Attias v. CareFirst, Inc.

• Decision Date: 01 August 2017
• Docket Number: No. 16-7108,16-7108
• Citation: 865 F.3d 620
• Parties: Chantal ATTIAS, Individually and on Behalf of All Others Similarly Situated, et al., Appellants v. CAREFIRST, INC., Doing Business as Group Hospitalization And Medical Services, Inc., Doing Business as Carefirst of Maryland, Inc., Doing Business as Carefirst Bluecross Blueshield, Doing Business as Carefirst Bluechoice, Inc., et al., Appellees
• Court: U.S. Court of Appeals — District of Columbia Circuit

865 F.3d 620

Chantal ATTIAS, Individually and on Behalf of All Others Similarly Situated, et al., Appellants

v.CAREFIRST, INC., Doing Business as Group Hospitalization And Medical Services, Inc., Doing Business as Carefirst of Maryland, Inc., Doing Business as Carefirst Bluecross Blueshield, Doing Business as Carefirst Bluechoice, Inc., et al., Appellees

No. 16-7108

United States Court of Appeals, District of Columbia Circuit.

Argued March 31, 2017

Decided August 1, 2017

Jonathan B. Nace argued the cause for appellants. With him on the briefs was Christopher T. Nace, Washington, DC.

Marc Rotenberg and Alan Butler, Washington, DC were on the brief for amicus curiae Electronic Privacy Information Center (EPIC) in support of appellants.

Tracy D. Rezvani, Rockville, MD was on the brief for amicus curiae National Consumers League in support of appellants.

Matthew O. Gatewood, Washington, DC argued the cause for appellees. With him on the briefs was Robert D. Owen, New York, NY.

Andrew J. Pincus, Stephen C.N. Lilley, Kathryn Comerford Todd, Steven P. Lehotsky, and Warren Postman, Washington, DC were on the brief for amicus curiae The Chamber of Commerce of the United States of America in support of appellees.

Before: Tatel, Griffith, and Millett, Circuit Judges.

Griffith, Circuit Judge

In 2014, health insurer CareFirst suffered a cyberattack in which its customers' personal information was allegedly stolen. A group of CareFirst customers attributed the breach to the company's carelessness and brought a putative class action. The district court dismissed for lack of standing, finding the risk of future injury to the plaintiffs too speculative to establish injury in fact. We conclude that the district court gave the complaint an unduly narrow reading. Plaintiffs have cleared the low bar to establish their standing at the pleading stage. We accordingly reverse.

I

CareFirst and its subsidiaries are a group of health insurance companies serving approximately one million customers in the District of Columbia, Maryland, and Virginia.¹ When customers purchased CareFirst's insurance policies, they provided personal information to the company, including their names, birthdates, email addresses, social security numbers, and credit card information. CareFirst then assigned each customer a subscriber identification number. The companies stored this information on their servers. Allegedly, though, CareFirst failed to properly encrypt some of the data entrusted to its care.

In June 2014, an unknown intruder breached twenty-two CareFirst computers and reached a database containing its customers' personal information. CareFirst did not discover the breach until April 2015 and only notified its customers in May 2015. Shortly after the announcement, seven CareFirst customers brought a class action against CareFirst and its subsidiaries in our district court. Their complaint invoked diversity jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d), and raised eleven different state-law causes of action, including breach of contract, negligence, and violation of various state consumer-protection statutes.

The parties disagree over what the complaint alleged. According to CareFirst, the complaint alleged only the exposure of limited identifying data, such as customer names, addresses, and subscriber ID numbers. According to plaintiffs, the complaint also alleged the theft of customers' social security numbers. The plaintiffs sought to certify a class consisting of all CareFirst customers residing in the District of Columbia, Maryland, and Virginia whose personal information had been hacked. CareFirst moved to dismiss for lack of Article III standing and, in the alternative, for failure to state a claim.

The district court agreed that the plaintiffs lacked standing, holding that they had alleged neither a present injury nor a high enough likelihood of future injury. The plaintiffs had argued that they suffered an increased risk of identity theft as a result of the data breach, but the district court found this theory of injury to be too speculative. The district court did not read the complaint to allege the theft of social security numbers or credit card numbers, and concluded that "[p]laintiffs have not suggested, let alone demonstrated, how the CareFirst hackers could steal their identities without access to their social security or credit card numbers." Attias v. CareFirst, Inc. , 199 F.Supp.3d 193, 201 (D.D.C. 2016).

Based on its determination that the plaintiffs had failed to allege an injury in fact, the district court ordered that their "[c]omplaint be dismissed without prejudice." J.A. 350 (emphasis omitted). The court did not decide whether diversity jurisdiction was proper, or whether the plaintiffs had stated a claim for which relief could be granted. Plaintiffs timely appealed.

II

Although the parties agree that we have jurisdiction to hear this appeal, we have an independent duty to ensure that we are acting within the limits of our authority. See Steel Co. v. Citizens for a Better Env't , 523 U.S. 83, 93-94, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Our jurisdiction embraces "appeals from all final decisions of the district courts of the United States." 28 U.S.C. § 1291 (emphasis added). In evaluating the finality of district court rulings on motions to dismiss, we have distinguished between orders dismissing the action , which are final, see Ciralsky v. CIA , 355 F.3d 661, 666 (D.C. Cir. 2004), and orders dismissing the complaint , which, if rendered "without prejudice," are "typically" not final, Murray v. Gilmore , 406 F.3d 708, 712 (D.C. Cir. 2005). But here, even though the district court ordered that the plaintiffs' "[c]omplaint be dismissed without prejudice," J.A. 350 (emphasis omitted), we are convinced that its order was final, and that we have jurisdiction over this appeal.

Key to that conclusion are the district court's grounds for dismissal. The court below concluded that it lacked subject-matter jurisdiction because the plaintiffs lacked Article III standing. See Lujan v. Defenders of Wildlife , 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (identifying the plaintiff's Article III standing as an element of federal courts' jurisdiction). When a court lacks subject-matter jurisdiction, it has no authority to address the dispute presented. "Jurisdiction is the power to declare the law, and when it ceases to exist, the only function remaining to the court is that of announcing the fact and dismissing the cause." Steel Co. , 523 U.S. at 94, 118 S.Ct. 1003 (quoting Ex parte McCardle , 74 U.S. (7 Wall.) 506, 514, 19 L.Ed. 264 (1868) ). Thus, in the ordinary case, a dismissal for lack of subject-matter jurisdiction ends the litigation and leaves nothing more for the court to do. That is the definition of a final, appealable order. See Riley v. Kennedy , 553 U.S. 406, 419, 128 S.Ct. 1970, 170 L.Ed.2d 837 (2008). This principle fits neatly into the Ciralsky - Murray framework: a dismissal for lack of subject-matter jurisdiction is, in effect, a dismissal of the action , and therefore final, even if, as here, it is styled as a dismissal of the complaint. See Tootle v. Sec'y of Navy , 446 F.3d 167, 172 (D.C. Cir. 2006) ("A district court must dismiss an action where ... it concludes that it lacks subject matter jurisdiction.").

But that rule is flexible, and we recognize, as did the Ciralsky court, that the district court's intent is a significant factor in the analysis. See 355 F.3d at 667-68. Thus, if the district court intended for the action to continue via amendment of the complaint to allege facts supporting jurisdiction, its dismissal order is not final. See Murray , 406 F.3d at 712-13.

To accommodate both the rule that a dismissal for lack of subject-matter jurisdiction ordinarily ends the action and the need to respect the intentions of the district court that entered the order, we will presume, absent a clear indication to the contrary, that a dismissal for lack of subject-matter jurisdiction under Rule 12(b)(1) is a final, appealable order. Other circuits have similarly concluded that a district court's dismissal for lack of subject-matter jurisdiction is generally final and appealable. See, e.g. , Radha Geismann, M.D., P.C. v. ZocDoc, Inc. , 850 F.3d 507, 509 n.3 (2d Cir. 2017) ; City of Yorkville ex rel. Aurora Blacktop Inc. v. Am. S. Ins. Co. , 654 F.3d 713, 715-16 (7th Cir. 2011) ; Whisnant v. United States , 400 F.3d 1177, 1180 (9th Cir. 2005).

Where subject-matter jurisdiction depends on the factual allegations in the complaint, as it does here, the district court can signal that a dismissal under Rule 12(b)(1) is not final if it expressly gives the plaintiff leave to amend the complaint. See FED. R. CIV. P. 15(a)(2). A court that has extended such an invitation to amend clearly contemplates that there is still some work for the court to do before the litigation is over. See Riley , 553 U.S. at 419, 128 S.Ct. 1970 ; see also Mohawk Indus., Inc. v. Carpenter , 558 U.S. 100, 106, 130 S.Ct. 599, 175 L.Ed.2d 458 (2009) (describing a final decision as one "by which a district court disassociates itself from a case" (quoting Swint v. Chambers Cty. Comm'n , 514 U.S. 35, 42, 115 S.Ct. 1203, 131 L.Ed.2d 60 (1995) )).

On the other hand, a court's statement that its jurisdictional dismissal is "without prejudice" will not, by itself, overcome the presumption that such dismissals terminate the action , not just the complaint. By dismissing without prejudice, a district court leaves the plaintiff free to return later to the same court with the same underlying claim. See Semtek Int'l Inc. v. Lockheed Martin Corp. , 531 U.S. 497, 505, 121 S.Ct. 1021, 149 L.Ed.2d 32 (2001). But as Ciralsky explained, either a complaint or an action can be dismissed "without prejudice." See 355 F.3d at 666-67. Thus, an order of dismissal "without prejudice" tells us nothing about whether the district court intended...