Schwartz v. ADP, Inc.

OPINION AND ORDER ^[1]

SHERI POLSTER CHAPPEL, UNITED STATES DISTRICT JUDGE

Before the Court is Defendants ADP, Inc. and Automatic Data Processing, Inc.'s (together “ADP”) Motion to Dismiss (Doc. 55). Plaintiff David Schwartz responded (Doc. 56). The Court grants the Motion in part.

BACKGROUND

This case arises from Schwartz's job with ADP. A few years ago, their relationship went awry. Schwartz alleges ADP has illegal business practices. After he blew the whistle on them, ADP retaliated. They locked him out of his work laptop and iPad, then fired him.

2

Later, ADP sued Schwartz in state court for breach of contract and taking trade secrets. Schwartz counterclaimed for wrongful termination. ADP followed with another state action for defamation. Those cases are pending. When the state-court litigation got publicity, ADP hacked into Schwartz's electronic communications and accounts. Now, in federal court, Schwartz brings a host of claims. The operative pleading is the Third Amended Complaint (the “Complaint”) (Doc. 50).

LEGAL STANDARD

A complaint must recite “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A facially plausible claim allows a “court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. Courts must accept all well-pled allegations as true and view them most favorably to plaintiff. Almanza v. United Airlines, Inc., 851 F.3d 1060, 1066 (11th Cir. 2017).

DISCUSSION

The parties' dispute proceeds in five parts below.

3

A. Counts 1 and 7

First, ADP says Schwartz did not state claims under the Computer Fraud and Abuse Act (“CFAA”). Schwartz responds ADP's “sole argument” revolves around failing to specify what devices it hacked. (Doc. 56 at 3). That's wrong. ADP moves to dismiss for several reasons, including the failure to allege proper damages. Even assuming Schwartz clarified the devices, the Court agrees with ADP on the damages element.

The CFAA punishes computer hacking. Fla. Atl. Univ. Bd. of Trs. v.Parsont, 465 F.Supp.3d 1279, 1290 (S.D. Fla. 2020). Its civil enforcement remedy “has four elements: (1) a defendant intentionally accessed a protected computer; (2) without authorization or exceeding authorized access; and the defendant (3) thereby obtained information; and (4) the plaintiff suffered damage or loss of at least $5, 000.”^[2] Hall v. Sargeant, No. 18-80748-CIV-ALTMAN/Reinhart, 2020 WL 1536435, at *28 (S.D. Fla. Mar. 30, 2020); see also Hamilton Grp. Funding, Inc. v. Basel, 311 F.Supp.3d 1307, 1313 (S.D. Fla. 2018) (parsing dense statute to cobble together this claim). To meet the statutory minimum, damages must satisfy the definition of “loss.” BrownJordan Int'l, Inc. v. Carmicle, 846 F.3d 1167, 1173 (11th Cir. 2017); 18 U.S.C. § 1030(c)(4)(A)(i)(I).

4

The CFAA recognizes two losses:

any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service

18 U.S.C. § 1030(e)(11) (emphasis added). So the CFAA allows recovery of (1) “direct costs of responding to the violation” and (2) “consequential damages resulting from interruption of service.” Carmicle, 846 F.3d at 1174. At bottom, some combination of those losses must meet the $5, 000 minimum. Id. at 1173.

ADP is correct the Complaint only makes the conclusory allegation losses reached that amount. While Schwartz alleges ADP hacked attorney-client communications and personal information valued at over $5, 000, those are not “losses” under the CFAA. Daughtry v. Atlanta Crane & Automated Handling, Inc., No. 2:10-cv-1371-AKK, 2012 WL 13024455, at *8 (N.D. Ala. Jan. 12, 2012) (“The CFAA's definition of ‘loss' does not include lost revenue from the possible misappropriation of ‘stolen' information.”); Aquent LLC v. Stapleton, 65 F.Supp.3d 1339, 1345 (M.D. Fla. 2014). Again, losses are the costs associated with remedying a CFAA violation and consequential damages from lost service. Carmicle, 846 F.3d at 1174; 18 U.S.C. § 1030(e)(11). Yet Schwartz offers no facts from which anyone could infer he suffered $5, 000 of those losses. With just conclusory allegations on the damages element, the claim must fail.

5

Oce N. Am., Inc. v. MCS Servs., Inc., 748 F.Supp.2d 481, 488 (D. Md. 2010); Psychas v. Dist. Dep't of Transp., No. 18-0081 (ABJ), 2019 WL 4644503, at *8-11 (D.D.C. Sept. 24, 2019) (surveying cases and explaining limitations on “losses”).^[3]

So the Court dismisses the CFAA claims.

B. Counts 4 and 10

Second, ADP seeks to dismiss both claims under the Consolidated

Omnibus Budget Reconciliation Act (“COBRA”), which amended the Employee Retirement Income Security Act (“ERISA”). According to Schwartz, ADP did not give him notice of his right to coverage. Without knowing about COBRA benefits, his family lost their insurance. So Schwartz and his wife decided not to have a second child. Like before, the Court concludes he doesn't have standing.^[4] (Doc. 36) (the “Order”).

6

The Order emphasized Schwartz must be a participant or beneficiary to have standing. But the Complaint did not fix the central defect: pleading Schwartz meets one statutory definition. See 29 U.S.C. § 1002(7)-(8) (demanding plaintiff be someone “who is or may become eligible” or “entitled to” benefits under an ERISA plan). On repleading, Schwartz sprinkled in a few conclusory statements. Yet he again sues for only statutory penalties and (maybe) consequential damages without addressing his expired COBRA benefits. So he still does not pursue COBRA or other ERISA benefits.

Most cases Schwartz relies on are easily distinguished. For instance, he says Christopher v. Mobil Oil Corp. helps his cause. 950 F.2d 1209 (5th Cir. 1992). Not so. In Christopher, plaintiff sued because defendant discharged him for exercising an ERISA right and to prevent benefits from vesting. But for that defendant's conduct, plaintiff would have standing. This case differs. Schwartz was a participant or beneficiary with standing in the past. But he isn't anymore. Unlike Christopher, the Complaint does not allege ADP fired Schwartz to deprive him of COBRA or other ERISA benefits (nor could he). And any COBRA rights Schwartz had expired long ago-whether or not ADP provided notice. See 29 U.S.C. § 1162(2)(A); Geissal v. Moore Med. Corp., 524 U.S. 74, 80 (1998). So ADP's conduct could not be the but-for cause of Schwartz nonentitlement to COBRA at the time of suit.

7

Other cases Schwartz cites are also unavailing. In those situations, plaintiffs were still entitled to ERISA plan benefits. So unlike Schwartz, they had standing.5 As much as Schwartz relies on a single, fourteen-year-old case from Illinois, the Court is unpersuaded. Enenstein v. Eagle Ins. Agency, Inc., No. 06 C 627, 2007 WL 2410098 (N.D. Ill. Aug. 23, 2007). There, it was unclear whether plaintiff's COBRA rights expired presuit. On the other hand, not even Schwartz alleges he still may have COBRA coverage. Instead, he doubles down on the theory to get damages by stating bare legal conclusions about a “colorable claim” to unidentified benefits. (Doc. 50 at 36, 48).

Again, all Schwartz seeks are statutory penalties and (possibly) consequential damages from not having another baby. Neither are benefits. So this is not a circumstance where Schwartz sues for ERISA benefits he lost because of ADP's failure to give COBRA notice. SeeHager v. DBG Partners, Inc., 903 F.3d 460 (5th Cir. 2018) (finding standing in suit over reimbursed medical expenses when defendant did not notify plaintiff of terminated COBRA benefits). Because he does not identify or pursue a single ERISA benefit to which he is (or could be) entitled, Schwartz does not have statutory^[5]

8

standing. (Doc. 36 at 11) (collecting cases); see also Nechis v. Oxford Health Plans, Inc., 421 F.3d 96, 101 (2d Cir. 2005) (“Participants can lose standing to sue if, despite their having suffered an alleged ERISA violation, their participant status has been terminated before suit is filed.”); Harzewski v.Guiant Corp., 489 F.3d 799, 805 (7th Cir. 2007) (“The statute authorizes suits for benefits, just not for damages separate from those benefits.... Nor can [plaintiff] sue to obtain the statutory penalty for failing to provide plan documents to a participant, since that penalty is not a benefit either.”).^[6]

So the Court dismisses the ERISA claims.

C. Counts 6 and 12

Third, ADP wants to dismiss Schwartz's claims under the Florida Deceptive and Unfair Trade Practices Act (“FDUTPA”).

FDUTPA is “construed liberally to . . . protect the consuming public and legitimate business enterprises . . . in the conduct of any trade or commerce.” Fla. Stat. § 501.202(2). Unsurprisingly then, this scheme bars “[u]nfair methods of competition, unconscionable acts or practices, and unfair or

9

deceptive acts or practices in the conduct of any trade or commerce.” Fla. Stat. § 501.204(1). The elements of the claim follow: “(1) a deceptive act or unfair practice; (2) causation; and (3) actual damages.” Carriuolo v. Gen. Motors Co., 823 F.3d 977, 983 (11th Cir. 2016). What's more, FDUTPA only “applies to unfair or deceptive acts or practices in trade or commerce.” Alhassid v.Nationstar...