (dismissing ACFA claim because “Plaintiffs . . . fail to allege any facts indicating they were aware of Defendant’s contracts, website, privacy policy, or advertising at the time they provided their PII to Defendant’s clients.”); Stratton v. Am. Med. Sec., Inc., 266 F.R.D. 340, 349 (D. Ariz. 2009) (“[T]he overwhelming authority in Arizona specifically requires proof of actual reliance.”).
And as USV notes, (Def. Br., ECF No. 83 at 8–9), the cases Plaintiffs rely on all involved parties with some relationship or at least where the plaintiffs were consumers of the defendants’ companies, whereas here, Plaintiffs were patients of Nationwide and there is no indication that they were even aware of USV’s relationship with Nationwide, let alone reviewed and relied on USV’s privacy policy and practices before providing their information to Nationwide. As such, Plaintiffs fail to sufficiently plead a claim under the ACFA and USV Defendants’ Motion to Dismiss Count XII must be granted. ii. New Jersey To state a cause of action under the NJCFA, a plaintiff must show “1) unlawful conduct by
14 defendant; 2) an ascertainable loss by plaintiff; and 3) a causal relationship between the unlawful conduct and the ascertainable loss.” Bosland v. Warnock Dodge, Inc., 964 A.2d 741, 749 (N.J. 2009) (citing Int’l Union of Operating Eng’rs Loc. No. 68 Welfare Fund v. Merck & Co., Inc., 929 A.2d 1076, 1086 (N.J. 2007)). The NJCFA requires the “unlawful conduct to be (1) ‘in connection’
with the sale or advertisement of a product or service, and (2) ‘misleading and . . . outside the norm of reasonable business practice in that it will victimize the average consumer.’” In re Am. Fin. Res., Inc. Data Breach Litig., No. 22-1757, 2023 WL 3963804, at *10 (D.N.J. Mar. 29, 2023) (internal citation omitted) (quoting Katz v. Ambit Ne. LLC, No. 20-1289, 2021 WL 2680184, at *8 (D.N.J. June 29, 2021)). “Unlawful practices fall into three general categories: affirmative acts, knowing omissions, and regulation violations.” Penn, LLC v. Freestyle Software Inc., No. 22- 6760, 2023 WL 5994642, at *8 (D.N.J. Sept. 15, 2023) (quoting Frederico v. Home Depot, 507 F.3d 188, 202 (3d Cir. 2007)). Therefore, “[t]o state a claim under the NJCFA, a plaintiff must allege that the defendant engaged in an unlawful practice that caused an ascertainable loss to the plaintiff.” Frederico, 507 F.3d at 202.
Plaintiffs now claim that their NJCFA claim is not based on fraud but rather unconscionable acts. Unconscionable commercial practices are categorized as “affirmative acts” under the NJCFA, and therefore “do not require a showing of ‘intent to deceive’ or ‘knowledge of the falsity of the representation.’” Katz v. Live Nation, Inc., No. 09-3740, 2010 WL 2539686, at *5 (D.N.J. June 17, 2010) (quoting Busse v. Homebank LLC, No. 07–3495, 2009 WL 424278, at *9 (D.N.J. Feb.18, 2009)). Yet, the NJCFA “does not define ‘unconscionable commercial practice.’” Ciser v. Nestle Waters N. Am., Inc., 596 F. App’x 157, 160 (3d Cir. 2015). Indeed, “[t]here is no precise formulation for an ‘unconscionable’ act [under the NJCFA] that satisfies the statutory standard for an unlawful practice.” D’gostino v. Maldonado, 78 A.3d 527, 537 (N.J.
15 2013). However, “[t]hough an unconscionable commercial practice ‘is an amorphous concept obviously designed to establish a broad business ethic,’ the term is not without limits” and “[t]he standard of conduct that the term ‘unconscionable’ implies is lack of ‘good faith, honesty in fact and observance of fair dealing.’” Ciser, 596 F. App’x at 161 (quoting Cox v. Sears Roebuck &
Co., 647 A.2d 454, 462 (N.J. 1994)). “Most importantly, the New Jersey Supreme Court has instructed that ‘[t]he capacity to mislead is the prime ingredient of all types of consumer fraud.’” Id. (quoting Fenwick v. Kay Am. Jeep, Inc., 371 A.2d 13 (N.J. 1977)). Although, whether conduct is unfair for purposes of the NJCFA is typically a question for the jury, Slack v. Suburban Propane Partners, L.P., No. 10-02548, 2010 WL 3810870, at *5 (D.N.J. Sept. 21, 2010), here, critically, Plaintiffs fail to even allege that they were consumers of USV. See Conte Bros. Auto., Inc. v. Quaker State-Slick 50, Inc., 992 F. Supp. 709, 716 (D.N.J. 1998), aff’d, 165 F.3d 221 (3d Cir. 1998) (holding that “[i]t is well-settled law that one must be a ‘consumer’ in order to sue under [the NJCFA]”). Though Plaintiffs’ claim in conclusory fashion to have received “merchandise” from USV, without definition thereof, (Am. Compl., ECF No. 79
at ¶ 252), they also explicitly state that they were the patients/customers of Nationwide only, not patients of USV. See (Am. Compl., ECF No. 79 at ¶¶ 10, 22, and 31). Indeed, Plaintiffs do not even allege that they had any relationship, contact, or even awareness of USV Defendants’ involvement with Nationwide before they gave their PII/PHI to Nationwide. See In re American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, No. 19-2904, 2021 WL 5937742, at *24 (D.N.J. Dec. 16, 2021). Without these critical facts, it is unclear what practices USV Defendants engaged in which mislead Plaintiffs when they provided their information to Nationwide. See Robinson v. Maintech Inc., No. 23-04458, 2024 WL 5165325, at *5 (D.N.J. Dec. 19, 2024) (internal quotation marks and citations omitted) (dismissing a NJCFA
16 with prejudice, albeit a fraud-based claim, because “[o]nce again, the Amended Complaint specifies that the people affected by the data breach did not have a relationship with Maintech” and thus the plaintiff “did not purchase a product or service from Defendant in the popular sense”). Putting aside this threshold deficiency, Plaintiffs also do not allege what commercial practices are
“unconscionable.” Accordingly, the New Jersey Consumer Fraud Act claims must be dismissed. And again, as this is the third iteration of the Complaint, Count XIV is dismissed with prejudice. D. Negligence and Negligence Per Se In New Jersey law, to assert a claim for negligence, a plaintiff must demonstrate four elements: “(1) a duty of care, (2) that [the defendant] breached that duty, (3) that such breach proximately caused harm, and (4) that [the plaintiff] suffered actual damages.” Lax v. City of Atl. City, No. 19-7036, 2019 WL 7207472, at *4 (D.N.J. Dec. 27, 2019). Indeed, a negligence claim requires a plaintiff to establish that a duty was owed to them. Pine Belt Enterprises, Inc. v. SC & E Admin. Servs., Inc., No. 04-105, 2005 WL 2469672, at *6 (D.N.J. Oct. 6, 2005) (internal
quotation marks and citation omitted) (“Before a party may be held liable for breach of an obligation, it must first be established that the party in fact owed a duty to act in a certain manner.”). “[A] duty is an obligation imposed by law requiring one party to conform to a particular standard of conduct toward another.” Rezem Fam. Assocs., LP v. Borough of Millstone, 30 A.3d 1061, 1071 (N.J. Super. Ct. App. Div. 2011) (quoting Acuna v. Turkish, 930 A.2d 416 (N.J. 2007)). And to be sure, “[i]t is axiomatic that a defendant has a duty to protect a plaintiff against foreseeable harm.” In re Am. Med. Collection Agency, Inc., 2021 WL 5937742, at *14. The determination of whether a duty exists is generally a matter for the Court. Id. “‘The foreseeability of harm is a significant consideration in the determination of a duty to exercise
17 reasonable care,’ and while it does not establish a duty in and of itself, ‘it is a crucial element in determining whether imposition of a duty on an alleged tortfeasor is appropriate.’” Adkins v. Everest Glob. Servs., Inc., No. 23-004, 2024 WL 3887127, at *8–10 (D.N.J. Aug. 21, 2024) (quoting Carvalho v. Toll Bros. & Devs., 675 A.2d 209, 212 (N.J. 1996)).
“Once a party satisfies foreseeability, the Court turns to ‘considerations of fairness and policy,’ including ‘identifying, weighing, and balancing several factors—the relationship of the parties, the nature of the attendant risk, the opportunity and ability to exercise care, and the public interest in the proposed solution.’” Id. (quoting Zielinski v. Pro. Appraisal Assocs., 740 A.2d 1131, 1135 (N.J. Super. Ct. App. Div. 1999)); see also New Jersey Dep’t of Env’t Prot. v. E.I. du Pont de Nemours & Co., No. 19-14766, 2021 WL 6144081, at *7 (D.N.J. Dec. 30, 2021) (noting that New Jersey law requires courts to consider the “relationship of the parties” in determining whether it is fair to find the existence of a duty). Like the Court found in Adkins, absent from the Second Amended Complaint is any relationship between Plaintiffs and USV Defendants, particularly given this Court’s determination
herein on Plaintiffs’ alter ego theory of liability. Indeed, Plaintiffs now unequivocally state that they were patients of Nationwide, who then in turn provided the PII/PHI to USV for storage. There are no facts that suggest Plaintiffs even knew that USV would be storing Plaintiffs’ information or that it was a consideration of Plaintiffs before they provided their PII/PHI to Nationwide. And, like the Court noted in Adkins, “‘the relationship of the parties’ is a factor ‘relevant to the existence of a duty under New Jersey law’” and here, it is apparent there was no relationship between Plaintiffs and the USV Defendants. See 2024 WL 3887127, at *9 (quoting Willekes v. Serengeti Trading Co., No. 13-7498, 2016 WL 5334522, at *16 (D.N.J. Sept. 22, 2016)); see also Willekes, 2016 WL 5334522, at *17 (dismissing claim where the plaintiff failed to “allege a
18 relationship that would give rise to a duty owed them”); S. Broward Hosp. Dist. v. MedQuist Inc., 516 F. Supp. 2d 370, 398 n.17 (D.N.J.), aff’d in part, 258 F. App’x 466 (3d Cir. 2007) (noting that the plaintiff is required to “plead facts to support the existence of [ ] a relationship” in order for the court to determine whether a duty arises out of same); see also Tersco, Inc. v. E.I. DuPont de
Nemours & Co., 879 F. Supp. 445, 449 (E.D. Pa. 1992) (dismissing claim where the plaintiff’s complaint failed to explain the relationships which gave rise to the alleged claims). Plaintiffs’ reliance on In re American Medical Collection Agency, Inc. Customer Data Security Breach Litigation is unavailing. There, the Court held that the defendants who had actually collected the information and then had given it to a third-party for storage owed the plaintiffs a duty, stating “[o]nce Defendants collected Plaintiffs’ information, they had a duty to protect Plaintiffs from foreseeable harm by taking reasonable precautions to safeguard that information.” 2021 WL 5937742, at *14. However, this case presents the opposite circumstances than those In re American Medical Collection Agency, Inc. Customer Data Security Breach Litigation. There, the third-party entity that stored the data—American Medical Collection
Agency—was not a defendant. Conversely, it was solely the parties who had collected the data, and in turn provided it to AMCA, that were defendants and who the Court held owed a duty which arose when these defendants collected the plaintiffs’ PII/PHI. Here, USV was the storing entity and there is no relationship between the parties on which the Court can find that USV Defendants owed Plaintiffs a duty. Finally, turning to Plaintiffs’ negligence per se claim, USV Defendants’ argument relying on standing cases is unavailing because given the sensitive nature of the information obtained, the intentional cyberattack, and the fact that at least one Plaintiff alleged fraudulent charges following the breach, there does appear to be sufficient allegations of cognizable damages at least at this
19 stage. Given that nearly four years have passed since the data breach, more factual allegations of actual harm are expected. However, more problematic are Plaintiffs’ bases for their negligence per se claim on violations of the Health Information Portability and Accountability Act (“HIPPA”) and the Federal Trade Commission Act (“FTCA”). (Am. Compl., ECF No. 79 at ¶¶ 134–139).
Courts have held that HIPPA does not provide a private right of action to remedy HIPPA violations. See Polanco v. Omnicell, Inc., 988 F. Supp. 2d 451, 468–69 (D.N.J. 2013); see also See Mebuin v. United States, Nos. 12–7220, 13–0446, 2013 WL 5411145, at *9 (D.N.J. Sept. 25, 2013) (observing that “[a]lthough the Court of Appeals for the Third Circuit has not addressed the question, every other federal Circuit Court to consider the matter has found that HIPAA provides neither an express nor an implied private right of action to an aggrieved patient” with regard to the disclosure of confidential medical information). Indeed, “the ability to bring an enforcement action to remedy HIPAA violations, and ensure that a healthcare provider is HIPAA complaint, lies within the exclusive province of the Secretary of Health and Human Services, not the hands of private citizens.” Id. (citation omitted).
And, as the USV Defendants note, a recent decision by the Arizona District Court is instructive and explained that HIPPA and the FTC have enforcement mechanisms that were not intended to provide a privacy right of action and as such, dismissed the plaintiffs’ negligence per se claims. See Gannon v. Truly Nolen of Am. Inc., No. 22-428, 2023 WL 6536477, at *2 (D. Ariz. Aug. 31, 2023); see also Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1080 (9th Cir. 2016) (explaining HIPPA does not provide for a private cause of action); Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) (“[e]very district court that has considered this issue is in agreement that the [HIPAA] statute does not support a private right of action.”). As such, Plaintiffs’ negligence and negligence per se claims must also be dismissed with
20 prejudice. CONCLUSION For the foregoing reasons, Defendants’ Motion to Dismiss (ECF No. 80) is GRANTED. All of Plaintiffs’ claims, aside from the breach of contract claim which is dismissed without prejudice, are dismissed with prejudice. An appropriate Order accompanies this Opinion.
Critne Other CHRISTINE P. O’HEARN United States District Judge