In Re Hannaford Bros. Co. Customer Data Security Breach Litigation ( 2009 )

671 F. Supp. 2d 198 (2009)

In re HANNAFORD BROS. CO. CUSTOMER DATA SECURITY BREACH LITIGATION.

MDL Docket No. 2:08-md-1954.

United States District Court, D. Maine.

November 24, 2009.

Peter L. Murray, Esq., Murray, Plumb & Murray, Lewis J. Saul, Lewis Saul & Associates, Portland, ME, for Plaintiffs.

Clifford Ruprecht, John K. Hatch, Gavin G. McCarthy, Pierce Atwood LLP, Portland, ME, Cynthia L. May, Peter W. Zinober, Greenberg Traurig LLP, Tampa, FL, Michael A. Oakes, Richard L. Wyatt, Jr., Akin Gump Strauss Hauer & Feld LLP, Washington, DC, for Defendants.

CERTIFICATE OF QUESTIONS OF STATE LAW TO THE SUPREME JUDICIAL COURT OF MAINE SITTING AS THE LAW COURT

D. BROCK HORNBY, District Judge.

The United States District Court for the District of Maine finds that this case involves questions of law of the State of Maine that may be determinative of the cause and that there are no clear controlling precedents thereon in the decisions of the Supreme Judicial Court of Maine sitting as the Law Court.

Accordingly, this court hereby CERTIFIES two questions to the Supreme Judicial Court of Maine sitting as the Law Court and respectfully requests the Law Court to provide instructions concerning such questions of state law pursuant to 4 M.R.S.A. § 57 and Maine Rule of Appellate Procedure 25(a).

PROCEDURAL BACKGROUND

In this action, the plaintiffs assert state law claims arising from third-party data theft of financial information held by the defendant grocer, Hannaford Bros. Co. ("Hannaford").^[1] I have determined that Maine law applies to the plaintiffs' claims for relief.

In ruling upon the defendant's motion to dismiss for failure to state a claim, I ruled that the plaintiffs successfully stated substantive liability claims under Maine law for breach of implied contract to take reasonable measures to protect consumers' account information, negligence, and unfair trade practices law. However, I ruled that generally they stated no recoverable damages claims under those three theories of liability because the damages they claimed were uncertain, remote, not reasonably foreseeable, speculative, and, for Maine's Unfair Trade Practices Act ("UTPA") purposes, not substantial. I therefore granted Hannaford's motion to dismiss the claims of all plaintiffs but one. That sole plaintiff, I ruled, had a cognizable injury in fraudulent postings of charges to her account that the bank had not removed. That lone plaintiff stated later that she had been reimbursed by her bank, however, effectively ending the case.

I noted in my decision that Maine law was uncertain on some of the issues. The plaintiffs then moved for reconsideration so that I could certify any uncertain issues of Maine law to the Maine Supreme Judicial Court sitting as the Law Court.

STATEMENT OF FACTS

The Law Court may consider as true the following assertions based upon the federal pleading standards I applied to the plaintiffs' Consolidated Complaint. (Hannaford contests the assertions but maintains that the plaintiffs' claims must fail as a matter of law even if the assertions are true.)

The plaintiffs are customers who used debit cards and credit cards issued by banks and other financial institutions to make purchases in Maine, Florida, New Hampshire, and Vermont at Hannaford grocery stores, at Sweetbay supermarkets owned by Hannaford's sister corporation, and at independent stores where Hannaford provides electronic payment processing services. Hannaford was unsuccessful in protecting the private and confidential financial information transmitted to Hannaford during credit and debit card purchases. As a result, from December 2007 until March 2008, data thieves breached Hannaford's computer system and stole up to 4.2 million debit card and credit card numbers, expiration dates, security codes, PIN numbers and other information belonging to customers including the plaintiffs. The thieves did not acquire customer names. The credit card association, Visa, Inc., notified Hannaford on February 27, 2008, that Hannaford's information technology system had been breached. Hannaford discovered the means of the thieves' access on March 8, 2008, contained it, notified financial institutions on March 10, 2008, and publicly disclosed the breach on March 17, 2008.

There was no identity theft as such, but as a result of the data theft, a number of plaintiffs in this case initially suffered fraudulent and unauthorized charges to their credit card accounts or bank accounts. These plaintiffs spent time and effort identifying the fraudulent charges. They also expended time and effort convincing their banks and credit card companies that the charges were fraudulent and that the fraudulent and unauthorized charges should be reversed. All such charges were eventually reversed. Ultimately, no plaintiff had to pay the fraudulent charges, and none of the named plaintiffs claims specific expenses incurred to remove the fraudulent charges. The plaintiffs have not placed a monetary value upon the time and effort that they spent dealing with credit companies or banks regarding the reversal of the fraudulent charges to their accounts.

QUESTIONS OF LAW TO BE ANSWERED

Although I have ruled that they have not alleged compensable out-of-pocket losses, the plaintiffs seek to recover damages for the value of time and effort that they expended to avoid or remediate harm from fraudulent charges posted to their accounts. They contend that damages for such time and effort are cognizable injuries under Maine law regardless of whether they suffered other forms of cognizable losses. I am not certifying any question under Maine's UTPA, 5 M.R.S.A. § 205-A et seq., because I have concluded that Maine law on damages under that statute and attendant Maine Law Court decisions is clear. But the plaintiffs point out that such damages are said to be recoverable in tort according to the Restatement (Second) of Torts § 919 (1979) and that the Massachusetts Appeals Court has held that such damages may be recovered. See Kuhn v. Capital One Financial Corp., 67 Mass.App.Ct. 1111, 2006 WL 3007931, at *3 (Mass.App.Ct. Oct. 23, 2006) (unpublished). The defendant argues that such damages are remote, unforeseeable, or speculative; are not monetized costs; and are therefore unrecoverable under Maine law. The defendant points to decisions contrary to the Massachusetts case. See, e.g., Forbes v. Wells Fargo Bank, N.A., 420 F. Supp. 2d 1018 (D.Minn.2006). Neither I nor the parties have found any Maine Law Court cases that address this issue directly. If the defendant's contention is correct (as I concluded in my original decision before the Motion for Reconsideration), then the lawsuit will be dismissed in its entirety.

The defendant argues that, even if these time and effort damages claims are cognizable in tort, the economic loss doctrine should bar the plaintiffs' negligence claims because they involve purely economic damages incurred in a contractual relationship without any personal injury or other physical property damages. They say that is the logic of Oceanside at Pine Point Condo. Owners' Association v. Peachtree Doors, Inc., 659 A.2d 267 (Me. 1995), and it is true that some jurisdictions have applied the economic loss doctrine to prevent tort recovery altogether for purely economic damages incurred by parties to a contractual relationship, unless there is also personal injury or physical property damage. See, e.g., Plourde Sand & Gravel Co. v. JGI Eastern, Inc., 154 N.H. 791, 917 A.2d 1250, 1253 (2007) ("While some states generally limit [the economic loss doctrine's] application to products liability cases, . . . New Hampshire . . . expanded its application to other tort cases."); Tietsworth v. Harley-Davidson, Inc., 270 Wis. 2d 146, 677 N.W.2d 233, 241 (2004) ("The economic loss doctrine is a judicially-created remedies principle that operates generally to preclude contracting parties from pursuing tort recovery for purely economic or commercial losses associated with the contract relationship."). The plaintiffs, on the other hand, argue that the economic loss doctrine in Maine is limited to Oceanside's narrow holding that it "do[es] not permit tort recovery for a defective product's damage to itself." 659 A.2d 267, 270 & n. 4. The federal courts have previously been uncertain of the scope of Maine's economic loss doctrine after Oceanside. See, e.g., Maine Rubber Int'l v. Envtl. Mgmt. Group, Inc., 298 F. Supp. 2d 133 (D.Me.2004); Fireman's Fund Ins. Co. v. Childs, 52 F. Supp. 2d 139 (D.Me.1999); Inhabitants of Saco v. General Elec. Co., 779 F. Supp. 186 (D.Me. 1991). If the Maine Law Court were to find that the plaintiffs' time and effort claims are a cognizable injury under Maine tort law but not under Maine contract law, then Hannaford's argument regarding the economic loss doctrine, if correct, would be dispositive of the entire action by providing Hannaford with a defense to the plaintiffs' remaining claim.

In order for this court to rule on the Motion for Reconsideration now pending before it, the following questions of Maine law must be answered:

1. In the absence of physical harm or economic loss or identity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable injury for which damages may be recovered under Maine law of negligence and/or implied contract?

2. If the answer to question # 1 is yes under a negligence claim and no under an implied contract claim, can a plaintiff suing for negligence recover damages under Maine law for purely economic harm absent personal injury, physical harm to property, or misrepresentation?

In accordance with Maine Rule of Appellate Procedure 25(b), I respectfully suggest that the plaintiffs be treated as the appellants before the Law Court.

The Clerk is hereby DIRECTED to cause twelve (12) copies of this Order to be certified, under official seal, to the Maine Supreme Judicial Court sitting as the Law Court. It is FURTHER ORDERED that the Clerk of this Court be, and is hereby, authorized and directed to provide, without any cost, to the Law Court, upon written request of the Chief Justice or the Clerk thereof, copies of any and all filings of the parties herein and of the docket sheets pertaining to this case.

SO ORDERED.

NOTES

[1] The plaintiffs have asserted federal jurisdiction under the Class Action Fairness Act of 2005, 28 U.S.C. § 1332(d), by alleging that at least one plaintiff has citizenship different from Hannaford, that there are more than 100 class members, and that the amount in controversy exceeds $5 million. Hannaford has not contested federal jurisdiction.