Nowak v. Barnes & Noble, Inc.

REPLY

N.D. Ill.November 14, 2013

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION IN RE BARNES & NOBLE PIN PAD LITIGATION This Document Relates To: ALL CASES Case No. 1:12-cv-08617 CLASS ACTION Honorable John W. Darrah DEFENDANT BARNES & NOBLE, INC.’S REPLY IN SUPPORT OF ITS MOTION TO DISMISS THE FIRST AMENDED CONSOLIDATED CLASS ACTION COMPLAINT Not only is Plaintiffs’ First Amended Consolidated Class Action Complaint (“Amended Complaint”) virtually identical to their original dismissed Consolidated Class Action Complaint (“Original Complaint”), but Plaintiffs have now filed an opposition that retreads, at times verbatim, the very arguments that this Court previously rejected. Plaintiffs offer no new facts and no new law that would warrant this Court to reconsider its prior conclusion that Plaintiffs lack Article III standing. Plaintiffs’ three categories of “new allegations” do nothing to remedy the numerous deficiencies that this Court previously identified. 1. “Plaintiffs’ PII was Stolen.” Plaintiffs baldly allege that their PII was “stolen” and on that basis alone contend that this “new allegation” establishes standing where their prior allegations had not. But this is not a new allegation. Plaintiffs previously made this same naked assertion both in their prior complaint1 and in their brief in opposition to the initial motion to 1 See Dkt. No. 39 (“Orig. Compl.”) ¶ 3 (“Barnes & Noble’s security failures enabled the skimmers to steal Plaintiffs’ and Class members’ PII from within Barnes & Noble’s stores.”) (emphasis added). Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 1 of 7 PageID #:510 2 dismiss.2 And to the extent they contend “[o]n information and belief” that their data was “disclosed,” that, too, was alleged before3 and remains completely unsupported. The Court previously concluded that these allegations failed to establish a basis for standing because Plaintiffs had not alleged any facts that would support their purely speculative, formulaic allegations. Specifically, the Court held that (1) “the inference that [Plaintiffs’] data was stolen, based merely on the security breach, is too tenuous to support a reasonable inference that can be made in Plaintiffs’ favor”; (2) that “there are no facts alleged to support the conclusion Plaintiffs’ information was disclosed,” and (3) that Plaintiffs “have not sufficiently alleged the information they are trying to protect was actually stolen.” (Dkt. No. 57 at 6-7.) Plaintiffs have not cured these defects in the least – they still offer no factual allegations supporting their claims. As the Court has already recognized, the allegation that “Plaintiffs’ PII was stolen” was – and still is – premised on the claim that Plaintiffs shopped at certain Barnes & Noble locations impacted by the PIN Pad incident. But the mere fact that a data breach has occurred without any plausible allegation that Plaintiffs’ data was implicated is insufficient to confer Plaintiffs with standing under Article III. See, e.g., Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011) (plaintiffs lacked standing despite unknown hacker potentially gaining access to their personal and financial information where they could not show any injury attributable to the breach); see also Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (requiring “facial plausibility” – that is, “plead[ing] factual content that allows the court to draw the reasonable inference that the 2 See Dkt. No. 48 at 3-4 (“As a result of B&N’s failure to properly secure and safeguard Plaintiffs’ PII, Plaintiffs’ PII was stolen . . . .”) (emphasis added). 3 Each of the four named Plaintiffs alleged in the Original Complaint that their PII was “exposed” as result of the PIN pad incident. (Orig. Compl. ¶¶ 10-13.) Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 2 of 7 PageID #:511 3 defendant is liable for the misconduct alleged”) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007)). Plaintiffs restate – at times verbatim – the very arguments Plaintiffs previously made in their original opposition brief that a mere “risk of future harm” is sufficient to establish standing. In rehashing the same argument, Plaintiffs once again argue that the Court should ignore the U.S. Supreme Court’s directly contrary holding in Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147 (2013) that a “risk of future harm” will not be sufficient unless the future injury is “certainly impending” and that “[a]llegations of possible future injury” will not suffice. 133 S. Ct. at 1147 (citations omitted). Plaintiffs have offered no additional facts to demonstrate that their risk of future harm is “certainly impending.” At most they simply insert the phrase “immediate risk” into their allegations but do not allege a single fact to support such a claim. The Supreme Court has made clear that such a tactic will not suffice: Clapper specifically requires that Plaintiffs present “concrete evidence” to show they face “certainly impending” harm. See 133 S. Ct. at 1154. Plaintiffs are still unable to do so. 2. “Plaintiff Winstead Suffered Out-of-Pocket Losses.” Plaintiffs next contend that Winstead’s new allegations are sufficient to give her standing. They are not. As demonstrated in Barnes & Noble’s opening brief, Winstead still has not presented any facts plausibly connecting the attempted unauthorized charge with the PIN Pad incident, beyond the unsubstantiated speculation that she was “unaware of any other data breaches” that could have caused the fraudulent charge. (See Dkt. No. 60 at 4-5). In fact, her claim that she purchased identity protection services prior to the breach renders her speculation about a connection to Barnes & Noble wholly implausible. The fact that she previously purchased these services and continues to do so demonstrates that there has been no change in the status quo – and thus no injury. Cf. Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 3 of 7 PageID #:512 4 Reilly, 664 F.3d at 45 (no injury where credit card statements were “exactly the same today as they would have been had [defendant’s] database never been hacked”). Plaintiffs’ reliance on Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012) is misplaced. In Resnick, it was undisputed that plaintiffs’ own personal information was contained on the stolen laptops and plaintiffs alleged that they suffered actual monetary damages directly attributable to the breach. For example, one plaintiff alleged that he was held liable for thousands of dollars in unauthorized activity that occurred after an identity thief opened a bank account in his name. See 2d Am. Compl. ¶¶ 60-64, Resnick, (No. 10-CV-24513 S.D. Fla. Apr. 25, 2011), ECF No. 31. Here, Winstead makes no such allegations – she does not allege that she has suffered any unreimbursed charges, despite this Court’s clear holding that “[i]n order to have suffered an actual injury, [Winstead] must have had an unreimbursed charge on her credit card.” (Dkt. No. 57 at 10). In the face of such clear instruction, Winstead’s failure to allege that she was held liable for any unauthorized charges is no oversight. Moreover, because Winstead has alleged no facts connecting her card issues to the Barnes & Noble incident, and because she concedes that she had purchased the “identity protection monitoring service” prior to the PIN Pad breach, the only plausible inference is that her unauthorized charge (for which she suffered no actual injury anyway) was the result of an unrelated identity theft or other unauthorized activity she had experienced in the past. Recognizing that she cannot point to any actual injury attributable to the PIN pad incident, Winstead attempts to manufacture standing by arguing that even though she purchased monitoring services before the skimming incident and for wholly unrelated reasons, she can nonetheless claim the cost of that service as cognizable injury here merely by asserting that she continues them “in part” because of the skimming. But the law is to the contrary. Even if her Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 4 of 7 PageID #:513 5 fanciful allegation that she continues the service “in part” because of the skimming, it is not cognizable under the Supreme Court’s controlling decision Clapper. She simply cannot manufacture standing through self-inflicted harm where the harm she seeks to avoid is not “certainly impending.” Clapper, 133 S. Ct. at 1151 (2013). Winstead continues to lack standing. 3. “Plaintiffs Paid Higher Prices to Barnes & Noble to Protect Their PII.” Plaintiffs again make the same verbatim arguments in support of their “diminished value” theory that the Court previously rejected. (Compare Dkt. No. 48 at 9, with Dkt. No 63 at 9). The Court made clear that Plaintiffs’ argument was “not persuasive” particularly because “Plaintiffs have not pled that Barnes & Noble charged a higher price for goods whether a customer pays with credit” and therefore, that payment card users incurred no additional charge attributable to data security. (Dkt. No. 57 at 9). Plaintiffs now allege that “the cost to Barnes & Noble of collecting and safeguarding PII is built into the purchase price of all of its products” and “regardless of whether a product is purchased via cash, credit card, or debit card.” (Dkt. No. 58 (“Am. Compl.”) ¶ 71). Plaintiffs also apparently argue that Barnes & Noble charges higher prices because it must factor in the cost of doing business, which “undoubtedly” has to include the cost of collecting and safeguarding customer information. (Dkt. No. 63 at 9). Notably, Plaintiffs’ Amended Complaint does not include any allegations to this effect, nor have Plaintiffs offered any facts that would support this purely speculative claim. Moreover, it simply makes no sense to contend that Barnes & Noble builds in the same cost of “data security” into purely cash transactions which involve no data. In short, Plaintiffs have offered no new factual or legal support to alter the Court’s prior decisions rejecting the “diminished value” theory in this and other cases. (See Dkt. No. 57 at 9; see also Sterk v. Best Buy Stores, L.P., 11 C 1894, 2012 WL 5197901, at *7 (N.D. Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 5 of 7 PageID #:514 6 Ill. Oct. 17, 2012) (rejecting diminished value theory “because Defendants charge the same price whether or not it obtains personal information, [thus] the ‘value’ of that information cannot be found to be plausibly factored into the sale price”). CONCLUSION Plaintiffs are still unable to offer any plausible allegations that their data was in fact impacted by the PIN Pad incident or that they have in fact been injured as a result – fourteen months after the security breach and a year and multiple complaints since this litigation commenced. Accordingly, Plaintiffs’ Amended Complaint should be dismissed with prejudice for lack of standing. Dated: November 14, 2013 Respectfully submitted, s/Kristen E. Hudson (ARDC # 6281191) Attorney for Barnes & Noble, Inc. Kenneth L. Chernof Peter V. Baugher (ARDC # 0138282) Hadrian R. Katz Kristen E. Hudson (ARDC # 6281191) ARNOLD & PORTER LLP SCHOPF & WEISS LLP 555 Twelfth Street, NW One South Wacker Drive, 28th Floor Washington, DC 20004 Chicago, Illinois 60606 (202) 942-5000 (312) 701-9300 Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 6 of 7 PageID #:515 7 CERTIFICATE OF SERVICE I, Kristen E. Hudson, an attorney, hereby certify that a true and correct copy of Barnes & Noble, Inc.’s Reply in Support of its Motion to Dismiss the First Amended Consolidated Class Action Complaint was filed electronically with the Clerk of the Court using the CM/ECF System, which will automatically provide electronic notice upon all counsel of record on this 14th day of November, 2013. /s/Kristen E. Hudson Kristen E. Hudson Case: 1:12-cv-08617 Document #: 64 Filed: 11/14/13 Page 7 of 7 PageID #:516