Mohammad S. Galaria (15-3386) v. Nationwide Mut. Ins. Co., 15-3386
| Decision Date | 12 September 2016 |
| Docket Number | No. 15-3386,No. 15-3387,15-3386,15-3387 |
| Parties | MOHAMMAD S. GALARIA (15-3386); ANTHONY HANCOX (15-3387), individually and on behalf of all others similarly situated, Plaintiffs-Appellants, v. NATIONWIDE MUTUAL INSURANCE COMPANY, Defendant-Appellee. |
| Court | U.S. Court of Appeals — Sixth Circuit |
HELENE N. WHITE, Circuit Judge. Plaintiffs Mohammad Galaria and Anthony Hancox brought these putative class actions after hackers breached the computer network of Defendant Nationwide Mutual Insurance Company and stole their personal information. In their complaints, Plaintiffs allege claims for invasion of privacy, negligence, bailment, and violations of the Fair Credit Reporting Act (FCRA). The district court dismissed the complaints, concluding that Plaintiffs failed to state a claim for invasion of privacy, lacked Article III standing to bring the negligence and bailment claims, and lacked statutory standing to bring the FCRA claims. In this consolidated appeal, Plaintiffs challenge the dismissal of the negligence, bailment, and FCRA claims. Because we conclude that Plaintiffs have Article III standing andthat the district court erred in dismissing the FCRA claims for lack of subject-matter jurisdiction, we REVERSE and REMAND for further proceedings.
As alleged in the complaints, Nationwide is an insurance and financial-services company that maintains records containing sensitive personal information about its customers, as well as potential customers who submit their information to obtain quotes for insurance products. The data include names, dates of birth, marital statuses, genders, occupations, employers, Social Security numbers, and driver's license numbers. On October 3, 2012, hackers broke into Nationwide's computer network and stole the personal information of Plaintiffs and 1.1 million others.
Nationwide informed Plaintiffs of the breach in a letter that advised taking steps to prevent or mitigate misuse of the stolen data, including monitoring bank statements and credit reports for unusual activity. To that end, Nationwide offered a year of free credit monitoring and identity-fraud protection of up to $1 million through a third-party vendor. Nationwide also suggested that Plaintiffs set up a fraud alert and place a security freeze on their credit reports. However, Nationwide's website explained that a security freeze could impede consumers' ability to obtain credit, and could cost a fee between $5 and $20 to both place and remove. Nationwide did not offer to pay for expenses associated with a security freeze.
Plaintiff Hancox filed a five-count putative class-action complaint against Nationwide in the United States District Court for the District of Kansas, and Plaintiff Galaria filed essentially the same complaint in the United States District Court for the Southern District of Ohio a month later. The Kansas district court transferred Hancox's action to the Ohio district court, which designated the dockets as related. In Counts I and II of the complaints, Plaintiffs allege that Nationwide willfully and negligently violated the Fair Credit Reporting Act (FCRA), Pub. L. No.91-508, 84 Stat. 1114 (1970) (codified at 15 U.S.C. § 1681), by failing to adopt required procedures to protect against wrongful dissemination of Plaintiffs' data. In Counts III, IV, and V, Plaintiffs allege claims for negligence, invasion of privacy by public disclosure of private facts, and bailment, which also arose out of Nationwide's failure to secure Plaintiffs' data against a breach.
In support of their claims, Plaintiffs allege that there is an illicit international market for stolen data, which is used to obtain identification, government benefits, employment, housing, medical services, financial services, and credit and debit cards. Identity thieves may also use a victim's identity when arrested, resulting in warrants issued in the victim's name. According to the complaints, the Nationwide data breach created an "imminent, immediate and continuing increased risk" that Plaintiffs and other class members would be subject to this kind of identity fraud. R. 1, PID 3. Plaintiffs cite a study purporting to show that in 2011 recipients of data-breach notifications were 9.6 times more likely to experience identity fraud, and had a fraud incidence rate of 19%.
Plaintiffs allege that victims of identity theft and fraud will "typically spend hundreds of hours in personal time and hundreds of dollars in personal funds," incurring an average of $354 in out-of-pocket expenses and $1,513 in total economic loss. Id., PID 13. To mitigate this risk, Plaintiffs "have suffered, and will continue to suffer" costs—both "financial and temporal"—that include "purchasing credit reporting services, purchasing credit monitoring and/or internet monitoring services, frequently obtaining, purchasing and reviewing credit reports, bank statements, and other similar information, instituting and/or removing credit freezes and/or closing or modifying financial accounts." Id. The complaints seek damages for, among other things, the increased risk of fraud; expenses incurred in mitigating risk, including the cost ofcredit freezes, insurance, monitoring, and other mitigation products; and time spent on mitigation efforts.
The district court granted Nationwide's motion to dismiss the complaints. First, the district court concluded that Plaintiffs did not have "statutory standing" under the FCRA and thus dismissed the FCRA claims for lack of subject-matter jurisdiction. R. 40, PID 408. Next, the district court addressed whether Plaintiffs had Article III standing to bring their negligence and bailment claims, concluded that Plaintiffs had not alleged a cognizable injury, and dismissed the claims for lack of jurisdiction. Lastly, the district court concluded that Plaintiffs had standing to bring their invasion-of-privacy claim but failed to state a claim for relief, and dismissed that claim with prejudice.
Plaintiffs moved for reconsideration and leave to amend, asserting that the district court erred in dismissing one of their FCRA claims. Plaintiffs did not seek reconsideration of the other four dismissed claims, which were omitted from the proposed amended complaint, but maintained their right to appeal the dismissals. Notably, the proposed amended complaint includes a new allegation that Plaintiff Galaria discovered three unauthorized attempts to open credit cards in his name. After checking with the credit-card companies, he learned that applications to open cards had been made using his name, Social Security number, and date of birth. The district court denied reconsideration and leave to amend, concluding that Plaintiffs had not demonstrated a clear error of law, and that the proposed amendment would not cure any deficiencies in the FCRA claim in any event.
Plaintiffs appeal the dismissal of their FCRA, negligence, and bailment claims for lack of jurisdiction, and the denial of their motions for reconsideration and leave to amend. Plaintiffs do not appeal the dismissal of their invasion-of-privacy claim.
We review de novo the district court's determination of Article III standing. McKay v. Federspiel, 823 F.3d 862, 866 (6th Cir. 2016). "Article III of the Constitution limits the jurisdiction of federal courts to 'Cases' and 'Controversies,'" and "[t]he doctrine of standing gives meaning to these constitutional limits by 'identify[ing] those disputes which are appropriately resolved through the judicial process.'" Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334, 2341 (2014) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). The Supreme Court has explained that "the 'irreducible constitutional minimum' of standing consists of three elements." Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (quoting Lujan, 504 U.S. at 560). A plaintiff "must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of a defendant, and (3) that is likely to be redressed by a favorable judicial decision." Id.
The plaintiff "bears the burden of showing that he has standing," Summers v. Earth Island Institute, 555 U.S. 488, 493 (2009), and "[e]ach element of standing 'must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation.'" Fair Elections Ohio v. Husted, 770 F.3d 456, 459 (6th Cir. 2014) (quoting Lujan, 504 U.S. at 561). "Where, as here, a case is at the pleading stage, the plaintiff must 'clearly . . . allege facts demonstrating' each element." Spokeo, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). The court "must accept as true all material allegations of the complaint, and must construe the complaint in favor of the complaining party." Parsons v. U.S. Dep't of Justice, 801 F.3d 701, 710 (6th Cir. 2015) (quoting Warth, 422 U.S. at 501).
Injury is "the '[f]irst and foremost' of standing's three elements." Spokeo, 136 S. Ct. at 1547 (quoting Steel Co. v. Citizens for Better Env't, 523 U.S. 83, 103 (1998)). "To establish injury in fact, a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (quoting Lujan, 504 U.S. at 560). Where plaintiffs seek to establish standing based on an imminent injury, the Supreme Court has explained "that 'threatened injury must be certainly impending to constitute injury in fact,' and that '[a]llegations of possible future injury' are not sufficient." Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, 1147 (2013) (emphasis in original) (...
To continue reading
Request your trial