Fernandez v. Leidos, Inc.
127 F. Supp. 3d 1078
E.D. Cal.2015Background
- Plaintiff (a current/former U.S. servicemember) sued after backup data tapes containing PII/PHI were stolen from a contractor employee’s car in Sept. 2011; tapes allegedly unencrypted or partially encrypted.
- Complaint asserts causes under CMIA, California UCL, and common law on behalf of a putative class of military members and their families.
- Alleged harms: actual identity theft/medical fraud (credit-report errors causing loss of a contractor job opportunity, attempted account access, targeted mail/email), lost/incomplete medical records, and increased risk of future misuse; also claims loss of value of personal information and diminished value of health services.
- Defendant moved to dismiss under Fed. R. Civ. P. 12(b)(1) (lack of Article III standing) and 12(b)(6) (CMIA applicability). The court treated most arguments as facial 12(b)(1) challenges.
- Court evaluated whether alleged injuries were concrete, particularized, and fairly traceable to the tape theft, and whether any threatened injury was imminent.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing for alleged actual identity theft/medical fraud | Fernandez alleges concrete harms (credit-report fraud prevented security clearance/job; attempted account access; targeted ads; lost medical records) | Allegations are speculative, implausible, and not plausibly traceable to the stolen tapes (missing dates, missing data types on tapes, attenuated chains) | Dismissed for lack of Article III standing |
| Standing based on increased risk of future harm | Theft of sensitive PII/PHI creates a substantial, imminent risk justifying remedial costs | Risk is speculative; harm depends on independent third parties taking many steps to access/use data | Dismissed for lack of standing (no substantial risk/imminence) |
| Standing for invasion of privacy / breach of confidentiality | Mere disclosure constituted confidentiality breach | No plausible allegation anyone viewed/accessed the data; tapes require expertise to read | Dismissed for lack of standing (no alleged access/viewing) |
| Standing for deprivation of value of personal information | Plaintiff says PII/PHI has market value and was deprived of that value | Plaintiff did not allege attempts/intention to sell or any foreclosed transaction | Dismissed for lack of standing (no allegation of lost sale or diminution) |
| Standing for diminished value of healthcare/benefit-of-the-bargain | Healthcare/insurance value diminished by defendant’s failure to safeguard data | Plaintiff received healthcare from provider (not defendant) and alleges no market-loss or overpayment theory | Dismissed for lack of standing (no plausible loss in value) |
| CMIA applicability (Rule 12(b)(6)) | CMIA claim pleaded against defendant as contractor handling PII/PHI for DoD | Defendant not plausibly a CMIA-covered entity (statutory definitions of contractor/provider/plan) | CMIA claim dismissed under Rule 12(b)(6) (no plausible CMIA-covered status); 20 days leave to amend |
Key Cases Cited
- Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (U.S. 2013) (threatened future injury must be certainly impending or present substantial risk; courts wary of speculative chains involving independent actors)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (standards for injury in fact, causation, traceability)
- O’Shea v. Littleton, 414 U.S. 488 (U.S. 1974) (named plaintiff must establish a case or controversy to represent class)
- Leite v. Crane Co., 749 F.3d 1117 (9th Cir. 2014) (distinguishing facial vs. factual Rule 12(b)(1) attacks)
- Safe Air for Everyone v. Meyer, 373 F.3d 1035 (9th Cir. 2004) (facial jurisdictional attack evaluated like Rule 12(b)(6))
- Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375 (U.S. 1994) (party asserting federal jurisdiction bears burden)
- Montana Envtl. Info. Ctr. v. Stone-Manning, 766 F.3d 1184 (9th Cir. 2014) (imminence and substantial risk standards for prospective injury)
- Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334 (U.S. 2014) (imminence standard for pre-enforcement standing)
- In re Sci. Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14 (D.D.C. 2014) (loss of data without evidence of access/use does not confer standing; persuasive precedent applied)