Burton v. Mapco Express, Inc.
47 F. Supp. 3d 1279
N.D. Ala.2014Background
- MAPCO suffered a data breach in March–April 2013 exposing customer data; Burton alleged a nationwide class and $300 in unauthorized charges from his debit card.
- Plaintiff asserted four counts: intentional and negligent FRCA violations (Counts I–II), invasion of privacy by public disclosure of private facts (Count III), and negligence (Count IV).
- Defendants MAPCO Express, Inc. and Delek U.S. Holdings, Inc. moved to dismiss for lack of standing and failure to state a claim; court applied Iqbal and considered standing in light of data-breach injury law.
- Court recognized data-breach standing is unsettled; Alabama law requires actual damages for ripeness/standing; court allowed Burton one final amendment to plausibly allege damages.
- Court dismissed FRCA claims (Counts I–II) and invasion of privacy (Count III); granted Burton one final opportunity to amend the negligence claim; denied dismissal on standing for now but warned dismissal could occur if damages remain undeveloped.
- Procedural posture included discussion of MDL transfer considerations and multiple prior related actions against MAPCO; decision reserves leave to amend within 14 days.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Burton has standing/subject-matter jurisdiction for negligence claims. | Burton alleged data breach caused unauthorized charges and ongoing risk. | Burton failed to plead actual damages; standing requires concrete injury. | Standing not established; plaintiff may amend to plausibly allege damages. |
| Whether Burton's negligence claim is plausible under Alabama law. | Damages follow from breach; negligence claim should survive. | Damages not alleged or proven; duty/causation unclear. | Not yet plausible; reiterates leave to amend to cure deficiencies. |
| Whether FCRA claims (Counts I–II) are viable. | Defendants violated FCRA through mishandling consumer information. | Plaintiff lacks statutory standing and specific FCRA violation theory. | Counts I–II are dismissed. |
| Whether invasion of privacy claim (Count III) is viable. | Disclosure of private financial information constitutes publicizing private facts. | No publicity to public at large; negligent breach cannot convert to intentional disclosure. | Count III is dismissed. |
| Whether the court should grant leave to amend the negligence claim. | Court grants 14-day window for a second amended complaint. |
Key Cases Cited
- Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012) (standing for identity-theft injuries recognized; injury in fact with damages)
- In re SAIC Backup Tape Data Theft Litigation, 45 F. Supp. 3d 14 (D.D.C. 2014) (data loss alone not injury; requires accessed/abused data)
- Ex parte Stonebrook Development, L.L.C., 854 So.2d 584 (Ala. 2003) (actual damages required; threat of future harm not enough)
- Ex parte Birmingham News, Inc., 778 So.2d 814 (Ala. 2000) (publicity essential element of invasion of privacy)