Woodard v. Boeing Employees Credit Union

Opinion

UNITED STATES DISTRICT COURT AT SEATTLE NOEL WOODARD, individually and on CASE NO. 2:23-cv-00033 behalf of all others similarly situated,

Plaintiff, ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT v. BECU’S MOTION TO DISMISS BOEING EMPLOYEES CREDIT UNION, KAYE-SMITH ENTERPRISES, INC., and DOES 1-100, inclusive,

Defendants.

Plaintiff Noel Woodard banked with Defendant Boeing Employees’ Credit Union (“BECU”). BECU shared her personally identifiable information with its printing vendor, Defendant Kaye-Smith Enterprises, Inc. A third-party hacked Kaye-Smith’s computer network in a data breach and gained access to Plaintiff’s and other BECU customers’ information. Plaintiff sued BECU and Kaye-Smith in this putative class action for breach of implied contract, violations of the Washington State Consumer Protection Act, and Unjust Enrichment. BECU filed this motion to dismiss, arguing that Plaintiff has failed to state a plausible claim for relief against BECU. Having reviewed the parties’ briefs and supporting material filed in support of and opposition to the motion, and the complaint, the Court GRANTS in part and DENIES in part BECU’s motion.

I. Background. The Court takes the following alleged facts from Plaintiff’s Complaint (Dkt. No. 1-1) and considers them true for purposes of ruling on the pending Motion to Dismiss. Defendant Boeing Employees’ Credit Union (“BECU”) is a Washington-based credit union. Dkt. No. 1-1 at 6. Defendant Kaye-Smith Enterprises is an Oregon-based company that provides printing services to BECU and other corporate clients. Id. at 12. BECU “acquired, collected, and stored” the personally identifiable information (“PII”) of its customers, and it provided this information to Kaye-Smith, which in turn stored the customers’ PII on its system. Id. at 12. At some point, cybercriminals breached Kaye-Smith’s computer network, accessing the

PII of BECU’s customers (the “Data Breach”). Id. at 3, 4. On June 6, 2022, BECU learned of the Data Breach and began notifying its customers the following month, including Plaintiff Noel Woodard. Id. at 3. When Plaintiff learned of the Data Breach, she began “verifying the legitimacy and impact of the Data Breach, exploring credit monitoring and identity theft insurance options, self-monitoring her accounts and seeking legal counsel regarding her options for remedying and/or mitigating the effects of the Data Breach.” Id. at 5. Plaintiff filed this putative class action against BECU and Kaye-Smith (together, “Defendants”), alleging Defendants failed to properly secure and safeguard Plaintiff and the Plaintiff Class’s PII. Id. at 2. Plaintiff alleges that she has suffered “damages to and diminution

in value of her PII,” “lost time, annoyance, interference,” “inconvenience,” “anxiety,” “increased risk of fraud, identity theft, and misuse,” as “a result of the Data Breach.” Id. at 5–6. Plaintiff previously sued BECU in August 2022 for the Data Breach, but she did not name Kaye-Smith as a defendant in the prior action. She voluntarily withdrew her lawsuit after BECU moved to dismiss her complaint. See Woodard v. Boeing Emps’. Credit Union Fin. Servs.

Inc., No. 2:22-cv-01093-RAJ (W.D. Wash.). I. Legal standard. A. Motion to dismiss standard. The Court will grant a motion to dismiss only if the complaint fails to allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citations omitted). The plausibility

standard is less than probability, “but it asks for more than a sheer possibility” that a defendant did something wrong. Id. (citations omitted). “Where a complaint pleads facts that are ‘merely consistent with’ a defendant’s liability, it “stops short of the line between possibility and plausibility of ‘entitlement to relief.’’” Id. (quoting Twombly, 550 U.S. at 557). In other words, a plaintiff must have pled “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Id. When considering a motion to dismiss, the Court accepts factual allegations pled in the complaint as true and construes them in the light most favorable to the plaintiff. Lund v. Cowan, 5 F.4th 964, 968 (9th Cir. 2021). But courts “do not assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064

(9th Cir. 2011) (citations omitted). Thus, “conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.” Id. (internal quotation marks omitted). B. Choice of law. “A federal court sitting in diversity ordinarily must follow the choice-of-law rules of the State in which it sits.” Atl. Marine Constr. Co. v. U.S. Dist. Ct., 571 U.S. 49, 65 (2013). “This

applies to actions brought under the Class Action Fairness Act [(“CAFA”), 28 U.S.C. § 1332(d)(2),] as well, since CAFA is based upon diversity jurisdiction.” Veridian Credit Union v. Eddie Bauer, LLC, 295 F. Supp. 3d 1140, 1149 (W.D. Wash. 2017) (citations omitted). Here, BECU asserts that the Court has jurisdiction under CAFA. Dkt. No. 1 at 1. Consequently, the Court follows Washington’s choice-of-law rules. Because there is no “conflict between the law of Washington and the law of another state,” the Court need not analyze this issue further and will apply Washington law to this dispute. Burnside v. Simpson Paper Co., 864 P.2d 937, 942 (Wash. 1994). II. Plaintiff has standing to sue.

As an initial matter, the Court has an “independent obligation to examine standing to determine” whether Plaintiff’s claims fall in line with the case or controversy requirement of Article III, Section 2 of the Constitution. Krottner v. Starbucks Corp., 628 F.3d 1139, 1141 (9th Cir. 2010). “The jurisdictional question of standing precedes, and does not require, analysis of the merits.” Equity Lifestyle Props., Inc. v. Cnty. of San Luis Obispo, 548 F.3d 1184, 1189 n. 10 (9th Cir. 2008). To establish Article III standing, Plaintiff must demonstrate “(i) that [s]he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2203 (2021) (citing Lujan v. Defs. of

Wildlife, 504 U.S. 555, 560–561 (1992)). Most standing challenges turn on the first requirement—the existence of an injury in fact—so the Court begins there. The Supreme Court recently revisited this subject in TransUnion, and held that “[t]o have Article III standing to sue in federal court, plaintiffs must

demonstrate, among other things, that they suffered a concrete harm. No concrete harm, no standing.” Id. at 2200. Concrete harms, such as physical harm and monetary harms, readily qualify as concrete injuries under Article III. Id. at 2204. But intangible harms can also be concrete when the injury bears a “close relationship to harm traditionally recognized as providing a basis for lawsuits in American courts.” Id. (quotations omitted). The Supreme Court described disclosure of private information and intrusion upon seclusion as examples of intangible harms that can also be concrete for standing purposes. Id. Importantly, within the context of this case, the Supreme Court held that “the mere risk of future harm, standing alone, cannot qualify as a concrete harm—at least unless the exposure to the risk of future harm itself

causes a separate concrete harm.” Id. at 2210–11. Here, Plaintiff alleges that she shared private, sensitive data with BECU, and that BECU failed to safeguard her information, which allowed malicious third parties to carry out the Data Breach. See generally Dkt. No. 1-1. The Court finds that Plaintiff’s asserted injuries flowing from these acts have a close historical and common-law analog since the theft and loss of control over PII is akin to traditional claims for invasions of privacy and intuition upon seclusion. See TransUnion, 141 S. Ct. 2204; see also Patel v. Facebook, Inc., 932 F.3d 1264, 1274 (9th Cir. 2019) (“Under the common law, an intrusion into privacy rights by itself makes a defendant subject to liability.”). Indeed, “numerous courts” since TransUnion, “including the Ninth Circuit, have found allegations concerning the interference with plaintiffs’ control over their personal

data to be sufficient for standing on account of their injury implicating an “invasion of the historically recognized right to privacy.” Leonard v. McMenamins, Inc., No. 2:22-CV-00094- BJR, 2022 WL 4017674, at *5 (W.D. Wash. Sept. 2, 2022) (collecting cases). Even without a historical analog tethering her claims to a concrete injury in fact, the

Court finds that Plaintiff has sufficiently pled the Data Breach caused “separate concrete harm” in the form of time expended investigating and mitigating the breach, as well as anxiety about the loss of privacy and what may happen with her data. Dkt. No. 1-1 at 5. As the Third Circuit explained, “if the plaintiff’s knowledge of the substantial risk of identity theft causes [her] to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has alleged a concrete injury.” Clemens v. ExecuPharm Inc., 48 F.4th 146, 156 (3d Cir. 2022); see also TransUnion, 141 S. Ct. at 2211 n.7 (“[A] plaintiff’s knowledge that he or she is exposed to a risk of future physical, monetary, or reputational harm could cause its own current emotional or psychological harm.”); Whittum v. Univ. Med. Ctr. of S.

Nevada, No. 2:21-CV-01777-MMD-EJY, 2023 WL 2967306, at *3 (D. Nev. Apr. 17, 2023) (“Because Plaintiffs undertook substantial mitigation and remedial measures to prevent fraud, incurred out-of-pocket expenses, and suffered emotional distress from the anticipation of fraud, the Court finds that Plaintiffs have alleged concrete, separate injuries for standing from the risk of future harm.”). Accordingly, Plaintiff has alleged a plausible injury in fact. Having found at least several of Plaintiff’s alleged harms to confer standing, the Court need not address the sufficiency of Plaintiff’s other alleged harms like the increased risk of fraud or identity theft, or the diminution in the value of Plaintiff’s PII. See Dkt. No. 1-1 at 5. Next, the Court considers whether Plaintiff’s injuries are “fairly traceable” to BECU’s

actions. A showing that an injury is fairly traceable requires less than a showing of “proximate cause.” Maya v. Centex Corp., 658 F.3d 1060, 1070 (9th Cir. 2011) (concluding that, for purposes of Article III standing, plaintiffs need not “demonstrate that defendants’ actions are the ‘proximate cause’ of plaintiffs’ injuries”). This step examines the chain of causation, but the chain does not fail simply because it contains several links or because the defendant’s actions are

not the last link in the chain. See Wash. Env’t Council v. Bellon, 732 F.3d 1131, 1142 (9th Cir. 2013). “Even a showing that a plaintiff’s injury is indirectly caused by a defendant's actions satisfies the fairly traceable requirement.” Resnick v. AvMed, Inc., 693 F.3d 1317, 1324 (11th Cir. 2012). Here, Plaintiff alleges BECU provided her PII to Kaye-Smith, who ultimately suffered the data breach. Thus, for purposes of the Court’s standing analysis, Plaintiff’s allegations demonstrate sufficiently that BECU’s actions are within the causal chain and therefore fairly traceable to her injuries. Concerning the last element of standing—whether Plaintiff’s alleged injuries are redressable by relief that could be obtained through this lawsuit—the Court finds that Plaintiff

has alleged sufficient facts demonstrating that her injuries could be compensated through monetary damages and injunctive relief. See Thole v. U.S. Bank N.A., 140 S. Ct. 1615, 1618 (2020). Accordingly, the final standing requirement is met. III. Plaintiff fails to state a plausible claim for relief on some of her claims. The fact that Plaintiff has standing to sue does not mean she has stated a plausible claim for relief against BECU. See Krottner, 406 F. App’x at 131 (“Article III standing does not establish that they adequately pled damages for purposes of their state-law claim.”). Indeed, establishing Article III standing means a Plaintiff has “[s]tanding to sue” but not necessarily “to succeed.” Doe v. Chao, 540 U.S. 614, 641 (2004).

Here, Plaintiff maintains three claims against BECU: breach of implied contract, violation of the CPA, and unjust enrichment.1 Plaintiff must allege enough to state a plausible claim for relief, but as explained below, she has not done so here for all of her claims. A. Plaintiff states a plausible CPA claim but just barely. The Washington CPA prohibits “[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce ….” RCW 19.86.020. To prevail on her CPA claim, Plaintiff must show: (1) an unfair or deceptive act (2) in trade or commerce (3) that affects the public interest, (4) injury to the plaintiff in his or her business or property, and (5) a causal link between the unfair or deceptive act complained of and the injury suffered. Trujillo v. Nw. Tr. Servs., Inc., 355 P.3d 1100, 1107 (Wash. 2015). Plaintiff must satisfy every element of a CPA claim. Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 719 P.2d 531, 539- 40 (Wash. 1986). BECU challenges the first, fourth, and fifth elements of Plaintiff’s CPA claim.

‘“Because the CPA does not define ‘unfair’ or ‘deceptive,’ the Washington Supreme Court has allowed the definitions to evolve through a gradual process of judicial inclusion and exclusion.’” Veridian Credit Union, 295 F. Supp. 3d at 1161 (quoting Saunders v. Lloyd’s of London, 779 P.2d 249, 256 (Wash. 1989). “Either an unfair or a deceptive act can be the basis for a CPA claim.” Id. (citing Klem v. Wash. Mut. Bank, 295 P.3d 1179, 1187 (Wash. 2013)). ‘“An unfair act is established by evidence that it (1) causes or is likely to cause substantial injury, which (2) consumers cannot avoid, and (3) is not ‘outweighed by countervailing benefits.’’” Id. (quoting Merriman v. Am. Guar. & Liab. Ins. Co., 396 P.3d 351, 368 (Wash. Ct. App. 2017)).

1 Plaintiff’s complaint included a fourth claim against BECU for common law negligence, but Plaintiff voluntarily withdrew her negligence claim in her response to BECU’s motion to dismiss. Dkt. No. 20 at 1. Based on the Washington courts’ definition and the liberal construction afforded to the CPA, the Court finds that Plaintiff has adequately alleged that BECU engaged in an unfair act when it failed to safeguard her data. Specifically, Plaintiff alleges that BECU “negligent[ly] …

provide[d] [her] … PII and financial information to a third-party who lacked adequate security measures,” knowing that doing so would expose Plaintiff to an increased risk of data theft. Dkt. No. 1-1 at 13, 17. Under similar circumstances, courts have found that the failure to take proper measures to secure PII can constitute an unfair act under the CPA. Leo Guy v. Convergent Outsourcing, Inc., No. C22-1558 MJP, 2023 WL 4637318, at *8 (W.D. Wash. July 20, 2023); Veridian Credit Union, 295 F. Supp. at 1162 (denying motion to dismiss CPA claim when “key wrong doing” alleged was defendant’s “failure to employ adequate data security measures”); In re MCG Health Data Sec. Issue Litig., 2023 WL 3057428, at *14, report and recommendation adopted, No. 2:22-CV-849-RSM-DWC, 2023 WL 4131746 (W.D. Wash. June 22, 2023) (report

and recommendation on defendant’s motion to dismiss recommending that plaintiff’s Washington CPA claim proceed based on plaintiffs allegations that defendant “failed to take proper measures to protect their private information with respect to its data security systems”); Buckley, 2018 WL 1532671, at *3 (denying motion to dismiss CPA claim when plaintiff alleged that defendant “intentionally exposed her to an unacceptable” risk of data theft when it shared her PII with unauthorized third-party). BECU also argues that Plaintiff suffered no injury as a result of its unfair or deceptive practice, and that to the extent she did suffer an injury, BECU was not the cause. But “injury to property or business is broadly construed;” “[e]ven minimal injury is sufficient to meet the damages element of a CPA claim.” Univ. of Wash. v. Gov’t Emps. Ins. Co., 404 P.3d 559, 571

(Wash Ct. App. 2017). In fact, nonquantifiable injuries such as time or expense incurred investigating a suspected deceptive practice will suffice. See Lock v. Am. Fam. Ins. Co., 460 P.3d 683, 694 (2020). As discussed above, under the standing analysis, the Court finds that Plaintiff has alleged sufficient injuries to proceed with her claims. The causation element is satisfied if the plaintiff establishes that she relied upon a

misrepresentation of fact, or where the defendant “induced” the plaintiff to act or refrain from acting. See Desranleau v. Hyland’s, Inc., 450 P.3d 1203, 1210 (Wash. Ct. App. 2019), review denied, 458 P.3d 783 (2020) (trial court properly dismissed CPA claim against manufacturer where plaintiff had never heard of product until after child’s death). But when the unfair or deceptive act is premised on an omission, as is the case here, Washington courts recognize a rebuttable presumption of reliance. Eng. v. Specialized Loan Servicing, 500 P.3d 171, 181 (Wash. Ct. App. 2021) (trial court erroneously dismissed CPA claim where borrower was entitled to rebuttable presumption of reliance); Deegan v. Windermere Real Estate/Center-Isle, Inc., 391 P.3d 582, 587 (Wash. Ct. App. 2017).

Thus, the Court finds that Plaintiff has stated a plausible claim for a violation of the CPA, but just barely so. Without Rule 12(b)(6)’s forgiving standard of review, she will need far more to survive later challenges to her CPA claim. B. Because an express contract covers the same subject matter, Plaintiff cannot maintain separate claims for breach of an implied contract and unjust enrichment.

Plaintiff claims BECU breached an implied contract to safeguard her PII; she described her claim as follows: Defendant required Plaintiff provide her information to Defendant as a condition of her relationship with it. Defendant assured reasonable security over that information. Plaintiff provided this information to Defendant under the implied condition it would be kept secure. She would not have entered that relationship with Defendant if she had known it would not keep her information secure.

Dkt. No. 20 at 9 (citations to the Complaint omitted). Besides Plaintiff’s now-withdrawn claim that BECU negligently shared her PII with Kaye-Smith, Plaintiff offers no factual allegations about how BECU failed to safeguard her information. Even so, the Court construes Plaintiff’s complaint liberally as alleging BECU breached some agreement, in some way, with Plaintiff by providing her PII to Kaye-Smith. See Doe v. United States, 419 F.3d 1058, 1062 (9th Cir. 2005)

(“On a motion to dismiss for failure to state a claim, the court must construe the complaint in the light most favorable to the plaintiff, taking all her allegations as true and drawing all reasonable inferences from the complaint in her favor.”). In response, BECU argues Plaintiff cannot claim breach of an implied contract when there’s an express contract that covers the issues at stake. BECU has a point. Under long standing Washington law, “[a] party to a valid express contract is bound by the provisions of that contract, and may not disregard the same and bring an action on an implied contract relating to the same matter, in contravention of the express contract.” Chandler v. Wash. Toll Bridge Auth., 137 P.2d 97, 103 (Wash. 1943). Before addressing this issue squarely,

however, the Court must first determine the scope of the record on review. Typically, the Court’s review of the record is confined to the contents of the complaint when considering a Rule 12(b)(6) motion. Campanelli v. Bockrath, 100 F.3d 1476, 1479 (9th Cir. 1996). But courts may consider documents referenced extensively in the complaint, documents that form the basis of plaintiff’s claim, and matters of judicial notice when determining whether the allegations in the complaint state a claim upon which relief can be granted. United States v. Ritchie, 342 F.3d 903, 908–09 (9th Cir. 2003). Here, Plaintiff made several references in her complaint to the “condition[s]” of her relationship with BECU as one of its customers. Dkt. No. 1-1 at 12, 13, 24. She claims that these conditions are common to all customers. Id. BECU has submitted its standard Membership Agreement containing the terms

and conditions of its relationship with customers like Plaintiff. Dkt. Nos. 10, 10-2. Plaintiff has not challenged the authenticity of the agreement or whether the Court may consider it as a matter of judicial notice or under the doctrine of incorporation by reference. For purposes of determining whether Plaintiff has stated a plausible claim for relief under an implied contract theory, the Court will consider the Membership Agreement.

BECU’s Membership Agreement contains a section title, “PRIVACY NOTICE.” Dkt. No. 10-2 at 7 (emphasis in original). The notice explains that, among other things, BECU will collect and share its customers’ PII “for [its] everyday business purposes,” “for [its] marketing purposes,” and “for joint marketing with other financial companies.” Id. When it comes to protecting personal information, the Membership Agreement states that BECU will protect “personal information from unauthorized access and use” and that BECU will “use security measures that comply with federal law[,]” including “computer safeguards and secured files and buildings.” Id. On this record, the Court finds that the Membership Agreement covers the same subject matter implicated by Plaintiff’s implied contract claim.

Plaintiff may contend that its claims are based on BECU’s alleged failure to follow some more generalized standard of care apart from its express contractual obligations, but this theory fails for at least two reasons: Plaintiff alleges no facts that BECU agreed to be bound by anything more than what’s in the express agreement, and any claim that BECU failed to exercise some level of reasonable care sounds in something other than contract. Thus, Plaintiff may not maintain a cause of action for breach of an implied contract. Plaintiff’s unjust enrichment claim meets a similar fate. “Unjust enrichment is the method of recovery for the value of the benefit retained absent any contractual relationship because notions of fairness and justice require it.” Young v. Young, 191 P.3d 1258, 1262 (Wash. 2008); see Hurlbut v. Crines, 473 P.3d 263, 270 (Wash. Ct. App. 2020) (“[T]he courts will not allow a

claim for unjust enrichment in contravention of a provision in a valid express contract.”) (internal citation omitted). Like Plaintiff’s implied contract claim, the Court finds that the Membership Agreement relates to the same subject matter as Plaintiff’s unjust enrichment claim and thus applies with equal preclusive force. Because the defects in Plaintiff’s implied contract and unjust enrichment claims cannot

be cured with additional factual allegations, the Court dismisses these claims with prejudice. VIII. Leave to Amend. In her opposition to the motion, Plaintiff requests leave to amend her complaint “if any of [her] claims are deemed insufficient.” Dkt. No. 20 at 11. BECU objects to this request. Dkt. No. 21 at 9. As explained above, the Court dismisses Plaintiff’s implied contract and unjust enrichment claims with prejudice, so Plaintiff’s request is denied. For the foregoing reasons, BECU’s motion to dismiss (Dkt. No. 9) is GRANTED in part and DENIED in part. Plaintiff’s implied contract and unjust enrichment claims against BECU are

dismissed with prejudice, but her CPA claims survives BECU’s motion. Dated this 28th day of July, 2023. A Jamal N. Whitehead United States District Judge