Amburgy v. Express Scripts, Inc.

• Decision Date: 23 November 2009
• Docket Number: No. 4:09CV705 FRB.,4:09CV705 FRB.
• Citation: 671 F.Supp.2d 1046
• Parties: John AMBURGY, Plaintiff, v. EXPRESS SCRIPTS, INC.,<SMALL><SUP>1</SUP></SMALL> Defendant.
• Court: U.S. District Court — Eastern District of Missouri

671 F.Supp.2d 1046

John AMBURGY, Plaintiff, v. EXPRESS SCRIPTS, INC.,¹ Defendant.

No. 4:09CV705 FRB.

United States District Court, E.D. Missouri, Eastern Division.

November 23, 2009.

COPYRIGHT MATERIAL OMITTED

Burton H. Finkelstein, Duvall Foundry, Karen J. Marcus, Mila F. Bartos, Shiva Sharifahmadian, Finkelstein and Thompson, Washington, DC, Gary A. Growe, Growe and Eisen, St. Louis, MO, for Plaintiff.

Joseph P. Conran, James F. Monafo, Thomas M. Dee, Husch Blackwell Sanders, LLP, St. Louis, MO, for Defendant.

MEMORANDUM AND ORDER

FREDERICK R. BUCKLES, United States Magistrate Judge.

Presently pending before the Court is defendant Express Scripts, Inc.'s Motion to Dismiss (Doc. # 12). All matters are pending before the undersigned United States Magistrate Judge, with consent of the parties, pursuant to 28 U.S.C. § 636(c).

Plaintiff John Amburgy brings this action on behalf of himself, and all others similarly situated,² alleging that defendant Express Scripts, Inc.'s (Express Scripts') inadequate security measures in relation to its computerized database system allowed unauthorized persons to gain access to confidential information of Express Scripts members contained in the database, with such information including names, dates of birth, Social Security numbers, and prescription information. Plaintiff claims that the unauthorized persons who committed the act informed Express Scripts in October 2008 of their breach of the system and threatened that they would make public the confidential information obtained through the breach if Express Scripts did not pay a certain amount of money to them. Plaintiff claims that Express Scripts notified its members of this security breach in November 2008 with a notice posted on its website, and that Express Scripts notified by personal letter those persons whose confidential information had been identified in the extortion letter.³ Plaintiff claims that as a result of Express Scripts' failure to maintain adequate security measures to protect against the theft of such confidential information, plaintiff and other Express Scripts members have been placed "at an increased risk of becoming victims of identity theft crimes, fraud, abuse, and extortion." (Pltf.'s Compl. at para. 3.) Plaintiff also claims that he and other members "have spent (or will need to spend) considerable time and money to protect themselves" as a result of Express Scripts' conduct. (Id.) Finally, plaintiff contends that millions of Express Scripts members, including plaintiff,

have had their Confidential Information compromised, their privacy invaded, have been deprived of the exclusive use and control of their proprietary prescription information, have incurred costs of time and money to consistently monitor their credit card accounts, credit reports, prescription accounts, and other financial information in order to protect their Confidential Information, and have otherwise suffered economic damages.

(Id. at para. 4.)

In his five-count Complaint brought under the Class Action Fairness Act of 2005, 28 U.S.C. § 1332(d), plaintiff claims Express Scripts' actions constituted negligence, breach of contract with respect to third-party beneficiaries, breach of implied contract, violations of "data breach notification laws" of various States, and violations of Missouri's Merchandising Practices Act.

Defendant Express Scripts seeks to dismiss plaintiff's action, arguing that this Court lacks subject matter jurisdiction over the cause inasmuch as plaintiff does not have standing to pursue the claims, and, further, that the Complaint fails to state a claim upon which relief can be granted. Plaintiff has responded to the motion to which defendant has replied. The Court will address each of defendant's arguments in turn.

A. Subject Matter Jurisdiction

Article III, § 2 of the United States Constitution limits federal jurisdiction to actual cases and controversies. The "threshold requirement" imposed by Article III is that those who seek to invoke the power of federal courts must allege an actual case or controversy. O'Shea v. Littleton, 414 U.S. 488, 494, 94 S.Ct. 669, 38 L.Ed.2d 674 (1974) (citing Flast v. Cohen, 392 U.S. 83, 94-101, 88 S.Ct. 1942, 20 L.Ed.2d 947 (1968); Jenkins v. McKeithen, 395 U.S. 411, 421-425, 89 S.Ct. 1843, 23 L.Ed.2d 404 (1969) (opinion of Marshall, J.)). As such, a plaintiff in federal court must "`allege some threatened or actual injury resulting from the putatively illegal action before a federal court may assume jurisdiction.'" Id. (quoting Linda R.S. v. Richard D., 410 U.S. 614, 617, 93 S.Ct. 1146, 35 L.Ed.2d 536 (1973)). In class action litigation, the named plaintiff purporting to represent a class must establish that he, personally, has standing to bring the cause of action. If the named plaintiff cannot maintain the action on his own behalf, he may not seek such relief on behalf of the class. Id.; Hall v. Lhaco, Inc., 140 F.3d 1190, 1196-97 (8th Cir.1998).

To show Article III standing, a plaintiff has the burden of proving: (1) that he suffered an "injury-in-fact," (2) that a causal relationship exists between the injury and the challenged conduct, and (3) that the injury likely will be redressed by a favorable decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992); Steger v. Franco, Inc., 228 F.3d 889, 892 (8th Cir. 2000). Abstract injury is not enough to demonstrate injury-in-fact. Plaintiff must allege that he has sustained or is in immediate danger of sustaining some direct injury as a result of the challenged conduct. O'Shea, 414 U.S. at 494, 94 S.Ct. 669 (citing Massachusetts v. Mellon, 262 U.S. 447, 488, 43 S.Ct. 597, 67 L.Ed. 1078 (1923)). The injury or threat of injury must be concrete and particularized, actual and imminent; not conjectural or hypothetical. Id. (citing Golden v. Zwickler, 394 U.S. 103, 109-10, 89 S.Ct. 956, 22 L.Ed.2d 113 (1969); Maryland Cas. Co. v. Pacific Coal & Oil Co., 312 U.S. 270, 273, 61 S.Ct. 510, 85 L.Ed. 826 (1941); United Pub. Workers v. Mitchell, 330 U.S. 75, 89-91, 67 S.Ct. 556, 91 L.Ed. 754 (1947)). See also Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000).

Here, defendant argues that plaintiff cannot demonstrate injury-in-fact inasmuch as he alleges only a possibility of having had his confidential information stolen and thus does not allege that his information has in fact been stolen, published or used in such a way so as to cause him damage either presently or in the future. Defendant also contends that plaintiff's claim of an "increased risk of harm" fails to meet the threshold requirement that the injury be actual or imminent, concrete and not hypothetical. For the following reasons, defendant's argument is well taken.

Database breaches appear to provide the basis for a new breed of lawsuits, and especially class action lawsuits, in which plaintiffs allege, as here, that the database handlers' negligence in developing and maintaining security measures have resulted in otherwise personal and confidential information being compromised, thereby increasing the risk of identity theft for those individuals whose information was so compromised. The remedies sought in these actions vary, but generally include costs for credit monitoring, costs for closing and opening financial accounts, and damages for emotional distress. Whether individuals have Article III standing to bring these lawsuits in federal court is a question that has been raised in many venues, to which divergent answers have been given. Indeed, the various district courts that have addressed this issue are nearly split in their decisions.⁴

Although the Eighth Circuit Court of Appeals has not yet spoken on this precise issue, one circuit court has addressed the matter and found standing to be present in such circumstances. In Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir.2007), the Seventh Circuit addressed its jurisdiction sua sponte, and determined that the plaintiffs' allegation of increased risk of identity theft was sufficient to confer standing, despite plaintiffs' failure to allege any completed financial loss to their accounts or that they had in fact been the victim of identity theft as a result of the security breach. The court stated that standing was nevertheless present in the circumstances, finding that "the injury-in-fact requirement can be satisfied by a threat of future harm or by an act which harms the plaintiff only by increasing the risk of future harm that the plaintiff would have otherwise faced, absent the defendant's actions." Id. at 634. In reaching this conclusion, the court relied on cases from the Second and Sixth Circuits, which addressed increased risk of future medical injury; and from the Fourth and Ninth Circuits, which addressed increased risk of future environmental injury. See id. at 634 n. 3. Other than citing these cases, the court engaged in no discussion applying the Supreme Court's recognized standard for determining whether the plaintiffs in the database breach case had standing under Article III of the United States Constitution.

Subsequent to the Seventh Circuit's decision in Pisciotta, district courts have consistently determined that claims of increased risk of identity theft resulting from security breaches sufficiently allege an injury-in-fact to confer Article III standing to those persons bringing such claims.⁵ Indeed, the District of Connecticut noted that "[t]he recent trend, in `lost data cases,' as exemplified by Pisciotta ..., seems to be in favor of finding subject matter jurisdiction." McLoughlin v. People's United Bank, Inc., No. 3:08-cv-00944 (VLB), 2009 WL 2843269, at *4 (D.Conn. Aug. 31, 2009) (citing cases). However, because the requirement of standing is firmly rooted in the Constitution and is not subject to whim, the undersigned is reluctant to look to a "recent...