Reilly v. Ceridian Corp.

• Decision Date: 12 December 2011
• Docket Number: No. 11–1738.,11–1738.
• Citation: 664 F.3d 38
• Parties: Kathy REILLY, individually and on behalf of all others similarly situated; Patricia Pluemacher, individually and on behalf of all others similarly situated, Appellants v. CERIDIAN CORPORATION.
• Court: U.S. Court of Appeals — Third Circuit

664 F.3d 38

Kathy REILLY, individually and on behalf of all others similarly situated; Patricia Pluemacher, individually and on behalf of all others similarly situated, Appellants

v.CERIDIAN CORPORATION.

No. 11–1738.

United States Court of Appeals, Third Circuit.

Argued Oct. 27, 2011.Filed Dec. 12, 2011.

Alan S. Pralgever, Esq. (Argued), Greenbaum, Rowe, Smith & Davis LLP, Roseland, NJ, for Appellants.

Steven J. Wells, Esq. (Argued), Bryan C. Keane, Esq., Dorsey & Whitney LLP, Minneapolis, MN, for Appellee.

Before: SLOVITER, GREENAWAY, JR. and ALDISERT, Circuit Judges.

OPINION OF THE COURT

ALDISERT, Circuit Judge.

Kathy Reilly and Patricia Pluemacher, individually and on behalf of all others similarly situated, appeal from an order of the United States District Court for the District of New Jersey, which granted Ceridian Corporation's motion to dismiss for lack of standing, and alternatively, failure to state a claim. Appellants contend that (1) they have standing to bring their claims in federal court, and (2) they stated a claim that adequately alleged cognizable damage, injury, and ascertainable loss. We hold that Appellants lack standing and do not reach the merits of the substantive issue. We will therefore affirm.

I.

A.

Ceridian is a payroll processing firm with its principal place of business in Bloomington, Minnesota. To process its commercial business customers' payrolls, Ceridian collects information about its customers' employees. This information may include employees' names, addresses, social security numbers, dates of birth, and bank account information.

Reilly and Pluemacher were employees of the Brach Eichler law firm, a Ceridian customer, until September 2003. Ceridian entered into contracts with Appellants' employer and the employers of the proposed class members to provide payroll processing services.

On or about December 22, 2009, Ceridian suffered a security breach. An unknown hacker infiltrated Ceridian's Powerpay system and potentially gained access to personal and financial information belonging to Appellants and approximately 27,000 employees at 1,900 companies. It is not known whether the hacker read, copied, or understood the data.

Working with law enforcement and professional investigators, Ceridian determined what information the hacker may have accessed. On about January 29, 2010, Ceridian sent letters to the potential identity theft victims, informing them of the breach: “[S]ome of your personal information ... may have been illegally accessed by an unauthorized hacker.... [T]he information accessed included your first name, last name, social security number and, in several cases, birth date and/or the bank account that is used for direct deposit.” App. 00039. Ceridian arranged to provide the potentially affected individuals with one year of free credit monitoring and identity theft protection. Individuals had until April 30, 2010, to enroll in the free program, and Ceridian included instructions on how to do so within its letter.

B.

On October 7, 2010, Appellants filed a complaint against Ceridian, on behalf of themselves and all others similarly situated, in the United States District Court for the District of New Jersey.¹ Appellants alleged that they: (1) have an increased risk of identity theft, (2) incurred costs to monitor their credit activity, and (3) suffered from emotional distress.

On December 15, 2010, Ceridian filed a motion to dismiss pursuant to Rules 12(b)(1) and 12(b)(6), Federal Rules of Civil Procedure, for lack of standing and failure to state a claim. On February 22, 2011, the District Court granted Ceridian's motion, holding that Appellants lacked Article III standing. The Court further held that, assuming Appellants had standing, they nonetheless failed to adequately allege the damage, injury, and ascertainable loss elements of their claims. Appellants timely filed their Notice of Appeal on March 18, 2011.

II.

We have jurisdiction to review the District Court's final judgment pursuant to 28 U.S.C. § 1291. But “[a]bsent Article III standing, a federal court does not have subject matter jurisdiction to address a plaintiff's claims, and they must be dismissed.” Taliaferro v. Darby Twp. Zoning Bd., 458 F.3d 181, 188 (3d Cir.2006). Hence, we exercise plenary review over the District Court's jurisdictional determinations, see Graden v. Conexant Sys. Inc., 496 F.3d 291, 294 n. 2 (3d Cir.2007), “review[ing] only whether the allegations on the face of the complaint, taken as true, allege facts sufficient to invoke the jurisdiction of the district court,” Common Cause of Penn. v. Pennsylvania, 558 F.3d 249, 257 (3d Cir.2009). We also review de novo a district court's grant of a motion to dismiss for failure to state a claim under Rule 12(b)(6). See Vallies v. Sky Bank, 432 F.3d 493, 494 (3d Cir.2006).

Because the District Court dismissed Appellants' claims pursuant to Rules 12(b)(1) and 12(b)(6), we accept as true all well-pleaded allegations and construe the complaint in the light most favorable to the non-moving party. See Lewis v. Atlas Van Lines, Inc., 542 F.3d 403, 405 (3d Cir.2008).

III.

Appellants' allegations of hypothetical, future injury do not establish standing under Article III. For the following reasons we will therefore affirm the District Court's dismissal.

A.

Article III limits our jurisdiction to actual “cases or controversies.” U.S. Const. art. III, § 2. One element of this “bedrock requirement” is that plaintiffs “must establish that they have standing to sue.” Raines v. Byrd, 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). It is the plaintiffs' burden, at the pleading stage, to establish standing. See Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992); Storino v. Borough of Point Pleasant Beach, 322 F.3d 293, 296 (3d Cir.2003). Although “general factual allegations of injury resulting from the defendant's conduct may suffice,” Lujan, 504 U.S. at 561, 112 S.Ct. 2130, the complaint must still “clearly and specifically set forth facts sufficient to satisfy” Article III. Whitmore v. Arkansas, 495 U.S. 149, 155, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990).

“[T]he question of standing is whether the litigant is entitled to have the court decide the merits of the dispute or of particular issues.” Elk Grove Unified Sch. Dist. v. Newdow, 542 U.S. 1, 11, 124 S.Ct. 2301, 159 L.Ed.2d 98 (2004). Standing implicates both constitutional and prudential limitations on the jurisdiction of federal courts. See Storino, 322 F.3d at 296. Constitutional standing requires an “injury-in-fact, which is an invasion of a legally protected interest that is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Danvers Motor Co. v. Ford Motor Co., 432 F.3d 286, 290–291 (3d Cir.2005) (citing Lujan, 504 U.S. at 560–561, 112 S.Ct. 2130). An injury-in-fact “must be concrete in both a qualitative and temporal sense. The complainant must allege an injury to himself that is ‘distinct and palpable,’ as distinguished from merely ‘abstract,’ and the alleged harm must be actual or imminent, not ‘conjectural’ or ‘hypothetical.’ ” Whitmore, 495 U.S. at 155, 110 S.Ct. 1717 (internal citations omitted).

Allegations of “possible future injury” are not sufficient to satisfy Article III. Whitmore, 495 U.S. at 158, 110 S.Ct. 1717; see also Lujan, 504 U.S. at 564 n. 2, 112 S.Ct. 2130 (stating that allegations of a future harm at some indefinite time cannot be an “actual or imminent injury”). Instead, “[a] threatened injury must be ‘certainly impending,’ ” Whitmore, 495 U.S. at 158, 110 S.Ct. 1717 (internal citation omitted), and “proceed with a high degree of immediacy, so as to reduce the possibility of deciding a case in which no injury would have occurred at all,” Lujan, 504 U.S. at 564 n. 2, 112 S.Ct. 2130; Whitmore, 495 U.S. at 155, 110 S.Ct. 1717 (explaining that the imminence requirement “ensures that courts do not entertain suits based on speculative or hypothetical harms”). A plaintiff therefore lacks standing if his “injury” stems from an indefinite risk of future harms inflicted by unknown third parties. See Lujan, 504 U.S. at 564, 112 S.Ct. 2130.

B.

We conclude that Appellants' allegations of hypothetical, future injury are insufficient to establish standing. Appellants' contentions rely on speculation that the hacker: (1) read, copied, and understood their personal information; (2) intends to commit future criminal acts by misusing the information; and (3) is able to use such information to the detriment of Appellants by making unauthorized transactions in Appellants' names. Unless and until these conjectures come true, Appellants have not suffered any injury; there has been no misuse of the information, and thus, no harm.

The Supreme Court has consistently dismissed cases for lack of standing when the alleged future harm is neither imminent nor certainly impending. For example, the Lujan Court addressed whether plaintiffs had standing when seeking to enjoin the funding of activities that threatened certain species' habitats. The Court held that plaintiffs' claim that they would visit the project sites “some day” did not meet the requirement that their injury be “imminent.” 504 U.S. at 564 n. 2, 112 S.Ct. 2130 (“[W]e are at a loss to see how, as a factual matter, the standard can be met by respondents' mere profession of an intent, some day, to return.”). Appellants' allegations here are even more speculative than those at issue in Lujan. There, the acts necessary to make the injury “imminent” were within plaintiffs' own control, because all plaintiffs needed to do was travel to the site to see the alleged destruction of wildlife take place. Yet, notwithstanding their stated intent to travel to the site at some point in the future—which the Court had no reason to doubt—their harm was not imminent enough to confer standing. See id. Here, Appellants' alleged increased risk of future...