In re GEICO Customer Data Breach Litig.

691 F.Supp.3d 624

IN RE GEICO CUSTOMER DATA BREACH LITIGATION

21-CV-2210 (KAM)(SJB)

United States District Court, E.D. New York

Signed August 28, 2023

MEMORANDUM & ORDER ADOPTING REPORT & RECOMMENDATION

KIYO A. MATSUMOTO, United States District Judge:

Before the Court is a consolidated putative class action filed after third parties gained access to driver's license numbers ("DLN") through GEICO's online insurance sales website. The putative class members are consumers whose personal information (including their DLNs) was allegedly exposed by GEICO. Plaintiffs Michael Viscardi, Kathleen Dorety, and William Morgan (collectively, "Plaintiffs"), individually and on behalf of the proposed class, assert claims of negligence per se, intrusion upon seclusion, and negligence, as well as violations of New York General Business Law § 349 and the federal Driver's Privacy Protection Act ("DPPA"). Plaintiffs also seek declaratory and injunctive relief.

Defendants Government Employees Insurance Company, GEICO Casualty Company, GEICO Indemnity Company, and GEICO General Insurance Company (collectively, "GEICO" or "Defendants") moved to dismiss pursuant to Fed. R. Civ. P. 12(b)(6) for failure to state a claim, and pursuant to Fed. R. Civ. P. 12(b)(1) for lack of subject matter jurisdiction over the action due to Plaintiffs' lack of standing. (ECF No. 73 and exhibits.) On April 6, 2023, the Court referred Defendants' motion to dismiss to Magistrate Judge Bulsara for a report and recommendation. (See 04/06/23 Dkt. Order.)

Before the Court are: (1) Magistrate Judge Bulsara's Report and Recommendation (ECF No. 95 ("R&R")), dated July 21, 2023, recommending that the motion be granted in part and denied in part; (2) GEICO's objections to the R&R (ECF No. 96 ("Defs. Objs.")); and (3) Plaintiffs' responses to GEICO's objections (ECF No. 98 ("Pls. Resp.").) For the reasons stated below, upon de novo review, the Court adopts Magistrate Judge Bulsara's thorough, meticulous and well-reasoned R&R in its entirety.

BACKGROUND AND FACTS

The Court assumes the parties' familiarity with the extensive facts thoroughly recounted in the R&R. (See generally R&R.) For present purposes, the Court reiterates only the procedural background and facts relevant to Defendants' objections, as set forth in the R&R and Plaintiffs' Class Action Complaint (ECF No. 61 ("Compl.")).

On July 21, 2023, Magistrate Judge Bulsara issued his report and recommendations to this Court. For the reasons set forth in the R&R, he recommends that GEICO's motion to dismiss be granted in part and denied in part as follows:

1. Granting GEICO's motion to dismiss Counts III (negligence per se), IV (New York General Business Law ("GBL") § 349), and V (intrusion upon seclusion), and granting dismissal of the intrusion upon seclusion claim with prejudice;

2. Denying GEICO's motion to dismiss Counts I (DPPA), II (negligence), and VI (declaratory and injunctive relief);

3. Granting GEICO's request to dismiss Plaintiffs Mirvis, Brody, and Connelly.¹

(R&R at 41.)

Magistrate Judge Bulsara further concluded that Plaintiffs had standing to obtain injunctive and declaratory relief, and to seek damages for the first five claims asserted. On August 4, 2023, GEICO timely filed four objections to Magistrate Judge Bulsara's R&R. Plaintiffs timely filed their responses to the objections on August 18, 2023.

LEGAL STANDARD

When a party objects to an R&R, the Court must review de novo those recommendations in the R&R to which the party objects. See Fed. R. Civ. P. 72(b)(3); United States v. Male Juvenile, 121 F.3d 34, 38 (2d Cir. 1997). Where a party does not object to a portion of the R&R, the Court " 'need only satisfy itself that there is no clear error on the face of the record.' " Galvez v. Aspen Corp., 967 F. Supp. 2d 615, 617 (E.D.N.Y. 2013) (quoting Reyes v. Mantello, No. 00-cv-8936, 2003 WL 76997, at *1 (S.D.N.Y. Jan. 9, 2003)). The Court may "accept, reject, or modify the recommended disposition; receive further evidence; or return the matter to the magistrate judge with instructions." Fed. R. Civ. P. 72(b)(3); see also 28 U.S.C. § 636(b)(1).

Objections "must be specific and clearly aimed at particular findings in the magistrate judge's proposal." Green v. Dep't of Educ. of City of N.Y., No. 18-CV-10817 (AT)(GWG), 2020 WL 5814187, at *2 (S.D.N.Y. Sept. 30, 2020) (quoting McDonaugh v. Astrue, 672 F. Supp. 2d 542, 547 (S.D.N.Y. 2009)); Barratt v. Joie, No. 96-CV-0324, 2002 WL 335014, at *1 (S.D.N.Y. Mar. 4, 2002) ("Parties filing objections to recommendations are required to 'pinpoint specific portions of the report and recommendations to which [they] objec[t] . . . .' " (quoting Camardo v. Gen. Motors Hourly-Rate Emps. Pension Plan, 806 F. Supp. 380, 382 (W.D.N.Y. 1992))). If "the [objecting] party makes only frivolous, conclusory or general objections, or simply reiterates [the party's] original arguments, the Court reviews the report and recommendation only for clear error." Velez v. DNF Assocs., LLC, No. 19-CV-11138, 2020 WL 6946513, at *2 (S.D.N.Y. Nov. 25, 2020) (quoting Chen v. New Trend Apparel, Inc., 8 F. Supp. 3d 406, 416 (S.D.N.Y. 2014)); see also Colliton v. Donnelly, No. 07-CV-1922 (LAK), 2009 WL 2850497, at *1 (S.D.N.Y. Aug. 28, 2009), aff'd, 399 F. App'x 619 (2d Cir. 2010) (summary order).

"[E]ven in a de novo review of a party's specific objections," however, "the court will not consider 'arguments, case law and/or evidentiary material which could have been, but were not, presented to the magistrate judge in the first instance.' " Brown v. Smith, No. 09-CV-4522, 2012 WL 511581, at *1 (E.D.N.Y. Feb. 15, 2012) (quoting Kennedy v. Adamo, No. 02-CV-1776, 2006 WL 3704784, at *1 (E.D.N.Y. Sept. 1, 2006)) (alterations omitted).

DISCUSSION

The Court addresses each of GEICO's objections in turn.

I. GEICO's Objections as to Plaintiffs' DPPA Claim

A. Plaintiffs Sufficiently Alleged "Knowing Disclosure" Under the DPPA

GEICO first argues that the R&R "mischaracterizes" Enslin v. Coca-Cola Co., 136 F. Supp. 3d 654, 670 (E.D. Pa. 2015):

The Report and Recommendation mischaracterizes Enslin when it held that the Enslin court "rejected the statutory interpretation being advanced by GEICO. The reason that there was no 'voluntary disclosure,' and no DPPA violation [in Enslin], was because there was no transmission of information at all - not because defendants failed to possess a heightened mens rea." Report and Recommendation, at p. 28. This statement regarding Enslin is inaccurate. The plaintiff in Enslin did allege that the theft of his PI [personal information] resulted in the PI eventually being accessed - and used - by malicious third parties to effectuate a wide range of fraudulent activity. See Enslin, 136 F. Supp. 3d at 659-60.

(Defs. Objs. at 6.)

GEICO also objects to the R&R's characterization of Allen v. Vertafore, Inc., Case No. 4:20-cv-04139, 2021 WL 3148870, at *4 (S.D. Tex. June 14, 2021), arguing that the R&R "inaccurately states that the underlying Memorandum and Recommendation in Allen held that Plaintiff failed to sufficiently plead a DPPA claim because the allegations there 'describe Vertafore as having stored the data on servers under Vertafore's control, meaning the data was never actually knowingly disclosed to anyone outside of Vertafore.' " (Def. Obj. at 9); see also Allen, 2021 WL 3148870, report and recommendation adopted, No. 4:20-cv-04139, 2021 WL 3144469 (S.D. Tex. July 23, 2021), aff'd, 28 F.4th 613 (5th Cir. 2022), cert. denied, — U.S. —, 143 S. Ct. 109, 214 L. Ed. 2d 26 (2022).

On de novo review, the Court finds that GEICO's arguments are unavailing, as GEICO's reliance on Enslin and Allen, neither of which is controlling, is misplaced and misconstrues Plaintiffs' well-pleaded allegations.

Enslin involved the theft of fifty-five laptops by an employee of the defendant company, theft which the company later discovered. The laptops contained personal information of the plaintiff and a putative class of current and former employees of the company. The Enslin court specifically noted that "Plaintiff does not describe any allegedly improper disclosure of Plaintiff's PDI ["person's driving information"] . . . rather, Plaintiff speaks in general terms about the 'Coke [D]efendants' retention of his PDI and purported 'disclosure' as a result of the theft of his PDI." Enslin, 136 F. Supp. 3d at 671 (emphasis added), aff'd sub nom. Enslin v. Coca-Cola Co., 739 F. App'x 91 (3d Cir. 2018). Allen, in turn, involved a data breach in which, "because of human error, three data files containing driver information for Texas driver's licenses . . . had been inadvertently stored in an unsecured external storage service that appeared to have been accessed without authorization." Allen, 2021 WL 3148870, at *1. The Allen court found that the plaintiffs failed to assert a DPPA claim because the complaint did not contain "any factual allegation describing how this purported mismanagement of information amounts to a knowing disclosure of personal information for an improper purpose." Id. at *3 (emphasis added).

On de novo review, the Court finds that, as the R&R accurately set forth, Plaintiffs' DPPA claim is grounded in allegations that "GEICO affirmatively displayed DLNs and Plaintiffs' information, and did so without any safeguards," and not in allegations that "GEICO was a passive bystander attacked by a third party." (R&R at 29 (citing Compl. ¶¶ 77-78).)

Plaintiffs allege in relevant part:

GEICO knew that it was using driver's license information on its online sales platform . . . and that the website would auto-populate driver's license information into its quoting tool once that basic information is entered. Indeed, GEICO was responsible for its website, including its design and design features. GEICO thus knew, inferably knew, or should have known, that its website and the website's auto-populate feature disclosed consumers' driver's license number to anyone.

(Compl. ¶ 77.)

Plaintiffs further...