580 F.Supp.3d 21
S.D.N.Y.2022Background
- Plaintiffs Nancy Bohnak and Janet Lea Smith, Florida residents and former employees of Marsh & McLennan Agency (MMA), sued Marsh & McLennan Companies, Inc. and MMA after a 2021 data breach that exposed unencrypted personally identifiable information (including Social Security numbers) of at least 7,000 individuals.
- Plaintiffs allege they took care to keep their PII private and that the breach increased their risk of identity theft and caused mitigation expenses, time lost, and diminution in the value of their PII.
- Plaintiffs filed a nationwide class action under state law (negligence, breach of implied contract, breach of confidence) invoking CAFA diversity jurisdiction.
- Defendants moved to dismiss for lack of subject-matter jurisdiction (standing) and for failure to state a claim.
- The court held Plaintiffs have Article III standing, finding the exposure of PII alleges an intangible, concrete harm analogous to public disclosure of private information.
- The court nevertheless granted dismissal on the merits: Plaintiffs failed to plead cognizable, non-speculative damages or irreparable injury required for monetary relief or injunctive relief under applicable state law, so their substantive claims were dismissed.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing: Is exposure to a data breach a concrete injury? | Exposure to increased risk of identity theft and mitigation expenses are concrete injuries; PII disclosure is a privacy harm. | Mere risk of future harm is speculative; no alleged misuse of data so no concrete injury under TransUnion. | Denied 12(b)(1). Court found a concrete intangible injury analogous to public disclosure of private information and held Plaintiffs have Article III standing. |
| Failure to state a claim: Do Plaintiffs plausibly allege cognizable damages and irreparable harm to support state-law claims and injunctive relief? | Plaintiffs alleged loss/diminution of PII value, out-of-pocket mitigation costs, lost time, and ongoing risk warranting injunctive relief. | Damages are speculative and not proximately caused by disclosure; mitigation costs are self-inflicted or speculative; no irreparable harm to support injunction. | Granted 12(b)(6). Court held damages speculative/not provable with reasonable certainty and mitigation costs not proximately caused; no irreparable injury, so monetary and injunctive relief fail and claims dismissed. |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (pleading standard for plausibility)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (U.S. 2021) (limitations on standing based on mere risk of future harm)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (U.S. 2016) (concreteness requirement for intangible injuries)
- McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2d Cir. 2021) (Second Circuit test for risk-of-identity-theft standing in data-breach cases)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (U.S. 2013) (imminence and speculative harm in standing analysis)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (standing elements)
- Maddox v. N.Y. Mellon Trust Co., N.A., 997 F.3d 436 (2d Cir. 2021) (legislative creations of legally cognizable interests can inform concreteness analysis)