Perkins v. Welldynerx, LLC ( 2023 )

UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION ERNEST PERKINS, on behalf of himself and all others similarly situated, Plaintiff, v. Case No. 8:22-cv-2051-TPB-AEP WELLDYNERX, LLC, Defendant. ________________________________/ ORDER GRANTING IN PART “DEFENDANT’S MOTION TO DISMISS PLAINTIFF’S CLASS ACTION COMPLAINT” This matter is before the Court on “Defendant’s Motion to Dismiss Plaintiff’s Class Action Complaint and Memorandum of Law in Support,” filed November 9, 2022. (Doc. 12). Plaintiff filed his response in opposition on January 13, 2023. (Doc. 25). After reviewing the motion, response, court file, and record, the Court finds as follows: Background1 Defendant WellDyneRx, LLC is a pharmacy benefit manager that assists consumers with their prescription medication needs, filling more than 15 million prescriptions each year. On December 2, 2021, Defendant became aware of a 1 The Court accepts as true the facts alleged in the complaint for purposes of ruling on the pending motion to dismiss. See Erickson v. Pardus, 551 U.S. 89, 94 (2007) (“[W]hen ruling on a defendant’s motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint.”). The Court is not required to accept as true any legal conclusions couched as factual allegations. See Papasan v. Allain, 478 U.S. 265, 286 (1986). potential data breach when unauthorized third parties breached its email system and potentially accessed consumers’ personally identifiable information (“PII”) and personal health information (“PHI”) from October 30, 2021, until November 11, 2021. In April 2022, Defendant began notifying potentially affected individuals about the incident. On September 6, 2022, Plaintiff Ernest Perkins filed this purported class action complaint alleging that some of his sensitive personal information was impacted by the data breach. He asserts that he has spent considerable time and effort monitoring his accounts to protect himself from identity theft, and that he is experiencing feelings of anxiety, sleep disruption, stress, and fear for his personal security amidst uncertainty over what financial and medical information was revealed in the data breach. The complaint asserts four claims: negligence, negligence per se, breach of implied contract, and unjust enrichment. Defendant moves to dismiss the complaint for lack of standing. Legal Standard Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain statement of the claim showing the [plaintiff] is entitled to relief.” Fed. R. Civ. P. 8(a). While Rule 8(a) does not demand “detailed factual allegations,” it does require “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In order to survive a motion to dismiss, factual allegations must be sufficient “to state a claim to relief that is plausible on its face.” Id. at 570. When deciding a Rule 12(b)(6) motion, review is generally limited to the four corners of the complaint. Rickman v. Precisionaire, Inc., 902 F. Supp. 232, 233 (M.D. Fla. 1995). Furthermore, when reviewing a complaint for facial sufficiency, a court “must accept [a] [p]laintiff’s well pleaded facts as true, and construe the [c]omplaint in the light most favorable to the [p]laintiff.” Id. (citing Scheuer v. Rhodes, 416 U.S. 232, 236 (1974)). “[A] motion to dismiss should concern only the complaint’s legal sufficiency, and is not a procedure for resolving factual questions or addressing the merits of the case.” Am. Int’l Specialty Lines Ins. Co. v. Mosaic Fertilizer, LLC, 8:09-cv-1264-T-26TGW, 2009 WL 10671157, at *2 (M.D. Fla. Oct. 9, 2009) (Lazzara, J.). Analysis In its motion, Defendant argues that the Court lacks subject matter jurisdiction because the constitutional standing requirements of Article III are not satisfied. To have standing, “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). Here, Defendant challenges whether Plaintiff has stated a cognizable injury in fact. “Only an alleged harm that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical’ is enough to show that a party ‘has a case or controversy rather than, say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees.’” Hunstein v. Preferred Collection and Mgmt. Servs., Inc., 48 F.4th 1236, 1242 (11th Cir. 2022) (quoting TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2206 (2021)). Upon review, the allegations of the complaint do not describe an injury in fact that supports Article III standing. Plaintiff asserts only that a data breach occurred, but “[e]vidence of a mere data breach does not, standing alone, satisfy the requirements of Article III standing.” Holmes v. Villages Tri-County Medical Ctr., Inc., No. 5:21-cv-508-JA-PRL, 2023 WL 315019, at *3 (M.D. Fla. Jan 19, 2023) (quoting Tsao v. Captiva MVP Rest. Partners, LLC, 986 F.3d 1332, 1344 (11th Cir. 2021)). The generalities and speculations alleged in the complaint, such as the increased risk of identity theft and other crimes, does not establish injury-in-fact. See id. at *4. Importantly, Plaintiff claims that he has been exposed to an increased risk of identity theft, but he only speculates as to whether his or anyone else’s information was accessed and does not allege any facts to show that this risk is “certainly impending.” See id. Although Plaintiff is not required to allege actual misuse to establish standing after a data breach, “without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was ‘certainly impending’ – or that there was a ‘substantial risk’ of such harm – will be difficult to meet.” Id. at *4 (quoting Tsao, 986 F.3d at 1343-44). Plaintiff “cannot rely on a risk of future harm for [his] damages claims ‘unless the exposure to the risk of future harm itself causes a separate concrete harm.’” Id. at *5 (quoting TransUnion, 141 S. Ct. at 2211). Plaintiff does not allege a separate concrete harm here, and he has not sufficiently asserted any substantial and imminent risk of future harm. Plaintiff asserts he has been damaged by the loss of value of his PHI and PII. But he does not explain how his personal information has lost value nor could he, without knowing whether ransomware attackers or others actually possess that information. See id. And he asserts neither the actual use nor attempted use of his or anyone else’s personal information. See id. Plaintiff also attempts to allege harm by having to take action to protect against future identity theft, but he “cannot manufacture standing merely by inflicting harm on [himself] based on [his] fears of hypothetical future harm that is not certainly impending.”2 Id. (quoting Clapper v. Amnesty Intern. USA, 568 U.S. 398, 416 (2013)). In the response in opposition, Plaintiff argues that the disclosure of medical information is similar to the common law tort of “disclosure of private information,” which could amount to a concrete injury. However, “finding a common law analog for harm is part of the analysis in cases involving ‘bare’ statutory violations . . . not cases like this one where the [plaintiff’s] claims are already common law causes of 2 The Court notes that it appears Defendant has proposed a credit monitoring service as a possible solution, but Plaintiff claims that this fix is inadequate to address his losses since he faces a risk of identity theft for the rest of his life. action.” Id. Furthermore, “the Eleventh Circuit explained in Hunstein that the tort of disclosure of private information requires ‘publicity’ – that is, the ‘making public – of private information.” Id. (citing Hunstein, 48 F.4th at 1245-49). Here, there are no allegations of publicity. Conclusion Plaintiff does not allege any facts to show that he has suffered an injury in fact sufficient to confer Article III standing. The crux of the complaint is that sensitive information may have been accessed by third parties, and that Plaintiff was notified of the data breach. The fact that the information that allegedly was accessed is sensitive – containing personal identifying information and personal health information – does not mean that Plaintiff has suffered an injury-in-fact. His data breach “assertions boil down to ‘fears of hypothetical future harm,’ which are not concrete injuries.” Id. at *6 (citing Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 926 (11th Cir. 2020)). Absent a concrete injury, Plaintiff does not have standing to pursue his claims in federal court. Although Defendant moves for dismissal with prejudice, the Court will grant leave to file an amended complaint in the event that Plaintiff (or another plaintiff) may be able to establish standing to pursue these claims. Because the Court finds the complaint fails to establish jurisdiction at this time, it does not consider Defendant’s arguments concerning whether Plaintiff has sufficiently stated claims or whether immaterial and impertinent allegations should be stricken. These arguments may be raised again, if appropriate, if an amended complaint is filed. Accordingly, it is ORDERED, ADJUDGED, and DECREED: (1) “Defendant’s Motion to Dismiss Plaintiff's Class Action Complaint and Memorandum of Law in Support” (Doc. 12) is hereby GRANTED to the extent the complaint is DISMISSED WITHOUT PREJUDICE, with leave to amend. (2) The motion is otherwise DENIED WITHOUT PREJUDICE. (3) Plaintiff is directed to file an amended complaint to correct the deficiencies identified in this Order on or before April 7, 2023. Failure to file an amended complaint as directed will result in this Order becoming a final judgment. See Auto. Alignment & Body Serv., Inc. v. State Farm Mut. Auto. Ins. Co., 953 F.3d 707, 719-20 (11th Cir. 2020). DONE and ORDERED in Chambers, in Tampa, Florida, this 23rd day of March, 2023. a A Yh ( -TOMBARBER i (asstsi‘“‘<‘:; UNITED STATES DISTRICT JUDGE Page 7 of 7