Pisciotta, Luciano v. Old Nat'l Bancorp ( 2007 )

In the
United States Court of Appeals
For the Seventh Circuit
____________
No. 06-3817
LUCIANO PISCIOTTA and DANIEL
MILLS, on behalf of themselves
and others similarly situated,
Plaintiffs-Appellants,
v.
OLD NATIONAL BANCORP,
Defendant-Appellee.
____________
Appeal from the United States District Court
for the Southern District of Indiana, Indianapolis Division.
No. 05 C 668—Larry J. McKinney, Chief Judge.
____________
ARGUED MAY 21, 2007—DECIDED AUGUST 23, 2007
____________
Before RIPPLE, WOOD and EVANS, Circuit Judges.
RIPPLE, Circuit Judge. Plaintiffs Luciano Pisciotta and
Daniel Mills brought this action on behalf of a putative
class of customers and potential customers of Old Na-
tional Bancorp (“ONB”). They alleged that, through its
website, ONB had solicited personal information from
applicants for banking services, but had failed to secure it
adequately. As a result, a third-party computer “hacker”
was able to obtain access to the confidential information of
tens of thousands of ONB site users. The plaintiffs sought
2 No. 06-3817
damages for the harm that they claim to have suffered
because of the security breach; specifically, they requested
compensation for past and future credit monitoring
services that they have obtained in response to the compro-
mise of their personal data through ONB’s website. ONB
answered the allegations and then moved for judgment on
the pleadings under Rule 12(c). The district court granted
ONB’s motion and dismissed the case. The plaintiffs timely
appeal. For the reasons set forth in this opinion, we affirm
the judgment of the district court.
I
BACKGROUND
A. Facts
ONB operates a marketing website on which individuals
seeking banking services can complete online applica-
tions for accounts, loans and other ONB banking services.
The applications differ depending on the service requested,
but some forms require the customer or potential cus-
tomer’s name, address, social security number, driver’s
license number, date of birth, mother’s maiden name and
credit card or other financial account numbers. In 2002 and
2004, respectively, Mr. Pisciotta and Mr. Mills accessed
this website and entered personal information in connec-
tion with their applications for ONB banking services.
In 2005, NCR, a hosting facility that maintains ONB’s
website, notified ONB of a security breach. ONB then sent
written notice to its customers. The results of the investiga-
tion that followed have been filed under seal in this court;
for present purposes, it will suffice to note that the scope
and manner of access suggests that the intrusion was
sophisticated, intentional and malicious.
No. 06-3817 3
B. District Court Proceedings
Mr. Pisciotta and Mr. Mills, on behalf of a putative class
of other ONB website users, brought this action in the
United States District Court for the Southern District of
Indiana. They named ONB and NCR as defendants and
asserted negligence claims against both defendants as
well as breach of implied contract claims by ONB and
breach of contract by NCR. The plaintiffs alleged that:
[b]y failing to adequately protect [their] personal
confidential information, [ONB and NCR] caused
Plaintiffs and other similarly situated past and present
customers to suffer substantial potential economic
damages and emotional distress and worry that third
parties will use [the plaintiffs’] confidential personal
information to cause them economic harm, or sell their
confidential information to others who will in turn
cause them economic harm.
R.37 at 2.
In pleading their damages, the plaintiffs stated that they
and others in the putative class “have incurred expenses
in order to prevent their confidential personal information
from being used and will continue to incur expenses in the
future.” Id. at 4. Significantly, the plaintiffs did not allege
any completed direct financial loss to their accounts as a
result of the breach. Nor did they claim that they or any
other member of the putative class already had been the
victim of identity theft as a result of the breach. The
plaintiffs requested “[c]ompensation for all economic and
emotional damages suffered as a result of the Defendants’
acts which were negligent, in breach of implied contract
or in breach of contract,” and “[a]ny and all other legal
and/or equitable relief to which Plaintiffs . . . are entitled,
4 No. 06-3817
including establishing an economic monitoring proce-
dure to insure [sic] prompt notice to Plaintiffs . . . of any
attempt to use their confidential personal information
stolen from the Defendants.” Id. at 5-6.
NCR moved to dismiss for failure to state a claim; its
motion was granted. This ruling has not been appealed.
ONB, the remaining defendant, answered the second
amended complaint. The plaintiffs moved for class certifi-
cation. ONB then filed a motion for judgment on the
pleadings under Federal Rule of Civil Procedure 12(c) and
a memorandum in opposition to class certification.
The district court granted ONB’s motion for judgment on
the pleadings and denied the plaintiffs’ motion for class
certification as moot. Specifically, the district court con-
cluded that the plaintiffs’ claims failed as a matter of law
because “they have not alleged that ONB’s conduct caused
them cognizable injury.” R.78 at 3. In support of its conclu-
sion, the court noted that, under Indiana law, damages
must be more than speculative; therefore, the plaintiffs’
allegations that they had suffered “substantial potential
economic damages” did not state a claim. Id. (emphasis
in original).
The district court looked to five cases from other district
courts across the Country that had rejected claims for “the
cost of credit monitoring as an alternative award for what
would otherwise be speculative and unrecoverable
damages.” Id. Finding their reasoning persuasive, the
district court concluded that “[t]he expenditure of money
to monitor one’s credit is not the result of any present
injury, but rather the anticipation of future injury that has
not yet materialized.” Id. at 4 (citing Forbes v. Wells Fargo
Bank, N.A., 420 F. Supp. 2d 1018, 1021 (D. Minn. 2006)). The
court also concluded that, although not enumerated as a
No. 06-3817 5
separate cause of action in the complaint, the plaintiffs had
made allegations that could relate to a claim for negligent
infliction of emotional distress; the court dismissed this
claim as well. It noted that, as a matter of Indiana law, any
such action was dependent on an underlying negligence
claim. Id. at 5. Finally, the court concluded that there
could be no action for breach of contract under Indiana
law in the absence of an allegation of cognizable damages.
The plaintiffs then timely appealed the entry of judg-
ment for ONB on the claims for negligence and breach of
implied contract1 and further asked that this court vacate
the order denying class certification as moot.
II
DISCUSSION
We review a district court’s decision on a 12(c) motion
de novo. Moss v. Martin, 473 F.3d 694, 698 (7th Cir. 2007).
We take the facts alleged in the complaint as true, drawing
all reasonable inferences in favor of the plaintiff. Thomas v.
Guardsmark, Inc., 381 F.3d 701, 704 (7th Cir. 2004). We
review the judgment for the defendants by employing the
same standard that we apply when reviewing a motion to
dismiss under Rule 12(b)(6). Guise v. BWM Mortgage, LLC,
377 F.3d 795, 798 (7th Cir. 2004). The complaint must
contain only “a short and plain statement of the claim
showing that the pleader is entitled to relief.” Fed. R. Civ.
P. 8(a)(2); see also Conley v. Gibson, 355 U.S. 41, 47 (1957).
1
The plaintiffs have waived review of the district court’s order
on their claims for negligent infliction of emotional distress.
See Appellants’ Br. at 9 n.4.
6 No. 06-3817
There is no need for detailed factual allegations. Conley,
355 U.S. at 47. However, the statement must “give the
defendant fair notice of what the . . . claim is and the
grounds upon which it rests.” Id. “Factual allegations must
be enough to raise a right to relief above the speculative
level.” Bell Atl. Corp. v. Twombly, __ U.S. __, 127 S. Ct. 1955,
1965 (2007); see also Jennings v. Auto Meter Prods., Inc., ___
F.3d ___, No. 06-2466, slip op. at 7-8 (7th Cir. July 25, 2007).
A. Jurisdiction
The plaintiffs filed this action in the district court under
the Class Action Fairness Act of 2005, Pub. L. 109-2, § 4,
119 Stat. 4, 9 (codified at 28 U.S.C. § 1332(d)) (“CAFA”), on
behalf of a putative class that includes residents of Indiana,
Illinois, Kentucky, Missouri, Ohio and Tennessee. Under
CAFA, the district court had jurisdiction over this action
because “the matter in controversy exceeds the sum or
value of $5,000,000, exclusive of interest and costs,” 28
U.S.C. § 1332(d)(2), and because at least one member of
the proposed class is a citizen of a State different from
ONB. Id. § 1332(d)(2)(A). In short, subject to limitations not
relevant here, CAFA allows for incomplete diversity. Id.; cf.
Strawbridge v. Curtiss, 3 Cranch 267, 7 U.S. 267 (1806)
(interpreting the language of the general federal diversity
statute to require complete diversity). In calculating the
requisite amount in controversy, CAFA requires that
the claims of all the plaintiffs be aggregated. 28 U.S.C.
§ 1332(d)(6); cf. In re Brand Name Prescription Drugs Antitrust
Litig., 123 F.3d 599, 607 (7th Cir. 1997) (noting the otherwise
applicable rule that aggregation is not permitted and,
therefore, at least one plaintiff in a particular class must
satisfy the jurisdictional minimum).
No. 06-3817 7
We have, of course, an independent responsibility to
examine our subject matter jurisdiction. See Steel Co. v.
Citizens for a Better Env’t, 523 U.S. 83, 95 (1998). As we have
noted, in reaching the conclusion that dismissal was
appropriate, the district court in this case relied on
several cases from other district courts throughout the
Country. Many of those cases have concluded that the
federal courts lack jurisdiction because plaintiffs whose
data has been compromised, but not yet misused, have not
suffered an injury-in-fact sufficient to confer Article III
standing.2 We are not persuaded by the reasoning of these
cases. As many of our sister circuits have noted, the injury-
in-fact requirement can be satisfied by a threat of future
harm or by an act which harms the plaintiff only by
increasing the risk of future harm that the plaintiff would
have otherwise faced, absent the defendant’s actions.3 We
2
See Randolph v. ING Life Ins. & Annuity Co., 486 F. Supp. 2d 1,
10 (D.D.C. 2007); Bell v. Acxiom Corp., 2006 WL 2850042, at *2
(E.D. Ark. Oct. 3, 2006) (unpublished); Key v. DSW, Inc., 454 F.
Supp. 2d 684, 690 (S.D. Ohio 2006); Giordano v. Wachovia Sec.,
LLC., 2006 WL 2177036, at *5 (D.N.J. July 31, 2006) (unpub-
lished).
3
See, e.g., Denney v. Deutsche Bank AG, 443 F.3d 253, 264-65 (2d
Cir. 2006) (stating, in dicta, that exposure to toxic substances
creates a cognizable injury for standing purposes, “even though
exposure alone may not provide sufficient ground for a claim
under state tort law”); Sutton v. St. Jude Med. S.C., Inc., 419 F.3d
568, 574-75 (6th Cir. 2005) (holding that standing was present
where a defective medical implement presented an increased
risk of future health problems); Cent. Delta Water Agency v.
United States, 306 F.3d 938, 947-48 (9th Cir. 2002) (holding that
“the possibility of future injury may be sufficient to confer
(continued...)
8 No. 06-3817
concur in this view.4 Once the plaintiffs’ allegations
establish at least this level of injury, the fact that the
plaintiffs anticipate that some greater potential harm might
follow the defendant’s act does not affect the standing
inquiry.
B. Availability of Credit Monitoring Damages Under
Indiana Law
With the issue of jurisdiction resolved, we now turn to
the merits of the plaintiffs’ claim for damages. This case,
invoking CAFA’s special rules for diversity jurisdiction,
alleges causes of action under Indiana law. Our duty,
3
(...continued)
standing on plaintiffs” and concluding that the suit could
proceed when the plaintiffs demonstrated a factual issue about
“whether they suffer a substantial risk of harm”); Friends of
the Earth, Inc. v. Gaston Copper Recycling Corp., 204 F.3d 149, 160
(4th Cir. 2000) (en banc) (“Threats or increased risk thus con-
stitutes cognizable harm.”).
4
See Lac Du Flambeau Band of Lake Superior Chippewa Indians v.
Norton, 422 F.3d 490, 498 (7th Cir. 2005) (“[T]he present impact
of a future though uncertain harm may establish injury in fact
for standing purposes.”); Johnson v. Allsteel, Inc., 259 F.3d 885,
888 (7th Cir. 2001) (holding that an ERISA plan administrator’s
increased discretion increased risk that the participant would
be denied benefits and that “[t]he increased risk the participant
faces as a result is an injury-in-fact” for standing purposes); Vill.
of Elk Grove Vill. v. Evans, 997 F.2d 328, 329 (7th Cir. 1993)
(“[E]ven a small probability of injury is sufficient to create a
case or controversy—to take a suit out of the category of the
hypothetical—provided of course that the relief sought would,
if granted, reduce the probability.”).
No. 06-3817 9
therefore, as in every diversity case, is to apply state
substantive law, as we believe the highest court of the state
would apply it. State Farm Mut. Auto. Ins. Co. v. Pate,
275 F.3d 666, 669 (7th Cir. 2001).
The principal claims in this case are based on a negli-
gence theory. The elements of a negligence claim under
Indiana law are: “(1) a duty owed to plaintiff by defen-
dant, (2) breach of duty by allowing conduct to fall below
the applicable standard of care, and (3) a compensable
injury proximately caused by defendant’s breach of duty.”
Bader v. Johnson, 732 N.E.2d 1212, 1216-17 (Ind. 2000)
(emphasis added). The plaintiffs’ complaint also alleges
that ONB has breached an implied contract. Compensable
damages are an element of a breach of contract cause of
action as well. See McCalment v. Eli Lilly & Co., 860 N.E.2d
884, 894 (Ind. Ct. App. 2007).
As this case comes to us, both the negligence and the
contractual issues can be resolved, and the judgment of
the district court affirmed, if the district court was correct
in its determination that Indiana law would not permit
recovery for credit monitoring costs incurred by the
plaintiffs. We review de novo the district court’s determi-
nation of the content of state law. Hinc v. Lime-O-Sol Co.,
382 F.3d 716, 720 (7th Cir. 2004); see also Salve Regina Coll. v.
Russell, 499 U.S. 225, 231-32 (1991) (rejecting a rule of
deference to district court determinations of state law). We
must determine whether Indiana would consider that the
harm caused by identity information exposure, coupled
with the attendant costs to guard against identity theft,
constitutes an existing compensable injury and consequent
damages required to state a claim for negligence or for
breach of contract. Neither the parties’ efforts nor our
own have identified any Indiana precedent addressing
10 No. 06-3817
this issue. Nor have we located the decision of any court
(other than the district court in this case) that examines
Indiana law in this context. We are charged with predict-
ing, nevertheless, how we think the Supreme Court of
Indiana would decide this issue. See Dumas v. Infinity Broad.
Corp., 416 F.3d 671, 680 n.11 (7th Cir. 2005).
When faced with a novel question of state law, federal
courts sitting in diversity have a range of tools at their
disposal. First, when the intermediate appellate courts of
the state have spoken to the issue, we shall give great
weight to their determination about the content of state
law, absent some indication that the highest court of the
state is likely to deviate from those rulings. See Woidtke v.
St. Clair County, Illinois, 335 F.3d 558, 562 (7th Cir. 2003).
We also shall consult a variety of other sources, including
other “relevant state precedents, analogous decisions,
considered dicta, scholarly works, and any other reliable
data tending convincingly to show how the highest court
in the state would decide the issue at hand.” McKenna v.
Ortho Pharm. Corp., 622 F.2d 657, 663 (3d Cir. 1980); see
generally Dolores K. Sloviter, A Federal Judge Looks at
Diversity Jurisdiction, 78 Va. L. Rev. 1671 (1992) (discussing
the challenges facing federal courts in applying un-
charted areas of state law). In the absence of any authority
from the relevant state courts, we also shall examine the
reasoning of courts in other jurisdictions addressing the
same issue and applying their own law for whatever
guidance about the probable direction of state law they
may provide. See Allstate Ins. Co. v. Tozer, 392 F.3d 950,
952 (7th Cir. 2004).
In the end, however, the plaintiffs must come forward
with some authority to support their view that they have a
right to the relief they seek because, as we have stated, we
No. 06-3817 11
have “limited discretion . . . with respect to untested legal
theories brought under the rubric of state law.” A.W. Huss
Co. v. Cont’l Cas. Co., 735 F.2d 246, 253 (7th Cir. 1984).
Without state authority to guide us, “[w]hen given a choice
between an interpretation of [state] law which reasonably
restricts liability, and one which greatly expands liability,
we should choose the narrower and more reasonable path
(at least until the [state] Supreme Court tells us differ-
ently).”). Todd v. Societe Bic, S.A., 21 F.3d 1402, 1412 (7th
Cir. 1994) (en banc); see also Insolia v. Philip Morris Inc., 216
F.3d 596, 607 (7th Cir. 2000) (“Federal courts are loathe to
fiddle around with state law. Though district courts may
try to determine how the state courts would rule on an
unclear area of state law, district courts are encouraged to
dismiss actions based on novel state law claims.”); Home
Valu, Inc. v. Pep Boys, 213 F.3d 960, 965 (7th Cir. 2000)
(adopting an interpretation of state law which, between
two possible options, “take[s] the approach that is restric-
tive of liability”).5 With these principles in mind, we turn
to our consideration of whether Indiana would recognize
a cause of action for a data exposure injury. Specifically,
we shall examine whether Indiana would compensate
victims who undertake credit monitoring to guard against
identity theft that might follow.
5
We have applied this restrictive approach to a plaintiff’s novel
theory of liability under state law even where the plaintiff had
no choice but to litigate his claim in federal court. Insolia v. Philip
Morris Inc., 216 F.3d 596, 607 (7th Cir. 2000) (noting that even
where “state law . . . is stunted by the ability of [defendants] to
remove cases under diversity jurisdiction . . . . that does not
justify the federal courts imposing a new tort claim” on a state).
12 No. 06-3817
1.
We begin our inquiry with the Indiana authority most
closely addressed to the issue before us. On March 21, 2006,
the Indiana legislature enacted a statute that applies to
certain database security breaches. Specifically, the statute
creates certain duties when a database in which personal
data, electronically stored by private entities or state
agencies, potentially has been accessed by unauthorized
third parties. I.C. § 24-4.9 et seq.6 The statute took effect on
6
For present purposes, it will suffice to note the relevant
substantive provisions added to the Indiana Code by § 6 of
Public Law 125-2006 (Mar. 21, 2006), codified at I.C. § 24-4.9 et
seq.:
(a) Except as provided in section 4(c), 4(d), and 4(e) of this
chapter, after discovering or being notified of a breach of
the security of a system, the data base owner shall disclose
the breach to an Indiana resident whose:
(1) unencrypted personal information was or may have
been acquired by an unauthorized person; or
(2) encrypted personal information was or may have
been acquired by an unauthorized person with access to
the encryption key;
if the data base owner knows, should know, or should have
known that the unauthorized acquisition constituting the
breach has resulted in or could result in identity deception
(as defined in IC 35-43-5-3.5), identity theft, or fraud
affecting the Indiana resident.
(b) A data base owner required to make a disclosure under
subsection (a) to more than one thousand (1,000) consumers
shall also disclose to each consumer reporting agency (as
defined in 15 U.S.C. 1681a(p)) information necessary to
(continued...)
No. 06-3817 13
July 1, 2006, see Ind. Pub. L. 125-2006, § 6 (Mar. 21, 2006),
after the particular incident involved in this case; neither
party contends that the statute is directly applicable to the
present dispute.7 We nevertheless find this enactment by
the Indiana legislature instructive in our evaluation of the
probable approach of the Supreme Court of Indiana to
the allegations in the present case.
The provisions of the statute applicable to private en-
tities storing personal information require only that a
database owner disclose a security breach to potentially
affected consumers; they do not require the database owner
to take any other affirmative act in the wake of a breach. If
the database owner fails to comply with the only affirma-
tive duty imposed by the statute—the duty to disclose—the
statute provides for enforcement only by the Attorney
General of Indiana. It creates no private right of action
against the database owner by an affected customer. It
imposes no duty to compensate affected individuals for
inconvenience or potential harm to credit that may follow.8
6
(...continued)
assist the consumer reporting agency in preventing fraud,
including personal information of an Indiana resident
affected by the breach of the security of a system.
I.C. § 24-4.9-3-1 (eff. July 1, 2006).
7
“As a general rule, the law in place at the time an action is
commenced governs. Unless a contrary intention is expressed,
statutes are treated as intended to operate prospectively, and
not retrospectively.” Indiana Dep’t of Envtl. Mgmt. v. Med.
Disposal Servs., Inc., 729 N.E.2d 577, 581 (Ind. 2000) (internal
quotation marks and citation omitted).
8
The Act provides as the exclusive remedy an action by the
Attorney General against the database owner:
(continued...)
14 No. 06-3817
The plaintiffs maintain that the statute is evidence that
the Indiana legislature believes that an individual has
suffered a compensable injury at the moment his personal
information is exposed because of a security breach. We
cannot accept this view. Had the Indiana legislature
intended that a cause of action should be available against
a database owner for failing to protect adequately personal
information, we believe that it would have made some
more definite statement of that intent. Moreover, given
the novelty of the legal questions posed by information
8
(...continued)
A person that is required to make a disclosure or notifica-
tion in accordance with IC 24-4.9-3 and that fails to comply
with any provision of this article commits a deceptive
act that is actionable only by the attorney general under this
chapter.
I.C. § 24-4.9-4-1(a) (emphasis added).
In such an action, the statute provides that the Attorney
General may obtain an injunction against future violations, a
civil penalty of not more than $150,000 per deceptive act and the
Attorney General’s reasonable costs in investigating the act and
maintaining the action. Id. § 24-4.9-4-2; see also Joanna L. Grama
& Scott L. Ksander, Recent Indiana legislation hopes to stem release
of personally identifying information, Res Gestae, Nov. 2006, 35 at
39 (“[B]oth new Ind. Code § 24-4.9 (private entities) and Ind.
Code § 4-1-11 (state agencies) offer no remedy to those persons
whose information was obtained by an unauthorized person as a re-
sult of a security breach, other than that those persons be in-
formed of the breach.” (emphasis added)); id. at 42 n.65 (“Of
course, in a subsequent criminal action against the unauthorized
person who acquired the personal information, a trial court could
order restitution for victims. See Ind. Code § 35-50-2-2.3(a)(5).”
(emphasis added)).
No. 06-3817 15
exposure and theft, it is unlikely that the legislature
intended to sanction the development of common law tort
remedies that would apply to the same factual circum-
stances addressed by the statute. The narrowness of the
defined duties imposed, combined with state-enforced
penalties as the exclusive remedy, strongly suggest that
Indiana law would not recognize the costs of credit moni-
toring that the plaintiffs seek to recover in this case as
compensable damages.
2.
The plaintiffs further submit that cases decided by the
Indiana courts in analogous areas of the law instruct that
they suffered an immediate injury when their informa-
tion was accessed by unauthorized third parties. Specifi-
cally, the plaintiffs claim that Indiana law acknowl-
edges special duties on the part of banks to prevent the
disclosure of the personal information of their customers;
they further claim that Indiana courts have recognized
explicitly the significant harm that may result from a
failure to prevent such a loss. See Indiana Nat’l Bank v.
Chapman, 482 N.E.2d 474 (Ind. Ct. App. 1985); American
Fletcher Nat’l Bank & Trust Co. v. Flick, 252 N.E.2d 839 (Ind.
Ct. App. 1969). In Indiana National Bank v. Chapman, 482
N.E.2d 474 (Ind. Ct. App. 1985), the Court of Appeals of
Indiana considered a claim that, in the course of an investi-
gation into possible financial motives for an arson, the
bank, intentionally and without authorization, had dis-
closed to law enforcement that an account of one of its
customers had been marked for repossession. The court
held that the bank had contracted impliedly with its
customers not to reveal financial information to law
enforcement, absent a public duty. Id. at 482. In American
16 No. 06-3817
Fletcher National Bank & Trust Co. v. Flick, 252 N.E.2d 839
(Ind. Ct. App. 1969), the Court of Appeals considered
liability based on a bank’s erroneous dishonor of a cus-
tomer’s check when a third-party attempted to cash it. The
appellate court concluded that the plaintiff, whose credi-
tors had been told that the plaintiff’s business account had
insufficient funds to cover the checks the plaintiff had
written, had suffered a presumptive present harm to his
business reputation and credit. Id. at 846.
Whatever these cases say about the relationship of banks
and customers in Indiana, they are of marginal assistance
to us in determining whether the present plaintiffs are
entitled to the remedy they seek as a matter of Indiana law.
The reputational injuries suffered by the plaintiffs in
American Fletcher and Indiana National Bank were direct and
immediate; the plaintiffs sought to be compensated for
that harm, rather than to be reimbursed for their efforts to
guard against some future, anticipated harm. We therefore
do not believe that the factual circumstances of the cases
relied on by the plaintiffs are sufficiently analogous to the
circumstances that we confront in the present case to
instruct us on the probable course that the Supreme Court
of Indiana would take if faced with the present question.9
9
The plaintiffs also contend that Article I, Section 12 of the
Indiana Constitution requires courts to fashion common law
remedies in all circumstances, for any harm alleged. That section
provides, in pertinent part, that “every person, for injury done
to him in his person, property, or reputation, shall have rem-
edy by due course of law.” Indiana Const. Art. I, § 12. We are
aware of no precedent from Indiana in which this provision was
held to mandate a damages remedy in a suit by one citizen
(continued...)
No. 06-3817 17
Although not raised by the parties, we separately note
that in the somewhat analogous context of toxic tort
liability,10 the Supreme Court of Indiana has suggested that
compensable damage requires more than an exposure to a
future potential harm. Specifically, in AlliedSignal, Inc. v.
Ott, 785 N.E.2d 1068 (Ind. 2003), the Supreme Court of
Indiana held that no cause of action accrues, despite
incremental physical changes following asbestos ex-
posure, until a plaintiff reasonably could have been
diagnosed with an actual exposure-related illness or
disease. Id. at 1075. In its decision that no compensable
9
(...continued)
against another whenever the plaintiff claims that he has been
“injured.” Indeed, as the Supreme Court of Indiana recently
has observed, “Article I, Section 12 does not specify any particu-
lar remedy for any particular wrong. Rather, it leaves the
definition of wrongs and the specification of remedies to the
legislature and the common law.” Cantrell v. Morris, 849 N.E.2d
488, 499 (Ind. 2006) (emphasis added). As we read this provision
in light of Indiana precedent, it does not appear to command
that the plaintiffs in this case have a present, viable right of
action.
10
See generally Vincent R. Johnson, Cybersecurity, Identity Theft,
and the Limits of Tort Liability, 57 S.C. L. Rev. 255, 305-11 (2005)
(noting the propriety of the analogy between toxic torts and
cybersecurity breaches). We need not endorse this analogy
for present purposes. We merely note that, to the extent the
analogy is apt, it does not support the view that Indiana tort law
recognizes costs of monitoring as a compensable damage. Even
in jurisdictions where medical monitoring has been acknowl-
edged as a compensable damage, courts still have expressed
doubt that credit monitoring also should be compensable. See
Kahle v. Litton Loan Servicing, LP, 486 F. Supp. 2d 705, 712 (S.D.
Ohio 2007); Key, 454 F. Supp. 2d at 691.
18 No. 06-3817
injury occurs at the time of exposure, the court relied on
precedent from both state and federal courts in general
agreement with the principle that exposure alone does
not give rise to a legally cognizable injury. Id. at 1075 n.8.
Although some courts have allowed medical monitoring
damages to be recovered or have created a special cause
of action for medical monitoring under similar circum-
stances, see Badillo v. American Brands, Inc., 16 P.3d 435, 438-
39 & nn.1-2 (Nev. 2001) (citing cases interpreting the law
of seventeen states to allow medical monitoring in some
form), no authority from Indiana is among them. Indeed,
its recent holding in AlliedSignal indicates a contrary
approach. To the extent the decision of the Supreme Court
of Indiana in that matter provides us with guidance on the
likely approach that court would adopt with respect to the
information exposure injury in this case, we think it
supports the view that no cause of action for credit moni-
toring is available.11
3.
Finally, without Indiana guidance directly on point, we
next examine the reasoning of other courts applying the
law of other jurisdictions to the question posed by this case.
Allstate Ins. Co., 392 F.3d at 952. In this respect, several
district courts, applying the laws of other jurisdictions,
have rejected similar claims on their merits. In addition to
11
See also Hendricks v. DSW Shoe Warehouse, Inc., 444 F. Supp. 2d
775, 783 (W.D. Mich. 2006) (dismissing a case where no Michigan
authority supported an action for credit monitoring and
where Michigan had considered and rejected a cause of action
for medical monitoring).
No. 06-3817 19
those cases in which the district court held that the plain-
tiff lacked standing,12 a series of cases has rejected infor-
mation security claims on their merits. Most have con-
cluded that the plaintiffs have not been injured in a manner
the governing substantive law will recognize. See, e.g., Kahle
v. Litton Loan Servicing, LP, 486 F. Supp. 2d 705, 712-13 (S.D.
Ohio 2007) (entering summary judgment for the defendant
because the plaintiff had failed to demonstrate an injury);
Guin v. Brazos Higher Educ. Serv. Corp., Inc., 2006 WL 288483
(D. Minn. Feb. 7, 2006) (unpublished) (same); Stollenwerk
v. Tri-West Healthcare Alliance, 2005 WL 2465906, at *5 (D.
Ariz. Sept. 6, 2005) (unpublished) (granting summary
judgment for defendants because the plaintiffs had failed
to provide evidence of injury); see also Hendricks v. DSW
Shoe Warehouse, 444 F. Supp. 2d 775, 783 (W.D. Mich. 2006)
(dismissing an action where “[t]here is no existing Michi-
gan statutory or case law authority to support plaintiff’s
position that the purchase of credit monitoring con-
stitutes either actual damages or a cognizable loss”).
Although some of these cases involve different types of
information losses, all of the cases rely on the same basic
premise: Without more than allegations of increased risk
of future identity theft, the plaintiffs have not suffered a
harm that the law is prepared to remedy. Plaintiffs have
not come forward with a single case or statute, from any
jurisdiction, authorizing the kind of action they now ask
this federal court, sitting in diversity, to recognize as a
valid theory of recovery under Indiana law. We decline to
adopt a “substantive innovation” in state law, Combs v. Int’l
Ins. Co., 354 F.3d 568, 578 (6th Cir. 2004), or “to invent what
would be a truly novel tort claim” on behalf of the state,
12
See note 2, supra.
20 No. 06-3817
Insolia, 216 F.3d at 607, absent some authority to sug-
gest that the approval of the Supreme Court of Indiana
is forthcoming. See Todd, 21 F.3d at 1412 (noting that fed-
eral courts should be wary of broadening untested
theories of liability under state law); see also Insolia, 216 F.3d
at 607 (noting that we would neither recognize independ-
ently nor certify a question to the state regarding “every
creative but unlikely state cause of action that litigants
devise from a blank slate”); Birchler v. Gehl Co., 88 F.3d 518,
521 (7th Cir. 1996) (favoring narrow interpretation of
undecided issues of liability under state law); Ry. Express
Agency, Inc. v. Super Scale Models, Ltd., 934 F.2d 135, 138 (7th
Cir. 1991) (noting that “recent opinions of this court have
strongly encouraged district courts to dismiss actions based
on novel state law claims”).
In sum, all of the interpretive tools of which we routinely
make use in our attempt to determine the content of
state law point us to the conclusion that the Supreme Court
of Indiana would not allow the plaintiffs’ claim to proceed.
Conclusion
Because we conclude that the damages that the plaintiffs
seek are not compensable as a matter of Indiana law,
we affirm the judgment of the district court.
AFFIRMED
No. 06-3817 21
A true Copy:
Teste:
_____________________________
Clerk of the United States Court of
Appeals for the Seventh Circuit
USCA-02-C-0072—8-23-07