MEMORANDUM AND ORDER
Target Corporation’s Motion to Dismiss the Consumer Plaintiffs’ First Amended Consolidated Class Action Complaint (Docket No. 258) in the Consumer Cases. For the reasons that follow, the Motion is granted in part and denied in part.
BACKGROUND
This case arises out of one of the largest breaches of payment-card security in United States retail history: over a period of more than three weeks during the 2013 holiday shopping season, computer hackers stole credit- and debit-card information and other personal information for approximately 110 million customers of Target’s retail stores. Plaintiffs are a putative class
The Judicial Panel on Multidistrict Litigation consolidated all federal litigation into this case, which is divided into two tracks: one for cases brought by financial institutions and one for cases brought by .consumers. In this Motion, Target asks the Court to dismiss the First Amended Consolidated Class Action Comрlaint
Plaintiffs’ Complaint raises seven claims. Count One contends that Target violated the consumer protection laws of 49 states (all states save Alaska) and the District of Columbia. Count Two alleges a similar violation with respect to the data breach statutes of 38 states. Count III asserts that Target was negligent in failing to safeguard its customers’ data. Count IV raises a claim for breach of an implied contract as to Plaintiffs who were not Target REDcard cardholders, and Count V claims a breach of contract as to Plaintiffs who were Target REDcard cardholders. Count VI claims a bailment, and Count VII claims unjust enrichment. Target seeks dismissal of all claims, contending that the 121-page, 356-paragraph Complaint lacks sufficient detail to support Plaintiffs’ allegations. Cf. Fed.R.Civ.P. 8(a)(2) (requiring a “short and plain statement of the claim”).
DISCUSSION
When evaluating a motion to dismiss under Rule 12(b)(6), the Court assumes the facts in the Complaint to be true and construes all reasonable inferences from those facts in the light most favorable to Plaintiffs. Morton v. Becker,
To survive a motion to dismiss, a complaint must contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly,
A. Standing
1. Injury
Target’s primary argument is that Plaintiffs do not have standing to raise any of their claims because Plaintiffs cannot establish injury. A plaintiff invoking the Article III jurisdiction of the federal courts must establish that he or she has standing to do so. That is, the plaintiff “must have suffered an ‘injury in fact’ — an invasion of a legally protected interest which is (a) concrete and particularized ... and (b) actual or imminent, not conjec
But Plaintiffs have alleged injury. Indeed, paragraphs l.a through l.g and 8 through 94 of the Complaint are a recitation of many of the individual named Plaintiffs’ injuries, including unlawful charges, restricted or blocked access to bank accounts, inability to pay other bills, and late payment charges or new card fees. Target ignores much of what is pled, instead contending that because some Plaintiffs do not allege that their expenses were un-reimbursed or say whether they or their bank closed their accounts, Plaintiffs have insufficiently alleged injury. These arguments gloss over the actual allegations made and set a too-high standard for Plaintiffs to meet at the motion-to-dismiss stage. Plaintiffs’ allegations plausibly allege that they suffered injuries that are “fairly traceable” to Target’s conduct. Allen v. Wright,
2. State Claims
Target also argues that because none of the 114 named Plaintiffs hails from five ' jurisdictions — Delaware, Maine, Rhode Island, Wyoming, or the District of Columbia — claims under the laws of those jurisdictions should be dismissed for lack of standing. Plaintiffs contend that this determination is premature, but ask in the alternative that the Court permit them to amend to add Plaintiffs from these jurisdictions if the Court is inclined to agree with Target.
There is a significant split of authority as to whether a court should address the standing of named plaintiffs at the motion-to-dismiss stage or at the class-certification stage. Another Judge in this District recently decided that the issue is best addressed at the motion-to-dismiss stage, and she dismissed for lack of standing state-law claims for states in which no named plaintiff resided. Insulate SB, Inc. v. Advanced Finishing Sys., Inc., Civ. No. 13-2664,
Insulate was an antitrust putative class action with a single named plaintiff, a California-resident corporation. Insulate’s complaint raised claims for violations of other state’s laws, .and the defendants moved to dismiss contending that Insulate lacked standing to assert state-law claims for states other than California. Id. at *10. Insulate argued, as Plaintiffs do here, that the standing issue was not ripe for decision until after the class-certification stage. Id.
Judge Montgomery noted that the split among courts regarding the proper time to evaluate a named plaintiffs standing
stems from the two Supreme Court cases of Amchem Prods., Inc. v. Windsor,521 U.S. 591 [117 S.Ct. 2231 ,138 L.Ed.2d 689 ] (1997), and Ortiz v. Fibreboard Corp.,527 U.S. 815 [119 S.Ct. 2295 ,144 L.Ed.2d 715 ] (1999). Both cases concern global settlements of class actions, address the standing of absent class members (rather than named plaintiffs) and involve situations in which the court was simultaneously presented*1160 with class certification issues and Article III issues. In each case, the Supreme Court resolved class certification issues prior to resolving Article III standing, because the class certification issues were dispositive in those cases and thus were “logically antecedent to the existence of Article III issues.”
Id. (quoting Amchem,
Although standing is a “threshold issue” usually considered at the outset of the case, Arkansas Right to Life State Political Action Comm. v. Butler,
In addition, there is an important difference between Insulate and the cases on which Insulate relied and this case. Insulate and the other cases holding that standing should be determined before class certification are antitrust cases, in which “ ‘the constitutional and prudential requirements of standing take on particular significance.’ ” In re Ductile Iron Pipe Fittings Indirect Purchaser Antitrust Litig., Civ. No. 12-169,
As Target undoubtedly knows, there are consumers in Delaware, Maine, Rhode Island, Wyoming, and the District of Columbia whose personal financial information was stolen in the 2013 breach. To force Plaintiffs’ attorneys to search out those individuals at this stage serves no useful purpose. In this case, and under the specific facts presented here, the Article III standing analysis is best left to after the class-certification stage. Should a class be certified, and should that class as certified contain no members from certain states, Target may renew its arguments regarding standing.
Finally, Target contends that Plaintiffs lack standing to seek injunctive relief because they do not allege that they face a threat of ongoing or future harm that is certainly.impending. The Prayer for Relief seeks “appropriate injunctive relief’ including an order that Target encrypt all customer data from the point of sale through Target’s payment system, comply with federal and Minnesota law regarding data security and the retention of data, adopt EMV chip technology for Target-issued credit and debit cards, and requiring Target to provide extended credit-monitoring services to Plaintiffs and class members. (Compl. at 121-22, ¶ C.)
To establish “injury in fact” for purposes of injunctive relief, a plaintiff must show that he “faces a' threat of ongoing or future harm.” Park v. U.S. Forest Serv.,
Target’s arguments regarding Plaintiffs’ standing are premature. Plaintiffs have plausibly pled that their injuries will be redressed by the injunctive relief they seek, and at this stage, that is all that is required. The cases on which Target relies determined the injunctive-relief standing issue at the summary-judgment stage, not the motion-to-dismiss stage. As the Supreme Court itself has noted, even
attenuated injuries are sufficient to confer Article III standing at the motion-to-dismiss stage. Whitmore v. Arkansas,
Plaintiffs’ plausible allegations are certainly more substantial than those in SCRAP. Those allegations, taken as true, establish Plaintiffs’ stаnding to seek in-junctive relief. Whether discovery will bear out those allegations is a matter for another day. Target’s Motion on this point is denied.
B. Consumer Protection Laws
Target first contends that Plaintiffs have failed to state a claim under any jurisdiction’s deceptive trade practices statutes.
• by “fail[ing] to maintain adequate computer systems and data security practices;”
• by “failfing] to disclose the material fact that it did not have adequate computer systems and safeguards to adequately protect customers’ personal and financial information;”
• by “failing] to provide timely and accurate notice to [Plaintiffs] of the material fact of the Target data breach;” and
• by continuing to “accept[ ] [Plaintiffs’] credit and debit card payments for purchases at Target after Target knew or should have known of that data breach and before it purged its systems of the hackers’ malware.”
(Id.)
1. Injury
Target contends that Plaintiffs have failed to allege economic injury, as the consumer protection laws in 26 of the 50 jurisdictions require. But Plaintiffs have pled economic injury, in the form of unreimbursed late fees, new card fees, and other charges. Regardless whether Plaintiffs have sufficiently pled economic injuries, however, the law is not as clear on this issue as Target argues. Although some states’ statutes provide that a plaintiff may recover only for “ascertainable loss,” that phrase is in general not limited to only purely economic loss, and includes other damages like loss of prospective customers, Serv. Rd. Corp. v. Quinn,
There are several jurisdictions, such as Wisconsin, in which the consumer protection statutes require “pecuniary loss.” Wis. Stat. § 100.20. Plaintiffs argue that courts in these states have required a “liberal construction” of these statutes, but a court cannot liberally construe a pecuniary-loss requirement to include non-pecuniary losses. Because Plaintiffs have plausibly alleged pecuniary loss, however, they have stated a claim even under state laws that require such loss.
Plaintiffs have plausibly pled injury sufficient to meet the loss requirements in each of the jurisdictions from which their consumer protection claims stem. The determination whether all of the injuries Plaintiffs claim (Compl. ¶ 262) are cognizable under each state’s consumer-protection laws is a matter for summary judgment, not a motion to dismiss.
2. Duty to Disclose
Target next argues that 18 states do not recognize a violation of consumer-protection statutes for omissions unless there was a duty to disclose. According to Target, Plaintiffs have failed to plead a duty to disclose. In addition, Target сontends that Plaintiffs must plead their omission-based consumer-protection claims under Rule 9(b)’s specific pleading requirements. Because of Plaintiffs’ alleged failure to plead with particularity, Target contends that Plaintiffs’ claims under nine states’ statutes — California, Delaware, Kansas, Maryland, Minnesota, New Mexico, Nevada, Pennsylvania, and Texas— should be dismissed, and that portion of Plaintiffs’ claims based on deceptive conduct should be dismissed as to the other nine states’ statutes — Arizona, California,
Plaintiffs allege that Target knew that its customers’ data was sensitive and should be protected, knew that its systems were inadequate to protect that data, and continued to accept credit and debit cards after it knew or should have known that the systems were susceptible to breach or had been breached. (Compl. ¶¶ 283-37.) Target argues that these allegations are insufficient to establish a duty.
Neither party has provided the Court with any legal authority regarding the type of allegations that are sufficient to establish a duty to disclose under a state consumer-protection statute. In the absence of such authority, Plaintiffs’ plausible allegations, taken as true, establish with sufficient specificity that Target had a duty to disclose. Target’s Motion on this point is denied.
3. Injunctive Relief
Target contends that several states’ consumer-protection laws authorize only in-junctive relief, and that Plaintiffs do not have standing to seek such relief. Plaintiffs have plausibly alleged their standing to seek injunctive relief, and this portion of Target’s Motion is denied.
4. No Private Right of Action
Plaintiffs concede that their claims under the Delaware Uniform Deceptive Trade Practices Act and the Oklahoma Deceptive Trade Practices Act fail because there is no private right of action under those statutes. However, Plaintiffs have raised consumer-protection claims under other Delaware and Oklahoma statutes (Compl. ¶¶ 263.g, 263.jj) that Target implicitly concedes do provide a private right of action, and so Plaintiffs’ claims under those laws survive this aspect of the Motion.
In addition, Plaintiffs’ claim under Wisconsin’s Deceptive Trade Practices Act, Wis. Stat. § 100.20, must be dismissed. This statute provides a private right of action only for violations of orders issued by the Wisconsin Department of Agriculture. See Emergency One, Inc. v. Waterous Co.,
5.Class Action
The consumer-protection statutes in eight states — Alabama, Georgia, Kentucky, Louisiana, Mississippi, Montana, South Carolina, and Tennessee — prohibit class-action treatment of claims under those statutes. An additional two states — Ohio and Utah — allow class pursuit of consumer-protection claims only if the challenged act has been declared deceptive by a final court judgment or by the state’s attorney general.
The parties dispute whether a state statute prohibiting class actions applies to bar such class actions in federal court. The dispute centers on a recent Supreme Court decision. Shady Grove Orthopedic Assoc., P.A. v. Allstate Ins. Co.,
In Shady Grove, a patient assigned her rights to insurance benefits arising out of a car accident in which she was injured to the clinic that treated her injuries. Id. at 397,
There is no majority opinion in Shady Grove. Rather, Justice Scalia wrote the opinion of the Court for a plurality of himself and three other Justices. He set forth the “familiar framework” for resolving conflicts between federal rules and state laws: the federal rule governs unless application of the federal rule “exceeds statutory authority or Congress’s rulemaking power” under the Rules Enabling Act,
Justice Stevens, writing alone, concurred in this judgment, but for a different reason than Justice Scalia and the three Justices joining his opinion. Justice Stevens found that New York’s class-action prohibition was procedural in nature, and thus that the application of the federаl rule would not alter any substantive rights. Id. at 432,
Target argues that Justice Stevens’s opinion controls because it is the narrow
Most courts that have evaluated state consumer-protection laws that conflict with Rule 23 have determined that Rule 23 cаnnot be applied to otherwise prohibited class actions, because the class-action prohibition defines the scope of the state-created right, namely the right to bring a lawsuit for violations of the state’s consumer-protection law. Davenport,
Although it is perhaps oversimplification to call Justice Stevens’s concurrence the holding of the Court in Shady Grove, it is clear that five Justices believe that it is the nature of the state statute at issue— whether the statute is substantive or procedural — that governs whether the state law can trump Rule 23’s federal class-action mechanism. This Court agrees with the decisions cited above that when a state legislature creates a private right of action to enforce a state statute’s requirements, the state’s definition of that private right of action to prohibit сlass actions “define[s] the scope of the state-created right,” Shady Grove,
Plaintiffs do not address Target’s argument that a class action is prohibited under Utah’s consumer-protection statute, and thus concede that issue. Plaintiffs assert that a class action is appropriate for violations of Ohio’s statute, and the Complaint catalogs cases holding allegedly similar conduct to be deceptive in violation of Ohio’s statute. (Compl. ¶ 263.Ü.) Plaintiffs contend that this is sufficient to establish entitlement to class-action status under Ohio law. Target responds that none of these cases discusses an “act substantially similar to Target’s alleged conduct.” (Def.’s Reply Mem. at 19.) Target does not further elucidate the alleged substantial differences between the conduct in the Ohio cases and Target’s conduct here.
The Court therefore has insufficient information as to whether any Ohio case has held similar conduct to violate Ohio’s consumer-protection statute. At this stage of the proceeding, the Court must view the allegations in the Complaint in favor of
6. Conclusion
In sum, Plaintiffs’ consumer-protection claims under the Delaware Uniform Deceptive Trade Practices Act, the Oklahoma Deceptive Trade Practices Act, and the Wisconsin Deceptive Trade Practices Act must be dismissed. In addition, Plaintiffs may not maintain a class action as to their claims under the consumer-protection statutes in Alabama, Georgia, Kentucky, Louisiana, Mississippi, Montana, South Carolina, Tennessee, and Utah. The remainder of Target’s Motion on this point is denied.
C. Data Breach Notice Statutes In Count II, Plaintiffs contend that Target violated the data-breach notice statutes of 38 jurisdictions.
1. Damages
Plaintiffs allege that Target violated the data-breach notice statutes of these jurisdictions by failing “to provide timely and accurate notice of the Target data breach.” (Compl. ¶ 286.) Target contends that all of Plaintiffs’ data-breach-statute claims fail because Plaintiffs, cannot show any damages flowing from the alleged violation of the statutes. In the main, Plaintiffs’ delayed-notice damages are “would not have shopped at Target” damages. Target maintains that because Plaintiffs have not alleged when they shopped at Target, they cannot establish any damages from allegedly delayed notice. In other words, because no Plaintiff alleges that he or she shopped at Tаrget on a specific date after Target knew or should have known about the breach but before Target notified consumers about the breach, no Plaintiff can establish “would not have shopped” damages.
This argument is premature. Plaintiffs have pled a “short and plain statement” of their claims, Fed.R.Civ.P. 8(a)(2); discovery will be required to flesh out which Plaintiffs are entitled to claim “would not have shopped” damages. In addition, Plaintiffs allege that Target should have found out about the breach immediately, so that notice potentially could have gone out mere days after the breach. If that is true, then nearly every putative class member may be able to claim “would not have shopped” damages. Target’s Motion on this point is denied.
2. Private Right of Action
According to Target, 29 of the 38 data-breach notice statutes on which Plaintiffs base their claims provide no private right of action. Plaintiffs concede this point as to the claims under Florida, Oklahoma, and Utah law, and have withdrawn those claims. Plaintiffs contend, however, that they are entitled to maintain their claims under the remaining 26 states’ laws either through eight
Target responds that, of the eight data-breach notice statutes that reference con
But again, the statutes are not as cut- and-dried as Target contends. North Dakota’s statute states that the “attorney general may enforce this chapter.” N.D. CentCode § 51-30-07. But the section also states that “[a] violation of this chapter is deemed a violation of [the consumer-protection statute],” and that the “remedies .... of this chapter are not exclusive and are in addition to all other causes of action, remedies, and penalties under [the consumer-protection statute]....” Id. Target does not dispute that North Dakota’s consumer-protection statute contains a private right of action. Thus, absent a case construing North Dakota law to preclude private enforcement of the data-breach notice statute, Plaintiffs have plausibly claimed that there is a private right of action under that statute.
Similarly, the Oregon statute provides that the director may enforce the data-breach notice statute, but the same section states that “the director may order compensation to consumers only upon a finding that enforcement of the rights of the consumers by private civil action would be so burdensome or expensive as to be impractical.” Or.Rev.Stat. § 646A.624(3). This section implies that private civil actions are available, and without any contrary authority, Plaintiffs have plausibly alleged that they are entitled to private enforcement of Oregon’s data-breach notice statute.
As to the six states that explicitly allow enforcement of the data-breach notice statute through the consumer-protection statute, Target contends that Plaintiffs have not sufficiently pled that the data-breach violation is a violation of the state’s consumer-protection law. But Plaintiffs have pled both a violation of each state’s consumer-protection law and a violation of the state’s data-breach notice statute. Such pleading puts Target on notice of the claims against them. Plaintiffs’ data-breach claims under these states — Alaska, Illinois, Maryland, Montana, New. Jersey, North Carolina, North Dakota, and Oregon — survive Target’s Motion.
Finally, there are 14 states that either provide for attorney general enforcement in what Plaintiffs contend is “permissive, non-exclusive language” and four states that are silent as to the enforcement of the data-breach notice statute. Aside from Minnesota’s data-breach notice statute, the parties do not discuss any of the remaining 17 states’ statutes specifically in their briefs, instead relying on the summary of each state’s law provided in their respective appendices. The appendices are intended to assist the Court, but instead serve to obfuscate the issues and make determining each parties’ arguments and each state’s law difficult. The Court understands that the parties operate under Court-imposed word-count limitations, but in the future they would be better served by requesting an extension of those limits, rather than attempting to reference legal principles buried in lengthy appendices.
There are two types of enforcement provisions typically found in state data-breach notice statutes: Attorney General or government enforcement only, or states in which the enforcement provision is either ambiguous or explicitly non-exclusive. And as noted, four states’ laws are silent as to enforcement. To simplify the follow
3. Attorney General enforcement only
The Arkansas data-breach notice statute, Ark.Code § 4-110-101 et seq., provides that a “violation of this chapter is punishable by action of the Attorney General under the provisions of § 4-88-101 et seq.” Ark.Code § 4-110-108. This is clear — only the Arkansas attorney general may enforce the Arkansas data-breach notice statute. Merely because the statute references the broader Arkansas consumer-protection statute does not mean that all of the remedies from the consumer-protection statute are available under the data-breach notice statute. There is no private right of action for violations of the Arkansas data-breach notice statute and Plaintiffs’ Arkansas claim is dismissed.
Connecticut’s data-breach notice statute provides that violations of the statute “shall be enforced by the Attorney General.” Conn. Gen.Stat. § 36a-701b(g). As with Arkansas, this language clearly limits enforcement power to the state’s attorney general and Plaintiffs’ Connecticut claim is dismissed.
Idaho’s law provides that “the primary regulator may bring a civil action to enforce compliance” with the state’s data-breach notice statute. Idaho Code Ann. § 28-51-107. There is no provision for any other enforcement action, and Plaintiffs’ Idaho claim is dismissed.
Massachusetts’s data-breach notice statute provides similarly that the “attorney general may bring an action ... to remedy violations of this chapter.” Mass. Gen. Laws Ch. 93H, § 6. Plaintiffs’ Massachusetts claim is dismissed.
Minnesota’s data-breach notice statute provides that the “attorney general shall enforce this section ... under section 8.31.” Minn.Stat. § 325E.61, subd. 6. Plaintiffs argue that the reference to § 8.31 gives individuals private-enforcement rights, because § 8.31 gives the attorney general non-exclusive authority to prosecute violations of certain statutes, and because subdivision 3a of § 8.31 allows private individuals to sue under the statutes referenced in § 8.31. Plaintiffs’ interpretation stretches the language of the statute beyond the breaking point, however. Minnesota’s data-breach notice statute provides that the “attorney general shall” enforce the statute; that language is unambiguous. Plaintiffs’ Minnesota claim is dismissed.
Similarly, Nebraska law provides that “the Attorney General may issue subpoenas and seek and recover direct economic damages for each affected Nebraska resident injured by a violation of the” data-breach notice statute. Neb.Rev.Stat. § 87-806. There is no provision for any other enforcement of the statute. Plaintiffs’ Nebraska claim is dismissed.
Nevada’s enforcement provision limits enforcement to a temporary or permanent injunction, and provides that “the Attorney General or district attorney may bring an action” to obtain that injunction. Nev. Rev.Stat. § 603A.920. Nevada law also provides that a data collector may bring a civil action against a person who steals personal information from the data collector’s records, id. § 603A.900, but that situation is not present here. Plaintiffs’ Nevada clаim is dismissed.
Texas’s data-breach notice statute provides only for attorney general enforcement, stating repeatedly that “[t]he attorney general may bring an action to recover the civil penalt[-y,-ies] imposed under this
4.' Ambiguous language or non-exclusive remedies
Colorado’s data-breach notice statute provides that the “attorney general may bring an action ... to address violations of this section,” but also provides that the “provisions of this section are not exclusive.” Col.Rev.Stat. § 6-1^-716(4). This permissive language is, as Plaintiffs’ argue, at least ambiguous as to whether there is a private right of action under Colorado law. Given the procedural posture of this Motion, which requires the Court to view the law in the light most favorable to Plaintiffs, and absent any authority construing this ambiguity to exclude private rights of action, Plaintiffs’ Colorado claim will not be dismissed.
Delaware’s statute provides that “the Attorney General may bring an action ... to address the violations of this chapter.” 6 Del-Code Ann. § 12B-104. The statute further provides that its provisions “are not exclusive.” As in Colorado, it is at least ambiguous whether there is a private right of action. Plaintiffs’ Delaware claim will not be dismissed.
In Iowa, a violation of the data-breach notice statute
is an unlawful practice [under the consumer-protection statute] and, in addition to the remedies provided to the attorney general [in the consumer-protection statute], the attorney general may seek and obtain an order that a party held to violate this section pay damages to the attorney general on behalf of a person injured by this violation. Iowa Code § 715C.2(9)(a). The statute further provides, however, that the “rights and remedies available under this section are cumulative to each other and to any other rights and remedies available under the law.” Id. § 715C.2(9)(b). This is at least ambiguous as to whether private enforcement is permissible, and Plaintiffs’ Iowa claim will not be dismissed.
Kansas’s data-breach enforcement provision is substantially similar to Delaware’s. It provides that “the attorney general is empowered to bring an action .. .• to address violations of this section” and also states that the enforcement provisions are “not exclusive.” Kan. Stat.' Ann. § 50-7a02(g). Plaintiffs’ claim under Kansas law will not be dismissed.
Michigan law provides for a civil fíne for a violation of the data-breach notice statute, and that the “attorney general or a prosecuting attorney may bring an action to recover” that fíne. Mich. Comp. Laws § 445.72(13). The statute also provides that the quoted subsection 13 does “not affect the availability of any civil remedy for a violation of state or federal law.” Id. § 445.72(15). This implies that consumers may bring a civil action to enforce Michigan’s data-breaсh notice statute through Michigan’s consumer-protection statute or other laws. Plaintiffs Michigan claim will not be dismissed.
Wyoming provides that the “attorney general may bring an action in law or equity to address any violation of’ the data-breach notice statute, and that the “provisions of this section are not exclusive.” Wyo. Stat. Ann. §' 40-12-502(f). Plaintiffs’ Wyoming claim will not be dismissed.
5. No enforcement provision
Georgia’s data-breach-notice statute is silent as to enforcement. Ga.Code Ann.
Kentucky’s statute is likewise silent. Ky.Rev.Stat. Ann. § 365.732(2). But Kentucky law elsewhere provides that a “person injured by the violation of any statute may recover from the offender such damages as he sustained by reason of the violation.” Id. § 446.070. This section gives a private right of action for a violation of Kentucky’s data-breach notice statute. Plaintiffs’ Kentucky claim will not be dismissed.
Rhode Island’s statute provides that “[e]ach violation of this chapter is a civil violation for which a penalty of not more than a hundred dollars ($100) per occurrence and not more than twenty-five thousand dollars ($25,000) may be adjudged against a defendant.” R.I. Gen. Laws Ann. § ll-49.2-6(a). “When a statute does not plainly provide for a private cause оf action [for damages], such a right cannot be inferred.’ ” Stebbins v. Wells,
Wisconsin’s statute, like Georgia’s, is silent on enforcement. Wis. Stat. § 134.98. Plaintiffs’ Wisconsin claim will not be dismissed.
6. Conclusion
Plaintiffs have withdrawn their claims under Florida, Oklahoma, and Utah law. In addition, the data-breach notice statutes of Arkansas, Connecticut, Idaho, Massachusetts, Minnesota, Nebraska, Nevada, and Texas allow for enforcement only by the state’s attorney general or other government official, and the Rhode Island statute’s silence on enforcement is to be construed as prohibiting private rights of action. Plaintiffs’ claims under these states’ laws are therefore dismissed. Plaintiffs have plausibly alleged data-breach notice claims from 26 states.
D. Negligence
Target argues that Plaintiffs’ negligence claim must be dismissed because Plaintiffs have failed to allege any damages that were caused by the breaches of duty they allege. Alternatively, Target contends that many states bar negligence claims for economic losses, and Target seeks the dismissal of the negligence claims brought under those states’ laws.
A claim of negligence requires a plaintiff to allege four elements: duty, breach, causation, and injury. Schmanski v. Church of St. Casimir of Wells,
1. Damages
Most of Target’s contentions about damages are the same as those discussed previously with respect to standing. Those arguments, as discussed, are premature.
Target raises one new argument: that Plaintiffs have not alleged any damages whatsoever flowing from the alleged delay in notifying. them of the breach. The Complaint contends that timely disclosure of the breach would have allowed Plaintiffs to “take appropriate measures to avoid unauthorized charges ..:, cancel or change usernames and passwords on compromised accounts, monitor their account information and credit reports for fraudulent activity, contact their banks ..., obtain credit monitoring services and * take other steps to mitigate or ameliorate the damages caused by Target’s misconduct.” (Compl. ¶292.) Although Target would like a more detailed explanation of what damages were caused by the delayed breach notification, the allegations in the Complaint are not fatally insufficient. Rather, those allegations are a “short and plain statement,” Fed.R.Civ.P. 8(a)(2), that plausibly alleges that Plaintiffs suffered damage as a result of the delay. Plaintiffs’ negligence claim will not be dismissed on this basis.
2. Economic Loss Rule
The economic loss rule “bars a plaintiff from recovering for purely economic losses under a tort theory of negligence.” In re Michaels Stores Pin Pad Litig.,
. Target’s opening brief contends that the economic loss rule bars Plaintiffs’ negligence claims in 20 states. (Def.’s Supp. Mem. (Docket No. 205) at 29-30.) Target’s reply brief seems to narrow that to 12 states, stating that in eight of those original 20 states “the economic loss rule does not bar plaintiffs’ negligence claims absent some contractual duty.” (Def.’s Reply Mem. (Docket No. 246) at 24 & n. 22.) Thus, Target appears to concede that only 12 states would apply the economic loss rule to bar Plaintiffs’ claims here. However, Target’s reply brief appendix lists only 11 states that it argues would apply the economic loss rule to facts similar to this case, and although the parties did not clarify the issue at the hearing, the Court will assume that only these 11 states are at issue.
Courts in five of these states — -California, Georgia, Illinois, Massachusetts, and Pennsylvania — have faced data-breach claims such as those here; all of these courts dismissed the negligence claims based on the economic loss rule. Plaintiffs contend that these decisions are wrong and do not correctly apply the laws of the states in two ways. First, Plaintiffs assert that each state recognizes an independent-duty exception to the economic loss rule, so the rule does not apply where the duty alleged is an independent duty that does not arise from commercial expectations.
a.Alaska
Plaintiffs contend that Alaska recognizes an independent-duty exception to the economic loss rule. (Pls.’ App’x Ex. C (citing Mattingly v. Sheldon Jackson College,
b.California
A court applying California law has dismissed negligence claims in a data-breach case under the economic loss rule. In re Sony Gaming Networks & Customer Data Sec. Breach Litig. (“Sony II ”),
c.District of Columbia
There is only one decision in the District of Columbia that addresses the economic loss rule and the parties disagree about its import. Aguilar v. RP MRP Washington Harbour, LLC,
Although the Aguilar court affirmed the grant of a motion to dismiss based on the economic loss rule, much of the opinion discussing the “special relationship” excep
d. Georgia
Target cites to a data-breach case in Georgia that it contends forecloses any argument that Georgia’s economic loss rule does not bar Plaintiffs’ Georgia negligence claims. Willingham v. Global Payments, Inc., No. 1:12cv1157,
The court in Willingham faced a negligence claim brought by consumers against the credit-card processor, not the merchant. The court rejected the notion that an independent duty might lie between the plaintiffs and the credit-card processor. Id. at *19. But that is not the situation here. Plaintiffs and Target have a direct relationship, not an attenuated one.
Plaintiffs cite Waithe v. Arrowhead Clinic, Inc., No. CV 409-021,
Neither party cites any authority regarding the duty Plaintiffs here allege: the duty to safeguard information. Absent Georgia authority refusing to recognize such an independent duty, Plaintiffs’ allegations are sufficient to establish that the economic loss rule does not bar their Georgia negligence claims.
e. Idaho
Under Idaho law, the economic loss rule will bar a negligence claim for pecuniary loss unless there is a special relationship between the parties or “where unique circumstances require a reallocation of the risk.” Aardema v. U.S. Dairy Sys., Inc.,
Target points to a case holding that the “sale and purchase of a particular product does not create the type of ‘unique circumstance’ required to justify a different allocation of risk.” Millenkamp v. Davisco Foods Int’l, Inc.,
f.Illinois
The court in In re Michaels faced a data-breach case similar to the instant matter and determined that Illinois’s economic loss rule barred the plaintiffs’ negligence claims.
g.Iowa
Plaintiffs contend that Iowa recognizes the independent-duty exception and that this exception saves their Iowa negligence claim. . But a recent decision by the Iowa Supreme Court forecloses Plaintiffs’ argument. See St. Malachy Roman Catholic Congregation of Geneseo v. Ingram,
h.Massachusetts
Interpreting Massachusetts law, the court in another data-breach case dismissed the plaintiffs’ negligence claim under the economic loss rule. In re TJX Cos. Retail Sec. Breach Litig.,
As noted above, New Hampshire does recognize an independent-duty exception to the economic loss rule. Target contends that this exception does not apply. Wyle v. Lees,
But Plourde also recognized that other independent duties may take a case out of the economic loss rule, although the court did not apply the independent-duty exception in that case. Id. at 1253-54; see also Animal Hosp. of Nashua, Inc. v. Antech Diagnostics, No. 11cv448,
In the absence of authority as to the application of an indeрendent duty under New Hampshire law, or excluding a situation akin to that here from the application of any independent-duty exception, dismissal of Plaintiffs’ New Hampshire negligence claim at this stage is not warranted.
j.New York
The parties seem to agree that New York recognizes an independent-duty exception to the economic loss rule. Target contends that it does not apply here, but cites no case outlining that exception under New York law. Rather, the case on which Target relies, In re Facebook Inc., IPO Sec. & Derivative Litig.,
k.Pennsylvania
Finally, Pennsylvania courts have determined in a data-breach case that the economic loss rule bars a negligence claim. Sovereign Bank v. BJ’s Wholesale Club, Inc.,
1. Conclusion
The economic loss rule in Alaska, California, Illinois, Iowa, and Massachusetts appears to bar Plaintiffs’ negligence claims under the laws of those states. Plaintiffs’ negligence claims in the remaining states may go forward.
E. Breach of Implied Contract
Count IV of the Complaint claims that Plaintiffs and Target had an implied contract in which Plaintiffs agreed to use their credit or debit cards to purchase goods at Target and Target agreed to safeguard Plaintiffs’ personal and financial information. (Compl. ¶¶ 314-15.) Target contends that Plaintiffs have failed to allege any meeting of the minds as to this alleged implied contract and have therefore failed to state a claim. In support, Target cites two decisions dismissing implied-contract claims for failure tо allege a meeting of the minds. Plaintiffs in turn cite two decisions that found dismissal of such claims premature.
The court in another multidistrict litigation case involving a retail data breach found that plaintiffs had failed to allege any express or implied contract under Nevada, Florida, Texas, and Alabama law. In re Zappos.com, Inc., No. 3:12ev325,
■ Target’s other authority is Krottner v. Starbucks Corp'.,
In contrast, another MDL data-breach case found that whether an implied contract exists is a question of fact under Maine law.
As the In re Hannaford Bros, court found, a determination of the terms of the alleged implied contract is a factual ques
Target also contends that Plaintiffs have failed to establish any damages flowing from the alleged breach of the implied contract. This argument merely restates Target’s contention that Plaintiffs have not alleged any damages here, and as discussed in more detail above, that contention is incorrect.
F.Breach of Contract
The breach of contract claim (Count V) alleges a breach of the REDcard agreement, and is brought only by REDcard debit cardholders. Target’s REDcard debit-card agreement provides that it is governed by South Dakota law. Target argues that Plaintiffs have failed to allege any breach of the agreement or any damages resulting therefrom.
The Complaint specifically alleges that Target breached a provision of the agreement in which Target сlaimed to “use security measures that comply with federal law.” (Compl. ¶ 325.) Target notes that Plaintiffs have not alleged any federal law with which Target failed to comply. Plaintiffs respond that they are not required to plead the law, only sufficient facts to support their claim.
If the breach of the parties’ contract is Target’s alleged failure to comply with federal law, however, Plaintiffs must plead the federal law or laws with which Target allegedly did not comply. The breach-of-contract claim is dismissed without prejudice, so that Plaintiffs may re-plead and sufficiently allege the elements of their breach-of-contract claim, should they wish to do so.
G. Bailment
A bailment is “the delivery of property for some purpose upon a contract, express or implied, that after the purpose has been fulfilled, the property shall be redelivered to the bailor or otherwise dealt with according to his directions.” Indemnity Ins. Co. of N. Am. v. Hanjin Shipping Co.,
H. Unjust Enrichment
The substantive law of unjust enrichment is consistent across all jurisdictions: Plaintiffs must plead that Target “knowingly received or obtained something of value [] which [it] ‘in equity and good conscience’ ” should not have received. ServiceMaster of St. Cloud v. GAB Bus. Servs., Inc.,
Two theories support Plaintiffs’ unjust-enrichment claim. First, Plaintiffs allege that the purchase price of the goods Target sold included a premium for adequate data security. By failing to maintain that
Plaintiffs’ “overcharge” theory has no merit, and the case on which Plaintiffs rely for this theory is not on point. Resnick v. AvMed, Inc.,
In AvMed, every member of the health care plan paid the allegedly increased charge for data security because every member’s personal information was at risk from insufficient security. But the same is not true at Target. Target charges all shoppers the same price for the goods they buy whether the customer pays with a credit card, debit card, or cash. But cash customers face no risk that a computer hacker will steal their personal financial information. If Target charged credit- and debit-card customers more for their purchases to offset the costs of data security, Plaintiffs might have a plausible allegation in this regard. But the fact that all customers regardless of payment method pay the same price renders Plaintiffs’ overcharge theory implausible. See In re Barnes & Noble Pin Pad Litig., No. 12-CV-8617,
Plaintiffs’ “would not have shоpped” theory, however, is plausible and supports their claim for unjust enrichment. If Plaintiffs can establish that they shopped at Target after Target knew or should have known of the breach, and that Plaintiffs would not have shopped at Target had they known about the breach, a reasonable jury could conclude that the money Plaintiffs spent at Target is money to which Target “in equity and good conscience” should not have received. This portion of Plaintiffs’ unjust enrichment claim is not dismissed.
CONCLUSION
As outlined above, the majority of Plaintiffs’ claims survive Target’s Motion. Accordingly, IT IS HEREBY ORDERED that:
1. Defendant’s Motion to Dismiss the Consolidated First Amended Class Action Complaint in the Consumer Cases (Docket No. 202) is GRANTED in part and DENIED in part.
2. Plaintiffs’ claims under the Delaware Uniform Deceptive Trade Practices Act, the Oklahoma Deceptive Trade Practices Act, and the Wisconsin Deceptive Trade Practices Act in Count I are DISMISSED with prejudice. In addi*1179 tion, Plaintiffs may not maintain a class action as to their claims under the consumer-protection statutes in Alabama, Georgia, Kentucky, Louisiana, Mississippi, Montana, South Carolina, Tennessee, and Utah.
3. Plaintiffs have withdrawn their Count II data-breach notice statutory claims under Florida, Oklahoma, and Utah law, and their claims under Arkansas, Connecticut, Idaho, Massachusetts, Minnesota, Nebraska, Nevada, Rhode Island, and Texas law are DISMISSED with prejudice.
4. Plaintiffs’ Count III negligence claims undеr Alaska, California, Illinois, Iowa, and Massachusetts law are barred by the economic loss rule and are DISMISSED with prejudice.
5. Count V, alleging breach of contract, is DISMISSED without prejudice. Plaintiffs shall have 30 days from the date of this Order to file an Amended Complaint sufficiently alleging the required elements of their breach-of-contract claim, should they wish to do so.
6. Count VI, alleging bailment, is DISMISSED with prejudice.
7. Count VII, alleging unjust enrichment, is GRANTED as to Plaintiffs’ “overcharge” theory and DENIED as to Plaintiffs’ “would not have shopped” theory.
Notes
. The First Amended Consolidated Class Action Complaint seeks the eventual certification of multiple classes of Plaintiffs: statewide consumer law classes (Compl. ¶ 240); statewide data breach statute classes (id. ¶ 241); statewide classes for the negligence, breach of implied contract, bailment and/or unjust enrichment claims (id. ¶ 242); and a nationwide Target REDcard class (id. ¶ 243).
. The Court will refer to this pleading as the Complaint.
. Of course, if np class is certified and there are no Plaintiffs from certain jurisdictions, Target may also renew its standing arguments.
. Target also contends that Plaintiffs cannot raise consumer protection claims under states' laws for states in which no named Plaintiff resides. ■ But that argument, as discussed above, is premature.
. Plaintiffs have brought claims under both the California Consumer Legal Remedies Act and the California Unfair Competition Law. According to Target, the Consumer Legal
. Plaintiffs’ brief states that nine states that allow private enforcement of their data-breach notice statute through the state's consumer-protection statute, but Plaintiffs’ Appendix lists only eight states in this category. The ninth state may be Tennessee, which provides for a private right of action in the data-breach notice statute and also provides for enforcement of the data-breach notice statute through the consumer-protection statute. Tenn.Code Ann. § 47-18-2105©; id. § 47-18-2106. Target does not contend that Plaintiffs' claim under Tennessee law should be dismissed for lack of a private right of action.
. These elements are substantially identical in every jurisdiction in which Plaintiffs raise a negligence claim.
. This "special relationship” exception is not the same as the special relationship doctrine discussed in the Court's ruling on the Motion to Dismiss in the Financial Institution Cases. (Dec. 2, 2014 Mem. & Order (Docket No. 261) at 4-5.) In that case, a special relationship creates a duty of care under Minnesota law. Here, a special relationship may prevent the application of the economic loss doctrine.
., Target argues that the two cases on which Plaintiffs rely should be limited to applying to the state laws discussed therein, but does not acknowledge that their own authority similarly dealt with only a few states’ laws. (Def.’s Supp. Mem. at 32 n. 23.)