Finesse Express, LLC v. Total Quality Logistics, LLC
| Decision Date | 30 March 2021 |
| Docket Number | Case No. 1:20cv235 |
| Parties | Finesse Express, LLC, et al., Plaintiffs, v. Total Quality Logistics, LLC, Defendant. |
| Court | U.S. District Court — Southern District of Ohio |
OPINION & ORDER
This matter is before the Court upon the Motion to Dismiss, or in the alternative, to Strike Class Allegations filed by Defendant Total Quality Logistics, LLC. (Doc. 16). Plaintiff filed a Response in Opposition (Doc. 18) and Defendants filed Reply (Doc. 19).
Defendant TQL is a freight broker which provides freight transportation and logistics services to customers. (Doc. 1, ¶ 2). Plaintiffs Finesse Express LLC, and Wider Group, Inc. are motor carriers. (Id., ¶ 3). Defendant contracts with motor carriers to pick up and deliver the freight of its customers. (Id., ¶ 2). Plaintiffs both entered into a contract with Defendant called a Broker/Carrier Agreement ("BCA"). (Id. ¶ 61). The BCA contains a "Confidentiality" provision which provides:
In addition to confidential information protected by law, whether statutory or otherwise, the Parties agree that all of their financial information and that of CUSTOMERS, including, without limitation, freight and brokerage rates, amounts received for brokerage services, amounts of freight charges collected, amounts of freight charges paid, freight volume requirements, as well as related CUSTOMER information, CUSTOMER shipping or other logistic requirements shared or learned between the Parties and CUSTOMERS shall be treated as confidential, and shall not be disclosed or used for any reason without prior written consent by the Parties. If confidentiality is breached, the Parties agree that the remedy at law, including monetary damages, may be inadequate and that the Parties shall be entitled, in addition to any other remedy available, to an injunction restraining the violating Party from further violation of this Agreement.
(Doc. 1-2, PAGEID# 41-42).
On February 27, 2020, Defendant emailed its customers and motor carriers to notify them that:
we have uncovered a breach of our IT systems. This breach compromised the security of our online portals for many of our carriers. We believe that external hackers gained access to your tax ID number, bank account numbers, and invoice information, including amounts and dates.
(Doc. 1, ¶¶ 16-17). Plaintiffs allege that as a result of the data breach, they face an "increased risk of fraud and identity theft," and have had "to divert company resources away from transporting freight during a urgent time of nationwide supply-chain crisis, and instead expend company resources monitoring accounts and interfacing with the understaffed IRS to prevent business identity theft and the potentially bankruptcy-inducing problems that could result." (Id., ¶ 8). Plaintiffs also allege that "Finesse and other Class members have already experienced fraudulent transactions and all members will continue to incur damages in the form of, among other things, identity theft, attempted identity theft, lost business opportunities, paid and unpaid overtime, lost time and expenses mitigating harms, increased risk of harm, diminished value of the Confidential Information, loss of privacy, and/or additional damages." (Id.)
In their Complaint, Plaintiffs assert claims on behalf of a nationwide class defined as follows:
All persons whose sensitive personal and business information, including Social Security numbers or Tax ID numbers, bank account numbers, and [sic] was compromised as a result of the Data Breach at Total Quality Logistics, LLC announced in February 2020.
(Id. ¶ 87). Plaintiffs bring four claims: negligence, breach of contract, unjust enrichment, and declaratory and injunctive relief. However, Plaintiffs' breach of contract claim is brought alternatively on behalf of a subclass of motor carriers. The parties agree that Ohio law applies to Plaintiffs' claims.
Defendant argues that Plaintiffs' Complaint should be dismissed pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) for lack of jurisdiction and failure to state a claim upon which relief can be granted. In the alternative, Defendant moves pursuant to Federal Rule of Civil Procedure 23 for an order striking the Complaint's class allegations.
Defendant argues that Plaintiffs' claims should be dismissed under Rule 12(b)(1) for lack of jurisdiction because Plaintiffs lack standing.
"Article III of the Constitution limits the jurisdiction of federal courts to 'Cases' and 'Controversies.'" Susan B. Anthony List v. Driehaus, 573 U.S. 149, 157, 134 S. Ct. 2334, 2341, 189 L. Ed. 2d 246 (2014) (quoting U.S. Const., Art. III, § 2). To establish Article III standing, a plaintiff must have: "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). When a case is at the pleading stage, the plaintiff must clearly allege facts demonstrating each element of standing. See Spokeo, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975)).However, "general factual allegations of injury resulting from the defendant's conduct may suffice, for on a motion to dismiss we 'presume[e] that general allegations embrace those specific facts that are necessary to support the claim.'" Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (quoting Lujan v. National Wildlife Federation, 497 U.S. 871, 889, 110 S.Ct. 3177, 111 L.Ed.2d 695 (1990)).
Defendant maintains that Plaintiffs cannot establish standing because Plaintiffs' allegations do not establish in injury-in-fact or an injury which is fairly traceable to Defendant.
First, Defendant argues that Plaintiffs have failed to plausibly allege an injury in fact. Plaintiffs respond that they have suffered several separate injuries which each independently confer Article III standing: (1) breach of Plaintiffs' contract rights; (2) identity theft; (3) actual losses in time spent responding to data breach; (4) substantial risk of future harm based on increased risk of future identity theft; and (5) diminished value of confidential information.
"To establish injury in fact, a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Spokeo, 136 S. Ct. at 1548. The mere "possib[ility of] future injury," is insufficient to constitute an injury in fact. Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). However, "[a]n allegation of future injury may suffice if the threatened injury is 'certainly impending,' or there is a 'substantial risk' that the harm will occur." Driehaus, 573 U.S. at 158, 134 S.Ct. 2334.
With regard to Plaintiffs' breach of contract claim, Defendant may question whetherPlaintiffs can ultimately prove contract damages, but that is an issue separate and apart from whether they have adequately alleged an injury-in-fact. See Kanuszewski v. Michigan Dep't of Health & Human Servs., 927 F.3d 396, 407 (6th Cir. 2019) (). Here, Plaintiffs have alleged actual damages in the form of company time responding to the data breach (Doc. 1, ¶¶ 78, 81-82) and a lost business opportunity. (Id., ¶ 80). Therefore, Plaintiffs have standing to bring their breach of contract claim. Accord Cain v. Redbox Automated Retail, LLC, 981 F. Supp. 2d 674, 687 (E.D. Mich. 2013) (). In addition, Plaintiffs allege they were deprived of "the value of the Confidential Information for which there is a well-established and quantifiable national and international market." (Doc. 1, ¶ 47). Courts have held that a loss in value of personal information supports a finding that a plaintiff has suffered an injury in fact. See, e.g., also Svenson v. Google, Inc., 2015 WL 1503429, at *5 (N.D. Cal. Apr. 1, 2015) (); but see Chambliss v. Carefirst, Inc., 189 F. Supp. 3d 564, 572 (D. Md. 2016) ().
Defendant argues that Plaintiffs' allegations that it might suffer harm in the future—through identity theft or fraud—are not sufficient to establish standing. There is a circuit split in the federal courts whether an increased risk of future harm due to a data breach is sufficient for Article III standing. In re Rutter's Inc. Data Sec. Breach Litig., No. 1:20-CV-382, 2021 WL 29054, at *5 (M.D. Pa. Jan. 5, 2021) (citing cases). However, as one court has observed, "the differing sets of facts involved in each circuit's decision are what appear to have driven the ultimate decision on standing, not necessarily a fundamental disagreement on the law." In re 21st Century Oncology Customer Data Sec. Breach Litig., 380 F. Supp. 3d 1243, 1251 (M.D. Fla. 2019). This same court has identified the following factors which have courts have considered in their analysis: (1) the alleged motive of the unauthorized third party; (2) the type of...
To continue reading
Request your trial