Case Information
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA NEWNAN DIVISION L. ROCHELLE BANKHEAD, Plaintiff,
CIVIL ACTION FILE v. NUMBER 3:24-cv-167-TCB AMAZON.COM, INC.; AMAZON DATA SERVICES INDIA PRIVATE LIMITED; and AMIT AGARWAL, CEO of Amazon India,
Defendants. O R D E R
This case comes before the Court on Defendants’ motion [15] to dismiss and Plaintiff L. Rochelle Bankhead’s motion [24] to amend. I. Background
On October 12, 2023, Bankhead’s Amazon account “ was compromised by an individual who was previously in a personal relationship with [her]. ” [3] at 3. Bankhead alleges that this person used her account to “ purchase a MacBook, gain access to Plaintiffs pay- to accounts, and access her Amazon Kindle Direct Publishing (KDP) earnings. ” Id. at 10. She claims that she changed her password once she learned of the unauthorized access and that Amazon allowed the “ unauthorized party to access [her] account without receiving the necessary authentication codes sent to [her] registered phone number. ” Id. at 7.
Next, Bankhead asserts that she attempted to resolve this issue through Amazon’s customer service channels, but “ Amazon failed to prevent further unauthorized access and did not timely or adequately address the breach. ” Id. at 12. According to Bankhead’s complaint, Amazon updated her account information to remove the email that the intruder used to access the account, but Amazon would not compensate her for the Macbook. See id. at 14.
In her original complaint, Bankhead brings three claims: (1) violation of the Federal Trade Commission Act (“FTCA”) under 15 U.S.C. § 45; (2) violation of the Computer Fraud and Abuse Act (“CFAA”) under 18 U.S.C. § 1030; and (3) common law negligence. Her proposed amended complaint includes the same three causes of action. See [24-2] at 4 – 6. II. Legal Standards
A. Motion to Dismiss To survive a Federal Rule of Civil Procedure 12(b)(6) motion, a
plaintiff must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570 (2007); see also Chandler v. Sec’y of Fla. Dep’t of Transp. , 695 F.3d 1194, 1199 (11th Cir. 2012) (quoting id. ). The Supreme Court has explained this standard as follows:
A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. The plausibility standard is not akin to a “probability requirement,” but it asks for more than a sheer possibility that a defendant has acted unlawfully.
Ashcroft v. Iqbal , 556 U.S. 662, 678 (2009) (citation omitted) (quoting Twombly , 550 U.S. at 556); see also Resnick v. AvMed, Inc. , 693 F.3d 1317, 1324 – 25 (11th Cir. 2012).
Thus, a claim will survive a motion to dismiss only if the factual allegations in the complaint are “enough to raise a right to relief above the speculative level.” Twombly , 550 U.S. at 555 – 56 (citations omitted). “[A] formulaic recitation of the elements of a cause of action will not do.” Id. at 555 (citation omitted). While all well-pleaded facts must be accepted as true and construed in the light most favorable to the plaintiff, Powell v. Thomas , 643 F.3d 1300, 1302 (11th Cir. 2011), the Court need not accept as true the plaintiff’s legal conclusions, including those couched as factual allegations, Iqbal , 556 U.S. at 678.
Accordingly, evaluating a motion to dismiss requires two steps: (1) eliminate any allegations in the pleading that are merely legal conclusions, and (2) where there are well-pleaded factual allegations, “assume their veracity and then determine whether th ey plausibly give rise to an entitlement to relief.” Id. at 679.
B. Motion to Amend Rule 15(a) of the Federal Rules of Civil Procedure provides that
after a responsive pleading has been served, a party may amend its complaint only by leave of court or by written consent of the adverse party. The rule embodies a liberal amendment policy, instructing that courts “should freely give leave when justice so requires.” F ED . R. C IV . P. 15(a)(2). Rule 15(a)’s liberal policy of “permitting amendments to facilitate determination of claims on the merits circumscribes the exercise of the district court ’ s discretion; thus, unless a substantial reason exists to deny leave to amend, the discretion of the district court is not broad enough to permit denial.” Shipner v. E. Air Lines, Inc. , 868 F.2d 401, 407 (11th Cir. 1989). Therefore, the Court should deny leave to amend only where the opposing party demonstrates the amendment will result in undue delay, bad faith, undue prejudice, a repeated failure to cure deficiencies by amendments previously allowed, or futility. Foman v. Davis , 371 U.S. 178, 182 (1962). III. Discussion
As an initial matter, the Court agrees with Defendants that Bankhead’s amended complaint fails to state a claim, and thus, allowing her to amend her complaint would be futile. As detailed below, Bankhead’s claims in her original complaint are legally insufficient. Her amended complaint asserts the same claims and thus is also deficient. Accordingly, her motion to amend will be denied.
Because the Court will not allow amendment, it considers only whether Bankhead’s original complaint states a claim. [1] A. Federal Trade Commission Act Claim To start, Bankhead’s FTCA claim fails as a matter of law because
the FTCA does not provide a private right of action. See Smith v. JP Morgan Chase , 837 F. App ’ x 769, 769 (11th Cir. 2021) (per curiam) (“ A private right of action does not exist under the FTCA .”); Rosenberg v. Blue Cross & Blue Shield of Fla., Inc. , No. 8:18-cv-2648-T-33SPF, 2019 WL 399571, at *4 (M.D. Fla. Jan. 31, 2019) (dismissing a 15 U.S.C. § 45 claim because “ [o]nly the Federal Trade Commission can bring a civil action under 15 U.S.C. § 45(a), which is part of the Federal Trade Commission Act” (quotation and citations omitted)).
B. Computer Fraud and Abuse Act Claim Next, Bankhead fails to state a claim under the CFAA. Bankhead
cites the CFAA generally and does not identify the provision under which she intends to bring this action. The Court will assume that she aims to bring this claim under 18 U.S.C. § 1030(g), which provides that “[a] ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain adopted , No. 1:19-cv-5050, 2020 WL 10046990 (N.D. Ga. Aug. 6, 2020). Accordingly, the Court does not consider these new claims. compensatory damages and injunctive relief or other equitable relief. ” Notably, the plain language of the statute highlights that actions should be brought “against the violator.” Id.
Even though Bankhead did not specify the provision under which she brings this claim, “ none of the forms of conduct listed in § 1030(a)(1 – 7) suggests that a person who does not access a plaintiff ’ s computer, and who does not access any information on the plaintiff ’ s computer, commits the offense. ” Enhanced Recovery Co. v. Frady , No. 3:13-cv-1262-J-34JBT, 2015 WL 1470852, at *11 (M.D. Fla. Mar. 31, 2015). Bankhead does not allege that any Defendant unlawfully accessed her account; rather, she avers that “ Defendants Amazon US and Amazon India knowingly and intentionally allowed unauthorized access to Plaintiff's Amazon account .” [3] at 16 (emphasis added). [2] Therefore, her claim under the CFAA fails as a matter of law because she did not bring it against the person who actually accessed her account without authorization. See Enhanced Recovery , 2015 WL 1470852, at *11 (dismissing a CFAA claim and holding that “[b] ecause Stellar and Akley themselves did not access ERC ’ s computers or any information therein, the Court is disinclined to read the CFAA so broadly as to find that Stellar and Akley directly violated the statute ”); Agilysys, Inc. v. Hall , 258 F. Supp. 3d 1331, 1344 (N.D. Ga. 2017) (dismissing CFAA claim because “ Solutions II did not access Agilysys ’ computers, and therefore, Solutions II may not be held liable as the violator under the CFAA ” (citations omitted)).
C. Common Law Negligence Claim Lastly, Bankhead fails to state a negligence claim under Georgia
law. In her complaint, she alleges that “ Defendants Amazon US, Amazon India, and Amit Agarwal had a duty to exercise reasonable care in safeguarding Plaintiff ’ s personal information and preventing unauthorized access to Plaintiff's account. ” [ 3] at 16. Defendants argue that no such duty exists under Georgia law.
The Georgia Supreme Court’s opinion in Department of Labor v. McConnell , 828 S.E.2d 352 (Ga. 2019), is instructive. There, a department of labor employee inadvertently emailed out a spreadsheet containing sensitive personal information of over 4,000 Georgia residents. These residents had not given permission for their information to be disseminated in this way. The Georgia Supreme Court affirmed that plaintiff failed to state a claim for negligence because the plaintiff did not show that “ the Department owed him or the other proposed class members a duty to protect their information against negligent disclosure. ” McConnell , 828 S.E.2d at 816. In so ruling, the Georgia Supreme Court rejected the premise that a general legal duty exists “ to all the world not to subject [others] to an unreasonable risk of harm.” Id. (alteration in original) (quoting Bradley Ctr. v. Wessner , 296 S.E.2d 693 (Ga. 1982)). The court also rejected the claim that O.C.G.A. §§ 10-1-910 and 10-1-393.8 create a duty to protect information against negligent disclosure.
The Court agrees that McConnell means that Amazon has no legal duty to protect Bankhead’s information from negligent disclosure, and thus, her negligence claim fails.
The cases Bankhead cites in support do not alter this conclusion. Most of the referenced cases do not involve Georgia law and therefore are not authoritative. Bankhead does cite one Georgia case that involves a similar issue, In re Equifax Inc. Customer Data Security Breach Litigation , 999 F.3d 1247 (11th Cir. 2021). While the issues addressed in the Eleventh Circuit’s opinion are not relevant here, the underlying district court order allowed p laintiffs’ negligence and negligence per se claims to proceed based on a finding that Equifax owed plaintiffs a duty of care to safeguard their personal information. In re Equifax, Inc., Customer Data Sec. Breach Litig. , 362 F. Supp. 3d 1295, 1325 (N.D. Ga. 2019).
This case is different. First, the court in Equifax reached its conclusion before the Georgia Supreme Court ’s opinion in McConnell . This is relevant because in McConnell , the Georgia Supreme Court disapproved of the notion that there is a general legal duty to not subject others to an unreasonable risk of harm, which factored into the Equifax court’s finding of a legal duty. See In re Equifax , 362 F. Supp. 3d. at 1326.
Further, the court in Equifax expressly noted that the “ duty of care arises from the allegations that the Defendants knew of a foreseeable risk to its data security systems but failed to implement reasonable security measures. ” Id. at 1325. The Court finds that Equifax is distinguishable because this case is not a data breach case involving an allegedly foreseeable risk to Amazon’s security system.
Accordingly, Amazon had no legal duty to safeguard Bankhead’s information, and she fails to state a claim for negligence. IV. Conclusion
For these reasons, [3] the Court grants Amazon’s motion [15] to dismiss and denies Bankhead’s motion [24] to amend. IT IS SO ORDERED this 15th day of May, 2025. ____________________________________ Timothy C. Batten, Sr. Chief United States District Judge
NOTES
[1] Bankhead seems to raise new claims in her response to Defendants’ motion to dismiss. This is not allowed. Burley v. Specialized Loan Servicing LLC , No. 1:19- cv-5050-MLB-CCB, 2020 WL 10046993, at *5 n.2 (N.D. Ga. July 6, 2020) (“Plaintiff cannot raise new claims for the first time in a response brief, in lieu of seeking leave of court to amend the complaint.” (citation omitted)), report and recommendation
[2] Bankhead’s complaint does not reference Defendant Agarwal in this claim.
[3] Because Bankhead fails to state a claim against any Defendant, the Court need not address Amazon’s supplementary arguments for dismissal.