Opinion
Case No. 1:14-cv-324-WKW-PWG
09-02-2015
BRADLEY S. SMITH, JULIE S. MCGEE, ADAM PARKER, SANDRA W. HALL, and JACK WHITTLE, Plaintiffs, v. TRIAD OF ALABAMA, LLC, Defendant.
REPORT AND RECOMMENDATION
This Fair Credit Reporting Act ("FCRA") case arises from the theft of the Plaintiffs' personally identifiable information and personal health information ("PII/PHI") from Defendant Triad of Alabama LLC d/b/a Flowers Hospital ("Defendant") by an employee of Defendant and an unknown accomplice.
15 U.S.C. 1681 et seq.
This putative class action is brought by Plaintiffs Bradley S. Smith ("Plaintiff Smith"), Julie S. McGee ("Plaintiff McGee"), Adam Parker ("Plaintiff Parker"), Sandra W. Hall ("Plaintiff Hall"), and Jack Whittle ("Plaintiff Whittle") (collectively "Plaintiffs"), individually and on behalf of all others similarly situated. There are six counts set out in the Second Amended Complaint, which is the operative pleading. (Doc. 25). There are two federal claims: willful violation of the FCRA (Count I) and negligent violation of the FCRA (Count II). The remaining claims arise under Alabama law and are as follows: negligence/wantonness (Count III); negligence per se (Count IV); invasion of privacy by public disclosure of private facts (Count V); and breach of express or implied contract (Second Count V).
There are two counts identified in the Second Amended Complaint as "Count V."
Before the court is Defendant's motion to dismiss Plaintiffs' Second Amended Complaint (Doc. 26) and brief in support thereof (Doc. 27).
I. JURISDICTION
Though contested by the Defendant on the basis of standing, subject matter jurisdiction over Plaintiffs' federal claims is conferred by 28 U.S.C. § 1331. The court may exercise supplemental jurisdiction over Plaintiffs' state law claims pursuant to 28 U.S.C. § 1367. The parties do not dispute venue or personal jurisdiction, and there are adequate allegations in Plaintiffs' Second Amended Complaint to support both. On November 25, 2014, this matter was referred to the undersigned by Chief U.S. District Judge William Keith Watkins for disposition or recommendation on all pretrial matters. (Doc. 31). See also 28 U.S.C. § 636(b); Rule 72, Fed. R. Civ. P.; United States v. Raddatz, 447 U.S. 667 (1980); Jeffrey S. v. State Board of Education of State of Georgia, 896 F.2d 507 (11th Cir. 1990).
For the reasons stated herein, the Magistrate Judge RECOMMENDS that Defendant's motion to dismiss is due to be GRANTED in part and DENIED in part. II. BACKGROUND AND FACTS
These are the facts for purposes of recommending a ruling on the pending motion to dismiss. They are gleaned exclusively from the allegations in the Second Amended Complaint.
Defendant is a hospital and in the regular course of its business, collects and maintains possession, custody, and control of personal and confidential information of its patients, including names, addresses, dates of birth, Social Security numbers, treating physician and/or departments for each patient, and each patient's medical diagnoses, record numbers, medical service codes, and health insurance information. (Doc. 25 at ¶¶ 27, 28).
Plaintiffs are all individuals who received some form of medical attention from Defendant during the time period of June 2013 until approximately February 2014. (Doc. 25 at ¶¶ 2; 12-13; 15-16; 18-19; 21-22; 24-25). Plaintiffs Smith, McGee, Hall and Whittle were treated at the Defendant Hospital. Plaintiff Parker was a patient at another healthcare facility, but his lab work was forward to Defendant for analysis. (Doc. 25 at ¶¶ 12; 15; 18; 21; 24) )
During the course of their treatment during that time period, Plaintiffs supplied their PII/PHI to Defendant. (Doc. 25 at ¶¶ 13; 16; 19; 22; 25). Defendant stored Plaintiffs' PII/PHI in an unprotected, unguarded, unsecured room on Defendant's premises. The room had little or no security to prevent unauthorized access. (Doc. 25 at ¶¶ 29; 30). The Plaintiffs' PII/PHI was not encrypted. (Doc. 25 at ¶ 29).
During the relevant time period, an employee and/or his unknown accomplice stole from the unsecured room an untold number of laboratory reports and/or files containing Plaintiffs' unencrypted PII/PHI. (Doc. 25 at ¶ 31). The employee has been charged by the State of Alabama with trafficking in stolen identities. (Doc. 25 at ¶ 31). Plaintiffs have all since learned that their Social Security numbers were used by unknown individuals to file in their respective names fraudulent tax returns. (Doc. 25 at ¶¶ 12; 15; 18; 21; 24).
Plaintiffs allege that as a result of Defendant's failure to secure their PII/PHI, they have incurred economic losses related to the theft of their Social Security number and the filing of a fraudulent tax return in their respective names. (Doc. 25 at ¶¶ 14, 17, 20, 23, 26, 34). They also aver that they have incurred out-of-pocket expenses related to mitigation of the increased risk of identity theft and/or identity fraud. (Doc. 25 at ¶ 34). In addition, Plaintiffs allege they have suffered emotional distress and anxiety. Id.
Plaintiffs further allege that personal information is a commodity on the so- called "cyber black market," and that because their Social Security numbers have been compromised, they face a significantly heightened risk of identity theft, identity fraud, and medical fraud. They state that the risk of identity theft or fraud is imminent and immediate. (Doc. 25 at ¶36; 40). Plaintiffs aver that because of the data breach, they will be required to spend money and time mitigating its effects, and specifically enumerate several activities that they will have to engage in to protect themselves from future harm which they contend is imminent, including the following: placing "freezes" and "alerts" with the credit reporting agencies, closing or modifying financial accounts, scrutinizing their bank and credit accounts, and purchasing products to monitor their credit reports and accounts for unauthorized activity. Id.
Defendant has offered to Plaintiffs one year's worth of credit monitoring. (Doc. 25 at ¶35).
III. MOTION TO DISMISS STANDARDS OF REVIEW
Defendant's motion to dismiss is brought pursuant to both Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6).
1. 12(b)(1) motion to dismiss standard of review.
"Motions to dismiss on grounds of an 'injury in fact' implicate constitutional standing principles and are therefore predicated upon Rule 12(b)(1) [...]." JWS Samuel LLC v. Hillsborough County, Fla., 2012 WL 3291831 at fn. 2 (S. D. Fla. Aug. 13, 2012).
The Rule 12(b(1) standard of review was summarized in Greenwell v. University of Alabama Bd. of Trustees, 2012 WL 3637768 (N. D. Ala. Aug. 22, 2012). The court explained:
Challenges to subject-matter jurisdiction under Rule 12(b)(1) of the Federal Rules of Civil Procedure can exist in two substantially different forms: facial attacks and factual attacks. Sinaltrainal v. Coca-Cola Co., 578 F.3d 1252, 1260 (11th Cir. 2009). When presented with a facial attack on the complaint, the court determines whether the complaint has sufficiently alleged subject-matter jurisdiction. Sinaltrainal, 578 F.3d at 1260. The court proceeds as if it were evaluating a Rule 12(b)(6) motion; that is, it views the complaint in the light most favorable to the plaintiff and accepts all well-pled facts alleged in the complaint as true. Id.
On the other hand, factual attacks question "the existence of subject matter jurisdiction in fact, irrespective of the pleadings, and matters outside the pleadings, such as testimony and affidavits, are considered." Id. (citing Lawrence v. Dunbar, 919 F.2d 1525, 1529 (11th Cir. 1990)). When a court is confronted with a factual attack, the standard of review diverges considerably:
Greenwell at *5. (alterations in original).[T]he trial court may proceed as it never could under 12(b)(6) or Fed.R.Civ.P. 56. Because at issue in a factual 12(b)(1) motion is the trial court's jurisdiction—its very power to hear the case—there is substantial authority that the trial court is free to weigh the evidence and satisfy itself as to the existence of its power to hear the case. In short, no presumptive truthfulness attaches to plaintiff's allegations, and the existence of disputed material facts will not preclude the trial court from evaluating for itself the merits of jurisdictional claims.Lawrence, 919 F.2d at 1529 (citing Williamson v. Tucker, 645 F.2d 404, 412 (5th Cir.), cert. denied, 454 U.S. 897 (1981)). When a district court has pending before it both a 12(b)(1) motion and a 12(b)(6) motion, the generally preferable approach, if the 12(b)(1) motion essentially challenges the existence of a federal cause of action, is for the court to find jurisdiction and then decide the 12(b)(6) motion. Jones v. State of Ga., 725 F .2d 622, 623 (11th Cir.1984).
Defendant's motion to dismiss presents a facial attack because it is "based solely on the allegations in the complaint." FCCI Ins. Co. v. McLendon Enterprises, Inc., 2013 WL 1898159 at *1 (S.D. Ga. May 7, 2013)(quoting Gibbs v. United States, 865 F. Supp. 2d 1127, 1135 (S.D. Fla. 2012)(in turn quoting Morrison v. Amway Corp., 323 F.3d 920, 924 n. 5 (11th Cir. 2005). Thus, the factual allegations in Plaintiffs' complaint will be taken as true and construed in the light most favorable to Plaintiffs. See JWS Samuel, supra, at *1. See also Carmichael v. Kellogg, Brown, and Root Servs., Inc., 572 F.3d 1271, 1279 (11th Cir. 2009)(a Rule 12(b)(1) facial challenge applies a Rule 12(b)(6) perspective); Lawrence v. Dunbar, supra at 1528-29 (a facial attack requires the court to accept plaintiff's allegations as true and determine if the complaint sufficiently alleges a basis for subject matter jurisdiction).
Defendant argues in its motion to dismiss that "Plaintiffs' Second Amended Complaint fails to allege facts that would establish that Plaintiffs have suffered an injury in fact that is fairly traceable to the Hospital, [therefore] Plaintiffs lack standing to bring the claims they assert." (Doc. 26 at p. 1)(emphasis supplied). In its brief, it argues that "[t]he law requires certain allegations to be pled in order for a civil lawsuit to be maintained against the Hospital in a case such as this" and that the Second Amended Complaint "fails to make necessary allegations that would allow this lawsuit to proceed." (Doc. 27 at p. 2). Defendant, however, includes in its standard of review section law relevant to factual attacks, which as explained above, trigger consideration of information outside of the pleadings. (Doc. 27 at pp. 3-4). Such consideration of outside materials is unwarranted in this case, and the factual allegations of the Second Amended Complaint will be taken as true at this pleading stage.
2. 12(b)(6) motion to dismiss standard of review.
A Rule 12(b)(6) motion to dismiss tests the sufficiency of the Complaint against the legal standard set forth in Rule 8: "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2).
When evaluating a motion to dismiss pursuant to Rule 12(b)(6), the court must take "the factual allegations in the complaint as true and construe them in the light most favorable to the plaintiff." Pielage v. McConnell, 516 F.3d 1282, 1284 (11th Cir. 2008). However, "the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions." Ashcroft v. Iqbal, 556 U.S. 662, 663 (2009). "[A] plaintiff's obligation to provide the 'grounds' of his 'entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555.
"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). "Determining whether a complaint states a plausible claim for relief [is] ... a context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. at 663 (alteration in original) (citation omitted). "[F]acial plausibility" exists "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly, 550 U.S. at 556). The standard also "calls for enough facts to raise a reasonable expectation that discovery will reveal evidence" of the claim. Twombly, 550 U.S. at 556. While the complaint need not set out "detailed factual allegations," it must provide sufficient factual amplification "to raise a right to relief above the speculative level." Id. at 555.
"So, when the allegations in a complaint, however true, could not raise a claim of entitlement to relief, 'this basic deficiency should ... be exposed at the point of minimum expenditure of time and money by the parties and the court.'" Twombly, 550 U.S. 558 (quoting 5 Wight & Miller § 1216, at 233-34 (quoting in turn Daves v. Hawaiian Dredging Co., 114 F.Supp. 643, 645 (D. Haw. 1953)) (alteration original). "[O]nly a complaint that states a plausible claim for relief survives a motion to dismiss." Iqbal, 556 U.S. at 679 (citing Twombly, 550 U.S. at 556).
In keeping with these principles a court considering a motion to dismiss can choose to begin by identifying pleadings that, because they are no more than conclusions, are not entitled to the assumption of truth.Iqbal, 556 U.S. at 679.
While legal conclusions can provide the framework of a complaint, they must be supported by factual allegations. When there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.
IV. DISCUSSION
A. The Fair Credit Reporting Act (FCRA) claims.
Congress enacted the FCRA "to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information...." 15 U.S.C. § 1681(b)(2012). "To achieve its purpose, the [FCRA] places distinct obligations on three types of entities: consumer reporting agencies, users of consumer reports, and furnishers of information to consumer reporting agencies." Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279, 1286 (N. D. Ala 2014)(citing Chipka v. Bank of Am., 355 Fed. Appx. 380, 382 (11th Cir. 2009)(citing 15 U.S.C. §§ 1681b, 1681m, and 1681s-2).
Plaintiff alleges that Defendant is a consumer reporting agency as defined by the FCRA and that it both willfully and/or recklessly (Count I) and negligently (Count II) violated the FCRA by failing to adopt protective measures to safeguard the Plaintiffs' PII/PHI. Defendant argues that both FCRA claims are due to be dismissed because Plaintiff has not alleged the facts required for standing. Defendant does not contest that it is a consumer reporting agency, and offers no substantive arguments for dismissing the FCRA claims.
Defendant remarks in a footnote in its Supplemental Brief in Support of its Motion to Dismiss (Doc. 33 at fn. 1) that it has "other defenses," including one that it is not a credit reporting agency, that it intends to raise at the summary judgment stage.
Defendant does not argue that the FCRA claims should be dismissed because it did not violate the FCRA or because Plaintiff has failed to allege facts sufficient to demonstrate a violation of the FCRA; rather, Defendants solely argue that the claims should be dismissed because Plaintiffs lack standing.
i. Plaintiffs have alleged an actual injury sufficient to confer Article III standing to assert willful and negligence based FCRA claims.
Jurisdiction must be present before this case can be adjudicated on the merits. To fulfill the minimum requirement that there is a case or controversy under the Constitution and that there exists standing to assert the claims, a plaintiff must show that: "(1) it has suffered an 'injury in fact' that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S. Ct. 693, 704, 145 L. Ed. 2d 610 (2000). "At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice" to show standing, "for on a motion to dismiss [a court] presume[s] that general allegations embrace those specific facts that are necessary to support the claim. Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S. Ct. 2130, 2137, 119 L. Ed. 2d 351 (1992)(internal citations omitted).
The Eleventh Circuit addressed the issue of whether a victim of actual identity theft resulting from a data breach has standing to assert a claim in Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012). In that case, plaintiffs alleged that laptops were stolen from defendant health care plan operator's corporate office and thereafter, their identities were stolen. One plaintiff learned that his sensitive information was used by an unknown third party to open an account with E*Trade Financial, which was then overdrawn. The second plaintiff learned that her sensitive information was used by an unknown third party to open credit accounts with Bank of America, and that subsequently issued credit cards were used to make unauthorized purchases in her name. The second plaintiff also learned that her home address had been changed with the United States Postal Service. Resnick, supra, at 1322.
The Resnick case did not involve the FCRA. The data breach victims in that case brought seven claims arising under Florida state law. This notwithstanding, the Eleventh Circuit's reasoning in the Resnick case is applicable herein.
The Eleventh Circuit, in analyzing the plaintiffs' claims as an issue of first impression, held that plaintiffs had alleged an injury sufficient to confer standing:
Whether a party claiming actual identity theft resulting from a data breach has standing to bring a suit is an issue of first impression in this Circuit. Plaintiffs allege that they have become victims of identity theft and have suffered monetary damages as a result. This constitutes an injury in fact under the law. Via Mat. Int'l S. Am. Ltd. v. United States, 446 F.3d 1258, 1263 (11th Cir. 2006)(finding economic harm sufficient to create standing); see also Lambert v. Hartman, 517 F.3d 433, 437 (6th Cir. 2008).Resnick at 1323. The Resnick court did not, however, clarify whether it was the existence of actual identity theft, or actual identity theft plus monetary damages, that constituted the injury in fact. In any event, the Resnick court made clear that a victim of actual identity theft who alleges monetary damages as a result has alleged an injury in fact sufficient to meet the first prong of the standing analysis.
The Resnick court then addressed whether the plaintiffs' injury was "fairly traceable" to the defendant's actions. It explained as follows:
A showing that an injury is fairly traceable requires less than a showing of 'proximate cause,' Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003). Even a showing that a plaintiff's injury is indirectly caused by a defendant's actions satisfies the fairly traceable requirement. Plaintiffs allege that [Defendant] failed to secure their information on company laptops, and that those laptops were subsequently stolen. Despite Plaintiff's personal habits of securing their sensitive information, Plaintiffs became victims of identity theft after the unencrypted laptops containing their sensitive information were stolen. For purposes of standing, these allegations are sufficient to 'fairly trace' their injury to [Defendant's] failures.Resnick at 1324.
Finally, the Resnick court addressed whether plaintiffs had shown that a favorable resolution of the case in their favor could redress their alleged injuries. The court stated: "Plaintiffs allege a monetary injury and an award of compensatory damages would redress that injury. Plaintiffs have alleged sufficient facts to confer standin[g]." Id. at 1324.
In the instant case, Defendant argues that Plaintiffs have failed to demonstrate the existence of the three factors necessary for standing. Though they were given careful consideration, Defendant's arguments are ultimately unpersuasive.
a. Plaintiffs have alleged an injury in fact.
In their Second Amended Complaint, Plaintiffs allege that during the relevant time period, an employee and/or his unknown accomplice stole from the unsecured room an untold number of laboratory reports and/or files containing Plaintiffs' unencrypted PII/PHI. (Doc. 25 at ¶ 31). Plaintiffs have all since learned that their Social Security numbers were used by unknown individuals to file in their respective names fraudulent tax returns. (Doc. 25 at ¶¶ 12; 15; 18; 21; 24). Plaintiffs further allege that as a result of Defendant's failure to secure their PII/PHI, they have incurred economic losses/damages related to the theft of their Social Security number and the filing of a fraudulent tax return in their respective names. (Doc. 25 at ¶ 14). They also aver that they have incurred out-of-pocket expenses related to mitigation of the increased risk of identity theft and/or identity fraud. (Doc. 25 at ¶ 34). In addition, Plaintiffs allege they have suffered emotional distress and anxiety. Id.
Plaintiffs further allege that personal information is a commodity on the so-called "cyber black market," and that because their Social Security numbers have been compromised, they face a significantly heightened risk of identity theft, identity fraud, and medical fraud. They state that the risk of identity theft or fraud is imminent and immediate. (Doc. 25 at ¶ 36; 40). Plaintiffs aver that because of the data breach, they will be required to spend money and time mitigating its effects, and specifically enumerate several activities that they will have to engage in to protect themselves from future harm which they contend is imminent, including the following: placing "freezes" and "alerts" with the credit reporting agencies, closing or modifying financial accounts, scrutinizing their bank and credit accounts, and purchasing products to monitor their credit reports and accounts for unauthorized activity. Id.
Defendant contends the above allegations fail to show an actual injury and that Plaintiffs' reliance "in part" on possible future injuries to substantiate their FCRA claims is insufficient for standing purposes. (Doc. 27 at pp. 6). Defendant admits that Plaintiffs allege that their Social Security numbers were used to file fraudulent tax returns in their names, but argues that because Plaintiffs have not alleged that the filing of the fraudulent tax returns "resulted in any monetary loss," they have failed to plead facts sufficient to conclude that they have suffered an injury in fact. Defendant also argues that in order to establish standing, Plaintiffs must allege that their respective identities were "misused because of the breach and also that they suffered some un-reimbursed or out of pocket expense." (Doc. 27 at p. 7).
Defendant relies on Resnick for its contention that a plaintiff must allege economic damages in FCRA cases in order to have standing. As an initial matter, Defendant stretches the Eleventh Circuit's holding in Resnick beyond its limits. The Eleventh Circuit's holding with regard to the plaintiffs' efforts to meet the injury in fact requirement was notably succinct. It held: "Plaintiffs allege that they have become victims of identity theft and have suffered monetary damages as a result. This constitutes an injury in fact under the law." Resnick at 1323. The Eleventh Circuit did not hold—as Defendant contends—that FCRA claims "requir[e] actual economic damages in order to confer standing on an alleged identity theft victim." (Doc. 27 at p. 7). Moreover, this court does not read the Resnick court's holding to stand for such a blanket statement of law.
In light of its holding that the plaintiffs' allegations of identity theft and economic damage were sufficient to allege an injury in fact, the Eleventh Circuit did not address whether allegations of damages of a non-economic nature would be sufficient for standing purposes. As noted, supra, the Resnick court did not make clear whether it was the existence of actual identity theft or the existence of identity theft and monetary damages that led the court to determine the plaintiffs had standing. The Resnick court noted that several circuit courts had found that the "threat of future identity theft is sufficient to confer standing in similar circumstances," but explained that because the plaintiffs "have alleged only actual—not speculative—identity theft, we need not address the issue of whether speculative identity theft would be sufficient to confer standing." Resnick, supra, at fn. 1.
Defendant relies on Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279 (N. D. Ala. 2014) for its contention that "in order for a consumer to have standing to pursue claims resulting from a data breach, the consumer must not only allege his or her identity was actually misused as a result of the breach, but the consumer must also allege that he/she suffered some un-reimbursed or out-of-pocket expense." (Doc. 27 at p. 7). Defendant also stretches the holding in the Burton case past its intended limits. This notwithstanding, even if the Burton decision explicitly espoused the principle as stated by Defendant, the Burton case is not binding on the court. Nonetheless, because it is from within the Eleventh Circuit, it bears a brief analysis.
The other, out-of-circuit case that Defendant cites for this principle was recently reversed. See Remijas v. Neiman Marcus Group, LLC, 2015 WL 4394814 (7th Cir. July 20, 2015)(reversing district court's decision that victims of identity theft whose credit cards were compromised had suffered no injury in fact sufficient for standing because they had been reimbursed for the unauthorized charges).
The Burton court, before denying the defendant's motion to dismiss and ordering the plaintiff to re-file his complaint, opined that if plaintiff could not "plausibly allege and ultimately prove his actual damages (for example, an allegation that the charges on his account were not forgiven, and he had to pay for the charges), then the Court must dismiss the claim for lack of subject matter jurisdiction." Burton at 1285. The Burton court then stated the plaintiff's "current allegation that his debit card was used for just under $300.00 of unauthorized purchases" is "not sufficient to survive a Rule 12(b)(1) challenge." Id. The Burton court did not—as Defendant contends— explicitly hold that a plaintiff must allege in a complaint that "he/she suffered some un-reimbursed or out-of-pocket expense." (Doc. 27 at p. 7). Moreover, the court's statements were in the context of explaining to the plaintiff how he should re-plead his claim in a new complaint, and as such are dicta.
But, assuming the language is not dicta and the Burton court's holding indeed stands for the above proposition, this court is unaware of any binding precedent holding the same, especially in light of the Supreme Court's holding in Lujan that at the pleading stage, general allegations of injury may be sufficient for standing purposes. See Lujan at 561.
The Burton court, in analyzing a negligence claim arising under Alabama law, held that the plaintiff's allegations of identity theft and unauthorized use of his debit card were not sufficient to survive a 12(b)(1) challenge to subject matter jurisdiction. To the extent Defendant intends this court to apply the Burton court's reasoning regarding the state law negligence claim in that case, it is difficult to reconcile the Burton court's reasoning with the Eleventh Circuit's holding in Resnick. There is no precedent binding on this court stating that for standing purposes, a victim of identity theft must allege that he or she suffered economic damages or that he/she suffered an un-reimbursed or out-of-pocket expense, and this court will not so hold.
The Burton court does not explain how it came to the conclusion that monetary damages in the amount of $300.00 are insufficient to allege an injury for standing purposes. It appears the Burton court, in applying Alabama law regarding negligence claims, may have equated the amount of $300.00 with "nominal damages." This court is unaware of binding precedent holding that nominal damages are insufficient to confer standing on a victim of identity theft pursuing a FCRA claim or that plaintiffs pursuing a FCRA claim must allege a threshold amount of monetary damages in order to establish standing. The Eleventh Circuit in Resnick held that a data breach victim who alleges monetary damages—not monetary damages of a certain amount—has stated an injury in fact sufficient for standing purposes.
The Eleventh Circuit in Resnick held that a victim of actual identity theft who alleges monetary damage has alleged an injury in fact sufficient to meet the first prong of the standing analysis. Though sparse the Plaintiffs' allegations may be, the Plaintiffs allege that they entrusted their PII/PHI to Defendant, that their PII/PHI was left unsecured, that a data breach occurred, that fraudulent tax returns were subsequently filed, and that they suffered economic damage/losses as a result. In light of the Supreme Court's holding in Lujan that at the pleading stage, general allegations of injury may be sufficient for standing purposes and the Eleventh Circuit's holding in Resnick, these allegations, which are taken as true at this juncture, are sufficient to survive Defendant's motion to dismiss. The case should proceed to discovery. The court recognizes that Plaintiffs may eventually not be able to provide an adequate factual basis for the inference, but they have no such burden at the 12(b)(1) stage. The Defendant may investigate the nature and extent of Plaintiffs' alleged economic damage and if it so desires, raise the issue of standing at that time.
See Remijas v. Neiman Marcus Group, LLC, 2015 WL 4394814 (7th Cir. 2015).
Defendant spends considerable time briefing the issue of whether an identity theft victim whose information was used to file a fraudulent tax return can even allege that the fraudulent filing resulted in economic loss to them, because the IRS provides refunds to victim taxpayers, though sometimes with a delay. This issue is, of course, fact-dependent. Defendant is entitled to discovery regarding the same, after which it may again raise the issue.
In part due to this court's order for supplemental briefing on the issue of an actual injury in fact, the parties engaged in significant briefing regarding whether a data breach victim who alleges imminent, prospective injuries resulting from expected future identity theft has alleged an injury in fact sufficient to establish standing. The Eleventh Circuit has not addressed this question, and courts nationwide that have addressed the issue have reached divergent conclusions. The parties also briefed the issue of whether or not monetary expenditures for prophylactic measures to prevent future identity theft (such as credit monitoring) are sufficient to satisfy the injury in fact prong of the standing analysis. The Eleventh Circuit has not weighed in on this issue, and courts nationwide are split on the issue. Finally, the parties briefed the issue of whether Plaintiffs have standing by sheer virtue of having alleged a violation of the FCRA. Again, the Eleventh Circuit has not weighed in on this issue, and courts nationwide disagree. Nevertheless, because Plaintiffs have alleged actual identity theft and an economic injury, which together constitute an injury in fact sufficient to meet the first prong of the standing analysis, it is not necessary to reach the questions of whether Plaintiffs would have standing on other, independent bases.
See Doc. 32.
See e.g., Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010)(finding an injury in fact where plaintiffs alleged a data breach and threat of identity theft, but no actual identity theft); Pisciotta v. Old Nat'l Bancorp., 499 F.3d 629, 634 (7th Cir. 2007)(same); Cf. Reilly v. Ceridian Corp., 664 F.3d 38 (3rd Cir. 2011)(holding that allegations of an increased risk of identity theft resulting from a security breach are insufficient to confer standing); Galaria v. Nationwide Mut. Ins. Co., 998 F. Supp. 2d 646 (S.D. Ohio 2014)(same).
See e.g., In re Sony Gaming Networks and Customer Data Security Breach Litigation, 903 F. Supp. 2d 942 (S. D. Ca. 2012)(holding that data breach victims who alleged that their sensitive personal information was wrongfully disseminated, thereby increasing the risk of future harm to them, had standing as the future harm was a cognizable loss sufficient to satisfy the injury in fact requirement); Cf. In re Science Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, 45 F. Supp. 3d 14 (D. D.C. 2014)(holding that the cost of credit monitoring and other preventative measures taken subsequent to a data breach cannot create standing).
See e.g., Robins v. Spokeo, Inc., 742 F.3d 409 (9th Cir. 2014)(holding that with regard to willful violations of the FCRA, a plaintiff is not required to show actual harm and need only allege a violation of the FCRA to have standing); Beaudry v. TeleCheck Servs., Inc., 579 F.3d 702, 705-707 (ruling that the FCRA "permits recovery when there are no identifiable or measurable actual damages"); Murray v. GMAC Mortg. Corp., 434 F.3d 948, 952-53 (7th Cir. 2006)(ruling that the FCRA "provide[s] for modest damages without proof of injury."); Hammer v. Sam's East, Inc., 754 F.3d 492 (8th Cir. 2014)(similar holding regarding the Fair and Accurate Credit Transactions Act (FACTA)). Cf. Sterk v. Best Buy Stores, L.P., et al., 2012 WL 5197901 (N.D. Ill. Oct. 17, 2012)(holding in the context of the Video Privacy Protection Act (VPPA) that data breach victims did not have standing solely because the VPPA provided for statutory penalties).
The parties are not precluded from raising these issues at the summary judgment stage.
b. Plaintiffs' alleged injury is fairly traceable to alleged actions of Defendant.
"A showing that an injury is fairly traceable requires less than a showing of 'proximate cause.'" Resnick at 1324 (citing Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)). "Even a showing that a plaintiff's injury is indirectly caused by a defendant's actions satisfies the fairly traceable requirement." Id.
Defendant repeatedly refers to "causation" in its argument that Plaintiffs have failed to show that their injuries are fairly traceable to Defendant's actions. (Doc. 27 at pp. 11-12). Whether proximate cause is present is not the salient question with regard to the "fairly traceable" inquiry.
Defendant takes liberties in its summary of Resnick's reasoning with regard to the "fairly traceable" requirement. Defendant states in its motion to dismiss that the Resnick court reasoned that the following must be shown in order to show that an injury is fairly traceable to a defendant's action: "(1) that the plaintiff gave the defendant his/her personal information; (2) the Plaintiffs' identity theft occurred in a time period after a data breach involving the defendant occurred; and (3) the plaintiff previously has not suffered any such incidents of identity theft."
The Resnick court did not so hold with regard to the "fairly traceable" requirement. It stated—in full—the following regarding the second prong of the standing analysis:
A showing that an injury is fairly traceable requires less than a showing of 'proximate cause,' Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003). Even a showing that a plaintiff's injury is indirectly caused by a defendant's actions satisfies the fairly traceable requirement. Plaintiffs allege that [Defendant] failed to secure their information on company laptops, and that those laptops were subsequently stolen. Despite Plaintiff's personal habits of securing their sensitive information, Plaintiffs became victims of identity theft after the unencrypted laptops containing their sensitive information were stolen. For purposes of standing, these allegations are sufficient to 'fairly trace' their injury to [Defendant's] failures.Resnick at 1324. Defendant extracted the above "factors" from the Resnick court's analysis—in a separate section of the opinion—regarding whether the plaintiffs had pled sufficient facts of causation to have stated various claims arising under Florida law relating to identity theft. Resnick at 1325-1327. The Resnick court was not discussing the "fairly traceable" requirement at that time and did not hold that plaintiffs must allege the three factors enumerated in Defendant's brief in order to establish standing.
Again, Defendant does not raise such a 12(b)(6) challenge to the FCRA claims, arguing that the claims should be dismissed solely because Plaintiffs lack of standing.
Plaintiffs allege that they entrusted their PII/PHI to Defendant and that Defendant did not secure it. They allege that a data breach resulted, and that their information was among that which was stolen. They further allege that their information was subsequently used to file fraudulent tax returns in their respective names. Plaintiffs have alleged sufficient facts to show that their injuries can be fairly traced (whether directly or indirectly) to Defendant's actions in failing to secure their PII/PHI. Plaintiffs have met the second prong of the standing analysis.
Defendant's arguments that Plaintiffs' injuries are not fairly traceable because they fail to allege "a sequential connection"of the use of their personal information after the data breach is unpersuasive. Plaintiffs allege that they entrusted their PII/PHI to Defendant between June 2013 and February 2014 and that they recently learned that fraudulent tax returns had been filed in their name. They have alleged sufficient facts to show that the tax returns were filed after the breach. Defendant's argument that Plaintiffs' claim is not fairly traceable because they fail to allege that they have never before been victims of identity theft is also not persuasive. Defendant cites no binding case law holding that such an allegation is required. While Resnick acknowledged that Plaintiffs had not been victims of identity theft before, it did not base its holding that they possessed standing on that fact.
c. A favorable resolution could redress Plaintiffs' alleged injuries.
As noted above, the Resnick court addressed whether plaintiffs had shown that a favorable resolution of the case in their favor could redress their alleged injuries. The court stated: "Plaintiffs allege a monetary injury and an award of compensatory damages would redress that injury. Plaintiffs have alleged sufficient facts to confer standin[g]." Resnick at 1324. The Plaintiffs herein have alleged economic injuries and as in Resnick, an award of compensatory damages would redress an economic injury. Plaintiffs have met the third prong of the standing analysis.
B. The state law claims.
Plaintiffs' complaint contains claims the following claims arising under Alabama law: negligence/wantonness (Count III); negligence per se (Count IV); invasion of privacy by public disclosure of private facts (Count V); and breach of express or implied contract (Second Count V).
Though Defendant does not make it entirely clear, to the extent it intends its argument regarding standing to apply equally to the state law claims as it does the FCRA claims, the motion to dismiss is due to be denied. Plaintiffs have alleged sufficient facts to establish standing at the 12(b)(1) stage.
Defendant does not make a 12(b)(6) challenge to Plaintiffs' negligence/wantonness claim, but makes challenges to Plaintiffs' remaining state law claims for negligence per se, invasion of privacy, and breach of contract. Each is discussed in turn hereinbelow.
i. Plaintiffs have plausibly alleged a claim for negligence per se.
Plaintiffs allege The Health Insurance Portability and Accountability Act (HIPAA) sets forth and otherwise establishes "duties in the industry that were applicable to [Defendant]." (Doc. 25 at ¶ 88). Plaintiffs further allege that Defendant's failure to safeguard and protect the Plaintiffs' PII/PHI, which violated HIPAA and resulted in the unauthorized disclosure of their information and subsequent damages, constituted negligence per se. (Doc. 25 at ¶ 88-94).
45 C.F.R. § 160.
Plaintiffs also allege in their Second Amended Complaint that "Alabama state law referenced above," places duties on Defendant and serves as the standard for their negligence per se claim; however, they later abandon this basis for their claim. (Doc. 25 at ¶ 88). Plaintiffs concede in their brief opposing Defendant's motion to dismiss that they failed "to cite the Alabama state law providing one of the foundations for their negligence per se claim," and state, "Plaintiffs have nevertheless pled all required elements of a valid claim of negligence per se resulting from a violation of [HIPAA]." (Doc. 29 at p. 9).
Defendants challenge the validity of the claim, arguing that HIPAA does not provide a private cause of action or a standard of care that could serve as the basis for Plaintiffs' negligence per se claim. Plaintiffs do not dispute Defendants' first argument, and confirm that they are not seeking to assert a private cause of action under HIPAA, but argue HIPAA is a proper basis for a negligence per se claim.
Defendant presents no binding precedent holding that a HIPAA violation is not a proper basis for a negligence per se claim under Alabama law. This court has undertaken a brief search of law from within Alabama and the Eleventh Circuit has been unable to find case law which speaks directly to this issue. There is, however, Alabama case law holding that even where a private right of action is not contemplated by a statute, the statute can still serve as the basis of a negligence per se claim. See Allen v. Delchamps, Inc., 624 So.2d 1065, 1067-68 (Ala. 1993)(acknowledging that no private cause of action exists under the Food, Drug and Cosmetic Act (FDCA), but allowing a negligence per se claim to proceed stating: "[T]he plaintiffs in this case are not suing directly under the FDCA or its accompanying regulations. Rather, they are relying on the regulations to establish a duty or standard of care.").
Defendant cites out-of-circuit precedent in support of its contention, none of which is binding on this court.
In light of Defendant's failure to provide precedent binding on this court holding that HIPAA cannot serve as the basis of a negligence per se claim, coupled with the Allen decision, which indicates Alabama court's willingness to allow statutes that do not otherwise provide private causes of action to serve as the basis for a negligence per se claim, Plaintiffs' negligence per se claim is not due to be dismissed on the basis that it is not cognizable as a matter of law.
Defendants argue that even if HIPAA can serve as the basis of a negligence per se claim, Plaintiffs have failed to allege facts to satisfy the requisite elements for the same. "To establish that a violation of a statute constitutes negligence per se, a plaintiff must meet a four pronged test: '(1) the statute must have been enacted to protect a class of persons, of which the plaintiff is a member; (2) the injury must be of the type contemplated by the statute; (3) the defendant must have violated the statute; and (4) the defendant's statutory violation must have proximately caused the injury.'" Johnson v. Food Giant Supermarkets, Inc., 2015 WL 3629777 at *3 (M. D. Ala. Jun. 10, 2015)(citing Parker Bldg. Servs. Co. v. Lightsey ex rel. Lightsey, 925 So.2d 927, 931 (Ala.2005)).
Defendant contests the first and fourth factors. (Doc. 27 at p. 18). Defendant first argues that HIPAA was not enacted to protect a particular class of citizens. Defendant cites no precedent, much less that which is binding, holding that HIPAA was not enacted to protect a particular class of citizens such that it cannot be considered the source of a duty or standard of care for a negligence per se claim. This court has, again, undertaken a brief a brief search of law from within Alabama and the Eleventh Circuit has been unable to find case law which speaks directly to this issue. Defendant has not provided the court with a basis, rooted in controlling precedent, to dismiss this claim on the basis that HIPAA is not intended to protect a particular class of citizens; therefore, the claim is not due to be dismissed.
Defendant states in a footnote that "Plaintiff cannot meet the third element, which is actually showing a statutory violation under HIPAA," but states that the third element is not addressed in the motion. (Doc. 27 at fn. 5).
Defendant cites in support of this argument a non-binding case from the Middle District of Alabama holding that the Fair Debt Collection Practices Act ("FDCPA"), which protects consumers, is not intended to protect a class narrower than the general public and that it therefore cannot serve as the basis of a negligence per se claim. See Winberry v. United States Collection Bureau, Inc., 697 F. Supp. 2d 1279. The court is not persuaded that a privacy law designed to protect patients who receive healthcare and entrust to their provider confidential personal information is analogous to one designed to protect all consumers. See 15 U.S.C. § 1692a(3)(a consumer is any natural person obligated or allegedly obligated to pay any debt).
Defendant also argues that Plaintiffs cannot establish causation of damages resulting from the HIPAA violation. (Doc. 27 at p. 22). Defendant, relying on a case from the Eastern District of Pennsylvania, argues that the hospital's failure to safeguard patient information did not proximately cause the Plaintiffs' claimed damages because there were "multiple intervening acts [including the theft perpetrated by the hospital employee] between the alleged HIPAA violation and the harm alleged by Plaintiffs." (Doc. 27 at p. 23). The question of whether intervening causes broke the chain of causation such that Plaintiff cannot sustain a claim of negligence per se against Defendant is one that necessarily requires a factual inquiry; therefore, the negligence per se claim is not due to be dismissed on this basis.
See Citizens Bank of Pennsylvania v. Reimbursement Technologies, Inc., et al., 2014 U.S. Dist. LEXIS 82098 (E.D. Pa. 2014).
Ultimately, Plaintiffs allege that HIPAA provides for privacy of patients' confidential information and that they were such patients. Plaintiffs further allege that Defendant violated the standard of care regarding privacy established by HIPAA, that the Defendant's violation led to their alleged damages. In light of the foregoing, the Plaintiffs' negligence per se claim is not due to be dismissed at this juncture.
This recommendation is not to be read as a conclusion that Plaintiff has established that Defendant was negligent per se. Rather, because Defendant has provided no binding precedent demonstrating that such a claim is not cognizable as a matter of law and because a factual inquiry is necessary to make a determination as to the balance of Defendant's arguments, the claim should proceed to discovery.
ii. Plaintiffs have not plausibly alleged a claim for invasion of privacy by public disclosure of private facts.
Plaintiffs allege that Defendant's failure to secure their PII/PHI constituted and continues to constitute an ongoing invasion of their privacy because their PII/PHI has been publicly disclosed. (Doc. 25 at ¶¶ 95-99). Defendant argues the Plaintiffs have failed to allege facts sufficient to support the existence of a "public disclosure" required to establish the tort of invasion of privacy was committed. Defendant further argues that Plaintiffs "equate theft by an employee with disclosure." (Doc. 27 at pp. 27-28). Plaintiffs clarify this argument in their reply brief, arguing that if a disclosure was made, it was made by the Defendant's employee who stole the information, not by the Defendant itself. (Doc. 30 at pp. 11-14). Defendant's argument that Plaintiffs have failed to allege facts to support the existence of a public disclosure is unpersuasive. However, Defendants' second argument is well-taken.
Defendant further argues, apparently out of an abundance of caution that in the event that Plaintiffs intended to pursue such a claim, Plaintiffs' allegations are insufficient to support a claim of vicarious liability against the Defendant for the actions of its employee. There does not appear to be such a claim in Plaintiffs' complaint, and the court interprets Plaintiffs' silence on that issue in their reply brief as admission of the same.
Defendant cites Key v. Compass Bank, Inc., 826 So.2d 159 (Ala. Civ. App. 2001) in support of its argument that Plaintiffs cannot hold Defendant liable for invasion of privacy absent allegations that the Defendant itself publicly disclosed the confidential information. In Key, the plaintiffs sought to hold a bank liable for invasion of privacy because it, as part of an investigation, gave photographs to a police officer, who then published them to general public. The court held that the bank had not invaded the privacy of the plaintiffs, explaining:
We note that the plaintiffs argue that [the Bank] should have foreseen that [the police officer] would publish the photographs to the general public through the course of his investigation of the forgery, and that, therefore, [the Bank] should be liable under this cause of action. However, the cause of action for this form of invasion of privacy [giving publicity to private information] addresses only the defendant's actual conduct; it does not address liability for the allegedly foreseeable consequences of that conduct. This court is not willing to so broadly expand this cause of action for invasion of privacy [...].Key at 167. In the instant case, Plaintiffs allege that Defendants "intentionally, willfully, recklessly, negligently, and/or wantonly" failed to take the necessary precautions to protect Plaintiffs' PII/PHI and that such failure resulted in their information being stolen and then disseminated. (Doc. 25 at ¶ 2). However, as in Key, Plaintiffs do not allege that Defendant itself actually disseminated the information to the public. The claim is due to be dismissed as a matter of law.
iii. Plaintiffs have plausibly alleged a claim for breach of express or implied contract.
Plaintiffs allege that Defendant "had a written understanding with the Plaintiffs ... as set forth in [its] Notice of Privacy Practices that [it] would not disclose Plaintiffs' ... confidential information in a manner not authorized by applicable law or industry standards." (Doc. 25 at ¶ 101). Plaintiff argues that the "Notice of Privacy Practices" constituted an express contract or at the very least created a meeting of the minds that was inferred from the conduct of the parties." (Doc. 25 at ¶ 102). Defendants contests the existence of both as well as the breach of the same.
a. Express contract
Defendant attaches to the motion to dismiss the Notice of Privacy Practices in question and argues that: (1) the notice is simply required by law and is not part of a contract between Defendant and patients, (2) the wording of the notice is not negotiated when patients receive care from Defendant, (3) the wording contained in the notice is mere policy and is not contractual, but required by law, and (4) there is no consideration for the agreement. (Doc. 27 at pp. 27-30).
"Motions to dismiss under Federal Rule 12(b)(6) are appropriately directed to the pleadings and not based on documents outside the pleadings." Nesbit v. Unisys Corp., 2005 WL 1968828, *2 (M. D. Ala. Aug. 10, 2005)(citing Grossman v. Nationsbank, N.A., 225 F.3d 1228, 1231 (11th Cir. 2000) ("When considering a motion to dismiss, all facts set forth in the plaintiff's complaint are to be accepted as true and the court limits its consideration to the pleadings and exhibits attached thereto.")(internal quotations and citation omitted)). Accordingly, "Defendant's reliance on evidentiary submissions to argue that the factual predicate for [Plaintiffs'] allegations do not exist is not procedurally proper at this stage in the proceedings." Id.
Determining the nature of the Notice of Privacy Practices at issue (i.e., whether it is simply a statement of policy or not), the impact or non-impact of the language contained therein, the context in which was given to the Plaintiffs, the context in which it was signed by the Plaintiffs, as well as Plaintiffs' reliance on the same, are "vital issues in this breach of contract action and should be decided based upon evidence, not the pleadings." Id. While all of Defendant's arguments have been considered, they require fact-intensive inquiries and are ultimately based on a document outside of the pleadings. They are, therefore, inappropriate at this juncture in this case.
Under Alabama law, "to become a binding promise, the language used ... must be specific enough to constitute an actual offer rather than a mere general statement of policy." Hoffman-LaRoche, Inc. v. Campbell, 512 So.2d 725, 734 (Ala. 1987). However, even when there is only a mere statement of policy, if a plaintiff relies on the policy to his or her detriment, the reliance can give rise to a breach of contract claim. See Jianjun Fu v. Wells Fargo Home Mortg., 2014 WL 4681543 (N. D. Ala. Sept. 14, 2014)(granting summary judgment because plaintiff victims of identity theft had failed to demonstrate that they relied on defendant's e-mail disclaimer which contained a prohibition against sending confidential or sensitive information).
Plaintiffs allege that both the Defendant and they understood from the written Notice of Privacy Practices that Defendant would not disclose their confidential information. They further allege that Defendant failed to secure their information, causing it be disclosed, and that the disclosure resulted in damages. Though slight, taking them as true at this stage in the proceedings, Plaintiffs' allegations are sufficient to plausibly raise the inference that Plaintiffs and Defendant entered into a contract, which Defendant then breached. The claim should proceed to discovery.
b. Implied Contract
Defendant argues that Plaintiffs are prohibited from bringing an implied contract claim concurrent with an express contract claim. This argument is not persuasive, as Plaintiff raises the existence of an implied contract as an alternative. See Federal Rule of Civil Procedure 8(e)(2).
Defendant further argues that Plaintiffs have failed to allege the requisite facts to establish the existence of an implied contract. Proof of an implied contract requires the same basic elements of an express contract. See Stacey v. Peed, 142 So.3d 529, 531 (Ala. 2013). "An implied contract arises where there are circumstances which, according to the ordinary course of dealing and common understanding, show a mutual intent to contract." Broyles v. Brown Eng'g Co., 151 So.2d 767, 770 (Ala. 1963). The implied contract claim is not due to be dismissed for the same reason the express contract claim is not due to be dismissed. Plaintiffs have alleged sufficient facts to allow the claim to proceed to discovery, during which the parties may engage in an investigation regarding the "circumstances" which show or do not show a mutual intent to contract.
V. CONCLUSION AND RECOMMENDATION
Accordingly, for the reasons as stated, it is the RECOMMENDATION of the Magistrate Judge that the Defendant's motion to dismiss (Doc. 26) be GRANTED IN PART and DENIED IN PART. The state law claim for invasion of privacy by public disclosure of private facts is due to be dismissed. The motion to dismiss due to be denied as to the remaining federal and state law claims.
It is ORDERED that the parties shall file any objections to the said Recommendation on or before September 16, 2015. Any objections filed must specifically identify the findings in the Magistrate Judge's Recommendation to which the party objects. Frivolous, conclusive or general objections will not be considered by the District Court. The parties are advised that this Recommendation is not a final order of the court and, therefore, it is not appealable.
Failure to file written objections to the proposed findings and recommendations in the Magistrate Judge's report shall bar the party from a de novo determination by the District Court of issues covered in the report and shall bar the party from attacking on appeal factual findings in the report accepted or adopted by the District Court except upon grounds of plain error or manifest injustice. Nettles v. Wainwright, 677 F.2d 404 (5th Cir. 1982). See Stein v. Reynolds Securities, Inc., 667 F.2d 33 (11th Cir. 1982).
DONE and ORDERED this 2nd day of September, 2015.
/s/ Paul W. Greene
United States Magistrate Judge