Robert Devine v. Horizontal Integration, Inc.

Summary

The United States District Court for the District of Minnesota granted without prejudice a defendant’s motion to dismiss claims arising from a data breach. The court held that the plaintiff failed to adequately allege Article III standing because he did not identify what personal information was disclosed, establish a substantial risk of future harm, or show that alleged spam, credit-related harm, emotional distress, and other injuries were fairly traceable to the breach. The court dismissed the action for lack of subject-matter jurisdiction and did not reach the Rule 12(b)(6) arguments.

Holdings

1. Plaintiff lacks standing for equitable relief because the complaint fails to establish a 'certainly impending' or 'substantial risk' of a future data breach absent the injunctive relief sought.
2. Plaintiff lacks standing for monetary damages because the complaint fails to identify what of plaintiff's own information was accessed or taken in the data breach, and thus fails to allege concrete or particularized harm from loss of privacy.
3. The complaint fails to plausibly plead traceability between increased spam emails and the data breach because it contains no allegations that plaintiff's email address was disclosed, does not describe the subject matter of the emails, and alleges only that spam occurred 'in the aftermath' of the breach.
4. Plaintiff's allegations of credit score decline and unauthorized inquiries are not fairly traceable to the data breach because credit scores can lower for a variety of reasons, and the timing allegations ('shortly after' and 'following') are insufficient to establish causation.
5. Time spent monitoring accounts does not create standing when the plaintiff has not established a substantial and imminent risk of identity theft, because a plaintiff cannot manufacture standing by inflicting harm on themselves based on fears of hypothetical future harm.
6. Allegations of diminished value of PII/PHI and lost benefit of the bargain are too general and conclusory to plausibly plead an injury in fact where the complaint does not identify the specific PII/PHI disclosed or explain how its monetary value was reduced.
7. Emotional distress allegations are not fairly traceable to the data breach absent allegations that plaintiff's own PII/PHI was disclosed and that this disclosure caused the emotional distress.

Questions Presented

1. Whether plaintiff has Article III standing to pursue claims arising from a data breach where the complaint does not allege that plaintiff's own personal identifiable information or protected health information was disclosed in the breach.
2. Whether allegations of future risk of identity theft, increased spam, credit score decline, time spent monitoring accounts, diminished value of PII/PHI, and emotional distress are sufficient to establish concrete injury in fact and traceability for standing purposes.

Disposition

dismissed