Opinion
CASE NO. 1:10-cv-24513-JLK.
April 5, 2011
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS
THIS CAUSE comes before the Court upon Defendant's Motion to Dismiss (DE #23), filed February 18, 2011. Therein, Defendant seeks the dismissal of Plaintiffs' nine-count First Amended Complaint (DE #15) for the following reasons: 1) failure to state a cognizable injury; and 2) failure to state a claim for any of Plaintiffs' underlying claims.
Plaintiffs filed their Response in Opposition (DE #24) on March 7, 2011, to which Defendant filed a Reply (DE #28) on March 17, 2011. As such, this matter is ripe for determination.
According to the Complaint, Defendant AvMed "is an integrated managed care organization that delivers health care services through health plans and government-sponsored managed care plans to more than 1.2 million individuals throughout the State of Florida and the United States." (DE #15 ¶ 3). The basis for Plaintiffs' claims arises from the theft of several laptops from Defendant's corporate headquarters in Gainesville, Florida. Plaintiffs allege that medical and personal information for over one million AvMed customers was contained within those computers and that, because that information was not encrypted in accordance with industry standards, Plaintiffs were exposed to an "increased risk of identity theft" arising from a third-party's possession of their medical and personal information. Plaintiffs therefore purport to state the following nine causes of action: 1) negligence; 2) breach of contract; 3) breach of implied contracts; 4) restitution/unjust enrichment; 5) violation of the Florida statute prohibiting misleading advertising; 6) negligence per se; 7) breach of fiduciary duty; 8) breach of the implied covenant of good faith and fair dealing; and 9) invasion of privacy.
Furthermore, Plaintiffs allege that Defendant violated certain requirements under HIPAA. (DE #15 ¶¶ 66-70).
Upon consideration of the grounds for dismissal raised by Defendant, the Court finds that Plaintiff's First Amended Complaint must be dismissed in its entirety. As to the first eight counts, Plaintiffs seek to predicate recovery upon a mere specter of injury: a heightened likelihood of identity theft. However, as noted by Defendant, such a possibility of risk does not represent a cognizable injury. See, e.g., Pisciotta v. Old Nat'l Bancorp., 499 F.3d 629, 639-40 (7th Cir. 2007) (finding that "[w]ithout more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy."). Moreover, to the extent that Plaintiffs have alleged that they will be required to expend time and money in the future attempting to combat the possibility of identity theft arising from the allegations contained within the First Amended Complaint, (DE #15 ¶¶ 88, 100, 108, 114, 126, 131, 135, 145, 152), courts have universally found that such prospective injury does not qualify as a cognizable injury. See, e.g., Shafran v. Harley Davidson, No. 07-01365, 2008 WL 763177 (S.D.N.Y. Mar. 30, 2008) (finding no actual injury under circumstances similar to those alleged by Plaintiffs here); Hammond v. The Bank of New York Mellon Corp., No. 08-6060, 2010 WL 2643307 (S.D.N.Y. June 25, 2010) (same). Although Shafran and Hammond were decided under New York law, Plaintiffs have failed to provide any basis for this Court holding that the same does not hold true under Florida law.
The Court notes that, whether the failure to identify a cognizable injury constitutes lack of standing under Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) or instead fails for lack of available remedy at law as in Pisciotta, the result is the same.
While the Court can empathize with Plaintiffs regarding any anxiety they might suffer as a result of the laptop theft at issue here, not every wrong is actionable. Here, the Court need not address the individual actions pleaded by Plaintiffs, as Counts 1 through 8 fail for the same reason: inability to state a cognizable injury. To the extent that Plaintiff Juana Curry alleges that she has suffered actual identity theft and traces that theft back to the theft of computers taken from Defendants' corporate headquarters, the Court finds that her allegations fail to satisfy the standard promulgated by the United States Supreme Court in Bell Atlantic v. Twombly, 550 U.S. 544 (2007).
Finally, as to Count IX of Plaintiffs' First Amended Complaint, the Court also finds that Plaintiffs have failed to satisfy the pleading requirements for a claim of invasion of privacy. Florida law is clear in holding that the tort for invasion of privacy is an intentional one, rather than one sounding in negligence. See Purelli v. State Farm Fire Cas. Co., 698 So. 2d 618, 620 (Fla. 2d DCA 1997). Where, as here, Plaintiffs have alleged only that Defendant was negligent in not taking certain actions to protect the confidential information of its customers, Defendant cannot be held liable for an intentional tort. Moreover, as Plaintiffs have failed to allege that the purloined information is "substantially certain to become public knowledge," their allegations cannot state a cause of action. Williams v. City of Minneola, 575 So. 2d 683, 689 (Fla. 5th DCA 1991).
Accordingly, the Court being otherwise fully advised, it is ORDERED, ADJUDGED, and DECREED that:
1. Defendant's Motion to Dismiss (DE # 23) be, and the same is, hereby GRANTED.
2. If Plaintiffs so elect, they shall FILE a Second Amended Complaint within twenty days of the date of this Order.DONE AND ORDERED in Chambers at the James Lawrence King Federal Justice Building and United States Courthouse in Miami, Florida.