Rand v. Travelers Indem. Co.

637 F.Supp.3d 55

Jennifer RAND, individually and on behalf of a class similarly situated, Plaintiff, v. The TRAVELERS INDEMNITY COMPANY, Defendant.

21 CV 10744 (VB)

United States District Court, S.D. New York

Filed October 27, 2022

Signed October 26, 2022

Thomas James McKenna, Gainey McKenna & Egleston, New York, NY, for Plaintiff.

Christopher Borchert, Alston & Bird, LLP, New York, NY, Donald MacKaye Houser, Kristine M. Brown, Alston & Bird, Atlanta, GA, for Defendant.

OPINION AND ORDER

Briccetti, United States District Judge:

Plaintiff Jennifer Rand brings this putative class action against defendant The Travelers Indemnity Company ("Travelers"), arising out of Travelers's disclosure of plaintiff's personal identifying information ("PII") to non-party cybercriminals. Plaintiff asserts claims under the Driver's Privacy Protection Act (the "DPPA") and Section 349 of the New York State General Business Law, as well as state law claims for negligence and negligence per se.

Now pending is Travelers's motion to dismiss the amended complaint under Rules 12(b)(1) and 12(b)(6). (Doc. #23).

For the foregoing reasons, the motion is GRANTED IN PART and DENIED IN PART.

BACKGROUND

For the purpose of the ruling on the motion, the Court accepts as true all well-pleaded allegations in the amended complaint and draws all reasonable inferences in plaintiff's favor, as summarized below.

Travelers and its related entitles provide insurance, banking, investment, retirement, and mortgage services.

Plaintiff alleges Travelers designed its website to ensure agents could generate insurance quotes for consumers as seamlessly as possible through a " 'shortcut' process." (Doc. #20 ("Am. Compl.") ¶¶ 44-46). Specifically, plaintiff contends an agent seeking to generate a quote for an individual consumer could do so by providing only "minimal information" about the consumer, such as a name, address, and date of birth. (Am. Compl. ¶¶ 44, 49). Plaintiff further alleges that once an agent requests a quote through the agency portal, Travelers provides a final insurance quote that auto-populates with PII regarding the individual, including the individual's driver's license number. This PII is allegedly drawn from the relevant state's department of motor vehicles ("DMV") or other third parties that receive the PII from DMVs.

Plaintiff contends needing minimal consumer information to generate a quote "is by design" as it "allows Defendant to employ less [agents] and handle less phone calls from consumers." (Am. Compl. ¶ 45). Plaintiff further alleges Travelers's insurance-quote application process "is easily exploitable by non-parties to obtain the PII of other individuals . . . who are not voluntary customers" of Travelers. (Am. Compl. ¶ 48).

On February 16, 2021, and again on March 30, 2021, the New York State Department of Financial Services ("NYSDFS") issued cybersecurity fraud alerts warning regulated financial entities like Travelers that cybercriminals were targeting "websites that offer instant online automobile insurance premium quotes" to steal driver's license numbers. (Am. Compl. ¶¶ 67, 71, 75). In light of the "serious risk of theft and consumer harm" posed by the instant quote system, NYSDFS recommended numerous data security measures, including redacting PII, "disabl[ing] prefill of redacted" PII, or "avoid[ing] displaying prefilled [PII] on public-facing websites" entirely. (Am. Compl. ¶¶ 73, 77-78).

Plaintiff alleges she received a December 10, 2021, notice from Travelers that an unauthorized party may have accessed her name, address, date of birth, and driver's license number by improperly using the credentials of Travelers agents to access Travelers's agency portal (the "Travelers Notice"). Plaintiff maintains she never applied for Travelers insurance on her own and is not a voluntary customer of Travelers.

As a result, Travelers allegedly offered plaintiff and the putative class members "complimentary identity theft and credit monitoring services for a period of one year." (Am. Compl. ¶ 57).

Plaintiff claims she spent "valuable time and resources in an effort to detect and prevent any additional misuses of her PII" and protect against "the heightened risk for fraud and identity theft" for years to come. (Am. Compl. ¶¶ 39-40). Plaintiff also claims she and putative class members "face years of constant surveillance of their financial and personal records, monitoring, and loss of rights" and they "are incurring and will continue to incur such damages in addition to any fraudulent use of their PII." (Am. Compl. ¶¶ 147-148). Plaintiff further alleges she and putative class members incurred "[c]osts associated with requested credit freezes," "[c]osts associated with the detection and prevention of identity theft," "[c]osts associated with purchasing credit monitoring and identity theft protection services," and "[l]owered credit scores resulting from credit inquiries following fraudulent activities." (Am. Compl. ¶ 173).

DISCUSSION

I. Standards of Review

A. Rule 12(b)(1)

"[F]ederal courts are courts of limited jurisdiction and lack the power to disregard such limits as have been imposed by the Constitution or Congress." Durant, Nichols, Houston, Hodgson & Cortese-Costa, P.C. v. Dupont, 565 F.3d 56, 62 (2d Cir. 2009).¹ "A case is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when the district court lacks the statutory or constitutional power to adjudicate it." Nike, Inc. v. Already, LLC, 663 F.3d 89, 94 (2d Cir. 2011), aff'd, 568 U.S. 85, 133 S.Ct. 721, 184 L.Ed.2d 553 (2013). "The party invoking the court's jurisdiction bears the burden of establishing jurisdiction exists." Conyers v. Rossides, 558 F.3d 137, 143 (2d Cir. 2009).

"When the Rule 12(b)(1) motion is facial, i.e., based solely on the allegations of the complaint . . . , the plaintiff has no evidentiary burden," and "[t]he task of the district court is to determine whether the [complaint] alleges facts that affirmatively and plausibly suggest that the plaintiff has standing to sue." Carter v. HealthPort Techs., LLC, 822 F.3d 47, 56 (2d Cir. 2016).

In deciding a motion to dismiss under Rule 12(b)(1) at the pleading stage, the court "must accept as true all material facts alleged in the complaint and draw all reasonable inferences in the plaintiff's favor." Conyers v. Rossides, 558 F.3d at 143. But "argumentative inferences favorable to the party asserting jurisdiction should not be drawn." Buday v. N.Y. Yankees P'ship, 486 F. App'x 894, 895 (2d Cir. 2012) (summary order).

When a defendant moves to dismiss for lack of subject matter jurisdiction and "on other grounds, the court should consider the Rule 12(b)(1) challenge first." Rhulen Agency, Inc. v. Ala. Ins. Guar. Ass'n, 896 F.2d 674, 678 (2d Cir. 1990).

B. Rule 12(b)(6)

In deciding a Rule 12(b)(6) motion, the Court evaluates the sufficiency of the complaint under the "two-pronged approach" articulated by the Supreme Court in Ashcroft v. Iqbal, 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). First, a plaintiff's legal conclusions and "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements," are not entitled to the assumption of truth and thus are not sufficient to withstand a motion to dismiss. Id. at 678, 129 S.Ct. 1937; Hayden v. Paterson, 594 F.3d 150, 161 (2d Cir. 2010). Second, "[w]hen there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief." Ashcroft v. Iqbal, 556 U.S. at 679, 129 S.Ct. 1937.

To survive a Rule 12(b)(6) motion, the complaint's allegations must meet a standard of "plausibility." Ashcroft v. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937; Bell Atl. Corp. v. Twombly, 550 U.S. 544, 564, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). A claim is facially plausible "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. "The plausibility standard is not akin to a 'probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Id. (quoting Bell Atl. Corp. v. Twombly, 550 U.S. at 556, 127 S.Ct. 1955).

II. Standing

Travelers argues plaintiff does not allege an injury-in-fact to support Article III standing.

The Court disagrees.

A. Legal Standard

To satisfy the "irreducible constitutional minimum of standing . . . [t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016).

An injury-in-fact is "an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." Spokeo, Inc. v. Robins, 578 U.S. at 339, 136 S.Ct. 1540. This is "a low threshold which helps to ensure that the plaintiff has a personal stake in the outcome of the controversy." John v. Whole Foods Mkt. Grp., Inc., 858 F.3d 732, 736 (2d Cir. 2017).

To be concrete, an injury "must actually exist." Spokeo, Inc. v. Robins, 578 U.S. at 340, 136 S.Ct. 1540. Further, an injury-in-fact must bear a "close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as physical harm, monetary harm, or various intangible harms." TransUnion LLC v. Ramirez, — U.S. —, 141 S. Ct. 2190, 2200, 210 L.Ed.2d 568 (2021).

Regarding statutory harms, it is not enough to allege a defendant violated the statute; "[o]nly those plaintiffs who have been concretely harmed by a defendant's statutory violation" will have standing. TransUnion LLC v. Ramirez, 141 S. Ct. at 2205.

"Any monetary loss suffered by the plaintiff satisfies [the injury-in-fact] element; even a small...