Colley v. Neighbors Credit Union

Summary

The United States District Court for the Eastern District of Missouri considers Neighbors Credit Union’s motion to dismiss and motion to compel arbitration in a putative class action arising from a data breach. The court concludes at the pleading stage that the plaintiffs adequately alleged Article III standing based on the disclosure of personal identifying information, mitigation expenses, contract-related injuries, and related harms, while rejecting diminished value of personal information as a sufficient injury. The court grants in part and denies in part without prejudice the motion to compel arbitration, with the excerpt addressing arbitration issues involving current and former credit-union customers.

Holdings

1. At the pleadings stage, plaintiffs adequately pleaded Article III standing because the alleged exposure and dark-web sale of sensitive personal identifying information, mitigation expenses, loss of contractual benefit, and emotional harm accompanying financial or other intangible injuries were sufficiently concrete, fairly traceable to Neighbors' alleged cybersecurity deficiencies, and likely redressable.
2. The court denied Neighbors' motion to compel arbitration as to Johnson and Beinart without prejudice because their denials of receipt of the mailed amendment created a genuine dispute of material fact concerning whether a valid arbitration agreement was formed.
3. Neighbors, as assignee of Colley and Wilbur's secured-vehicle-loan contracts, could enforce the contracts' arbitration provisions.
4. Colley and Wilbur's data-breach claims fell within the broad arbitration clauses in their secured-vehicle-loan contracts, so the court granted the motion to compel arbitration as to both plaintiffs.
5. Under Missouri law, the remaining plaintiffs failed to state negligence and negligence-per-se claims because Neighbors owed no recognized duty of care on the alleged relationships and the Federal Trade Commission Act could not supply the basis for negligence per se because it creates no private right of action.
6. The remaining plaintiffs failed to plausibly state claims for breach of implied contract, unjust enrichment, breach of confidence, or invasion of privacy under Missouri law.

Questions Presented

1. Whether plaintiffs adequately pleaded Article III injury in fact, traceability, and redressability.
2. Whether Johnson and Beinart entered enforceable arbitration agreements through a mailed amendment and failure to opt out.
3. Whether Neighbors, as assignee of Colley and Wilbur's vehicle-loan contracts, could enforce the contracts' arbitration provisions.
4. Whether Colley and Wilbur's data-breach claims fell within the scope of their arbitration clauses.
5. Whether Hollis, Short-Shumate, Beatty Jr., and Putney plausibly stated claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of confidence, and invasion of privacy under Missouri law.

Disposition

other