Pisciotta v. Old Nat. Bancorp
| Citation | 499 F.3d 629 |
| Decision Date | 23 August 2007 |
| Docket Number | No. 06-3817.,06-3817. |
| Parties | Luciano PISCIOTTA and Daniel Mills, on behalf of themselves and others similarly situated, Plaintiffs-Appellants, v. OLD NATIONAL BANCORP, Defendant-Appellee. |
| Court | U.S. Court of Appeals — Seventh Circuit |
William N. Riley (argued), Price Waicukauski Riley & Debrota, Indianapolis, IN, for Plaintiffs-Appellants.
Mark J.R. Merkle (argued), Greg A. Small, Krieg Devault, Indianapolis, IN, for Defendant-Appellee.
Before RIPPLE, WOOD and EVANS, Circuit Judges.
Plaintiffs Luciano Pisciotta and Daniel Mills brought this action on behalf of a putative class of customers and potential customers of Old National Bancorp ("ONB"). They alleged that, through its website, ONB had solicited personal information from applicants for banking services, but had failed to secure it adequately. As a result, a third-party computer "hacker" was able to obtain access to the confidential information of tens of thousands of ONB site users. The plaintiffs sought damages for the harm that they claim to have suffered because of the security breach; specifically, they requested compensation for past and future credit monitoring services that they have obtained in response to the compromise of their personal data through ONB's website. ONB answered the allegations and then moved for judgment on the pleadings under Rule 12(c). The district court granted ONB's motion and dismissed the case. The plaintiffs timely appeal. For the reasons set forth in this opinion, we affirm the judgment of the district court.
ONB operates a marketing website on which individuals seeking banking services can complete online applications for accounts, loans and other ONB banking services. The applications differ depending on the service requested, but some forms require the customer or potential customer's name, address, social security number, driver's license number, date of birth, mother's maiden name and credit card or other financial account numbers. In 2002 and 2004, respectively, Mr. Pisciotta and Mr. Mills accessed this website and entered personal information in connection with their applications for ONB banking services.
In 2005, NCR, a hosting facility that maintains ONB's website, notified ONB of a security breach. ONB then sent written notice to its customers. The results of the investigation that followed have been filed under seal in this court; for present purposes, it will suffice to note that the scope and manner of access suggests that the intrusion was sophisticated, intentional and malicious.
Mr. Pisciotta and Mr. Mills, on behalf of a putative class of other ONB website users, brought this action in the United States District Court for the Southern District of Indiana. They named ONB and NCR as defendants and asserted negligence claims against both defendants as well as breach of implied contract claims by ONB and breach of contract by NCR. The plaintiffs alleged that:
[b]y failing to adequately protect [their] personal confidential information, [ONB and NCR] caused Plaintiffs and other similarly situated past and present customers to suffer substantial potential economic damages and emotional distress and worry that third parties will use [the plaintiffs'] confidential personal information to cause them economic harm, or sell their confidential information to others who will in turn cause them economic harm.
In pleading their damages, the plaintiffs stated that they and others in the putative class "have incurred expenses in order to prevent their confidential personal information from being used and will continue to incur expenses in the future." Id. at 4. Significantly, the plaintiffs did not allege any completed direct financial loss to their accounts as a result of the breach. Nor did they claim that they or any other member of the putative class already had been the victim of identity theft as a result of the breach. The plaintiffs requested "[c]ompensation for all economic and emotional damages suffered as a result of the Defendants' acts which were negligent, in breach of implied contract or in breach of contract," and "[a]ny and all other legal and/or equitable relief to which Plaintiffs . . . are entitled, including establishing an economic monitoring procedure to insure [sic] prompt notice to Plaintiffs . . . of any attempt to use their confidential personal information stolen from the Defendants." Id. at 5-6.
NCR moved to dismiss for failure to state a claim; its motion was granted. This ruling has not been appealed. ONB, the remaining defendant, answered the second amended complaint. The plaintiffs moved for class certification. ONB then filed a motion for judgment on the pleadings under Federal Rule of Civil Procedure 12(c) and a memorandum in opposition to class certification.
The district court granted ONB's motion for judgment on the pleadings and denied the plaintiffs' motion for class certification as moot. Specifically, the district court concluded that the plaintiffs' claims failed as a matter of law because "they have not alleged that ONB's conduct caused them cognizable injury." R.78 at 3. In support of its conclusion, the court noted that, under Indiana law, damages must be more than speculative; therefore, the plaintiffs' allegations that they had suffered "substantial potential economic damages" did not state a claim. Id. (emphasis in original).
The district court looked to five cases from other district courts across the Country that had rejected claims for "the cost of credit monitoring as an alternative award for what would otherwise be speculative and unrecoverable damages." Id. Finding their reasoning persuasive, the district court concluded that "[t]he expenditure of money to monitor one's credit is not the result of any present injury, but rather the anticipation of future injury that has not yet materialized." Id. at 4 (citing Forbes v. Wells Fargo Bank, N.A., 420 F.Supp.2d 1018, 1021 (D.Minn.2006)). The court also concluded that, although not enumerated as a separate cause of action in the complaint, the plaintiffs had made allegations that could relate to a claim for negligent infliction of emotional distress; the court dismissed this claim as well. It noted that, as a matter of Indiana law, any such action was dependent on an underlying negligence claim. Id. at 5. Finally, the court concluded that there could be no action for breach of contract under Indiana law in the absence of an allegation of cognizable damages.
The plaintiffs then timely appealed the entry of judgment for ONB on the claims for negligence and breach of implied contract1 and further asked that this court vacate the order denying class certification as moot.
We review a district court's decision on a 12(c) motion de novo. Moss v. Martin, 473 F.3d 694, 698 (7th Cir.2007). We take the facts alleged in the complaint as true, drawing all reasonable inferences in favor of the plaintiff. Thomas v. Guardsmark, Inc., 381 F.3d 701, 704 (7th Cir.2004). We review the judgment for the defendants by employing the same standard that we apply when reviewing a motion to dismiss under Rule 12(b)(6). Guise v. BWM Mortgage, LLC, 377 F.3d 795, 798 (7th Cir.2004). The complaint must contain only "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a)(2); see also Conley v. Gibson, 355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957). There is no need for detailed factual allegations. Conley, 355 U.S. at 47, 78 S.Ct. 99. However, the statement must "give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Id. "Factual allegations must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, ___ U.S. ___, 127 S.Ct. 1955, 1965, 167 L.Ed.2d 929 (2007); see also Jennings v. Auto Meter Prods., Inc., 495 F.3d 466, 472 (7th Cir.2007).
The plaintiffs filed this action in the district court under the Class Action Fairness Act of 2005, Pub.L. 109-2, § 4, 119 Stat. 4, 9 (codified at 28 U.S.C. § 1332(d)) ("CAFA"), on behalf of a putative class that includes residents of Indiana, Illinois, Kentucky, Missouri, Ohio and Tennessee. Under CAFA, the district court had jurisdiction over this action because "the matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and costs," 28 U.S.C. § 1332(d)(2), and because at least one member of the proposed class is a citizen of a State different from ONB. Id. § 1332(d)(2)(A). In short, subject to limitations not relevant here, CAFA allows for incomplete diversity. Id.; cf. Strawbridge v. Curtiss, 3 Cranch 267, 7 U.S. 267, 2 L.Ed. 435 (1806) (). In calculating the requisite amount in controversy, CAFA requires that the claims of all the plaintiffs be aggregated. 28 U.S.C. § 1332(d)(6); cf. In re Brand Name Prescription Drugs Antitrust Litig., 123 F.3d 599, 607 (7th Cir.1997) ().
We have, of course, an independent responsibility to examine our subject matter jurisdiction. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). As we have noted, in reaching the conclusion that dismissal was appropriate, the district court in this case relied on several cases from other district courts throughout the Country. Many of those cases have concluded that the federal courts lack jurisdiction because plaintiffs whose data has been compromised, but not yet misused, have not suffered an injury-in-fact sufficient to confer Article III standing.2 We are not persuaded by the...
To continue reading
Request your trial
-
In re Sony Gaming Networks & Customer Data Sec. Breach Litig., MDL No.11md2258 AJB (MDD)
...to plead that the monitoring costs were both reasonable and necessary.19 See Stollenwerk, 254 F. App'x at 666; Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 639 (7th Cir. 2007). As a result, courts assessing data breach cases have found that where a state allows recovery for medical monitori......
-
Dinerstein v. Google, LLC, No. 19 C 4311
...of action in a federal statute actually weighs against preemption." Id. at 582 (emphasis in original); see also Pisciotta v. Old Nat. Bancorp , 499 F.3d 629, 634 (7th Cir. 2007) (noting that in a case "invoking CAFA's special rules for diversity jurisdiction," the court's duty with respect ......
-
Freeman v. City of Milwaukee
...a motion under Rule 12(b)(6). Buchanan–Moore v. Cty. of Milwaukee, 570 F.3d 824, 827 (7th Cir.2009) (citing Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 633 (7th Cir.2007)). This means that the Court must treat all of the plaintiff's factual allegations as true and draw all reasonable infe......
-
Int'l Union of Operating Eng'rs Local 139 v. Schimel
..."take the facts alleged in the complaint as true, drawing all reasonable inferences in favor of the plaintiff." Pisciotta v. Old Nat. Bancorp , 499 F.3d 629, 633 (7th Cir. 2007).3. ANALYSIS The plaintiffs argue that Act 1: (1) is preempted by the NLRA; and (2) effects an unconstitutional ta......
-
Medical Monitoring – 50-State Survey
...decisions directly hold that no-injury medical monitoring claims are not permitted under Indiana law: Pisciotta v. Old National Bancorp, 499 F.3d 629, 639 & n.10 (7th Cir. 2007) (“compensable damage requires more than an exposure to a future potential harm”) (applying Indiana law); Barbee v......
-
Live Free, or at Least Have a Present Injury
...883 (11th Cir. 2007). Illinois: Berry v. City of Chicago, 181 N.E.3d 679, 688-89 (Ill. 2020). Indiana: Pisciotta v. Old National Bancorp, 499 F.3d 629, 639 & n.10 (7th Cir. 2007); Hunt v. American Wood Preservers Institute, 2002 WL 34447541, at *1 (S.D. Ind. July 31, 2002); Johnson v. Abbot......
-
First Line Of Defense In Privacy Class Actions - Damages
...absence of pecuniary loss precludes the assertion of statutory or common law causes of action. See, e.g., Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2007). In Pisciotta, the Seventh Circuit disagreed with the courts that had held that the absence of actual damages would deprive ......
-
First There Was Litigation; And Then There Was Standing
...when the data exposed is likely to lead to identity theft. This is supported by the decisions in Pisciotta v. Old Nat'l Bancorp,?499 F.3d 629, 634 (7th Cir. 2007), which found injury in fact when plaintiffs claimed an increased risk of data theft after their information had been accessed by......
-
American Law Institute Proposes Controversial Medical Monitoring Rule in Final Part of Torts Restatement.
...a present physical injury or a reasonable certainty of contracting a disease in the future."). (xiv) Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 639 (7th Cir. 2007) (rejecting claim for credit monitoring after finding no Indiana authority allowing medical monitoring in tort context); John......
-
The State of Data-breach Litigation and Enforcement: Before the 2013 Mega Breaches and Beyond
...of payroll processing firm absent proof hacker "read, copied, and understood" their data).30. Cf. Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007) (finding standing for bank customers due to "increased risk" of future harm following data hack).31. U.S. Hotel & Resort Mgmt, ......
-
How Viable Is the Prospect of Enforcement of Privacy Rights in the Age of Big Data? an Overview of Trends and Developments in Consumer Privacy Class Actions
...security numbers were wrongfully obtained when a laptop containing their personnel records was stolen); Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2007) (explaining that consumers were impacted by hackers stealing information collected on bank's website). But see Lambert v. Hart......
-
Ohio's "aggressive" attack on medical identity theft.
...recover on their breach of contract claim because of their failure to establish compensable damages. See Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629, 639-40 (7th Cir. 2007). The court noted that without more than allegations of increased risk of future identity theft, the plaintiffs had no......