518 F.Supp.3d 43
D.D.C.2021Background
- In 2014 CareFirst suffered a data breach exposing names, birthdates, email addresses, and subscriber IDs for over one million insureds; seven named plaintiffs (from D.C., Maryland, Virginia) sued on behalf of a putative class.
- The complaint asserted 11 claims (breach of contract, negligence, D.C. CPPA, state consumer-protection statutes, fraud, etc.) and sought damages including heightened risk of identity theft, mitigation costs, and emotional distress; only the Tringlers alleged actual misuse (tax-refund fraud).
- The district court first dismissed for lack of Article III standing; the D.C. Circuit reversed, holding a heightened risk of identity theft can satisfy standing.
- On remand the district court dismissed most claims under Rule 12(b)(6) for failure to plead "actual damages" (and on the independent-duty/contract-duplication ground), leaving only the Tringlers’ claims; the court entered a Rule 54(b) certification but the D.C. Circuit later concluded that certification was improper and dismissed the appeal.
- Plaintiffs moved for reconsideration arguing (i) D.C. contract law does not require actual damages to state a claim, (ii) the D.C. Circuit’s OPM decision treats mitigation/credit-monitoring expenses as "actual damages," and (iii) the D.C. CPPA dismissal as duplicative was error; the district court granted reconsideration in part and denied it in part.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether a D.C. breach-of-contract claim requires pleading actual damages | Attias: D.C. law (Wright/Francis) allows contract claims to proceed without pleaded monetary injury; nominal/declaratory relief suffices | CareFirst: traditional D.C. authorities require proof of damages to state a contract claim | Court: granted reconsideration and reinstated contract claims, deferring resolution of the doctrinal conflict to later proceedings (favoring more recent D.C. decisions) |
| Whether mitigation expenses (credit monitoring) qualify as "actual damages" after In re OPM | Attias: OPM treats prophylactic mitigation costs as actual damages and undermines the district court's prior rejection of mitigation theory | CareFirst: OPM construed a federal statute (Privacy Act) and is not controlling for state-law claims; Randolph remains binding in D.C. | Court: denied reconsideration for D.C. claims (Randolph controls); but granted reconsideration and reinstated Virginia and Maryland consumer-protection claims (concluding OPM makes mitigation damages plausible under those statutes) |
| Whether plaintiffs’ tort claims were properly dismissed as duplicative of contract (independent-duty rule) | Attias: tort duties exist independent of contract and tort claims should proceed | CareFirst: tort theories are not separable from contractual duties; independent-duty rule bars them | Court: affirmed dismissal of the tort claims under the independent-duty rule (no separate duty pleaded) |
| Whether the D.C. CPPA claims were improperly dismissed as duplicative | Attias: Velcoff supports CPPA viability and undermines dismissal | CareFirst: CPPA claims duplicate contract and are barred | Court: denied reconsideration; Velcoff does not change the court’s duplication analysis and CPPA dismissal stands |
Key Cases Cited
- Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017) (heightened risk of identity theft can satisfy Article III standing)
- Attias v. CareFirst, Inc., 365 F. Supp. 3d 1 (D.D.C. 2019) (district court opinion dismissing most claims for failure to plead actual damages and as duplicative; basis for reconsideration)
- Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702 (D.C. 2009) (D.C. Court of Appeals: mitigation/credit-monitoring costs are not "actual damages" absent present misuse)
- In re U.S. Office of Personnel Mgmt. Data Sec. Breach Litig., 928 F.3d 42 (D.C. Cir. 2019) (D.C. Circuit: credit-monitoring and similar prophylactic expenses can constitute "actual damages" under the Privacy Act)
- Wright v. Allen, 60 A.3d 749 (D.C. 2013) (absence of a specific monetary injury does not bar accrual of a breach-of-contract cause of action; nominal/declaratory relief may suffice)
- Cahn v. Antioch Univ., 482 A.2d 120 (D.C. 1984) (traditional D.C. statement that a contract plaintiff must establish the fact of damage and a reasonable estimate)
- Velcoff v. Medstar Health, Inc., 186 A.3d 823 (D.C. 2018) (CPPA pleading does not require matching each allegation to a specific statutory subsection)
- Cobell v. Jewell, 802 F.3d 12 (D.C. Cir. 2015) (discussing district court discretion under Rule 54(b) to revisit interlocutory rulings)