GREEN v. eBAY INC.

ORDER AND REASONS

SUSIE MORGAN, District Judge.

Before the Court is Defendant eBay Inc.'s ("eBay") Motion to Dismiss Plaintiff's Class Action Complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6).1 In its motion, eBay first argues the Class Action Complaint should be dismissed pursuant to Rule 12(b)(1) because Plaintiff Collin Green, the sole named Plaintiff in this action, has failed to allege a cognizable injury-in-fact; therefore, he lacks Article III standing to pursue this case in federal court. In the alternative, eBay contends the Class Action Complaint should be dismissed pursuant to Rule 12(b)(6) for failure to state a claim upon which relief can be granted.

This case raises the issue of whether the increased risk of future identity theft or identity fraud posed by a data security breach confers Article III standing on individuals whose information has been compromised by the data breach but whose information has not yet been misused. After considering the parties' briefs and the relevant case law, the Court finds itself positioned with the majority of district courts that have held the answer is no. Because Plaintiff has failed to allege a cognizable Article III injury, the Court grants eBay's motion and dismisses the Class Action Complaint for lack of standing.

BACKGROUND

eBay is a global e-commerce website that enables its over 120 million active users to buy and sell in an online marketplace.2 In its normal course of business, eBay maintains personal information of its users, including: names, encrypted passwords, dates of birth, email addresses, physical addresses, and phone numbers.3 In February and March 2014, unknown persons accessed eBay's files containing this user information (the "Data Breach").4 On May 21, 2014, eBay notified its users of the Data Breach and recommended that users change their passwords.5 Although eBay also collects other information, including credit card and bank account information, there is no indication that any financial information was accessed or stolen during the Data Breach.6

Plaintiff Collin Green filed this 10-count consumer privacy putative class action against eBay on behalf of himself and all eBay users in the United States whose personal information was accessed during the Data Breach.7 Plaintiff alleges that as a direct and proximate result of eBay's conduct, "Plaintiff and the putative class members have suffered economic damages,"8 "actual identity theft, as well as (i) improper disclosures of their personal information; (ii) out-of-pocket expenses incurred to mitigate the increased risk of identity theft and/or identity fraud due to eBay's failures; (iii) the value of their time spent mitigating identity theft and/or identity fraud, and/or the increased risk of identity theft and/or identity fraud; (iv) and deprivation of the value of their personal information."9 The Class Action Complaint asserts federal causes of action under the Federal Stored Communications Act, Fair Credit Reporting Act, and Gramm-Leach-Bliley Act and several state law causes of action, including negligence, breach of contract, and violation of state privacy laws. eBay now moves to dismiss the Class Action Complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) for lack of standing and 12(b)(6) for failure to state a claim.10

ANALYSIS

The gravamen of eBay's motion to dismiss is that Plaintiff lacks Article III standing to bring this action in both his individual and representative capacities. eBay contends the Court lacks subject-matter jurisdiction because Plaintiff "has not alleged any cognizable injury whatsoever, and he thus lacks Article III standing."11 eBay argues "Plaintiff does not allege that he has been injured by misuse of the stolen information[,]. . . that anyone has used his password, or that anyone has even tried to commit identity fraud with his information—let alone that anyone has actually succeeded in doing so— and that he has thereby suffered harm."12 Instead, eBay claims "Plaintiff relies on vague, speculative assertions of possible future injury—that maybe at some point in the future, he might be harmed. . . . But the speculative possibility of future injury does not constitute injury-in-fact."13 eBay asserts that the Supreme Court recently made clear in Clapper v. Amnesty International USA that a future injury must be "certainly impending" to establish injury-in-fact, and "[b]ecause Plaintiff has not alleged specific facts constituting an injury that is present or `certainly impending,' Plaintiff lacks standing and the Complaint must be dismissed."14 In support, eBay points to numerous post-Clapper data breach cases where courts have held that neither the increased risk of identity theft nor expenses incurred to mitigate this speculative risk constitute injury-infact as required for Article III standing.15

Plaintiff argues eBay has misconstrued recent Supreme Court case law on standing and contends the Class Action Complaint sufficiently alleges injury-in-fact because Plaintiff and the putative class members are now subject to the "statistically certain threat" of identity theft or identity fraud, and they have incurred, or will incur, costs to mitigate that risk.16 Plaintiff states his personal information was stolen, along with that of all of the members of the putative class, and "[e]mpirical data shows a vast number of the class members will be significantly harmed."17 Although Plaintiff concedes the entire class may not suffer injury,18 he argues the Fifth Circuit "has explained . . . that the fact a section of the class may not suffer the damages alleged is not sufficient to destroy Article III standing; it is the allegation of injury that determines at this phase."19

"Article III of the United States Constitution limits the jurisdiction of federal courts to actual `Cases' and `Controversies.'"20 "One element of the case-or-controversy requirement is that plaintiffs must establish that they have standing to sue."21 Because standing is a matter of subject-matter jurisdiction, a motion to dismiss for lack of standing is properly brought pursuant to Federal Rule of Civil Procedure 12(b)(1).22 Federal courts must dismiss an action if, "at any time," it is determined that subject-matter jurisdiction is lacking.23 As the party invoking federal jurisdiction, the plaintiff constantly bears the burden of establishing the jurisdictional requirements, including standing.24

"To establish Article III standing, a plaintiff must show (1) an `injury in fact,' (2) a sufficient `causal connection between the injury and the conduct complained of,' and (3) a `likel[ihood]' that the injury `will be redressed by a favorable decision.'"25 The first prong focuses on whether the plaintiff suffered harm, the second focuses on who inflicted that harm, and the third focuses on whether a favorable decision will likely alleviate that harm.26 Although all three elements are required for Article III standing, the injury-in-fact element is often determinative.27

In the class action context, "named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class."28 "[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class."29

In this case, eBay contends Green, the only named Plaintiff, lacks standing because he has failed to allege a cognizable injury. The injury-in-fact element "helps ensure that the plaintiff has a personal stake in the outcome of the controversy."30 Recently, the Supreme Court in Clapper v. Amnesty International USA provided guidance on the standard for establishing injury-in-fact:31

Following Clapper, the majority of courts faced with data breach class actions where complaints alleged personal information was accessed but where actual identity theft was not alleged have applied this "certainly impending" standard; notably, where plaintiffs have alleged their injury was the increased risk of identity theft, courts have dismissed the complaints for lack of Article III standing.33 These courts found that the mere increased risk of identity theft or identity fraud alone does not constitute a cognizable injury unless the harm alleged is certainly impending.34

For example, in Strautins v. Trustwave Holdings, Inc., a hacker infiltrated the South Carolina Department of Revenue, and "approximately 3.6 million Social Security numbers, 387,000 credit and debit card numbers, and tax records for 657,000 businesses had been exposed."35 The plaintiff filed a class action claiming she and the other class members incurred the following injuries:

The court in Strautins stated that "[t]hese claims of injury, however, are too speculative to permit the complaint to go forward."37 This is because under Clapper, "allegations of possible future injury are not sufficient to establish standing. . . . [T]he threatened injury must be certainly impending."38

Even where actual fraudulent credit card charges are made after a data breach, courts have held the injury requirement still is not satisfied if the plaintiffs were not held financially responsible for paying such charges. For example, in Peters v. St. Joseph Services Corp., hackers infiltrated a health care service provider's network and accessed personal information of patients and employees, including names, social security numbers, birthdates, addresses, medical records, and bank account information.39 Even though there was an attempted purchase on the plaintiff's credit card, which was declined by the plaintiff when she received a fraud alert, the court held the plaintiff did not have standing.40 The Court found the plaintiff's theory based on a certainly impending or substantial risk of identity theft/fraud was too speculative and attenuated to constitute injury-in-fact because she was unable to "describe how [she would] be injured without beginning the explanation with the word `if.'"41 Similarly, the court in Remijas v. Neiman Marcus Group, LLC found the complaint did not adequately allege standing on the basis of increased risk of future identity theft.42 Despite the fact that thousands of Neiman Marcus customers had actual fraudulent charges on their credit cards, the court found the plaintiffs failed to allege that any of the fraudulent charges were unreimbursed, and the court was "not persuaded that unauthorized credit card charges for which none of the plaintiffs are financially responsible qualify as `concrete' injuries."43

Although Plaintiff's Class Action Complaint states all members of the putative class "have suffered actual identity theft,"44 Plaintiff makes this conclusory statement without any allegations of actual incidents of identity theft that any class member has suffered, let alone that Plaintiff himself has suffered. Plaintiff does not allege that any of the information accessed was actually misused or that there has even been an attempt to use it. Plaintiff has not alleged that his password was decrypted and utilized or that any of his other personal information has been leveraged in any way. As Plaintiff's opposition makes clear, his true argument is that his injury-in-fact is the increased risk of future identity theft or identity fraud—not actual identity theft or identity fraud.45 Thus, for Plaintiff to have standing under Article III, the threat of identity theft or identity fraud must be concrete, particularized, and imminent—meaning the harm must be certainly impending.46

The Court finds Plaintiff has failed to allege an injury-in-fact: the allegations in the Complaint fail to demonstrate a concrete and particularized actual or threatened injury that is certainly impending. In most data breach cases, the complaints allege sensitive information was stolen, such as financial information or Social Security numbers.47 In such cases, courts nonetheless have found that the mere risk of identity theft is insufficient to confer standing, even in cases where there were actual attempts to use the stolen information.48 In this case, there is no evidence that any financial information or Social Security numbers were accessed during the Data Breach. Additionally, the fact there is no evidence of actual or even attempted identity theft or identity fraud further supports the Court's finding that Plaintiff has failed to show the alleged future injury is certainly impending. Furthermore, "[i]t is well settled that `[a] claim of injury generally is too conjectural or hypothetical to confer standing when the injury's existence depends on the decisions of third parties,'"49 and the existence of Plaintiff's alleged injury in this case rests on whether third parties decide to do anything with the information. If they choose to do nothing, there will never be an injury.

Indeed, Plaintiff's Complaint makes clear that he does not face a certainly impending risk of future identity theft or identity fraud. For example, the Complaint states: "Criminals who now possess Plaintiffs' [sic] and the class members' personal information may hold the information for later use, or continue to sell it between identity thieves. Thus, Plaintiff and the class members must be vigilant for many years in checking for fraud in their name, and be prepared to deal with the steep costs associated with identity fraud."50 Additionally, the Complaint states: "Studies indicate that individuals whose personal information is stolen are approximately 9.5 times more likely than other people to suffer identity fraud. Moreover, it can take time before the identity thieves use the stolen information."51 However, an increase in the risk of harm is irrelevant—the true question is whether the harm is certainly impending.52 Just as in Peters v. St. Joseph Sevices Corp., the allegations in Plaintiff's Class Action Complaint make clear that "[t]he misuse of the accessed information could take any number of forms, at any point in time. . . . It may even be impossible to determine whether the misused information was obtained from exposure caused by the Data Breach or from some other source. Ultimately, [Plaintiff's] theory of standing `relies on a highly attenuated chain of possibilities.' As such, it fails to satisfy the requirement that `threatened injury be certainly impending to constitute injury in fact.'"53

Although Plaintiff claims "[t]he only purpose to steal the information [from eBay] is to profit from it,"54 nothing in the Complaint indicates the threat of future identity theft or identity fraud is certainly impending. The potential injury in this case is far too hypothetical or speculative to meet Clapper's certainly impending standard.55 Whether Plaintiff and other class members actually become victims of identity theft depends on numerous variables, including whether their data was actually taken when it was accessed, whether certain information was decrypted, whether the data was actually misused or transferred to another third party and misused, and whether or not the third party succeeded in misusing the information. The mere fact that Plaintiff's information was accessed during the Data Breach is insufficient to establish injury-in-fact. Thus, the potential threat of identity theft or identity fraud, to the extent any exists in this case, does not confer standing on Plaintiff to pursue this action in federal court.56

The Complaint also alleges that Plaintiff and the putative class members have spent, or will need to spend, both time and out-of-pocket expenses to protect themselves from identity theft or identity fraud and/or the increased risk of either occurring.57 As the Supreme Court made clear in Clapper, mitigation expenses do not qualify as injury-in-fact when the alleged harm is not imminent.58 Therefore, Plaintiff's allegations relating to costs already incurred or that may be incurred to monitor against future identity theft or identity fraud likewise fail to constitute injury-in-fact for standing purposes.59

Based on Plaintiff's failure to allege facts showing he has suffered an actual or imminent injury, the Court must dismiss the Class Action Complaint for lack of standing. This disposition is in line with the vast majority of post-Clapper data breach cases where no actual identity theft or identity fraud was alleged.60 Plaintiff lacks standing to sue in federal court unless and until he suffers an actual injury or faces an imminent injury traceable to the Data Breach that can be fully compensated with money damages, and there is simply no compensable injury at this time.

Given the Court's lack of original jurisdiction over Plaintiff's federal claims, the Court declines to exercise supplemental jurisdiction over the state law claims pursuant to 28 U.S.C. § 1367. Thus, the state law claims are dismissed without prejudice.61

CONCLUSION

Based on the foregoing analysis and discussion, Plaintiff has not adequately alleged Article III standing. For that reason, the case must be dismissed for want of subject-matter jurisdiction.62 Accordingly,

IT IS ORDERED that eBay's Motion to Dismiss for lack of standing (R. Doc. 20) be and hereby is GRANTED, and the Class Action Complaint is DISMISSED without prejudice.