Desue v. 20/20 Eye Care Network, Inc.

• Decision Date: 15 March 2022
• Docket Number: 21-CIV-61275-RAR
• Court: U.S. District Court — Southern District of Florida
• Parties: WENSTON DESUE, individually and as legal guardian of N.D. and M.D. and all others similarly situated, Plaintiff, v. 20/20 EYE CARE NETWORK, INC., et al., Defendants.

WENSTON DESUE, individually and as legal guardian of N.D. and M.D. and all others similarly situated, Plaintiff,
v.
20/20 EYE CARE NETWORK, INC., et al., Defendants.

No. 21-CIV-61275-RAR

United States District Court, S.D. Florida

March 15, 2022

ORDER GRANTING IN PART DEFENDANTS' MOTION TO DISMISS

RC DOLFO A. RUIZ II., UNITED STATES DISTRICT JUDGE.

THIS CAUSE comes before the Court upon Defendants' Joint Motion to Dismiss Plaintiffs' First Amended Consolidated Complaint [ECF No. 40] (“Motion”). Having reviewed the Motion, Plaintiffs' Opposition [ECF No. 41] (“Response”), Defendants' Joint Reply in Support of the Motion [ECF No. 43] (“Reply”), the record, applicable law, and being otherwise fully advised, it is hereby

ORDERED AND ADJUDGED that Defendants' Motion to Dismiss is GRANTED IN PART as set forth herein.

BACKGROUND

This action is the result of a data breach detected in January 2021 (“Data Breach”), when 20/20 Eye Care, 20/20 Hearing Care, and iCare allegedly failed to protect the personally identifiable information (“PII”) and protected health information (“PHI”) of Plaintiffs and over 3.2 million similarly situated persons-including their names, dates of birth, Social Security numbers, member identification numbers, and health insurance information. [ECF No. 37] (“Amended Complaint”) ¶¶ 1-4, 6-7. Defendants provide third-party administrative services in the healthcare space, sharing and storing patients' PII and PHI in the same platform. Id. ¶¶ 21, 25-26.

1

Defendant 20/20 Eye Care is a managed vision care company that provides eye care services and acts as a third-party insurance plan administrator, assisting both insurance companies and patients. Id. ¶¶ 20-21. Defendant iCare acquired Defendant 20/20 Eyecare in September 2020 and exercises some control over 20/20 Eye Care. Id. ¶ 23. Defendant 20/20 Hearing Care manages a network of audiologists, acting as a middleman between managed care plans and their members. Id. ¶ 25.

After the Data Breach occurred, Defendants provided notice to various state Attorneys General explaining that the Data Breach was “insider wrong doing.” Id. ¶ 97. As a result of the Data Breach, the PII and PHI of more than 3.2 million health plan members were potentially accessed, downloaded, and deleted from Defendants' technological platform. Id. ¶ 95. Defendants began notifying victims of the Data Breach in late May of 2021-approximately four months after Defendants became aware of the potential breach. Id. ¶ 100.

Plaintiffs allege that Defendants failed “to implement and maintain adequate and reasonable data security safeguards, fail[ed] to exercise reasonable care in the hiring, training, and supervision of its employees and agents, and fail[ed] to comply with industry-standard data security practices and federal and state laws and regulations governing data security and privacy….” Id. ¶ 6. Plaintiffs maintain these failures and the ensuing Data Breach have caused them numerous and imminent injuries. Id. ¶ 16. Plaintiffs, on behalf of themselves and purported Class Members, assert the following claims: negligence, unjust enrichment, breach of confidence, and a violation of the Florida Deceptive and Unfair Trade Practices Act (FDUTPA). Id. ¶ 18. They seek injunctive relief, declaratory relief, monetary damages, and any other relief as authorized by law. Id. at 60.

Defendants have now moved to dismiss Plaintiffs' Amended Complaint for lack of Article III standing and alternatively, for failure to state a claim upon which relief can be granted.

2

LEGAL STANDARD

I. Lack of Subject Matter Jurisdiction Under Fed.R.Civ.P. 12(b)(1)

One element of the case-or-controversy requirement under Article III of the United States Constitution is that plaintiffs “must establish that they have standing to sue” in federal court. Raines v. Byrd, 521 U.S. 811, 818 (1997). Thus, standing is a “threshold question in every federal case, determining the power of the court to entertain the suit.” Warth v. Sedlin, 422 U.S. 490, 498 (1975).

In the class action context, Article III requires two distinct inquiries to determine whether a class representative has “standing to represent a class.” Fox v. Ritz-Carlton Hotel Company, L.L.C., 977 F.3d 1039, 1046 (11th Cir. 2020) (citing Mills v. Foremost Ins. Co., 511 F.3d 1300, 1307 (11th Cir. 2008)). A class representative must satisfy the individual standing prerequisites for each claim he or she asserts and “must also ‘be part of the class and possess the same interest and suffer the same injury as the class members.'” Id. (citations omitted); see also Preisler v. Eastpoint Recovery Group, Inc., No. 20-62268, 2021 WL 2110794, at *3 (S.D. Fla. May 25, 2021). To be clear, if “we have at least one individual plaintiff who has demonstrated standing, ” we do not need to “consider whether the other ... plaintiffs have standing to maintain the suit.” Wilding v. DNC Servs. Corp., 941 F.3d 1116, 1124-25 (11th Cir. 2019) (citing Arlington Heights v. Metro. Hous. Dev. Corp., 429 U.S. 252, 264 n.9 (1977) (citations omitted)).

To establish the individual standing prerequisites, a plaintiff must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1547 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). These three elements must be supported “with the manner and degree of evidence required at the successive stages of the litigation.” Wilding, 941 F.3d at 1124 (citing Lujan, 504 U.S. at 561); see also 31 Foster Children v. Bush,

3

329 F.3d 1255, 1263 (11th Cir. 2003) (“How much evidence is necessary to satisfy [the standing requirement] depends on the stage of litigation at which the standing challenge is made.”). And plaintiffs must establish standing for each claim that they press and for each form of relief that they seek. TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2208 (2021).

A plaintiff has suffered an injury in fact if he has “suffered ‘an invasion of a legally protected interest' that is ‘concrete and particularized' and ‘actual or imminent, not conjectural or hypothetical.'” Spokeo, 136 S.Ct. at 1548 (quoting Lujan, 504 U.S. at 560). “Central to assessing concreteness is whether the asserted harm has a ‘close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts-such as a physical harm, monetary harm, or various intangible harms….” TransUnion LLC, 141 S.Ct. at 2200. Concrete intangible harms may include reputational harms, disclosure of private information, and intrusion upon seclusion. Id. at 2204 (collecting cases).

Beyond establishing that plaintiff has suffered an injury in fact, plaintiff must allege a “causal connection between the injury and the conduct complained of”-in other words, the injury must be “fairly traceable to the challenged action of the defendant.” Lujan, 504 U.S. at 560 (quotation omitted and alterations adopted). However, Article III standing does not require that the defendant “be the most immediate cause, or even a proximate cause, of the plaintiffs' injuries; it requires only that those injuries be ‘fairly traceable' to the defendant.” Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S.Ct. 1377, 1391 n.6 (2014). “[E]ven harms that flow indirectly from the action in question can be said to be ‘fairly traceable' to that action for standing purposes.” Wilding, 941 F.3d at 1125 (citing Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)).

II. Failure to State a Claim Under Fed.R.Civ.P. 12(b)(6)

“To survive a motion to dismiss, a complaint must contain sufficient factual matter,

4

accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). When reviewing a motion to dismiss pursuant to Rule 12(b)(6), a court must accept as true all factual allegations contained in the complaint, and the plaintiff should receive the benefit of all favorable inferences that can be drawn from the facts alleged. See Chaparro v. Carnival Corp., 693 F.3d 1333, 1337 (11th Cir. 2012); see also Iqbal, 556 U.S. at 678. A court considering a Rule 12(b)(6) motion is generally limited to the facts contained in the complaint and attached exhibits but may also consider documents referred to in the complaint that are central to the claim and whose authenticity is undisputed. See Wilchombe v. TeeVee Toons, Inc., 555 F.3d 949, 959 (11th Cir. 2009). “Dismissal pursuant to Rule 12(b)(6) is not appropriate unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.” Magluta v. Samples, 375 F.3d 1269, 1273 (11th Cir. 2004) (citation and quotation omitted).

ANALYSIS

Defendants raise several arguments in favor of dismissal, including a lack of subject matter jurisdiction under Rule 12(b)(1) and failure to state a claim under Rule 12(b)(6).^[1] The Court will address each argument in turn.

I. Plaintiffs have sufficiently alleged Article III standing.

Of the three standing prerequisites-injury in fact, traceability, and redressability- Defendants challenge two. First, they contend that two of the five named Plaintiffs fail to allege an injury in fact. And second, that all named Plaintiffs fail to plausibly allege traceability. Because

5

Defendants' standing arguments solely address the allegations in the First Amended Complaint rather than any extrinsic materials, this is considered a facial attack, which “requires the [C]ourt merely to look and see if the [P]laintiff[s] ha[ve] sufficiently alleged a basis of subject matter jurisdiction.” See Stalley ex rel. U.S. v. Orlando Reg'l Healthcare Sys., Inc., 524...