Class Action Seeking Credit Monitoring Costs and Identify Theft Insurance Following Theft of Laptops Containing Employees’ Personal Information, including Social Security Numbers, Failed to Establish Negligence or Breach of Fiduciary Duty Claims New York Federal Court Holds
Plaintiff filed a class action against Towers, Perrin, Forster & Crosby, Inc., a benefit and pension consultant to Altria, the parent company of Phillip Morris, where plaintiff worked for 20 years; the class action followed Altria’s disclosure that several laptops had been stolen from Towers’ New York office, and that one of the laptops contained personal information concerning plaintiff, including his social security number. Caudle v. Towers, Perrin, Forster & Crosby, Inc., ___ F.Supp.2d ___, 2008 WL 4104035, *1 (S.D.N.Y. 2008). The class action was filed in federal court under the auspices of the Class Action Fairness Act (CAFA), _id._, at *4. Altria’s letter to plaintiff stated that “although all of the laptops were ‘password-protected,’ only ‘some’ of the files contained on the hard drive of the laptop were protected by a separate and additional password.” _Id._, at *1. Plaintiff received an additional letter directly from Towers stating that it had arranged, and would pay for one year, for Caudle to enroll in the Equifax Credit Watch Gold, a 3-in-1 credit monitoring service that would provide plaintiff “with an early warning system for changes to [his] credit file and help [him] to understand the content of [his] credit file at the three credit reporting agencies.” _Id._ Instead, plaintiff enrolled in “LifeLock,” in part because LifeLock offered more credit fraud insurance than Equifax and because plaintiff believed he needed more than one year of credit monitoring. _Id._, at *2. Plaintiff’s class action alleged that Towers “negligent and breached its contractual and fiduciary duties in allowing the theft to occur,” and sought “to recover the costs of multi-year credit monitoring and identity theft insurance.” _Id._, at *1. Notably, the class action complaint did not allege that plaintiff’s (or any class member’s) personal information had been misused, or that plaintiff had suffered any out-of-pocket loss other than the cost of credit monitoring and identity theft insurance. _Id._ The district court bifurcated discovery, “setting a first phase of discovery to permit the parties to explore whether plaintiff has suffered a compensable injury.” _Id._ At the conclusion of the first phase of discovery, defense attorneys moved for judgment on the class action complaint; the district court granted the motion as to the class action claims for negligence and breach of fiduciary duty, but denied the motion as to the contract claims “without prejudice to the making of a summary judgment motion after the close of all discovery.” _Id._
In granting the defense motion, the district court noted that plaintiff had been told “by Towers, his employer, all three credit reporting agencies and by LifeLock’s marketing materials that, save for the credit fraud insurance, he could perform all the services performed by LifeLock for free.” Caudle, at *2. The class action complaint alleged that plaintiff and 300,000 others “were injured by the theft of the laptops because their personal information was exposed, creating the potential for identity theft and fraud leading plaintiff and the purported class to spend money on monitoring services.” Id. The class action alleged further that “‘[t]he moneys that Plaintiffs reasonably spend to reduce the danger of identity theft and mitigate their damages’ would have to continue ‘beyond the one-year coverage offered by Towers Perrin.’” Id. However, the only actual damages, if any, suffered by plaintiff or the class was the cost for credit monitoring; the class action did not allege any direct financial loss or that any class member had suffered identity theft. Id.
In analyzing the defense motion for summary judgment as to the negligence and breach of fiduciary duty claims, the district court first concluded that New York law governed. Caudle, at *6-*7. While New York’s highest court had not yet addressed the claims at issue, the federal court held, “Factors giving rise to a demonstrable basis for a serious concern over misuse may include evidence of the following: (1) the of lack any password-protection for use of the computer such that an unsophisticated user could boot the computer and immediately access the file; (2) that the person stealing the hard drive was motivated by a desire to access the data and had the capabilities to do so; or (3) actual access or misuse of information of the plaintiff or another person whose data was stored on the same hard drive.” Id., at *7. The court concluded, “This Court cannot say with confidence that New York would recognize a claim if any or all of these elements were met. However, the Court can comfortably conclude that New York would not allow a claim to proceed where none of these elements are present.” Id. Given the facts of this case, the federal court concluded that the class action’s negligence and breach of fiduciary duty claims could not proceed. Id., at *8. Put simply, the district court believed that “[w]ithout more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy.” Id. Accordingly, it granted the defense motion for summary judgment as to these claims, id., at *9. However, with respect to the class action’s breach of contract claim, the federal court reached a different conclusion. Because the parties had conducted only limited discovery under the court’s bifurcated discovery plan, the district court explained that it “[did] not know the terms of the contract nor [could] it make an intelligent decision on the choice of law analysis.” Id. Accordingly, it denied the motion without prejudice. Id., at *9-10.
NOTE: We do not here discuss the district court’s discussion of defendant’s claim that subject matter jurisdiction did not exist under CAFA, see Caudle, at *4, or that plaintiff had Article III standing, see id., at *4-*6.
Download PDF file of Caudle v. Towers, Perrin, Forster & Crosby
Comments are closed.