Lamie v. LendingTree, LLC

1

CHRISTOPHER LAMIE AND AMABEL LIN, on behalf of themselves and others similarly situated, Plaintiff, v. LENDINGTREE, LLC, Defendant.

No. 3:22-cv-00307-FDW-DCK

United States District Court, W.D. North Carolina, Charlotte Division

February 9, 2023

ORDER

Frank D. Whitney, United States District Judge

THIS MATTER is before the Court on Defendant's Motion to Dismiss, (Doc. No. 14), which was filed before Plaintiffs amended their complaint, (Doc. No. 19), and Defendant's Motion to Dismiss the First Amended Complaint, (Doc. No. 20). This motion has been fully briefed, (Doc. Nos. 21, 25, 26 29, 30), and is ripe for ruling. For the reasons that follow the Court DENIES AS MOOT Defendant's original Motion to Dismiss and DENIES Defendant's Motion to Dismiss the First Amended Complaint.

I. Background

According to the Amended Complaint, Defendant is an online marketplace for loan services that acquires, collects, and stores private and sensitive personally identifiable information (“PII”) including full names, Social Security numbers, dates of birth, and street addresses provided by consumers and potential consumers as part of its business. (Doc. No. 19). Plaintiff Lin utilized Defendant's services for financial borrowing needs, and-as part of the transaction-provided Defendant with her PII, which Defendant then stored on its servers. Plaintiff Lamie never utilized Defendant's services, but alleges Defendant obtained his PII from third parties as part of a data aggregation and marketing plan. Defendant also stored Lamie's PII on its servers. Defendant sent both named Plaintiffs a Notice of Data Breach letter dated June 29, 2022, indicating that on June 3, 2022, Defendant determined that “a code vulnerability likely resulted in the unauthorized disclosure of . . . sensitive personal information” and that the “unauthorized disclosure began in mid-February 2022.” (Doc. No. 19, p. 6). Plaintiffs contend the data breach occurred in a “criminal cyberattack” when criminals “illegally accessed Defendant's network for the specific purpose of targeting the PII,” which the criminals “accessed,” “exfiltrated,” “exposed,” and “posted the entire dataset” on a web forum. (Doc. No. 19, pp. 10, 25, 27). Plaintiffs allege various injuries arising out of the data breach. Among other things, Lin contends she suffered “multiple identify theft and/or fraud attempts . . . including attempted loan applications, unknown funds being deposited into her bank account, and others.” (Doc. No. 19, p. 26). Similarly, Lamie contends that his injuries include “at least four instances of identify theft . . . [including] fraudulent charges on his personal credit card[;]” and, in May 2022, “someone attempted to open an account in his name with an online store, someone else changed his USPS home address, and another person tried to open financial accounts in his name with three different institutions.” (Doc. No. 19, p. 28).

Plaintiffs, on behalf of themselves and purported classes of similarly situated individuals, filed suit against Defendant alleging various claims arising out of the 2022 data breach. Plaintiffs assert claims in tort (negligence and negligence per se), breach of implied contract (including the related claim for unjust enrichment), and pursuant to statutory law (North Carolina's Unfair and Deceptive Trade Practices Act). Defendant seeks dismissal of Plaintiffs' claims.

II. Applicable Law

As an initial matter, the parties disagree as to the law that governs this action. The named Plaintiffs Christopher Lamie and Amabel Lin are residents of Massachusetts and Hawaii respectively, and Defendant is a Delaware limited liability company with its headquarters and principal place of business in Charlotte, North Carolina. Plaintiffs contend North Carolina law applies, while Defendant contends the laws of Plaintiffs' home states govern their claims.

A federal court sitting in diversity jurisdiction, as it does here, must apply the substantive law and choice-of-law rules of the state in which it sits. Colgan Air, Inc. v. Raytheon Aircraft Co., 507 F.3d 270, 275 (4th Cir. 2007); see also Volvo Constr. Equip. N. Am., Inc. v. CLM Equip. Co., 386 F.3d 581, 599-600 (4th Cir. 2004) (citing Erie R.R. Co. v. Tompkins, 304 U.S. 64, 79 (1938)). In determining the applicable law to govern these claims, the Court applies North Carolina's choice of law rules.

For tort claims, North Carolina uses the law of the situs, or “lex loci,” test to determine the choice of law. See Boudreau v. Baughman, 368 S.E.2d 849, 854 (N.C. 1988); Harco Nat'l Ins. Co. v. Grant Thornton LLP, 698 S.E.2d 719, 722 (N.C. Ct. App. 2010). “[T]he state where the injury occurred is considered the situs of the claim.” Boudreau, 368 S.E.2d at 854; see Harco, 698 S.E.2d at 722. The court must scrutinize the allegations in the amended complaint to determine “where the plaintiff has actually suffered harm.” Harco, 698 S.E.2d at 726. “The plaintiff's injury is considered to be sustained in the state where the last act occurred giving rise to the injury.” Id. at 724. “The law of the place where the injury occurs controls tort claims, because an act has legal significance only if the jurisdiction where it occurs recognizes that legal rights and obligations ensue from it.” Terry v. Pullman Trailmobile, Div. of Pullman, Inc., 376 S.E.2d 47, 49 (N.C. Ct. App. 1989); see also Quillen v. International Playtex, Inc., 789 F.2d 1041, 1044 (4th Cir. 1986) (“The place of the wrong for purposes of the lex loci delicti rule, however, is defined as the place where ‘the last event necessary to make an act liable for an alleged tort takes place.'” (quoting Miller v. Holiday Inns, Inc., 436 F.Supp. 460, 462 (E.D.Va.1977)). Defendant concedes, “Unjust enrichment is considered a tort for the purpose of North Carolina choice of law rules.” (Doc. No. 21, p. 19 (citing N.C. ex rel. Long v. Coastal States Life Ins. Co., 1994 U.S. Dist. LEXIS 21844, at *11 (E.D. N.C. Apr. 18, 1994)). Other authority supports the conclusion that the last act giving rise to a defendant's liability occurs where the defendant received the alleged benefit for which it is unjustly enriched. See, e.g., SensorRx, Inc. v. Eli Lilly & Co., No. 3:19-CV-643-RJC-DCK, 2022 WL 4480701, at *4 (W.D. N.C. Sept. 26, 2022) (concluding under North Carolina choice of law principles that Indiana law governed the plaintiff's unjust enrichment claim because the “last act triggering liability” occurred at the defendant's principle place of business in Indiana and is also the place where the defendant received “any benefit from the information”).

Plaintiff Lin alleges a claim for breach of implied contract based on Defendant's “conduct and statements,” as well as her “reasonabl[e] belie[f]” and “meeting of the minds that Defendant would secure, protect, and keep the PII confidential.” (Doc. No. 19, p. 40).

A contract implied in fact arises where the intention of the parties is not expressed, but an agreement in fact, creating an obligation is implied or presumed from their acts, or, as it has been otherwise stated, where there are circumstances which, according to the ordinary course of dealing and the common understanding of men, show a mutual intent to contract.

Snyder v. Freeman, 266 S.E.2d 593, 602 (N.C. 1980) (marks omitted). “Such an implied contract is as valid and enforceable as an express contract.” Creech v. Melnik, 495 S.E.2d 907, 911 (N.C. 1998). Under North Carolina's choice-of-law principles, “the interpretation of a contract is governed by the law of the place where the contract was made.” Schwarz v. St. Jude Med., Inc., 802 S.E.2d 783, 788 (N.C. Ct. App. 2017) (quoting Tanglewood Land Co. v. Byrd, 261 S.E.2d 655, 656 (N.C. 1980)). “[T]he place at which the last act was done by either of the parties essential to a meeting of the minds determines the place where the contract was made.” Nytco Leasing, Inc. v. Dan-Cleve Corp, 230 S.E.2d 559, 562-63 (N.C. Ct. App. 1976) (citing Fast v. Gulley, 155 S.E.2d 507 (N.C. 1967)).

III. Analysis

In applying North Carolina choice of law principles to the claims at bar, the Court finds persuasive the decisions from colleagues in the District Court of South Carolina and the Middle District of North Carolina, where the courts concluded during the early stages of litigation in data beach cases that the last act necessary in which the defendant could potentially be liable for the common law torts to be in the state in which the servers were located, noting that the injury occurs when the data is stolen. See Detrina Solomon, on behalf of herself & all others similarly situated, v. ECL Group, LLC, No. 1:22-CV-526, 2023 WL 1359662 (M.D. N.C. Jan. 31, 2023) (applying North Carolina law in reliance on the complaint's allegations regarding the defendant's operations in North Carolina); In re Blackbaud, Inc., Customer Data Breach Litig., 567 F.Supp.3d 667, 675 (D.S.C. 2021) (applying South Carolina law because the place of the breach cannot be determined without further discovery and South Carolina is the only location for the defendant specifically enumerated in the record) (hereinafter, “2021 Blackbaud”); see also In re Blackbaud, Inc., Customer Data Sec. Breach Litig., No. 3:20-MN-02972-JFA, 2022 WL 2314714 (D.S.C. June 28, 2022) (revisiting the prior decision following discovery regarding the location of the defendant's servers and applying Massachusetts law because the last act necessary in which the defendant could be liable occurred in Massachusetts, where the servers were located) (hereinafter, “2022 Blackbaud”). For purposes of the unjust claim, the Amended Complaint indicates the last act triggering Defendant's liability for unjust enrichment occurred when it “wrongfully accepted and retained these benefits,” including...