Opinion
09 Civ. 1397 (CM).
July 7, 2009
DECISION AND ORDER GRANTING DEFENDANT J.P. MORGAN CHASE, N.A.'S MOTION TO DISMISS COMPLAINT
Plaintiff James Willey (hereinafter "Willey") brings this lawsuit individually and as a class action against defendant, Chase Card Services (hereinafter "Chase"), asserting violations of the Fair Credit Reporting Act as well as state law claims under negligence, negligence per se, breach of implied contract, breach of contract, violation of the New York Deceptive Trade Practices Act, and breach of bailment theories. Chase moves to dismiss the entire complaint for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6).
The motion is granted.
Background
Chase is incorporated under the laws of Delaware and has its principal place of business in New York. (Compl. ¶ 5.)
In October 2004, Chase introduced a credit card in collaboration with Circuit City, a nationwide electronics retailer. (Id. ¶ 10.) The Chase-Circuit City credit card gave customers instant credit in Circuit City stores and outlets. (Id.)
On September 7, 2006, Chase issued a press release disclosing that the personal information of 2.6 million current and former Circuit City-Chase credit card holders had been mistakenly identified as trash and had been thrown out and destroyed (hereinafter "data loss incident"). (Id. ¶ 11.) Chase announced that it would notify and offer credit monitoring to customers whose personal information was thrown out. (Id. ¶¶ 12, 13; Levine Decl., Ex. 1.)
Willey, a citizen and resident of Ohio, alleges that he was a cardholder whose personal information was compromised as a result of the data disposal, although Chase did not notify him of the breach. (Compl. ¶¶ 4, 15.)
On February 17, 2009, Willey brought this lawsuit against Chase, on his own behalf and as a class action on behalf of all persons whose personal information disposed of by Chase. (Id. ¶ 20.) Willey contends that, "In conscious disregard of the rights of Plaintiff and Class Members, [Chase] deliberately and/or recklessly did not maintain reasonable procedures designed to protect against unauthorized access while disposing of the Personal Financial Information." (Id. ¶ 40.)
Willey brings eight causes of action against Chase: (1) willful violation of the Fair Credit Reporting Act (hereinafter "FCRA") pursuant to 15 U.S.C. § 1681w ("Count I"); (2) negligent violation of the FCRA pursuant to 15 U.S.C. § 1681w ("Count II"); (3) negligence ("Count III"); (4) negligence per se in violation of the FCRA and the Gramm-Leach-Bliley Act (hereinafter "GLBA") ( 15 U.S.C. § 1601) ("Count IV"); (5) breach of implied contract ("Count V"); (6) breach of contract ("Count VI"); (7) violation of the New York Deceptive Trade Practices Act (hereinafter "DTPA") (N.Y. Gen. Bus. Law §§ 349 et seq.) ("Count VII"); and (8) breach of bailment ("Count VIII").
Discussion
I. Standard of Review for a Rule 12(b)(6) Motion
Rule 12(b)(6) of the Federal Rules of Civil Procedure provides for dismissal of a complaint that fails to state a claim upon which relief can be granted. The standard of review on a motion to dismiss is weighted in favor of the plaintiff. See Frasier v. General Elec. Co., 930 F.2d 1004, 1007 (2d Cir. 1991) ("In ruling on a motion to dismiss for failure to state a claim upon which relief may be granted, the court is required to accept the material facts alleged in the complaint as true.")
"While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do."Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 545 (2007). To survive a motion to dismiss, a complaint's "factual allegations must be enough to raise a right to relief above the speculative level." Id. at 555 (2007).
The Supreme Court's recent Iqbal decision confirmed that theTwombly "plausibility" standard applied in all civil actions.Ashcroft v. Iqbal, 129 S.Ct. 1937, 1953 (2009). In Iqbal, the Supreme Court held that a Muslim Pakistani pretrial detainee who had brought Bivens claims against current and former government officials in connection with his arrest and detention had failed to plead sufficient facts to state a claim for purposeful and unlawful discrimination. Id. at 1951. The plaintiff's allegations that defendants "willfully and maliciously agreed to subject him to harsh conditions of confinement . . . solely on account of his religion, race, and/or national origin" were not entitled to be assumed true because the allegations were conclusory and a "formulaic recitation" of the elements of a constitutional discrimination claim. Id. (internal quotation marks omitted). The Court stated that "threadbare recitals of a cause of action's elements, supported by mere conclusory statements" will not support a complaint. Id. at 1940. Plaintiff's allegations did not cross the line from conceivable to plausible because the court did not accept his conclusory statements as true, and he did not have sufficient factual allegations "nudge" his claims of invidious discrimination "across the line from conceivable to plausible." Id. (internal quotation marks omitted).
II. FCRA Claims
Willey brings this lawsuit against Chase for violation of the FCRA § 1681w under §§ 1681n and 1681o, which gives a private right of action for willful and negligent violations of the FCRA. Chase argues that Willey's FCRA claims should be dismissed. Chase contends that Willey fails to state a claim for violation of § 1681w both because "the complaint includes no proper allegations of any violation of the applicable FCRA disposal regulations" (Mot. to Dismiss 7.), and because the FCRA claims are barred by the two year statute of limitations set forth in 15 U.S.C. § 1681p (id. 4-6.).
The FCRA claims are Willey's only federal claims.
A. Willey Fails to State a Claim Under the Fair Credit Reporting Act
1. Elements of a FCRA Claim
Pursuant to 15 U.S.C. §§ 1681n and 1681o, the FCRA creates a private right of action for willful or negligent violations of duties imposed by the statute. Successful plaintiffs may recover actual damages under § 1681o for negligent violations and may recover actual damages, statutory damages, and punitive damages under § 1681n for willful violations.
Willey alleges that Chase both negligently (Count II) and willfully (Count I) violated § 1681w of the FCRA, which regulates the disposal of consumer information. Section 1681w provides:
The Federal banking agencies . . . with respect to the entities that are subject to their respective enforcement authority . . . shall issue final regulations requiring any person that maintains or otherwise possesses consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose to properly dispose of any such information or compilation.15 U.S.C. § 1681w.
Willey initially argued that the FTC's guidelines regarding disposal of consumer information in 16 C.F.R. § 682.3 applied to Chase. However, as the Office of the Comptroller of the Currency ("OCC") has authority over Chase, its guidelines regarding the FCRA are applicable to Chase, not those of the FTC. The defined scope of the OCC's "Interagency Guidelines Establishing Information Security Standards" encompasses "entities over which the OCC has authority," 12 C.F.R. pt. 30, App. B, I.A., and the OCC has authority over Chase. Therefore, the OCC Guidelines articulated in 12 C.F.R. § 41 are applicable.
The OCC Guidelines "establish standards for national banks regarding consumer report information [and] measures national banks must take to combat consumer fraud and related crimes, including identity theft." 12 C.F.R. § 41.1.
12 C.F.R. § 41.83 requires that:
Each bank must properly dispose of any consumer information that it maintains or otherwise possesses in accordance with the Interagency Guidelines Establishing Information Security Standards, as set forth in appendix B to 12 CFR part 30, to the extent that the bank is covered by the scope of the Guidelines.12 C.F.R. § 41.83. The "Interagency Guidelines Establishing Information Security Standards" in turn direct banks to:
Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank and the nature and scope of its activities.12 C.F.R. pt. 30, App. B, II(A). The Guidelines direct the boards of directors at banks to approve and oversee the development and implementation of the bank's security program. Id. at III(A)(1-2). Each bank must identify foreseeable internal and external threats, assess the likelihood and potential damage of the threats, and assess the sufficiency of policies and procedures in place to control those threats. Id. at III(B)(1-3).
The Guidelines further stipulate that each bank must "design its information security program to control the identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of the bank's activities." Id. at III(C)(1). The Guidelines then require banks to implement a number of security measures if the bank concludes that such measures are appropriate, id., including restricting access to consumer information, id. at III(C)(1)(a), encrypting consumer information, id. at III(C)(1)(c), using monitoring systems, id. at III(C)(1)(f), and developing response programs in case of data breach, id. at III(C)(1)(g).
Whether or not Chase committed a violation of 15 U.S.C. § 1681w thus depends on whether or not it adopted and implemented the comprehensive security program envisioned by the OCC's regulations.
2. Discussion
Willey's FCRA claims fall well short under pleading standards articulated in Twombly and Iqbal, because Willey does not make factual allegations with enough specificity to plausibly allege that Chase violated OCC regulations.
Willey's claim for willful violation of § 1681w alleges that, "in conscious disregard of the rights of the Plaintiff and Class Members, Defendant deliberately and/or recklessly did not maintain reasonable procedures designed to protect against unauthorized access while disposing of the Personal Financial Information." (Compl. ¶ 40.)
His claim for negligent violation of § 1681w alleges that, "Defendant was negligent in failing to maintain reasonable procedures designed to protect against the unauthorized access while transferring the Personal Information." (Compl. ¶ 57.)
These allegations are no more than a "formulaic recitation of the elements of [his] cause of action." Twombly, 550 U.S. at 555. Willey does not support these formulaic recitations with factual allegations that describe any insufficiency in Chase's security procedures, or with allegations that Chase lacked such procedures. Nor does he explain how the procedures Chase adopted failed to comply with the OCC Guidelines. Due to this lack of factual allegations, Willey's right to relief does not rise above the "speculative level." Therefore, his allegations that Chase maintained unreasonable procedures regarding disposal of consumer information in violation of § 1681w do not cross "the line from conceivable to plausible." Iqbal, 129 S.Ct. at 1951.
Indeed, without providing a factual basis, Willey appears to assert that a violation of the FCRA must have occurred simply because the data loss incident occurred. That sort of ipse dixit pleading is insufficient.
Willey argues that without discovery, it would be "impossible for Plaintiff to allege with greater specificity what policy or procedure Defendant willfully or negligently failed to comply with" when disposing of the consumer information. (Opp. 5-6.) ButIqbal unequivocally rejects the notion that conclusory statements unsupported by factual allegations can subject a defendant to the burdens of discovery.
Willey's claims for violation of § 1681w are, therefore, dismissed.
B. The Statute of Limitations Bars Willey's FCRA Claims
Ordinarily that dismissal would be without prejudice. However, amendments would be futile, because Willey's FCRA claims are barred by the two year statute of limitations. 15 U.S.C. § 1681p.
1. Relevant FCRA provision
Claims made under the FRCA must comply with the statute of limitations set forth in 15 U.S.C. § 1681p, which provides:
An action to enforce any liability created under this title may be brought . . . not later than the earlier of (1) 2 years after the date of discovery by the plaintiff of the violation that is the basis for such liability; or (2) 5 years after the date on which the violation that is the basis for such liability occurs."15 U.S.C. § 1681p. The shorter two year statute runs from the date when Willey was on "inquiry notice" regarding Chase's release of consumer financial information.
Chase contends that Willey was placed on "inquiry notice" when Chase issued a press release about the data loss incident and when national newspapers reported the incident. (Mot. to Dismiss 5.) Chase argues that the two year limitations period begins when "a reasonable [person] of ordinary intelligence would have discovered the existence" of the relevant claim. In re Merrill Lynch Ltd. P'ships Litig., 154 F.3d 56, 60 (2d Cir. 1998). Because the incident was widely publicized more than two years before Willey filed his complaint, Chase argues that his claim should fail because it does not comply with the two year statute of limitations.
Chase is correct.
2. Inquiry Notice
"In this District, as little as one news article is enough to put an investor on inquiry notice." In re Moody's Corp. Sec. Litig., 599 F. Supp. 2d 493, 505 (S.D.N.Y. 2009) (internal quotation marks omitted). By contrast, multiple public sources may be insufficient. The key is what kind of information is publicly available and when information of sufficient specificity becomes available to alert a potential plaintiff of his claim. News articles and press releases that contain sufficient detail and specific information, and that are likely to come to the attention of persons of ordinary intelligence, will be sufficient to warn them of the probability of fraud. Id.
For instance, the Second Circuit found that several magazine articles discussing securities fraud that was allegedly taking place at Morgan Stanley were specific and detailed enough to "suggest to an investor of ordinary intelligence the probability that she ha[d] been defrauded." Shah v. Meeker, 435 F.3d 244, 250 (2d Cir. 2006). In Shah, the plaintiff, a Morgan Stanley shareholder, sued Morgan Stanley for securities fraud; the alleged fraud was Morgan Stanley's representation to investors that its research analysts were unbiased and objective. Id. at 245. Several articles in the Wall Street Journal, The New Yorker, and Fortune, described the conflict of interest between the research and investment banking groups at Morgan Stanley, both generally and in detail. Id. The Second Circuit found that the articles were sufficient to put shareholders on inquiry notice because the content of the articles went beyond discussing "mere existence of a conflict of interest" and "specifically describe[d] the business practices" that formed the basis for the shareholders' complaint. Id. at 247-51.
By contrast, the Second Circuit determined that plaintiffs were not put on inquiry notice of securities fraud in Staehr v. Hartford Financial Services Group, Inc., 547 F.3d 406, 416 (2d Cir. 2008), by mainstream press reports that did not mention the defendant, industry newsletters that were not widely read by the investing public, state regulatory filings filed with insurance commissions, and four lawsuits filed in different states only one of which named the defendant and none of which garnered any publicity.
More recently, a court in this district determined that the plaintiffs in Moody's were not put on inquiry notice of securities fraud by numerous SEC releases, news articles, and other publications. 599 F. Supp. 2d at 505-6. Plaintiffs brought a class action lawsuit against Moody's for securities fraud, asserting that Moody's made material misrepresentations and omissions in public statements concerning its business and methods of rating securities. Id. at 499.
Moody's argued that plaintiffs claims should be barred by the statute of limitations because plaintiffs were placed on inquiry notice by numerous SEC releases, news articles, and other publications that warned of potential conflicts of interest in the credit ratings industry. Id. at 505. The court found the articles insufficiently detailed to trigger inquiry notice. Id. at 506. The court reasoned that the articles and press releases made no direct reference to the defendant, nor did they mention securities fraud specifically. Id. Instead, the articles merely identified "potential conflicts of interest [and were] couched in equivocating language," id., and so were therefore insufficient to raise the probability of fraud. Id.
3. Discussion
In this case, the press release and news articles were sufficiently detailed to put Willey and class members on inquiry notice of their potential claims. The press release and news articles contain the specificity that was missing in Hartford andMoody's. In fact, they form the very basis of Willey's complaint, as was the case in Shah.
The press release, dated September 7, 2006, stated that:
[Chase] is notifying 2.6 million current and former Circuit City credit card account holders that computer tapes containing their personal information were mistakenly identified as trash and thrown out. . . . Notification to affected individuals began today [September 7, 2006] and should be completed over the next two to three weeks.
(Levine Decl., Ex. 1.) Subsequent news articles contain updates about the situation. (Id., Ex. 2 and 3.) All these sources identified the specific credit card involved and explained that the personal data of 2.6 million cardholders had been thrown out and destroyed. Unlike in Hartford or Moody's, this information is sufficiently detailed information to put any holder of a Chase-Circuit City credit card on notice that his or her personal information may have been compromised. The fact that Plaintiff's complaint does no more than reference Chase's press release, which was publicly available more than two years ago, underscores the inevitability of this conclusion. Under Shah, this level of specificity is sufficient to trigger inquiry notice.
Of course, the press release and articles in do not identify the 2.6 million cardholders and indicate that Chase intended to notify the affected parties. For an article to trigger inquiry notice, it must warn the investor of the probability of fraud,Moody's, 599 F. Supp. 2d at 505; for any individual cardholder, it could be argued that the publicly available information warns only of the possibility that his or her information was thrown away. One might, therefore, argue that the limitation period should run from the date of notification.
That, however, would be true only for those holders of the Chase-Circuit City card who were told by Chase that their data had been compromised. Willey is not part of that group. His own pleading avers that he was never notified that his data had been thrown out. (Compl. ¶ 15.) The essence of his claim is that he was placed in a position of uncertainty by Chase's action and so was required to take steps to protect his personal information. Willey knew everything he needed to know to file the claim as soon as the story about the lost data hit the media. Since that was more than two years before he filed suit, the FCRA claims are dismissed with prejudice.
III. State Law Claims
In addition to his FCRA claims, Willey alleges negligence, negligence per se, breach of implied contract, breach of contract, violation of the DTPA, and breach of bailment.
This Court has diversity jurisdiction over these claims, pursuant to 28 U.S.C. § 1332(d), because the amount in controversy is alleged to be more than $5 million and there is diversity of citizenship between Willey and Chase. 28 U.S.C. § 1332(d)(2)(A).
Chase argues that Willey's state law claims should be dismissed because they are preempted by the FCRA and fail to allege any cognizable harm. (Mot. to Dismiss 13.) Again, Chase is correct.
Each of Willey's state law claims is, essentially, a repetition of the conclusory allegation that Chase violated the FCRA. The negligence, negligence per se, breach of implied contract, breach of contract, violation of DTPA, and breach of bailment claims do no more than allege that Chase did not properly safeguard consumer information or did not properly notify consumers about the data loss incident after it occurred.
To the extent that Willey's state law claims address the conduct required by the FCRA, those claims are preempted. Because each of Willey's state law claims allegations directly relates to the conduct prescribed in the OCC Guidelines, all of his state law claims are preempted.
A. Willey's State Law Claims are Preempted
1. Relevant Statute
The FCRA contains a general preemption provision, which states in relevant part:
No requirement or prohibition may be imposed under the laws of any state . . . with respect to the conduct required by the specific provisions of . . . section 1681w of this title.15 U.S.C. § 1681t(b)(5)(1). Section 1681w requires Federal banking agencies to issue regulations requiring entities subject to their enforcement authority to properly dispose of consumer information. 15 U.S.C. § 1681w. The OCC Guidelines promulgated pursuant to § 1681w require banks to implement security procedures appropriate to the size and nature of the bank's activities. 12 C.F.R. § 30, App. B, II(A).
Whether Willey's state law claims are preempted by the FCRA depends on how broad a reading is warranted by "conduct required by the specific provisions." 15 U.S.C. § 1681t(b)(5)(I). No federal court has interpreted § 1681t(b)(5)(I), and both sides urge different interpretations.
2. Discussion
Willey argues that the "conduct" in § 1681w should be interpreted narrowly. He contends that the only conduct required by § 1681w is that federal agencies issue regulations for the proper disposal of consumer information. (Opp. 12.) Therefore, only state law claims that interfere with federal agencies' issuance of regulations for the proper disposal of consumer information are preempted by § 1618t(b)(5)(I). (Id.) Because Willey's state law claims do not seek to impose prohibitions or regulations on federal agencies, he argues that his state law claims are not preempted. (Id.)
Chase argues for a broader reading of the relevant language, pointing out that Willey's narrow reading of the preemption provision would render § 1681t(b)(5)(I) superfluous, because states cannot interfere with a federal agency's issuance of regulations. (Reply at 8.). Chase contends that the preempted "conduct" encompasses the conduct required by the OCC regulations. (Id. at 9.)
Chase also points to legislative history, which indicates that Congress intended to set uniform national standards for matters covered by the FCRA, which includes the disposal of consumer information. (Mot. to Dismiss 15.) Given the purpose, a reading of § 1681t(b)(5)(I) that implies broad preemption of state law claims is more consistent with Congress' intent. (Id. at 14-15.)
No doubt sensing the weakness of his first premise, Willey argues in the alternative that his state law claims are not preempted because they do not specifically impose requirements or prohibitions about the disposal of consumer information. (Opp. 12.) Willey contends that the language of § 1681t(b)(5)(I) indicates that Congress did not intend all state law claims to be preempted; rather, Willey argues that Congress only intended the FCRA to preempt state law claims that would specifically impose some requirement concerning the disposal of consumer information on a bank. (Id.) Compare 15 U.S.C. § 1681t(b)(5)(1) ("No requirement or prohibition may be imposed under the laws of any State . . . with respect to the conduct required by the specific provisions of . . . section 1681w of this title") (emphasis added) with 15 U.S.C. § 1681t(b)(1) ("No requirement or prohibition may be imposed under the laws of any State . . . with respect to any subject matter regulated under [various other provisions of the FCRA]") (emphasis added). Willey insists that prosecution of his state law claims would not impose requirements on the disposal of consumer information. (Opp. 12.) Instead, Willey argues that his state law claims implicate conduct beyond the disposal of consumer information, such as the safeguarding of information and the disclosure of data loss incidents. (Id.)
Willey is correct that there are two preemption provisions in the FCRA and that the one applicable to § 1681w is the narrower provision. He is wrong, however, to insist that his state law claims do not impose requirements and prohibitions on the conduct required by § 1681w. The conduct required by § 1681w is enunciated in the OCC Guidelines. The OCC Guidelines promulgated pursuant to § 1681w address financial institutions' safeguarding and disposal of consumer information, and impose requirements for giving consumers notice when information is lost or breached. 12 C.F.R. pt. 30, App. B, at II(A), III(B)(4), III(C)(1)(g). Willey's state law claims allege that Chase violated statute and common law by failing to safeguard customer data and by failing to notify customers of the data loss. (Opp. at 13.) Therefore, Willey's state law claims are preempted by the FCRA.
Willey's breach of express and implied contract claims are also preempted. Willey alleges in Count V that Chase breached an implied contract: "Defendant came into possession of Plaintiff's and Class Members' Confidential Information and had an implied contract to protect such information." (Compl. ¶ 77.) In Count VI, Willey alleges that Chase breached the contract between Chase and Circuit-City "to provide credit card processing in a secure manner," and that Plaintiffs are the intended third-party beneficiaries of the contract. (Id. ¶ 83.) Willey's claim for breach of bailment in Count VIII is essentially a breach of contract claim, as "a bailment is . . . merely a special kind of contract." Ellish v. Airport Parking Co. of America, Inc., 42 A.D.2d 174, 176 (N.Y.App.Div. 2d Dep't 1973) aff'd, 32 N.Y.2d 882 (N.Y. 1974).
Willey argues that obligations imposed by contracts are not requirements "imposed under the laws of any State," 15 U.S.C. § 1681t(b)(5)(I), because the obligations imposed by contracts are imposed by the parties themselves. Leet v. Cellco P'ship, 480 F. Supp. 2d 422, 431 (D. Mass. 2007). However Willey has not alleged a breach of contract claim with any sort of specificity. The most he alleges is that Chase failed to safeguard his data, and that breaches some unidentified contractual obligation. But Chase's obligation to safeguard data is not a creature of contract; it is addressed directly by the OCC Guidelines. Again, Willey's contract claims boil down to a rephrasing of the allegation that Chase failed to follow the OCC Guidelines in violation of the FCRA. Thus, Willey's breach of contract claims are also preempted by the FCRA.
B. Even if Willey's State Law Claims Were Not Preempted, He Has Failed to Allege Actual Damages
Actual damages are an element of each of Willey's state law claims. Because he does not allege that any of his personal data (or anyone else's for that matter) was actually misused, he has not alleged damages sufficient to support his state law claims. Thus, even if Willey's state law claims were not preempted, they would have to be dismissed for failing to state a claim.
As Chase notes, actual damages are an element of each of Willey's state law claims. See King v. Crossland Sav. Bank, 111 F.3d 251, 259 (2d Cir. 1997) (listing damages as an element of negligence); Ezagui v. Dow Chemical Corp., 598 F.2d 727, 733 (2d Cir. 1979) (listing injury as an element of negligence per se);First Investors Corp. v. Liberty Mut. Ins. Co., 152 F.3d 162, 168 (2d Cir. 1998) (listing damages as an element of breach of contract claim); Ellish, 42 A.D.2d at 176 (holding that a bailment is merely a special kind of contract); Cohen v. J.P. Morgan Chase Co., 498 F.3d 111, 126 (2d Cir. 2007) (listing injury as an essential element of claim under the DTPA).
Damages under the FCRA can include humiliation and emotional distress, Robinson v. Equifax Info. Serv., LLC, 560 F.3d 235, 239-40. In state law information loss cases, however, case law distinguishes between data loss and data breach. The risk that plaintiff's data may be misused because it has been lost is not a cognizable harm. See, e.g., Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 639 (7th Cir. 2007) ("Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy"). Without actual misuse of personal information, damages for humiliation, mental distress, and credit monitoring are insufficient to support the sort of state law claims asserted by Plaintiff. Id.
In Caudle v. Towers, Perrin, Forster Crosby, Inc., 580 F. Supp. 2d 273, 282 (S.D.N.Y. 2008), a court in this district granted the defendant's motion for summary judgment on the plaintiff's claim for negligence and breach of fiduciary duty after a laptop with the plaintiff's personal information was stolen from the defendant. The plaintiff sought to recover the costs of multi-year credit monitoring and identity theft insurance. Id. at 281. Because there was no evidence that the plaintiff's data had been accessed or used by anyone as a result of the theft, the court held that the plaintiff could not prove that he had sustained damages. Id. Similarly, in Shafran v. Harley-Davidson, Inc., No. 07 Civ. 1365, 2008 WL 763177, at *1 (S.D.N.Y. Mar. 20, 2008), plaintiffs brought claims against the defendant after a laptop containing plaintiffs' personal information went missing. In dismissing the plaintiffs' claims, Judge Daniels concluded that time and money spent to guard against potential identify theft did not constitute a compensable injury because "plaintiff's alleged injuries are solely the result of a perceived and speculative risk of future injury that may never occur." Id. at *3.
In the present case, Willey has not alleged that his or any class member's information has actually been misused. Willey's claims for expenses related to credit monitoring, anxiety, emotional distress, and loss of privacy all arise due to the probability that his data might have been misused. Because this does not rise to the level of actual damages, the state law claims fail to allege actual damages and must be dismissed.
Indeed, the fact that Willey himself was not notified that his data had been lost — which admits of the inference that he was not one of the 2.6 million customers affected by Chase's improper disposal of data — fairly implies that he could not have been damaged at all.
Conclusions
For the reasons stated above, the motion to dismiss the complaint is granted. The Clerk of the Court is directed to enter judgment for Defendant and to close the file.
This constitutes the decision and order of the Court.