Summary
In Whitaker v. Health Net of California, Inc., No. CIV S-11-0910 KJM-DAD, 2012 WL 174961, at *1 (E.D. Cal. Jan. 20, 2012), which was decided before Zappos, computer server drives containing the plaintiffs' "personal and medical information" were "lost."
Summary of this case from Stasi v. Inmediata Health Grp.Opinion
No. CIV S-11-0910 KJM-DAD
01-19-2012
DWIGHT WHITAKER; et al., Plaintiffs, v. HEALTH NET OF CALIFORNIA, INC.; et al., Defendants.
ORDER
This matter comes before the court upon the separate motions to dismiss plaintiffs' amended complaint filed by defendants Health Net of California, Inc. ("Health Net") and International Business Machines Corporation ("IBM"). The court heard these motions on November 9, 2011; C. Brooks Cutter, Michael Ram, Todd Schneider, Geoffrey Munroe, Tina Wolfson and Robert Buccola appeared for plaintiffs; Ethan Schulman and Steven Wilson appeared for Health Net; and Karin Kramer and Steven Madison appeared for IBM. For the following reasons, IBM's motion to dismiss is GRANTED insofar as it alleges lack of subject matter jurisdiction, IBM's motion to dismiss is denied as moot insofar as it alleges failure to state a claim, Health Net's motion to dismiss is denied as moot, and this action is dismissed without prejudice.
I. FACTS AND PROCEDURAL HISTORY
Plaintiffs are all California citizens residing in California. (Am. Compl. ¶¶ 7-16, ECF 32.) Health Net is a California corporation with its principal place of business in Woodland Hills, California; IBM is a New York corporation with its principal place of business in Woodland Hills, California. (Id. ¶¶ 17, 18.) IBM manages Health Net's information technology infrastructure and had access to Health Net members' information during the time period at issue. (Id. ¶ 1.) On January 21, 2011, IBM informed Health Net that it had lost nine Health Net server drives consisting of more than 800,000 California residents' personal and medical information, including plaintiffs' information. (Id. ¶¶ 1, 4.) Plaintiffs and other Health Net members received a letter from the Chief Operating Officer of Health Net's parent company in mid-March 2011, informing them that IBM had lost the information. (Id. ¶¶ 21-23.) Three of the nine server drives have since been located; however, the other six, including the four containing plaintiffs' information, remain missing. (Pl.'s Opp'n to Health Net's Mot. to Dismiss at 4 n.2, ECF 47.)
Plaintiff Dwight Whitaker filed his putative class action complaint on April 5, 2011. (ECF 1.) On July 15, 2011, Dwight Whitaker was joined by nine additional plaintiffs in filing the operative amended complaint, alleging three causes of action: 1) violation of the Confidentiality of Medical Information Act ("CMIA"), Cal. Civ. Code § 56, et seq. against Health Net; 2) violation of the CMIA against IBM; and 3) violation of the Customer Records Act ("CRA"), Cal. Civ. Code § 1798.82 against Health Net. (ECF 32.) Plaintiffs seek to represent "[a]ll current or former members of Health Net of California, Inc. who were notified . . . that their health information was included on missing Health Net server drives." (Id. ¶ 31.)
Both Health Net and IBM filed their motions to dismiss in lieu of answers on August 29, 2011. (ECF 34, 38.) Plaintiffs filed their oppositions on September 28, 2011. (ECF 47, 48.) Health Net filed its reply on October 13, 2011 (ECF 54) and IBM filed its reply on October 14, 2011 (ECF 56). IBM filed a notice of supplemental authority on December 13, 2011. (ECF 60.)
II. ANALYSIS
A. Standard
"To demonstrate standing, a plaintiff must (1) have suffered an injury in fact - an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) there must be a causal connection between the injury and the conduct complained of - the injury has to be fairly . . . traceable to the challenged action of the defendant, and not . . . the result [of] the independent action of some third party not before the court; and (3) it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Pritikin v. Dep't of Energy, 254 F.3d 791, 796-97 (9th Cir. 2001) (internal quotations and citations omitted) (alterations in original). "If a plaintiff faces 'a credible threat of harm,' and that harm is 'both real and immediate, not conjectural or hypothetical,' the plaintiff has met the injury-in-fact requirement for standing under Article III." Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (citations omitted). "The party asserting federal jurisdiction bears the burden of establishing these requirements at every stage of the litigation . . . ." Id. at 1141. After a defendant moves to dismiss a case under Federal Rule of Civil Procedure 12(b)(1), "[i]t then becomes necessary for the party opposing the motion to present affidavits or any other evidence necessary to satisfy its burden of establishing that the court, in fact, possesses subject matter jurisdiction." Colwell v. Dep't of Health & Human Servs., 558 F.3d 1112, 1121 (9th Cir. 2009) (internal quotation marks omitted) (citing St. Clair, 880 F.2d at 201). Indeed, if the party moving for dismissal under Rule 12(b)(1) "denies or controverts the pleader's allegations of jurisdiction, then he is deemed to be challenging the actual existence of subject matter jurisdiction, and the allegations of the complaint are not controlling." Trentacosta v. Frontier Pac. Aircraft Indus., 813 F.2d 1553, 1559 (9th Cir. 1987) (citation omitted). At that point, "the nonmoving party [must] present evidence outside his pleadings in opposition to a motion to dismiss for lack of subject matter jurisdiction." Id.
B. Application
IBM moves to dismiss the amended complaint for lack of standing. (IBM's Mem. P&A in Support of Mot. to Dismiss ("IBM's Mot.") at 4, ECF 39.) IBM specifically contends that plaintiffs lack standing because they have not asserted that they suffered any injury. (Id. at 14.) Plaintiffs contend they have standing because of the threat posed by the loss of their information. (Pls.' Opp'n to IBM's Mot. to Dismiss at 6-7, ECF 48.)
Plaintiffs lack standing to proceed with this action. Plaintiffs nowhere allege they have suffered an injury in fact. At the hearing and in their opposition plaintiffs argued they satisfy the standard for standing established by the Ninth Circuit in Krottner v. Starbucks Corp. and Ruiz v. Gap, Inc., No. 09-15971, 380 F. Appx. 689 (9th Cir. May 28, 2010), based on the loss of their data alone; in essence, they say, it naturally follows that they face the threat of harm. Krottner and Ruiz each arose from the theft of information, not its loss. The Krottner court found that the plaintiffs had "alleged a credible threat of real and immediate harm stemming from the theft of a laptop containing their unencrypted personal data." 628 F.3d at 1143. The Ruiz court similarly found that the plaintiff had standing where he alleged that he was at a great risk of identity theft based on the theft of a laptop computer containing his Social Security Number. 380 Fed. Appx. at 691. Plaintiffs argue there is no difference between theft and loss. Even if that is so, plaintiffs do not explain how the loss here has actually harmed them or threatens to harm them, or that third parties have accessed their data. Any harm stemming from their loss thus is precisely the type of conjectural and hypothetical harm that is insufficient to allege standing. See Birdsong v. Apple, Inc., 590 F.3d 955, 961 (9th Cir. 2009) (plaintiffs lacked standing where they did not claim they have suffered or were substantially certain to suffer harm but asserted only there was a possibility they could suffer harm). The Ninth Circuit in Krottner provided this scenario as an example of a less credible threat: where "no laptop had been stolen, and Plaintiffs had sued based on the risk that it would be stolen at some point in the future." Krottner, 628 F.3d at 1143.
In their opposition, plaintiffs avoid arguing there is a concrete and particularized threat of harm and instead only broadly assert that the general "threat posed by lost medical data is in some ways more severe than stolen personal data." (ECF 48 at 6.)
Recently, in Low v. LinkedIn Corp., the Northern District of California found the named plaintiff lacked standing where the plaintiff failed to allege any present harm and his allegations of possible future harm were "too theoretical to support injury-in-fact for the purposes of Article III standing." Low v. LinkedIn Corp., No. 11-CV-01468-LHK, 2011 U.S. Dist. LEXIS 130840, at *9 (N.D. Cal. Nov. 11, 2011). The Low plaintiff's specific allegations were that the defendant essentially disclosed its members' private information to third parties; however, the plaintiff did not allege what information was actually disclosed to third parties that caused the plaintiff's alleged harm, that his private information was actually transmitted to any third parties, how third parties would be able to infer his personal identity from the information allegedly transmitted, how the information was transmitted to third parties, and how the defendant actually caused him harm. See id. at *8-9. The court in Low distinguished that case from Krottner as follows: "Low . . . has not yet articulated or alleged a particularized and concrete harm as the plaintiffs did in Krottner . . . . The plaintiffs in Krottner . . . were concerned with the harm that arose from the actual publication or theft of their highly sensitive personal data. Low has not alleged that his credit card number, address, and social security number have been stolen or published or that he is a likely target of identity theft as a result of LinkedIn's practices. Nor has Low alleged that his sensitive personal information has been exposed to the public." Id. at *14-15; see also Reilly v. Ceridian Corp., No. 11-1738, 2011 U.S. App. LEXIS 24561, at *5 (3d Cir. Dec. 12, 2011) (threatened harm in Krottner imminent and impending where plaintiffs' names, addresses and social security numbers were stored on a laptop that was stolen and someone had attempted to open a bank account with a plaintiff's information following the theft).
Here, the only allegation of particularized, real and immediate harm alleged is in paragraph 30 of the amended complaint, in which plaintiffs allege that one of them received a letter informing them their minor daughter's Social Security Number has been misused. The minor is not a named plaintiff in this action. "'That a suit may be a class action . . . adds nothing to the question of standing, for even named plaintiffs who represent a class must allege and show that they personally have been injured, not that the injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.'" Lewis v. Casey, 518 U.S. 343, 357 (1996) (quoting Simon v. Eastern Ky. Welfare Rights Org., 426 U.S. 26, 40 n.20 (1976) (internal quotation omitted)); see also Blum v. Yaretsky, 457 U.S. 991, 999 (1982) ("It is axiomatic that the judicial power conferred by Art. III may not be exercised unless the plaintiff shows that he personally has suffered some actual or threatened injury as a result of the putatively illegal conduct of the defendant. [internal citation] It is not enough that the conduct of which the plaintiff complains will injure someone. The complaining party must also show that he is within the class of persons who will be concretely affected."); see also Low, 2011 U.S. Dist. LEXIS 130840, at *7 (quoting Lierboe v. State Farm Mut. Auto Ins. Co., 350 F.3d 1018, 1022 (9th Cir. 2003) ("'[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.'")).
Here, the threat plaintiffs allege is wholly conjectural and hypothetical; plaintiffs lack standing to bring these claims.
III. CONCLUSION
For the foregoing reasons, IBM's motion to dismiss is GRANTED insofar as it alleges lack of subject matter jurisdiction, IBM's motion to dismiss is denied as moot insofar as it alleges failure to state a claim, Health Net's motion to dismiss is denied as moot, and this action is dismissed with leave to amend. Plaintiffs may file a second amended complaint within thirty (30) days, taking into account the contents of this order.
IT IS SO ORDERED.
____________________________
UNITED STATES DISTRICT JUDGE