Gordon v. Chipotle Mexican Grill, Inc.

344 F.Supp.3d 1231

Todd GORDON, Marc Mercer, Kristen Mercer, Kristin Baker Michelle Fowler, Greg Lawson and Judy Conard, Plaintiffs,

v.CHIPOTLE MEXICAN GRILL, INC., Defendant.

Civil Action No. 17-cv-01415-CMA-SKC

United States District Court, D. Colorado.

Signed September 26, 2018

Benjamin F. Johns, Jessica L. Titler-Lingle, Chimicles & Tikellis, LLP, One Haverford Centre, Haverford, PA, Jean Sutton Martin, Jean Sutton Martin, PLLC, Wilmington, NC, Justin Daniel Blum, Kevin Scott Hannon, Hannon Law Firm, LLC, Denver, CO, Tina Wolfson, Ahdoot & Wolfson, PC, Los Angeles, CA, for Plaintiffs.

Ann Yackshaw, Baker & Hostetler, LLP, Columbus, OH, Carrie Dettmer Slye, Baker & Hostetler, LLP, Cincinnati, OH, Paul Gregory Karlsgodt, Xakema Henderson, Baker & Hostetler, LLP, Denver, CO, Sam Anthony Camardo, Baker & Hostetler, LLP, Cleveland, OH, for Defendant.

ORDER AFFIRMING IN PART AND REJECTING IN PART THE AUGUST 1, 2018 RECOMMENDATION OF UNITED STATES MAGISTRATE JUDGE AND GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS

CHRISTINE M. ARGUELLO, United States District Judge

This matter is before the Court on the August 1, 2018 Recommendation by United States Magistrate Judge Mark L. Carman (Doc. # 73), in which he recommended that the Court grant in part and deny in part Defendant Chipotle Mexican Grill, Inc.'s Motion to Dismiss (Doc. # 43). Plaintiffs, a putative class of Defendant's customers, and Defendant object to portions to the Recommendation. (Doc. ## 76, 77.) For the reasons described below, the Court adopts in part and rejects in part the Recommendation and grants in part and denies in part Defendant's Motion to Dismiss.

I. BACKGROUND

Defendant operates more than 2,000 fast-casual Chipotle burrito restaurants across the United States and two quick-serve Pizzeria Locale pizza locations in Colorado. (Doc. # 36 at 11.) It is incorporated in Delaware and maintains its principal place of business in Denver, Colorado. (Id. ) Defendant experienced a data breach in early 2017, see (Doc. # 43 at 2); between March 24, 2017, and April 18, 2017, hackers utilized malicious software to access the point-of-sale systems at Defendant's locations and stole customers' payment card information and other personal information (the "Chipotle Data Breach") (id. ). Defendant issued a security notice on April 25, 2017, to alert its customers to the Chipotle Data Breach:

We want to make our customers aware that we recently detected unauthorized activity on the network that supports payment processing for purchases made in our restaurants.... We anticipate providing notification to any affected customers as we get further clarity about the specific timeframes and restaurant locations that may have been affected. Consistent with good practices, consumers should closely monitor their payment card statements. If anyone sees an unauthorized charge, they should immediately notify the bank that issued the card. Payment card network rules generally state that cardholders are not responsible for such charges.

(Doc. # 36 at 13–14.)

Plaintiffs allege that they used payment cards at Defendant's restaurants in the states in which they reside¹ during the Chipotle Data Breach and that their personally identifiable information ("PII") was compromised by the breach. (Id. at 1–2.) Plaintiffs bring this action "individually and on behalf of others similarly situated" and seek to recover damages for their alleged loss of time and money "resolving fraudulent charges ... [and] obtaining protections against future identity theft," loss of control "over the value of personal information, and financial losses "related to purchases made at Chipotle that Plaintiffs ... would have never made," to "fraudulent charges," and to "exceeding credit and debit card limits and balances." (Id. at 29.) They bring several tort, contract, statutory, and equitable claims, apparently under the laws of the states in which they reside and made their purchases:

1. Negligence (id. at 40–42);

2. Negligence per se (id. at 42–44);

3. Violation of the Colorado Consumer Protection Act, C.R.S. § 6-1-105(1)(I), et seq., (id. at 45–50);

4. Breach of implied contract (id. at 50–52);

5. Unjust enrichment (id. at 52–53);

6. Violation of the Arizona Consumer Fraud Act, Ariz. Rev. Stat. §§ 44-1521, et seq., by Plaintiff Gordon (id. at 53–56);

7. Violation of the California Customer Records Act, Cal. Civ. Code § 1798.80, et seq, by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 57–59);

8. Violation of the California Unfair Competition Law, Cal Bus. & Prof. Code § 17200, et seq, by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 59–63);

9. Violation of the California Consumers Legal Remedies Act, Cal. Civ. Code §§ 1750, et seq., by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 63–66);

10. Violation of the Illinois Consumer Fraud and Deceptive Practices Act, 815 Ill. Comp. Stat. §§ 505/1, et seq., by Plaintiff Fowler (id. at 66–70);

11. Violations of the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp. Stat. §§ 510/1, et seq., by Plaintiff Fowler (id. at 70–71); and

12. Violation of the Missouri Merchandising Practices Act, Mo. Ann. Stat. § 407.020(1), et seq., by Plaintiff Lawson (id. at 71–73).

Plaintiffs will presumably seek class certification pursuant to Federal Rule of Civil Procedure 23.² See (id. at 34–35.)

Defendant filed its Motion to Dismiss on January 22, 2018. (Doc. # 43.) First, Defendant asserts that Plaintiffs Baker and Lawson do not have standing because they have not alleged an injury in fact and must be dismissed pursuant to Rule 12(b)(1). (Id. at 3–8.) Second, it asserts that the remaining Plaintiffs' claims fail to state a claim for relief and must be dismissed pursuant to Rule 12(b)(6). (Id. at 8–26.) Plaintiffs filed their Response on February 21, 2018 (Doc. # 57), to which Defendant replied on March 14, 2018 (Doc. # 64.)

Magistrate Judge Carman issued his Recommendation on Defendant's Motion to Dismiss on August 1, 2018. (Doc. # 73.) As the Court will discuss in further detail, Magistrate Judge Carman recommended:

• Granting in part and denying in part the motion to dismiss Plaintiffs Baker and Lawson for lack of standing, to dismiss only the allegations of independent value in Plaintiffs' stolen PII and overpayment;

• Granting the motion to dismiss Counts 1, 2, 3, and 11;

• Denying the motion to dismiss Counts 4, 6, 9, 10, and 12, and

• Granting in part and denying in part the motion to dismiss Counts 5, 7, and 8.

(Id. at 60.) Both Plaintiffs and Defendant filed Objections to the Recommendation on August 15, 2018. (Doc. ## 76, 77.) They timely responded to one another's Objections on August 29, 2018. (Doc. ## 80, 81.)

II. APPLICABLE LEGAL PRINCIPLES

A. STANDARD OF REVIEW: REVIEW OF A RECOMMENDATION

When a magistrate judge issues a recommendation on a dispositive matter, Federal Rule of Civil Procedure 72(b)(3) requires that the district judge "determine de novo any part of the magistrate judge's [recommended] disposition that has been properly objected to." An objection is properly made if it is both timely and specific. United States v. One Parcel of Real Property Known As 2121 East 30th Street , 73 F.3d 1057, 1059 (10th Cir. 1996). In conducting its review, "[t]he district judge may accept, reject, or modify the recommended disposition; receive further evidence; or return the matter to the magistrate judge with instructions." Fed. R. Civ. P. 72(b)(3).

B. RULE 12(B)(1)

Dismissal pursuant to Rule 12(b)(1) is appropriate if the Court lacks subject matter jurisdiction over claims for relief asserted in the complaint. "The burden of establishing subject matter jurisdiction is on the party asserting jurisdiction." Port City Props. v. Union Pac. R.R. Co. , 518 F.3d 1186, 1189 (10th Cir. 2008). Rule 12(b)(1) challenges are generally presented in one of two forms: "[t]he moving party may (1) facially attack the complaint's allegations as to the existence of subject matter jurisdiction, or (2) go beyond allegations contained in the complaint by presenting evidence to challenge the factual basis upon which subject matter jurisdiction rests." Merrill Lynch Bus. Fin. Servs., Inc. v. Nudell , 363 F.3d 1072, 1074 (10th Cir. 2004) (quoting Maestas v. Lujan , 351 F.3d 1001, 1013 (10th Cir. 2003) ); See Ruiz v. McDonnell , 299 F.3d 1173, 1180 (10th Cir. 2002). When reviewing a facial attack, a court takes the allegations in the complaint as true, but when in reviewing a factual attack, the court does not presume the truthfulness of the complaint's factual allegations and may consider affidavits or other documents to resolve jurisdictional facts. Holt v. United States , 46 F.3d 1000, 1002–03 (10th Cir. 1995). Defendant's Motion to Dismiss launches a facial attack on this Court's subject matter jurisdiction. See (Doc. # 73 at 4.)

Defendant takes issue with the standing of Plaintiffs Baker and Lawson. (Doc. # 43 at 3.) Article III of the United States Constitution restricts the federal courts to the adjudication of "Cases" and "Controversies." U.S. Const. art. III, § 2, cl. 1 ; Steel Co. v. Citizens for a Better Env't , 523 U.S. 83, 102, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). The standing inquiry ensures that a plaintiff has a sufficient personal stake in the dispute to ensure the existence of a live case or controversy that renders judicial resolution appropriate. See Allen v. Wright , 468 U.S. 737, 750–51, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984). To establish Article III standing, a plaintiff must show that: (1) he has suffered an "injury in fact"; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by the relief requested. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc. , 528 U.S. 167, 180, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000). Defendant contends that Plaintiffs Baker and Lawson cannot satisfy the first element of...