Jean Resnick v. AvMed, Inc.
2012 U.S. App. LEXIS 18680
| 11th Cir. | 2012Background
- AvMed suffered a December 2009 data breach when two laptops containing sensitive information, encrypted? unencrypted, were stolen from AvMed's Gainesville office, exposing about 1.2 million current/former members’ data.
- Plaintiffs Juana Curry and William Moore allege they were harmed by identity theft after the breach and were careful to protect their information.
- The district court dismissed the Second Amended Complaint for lack of a cognizable injury and failed standing; plaintiffs appealed.
- Plaintiffs asserted seven Florida-law claims: negligence, negligence per se, breach of contract and implied contract, unjust enrichment, implied covenant of good faith and fair dealing, and fiduciary duty.
- The Eleventh Circuit held plaintiffs had standing to sue but that two claims (negligence per se and breach of the implied covenant of good faith and fair dealing) were not sufficiently pleaded under Florida law; other claims survived dismissal.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing: cognizable injury needed | Curry/ Moore allege actual identity theft as injury | AvMed contends no cognizable Florida injury | Plaintiffs have standing; injury cognizable under Florida law and standing theories |
| Causation: data breach caused identity theft | Breach caused identity theft; nexus shown by thefts | Causation not plausibly alleged; mere temporal link insufficient | Causation pleadings plausibly stated for several counts (negligence, negligence per se, fiduciary duty, contract, implied contract, implied covenant) |
| Negligence per se under Florida law | Violation of Florida Stat. 395.3025 supported liability | Statute applies only to licensed facilities; AvMed not subject | Negligence per se claim defectively plead; Florida statute not applicable to AvMed |
| Breach of the implied covenant of good faith and fair dealing | Breach alleged by failing to safeguard data and comply with law | Implied covenant cannot stand alone; insufficient facts showing conscious/frustrating act | Implied covenant claim not adequately pled under Florida law; dismissed on that ground |
| Unjust enrichment | Premiums were conferred; AvMed benefited from data-security failures | Express contract exists; quasi-contract claim barred | Unjust enrichment claim survives only to the extent no express contract governs; court remanded for further proceedings |
Key Cases Cited
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing requires injury-in-fact, traceability, redressability)
- Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167 (2000) (standing can be found on the pleadings; injury-in-fact)
- Twombly v. Bell Atl. Corp., 550 U.S. 544 (2007) (plausibility standard for pleading)
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (clarifies plausibility standard and factual sufficiency)
- Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263 (11th Cir. 2003) (fairly traceable standard; indirect causation sufficient)
- Stollenwerk v. Tri-West Health Care Alliance, 254 Fed.Appx. 664 (9th Cir. 2007) (example of proximate causation requiring more than temporal connection)
- Anago v. Shaz, 677 F.3d 1272 (11th Cir. 2012) (standing prerequisite and jurisdictional concerns)
- Lambert v. Hartman, 517 F.3d 433 (6th Cir. 2008) (economic harm suffices for standing in data breach context)
- Davis v. Otis Elevator Co., 515 So.2d 277 (Fla. Dist. Ct. App. 1987) (negligence per se elements under Florida law)
- Capitol Envtl. Servs., Inc. v. Earth Tech, Inc., 25 So.3d 593 (Fla. Dist. Ct. App. 2009) (damages for contract-related claims)
- Baron v. Osman, 39 So.3d 449 (Fla. Dist. Ct. App. 2010) (implied contract and breach considerations)