Case Information
USDC SDNY DOCUMENT ELECTRONICALLY FILED UNITED STATES DISTRICT COURT DOC #: _________________ SOUTHERN DISTRICT OF NEW YORK DATE FILED: 2/4/2022 ------------------------------------------------------------------ X PHILLIP TORETTO, DANIEL C. KING, and :
SHERI BRAUN, individually and on behalf of :
others similarly situated, :
: 1:20-cv-2667-GHW Plaintiffs, : -against- : MEMORANDUM OPINION : AND ORDER
DONNELLEY FINANCIAL SOLUTIONS, INC. : and MEDIANT COMMUNICATIONS, INC., :
:
Defendants. :
------------------------------------------------------------------ X
GREGORY H. WOODS, United States District Judge:
Plaintiffs bring this putative class action against Defendants Donnelley Financial Solutions, Inc. (“Donnelley”) and Mediant Communications, Inc. (“Mediant”), alleging claims for negligence, negligence per se , breach of contracts to which Plaintiffs are third-party beneficiaries, unjust enrichment, violation of the California Customer Records Act (the “CRA”), violation of the California Unfair Competition Law (the “UCL”), violation of the Florida Deceptive and Unfair Trade Practices Act (the “FDUTPA”), and declaratory judgment. Plaintiffs’ claims stem from a data breach of one of Mediant’s email servers, in which hackers stole the personal information of over 200,000 individuals. Mediant obtained Plaintiffs’ personal information while working with Donnelley to provide proxy services to public companies and mutual funds in which Plaintiffs had invested. Defendants moved to dismiss Plaintiffs’ complaint. Because Plaintiffs plausibly allege that Mediant breached its duty to exercise reasonable care safeguarding Plaintiffs’ personal information, Plaintiffs’ negligence and declaratory judgment claims against Mediant can proceed. However, Mediant’s motion to dismiss is granted as to the remainder of Plaintiffs’ claims and Donnelley’s motion to dismiss is granted in full.
I. BACKGROUND
Facts [1]
1. The Hack On April 1, 2019, hackers gained unauthorized access to Mediant’s business email accounts. Second Amended Complaint (the “SAC”), Dkt. No. 57, ¶ 16. The hackers stole the personal information of a number of individuals, including the named Plaintiffs in this case. Id. ¶¶ 6–8, 29– 30, 36–38, 42–43. Mediant had received the personal information as part of its business providing investor communication services to financial institutions. ¶ 20. Mediant discovered the hack the day of the intrusion, and promptly disconnected the affected server from its system. Id. ¶ 16. Mediant began an investigation into the breach, but the company did not immediately notify the impacted customers. Id. It was not until the end of May 2019, nearly two months after the breach, that Mediant notified the affected customers. Id. ¶ 17. The breach was truly massive: notices went out to “over 200,000 individuals in all fifty states and the District of Columbia and Puerto Rico.” Id .
Plaintiffs allege that the hack was enabled by Mediant’s poor network security. “The criminal hackers would not have been able to gain access to four email accounts simultaneously but for Mediant maintaining deficient controls to prevent and monitor for unauthorized access.” Id. ¶ 23. And Mediant did not encrypt personal information stored in the company’s system. Id. ¶ 18. Plaintiffs also allege that Mediant failed to adequately notify its customers regarding the breach. Id. ¶¶ 26–27.
2. The “Partnership” Donnelley and Mediant work together to provide proxy services. Id. ¶ 15. Donnelley describes itself as “a leader in risk and compliance solutions, providing insightful technology, industry expertise and data insights to clients across the globe.” Id. ¶ 13. Donnelley offers a broad range of products and services, including in technology, initial public offerings, mergers and acquisitions, proxy services, and other global filings. Id. Mediant “holds itself out as a leader in investor communications, offering ‘game-changing new technologies for banks, brokers, fund companies, and issuers.’” Id. ¶ 14. Together, the pair describe themselves as “the perfect partnership to power [their clients’] fund proxies.” Id . ¶ 15. Defendants’ marketing materials describe the pair as the “industry’s only single-source solution for start-to-finish fund proxy services.” Id. Mediant received the personal information of the named Plaintiffs in this case through its working relationship with Donnelley. Id. ¶¶ 30, 37, 43.
Partially in reliance on Donnelley and Mediant’s description of themselves as a partnership, the SAC alleges that the pair formed a legal partnership and refers to them collectively as the “Partnership.” The SAC alleges that Donnelley “had equal rights in the management and conduct of the Partnership.” Id. ¶ 26. It also states that Donnelley had the “right as a partner in the Partnership” to “exercise appropriate managerial oversight of Mediant’s data security.” Id .
The SAC alleges that the companies and investment funds that used the pair’s services hired Donnelley and Mediant together—not just one or the other, but instead, the touted “perfect partnership.” Id. ¶ 1. The SAC alleges that “[p]ublic companies and mutual funds hire Donnelley and Mediant as their proxy agent to distribute materials to shareholders, coordinate shareholder votes, and tabulate voting results.” Id. The allegation is that the pair are hired jointly as the singular “proxy agent” for the companies and funds.
Donnelley is alleged to be liable for the security breach at Mediant for two reasons. First, Plaintiffs assert that Donnelley is vicariously liable for the hack at Mediant and its consequences because the pair were partners. Id. ¶ 130 (“[B]y entering into a partnership with Mediant for the provision of proxy services, Donnelley is vicariously liable for Mediant’s failures as alleged herein.”); see also id. ¶¶ 4, 26, 130. The SAC attributes many of the asserted deficiencies that led to the breach, and in the response to the breach, to the “Partnership.”
Second, Plaintiffs assert that Donnelley was directly liable for Plaintiffs’ injuries because of its alleged “failure to exercise appropriate managerial oversight of Mediant’s data security.” Id. ¶¶ 4, 26. Donnelley is alleged to have failed “to ensure its agent and partner Mediant implemented security systems, protocols and practices sufficient to protect Plaintiffs’ and Class Members’ Personal Information” and failed “to supervise its agent and partner Mediant regarding Mediant’s data security systems, protocols and practices when it knew or should have known those systems, protocols and practices were inadequate.” Id. ¶ 129. Donnelley is also alleged to have been directly liable as a result of its conduct after the breach because it failed “to timely disclose that Plaintiffs’ and Class Members’ Personal Information had been improperly acquired or accessed.” Id. Donnelley is also alleged to have violated contracts of which Plaintiffs were third party beneficiaries. Id. ¶¶ 145–49.
3. Plaintiffs’ Claims to be Third Party Beneficiaries of Donnelley and Mediant’s Contracts with Their Customers Plaintiffs assert that they are third party beneficiaries of contracts entered into between Donnelley and its customers—the funds and companies to whom it provides proxy and other financial services. Donnelley “entered into contracts with public companies and mutual funds to provide and perform proxy services.” Id. ¶ 145. The personal information of each of the named Plaintiffs was stolen as a result of their investment in identified funds. In the case of each named Plaintiff, the relevant fund had entered into a direct contractual relationship with Donnelley for the provision of proxy services. See, e.g. , id. ¶ 30 (“Donnelley had the direct contractual relationship with Blackstone Real Estate Income Trust, Inc. or its agents for the performance of the Partnership’s proxy services.”); see also id. ¶¶ 37, 43 (alleging the same with respect to funds in which the other named Plaintiffs invested). The SAC also alleges that “[i]n some instances, acting in the ordinary course of the Partnership, Mediant also directly contracted with public companies and mutual funds to provide and perform proxy services.” Id. ¶ 145.
The SAC alleges that Donnelley acted “in the ordinary course of the business of the Partnership” when it entered into contracts with customers to provide proxy services. As a result of Donnelley’s agreement with the funds in which the named Plaintiffs invested, Mediant was provided their personal data, which was later stolen in the hack.
Plaintiffs allege “[o]n information and belief” that “each of those respective contracts contained provisions requiring Donnelley and/or Mediant to protect the investor information that
Donnelley and/or Mediant received in order to provide such proxy services in carrying out the business of the Partnership.” Id. ¶ 146. Also “[o]n information and belief” Plaintiffs allege that “these provisions requiring Donnelley and/or Mediant acting in the ordinary course of the business of the Partnership to protect the personal information of the company/mutual fund’s investors was intentionally included for the direct benefit of Plaintiffs and Class Members, such that Plaintiffs and Class Members are intended third party beneficiaries of these contracts, and therefore are entitled to enforce them.” Id. ¶ 147.
Procedural History
Plaintiffs previously brought actions against Mediant in the Northern District of California
and the Southern District of Florida. Both of those actions were dismissed for lack of personal
jurisdiction.
Toretto v. Mediant Commc’ns, Inc.
, No. 19-cv-52980,
Plaintiffs filed this action on March 30, 2020, naming both Mediant and Donnelley as defendants. Dkt No. 1. On May 19, 2020, Plaintiffs filed their first amended complaint. Dkt No. 23. On July 17, 2020, Mediant moved to dismiss several counts of the first amended complaint; Donnelley moved to dismiss that complaint in its entirety. Dkt Nos. 46, 50.
On August 5, 2020, Plaintiffs filed the second amended complaint. Dkt No. 57. Each
defendant filed a motion to dismiss the SAC pursuant to Fed. R. Civ. P. 12(b)(1), asserting that the
SAC did not adequately plead that Plaintiffs have standing to assert their claims against Defendants.
The Court denied those motions.
See generally Toretto v. Donnelley Fin. Sols., Inc.
, No. 1:20-cv-2667,
II.
LEGAL STANDARDS
Rule 12(b)(6)
“To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted
as true, to ‘state a claim to relief that is plausible on its face.’”
Ashcroft v. Iqbal
,
Determining whether a complaint states a plausible claim is a “context-specific task that
requires the reviewing court to draw on its judicial experience and common sense.”
Iqbal
, 556 U.S.
at 679. The court must accept all facts alleged in the complaint as true and draw all reasonable
inferences in the plaintiff’s favor.
Burch v. Pioneer Credit Recovery, Inc.
,
“[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” A complaint must therefore contain more than “naked assertion[s] devoid of further factual enhancement.” Pleadings that contain “no more than conclusions . . . are not entitled to the assumption of truth” otherwise applicable to complaints in the context of motions to dismiss.
DeJesus v. HF Mgmt. Servs., LLC
,
On a motion to dismiss, a court must generally “limit itself to the facts stated in the
complaint.”
Field Day, LLC v. Cnty. of Suffolk
,
“In considering a motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6), a
district court may consider the facts alleged in the complaint, documents attached to the complaint
as exhibits, and documents incorporated by reference in the complaint.”
DiFolco v. MSNBC Cable
L.L.C.
,
A court can also consider documents that are “integral to” the complaint.
Id.
In order for a
document to meet this exception to the general principle that a court may not consider documents
outside of the pleadings without converting the motion to one for summary judgment, the
complaint must rely heavily upon its terms and effects.
See DiFolco
,
“Where a district court considers material outside of the pleadings that is not attached to the
complaint, incorporated by reference, or integral to the complaint, the district court, to decide the
issue on the merits, must convert the motion into one for summary judgment.”
Id.
“This
requirement ‘deters trial courts from engaging in factfinding when ruling on a motion to dismiss and
ensures that when a trial judge considers evidence [outside] the complaint, a plaintiff will have an
opportunity to contest defendant’s relied-upon evidence by submitting material that controverts it.’”
Id.
(alteration in original) (quoting
Glob. Network Commc’ns
,
Here, Defendants filed a supplier agreement between Donnelley and Mediant in connection with their motions to dismiss. Dkt. No. 97, Ex. A; Dkt. No. 101, Ex. A (the “Supplier Agreement”). Donnelley alleges that the Supplier Agreement governs Donnelley and Mediant’s joint provision of proxy services. The Supplier Agreement was not included, referenced, or relied upon, in the SAC. Nevertheless, Donnelley argues that the Court can consider the Supplier Agreement because the SAC “reference[s] Defendants’ legal relationship and heavily relies on that relationship.” Donnelley’s Reply to Pls.’ Opp’n (“Donnelley Reply”), Dkt. No. 117, at 13. Although the SAC alleges that Donnelley and Mediant are legal partners, the SAC does not allege that the partnership results from any express contract, let alone the specific agreement filed by Defendants. Because the SAC does not rely on the terms and effects of the Supplier Agreement, the Court cannot conclude that it is integral to the complaint. Further, Plaintiffs reasonably challenge the Supplier Agreement’s relevance to Defendants’ alleged partnership to provide proxy services. See Pls.’ Consolidated Opp’n to Defs.’ Motions to Dismiss (“Opp’n”), Dkt. No. 108, at 15–16. Accordingly, the Court has not considered the Supplier Agreement in deciding this motion.
Choice of Law
A federal court sitting in diversity must apply the choice of law rules of the forum state,
which in this case is New York.
See Licci ex rel. Licci v. Lebanese Canadian Bank, SAL
,
which obtain significance in defining State interests are those which relate to the purpose of the
particular law in conflict.”
Schultz v. Boy Scouts of Am., Inc.
,
Ascertaining State Law
“Where the substantive law of the forum state is uncertain or ambiguous, the job of the
federal courts is carefully to predict how the highest court of the forum state would resolve the
uncertainty or ambiguity.”
Phansalkar v. Andersen Weinroth & Co., L.P.
,
by a federal court unless it is convinced by other persuasive data that the highest court of the state
would decide otherwise.’”
DiBella v. Hopkins
,
III. DISCUSSION
Partnership
Before turning to Plaintiffs’ substantive claims, the Court first addresses Plaintiffs’ allegation
that Donnelley and Mediant are in a legal partnership. A number of Plaintiffs’ theories of liability
are reliant on the existence of the alleged partnership. Under New York Law, “[t]he indicia of the
existence of a joint venture are: acts manifesting the intent of the parties to be associated as joint
venturers, mutual contribution to the joint undertaking through a combination of property, financial
resources, effort, skill or knowledge, a measure of joint proprietorship and control over the
enterprise, and a provision for the sharing of profits and losses.”
Brown v. Cara
,
Plaintiffs do not adequately plead the existence of a legal partnership between Donnelley and Mediant. At the outset, the Court observes that the SAC does not specifically plead any of the factors of the existence of a partnership. Instead, the SAC contains the conclusory allegation that “Donnelley and Mediant are partners in their provision of these proxy services” and infers the existence of a partnership based primarily on Defendants’ marketing materials and a declaration submitted by Defendants in this case. In the declaration, a Donnelley executive states that Mediant and Donnelley “first partnered” in 2008 to “jointly provide proxy services to mutual funds and publicly owned companies,” and that “the partnership . . . continues to this day.” Declaration of Bridget Hughes, Dkt No. 51, ¶¶ 2–3. Defendants’ marketing materials state that Donnelley and Mediant are a “perfect partnership,” that they “offer the industry’s only single-source solution for start-to-finish fund proxy services,” and that clients can get everything they need “all in one place. . . from a single, intuitive platform.” See SAC ¶¶ 1 n.2, 15 n.8 (incorporating Donnelley’s website by reference). The materials also refer to customers as “our clients” and state that Defendants’ joint services can be accessed through a “single point of contact backed by an expert team of project managers.”
Plaintiffs assert that Defendants admitted “that a legal partnership exists between Donnelley
and Mediant” by referring to the relationship as a partnership. Opp’n at 10. However, “calling an
organization a partnership does not make it one.”
Brodsky v. Stadlen
,
Most notably, the SAC lacks any allegation that Donnelley and Mediant agreed to share
profits and losses. “[T]he crucial element of a joint venture is the existence of ‘a mutual promise or
undertaking of the parties to share in the profits . . . and submit to the burden of making good the
losses.’”
Mallis v. Bankers Tr. Co.
,
In an attempt to explain away the lack of factual allegations in the SAC, Plaintiffs argue that
they “are not privy to the details of the partnership agreement between Donnelley and Mediant and
thus cannot be expected to allege these details.” Opp’n at 12. This fact does not obviate Plaintiffs’
pleading burden. Instead, when information is particularly within a defendant’s knowledge, courts
generally permit a plaintiff to plead upon information and belief.
See Boykin v. KeyCorp
,
Negligence The Court now turns to Plaintiffs’ substantive claims against Defendants. First, Plaintiffs allege that Mediant was negligent in implementing its data security systems and that Donnelley was negligent for failing to supervise Mediant. For the reasons described below, the Court concludes that Plaintiffs have plausibly alleged that Mediant was negligent but that Plaintiffs’ negligence claim against Donnelley is not pleaded adequately.
1. Choice of Law
The Court must first determine which law applies to Plaintiffs’ negligence claims. “The New
York Court of Appeals has held that ‘the relevant analytical approach to choice of law in tort actions
in New York’ is the ‘interest analysis.’”
GlobalNet
,
sets of rules: conduct-regulating rules and loss-allocating rules.”
Licci
,
New York has the greatest interest in Plaintiffs’ negligence claims against Mediant. The tortious conduct alleged in the complaint—namely, that Mediant “fail[ed] to implement security systems, protocols and practices sufficient to protect” Plaintiffs’ personal information—occurred in New York. See SAC ¶ 128. As Plaintiffs observe, Mediant’s decisions regarding its data security “likely occurred at the corporate level from Mediant’s corporate headquarters in New York.” Opp’n at 33. Further, the SAC has no factual allegations linking Mediant’s data security practices with any other state. Because the alleged tortious conduct occurred in New York, the Court applies New York law to Plaintiffs’ negligence claims against Mediant.
Similarly, the Court concludes that Illinois has the greatest interest in Plaintiffs’ negligence claims against Donnelley. The complaint alleges that Donnelley failed to supervise Mediant’s data security and ensure that Mediant implemented sufficient security systems. Plaintiffs argue that these failures “occurred where Mediant’s data security systems, protocols, and practices were located or carried out.” Opp’n at 33. Plaintiffs state that this “location was very likely not Illinois” but do not specifically allege the location. See id. Nevertheless, Plaintiffs argue that New York law “is [the] most likely to apply to . . . Donnelley based on the facts currently known and alleged.” at 34.
Plaintiffs fail to plausible allege that Donnelley’s failure to oversee Mediant occurred in New
York. Plaintiffs do not allege that Donnelley took any action in New York. In fact, Plaintiffs’
claims are premised on Donnelley’s
failure
to act. Yet, the SAC is devoid of any factual allegations
connecting Donnelley’s omissions with New York. Without any support that these omissions
occurred in New York, the Court concludes that Donnelley’s alleged tortious conduct occurred in
Illinois, where it is headquartered.
See Holborn Corp. v. Sawgrass Mut. Ins. Co.
,
2. Economic Loss Doctrine As a threshold issue, Defendants argue that Plaintiffs’ negligence claims are barred by the economic loss doctrine under both Illinois and New York law. For the reasons below, the Court concludes that New York’s economic loss doctrine does not bar Plaintiffs’ claims and declines to address whether the doctrine bars Plaintiffs’ claims under Illinois law.
i. New York
“New York applies the economic loss doctrine to negligence claims. This doctrine prevents
a plaintiff from recovering purely economic losses in a negligence action.”
Cruz v. TD Bank, N.A.
,
The parties dispute whether the economic loss doctrine applies to data breach cases. The
New York Court of Appeals has not addressed this issue, but numerous federal courts applying New
York law have concluded that the economic loss doctrine does not bar negligence claims in data
breach cases.
See Cohen v. Ne. Radiology, P.C.
, No. 20-cv-1202,
ii. Illinois
Under Illinois law, “[t]he economic loss doctrine bars a plaintiff from recovering for purely
economic losses under a tort theory of negligence.”
Perdue v. Hy-Vee, Inc.
,
The Illinois Supreme Court and Court of Appeals have not addressed whether the economic
loss doctrine bars negligence claims in data breach cases.
See In re Marriott Int’l, Inc., Customer Data
Sec. Breach Litig.
,
3. Donnelley’s Alleged Negligence
Plaintiffs fail to establish that Donnelley owed them a duty to protect their personal
information under Illinois law. To establish negligence under Illinois law, a plaintiff must prove
“that the defendant owed a duty to the plaintiff, that defendant breached that duty, and that the
breach was the proximate cause of the plaintiff’s injuries.”
Blood v. VH-1 Music First
,
Donnelley argues that Illinois law does not recognize a common-law duty to protect
personal information. “Although the Illinois Supreme Court has not opined on the issue, the
Illinois Appellate Court has refused to create ‘a new legal duty beyond legislative requirements’ to
safeguard an individual’s personal information or protect it from disclosure.”
USAA Fed. Sav. Bank
v. PLS Fin. Servs., Inc.
,
Plaintiffs acknowledge that “several Illinois courts have refused to recognize a duty of care
in the context of a data breach” by relying on
Cooney
. Opp’n at 34 n.22. Plaintiffs do not challenge
Cooney
and instead argue that they do not seek the creation of a “new duty,” but rather that “[a] duty
exists under traditional negligence principles and the general duty analysis applied by Illinois courts.”
Opp’n at 34 n.22. To determine whether a duty exists, Illinois courts consider “(1) the reasonable
foreseeability of the injury, (2) the likelihood of the injury, (3) the magnitude of the burden of
guarding against the injury, and (4) the consequences of placing that burden on the defendant.”
Bruns v. City of Centralia
,
4. Mediant’s Alleged Negligence
Plaintiffs have adequately pleaded that Mediant was negligent by failing to exercise
reasonable care in safeguarding Plaintiffs’ personal information. “To show negligence under New
York state law, a plaintiff must demonstrate ‘(1) the defendant owed the plaintiff a cognizable duty
of care; (2) the defendant breached that duty; and (3) the plaintiff suffered damage as a proximate
result.’”
Ferreira v. City of Binghamton
,
i. Duty
“The existence and scope of an alleged tortfeasor’s duty is, in the first instance, a legal
question for determination by the court.”
Arango v. Vasquez
,
“The injured party must show that a defendant owed not merely a general duty to society but
a specific duty to him or her, for ‘[w]ithout a duty running directly to the injured person there can be
no liability in damages, however careless the conduct or foreseeable the harm.’ That is required in
order to avoid subjecting an actor ‘to limitless liability to an indeterminate class of persons
conceivably injured by any negligence in that act.’”
Id.
(citations omitted) (first quoting
Lauer
, 95
N.Y.2d at 96; and then quoting
Eiseman v. State
,
This judicial resistance to the expansion of duty grows out of practical concerns both about potentially limitless liability and about the unfairness of imposing liability for the acts of another.
A duty may arise, however, where there is a relationship either between defendant and a third-person tortfeasor that encompasses defendant’s actual control of the third person’s actions, or between defendant and plaintiff that requires defendant to protect plaintiff from the conduct of others. Examples of these relationships include master and servant, parent and child, and common carriers and their passengers. The key in each is that the defendant’s relationship with either the tortfeasor or the plaintiff places the defendant in the best position to protect against the risk of harm. In addition, the specter of limitless liability is not present because the class of potential plaintiffs to whom the duty is owed is circumscribed by the relationship. Plaintiffs have plausibly alleged that Mediant owed them a duty to exercise reasonable care safeguarding their personal information. Plaintiffs allege that Mediant is “well-aware of the importance of data security” to its business. SAC ¶ 56. To obtain Mediant’s services, Mediant’s customers are required to share sensitive shareholder information. SAC ¶ 1. The SAC alleges that on its website, Mediant “touts its ‘web-based technology’ and ‘industry-leading security,’ and states that it maintains a ‘[c]omprehensive cybersecurity program with highly robust, redundant infrastructure platform that provides reliability and security you need.’” Id. ¶ 56. “Mediant’s Privacy Policy . . . states that it is committed to maintaining the privacy of shareholders’ Personal Information” and “promises that personally identifiable data ‘provided to Mediant by you or by third parties will be kept confidential.’” Id. ¶ 59. “Further, Mediant represents that it ‘maintains physical, electronic and procedural safeguards in accordance with laws and regulations governing confidentiality and security of information. Access to personal information is limited to only those workers and third parties who need access to the information to perform necessary activities for Mediant. We also provide security for your information by maintaining servers that are secure and dedicated solely to the services that we provide to protect against loss, misuse, or alteration of your information.’” Id. ¶ 60.
The SAC also alleges that Mediant is particularly aware that it is a target of cyber-attacks. Mediant’s CTO wrote an article “specifically addressing the severe threat cyber-attacks pose to the financial industry and companies like Mediant.” Id. ¶ 63. The article states that it is “certainly possible—and these days, essential—to develop and implement a robust security framework that accounts for all vulnerabilities.” Id. ¶ 67. Additionally, Plaintiffs allege that “[b]ut for Defendants’ willingness and commitment to maintain its privacy and confidentiality, [Plaintiffs’ personal information] would not have been transferred to and entrusted with Defendants.” ¶ 155.
These facts, accepted as true, are sufficient to plausibly allege that Mediant owed a duty to reasonably safeguard Plaintiffs’ personal information. Mediant received Plaintiffs’ personal information while providing its services and stored that information on its servers. Mediant is in the best position to protect information on its own servers from data breach. Further, the SAC alleges that Mediant understood the importance of data security to its business, knew it was the target of cyber-attacks, and touted its data security to current and potential customers. Finally, the imposition of a duty does not open Mediant up to limitless liability. Mediant’s potential liability is limited to the individuals whose personal information it obtained while providing its services. Thus, under the facts alleged in the SAC, Mediant owed Plaintiffs a duty to exercise reasonable care safeguarding their personal information.
Mediant refutes that it owed a duty to Plaintiffs and argues that
Hammond v. The Bank of New
York Mellon Corp.
, No. 08-cv-6060,
Hammond
is distinguishable from this case. First, the Court observes that
Hammond
was
decided in 2010. At that time, as the court in
Hammond
noted, “every court” to consider data breach
claims ultimately dismissed the claims, and many of those decisions determined “that loss of identity
information is not a legally cognizable claim.” at *1–2. Data breach jurisprudence has developed
significantly in the last twelve years. Numerous courts applying New York law have denied motions
to dismiss negligence claims in data breach cases.
See, e.g.
,
In re GE/CBPS Data Breach Litig.
, No. 20-
cv-2903,
In addition, the decision in
Hammond
did not substantively address the factors for
determining whether a duty exists under New York law as outlined above. Instead,
Hammond
relied
in part on the general rule that banks do not owe a duty of care to their non-customers.
Hammond
,
ii. Breach
Plaintiffs have adequately pleaded that Mediant breached its duty to exercise reasonable care
safeguarding their personal information. The SAC alleges that Mediant “fail[ed] to implement
security systems, protocols and practices sufficient to protect” Plaintiffs’ personal information,
“fail[ed] to comply with industry data security standards,” and “fail[ed] to comply with statutory and
regulatory . . . safeguards.” SAC ¶ 128. The SAC further alleges that Mediant “maintain[ed]
deficient controls to prevent and monitor for unauthorized access” of its email accounts and failed
to encrypt the personal information stored on its servers. ¶¶ 18, 23. Additionally, the SAC
contains numerous specific factual allegations detailing Mediant’s awareness that it was a target of
cybersecurity threats.
See
SAC ¶¶ 55–76. These allegations are sufficient to plausibly allege that
Mediant breached its duty.
See In re GE/CBPS
,
iii. Damages
Plaintiffs have also sufficiently alleged that they suffered damage as a proximate result of the
data breach. “[W]here plaintiffs have shown a substantial risk of future identity theft or fraud, ‘any
expenses they have reasonably incurred to mitigate that risk likewise qualify as injury in fact.’”
McMorris v. Carlos Lopez & Assocs., LLC
,
Mediant contends that this rule does not comport with New York law. Relying primarily on
the decision in
Caronia v. Philip Morris USA, Inc.
,
In this case, by contrast, Plaintiffs assert that they “face[d] a substantial risk of harm, such
that . . . the plaintiff’s mitigation costs to remediate that risk . . . state an injury in fact.” Opp’n at 20.
The SAC alleges that the data breach exposed Plaintiffs’ sensitive information, including “names,
genders, physical addresses, email addresses, phone numbers, Social Security Numbers, tax
identification numbers, and bank account numbers, as well as specific information relating to
investors’ securities holdings, including securities units purchased, dates of purchase, and individuals
or entities designated to collect investment payments.” ¶ 2. The data breach was “the result of a
criminal hack wherein hackers obtained unauthorized access to four Mediant business email
accounts exploiting a vulnerability in Mediant’s email system.”
Id.
¶ 18. “The most likely and
obvious motivation for the hacking is to use Plaintiffs’ [personal information] nefariously or sell it to
someone who would.”
Sackin
,
These allegations, which the Court must accept as true, are sufficient to plausibly allege that
Plaintiffs faced a substantial risk of future identity theft and fraud.
In re GE/CBPS
, 2021 WL
3406374, at *7;
Wallace
,
Because Plaintiffs face a substantial risk of identity theft or fraud, Plaintiffs’ costs incurred to
mitigate that threat satisfy the damages element of their claim.
Sackin
,
In sum, the Court concludes that Plaintiffs have adequately pleaded the elements of a negligence claim against Mediant. For that reason, Mediant’s motion to dismiss Plaintiffs’ negligence claim is denied.
5. Vicarious Liability Finally, Plaintiffs allege that Donnelley is vicariously liable for Mediant’s negligence because Donnelley is Mediant’s partner. Because Plaintiffs did not adequately plead the existence of a
partnership, Plaintiffs’ vicarious liability claim is dismissed.
Negligence Per Se Next, Defendants move to dismiss Plaintiffs’ negligence per se claims. Plaintiffs allege that Defendants were negligent per se “by failing to use reasonable measures to protect Plaintiffs’ and Class Members’ Personal Information and by failing to comply with applicable industry standards” in violation of Section 5 of the Federal Trade Commission Act (the “FTCA”). SAC ¶ 137. In addition, Plaintiffs allege that Donnelley was negligent per se for violating its “duty to use reasonable security measures” under the Gramm-Leach-Bliley Act (the “GLBA”). Id. ¶ 138. Plaintiffs’ negligence per se claims are not viable under either Illinois or New York law and are therefore dismissed.
1. Donnelley
“[A]ctions for negligence per se are allowed” under Illinois law.
Test Drilling Serv. Co. v. Hanor
Co.
,
2. Mediant
“In New York, the ‘unexcused omission’ or violation of a duty imposed by statute for the
benefit of a particular class ‘
is
negligence itself.’”
Chen v. United States
,
Plaintiffs fail to plead a negligence
per se
claim. Plaintiffs base their claim against Mediant on
Section 5 of the FTCA. However, as Plaintiffs admit, Section 5 does not provide for a private right
of action.
Alfred Dunhill Ltd. v. Interstate Cigar Co.
,
create a private right of action “weighs heavily against implying a private right of action necessary to
sustain a negligence
per se
claim based upon . . . the FTC[A]”);
Smahaj v. Retrieval-Masters Creditors
Bureau, Inc.
,
Breach of Contract/Third-Party Beneficiary
1. Choice of Law
“Under New York’s choice-of-law rules, the interpretation and validity of a contract is
governed by the law of the jurisdiction which is the ‘center of gravity’ of the transaction.”
Alderman
v. Pan Am World Airways
,
Plaintiffs allege that they are third-party beneficiaries to contracts that Donnelley and Mediant separately entered into with “public companies and mutual funds to provide and perform proxy services.” SAC ¶¶ 145–47. Plaintiffs offer no factual allegations regarding where these contracts were negotiated or the place of business of the specific “public companies and mutual funds.” Nor do they plead the existence of relevant governing law provisions in those agreements. Because Defendants were parties to the contracts and the contracts govern services to be provided by Defendants, the Court concludes that the place of business of each Defendant is the “center of gravity” of their respective contracts. Accordingly, Illinois law applies to the third-party beneficiary claim against Donnelley, and New York law applies to the third-party beneficiary claim against Mediant.
2. Donnelley
Plaintiffs fail to adequately allege a third-party beneficiary claim against Donnelley. Under
Illinois law, “[t]he elements of a breach-of-contract action are: ‘(1) the existence of a valid and
enforceable contract; (2) performance by the plaintiff; (3) breach of the contract by the defendant;
and (4) resultant injury to the plaintiff.’”
Cohn v. Guaranteed Rate Inc
.,
Whether someone is a third-party beneficiary depends on the intent of the contracting parties, as evidenced by the contract language. It must appear from the language of the contract that the contract was made for the direct, not merely incidental, benefit of the third person. Such an intention must be shown by an express provision in the contract identifying the third-party beneficiary by name or by description of a class to which the third party belongs. If a contract makes no mention of the plaintiff or the class to which he belongs, he is not a third-party beneficiary of the contract.
Id. (citations omitted).
Here, Plaintiffs allege that Donnelley entered into contracts with three specific entities in which the lead Plaintiffs invested. SAC ¶¶ 30, 37, 43; see also id. ¶ 145. Plaintiffs allege that these contracts “contained provisions requiring Donnelley . . . to protect the investor information that Donnelley . . . received in order to provide such proxy services.” SAC ¶¶ 145–46. Plaintiffs allege that Donnelley “breached these contracts while acting in the course of the business of the Partnership by not protecting Plaintiffs’ and Class Members’ Personal Information.” ¶ 148.
Donnelley argues that Plaintiffs “fail to allege the specific terms in Donnelley’s purported
contracts with its clients . . . that Donnelley . . . supposedly breached, much less explain how they
were breached.” Donnelley Mem., Dkt. No. 100, at 24. In response, Plaintiffs argue that in the
Court’s prior decision, the Court noted that “the terms of the alleged contract are particularly within
the possession and control of Defendants.” Opp’n at 47 (quoting
Toretto
,
Plaintiffs fail to adequately allege that Donnelley breached the contracts at issue. While Plaintiffs allege that Donnelley was required to protect the personal information it received to provide proxy services, the SAC does not contain any allegations that Donnelley even received Plaintiffs’ information, much less that Donnelley failed to protect it. Instead, the SAC alleges that Mediant failed to adequately protect Plaintiffs’ personal information and that Donnelley “fail[ed] to exercise appropriate managerial control over Mediant’s data security.” As discussed above, Plaintiffs have not adequately alleged a partnership between Donnelley and Mediant and have therefore failed to establish that Donnelley had the duty, or even ability, to control Mediant’s data security. Plaintiffs do not allege that the contracts required Donnelley to exercise control over third parties who received investor information from Donnelley’s clients. Without any factual allegations to support that Donnelley failed to protect any personal information it received, or that the contracts required Donnelley to ensure that Mediant adequately protect Plaintiffs’ personal information, Plaintiffs have not plausibly alleged that Donnelley breached the contracts at issue. Accordingly, Plaintiffs’ third- party beneficiary claim against Donnelley is dismissed.
3. Mediant
Plaintiffs’ third-party beneficiary claim against Mediant also fails. “Under New York State
law, a party claiming rights as a third-party beneficiary must demonstrate ‘(1) the existence of a valid
and binding contract between other parties, (2) that the contract was intended for his benefit and (3)
that the benefit to him is sufficiently immediate, rather than incidental, to indicate the assumption by
the contracting parties of a duty to compensate him if the benefit is lost.’”
Stevens v. Goord
, 535 F.
Supp. 2d 373, 390–91 (S.D.N.Y. 2008) (quoting
State of Cal. Pub. Employees’ Ret. Sys. v. Shearman &
Sterling
,
The SAC contains a sole conclusory allegation that “Mediant . . . directly contracted with public companies and mutual funds to provide and perform proxy services.” SAC ¶ 145. The SAC fails to identify the entities that Mediant allegedly contracted with and provides no other factual enhancement regarding the formation of the contracts. Merely stating the legal conclusion that Mediant “entered contracts” with unspecified “public companies and mutual funds” is insufficient to establish the existence of an enforceable contract between Mediant and any other party. Because Plaintiffs do not sufficiently allege the existence of an enforceable agreement, the Court dismisses Plaintiffs’ third-party beneficiary claim against Mediant.
Unjust Enrichment
1. Choice of Law
The parties dispute the proper choice of law rule to apply to Plaintiffs’ unjust enrichment
claims. Plaintiffs assert that the unjust enrichment claims are quasi-contract claims and therefore
should be governed by the choice of law analysis applicable to contract claims.
See
Opp’n at 48 n.29.
Defendants, on the other hand, contend that “the choice of law analysis applicable to tort claims
would apply since the unjust enrichment claim does not relate to an enforceable contract.”
Donnelley Reply at 17 n.18. The Court need not resolve this issue because under either approach
New York law applies to the claim against Mediant and Illinois law applies to the claim against
Donnelley.
See supra
Sections III(B)(1), III(D)(1).
2. Mediant
“To state a claim for unjust enrichment in New York, a plaintiff must allege that
(1) defendant was enriched; (2) the enrichment was at plaintiff’s expense; and (3) the circumstances
were such that equity and good conscience require defendants to make restitution.”
Talon Pro. Servs.,
LLC v. CenterLight Health Sys. Inc.
, No. 20-cv-78,
Mediant argues that Plaintiffs’ unjust enrichment claim should be dismissed as duplicative.
“[U]njust enrichment is not a catchall cause of action to be used when others fail.”
Corsello v. Verizon
New York, Inc.
,
3. Donnelley
Under Illinois law, “[t]o state a cause of action based on a theory of unjust enrichment, a
plaintiff must allege that the defendant has unjustly retained a benefit to the plaintiff’s detriment,
and that defendant’s retention of the benefit violates the fundamental principles of justice, equity,
and good conscience.”
HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc.
,
California Customer Records Act
Toretto fails to sufficiently plead a claim under the CRA because he does not adequately
allege that he is a customer of Defendants as defined by the CRA. The CRA “regulates businesses
with regard to treatment and notification procedures relating to their customers’ personal
information.”
Corona v. Sony Pictures Ent., Inc.
, No. 14-cv-09600,
Toretto seeks both damages and injunctive relief under the CRA. SAC ¶ 179. Section
1798.84(b) provides that “[a]ny customer injured by a violation of this title may institute a civil
action to recover damages.” Cal. Civ. Code § 1798.84(b). The section expressly “limits such action
to ‘any customer.’”
Corona
,
Boorstein v. CBS Interactive, Inc.
,
Toretto argues that he is a “customer” for purposes of the CRA because “Mediant maintained his Personal Information to use that information in transactions with him.” Opp’n at 57. In his attempt to broadly define the meaning of “customer” under the CRA, Toretto cites to a provision outlining the purpose of the CRA. See id. (citing Cal. Civ. Code § 1798.81.5(a)(1)–(2)). However, Toretto does not grapple with the express definition of “customer” in the CRA, which requires an individual to “provide[ ] personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.” Cal. Civ. Code § 1798.80(c). The SAC does not allege that Toretto provided his personal information to Defendants for any reason, let alone for the purpose of purchasing or leasing a product or obtaining a service from Defendants. Instead, the SAC alleges that Mediant obtained Toretto’s personal
information while providing services to an entity in which Toretto had invested.
See
SAC ¶¶ 29–30.
As a result, Toretto has not adequately pleaded that he is a customer of Defendants under the CRA.
The Court therefore dismisses his claim for damages and injunctive relief under the CRA.
See Patton
,
California Unfair Competition Law
Toretto’s claim under the UCL is not pleaded adequately. “The UCL prohibits, and
provides civil remedies for, unfair competition, which it defines as ‘any unlawful, unfair or
fraudulent business act or practice.’”
Kwikset Corp. v. Superior Ct.
,
Under California’s presumption against extraterritoriality, courts “presume the Legislature
did not intend a statute to be operative, with respect to occurrences outside the state, . . . unless such
intention is clearly expressed or reasonably to be inferred from the language of the act or from its
purpose, subject matter or history.”
Sullivan v. Oracle Corp.
,
Accordingly, the Court must consider whether Plaintiffs’ proposed application of the UCL
would cause the UCL to impermissibly apply to out-of-state conduct. “[T]he relevant inquiry for
whether a state law is being applied extraterritorially is . . . whether ‘the conduct
which gives rise to
liability
. . . occurs in California.’”
Leibman v. Prupes
, No. 2:14-cv-09003,
Here, it is indisputable that the conduct which allegedly gives rise to liability in this case
occurred entirely outside of California. Notwithstanding, Toretto argues that he can bring a claim
under the UCL because he is a California resident and because Defendants’ conduct allegedly caused
injury in California.
See
Opp’n at 53–54. In support, Toretto cites the decision
Speyer v. Avis Rent a
Car Sys., Inc.
,
Given the lack of a decision on this issue by the Supreme Court of California, there is no
binding precedent governing whether the UCL applies to a claim by a plaintiff who is a California
resident and was allegedly injured in California by out-of-state conduct, but who alleges no
connection between the defendant and California. Accordingly, the Court’s job is to determine how
the Supreme Court of California would resolve this issue.
See Phansalkar
,
First, in
Norwest
, the court held that Californian plaintiffs could bring UCL claims against the
defendant regardless of where the defendant’s conduct occurred.
Norwest
,
In
Yu
, the court held that “[i]n the absence of any federal preemption, a defendant who is
subject to jurisdiction in California and who engages in out-of-state conduct that injures a California
resident may be held liable for such conduct in a California court.”
Yu
,
Even if the Court read
Norwest
and
Yu
that broadly, the Court is convinced that the Supreme
Court of California would decide otherwise.
See DiBella
,
Braun does not allege that Defendants committed any deceptive acts or practices in Florida.
The SAC alleges that all relevant conduct occurred either at Mediant’s headquarters in New York or
at Donnelley’s headquarters in Illinois. Braun does not challenge this point. Instead, Braun argues
that “it is enough that the conduct generated a sufficient relationship with Florida by injuring Florida
investors like Plaintiff Braun.” Opp’n at 52. Yet, Braun does not identify a single case where a
court has held that FDUTPA applies to conduct that occurred fully outside of Florida. Although
FDUTPA “does not limit its protection to acts occurring exclusively in Florida,”
Eli Lilly & Co. v.
Tyco Integrated Sec., LLC.
, No. 13-80371-CIV,
his FDUPTA claim is dismissed.
Declaratory Judgment
Finally, Defendants argue that if the Court concludes that Plaintiffs failed to state a
substantive claim, Plaintiffs’ claim for declaratory judgement also fails. “A plaintiff cannot maintain
a claim for a declaratory judgment where the underlying substantive claim has been dismissed since
the Declaratory Judgment Act only created a procedural mechanism and not an independent cause
of action.”
Prignoli v. Bruczynski
, No. 20-cv-907,
IV. LEAVE TO AMEND
The Court grants Plaintiffs leave to replead the dismissed claims.
See Cortec Indus., Inc. v. Sum
Holding L.P.
,
V. MOITIONS TO SEAL
Finally, the Court turns to the parties’ motions to seal. Defendants filed a motion to seal the Supplier Agreement, which Defendants filed in connection with their motions to dismiss. Dkt. No. 93. In connection with that request, Donnelley also sought to redact the portions of its brief in support of its motion to dismiss that contained “corresponding information relating to the confidential terms of the Supplier Agreement.” Id. Plaintiffs filed a motion to redact portions of their opposition brief that “refer to and quote from” the Supplier Agreement. Dkt. No. 106. Finally, Donnelley filed a motion to redact portions of its reply brief containing “substantive descriptions of the content of” the Supplier Agreement. Dkt. No. 115.
“There is a common law presumption in favor of permitting public access to judicial
documents, which are those documents ‘relevant to the performance of the judicial function and
useful in the judicial process.’”
GoSMiLE, Inc. v. Dr. Jonathan Levine, D.M.D. P.C.
, 769 F. Supp 2d
630, 649 (S.D.N.Y. 2011) (quoting
Lugosch v. Pyramid Co. of Onondaga
,
A court balances this common law presumption of access against competing considerations,
including “the privacy interests of those resisting disclosure.”
Lugosch
,
The Supplier Agreement, which the Court has not considered in deciding the motions to
dismiss, is not a judicial document.
See Vasquez v. City of New York
, No. 10-cv-6277, 2012 WL
4377774, at *1 (S.D.N.Y. Sept. 24, 2012) (“Generally, because courts usually ‘cannot consider
evidence outside the pleadings without giving the parties notice and an opportunity to present
additional evidence and converting the motion into one for summary judgment, . . . documents
submitted in connection with a Rule 12(b)(6) motion cannot qualify as judicial.’” (quoting
Standard
Inv. Chartered, Inc. v. Nat’l Assn’ of Sec. Dealers
,
On the other hand, the parties’ briefs in connection with the motions to dismiss are plainly
judicial documents.
See Raffaele v. City of New York
, No. 13-cv-4607,
VI. CONCLUSION
For the reasons described above, Mediant’s motion to dismiss is GRANTED in part and DENIED in part. Donnelley’s motion to dismiss is GRANTED in full.
The Clerk of Court is directed to terminate the motions pending at Dkt. Nos. 93, 94, 96, 106, 115.
SO ORDERED. Dated: February 4, 2022 _____________________________________ New York, New York GREGORY H. WOODS
United States District Judge
Notes
[1] Unless otherwise noted, the facts are taken from the second amended complaint and are accepted as true for the
purposes of these motions.
See Chambers v. Time Warner, Inc.
,
[2] As stated in Plaintiffs’ opposition brief, “Plaintiffs do not dispute that whether Mediant and Donnelley entered into a
partnership should be determined by either Illinois or New York law, where the agreement to enter into the Partnership
presumably occurred. Plaintiffs agree there does not appear to be any material differences between Illinois and New
York law on the requirements for establishing a partnership.” Opp’n at 8 n.4. Because the court has not identified an
actual conflict between the applicable state laws, the Court applies New York law.
See Licci
,
[3] Further, Plaintiffs’ negligence claim relies on Donnelley’s alleged duties as Mediant’s legal partner to ensure that Mediant had adequate data security. However, as discussed, Plaintiffs failed to plead the existence of a legal partnership between Donnelley and Mediant. Even if Illinois recognized a general duty to safeguard personal information, Plaintiffs do not cite any authority to support that Donnelley would owe a duty to ensure that Mediant, a third party, properly safeguarded Plaintiffs’ information.