Class Action Seeking Monetary and Injunctive Relief Arising from Theft of Personal Information, Allegedly Creating “Increased Risk” of Identity Theft Requiring Monitoring of Credit, Dismissed for Lack of Standing because Putative Class Representative did not Allege his Information was Stolen or had been used or Disclosed so Plaintiff Failed to Establish Injury-in-Fact Missouri Federal Court Holds
Plaintiff filed a putative class action against Express Scripts for negligence, breach of contract, violations of various “data breach notification laws” and violations of Missouri’s Merchandising Practices Act, arising out of the theft of its customers’ personal identification information; the class action complaint alleged that “inadequate security measures in relation to its computerized database system allowed unauthorized persons to gain access to confidential information of Express Scripts members contained in the database, with such information including names, dates of birth, Social Security numbers, and prescription information.” Amburgy v. Express Scripts, Inc., ___ F.Supp.2d ___ (E.D.Mo. November 23, 2009) [Slip Opn., at 1, 3.] Plaintiff filed the class action in federal court, asserting jurisdiction under the Class Action Fairness Act of 2005 (CAFA), _id._, at 3. According to the allegations underlying the class action complaint, the criminals who stole the information advised Express Scripts “that they would make public the confidential information obtained through the breach if Express Scripts did not pay a certain amount of money to them.” _Id._, at 2. Express Scripts advised its customers of the security breach, _id._ The class action alleged that the theft placed class members “at an increased risk of becoming victims of identity theft crimes, fraud, abuse, and extortion,” and that class members would be required to spend “considerable time and money to protect themselves” from injury. _Id._ Defense attorneys moved to dismiss the class action complaint on the grounds that plaintiff lacked standing and that the class action failed to state a claim for relief. _Id._, at 3. The district court granted the motion.
The federal court noted, “Database breaches appear to provide the basis for a new breed of lawsuits, and especially class action lawsuits, in which plaintiffs allege, as here, that the database handlers’ negligence in developing and maintaining security measures have resulted in otherwise personal and confidential information being compromised, thereby increasing the risk of identity theft for those individuals whose information was so compromised. The remedies sought in these actions vary, but generally include costs for credit monitoring, costs for closing and opening financial accounts, and damages for emotional distress.” Amburgy, at 5. The district court observed that federal courts have reached different conclusions as to whether individuals have Article III standing to prosecute such lawsuits, though the “recent trend” has been to find that standing exists based on a Seventh Circuit decision in Pisciotta v. Old Nat’l Bancorp., 499 F.3d 629 (7th Cir. 2007). See id., at 5-7. But the court explained at page 7, “because the requirement of standing is firmly rooted in the Constitution and is not subject to whim, the undersigned is reluctant to look to a ‘recent trend’ when analyzing whether or not a party has standing to sue in federal court.” Accordingly, it examined the standing issue with fresh eyes.
The district court observed that Supreme Court authority requires plaintiff’s injury-in-fact to be “actual or imminent, which has been described by the Supreme Court as certainly impending and immediate — not remote, speculative, conjectural, or hypothetical.” Amburgy, at 8. In this case, however, plaintiff concedes that he does not know whether his personal information was stolen, and “that there has been no publication of any information allegedly wrongfully obtained, nor any fraudulent or otherwise harmful use of such information.” Id., at 9. Instead, plaintiff argues that the security breach creates “an increased risk of identity theft at an unknown point in the future,” which fails to satisfy the requirement that plaintiff’s injury be “imminent.” Id. In other words, because plaintiff was not identified as one of the customers whose personal information was stolen, the risk of future harm is entirely speculative, id., at 10. “Where the timing and type of injury cannot be determined, such abstract injuries do not provide the injury-in-fact required for Article III standing.” Id. Accordingly, plaintiff lacks standing to prosecute the class action claims, id., at 11.
We do not discuss the federal court’s analysis of whether the class action claims stated claims for relief. See Amburgy, at 11-22_._ Because plaintiff lacked standing, the district court dismissed the class action complaint in its entirety. _Id._, at 22.
Download PDF file of Amburgy v. Express Scripts
Comments are closed.