Whitfield v. ATC Healthcare Servs.

1

PATRICE WHITFIELD, individually and on behalf of all others similarly situated, Plaintiff, v. ATC HEALTHCARE SERVICES, LLC, Defendant.

No. 22-CV-5005 (JMA) (LGD)

United States District Court, E.D. New York

August 22, 2023

ORDER

JOAN M. AZRACK, UNITED STATES DISTRICT JUDGE

Before the Court is a motion filed by Defendant ATC Healthcare Services, LLC (“Defendant”), seeking dismissal of Plaintiff Patrice Whitfield's (“Plaintiff”) Complaint for lack of subject matter pursuant to Rule 12(b)(1) and for failure to state a claim pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure (“Fed R. Civ. P.”), or in the alternative, to dismiss or strike certain allegations from the Complaint pursuant to Fed.R.Civ.P. 23(d)(1)(D). (See Defendant's Motion to Dismiss (“Defendant's Motion”), ECF No. 17.) For the reasons set forth herein, Defendant's Motion is granted in part and denied in part.

I. BACKGROUND

The following facts, set forth in the Complaint and the attached exhibit, are presumed true for purposes of Defendant's motion to dismiss.

A. Defendant's PII/PHI Collection

Defendant is a Georgia-based limited liability healthcare staffing company with its principal place of business in Lake Success, New York. (See Complaint (“Compl.”), ECF No. 1, ¶¶ 15, 19.) Plaintiff is an Illinois citizen who was employed by Defendant from October 2015 through August 2019. (Id. ¶ 14.) According to Plaintiff, Defendant collects and maintains “highly sensitive personal identifying information (‘PII') and personal health information (‘PHI')” from employees as a prerequisite to employment. (Id. ¶¶ 1, 25.) Defendant maintains this information even after employees cease their employment and, in doing so, purportedly agreed to “safeguard the data according to its internal policies and state and federal law.” (Id. ¶¶ 26-27.)

B. Defendant's Post-Breach Investigation and Notification

On or about December 22, 2021, Defendant “discovered unusual activity involving employee email accounts.” (Id. ¶ 2.) Defendant investigated and determined that, between February 9, 2021, and December 22, 2021, cybercriminals accessed those email accounts without authorization (the “Data Breach”). (Id. ¶¶ 2, 31.) Defendant identified the information present in the impacted email accounts on or about May 19, 2022. (Id. ¶ 32.) Defendant then “reconcile[d] the information with [its] internal records” and identified the individuals with whom the data was associated; it completed this investigative phase on or about June 2, 2022. (Id. ¶ 33.)

On or about July 1, 2022 Defendant issued a “Notice of Data Breach Incident” (the “Notice”) to potentially affected individuals, including Plaintiff. (See id. ¶¶ 3, 33; see also Notice, ECF No. 1-3.) According to the Notice, Defendant confirmed that the employee information exposed in the Data Breach included “names, Social Security numbers, driver's licenses, financial account information, usernames, passwords, passport numbers, biometric data, medical information, health insurance information, electronic/digital signatures and employer-assigned identification numbers.” (See Compl. ¶ 3; Notice at 1.)

C. Plaintiff's Post-Breach Issues

Plaintiff subsequently “spent time dealing with the consequences of the Data Breach, which include[d] time spent verifying the legitimacy of the Breach Notice, [and] self-monitoring her accounts and credit reports to ensure no fraudulent activity has occurred.” (See Compl. ¶ 38.)

Plaintiff's debit card has been compromised three times post-Breach, and her bank account was compromised, forcing her to close the account and open a new one. (Id. ¶ 39.) Accordingly, on or about August 23, 2022, Plaintiff filed the instant Complaint on behalf of herself and on behalf of a class and subclass: (i) the “Nationwide Class” of “[a]ll individuals residing in the United States whose PII and/or PHI was compromised in the Data Breach”; and (ii) the “Illinois Subclass” of “[a]ll individuals residing in Illinois whose PII and/or PHI was compromised in the Data Breach.” (See id. ¶ 72.) The Complaint asserts common law claims on behalf of Plaintiff and the Nationwide Class for: (1) negligence; (2) negligence per se; (3) breach of an implied contract; (4) unjust enrichment; and (5) declaratory and injunctive^[1] relief, as well as (6) a claim on behalf of Plaintiff and the Illinois Subclass for violation of the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/15(d).

The Court issued a briefing schedule for Defendant's Motion on December 19, 2022, see December 19, 2022 Electronic Order, which was fully briefed and filed on February 24, 2023. (See generally Defendant's Motion.) For the following reasons, the Court grants Defendant's motion to dismiss in part and denies it in part.

II. DISCUSSION

A. Legal Standards

1. Rule 12(b)(1)

“[F]ederal courts are courts of limited jurisdiction and lack the power to disregard such limits as have been imposed by the Constitution or Congress.” In re USAA Data Sec. Litig., 621 F.Supp.3d 454, 463 (S.D.N.Y. 2022) (quoting Durant, Nichols, Houston, Hodgson & Cortese-Costa, P.C. v. Dupont, 565 F.3d 56, 62 (2d Cir. 2009)). “A case is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when the district court lacks the statutory or constitutional power to adjudicate it.” Nike, Inc. v. Already, LLC, 663 F.3d 89, 94 (2d Cir. 2011), aff'd, 568 U.S. 85 (2013). The party invoking the court's jurisdiction bears the burden of establishing jurisdiction exists. Conyers v. Rossides, 558 F.3d 137, 143 (2d Cir. 2009).

When a Rule 12(b)(1) motion is based solely on the allegations of the complaint, the court must “determine whether the [complaint] alleges facts that affirmatively and plausibly suggest that the plaintiff has standing to sue.” Carter v. HealthPort Techs., LLC, 822 F.3d 47, 56 (2d Cir. 2016). In deciding a Rule 12(b)(1) motion to dismiss, the court “must accept as true all material facts alleged in the complaint and draw all reasonable inferences in the plaintiff's favor,” Conyers, 558 F.3d at 143, but “argumentative inferences favorable to the party asserting jurisdiction should not be drawn.” Buday v. N.Y. Yankees P'ship, 486 Fed.Appx. 894, 895 (2d Cir. 2012) (summary order). When, as here, a defendant moves to dismiss for lack of subject matter jurisdiction and on other grounds, the court should consider the Rule 12(b)(1) challenge first. Rhulen Agency, Inc. v. Ala. Ins. Guar. Ass'n, 896 F.2d 674, 678 (2d Cir. 1990).

2. Rule 12(b)(6)

To survive a Rule 12(b)(6) motion to dismiss, a plaintiff must allege sufficient facts “to state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible only “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). Mere labels and legal conclusions will not suffice. Twombly, 550 U.S. at 555. In reviewing a motion to dismiss, the Court must accept the factual allegations set forth in the complaint as true and draw all reasonable inferences in favor of the plaintiff. See Dobroff v. Hempstead Union Free School Dist., No. 21-cv-1567, 2022 WL 4641128, at *4 (E.D.N.Y. Sept. 30, 2022) (citing Cleveland v. Caplaw Enters., 448 F.3d 518, 521 (2d Cir. 2006)). A court may also consider materials attached to the complaint, materials integral to the complaint, and materials incorporated into the complaint by reference. See Sira v. Morton, 380 F.3d 57, 67 (2d Cir. 2004).

3. Rule 23(d)(1)(D)

Rule 23(c)(1)(A) requires courts to “decide whether to certify a class action ‘[a]t an early practicable time' after a putative class action is brought.” Candelaria v. Conopco, Inc., No. 21-cv-6760, 2023 WL 2266047, at *5 (E.D.N.Y. Feb. 28, 2023) (quoting Talarico v. Port Auth. of New York & New Jersey, 367 F.Supp.3d 161, 166 (S.D.N.Y. 2019)). “Because a decision in the negative might be practicable even prior to discovery, Rule 23(d)(1)(D) allows” courts to strike aspects of class claims at early stages of litigation. Talarico, 367 F.Supp.3d at 166 (quoting Fed.R.Civ.P. 23(d)(1)(D)). However, these motions are typically “disfavored” within this Circuit because they seek to “preemptively terminate” class claims before discovery that plaintiffs “would otherwise be entitled [to] on questions relevant to class certification.” Candelaria, 2023 WL 2266047, at *5 (quoting Calibuso v. Bank of Am. Corp., 893 F.Supp.2d 374, 383 (E.D.N.Y. 2012)); see also Duron v. Henkel of Am., Inc., 450 F.Supp.3d 337, 357 (S.D.N.Y. 2020) (same). Courts typically only grant motions to strike class allegations where a defendant has demonstrated from the face of the complaint that “it would be impossible to certify the alleged class regardless of the facts [the] [p]laintiffs may be able to obtain during discovery.” Hobbs v. Knight-Swift Transportation Holdings, Inc., No. 21-cv-1421, 2022 WL 118256, at *4 (S.D.N.Y. Jan. 12, 2022) (quoting Mayfield v. Asta Funding, Inc., 95 F.Supp.3d 685, 696 (S.D.N.Y. 2015)).

B. Analysis

1. Defendant's Rule 12(b)(1) Motion

Defendant initially contends that Plaintiff lacks standing based on her failure to establish that Defendant caused her a concrete injury, and that she instead asserts speculative allegations of a risk of non-imminent, future harm. Plaintiff maintains that Defendant's failure to prevent the Data Breach caused concrete injuries, including a “disclosure of private information,” identity theft, lost time and expenses, emotional damages, and the “lost benefit of the bargain.” Those injuries, alleges Plaintiff establish her standing. The Court agre...