Hutton v. Nat'l Bd. of Exam'rs in Optometry, Inc.

243 F.Supp.3d 609

Rhonda L. HUTTON, O.D. et al., Plaintiffs

v.NAT'L BD. OF EXAM'RS IN OPTOMETRY, INC., Defendant

Nicole Mizrahi, Plaintiff

v.Nat'l Bd. of Exam'rs in Optometry, Inc., Defendant

CIVIL NO. JKB–16–3025

CIVIL NO. JKB–16–3146

United States District Court, D. Maryland.

Signed March 22, 2017

Hassan A. Zavareei, Tycko and Zavareei LLP, Donald J. Enright, Levi and Korsinsky LLP, Washington, DC, Barrett J. Vahle, J. Austin Moore, Norman E. Siegel, Stueve Siegel Hanson LLP, Kansas City, MO, Carl Malmstrom, Wolf Haldenstein Adler Freeman and Herz LLC, Chicago, IL, Michael Liskow, Wolf Haldenstein Adler Freeman and Herz LLP, New York, NY, for Plaintiffs.

Cynthia L. Maskol, Wilson Elser Markowitz Edelman and Dicker LLP, Baltimore, MD, for Defendants.

MEMORANDUM

James K. Bredar, United States District Judge

I. Background

Two cases before the Court rest upon similar allegations by different Plaintiffs, and they are the subjects of nearly identical defense motions. Both cases seek to represent the same class of similarly situated individuals. The causes of action overlap between the cases, with some differences in state-law theories of recovery. Plaintiffs allege the Defendant, National Board of Examiners in Optometry, Incorporated ("NBEO"), suffered a data breach sometime before July 23, 2016, that the personally identifiable information ("PII") Plaintiffs had supplied to NBEO to register for exams in order to obtain an optometry license was stolen, and that they have incurred damage as a result. (16–3025, Compl., ECF No. 1; 16–3146, Compl., ECF No. 1.)

Now pending before the Court are NBEO's motions to dismiss pursuant to Federal Rules of Civil Procedure 12(b)(1) and 12(b) 6) or, in the alternative, motions to strike pursuant to Rules 12(f) and 23(d)(1)(D). (16–3025, ECF No. 11; 16–3146, ECF No. 9.) Plaintiffs have also filed motions to consolidate the two cases. (16–3025, ECF No. 12; 16–3146, ECF No. 10.) NBEO does not object to the latter motion as long as the motions to dismiss are addressed first. The Court agrees it is appropriate to decide the potentially dispositive motions first. The motions have been briefed and are ripe for decision. No hearing is necessary. Local Rule 105.6 (D. Md. 2016). NBEO's motions will be granted pursuant to Rule 12(b)(1) for lack of standing. As a result, the Court will find moot NBEO's motions to the extent they are premised on other rules. Concomitantly, the Court will find moot Plaintiffs' motions to consolidate.

II. Standard for Dismissal under Rule 12(b)(1)

The burden of proving subject-matter jurisdiction is on the plaintiff. A challenge to jurisdiction may be either facial, i.e. , the complaint fails to allege facts upon which subject-matter jurisdiction can be based, or factual, i.e. , jurisdictional allegations of the complaint are not true. Adams v. Bain , 697 F.2d 1213, 1219 (4th Cir. 1982). See also Kerns v. United States , 585 F.3d 187, 192 (4th Cir. 2009) (same); Richmond, Fredericksburg & Potomac Ry. Co. v. U.S. , 945 F.2d 765, 768 (4th Cir. 1991) (same). In the case of a factual challenge, it is permissible for a district court to "consider evidence outside the pleadings without converting the proceeding to one for summary judgment." Richmond, Fredericksburg , 945 F.2d at 768 (citing Adams , 697 F.2d at 1219 ).

III. Standing

In a class action, the Court must "analyze standing based on the allegations of personal injury made by the named plaintiffs." Beck v. McDonald , 848 F.3d 262, 269 (4th Cir. 2017). To have standing, one must claim "injury in fact" (1) that is concrete and particularized, and either actual or imminent, (2) that has a causal connection to defendant's conduct, and (3) that is likely redressable by a favorable judicial decision. See Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). To establish standing at the motion-to-dismiss stage, a plaintiff must allege "sufficient ‘factual matter’ " to render a claim of standing " ‘plausible on its face.’ " Beck , 848 F.3d at 270 (citing Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) ). As with any motion to dismiss premised upon the question of sufficiency of the pleading, "[f]actual allegations must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). "A pleading that offers ‘labels and conclusions' or ‘a formulaic recitation of the elements of a cause of action will not do.’ ... Nor does a complaint suffice if it tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement.’ " Iqbal , 556 U.S. at 678, 129 S.Ct. 1937 (quoting Twombly , 550 U.S. at 555, 557, 127 S.Ct. 1955 ). Although when considering a motion to dismiss a court must accept as true all factual allegations in the complaint, this principle does not apply to legal conclusions couched as factual allegations. Twombly , 550 U.S. at 555, 127 S.Ct. 1955.

IV. Allegations of the Complaint

Plaintiff Rhonda L. Hutton, O.D., is a Kansas resident who submitted her PII to NBEO in 1998. (16–3025 Compl. ¶ 5.) Plaintiff Tawny P. Kaeochinda, O.D., is a California resident who submitted her PII to NBEO in 2006–2008. (Id. ¶ 6.) Hutton and Kaeochinda are the two named Plaintiffs in 16–3025. In 16–3146, the named Plaintiff is Nicole Mizrahi, O.D., who is a New York resident and who alleges she supplied her PII to NBEO, but does not say when that occurred. (16–3146 Compl. ¶ 9.) The PII is defined by Hutton¹ as "including but not limited to names, birth dates, Social Security numbers, addresses, and credit card information." (16–3025 Compl. ¶ 1.)

The context for Plaintiffs' complaints is provided in the following paragraphs from Hutton's complaint:

2. On or around July 23, 2016, optometrists from around the country began to notice that fraudulent Chase accounts were being opened in their names. They started discussing it on various Facebook groups and soon realized they were all victims of the same type of fraud. In particular, many optometrists learned that a Chase Amazon Visa credit card had been applied for in their name, or some other line of credit, and all within a few days of one another. The optometrists soon realized that the only common source amongst them and to which they had all given their Personal Information that included Social Security numbers and dates of birth (information necessary to apply for new lines of credit, among other things), was the NBEO, where every graduating optometry student has to submit their Personal Information to sit for board-certifying exams. This also affected optometrists who served as examiners or committee members for NBEO and optometrists who later sat for additional NBEO competency exams well after graduating from optometry school. Individuals that submitted their Personal Information to NBEO even more than fifteen years ago have been affected, and the fraud has expanded from only Chase accounts to other means.

3. The NBEO denied its responsibility for the fraud for several days, but on August 4, 2016, it issued a statement on its website stating that it had "decided further to investigate whether personal data was stolen from [its] information systems to support the perpetrators' fraud on individuals and Chase."¹

¹ http://www.optometry.org/

Mizrahi also alleges the following:

Since [the August 4, 2016, statement], the NBEO has deigned to update the public only once, on August 25, 2016, to state that the investigation is ongoing but that so far the investigation "does not establish whether an intrusion in fact occurred. Collection and technical analysis is therefore continuing, involving still more data, both current and retrospective."³ The NBEO also stated that "[d]epending on what that inquiry reveals and when, it could take a number of additional weeks to complete."⁴³Id. [referring to https://www.facebook.com/NationalBoard/hc_ref=NEWSFEED&fref=nf (last viewed September 13, 2016); http://www.optometry.org/ (last viewed September 13, 2016) ].

⁴Id.

(16–3146 Compl. ¶ 6.)

As for the individual Plaintiffs, Hutton alleges that she received on August 5, 2016, a Chase Amazon Visa credit card for which she did not apply. (16–3025 Compl. ¶ 5.) She alleges the card was opened in her maiden name, which was the name she had supplied to NBEO. (Id. ) She claims she was harmed by the compromise of her PII and faces an "increased threat of identity theft and fraud due to her Personal Information being sold on the Internet black market and/or misused by criminals. Plaintiff Hutton also has spent time and money putting credit freezes in place with the credit reporting agencies Experian, TransUnion, and Equifax." (Id. )

Kaeochinda alleges that, "on August 1, 2016, she learned that someone had applied for a Chase Amazon Visa credit card using, among other things, her former married name, which was the name she provided to NBEO as part of the examination process." (Id. ¶ 6.) She claims the same injury as Hutton, although Kaeochinda adds that she has filed reports with the FTC, FBI, IRS, and her local police department. (Id. )

Mizrahi alleges the following:

... her credit score was damaged when unknown persons applied for a Chase Bank Amazon credit card in her name on August 26, 2016. Plaintiff now faces a long, arduous, and potentially costly struggle to prevent her [PII] from being used in fraudulent transactions that may affect her finances. Plaintiff's [PII] has been compromised due to the NBEO's failure to maintain reasonable and adequate security measures to protect the [PII] it collected from Plaintiff and the Class in exchange for, inter alia, payments to the NBEO.

(16–3146 Compl. ¶ 7.) Mizrahi alleges that, after she placed a fraud alert on her credit reporting file, the application for the Chase Amazon card was automatically denied. (¶¶ 30–31.) She alleges a credit monitoring service informed her that her credit score decreased 11 points between August 23, 2016,...