Enslin v. Coca-Cola Co.

• Decision Date: 29 September 2015
• Docket Number: No. 2:14-cv-06476,2:14-cv-06476
• Parties: Shane K. Enslin, on behalf of himself and all others similarly situated, Plaintiff, v. The Coca-Cola Company et al., Defendants.
• Court: U.S. District Court — Eastern District of Pennsylvania

136 F.Supp.3d 654

Shane K. Enslin, on behalf of himself and all others similarly situated, Plaintiff,
v.
The Coca-Cola Company et al., Defendants.

No. 2:14-cv-06476

United States District Court, E.D. Pennsylvania.

Signed September 29, 2015
Filed September 30, 2015

136 F.Supp.3d 658

Donald E. Haviland, Jr., Jay W. Chamberlin, Haviland Hughes LLC, Ambler, PA, for Plaintiff.

Mark S. Melodia, Paul Bond, Reed Smith LLP, Princeton, NJ, Nipun J. Patel, Reed Smith LLP, Philadelphia, PA, for Defendant.

MEMORANDUM OPINION

Joseph F. Leeson, Jr., United States District Judge

Defendants' Motion to Dismiss, ECF No. 10—granted in part and denied in Part

Presently before the Court is the Motion to Dismiss of Defendants The Coca-Cola Company, Coca-Cola Refreshments USA, Inc., Keystone Coca-Cola and Bottling and Distribution Corporation, Keystone Coca-Cola Bottling Company, Inc., Keystone Coca-Cola Bottling Co., and Keystone Coca-Cola Bottling Corporation ("the Coke Defendants"). ECF No. 10. The Coke Defendants seek to dismiss each of Plaintiff Shane K. Enslin's state law and federal law claims. First, pursuant to Rule 12(b)(1), the Coke Defendants argue that Plaintiff has not properly alleged an actual case or controversy, depriving this court of subject matter jurisdiction to hear his claim. Second, pursuant to Rule 12(b)(6), the Coke Defendants move to dismiss all ten of Plaintiff's claims for failing to state a claim upon which relief can be granted. The Court finds that Plaintiff has standing to advance his claims, and for the following reasons, the Court grants in part and denies in part Defendants' Motion to Dismiss.

I. Background

This action arises out of the theft of fifty-five laptops allegedly containing the personal identification information ("PII") of Plaintiff and 74,000 other current and former employees of the Coke Defendants. Compl. ¶¶ 2, 31, 44.

Plaintiff was hired by Defendant Keystone Coca-Cola Bottling Company ("Keystone Coke") in 1996 as a service technician assigned to the Poconos region of Pennsylvania. Id. ¶¶ 16, 49. As part of his employment, Plaintiff was required to provide Keystone Coke with his PII. Id. This PII included Plaintiff's Social Security number ("SSN"), address, bank account information, credit card numbers, driver's license information, and motor vehicle records. Id. ¶¶ 32, 49. Plaintiff's PII was stored by Keystone Coke on one or more laptop computers in an unencrypted format. Id. ¶¶ 16, 31. During his term of employment, the Coke Defendants represented to Plaintiff that, in exchange for his employment, his PII would be securely retained. Id. ¶ 42. In 2007, after eleven

136 F.Supp.3d 659

years of employment, Plaintiff left his job at Keystone Coke. Id. ¶¶ 16, 31

On December 31, 2007, Defendant Coca-Cola Enterprises ("CCE") acquired Keystone Coke as a subsidiary of CCE. Id. ¶ 18. In 2010, The Coca-Cola Company ("Coca-Cola Co.") acquired CCE. Id. ¶ 2. While it is unclear which Coke Defendant controlled Plaintiff's PII at each of the relevant times in Plaintiff's complaint, eventually "laptops assigned to current CCR¹ and former CCE users" containing the PII of Plaintiff and relevant class members made their way into the possession of CCE. Id. ¶¶ 2, 4-6, 44, 46, 49; id. Ex. A, at 1.²

Over a nearly six-year period, beginning in January 2007 and continuing through November 2013, approximately fifty-five of these laptop computers were stolen from CCE. Id. ¶¶ 2, 44. The stolen laptops allegedly contained the PII of over 74,000 people, including Plaintiff. Id. ¶¶ 2, 31, 44. On November 17, 2013, the Coke Defendants discovered that the theft had occurred and undertook efforts to recover the stolen laptops. Id. ¶ 45. By December 10, 2013, the Coke Defendants had recovered all fifty-five stolen laptops. Id.

The Coke Defendants determined that Thomas William Rogers, an employee of CCE responsible for retaining or destroying the laptops, was responsible for the theft of the laptops. Id. ¶¶ 24, 44. Rogers was arrested on June 14, 2014, by Cobb County police and stands charged with felony and misdemeanor theft by taking. Id. Plaintiff alleges that, from these stolen laptops, various, unknown identity thieves were able to gain access to Plaintiff's PII. Id. ¶¶ 25-29, 49.

On February 23, 2014, CCE and Coca-Cola Co. sent a letter to Plaintiff, notifying him of the theft of the laptops and informing him that these laptops may have contained his PII. Id. ¶ 46; id. Ex. A, at 1. The letter also offered Plaintiff a one-year subscription of credit monitoring service. Id. ¶ 47; id. Ex. A, at 1.

A few months after receiving this notification letter, Plaintiff alleges he began to experience unauthorized uses of his finances and identity by unknown persons ("Identity thieves"). Id. ¶ 50. Identity thieves fraudulently purchased $958.44 of merchandise from Bloomingdale's, Inc., and had the merchandise shipped to an address in Staten Island, New York. Id. ¶ 51. The same identity thieves then used money from Plaintiff's checking account to pay this bill. Id. Plaintiff was forced to close that account, incurring a $17.00 charge. Id.

On April 8, 2014, the same identity thieves ordered $825.86 of merchandise from Fingerhut, an online retailer, and had this merchandise shipped to the same Staten Island address. Id. ¶ 52. The identity thieves also attempted to change the addresses for each of Plaintiff's bank accounts to the same address in Staten Island. Id. Plaintiff and his wife expended numerous hours attempting to correct these attempted address changes. Id. Also on April 8, 2014 there was fraudulent activity on two of Plaintiff's Capitol One branded credit cards and his Best Buy credit card. Id. ¶ 53. "With these accounts, the [identity thieves] attempted to pay the outstanding balances from [Plaintiff's] checking account." Id. At various times during these events, the same identity thieves also tried to open new credit cards in Plaintiff's name. Id. ¶ 54. The identity

136 F.Supp.3d 660

thieves also attempted to use Plaintiff's Macy's Department Store credit card and to pay off the balance of the card using his checking account. Id. ¶ 55. In addition, the identity thieves attempted to have new Macy's credit cards shipped to them in Plaintiff's name. Id. On May 1, 2014, the identity thieves successfully changed the address on Plaintiff's Macy's credit card to an address in their control. Id. ¶ 56. Plaintiff was required to expend time and effort in order to revert the changes the identity thieves had made to his Macy's credit card account. Id. Eventually, Plaintiff closed his Macy's credit card account, which required more time and effort. Id. ¶ 57.

On July 4, 2014, an identity thief was able to obtain a job at United Parcel Service of America ("UPS") using Plaintiff's name. Id. ¶ 59. On July 7, 2014, the identity thieves used newly-opened credit card accounts, opened in Plaintiff's name, to make overseas purchases in the Republic of Ireland. Id. ¶ 58. Shortly thereafter, CCE and Coca-Cola Co. contacted Plaintiff and offered him an upgrade to the credit monitoring service originally provided to him. Id. ¶ 60.

Plaintiff brings ten claims on behalf of himself and all others similarly situated. Plaintiff alleges (1) violation of the Driver's Privacy Protection Act, 18 U.S.C. § 2724 (2012), (2)negligence, (3) negligent misrepresentation, (4) fraud, (5) breach of express contract, (6) breach of implied contract, (7) breach of covenant of good faith and fair dealing, (8) unjust enrichment, (9) bailment, and (10) civil conspiracy. Plaintiff claims that he has suffered these injuries due to the negligence of the Coke Defendants in retaining and safeguarding his PII. Compl. ¶¶ 87-90. He further alleges that the Coke Defendants breached their contractual relationship with him when they failed to maintain the security of his PII. Id. ¶¶ 105-29. Plaintiff claims that, after the theft of the laptops containing his PII, the Coke Defendants engaged in misrepresentation, fraud, and conspiracy against him by failing to disclose the true extent of the data breach. Id. ¶¶ 91-104, 134-38. Finally, Plaintiff argues that among his lost PII was his personal driver information, the loss of which constitutes a violation of the Driver's Privacy Protection Act. 18 U.S.C. § 2724 (2012); id. ¶¶ 76-86. Plaintiff seeks actual, punitive, treble, and statutory damages for these harms. Compl. ¶¶ 36-37.

II. Legal Standard

A. Motion to dismiss for lack of standing pursuant to Rule 12(b)(1)

A defendant may move to dismiss an action for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) if the plaintiff lacks standing under Article III of the constitution. Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 101–02, 118, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Article III limits the jurisdiction of federal courts to "actual cases and controversies," U.S. Const. art. III, § 2, and one element of this "bedrock requirement" is that plaintiffs "must establish that they have standing to sue." Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir.2011)(quoting Raines v....