637 F.Supp.3d 55
S.D.N.Y.2022Background
- Travelers’ agency portal auto-populated insurance-quote pages with consumers’ PII (including driver’s license numbers) based on minimal identifying data provided by an agent or requester.
- Cybercriminals obtained agent credentials and accessed the portal to retrieve PII; Travelers sent plaintiff a breach notice even though she never requested insurance and is not a Travelers customer.
- New York State Department of Financial Services issued alerts warning that instant-quote systems were targeted and recommending redaction/disablement of prefill features.
- Plaintiff sued under the Driver’s Privacy Protection Act (DPPA), New York GBL § 349, and state-law negligence and negligence per se claims, seeking damages, declaratory relief, and injunctive relief; Travelers moved to dismiss under Rules 12(b)(1) and 12(b)(6).
- Court denied the jurisdictional challenge, allowed the DPPA, negligence, and negligence-per-se claims to proceed limited to monetary mitigation damages, dismissed the GBL § 349 claim, dismissed declaratory relief tied to FTCA and NY Shield Act, and allowed injunctive relief and declaratory relief derivative of surviving claims.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing (injury-in-fact) | Loss of privacy from DPPA-protected disclosure plus mitigation costs (credit freezes, monitoring) are concrete injuries | No concrete or imminent injury; mere risk and time spent insufficient | Court: Standing adequately alleged — loss of privacy and reasonable mitigation costs satisfy injury-in-fact under Spokeo/TransUnion and McMorris framework; 12(b)(1) denied |
| DPPA liability | Travelers "knowingly" disclosed DMV-derived PII by auto-populating quotes and should have known risk after NYSDFS alerts | No knowing or intentional disclosure by Travelers | Court: DPPA claim survives — auto-populate feature constitutes knowing disclosure or at least redisclosure where Travelers should have known of improper uses |
| Negligence & Negligence per se | Travelers owed a duty to protect PII and violated statutory duties (DPPA, FTCA, NY Shield Act); plaintiff incurred recoverable mitigation costs and other harms | No duty to non-customers; many alleged harms (time, anxiety, lost privacy value) not cognizable damages | Court: Duty plausibly alleged; negligence and negligence per se allowed only as to monetary mitigation damages (credit freezes, monitoring); non-monetary/time/anxiety and lost-value theories dismissed |
| GBL § 349 consumer-fraud claim | Travelers’ practices were consumer-oriented and materially misleading, causing plaintiff’s injury | Plaintiff was never exposed to Travelers’ marketing/representations (not a customer), so no causation | Court: Section 349 claim dismissed — plaintiff not exposed to the alleged deceptive conduct |
| Declaratory & Injunctive relief | Requests declaration of duties under DPPA, NY Shield Act, FTC §5 and injunction requiring security reforms | Relief not an independent cause of action; some statutes do not create private rights | Court: Declaratory relief allowed only derivatively for surviving claims (DPPA, negligence); declaratory requests tied to FTCA and NY Shield Act dismissed; injunctive relief plausibly alleged and may proceed |
Key Cases Cited
- Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) (concrete and particularized injury requirement for standing)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021) (statutory violations require concrete harm; risk of future harm alone insufficient for damages claims)
- McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295 (2d Cir. 2021) (three-factor test for substantial risk of identity theft in data-breach standing analysis)
- Gordon v. Softech Int’l, Inc., 726 F.3d 42 (2d Cir. 2013) (redisclosers of DMV data owe a duty of reasonable care under the DPPA)
- Reno v. Condon, 528 U.S. 141 (2000) (DPPA covers resale and redisclosure of DMV information)
- Senne v. Village of Palatine, 695 F.3d 597 (7th Cir. 2012) ("knowing disclosure" in DPPA context means voluntary disclosure, not necessarily knowledge of illegality)
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (pleading standard for plausibility)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) (plausibility standard for Rule 12(b)(6))
- eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388 (2006) (four-factor test for injunctive relief)
- Carter v. HealthPort Techs., LLC, 822 F.3d 47 (2d Cir. 2016) (standing inquiry at pleading stage)
- John v. Whole Foods Mkt. Grp., Inc., 858 F.3d 732 (2d Cir. 2017) (injury-in-fact is a low threshold ensuring personal stake)