693 F.3d 1317 (11th Cir. 2012), 11-13694, Resnick v. AvMed, Inc.

Docket Nº:11-13694.
Citation:693 F.3d 1317
Opinion Judge:WILSON, Circuit Judge:
Party Name:Jean RESNICK, et al., Plaintiffs, v. AVMED, INC., a Florida corporation, Defendant-Appellee. Juana Curry, William Moore, Plaintiffs-Appellants,
Attorney:Benjamin Scott Thomassen, Jay Edelson, William C. Gray, Ari J. Scharg, Edelson McGuire, LLC, Chicago, IL, for Plaintiffs-Appellants. John Delionado, Paulo R. Lima, Hunton & Williams, LLP, Miami, FL, Neil K. Gilman, Hunton & Williams, LLP, Washington, DC, for Defendant-Appellee.
Judge Panel:Before WILSON, PRYOR and MARTIN, Circuit Judges. PRYOR, Circuit Judge, dissenting:
Case Date:September 05, 2012
Court:United States Courts of Appeals, Court of Appeals for the Eleventh Circuit
 
FREE EXCERPT

Page 1317

693 F.3d 1317 (11th Cir. 2012)

Jean RESNICK, et al., Plaintiffs,

Juana Curry, William Moore, Plaintiffs-Appellants,

v.

AVMED, INC., a Florida corporation, Defendant-Appellee.

No. 11-13694.

United States Court of Appeals, Eleventh Circuit.

September 5, 2012

As Corrected Sept. 6, 2012.

Page 1318

[Copyrighted Material Omitted]

Page 1319

[Copyrighted Material Omitted]

Page 1320

[Copyrighted Material Omitted]

Page 1321

Benjamin Scott Thomassen, Jay Edelson, William C. Gray, Ari J. Scharg, Edelson McGuire, LLC, Chicago, IL, for Plaintiffs-Appellants.

John Delionado, Paulo R. Lima, Hunton & Williams, LLP, Miami, FL, Neil K. Gilman, Hunton & Williams, LLP, Washington, DC, for Defendant-Appellee.

Appeal from the United States District Court for the Southern District of Florida.

Before WILSON, PRYOR and MARTIN, Circuit Judges.

WILSON, Circuit Judge:

Juana Curry and William Moore (collectively " Plaintiffs" ) appeal the district court's dismissal of their Second Amended Complaint (" Complaint" ) for failure to state a claim upon which relief may be granted. The district court held that among its other deficiencies, the Complaint failed to state a cognizable injury. We find that the complaint states a cognizable injury for the purposes of standing and as a necessary element of injury in Plaintiffs' Florida law claims. We also conclude that the Complaint sufficiently alleges the causation element of negligence, negligence per se, breach of contract, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and breach of fiduciary duty under Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), and Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). The Complaint similarly alleges facts sufficient to withstand a motion to dismiss on the restitution/unjust enrichment claim. However, the Complaint fails to allege entitlement to relief under Florida law for the claims of negligence per se and breach of the implied covenant of good faith and fair dealing. We therefore reverse in part, affirm in part, and remand the case to the district court for further proceedings.

I

We state the facts as alleged in the Complaint, accept them as true, and construe them in the light most favorable to

Page 1322

Plaintiffs. Lanfear v. Home Depot, Inc., 679 F.3d 1267, 1271 n. 4 (11th Cir.2012). AvMed, Inc. is a Florida corporation that delivers health care services through health plans and government-sponsored managed-care plans. AvMed has a corporate office in Gainesville, Florida, and in December 2009, two laptop computers were stolen from that office. Those laptops contained AvMed customers' sensitive information, which included protected health information, Social Security numbers, names, addresses, and phone numbers. AvMed did not take care to secure these laptops, so when they were stolen the information was readily accessible. The laptops were sold to an individual with a history of dealing in stolen property. The unencrypted laptops contained the sensitive information of approximately 1.2 million current and former AvMed members.

The laptops contained personal information of Juana Curry and William Moore. Plaintiffs are careful in guarding their sensitive information and had never been victims of identity theft before the laptops were stolen. Curry guards physical documents that contain her sensitive information and avoids storing or sharing her sensitive information digitally. Similarly, Moore guards physical documents that contain his sensitive information and is careful in the digital transmission of this information.

Notwithstanding their care, Plaintiffs have both become victims of identity theft. Curry's sensitive information was used by an unknown third party in October 2010— ten months after the laptop theft. Bank of America accounts were opened in Curry's name, credit cards were activated, and the cards were used to make unauthorized purchases. Curry's home address was also changed with the U.S. Postal Service. Moore's sensitive information was used by an unknown third party in February 2011— fourteen months after the laptop theft. At that time, an account was opened in Moore's name with E*Trade Financial, and in April 2011, Moore was notified that the account had been overdrawn.

II

In November 2010, five named plaintiffs seeking to represent the class of individuals whose information was stored on the unsecured laptops filed this case in Florida state court, captioned Jean Resnick et al. v. AvMed, Inc. AvMed removed the case to federal court pursuant to the Class Action Fairness Act of 2005, 28 U.S.C. § 1332(d) and filed a motion to dismiss for failure to state a claim. See Fed.R.Civ.P. 12(b)(6). The initial plaintiffs then amended their complaint to address the identified deficiencies and filed a new complaint. The First Amended Complaint added Curry as a named plaintiff. AvMed again filed a motion to dismiss under Rule 12(b)(6), which the district court granted without prejudice on the ground that the plaintiffs failed to state a cognizable injury. Specifically, the district court reasoned that the plaintiffs sought to " predicate recovery upon a mere specter of injury: a heightened likelihood of identity theft." The court explicitly declined to analyze whether the plaintiffs' complaint failed to allege a cognizable injury for the purposes of standing, see Lujan v. Defenders of Wildlife, 504 U.S. 555, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992), or under state law, see Pisciotta v. Old National Bancorp, 499 F.3d 629 (7th Cir.2007). The court found that to the extent the plaintiffs alleged actual identity theft, they failed to satisfy the pleading standards established by the Supreme Court in Twombly . Plaintiffs then filed a Second Amended Complaint— the Complaint at issue in this appeal— in which they added Moore and dropped the

Page 1323

original five named plaintiffs who did not allege actual identity theft.

In the Complaint at issue, Plaintiffs seek to represent the class of AvMed customers whose sensitive information was stored on the stolen laptops and a subclass of individuals whose identities have been stolen since the laptop theft. Plaintiffs brought seven counts against AvMed under Florida law. Plaintiffs allege that AvMed was negligent in protecting their sensitive information and negligent per se when it violated section 395.3025 of the Florida Statutes, which protects medical information. Plaintiffs also allege that AvMed breached its contract with Plaintiffs, and alternatively that AvMed breached its implied contract with Plaintiffs. In the alternative to the breach of contract claim, Plaintiffs also allege a claim for restitution/unjust enrichment. Finally, Plaintiffs allege that AvMed breached the implied covenant of good faith and fair dealing, and that AvMed breached the fiduciary duty it owed to Plaintiffs.

AvMed filed a motion to dismiss the Complaint for failure to state a claim, and the district court granted the motion, stating only that " [a]mong its other deficiencies, Plaintiffs' Second Amended Complaint again fails to allege any cognizable injuiry." Plaintiffs appeal.

III

Prior to making an adjudication on the merits, we must assure ourselves that we have jurisdiction to hear the case before us. Anago v. Shaz, 677 F.3d 1272, 1275 (11th Cir.2012) (citing Arbaugh v. Y& H Corp., 546 U.S. 500, 514, 126 S.Ct. 1235, 1244, 163 L.Ed.2d 1097 (2006)). Litigants must show that their claim presents the court with a case or controversy under the Constitution and meets the " irreducible constitutional minimum of standing." Lujan, 504 U.S. at 560, 112 S.Ct. at 2136. To fulfill this requirement, a plaintiff must show that:

(1) it has suffered an " injury in fact" that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.

Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S.Ct. 693, 704, 145 L.Ed.2d 610 (2000). " At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice" to establish standing. Lujan, 504 U.S. at 561, 112 S.Ct. at 2137.

Whether a party claiming actual identity theft resulting from a data breach has standing to bring suit is an issue of first impression in this Circuit. Plaintiffs allege that they have become victims of identity theft and have suffered monetary damages as a result. This constitutes an injury in fact under the law.1 Via Mat Int'l S. Am. Ltd. v. United States, 446 F.3d 1258, 1263 (11th Cir.2006) (finding economic harm sufficient to create standing); see also Lambert v. Hartman, 517 F.3d 433, 437 (6th Cir.2008).

Page 1324

We must next determine whether Plaintiffs' injury is fairly traceable to AvMed's actions. A showing that an injury is " fairly traceable" requires less than a showing of " proximate cause." Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir.2003). Even a showing that a plaintiff's injury is indirectly caused by a defendant's actions satisfies the fairly traceable requirement. Id. Plaintiffs allege that AvMed failed to secure their information on company laptops, and that those laptops were subsequently stolen. Despite Plaintiffs' personal habits of securing their sensitive information, Plaintiffs became the victims of identity theft after the unencrypted laptops containing their sensitive information were stolen. For purposes of standing, these allegations are...

To continue reading

FREE SIGN UP