Toretto v. Donnelley Financial Solutions, Inc.Toretto v. Donnelley Financial Solutions, Inc.
Case Information
USDC SDNY DOCUMENT ELECTRONICALLY FILED UNITED STATES DISTRICT COURT DOC #: _________________ SOUTHERN DISTRICT OF NEW YORK DATE FILED: 3/5/2021 ------------------------------------------------------------------ X PHILLIP TORETTO, DANIEL C. KING, and :
SHERI BRAUN, individually and on behalf of :
others similarly situated, :
: 1:20-cv-2667-GHW Plaintiffs, : -against- : MEMORANDUM OPINION : AND ORDER
DONNELLEY FINANCIAL SOLUTIONS, INC. : and MEDIANT COMMUNICATIONS, INC., :
:
Defendants. :
------------------------------------------------------------------ X
GREGORY H. WOODS, United States District Judge:
Defendants Donnelley Financial Solutions (“Donnelley”) and Mediant Communications, Inc. (“Mediant”) work together to provide proxy services for public companies and mutual funds. In 2019, hackers breached one of Mediant’s servers. The hackers stole the personal information of over 200,000 people, including Plaintiffs. Plaintiffs brought this action against Mediant alleging, among other things, that Mediant was negligent in the implementation of its cyber security policies. Although the breach itself occurred at Mediant, Plaintiffs allege that Donnelley too was negligent because it failed to adequately supervise Mediant’s cyber security practices.
In this set of motions, Defendants challenge Plaintiffs’ standing to bring the claims against them. Defendants’ arguments focus on the sufficiency of the complaints’ allegations regarding whether Donnelley and Mediant are partners—Donnelley contends that unless it is demonstrated to have been Mediant’s partner, Plaintiffs’ injuries cannot be “fairly traceable” to it. And Mediant contends that it cannot be held liable for breaches of contracts entered into by Donnelley unless it is shown to have been Donnelley’s partner. But the motion disregards the complaint’s allegations that each of the Defendants directly caused Plaintiffs’ alleged injuries, and confuses the standard for pleading the merits of a claim and that for standing. Because the complaint makes the modest showing required to plead standing, Defendants’ motions to dismiss are denied.
I. BACKGROUND
Facts
1. The Hack On April 1, 2019, hackers accessed the business email accounts of Mediant. Second Am. Compl. (“SAC”), Dkt. No. 57, ¶¶ 16. The hackers stole the personal information of a number of individuals, including the named plaintiffs in this case. ¶¶ 6–8, 29–30, 36–38, 42–43. Mediant had received the stolen information as part of its business providing investor communication services to financial institutions. ¶ 20. Mediant discovered the hack the day of the intrusion, and promptly disconnected the affected server from its system. Id. ¶ 16. Mediant began an investigation into the breach, but the company did not immediately notify the impacted customers. Id. It was not until the end of May 2019, nearly two months after the breach that Mediant notified the affected customers. Id. ¶ 17. The breach was truly massive: notices went out to “over 200,000 individuals in all fifty states and the District of Columbia and Puerto Rico.” Id .
Plaintiffs allege that the hack was enabled by Mediant’s poor network security. “The criminal hackers would not have been able to gain access to four email accounts simultaneously but for Mediant maintaining deficient controls to prevent and monitor for unauthorized access.” Id. ¶ 23. And Mediant did not encrypt personal information stored in the company’s system. ¶ 18. Plaintiffs also allege that Mediant failed to adequately notify its customers regarding the breach. Id.
¶¶ 26–27.
2. The “Partnership” The hackers attacked Mediant, but Mediant is not the only target of this lawsuit. That is because Mediant worked together with Donnelley to provide investor communication services. It was through Mediant’s working relationship with Donnelley that Mediant received the personal information of the named plaintiffs in this case. Id. ¶¶ 30, 37, 43. The Defendants’ motions focus on the nature of the relationship between Mediant and Donnelley. In particular, the motions challenge whether Donnelley’s involvement in Mediant’s business was sufficient for Donnelley to be sued for the alleged deficiencies in Mediant’s cybersecurity, and whether the two companies are adequately alleged to have been “partners,” such that Mediant can be bound by contracts signed by Donnelley.
Donnelley describes itself as “a leader in risk and compliance solutions, providing insightful technology, industry expertise and data insights to clients across the globe.” Id. ¶ 13. Donnelley offers a broad range of products and services, significantly here in technology, initial public offerings, mergers and acquisitions, proxy services, and other global filings. Id. Mediant “holds itself out as a leader in investor communications, offering ‘game-changing new technologies for banks, brokers, fund companies, and issuers.’” Id. ¶ 14.
Donnelley and Mediant work together to provide proxy services. Id. ¶ 15. The pair describe themselves as “the perfect partnership to power [their clients’] fund proxies.” Id . Defendants’ marketing materials describe the pair as “industry’s only single-source solution for start-to-finish fund proxy services.” Id. (quoting The Perfect Partnership to Power Your Fund Proxies , https://www.dfinsolutions.com/insights/fact-sheet/dfin-and-mediant-perfect-partnership-power- you-fund-proxies).
Partially in reliance on Donnelley and Mediant’s description of themselves as a partnership, the complaint alleges that the pair formed a legal partnership, and refers to them collectively as the “Partnership.” The complaint alleges that Donnelley “had equal rights in the management and conduct of the Partnership.” ¶ 26. It also states that, in particular, Donnelley had the “right as a partner in the Partnership” to “exercise appropriate managerial oversight of Mediant’s data security.” Id .
The complaint alleges that the companies and investment funds that used the pair’s services hired both of them together—not just one or the other, but instead, the touted “perfect partnership.” Id. ¶ 1. The complaint alleges that “[p]ublic companies and mutual funds hire Donnelley and Mediant as their proxy agent to distribute materials to shareholders, coordinate shareholder votes, and tabulate voting results.” Id. The allegation is that the pair are hired jointly as the singular “proxy agent” for the companies and funds.
Donnelley is alleged to be liable for the security breach at Mediant for two reasons. First, Plaintiffs assert that Donnelley is vicariously liable for the hack at Mediant and its consequences because the pair were partners. Id. ¶ 130 (“[B]y entering into a partnership with Mediant for the provision of proxy services, Donnelley is vicariously liable for Mediant’s failures as alleged herein.”); see also id. ¶¶ 4, 26, 140. The complaint attributes many of the asserted deficiencies that led to the breach, and in the response to the breach, to the “Partnership.”
Second, Plaintiffs assert that Donnelley was directly liable for the plaintiffs’ injuries because of its alleged “failure to exercise appropriate managerial oversight of Mediant’s data security.” Id. ¶¶ 4, 26. Donnelley is alleged to have failed “to ensure its agent and partner Mediant implemented security systems, protocols and practices sufficient to protect Plaintiffs’ and Class Members’ Personal Information” and failed “to supervise its agent and partner Mediant regarding Mediant’s data security systems, protocols and practices when it knew or should have known those systems, protocols and practices were inadequate.” Id. ¶ 129. Donnelley is also alleged to have been directly liable as a result of its conduct after the breach because it failed “to timely disclose that Plaintiffs’ and Class Members’ Personal Information had been improperly acquired or accessed.” Id. Donnelley is also alleged to have violated contracts of which Plaintiffs were third party beneficiaries. ¶¶ 145–49.
3. Plaintiffs’ Claims to be Third Party Beneficiaries of Donnelley and Mediant’s Contracts with Their Customers Plaintiffs assert that they are third party beneficiaries of contracts entered into between Donnelley and its customers—the funds and companies to whom it provides proxy and other financial services. Donnelley “entered into contracts with public companies and mutual funds to provide and perform proxy services.” Id. ¶ 145. The personal information of each of the named Plaintiffs was stolen as a result of their investment in identified funds. In the case of each named Plaintiff, the relevant fund had entered into a direct contractual relationship with Donnelley for the provision of proxy services. See, e.g. , id. ¶ 30 (“Donnelley had the direct contractual relationship with Blackstone Real Estate Income Trust, Inc. or its agents for the performance of the Partnership’s proxy services.”); see also id. ¶¶ 37, 43 (alleging the same with respect to funds in which the other named Plaintiffs invested). The complaint also alleges that “[i]n some instances, acting in the ordinary course of the Partnership, Mediant also directly contracted with public companies and mutual funds to provide and perform proxy services. ¶ 145.
The complaint alleges that Donnelley acted “in the ordinary course of the business of the Partnership” when it entered into contracts with customers to provide proxy services. Id. ¶ 145. As a result of Donnelley’s agreement with the funds in which the named Plaintiffs invested, Mediant was provided their personal data, which was later stolen in the hack.
Plaintiffs allege “[o]n information and belief” that “each of those respective contracts contained provisions requiring Donnelley and/or Mediant to protect the investor information that Donnelley and/or Mediant received in order to provide such proxy services in carrying out the business of the Partnership.” ¶ 146. Also “[o]n information and belief” Plaintiffs allege that “these provisions requiring Donnelley and/or Mediant acting in the ordinary course of the business of the Partnership to protect the personal information of the company/mutual fund’s investors was intentionally included for the direct benefit of Plaintiffs and Class Members, such that Plaintiffs and Class Members are intended third party beneficiaries of these contracts, and therefore are entitled to enforce them.” ¶ 147.
Procedural History
This is not the first attempt by Plaintiffs to sue Mediant as a result of the hack and its
consequences. Plaintiffs previously brought actions against Mediant in both the Northern District
of California and the Southern District of Florida. Both of those actions were dismissed for lack of
personal jurisdiction.
Toretto v. Mediant Commc’ns, Inc.
, No. 19-cv-52980-EMC,
Plaintiffs filed this action on March 30, 2020, naming both Mediant and Donnelley as defendants. Dkt No. 1. On May 19, 2020, Plaintiffs filed their first amended complaint. Dkt No. 19. On July 17, 2020, Mediant moved to dismiss several counts of the first amended complaint; Donnelley moved to dismiss that complaint in its entirety. Dkt Nos. 46, 50.
On August 5, 2020, Plaintiffs filed the second amended complaint. Dkt No. 57. The second amended complaint asserts several causes of action against each of the defendants: negligence (Count I), negligence per se (Count II), breach of contracts to which Plaintiffs allege that they are third-party beneficiaries (Count III), unjust enrichment (Count IV), declaratory judgment (Count V), and violation of various California and Florida state statutes (Counts VI–VIII).
Each of the defendants filed a separate motion to dismiss the second amended complaint pursuant to Fed. R. Civ. P. 12(b)(1), asserting that the complaint does not adequately plead that
Plaintiffs have standing to assert all of their claims against Defendants. In its motion, Donnelley has moved to dismiss all of the claims against it. Dkt. No. 64. Donnelley asserts that Plaintiffs’ claims against it rely on the complaint’s allegations regarding the existence of a partnership relationship between it and Mediant. Donnelley argues that because all of the elements of a legal partnership are not adequately pleaded in the complaint, Plaintiffs have not adequately demonstrated that Donnelley caused their injury. Mediant moved only to dismiss the breach of contract claim against it. Dkt. No. 67. Because the complaint does not allege that Mediant signed the contracts with Plaintiffs, it asserts that Plaintiffs cannot sue it, a non-signatory, for breach of contract. Each of these arguments is discussed in detail below.
II. DISCUSSION
A. Legal Standard
1.
Fed. R. Civ. P. 12(b)(1)
“A district court properly dismisses an action under Fed R. Civ. P. 12(b)(1) for lack of
subject-matter jurisdiction if the court ‘lacks the statutory or constitutional power to adjudicate it,’
such as when . . . the plaintiff lacks constitutional standing to bring the action.”
Courtland St. Recovery
Corp. v. Hellas Telcomms., S.a.r.l.
,
2.
Article III Standing
“Article III restricts federal courts to the resolution of cases and controversies . . . . That
restriction requires that the party invoking federal jurisdiction have standing—the personal interest
that must exist at the commencement of the litigation.”
Carter
,
Defendants’ motions here focus on the second of these three elements—traceability, or
causation. “The traceability requirement for Article III standing means that the plaintiff must
‘demonstrate a causal nexus between the defendant’s conduct and the injury.’”
Rothstein v. UBS AG
,
Such a nexus is most easily shown if there is a direct relationship between the plaintiff and the defendant with respect to the conduct at issue. However, while the “indirectness” of an injury “‘may make it substantially more difficult’” to show the “fairly traceable” element of Article III standing, i.e., “‘to establish that, in fact, the asserted injury was the consequence of the defendants’ actions,” indirectness is “not necessarily fatal to standing,” because the “fairly traceable” standard is lower than that of proximate cause. Central to the notion of proximate cause is the idea that a person is not liable to all those who may have been injured by his conduct, but only to those with respect to whom his acts were a substantial factor in the sequence of responsible causation and whose injury was reasonably foreseeable or anticipated as a natural consequence.
Id. (citations omitted).
“The requirement that a complaint allege[] an injury that is fairly traceable to defendants’
conduct ... for [purposes of] constitutional standing is a lesser burden than the requirement that it
show proximate cause.” at 92. (alterations in original) (internal quotation marks and citation
omitted). The fact that there is an intervening cause of a plaintiff’s injury is not necessarily a basis to
find that the injury is not “fairly traceable” to a defendant’s conduct, even if that intervening cause
would foreclose a finding of proximate cause.
Id.
As a result, the Second Circuit has noted that
“particularly at the pleading stage, the ‘fairly traceable’ standard is not equivalent to a requirement of
tort causation’ and that ‘for purposes of satisfying Article III’s causation requirement, we are
concerned with something
less than the concept of proximate cause
.”
Id.
(quoting
Connecticut v. Am. Elec.
Power Co.
,
At the pleading stage of an action, as here, “the plaintiff’s burden . . . of alleging that their
injury is ‘fairly traceable’ to the challenged act is relatively modest.”
Id.
(internal quotations and
citation omitted). “In sum, the test for whether a complaint shows the “fairly traceable” element of
Article III standing imposes a standard lower than proximate cause.”
Id.
Rather than a showing of
proximate cause, “Article III ‘requires no more than
de facto
causality.’”
U.S. Dep’t of Com. v. New
York
,
A plaintiff’s pleading burden to establish the elements of standing is lower than that for
pleading the merits of a claim. To successfully plead the elements of Article III standing, “[i]t is the
responsibility of the complainant clearly to allege facts demonstrating that he is a proper party to
invoke judicial resolution of the dispute . . . .”
Warth
,
This distinction in the pleading standard for standing and merits issues can result in “a
common confusion between the standing and merits inquiries, which—of course—are conceptually
distinct.”
New York v. U.S. Dep’t of Commerce
,
B. Application
1. Plaintiffs Adequately Plead Donnelley Was A Direct Cause of Plaintiffs’ Injuries
Plaintiffs have adequately pleaded that Donnelley was a direct cause of Plaintiffs’ injuries. Donnelley entered into contracts with the funds in which Plaintiffs invested. SAC ¶¶ 30, 37, 43. As a result of Donnelley’s contractual relationships with those funds, Mediant was provided with Plaintiffs’ personal information, which was later disclosed in the hack. Plaintiffs plausibly allege that Donnelley failed to ensure that Mediant implemented appropriate security systems and protocols, and that it failed to supervise Mediant’s security practices “when it knew or should have known” that its security practices were inadequate. ¶ 129. Donnelley is also alleged to be liable as a result of its conduct after the breach because it failed “to timely disclose that Plaintiffs’ and Class Members’ Personal Information had been improperly acquired or accessed.” Id. Moreover, Plaintiffs assert a claim for breach of contract against Donnelley directly, claiming that they are third party beneficiaries of the contracts that Donnelley entered into with its customers. ¶¶ 145–48.
These allegations are more than sufficient to clearly allege facts showing that Plaintiffs’
injuries are fairly traceable to Donnelley’s actions. Donnelley contracted to provide proxy services
for its clients; the information was provided to Mediant as a result of that contract, and the
information was compromised. Donnelley failed to advise its customers of the breach timely.
Donnelley is alleged to have contractual obligations to Plaintiffs, which were violated when
Plaintiffs’ personal data was exposed. While the ultimate breach occurred at Mediant, “the fact that
there is an intervening cause of the plaintiff’s injury may foreclose a finding of proximate cause but
is not necessarily a basis for finding that the injury is not ‘fairly traceable’ to the acts of the
defendant.”
Rothstein
,
Donnelley proposes that the Court hold Plaintiffs to a much higher pleading standard. Donnelley inaccurately asserts that Plaintiffs must plead that “the defendant’s influence [has] been a sufficient cause —not just a but-for or necessary cause—of the third party’s injury-causing actions for the plaintiff’s injuries to be traceable to that defendant.” Donnelley Mem. Law Supp. Mot. to Dismiss (“Donnelley Mem.”), Dkt. No. 68, at 11–12 (emphasis added). Donnelley proposes that the Court set the pleading standard for standing at a higher bar than even proximate causation—and a substantially higher bar than de facto causality.
Donnelley bases its argument on a misapplication of the discussion of a “determinative or coercive” effect of independent third-party acts in relation to standing in the Second Circuit’s unreported decision in National Council of La Raza v. Mukasey , 283 Fed. App’x 848 (2d Cir. 2008). In National Council of La Raza , the Circuit wrote:
While the Supreme Court has explained that causation is lacking if the claimed injury is “the result [of] the independent action of some third party not before the court,” a plaintiff need not allege that a defendant’s challenged actions were the very last step in a chain of events leading to an alleged injury to allege causation adequately. It is sufficient for a plaintiff to plead facts indicating that a defendant’s actions had a “determinative or coercive effect upon the action of someone else” who directly caused the alleged injury. at 851 (alteration in original) (internal citations omitted). This statement relies on the Supreme
Court’s decision in
Bennett v. Spear
,
There are two principal reasons why Donnelley’s reliance on this line of cases is errant.
First, each of the cases applying this standard does so in the context in which the claimed injury
resulted from “the independent action of some third party not before the court.”
See, e.g.
,
Carver
,
Second, Donnelley’s argument that to show that a third party’s action had a “determinative
and coercive” effect, a plaintiff must plead a higher standard of causation than but-for cause is not
supported by the case law. Donnelley Mem. at 11. As the Circuit wrote while applying the test in
Carver
, “causation turns on the degree to which the defendant’s actions constrained or influenced the
decision of the final actor in the chain of causation.”
Third, to the extent that the determinative and coercive test applies here, it is satisfied by the facts as pleaded. Donnelley entered into agreements with its customers to provide proxy services. It, in turn, worked with Mediant so that Mediant would provide a portion of the services that Donnelley agreed to provide to its customers. As alleged, Donnelley had the authority to supervise the cyber security protocols of Mediant. That allegation is far from implausible. Regardless of whether Donnelley and Mediant were legal partners, Donnelley provided its customers’ personal information to Mediant in support of Donnelley’s customer relationships. Donnelley is alleged to have been aware of concerns regarding cyber security. See, e.g. , SAC ¶ 81. In the 21st century, it is certainly plausible that Donnelley would not have entrusted its clients’ data to Mediant without some assurances regarding, and control over, Mediant’s cyber security practices.
Donnelley’s argument that Plaintiffs must plead all of the elements of a legal partnership in
order to have standing to pursue its claims that Donnelley is vicariously liable as Mediant’s partner is
largely misplaced. Donnelley has succumbed to the common confusion of conflating a merits issue
with standing. Whether Donnelley is vicariously liable for Mediant’s breach “is a merits question
that should not be conflated with the standing issue.”
See Merriam
,
2. Plaintiffs Have Clearly Alleged Facts Demonstrating Standing to Assert Breach of Contract Claims
Plaintiffs also have standing to bring their breach of contract claim against Defendants. Plaintiffs allege that Donnelley entered into contracts with three specific entities in which the lead Plaintiffs invested. SAC ¶¶ 30, 37, 43. “Donnelley entered into contracts with public companies and mutual funds to provide and perform proxy services.” Id. ¶ 145. But Plaintiffs do not allege that all contracts were with Donnelley: Plaintiffs allege that “[i]n some instances . . . Mediant also directly contracted with public companies and mutual funds to provide and perform proxy services.” Plaintiffs further allege “[o]n information and belief” that “each of those respective contracts contained provisions requiring Donnelley and/or Mediant to protect the investor information that Donnelley and/or Mediant received.” Id. ¶ 146. Plaintiffs allege, again “[o]n information and belief” that these provisions were “intentionally included for the direct benefit” of Plaintiffs. Id. ¶ 147. Plaintiffs allege these contracts were breached when Donnelley and Mediant failed to protect their information. ¶ 148.
Mediant’s argument that Plaintiffs’ standing relies on the existence of a partnership between Mediant and Donnelley disregards these pleaded facts. Mediant argues that “[w]ithout their partnership theory, Plaintiffs have failed to allege the existence of a contract between Mediant and any other entity. As it is legally impossibly to be a third party beneficiary to a non-existent contract, Plaintiffs’ Count III must be dismissed.” Mediant Mem. Supp. Mot. to Dismiss (“Mediant Mem.”) at 6, Dkt. No. 66. The complaint does allege the existence of contracts with Mediant. SAC ¶ 145. And it alleges that those contracts contained provisions requiring Mediant to protect investors’ information, id. ¶ 146, and that they included provisions making Plaintiffs and class members intended third party beneficiaries of the contracts. ¶ 147. These allegations do not rely on the viability of Plaintiffs’ allegations regarding the partnership between Donnelley and Mediant. Accepted as true, they are sufficient to make the modest showing required to plead Plaintiffs’ standing to pursue their breach of contract claims.
The remainder of Defendants’ arguments contesting Plaintiffs’ standing to pursue their breach of contract claims attack the sufficiency of the allegations to plead that Plaintiffs’ are the third-party beneficiaries of the contracts at issue. [2] At the outset, by challenging the sufficiency of the allegations to plead a cause of action for breach of contract in the context of a Rule 12(b)(1) challenge to Plaintiffs’ standing, Defendants again tempt the Court to conflate a merits inquiry with standing. To the extent that Plaintiffs have failed to plead a cause of action, that issue is properly raised in the context of a motion under Rule 12(b)(6).
Nonetheless, the Court addresses Defendants’ argument that Plaintiffs have failed to
adequately plead that they are the third-party beneficiaries of the contracts at issue. Mediant notes
that “third party beneficiary claims are narrow exceptions to the general rule that a non-party has no
standing to enforce a contract.” Mediant Mem. at 7 (citing
In re Motors Liquidation Co.
,
The complaint clearly alleges that Plaintiffs were intended third-party beneficiaries of the
agreements. As shown by the quoted text above, the complaint states that the contracts contain
language to that effect and that the provisions were intentionally included for Plaintiffs’ benefit.
These allegations are sufficient, notwithstanding the fact that they are made on information and
belief.
See Fishbein v. Miranda
,
Mediant asks that the Court disregard those factual allegations because they were pleaded
“on information and belief.” The Court cannot do so. The Court must “accept[] as true all material
factual allegations of the complaint,” “draw[] all reasonable inferences in favor of the plaintiff,” and
“presume that general allegations embrace those specific facts that are necessary to support the
claim.”
Carter
,
The cases that Mediant points to in support of its argument that the Court should disregard
these allegations because they are made on information and belief are clearly distinguishable. For
example, Mediant cites to
Everlast World’s Boxing Headquarters Corp. v. Trident Brands Inc.
, No. 19-CV-
503 (JMF),
III. CONCLUSION
“While the pleading of a cause of action must possess enough heft to show that the pleader
is
entitled to relief
, to plead standing, the pleader need only show that allowing her to
raise
her claim in
federal court would not move so beyond the court’s ken as to usurp the power of the political
branches.”
Harry
,
The Clerk of Court is directed to terminate the motions pending at Dkt. Nos. 64 and 67.
SO ORDERED.
Dated: March 5, 2021 _____________________________________ New York, New York GREGORY H. WOODS
United States District Judge
Notes
[1] Donnelley’s arguments also contort the case law by arguing that “where the alleged injury was not directly caused by the defendant, but rather by a third party, a plaintiff must ‘plead facts indicating that a defendant’s actions had a ‘determinative or coercive effect upon the action of [the third party]’ who directly caused the alleged injury’” Donnelley Mem. at 10 (quoting Nat’l Council of La Raza , 283 Fed. App’x at 851) (alteration in original) (emphasis added). Note that Donnelley inserts the word “must” before the quoted text from La Raza . What the La Raza court actually said—in line with Bennett —was that “[i]t is sufficient for a plaintiff to plead facts indicating that a defendant’s actions had a ‘determinative or coercive effect.’” Nat’l Council of La Raza , 283 Fed. App’x at 851 (emphasis added). It makes a difference whether it is sufficient to show something to meet a standard, or whether one “must” make that showing: saying that a 4.0 GPA is sufficient to get you into Cornell University does not mean that you must have a 4.0 GPA to do so. Donnelley’s word substitution substantively alters the standard in a misleading way.
[2] Donnelley incorporates Mediant’s arguments by reference.
[3] This is a fair statement of the general rule, although the parties do not distinguish between prudential and
constitutional standing in their discussion of the issue. “The doctrine of standing asks whether a litigant is entitled to
have a federal court resolve his grievance. This inquiry involves ‘both constitutional limitations on federal-court
jurisdiction and prudential limitations on its exercise.’”
Kowalski v. Tesmer
,