Webb v. Injured Workers Pharmacy, LLC

• Court: District Court, D. Massachusetts
• Decided: October 17, 2022
• Docket: 1:22-cv-10797
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

CIVIL ACTION NO. 22-10797-RGS

ALEXSIS WEBB and MARSCLETTE CHARLEY, and ALL OTHERS SIMILARLY SITUATED

v.

INJURED WORKERS PHARMACY, LLC

MEMORANDUM AND ORDER ON DEFENDANT’S MOTION TO DISMISS

October 17, 2022 STEARNS, D.J. Plaintiffs Alexsis Webb and Marsclette Charley filed this putative class action1 against defendant Injured Workers Pharmacy (IWP) for alleged injuries arising out of a data breach that compromised the personally identifiable information (PII) of over 75,700 customers. IWP moves to dismiss all claims for lack of subject-matter jurisdiction under Fed. R. Civ. P. 12(b)(1), and for failure to state a claim upon which relief can be granted pursuant to Rule 12(b)(6). For the reasons below, the court will ALLOW the motion.

1 Plaintiffs’ Complaint consists of six counts: negligence (Count I); negligence per se (Count II); breach of implied contract (Count III); unjust enrichment (Count IV); invasion of privacy (Count V); and breach of fiduciary duty (Count VI). BACKGROUND

In May of 2021, IWP, a pharmaceutical home delivery service discovered a data breach occurring earlier in January of sensitive personal records in its custody. IWP did not begin notifying affected customers until February of 2022. The breached data consisted of PII including customers’

names and Social Security numbers. The data of both named plaintiffs Webb and Charley, a current and former IWP customer respectively, were compromised by the breach. Following the breach, Webb and Charley allege

they experienced “anxiety, sleep disruption, stress, and fear” (with Charley adding rage, anger, and physical pain) and were forced to spend “considerable time and effort” monitoring their accounts. Compl. ¶¶ 86, 97. Webb also alleges that she spent hours dealing with the IRS with regard to a

2021 tax return made by an unauthorized third party. Both plaintiffs allege they suffered actual injury in the form of “damages to and diminution in the value of [their] PII” which they estimate to be worth at least $1,000.00 on the dark web. See id. ¶¶ 57-58, 91, 99.

DISCUSSION IWP moves to dismiss under Rules 12(b)(1) and 12(b)(6). “When faced with motions to dismiss under both 12(b)(1) and 12(b)(6), a district court, absent good reason to do otherwise, should ordinarily decide the 12(b)(1) motion first.”2 Ne. Erectors Ass’n of the BTEA v. Sec’y of Lab., 62 F.3d 37,

39 (1st Cir. 1995). “The party invoking the jurisdiction of a federal court carries the burden of proving its existence.” Murphy v. United States, 45 F.3d 520, 522 (1st Cir. 1995), quoting Taber Partners, I v. Merit Builders, Inc., 987 F.2d 57, 60 (1st Cir. 1993). In assessing whether that burden is met,

a court “take[s] as true all well-pleaded facts in the plaintiffs’ complaint[], scrutinize[s] them in the light most hospitable to the plaintiffs’ theory of liability, and draw[s] all reasonable inferences therefrom in the plaintiffs’

favor.” Fothergill v. United States, 566 F.3d 248, 251 (1st Cir. 2009). I. Article III Standing Article III of the Constitution “limits the judicial power of the federal courts to actual cases and controversies.” Katz v. Pershing, LLC, 672 F.3d

64, 71 (1st Cir. 2012), citing U.S. Const. art. III. § 2. To establish that a case or controversy exists, the party asserting federal jurisdiction must demonstrate “such a personal stake in the outcome . . . as to assure that concrete adverseness which sharpens the presentation of issues upon which

the court so largely depends.” Id., quoting Baker v. Carr, 369 U.S. 186, 204

2 Because the case will be dismissed under Rule 12(b)(1), the court does not consider the counts under Rule 12(b)(6). (1962). In demonstrating Article III standing, plaintiff bears the burden of establishing that (1) it has suffered an injury-in-fact; (2) the injury is fairly

traceable to the challenged action; and (3) it is likely and beyond mere speculation that the injury will be “redressed by a favorable decision.” Lujan v. Defs. of Wildlife, 504. U.S. 555, 560-561 (1992). a. Injury in Fact

An “injury in fact” must be (1) concrete and particularized; and (2) actual or imminent. Id. In other words, the plaintiff must have personally suffered some identifiable harm that has either happened or is likely to occur.

See Katz, 672 F.3d at 71. In a suit for damages, the mere risk of future harm, without more, cannot establish Article III standing. See TransUnion LLC v. Ramirez, 141 S.Ct 2190, 2211 (2021); Maine People’s All. & Nat. Res. Def. Council v. Mallinckrodt, Inc., 471 F.3d 277, 284 (1st Cir. 2006) (“To establish

an injury in fact based on a probabilistic harm, a plaintiff must show that there is a substantial probability that harm will occur.”).3

3 The court in Maine People’s Alliance found plaintiffs had established a probabilistic injury, reasoning “the presence of a great deal of smoke justified looking for a fire.” 471 F.3d at 285. While the likelihood of mercury flowing downriver from defendant’s plant generated plenty of smoke in Maine People’s Alliance, there are clear skies in this case. The Complaint does not sufficiently allege that the breach caused any identifiable harm. It is only alleged that Webb and Charley spent

“considerable time and effort” monitoring their accounts and, in Webb’s case, dealing with the IRS.4 Plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on . . . hypothetical future harm.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). The Complaint

alleges neither monetary loss,5 the misuse of data, nor that a third party stole their PII. Plaintiffs’ alleged injuries rest entirely on the future possibility that an unauthorized third party will, at some undetermined time, misuse their

PII. Based on the facts of the Complaint, this potential harm is not sufficiently threatening to establish an “injury in fact.” Katz, 672 F3.d at 71.

4 There is no allegation of a plausible connection between the data breach and the filing of the return, only conjecture that a connection may exist. Further, while fraudulent tax returns did establish standing in Portier v. NEO Technology Solutions, 2019 WL 7946103, at *5 (D. Mass. Dec. 31, 2019), those fraudulent actions delayed the legitimate returns. No such impact is alleged in this case, and even if it were, the Complaint does not fairly trace the activity to the breach. Lujan, 504 U.S. at 60-61.

5 It is unclear how the alleged loss of their PII’s black market value injures Webb and Charley. See In re Sci. Applications Int’l Corp, (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 30 (D.D.C. 2014) (noting that an injury claim would fail even if plaintiffs themselves intended to sell their personal data on the black market). CONCLUSION Plaintiffs do not allege concrete and particularized injuries that are

actual or imminent. Therefore, this court lacks jurisdiction to hear this case and it should be dismissed under Rule 12(b)(1). ORDER For the foregoing reasons, the Motion to Dismiss is ALLOWED.