Beck v. McDonald

• Court: U.S. Court of Appeals — Fourth Circuit
• Writing for the Court: DIAZ, Circuit Judge
• Citation: Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017)
• Decision Date: 06 February 2017
• Docket Number: No. 15-1715,No. 15-1395,15-1395
• Parties: Richard G. BECK ; Lakreshia R. Jeffery; Beverly Watson ; Cheryl Gajadhar; Jeffery Willhite, on behalf of themselves and all others similarly situated, Plaintiffs–Appellants, v. Robert A. MCDONALD, in his official capacity as Secretary of Veterans Affairs; Timothy B. McMurry, in his official capacity as the former Medical Director of William Jennings Bryan Dorn VA Medical Center ; Bernard L. Dekoning, in his official capacity as the Chief of Staff of William Jennings Bryan Dorn VA Medical Center ; Ruth Mustard, RN, Director for Patient Care–Nursing Services of William Jennings Bryan Dorn VA Medical Center; Jon Zivony, Assistant Director of William Jennings Bryan Dorn VA Medical Center ; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center, Defendants–Appellees. Beverly Watson, on behalf of herself and all others similarly situated, Plaintiff–Appellant, v. Robert A. McDonald, in his official capacity as Secretary of Veterans Affairs; Timothy McMurry, in his official capacity as the Medical Director of William Jennings Bryan Dorn VA Medical Center ; ruth mustard, RN, in her official capacity as the Associate Director for Patient Care/Nursing Services of William Jennings Bryan Dorn VA Medical Center; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center ; Jon Zivony, in his official capacity as the Assistant Director of William Jennings Bryan Dorn VA Medical Center ; Sue Panfil, in her official capacity as the Privacy Officer of William Jennings Bryan Dorn VA Medical Center, Defendants–Appellees.

848 F.3d 262

Richard G. BECK ; Lakreshia R. Jeffery; Beverly Watson ; Cheryl Gajadhar; Jeffery Willhite, on behalf of themselves and all others similarly situated, Plaintiffs–Appellants,

v.Robert A. MCDONALD, in his official capacity as Secretary of Veterans Affairs; Timothy B. McMurry, in his official capacity as the former Medical Director of William Jennings Bryan Dorn VA Medical Center ; Bernard L. Dekoning, in his official capacity as the Chief of Staff of William Jennings Bryan Dorn VA Medical Center ; Ruth Mustard, RN, Director for Patient Care–Nursing Services of William Jennings Bryan Dorn VA Medical Center; Jon Zivony, Assistant Director of William Jennings Bryan Dorn VA Medical Center ; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center, Defendants–Appellees.

Beverly Watson, on behalf of herself and all others similarly situated, Plaintiff–Appellant,

v.Robert A. McDonald, in his official capacity as Secretary of Veterans Affairs; Timothy McMurry, in his official capacity as the Medical Director of William Jennings Bryan Dorn VA Medical Center ; ruth mustard, RN, in her official capacity as the Associate Director for Patient Care/Nursing Services of William Jennings Bryan Dorn VA Medical Center; David L. Omura, in his official capacity as the Associate Director of William Jennings Bryan Dorn VA Medical Center ; Jon Zivony, in his official capacity as the Assistant Director of William Jennings Bryan Dorn VA Medical Center ; Sue Panfil, in her official capacity as the Privacy Officer of William Jennings Bryan Dorn VA Medical Center, Defendants–Appellees.

No. 15-1395

No. 15-1715

United States Court of Appeals, Fourth Circuit.

Argued: September 20, 2016

Decided: February 6, 2017

ARGUED: Douglas J. Rosinski, Columbia, South Carolina, for Appellants. Sonia Katherine McNeil, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for Appellees. ON BRIEF: D. Michael Kelly, Bradley D. Hewett, MIKE KELLY LAW GROUP, LLC, Columbia, South Carolina, for Appellants. Benjamin C. Mizer, Principal Deputy Assistant Attorney General, Mark B. Stern, Civil Division, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C.; William N. Nettles, United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Columbia, South Carolina, for Appellees.

Before NIEMEYER and DIAZ, Circuit Judges, and Irene M. KEELEY, United States District Judge for the Northern District of West Virginia, sitting by designation.

Affirmed by published opinion. Judge Diaz wrote the opinion, in which Judge Niemeyer and Judge Keeley joined.

DIAZ, Circuit Judge:

The Plaintiffs in these consolidated appeals are veterans who received medical treatment and health care at the William Jennings Bryan Dorn Veterans Affairs Medical Center ("Dorn VAMC") in Columbia, South Carolina. After two data breaches at the Center compromised their personal information, the Plaintiffs brought separate actions against the Secretary of Veterans Affairs and Dorn VAMC officials ("Defendants"), alleging violations of the Privacy Act of 1974, 5 U.S.C. § 552a et seq. and the Administrative Procedure Act ("APA"), 5 U.S.C. § 701 et seq.

In both cases, the Plaintiffs sought to establish Article III standing based on the harm from the increased risk of future identity theft and the cost of measures to protect against it. The district court dismissed the actions for lack of subject-matter jurisdiction, holding that the Plaintiffs failed to establish a non-speculative, imminent injury-in-fact for purposes of Article III standing. We agree with the district court and therefore affirm.

I.

A.

The Beck case arises from a report that on February 11, 2013, a laptop connected to a pulmonary function testing device with a Velcro strip was misplaced or stolen from Dorn VAMC's Respiratory Therapy department. The laptop contains unencrypted personal information of approximately 7,400 patients, including names, birth dates, the last four digits of social security numbers, and physical descriptors (age, race, gender, height, and weight).

An internal investigation determined that the laptop was likely stolen and that Dorn VAMC failed to follow the policies and procedures for utilizing a non-encrypted laptop to store patient information. Dorn VAMC officials used medical appointment records to notify every patient tested using the missing laptop and offered one year of free credit monitoring. To date, the laptop has not been recovered.

Richard Beck and Lakreshia Jeffery (the "Beck plaintiffs")¹ filed suit on behalf of a putative class of the approximately 7,400 patients whose information was stored on the missing laptop. Relevant to this appeal, the Beck plaintiffs sought declaratory relief and monetary damages under the Privacy Act, alleging that the "Defendants' failures" and "violations" of the Privacy Act "caused Plaintiffs ... embarrassment, inconvenience, unfairness, mental distress, and the threat of current and future substantial harm from identity theft and other misuse of their Personal Information." J.A. 12. They further allege that the "threat of identity theft" required them to frequently monitor their "credit reports, bank statements, health insurance reports, and other similar information, purchas[e] credit watch services, and [shift] financial accounts." J.A. 12.

In addition to their Privacy Act claims, the Beck plaintiffs sought broad injunctive relief under the APA, requiring the VA to account for all Privacy Act records in the possession of Dorn VAMC and to recover and permanently destroy any improperly maintained records. The Beck plaintiffs also sought to enjoin the Defendants from transferring patient information from computer systems to any portable device "until and unless Defendants demonstrate to the Court that adequate information security has been established." J.A. 23. Finally, the Beck plaintiffs alleged separate common-law negligence claims.

The Defendants moved to dismiss for lack of subject-matter jurisdiction or, in the alternative, for failure to state a claim. The district court granted the motion as to the common-law negligence claims, but declined to dismiss the Privacy Act and APA claims.

Following extensive discovery, the Plaintiffs moved for partial summary judgment and for class certification. The Defendants renewed their motion to dismiss the Plaintiffs' claims for lack of subject-matter jurisdiction and, in the alternative, moved for summary judgment. The district court granted the Defendants' motion to dismiss, holding, pursuant to Clapper v. Amnesty International USA , ––– U.S. ––––, 133 S.Ct. 1138, 1155, 185 L.Ed.2d 264 (2013), that the Beck plaintiffs lacked standing under the Privacy Act because they had "not submitted evidence sufficient to create a genuine issue of material fact as to whether they face a ‘certainly impending’ risk of identity theft." J.A. 1059.

The Beck plaintiffs' fear of harm from future identity theft, said the district court, was too speculative to confer standing because it was "contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendants." J.A. 1059 (citing Clapper , 133 S.Ct. at 1148 ). The Beck plaintiffs also failed to satisfy the "lesser standard" of "substantial risk" of future harm referenced in Clapper : The plaintiffs' calculations that 33% of those affected by the laptop theft would have their identities stolen and that all affected would be 9.5 times more likely to experience identity theft "d[id] not suffice to show a substantial risk of identity theft." J.A. 1060.

The district court also rejected the Beck plaintiffs' attempt to "create standing by choosing to purchase credit monitoring services or taking any other steps designed to mitigate the speculative harm of future identity theft." J.A. 1061. These measures, according to the court, did not amount to an injury-in-fact because they were taken solely "to mitigate a speculative future harm." J.A. 1061.

Turning to the Beck plaintiffs' request for injunctive relief under the APA, the district court acknowledged that the claim that "there have been at least seventeen data breaches at Dorn [VAMC] during the course of th[e] [Beck ] litigation" was "undoubtedly concerning." J.A. 1064. Nonetheless, the court concluded that Dorn VAMC's "past Privacy Act violations are insufficient to establish Plaintiffs' standing to seek injunctive relief" where it was "no more than speculation for Plaintiffs to assert that their personal information will again be compromised by a future Privacy Act violation and that they will be injured as a result." J.A. 1064.

The district court ruled in the alternative that the Defendants were entitled to summary judgment on the merits, because: (1) the Beck plaintiffs had not suffered "actual damages" as required to recover damages under the Privacy Act, and (2) the APA could not be read to "provide for the broad judicial oversight" of the VA's entire privacy program sought by the Plaintiffs. J.A. 1067–68.

B.

The Watson case arises from Dorn VAMC's July 2014 discovery that four boxes of pathology reports headed for long-term storage had been misplaced or stolen. The reports contain identifying information of over 2,000 patients, including names, social security numbers, and medical diagnoses. Dorn VAMC officials alerted those affected and, as they did following the laptop's disappearance, offered each of them one year of free credit monitoring. The boxes have not been recovered.

While the Beck litigation was pending, Beverly Watson² brought a putative class-action lawsuit on behalf of the over 2,000 individuals whose pathology reports had gone missing. Watson sought money damages and declaratory and injunctive relief, alleging the same harm as did the Beck plaintiffs. The Defendants moved to dismiss the complaint for lack of subject-matter jurisdiction and for failure to state a claim.

The district court granted the Defendants' motion to dismiss for lack of...