Bohannan et al v. Innovak International, Inc. (JOINT ASSIGN)

Filing 16

MEMORANDUM OPINION AND ORDER: it is ORDERED that Dft's 8 motion to dismiss is DENIED; further ORDERED that Dft's 8 motion for a more definite statement is DENIED. Signed by Chief Judge William Keith Watkins on 8/4/2016. (Attachments: # 1 Civil Appeals Checklist) (wcl, )

IN THE UNITED STATES DISTRICT COURT
FOR THE MIDDLE DISTRICT OF ALABAMA
SOUTHERN DIVISION
MELISSA BOHANNAN, et al.,
Plaintiffs,
v.
INNOVAK INTERNATIONAL,
INC.,
Defendant.

)
)
)
)
)
)
)
)
)
)

CASE NO. 1:16-CV-272-WKW
[WO]

MEMORANDUM OPINION AND ORDER
Before the court is Defendant’s motion to dismiss (Doc. # 8), which is
construed as also containing a motion for a more definite statement (see Doc. # 8, at
10). The motions have been fully briefed (Docs. # 14 and 15). Upon careful
consideration, both motions will be denied.
I. JURISDICTION AND VENUE
Subject-matter jurisdiction is exercised pursuant to the Class Action Fairness
Act, 28 U.S.C. § 1332(d). Plaintiffs allege that they are all citizens of Alabama, that
Defendant is a citizen of South Carolina, that they bring this action on behalf of a
class that exceeds 100 individuals, and that the amount in controversy exceeds
$5,000,000. The parties do not contest personal jurisdiction or venue.

II. STANDARD OF REVIEW
A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil
Procedure tests the sufficiency of the complaint against the legal standard articulated
by Rule 8 of the Federal Rules of Civil Procedure. Rule 8 provides that the complaint
must include “a short and plain statement of the claim showing that the pleader is
entitled to relief.” Fed. R. Civ. P. 8(a)(2). When evaluating a motion to dismiss
pursuant to Rule 12(b)(6), the court must take the facts alleged in the complaint as
true and construe them in the light most favorable to the plaintiff. Resnick v. AvMed,
Inc., 693 F.3d 1317, 1321–22 (11th Cir. 2012).
To survive a Rule 12(b)(6) motion, the complaint “must contain sufficient
factual matter, accepted as true, to ‘state a claim to relief that is plausible on its
face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). The complaint is facially plausible when “the
plaintiff pleads factual content that allows the court to draw the reasonable inference
that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678.
A party may move for a more definite statement under Rule 12(e) of the
Federal Rules of Civil Procedure when a pleading is “so vague or ambiguous that
the party cannot reasonably prepare a response.”

2

III. BACKGROUND
Plaintiffs brought this class action after learning that unknown individuals
misappropriated their personal private information. The facts and procedural history
will be briefly discussed.
Defendant Innovak International, Inc. (“Innovak”) is an information
technology company serving employers like schools, school systems, and other state
agencies.

Innovak’s software allows its end users to access tax and payroll

information remotely through its internet portal. The internet portal stores an array
of employee personal private information (“PPI”), including social security
numbers, addresses, telephone numbers, and dates of birth.
Plaintiffs, who are end users of Innovak’s ledger software system,1 allege that
Innovak suffered a security breach when hackers infiltrated the internet portal. They
contend that Innovak was aware of its software’s vulnerabilities as early as 2014, yet
failed to take protective measures to ensure data security. They further contend that,
in April of 2016, Innovak admitted to news media outlets that it suffered a data
breach, but took no steps to directly inform its end users of the breach. Instead,

1

Ten plaintiffs brought this action on behalf of themselves and a class of similarly situated
individuals. The named plaintiffs, referred to collectively as “Plaintiffs,” include Melissa
Bohannan, Cherissa Hall, Jolie Hall, Summer Lisenby, Maryellen Prophet, Jennifer Matheny,
Tiffany McCoy, Ashley McGhee, Sherrie Salem, and Crystal Shelley.
3

Plaintiffs learned about the breach when they received letters from the Internal
Revenue Service indicating that their PPI had been compromised.
In their class action complaint, Plaintiffs assert claims for (1) negligence, (2)
breach of implied contract, (3) gross negligence, recklessness and/or wantonness,
(4) unjust enrichment, and (5) fraudulent suppression. Plaintiffs allege that they
have suffered psychic injuries as a result of learning that their PPI had been
compromised. Some Plaintiffs further allege that nefarious individuals used their
misappropriated PPI to file false tax returns in their names. They also have incurred
the costs of mitigating additional harm associated with the breach. They seek
compensatory damages, punitive damages, restitution, attorneys’ fees, and costs.
The complaint includes specific class action allegations. Plaintiffs define the
putative nationwide class as “all persons whose PPI was compromised as a direct
and proximate result of the Innovak data breach.”

(Doc. # 1, at 8.)

They

alternatively propose various statewide classes consisting of, for example, “[a]ll
persons in Alabama whose PPI was compromised as a direct result of the Innovak
data breach.” (Doc. # 1, at 8.) With respect to the class action prerequisites set forth
in Rule 23(a) of the Federal Rules of Civil Procedure, Plaintiffs contend that the
class is so numerous that joinder is impracticable, that there are questions of law and
fact common to putative class members, that Plaintiffs’ claims are typical of the
4

claims of the class members, and that Plaintiffs will adequately protect the interests
of the putative class members. They further allege that the questions of law and fact
common to the class members predominate over individual questions, and that class
treatment is superior to individual adjudication. See Fed. R. Civ. P. 23(b)(3).
Innovak responded to Plaintiffs’ complaint with a motion to dismiss for failure
to state a claim upon which relief can be granted. (Doc. # 8.) Pursuant to the briefing
order (Doc. # 12), Defendants filed a brief in support of their motion (Doc. # 14),
and Plaintiffs filed a response (Doc. # 15). Defendants did not file a reply brief, and
the matter is considered submitted on the briefing.
IV. DISCUSSION
In the motion now before the court, Innovak advances three arguments. First,
it contends that Plaintiffs’ class complaint should be dismissed for failure to satisfy
Rule 23 of the Federal Rules of Civil Procedure. Second, it argues that the complaint
should be dismissed for failure to state a claim upon which relief can be granted.
Third, it maintains that the complaint is so vague or ambiguous that it cannot
reasonably prepare a response. These arguments will be addressed in turn.
A.

The Complaint Will Not Be Dismissed for Failure to Satisfy Rule 23.
Innovak first argues that the class complaint should be dismissed because the

class is not ascertainable, and thus fails to satisfy the requirements of Rule 23. The
5

principles governing class certification will first be generally addressed. These
principles will then be applied to Plaintiffs’ proposed class.
Pursuant to Rule 23(a), plaintiffs may sue on behalf of a class only where:
“(1) the class is so numerous that joinder of all members is impracticable; (2) there
are questions of law and fact common to the class; (3) the claims or defenses of the
representative parties are typical of the claims or defenses of the class; and (4) the
representative parties will fairly and adequately protect the interests of the class.”
Rule 23(b) further requires that the class fit within one of three enumerated
categories. In addition to these explicit requirements, Rule 23 has been construed to
include an implicit requirement that the purported class be ascertainable by reference
to objective criteria. Bussey v. Macon Cty. Greyhound Park, 562 F. App’x 782, 787
(11th Cir. 2014). The objective criteria should allow class members to be identified
in a manner that is administratively feasible, which means that identifying class
members requires little, if any, individual inquiry. Id.
Where the proposed class definition requires the court to determine the merits
of an individual class member’s claims as a predicate to determining her membership
in the class, the class is not ascertainable. See Likes v. DHL Express, 288 F.R.D.
524, 531–32 (N.D. Ala. 2012). These “fail-safe” classes, which are framed in terms
of legal conclusions, are not administratively feasible. They inevitably require mini6

trials to determine which individuals belong to the class. William H. Rubenstein,
Newberg on Class Actions § 3:6 (5th ed.).
Innovak contends that Plaintiffs’ proposed class constitutes a fail-safe class
and is otherwise unascertainable under the controlling legal principles. Innovak
acknowledges that class allegations generally are not dismissed at the pleading stage
for failure to comply with Rule 23, but nonetheless maintains that it is appropriate
to dismiss Plaintiffs’ class complaint under Rule 12(b)(6). (Doc. # 14, at 5 (citing
Schilling v. Kenton Cty., Civil Action No. 10-143-DLB, 2011 WL 293759 (E.D. Ky.
Jan. 27, 2011).) Despite the early nature of this motion, nothing in Rule 23 precludes
the consideration of class certification issues in the context of a motion to dismiss.
It merely provides that issues of class certification should be decided “at an early
practicable time.” Fed. R. Civ. P. 23(c)(1)(A).
The relevant inquiry here is whether the allegations are sufficient to plausibly
support the existence of an ascertainable class. See Iqbal, 556 U.S. at 678. Or, to
borrow phrasing from the case on which Innovak chiefly relies for this motion, the
moving party bears the burden of demonstrating that it will be “impossible to certify
the class as alleged.” Schilling, 2011 WL 293759, at * 4 (citing Bryant v. Food Lion,
Inc., 774 F. Supp. 1484, 1495 (D.S.C. 1991)). The issue of whether Plaintiffs

7

proposed a fail-safe class will be addressed first. It will then be determined whether
the proposed class is otherwise ascertainable.
Based on the allegations in the complaint, it cannot be said that Plaintiffs have
proposed an unascertainable fail-safe class. As noted above, a proposed class is
deficient as fail-safe where it is defined in such a way that determining its
membership requires a determination of the merits of the potential class members’
claims. See Likes, 288 F.R.D. at 531–32. Innovak argues that Plaintiffs’ proposed
class definitions require findings “that [Innovak’s] conduct was ‘wrongful,’
‘unlawful,’ ‘negligent,’ ‘wanton,’ [or] ‘reckless.’” (Doc. # 14, at 6.) Innovak also
contends that the class definitions require the finding “that [Innovak] ‘knew of the
risks,’ acted with a ‘conscious disregard,’ and ‘refused to take adequate and
reasonable precautions . . . to adequately protect [PPI].’” (Doc. # 14, at 6–7.)
None of the words or phrases Innovak quoted in this portion of its brief
actually appears in the proposed class definitions. The proposed class definitions
themselves do not mention that Innovak was negligent, reckless, or wanton in its
behavior. Nor do the proposed class definitions make reference to Innovak’s
conscious disregard for a known risk. The proposed classes merely include those
persons, either on a nationwide or statewide scale, “whose PPI was compromised as
a direct and proximate result of the Innovak data breach.” (Doc. # 1, at 8.) Innovak
8

grafted this litany of legal conclusions onto the proposed class definitions without
further explanation. They otherwise are only found in the portion of the complaint
in which Plaintiffs lay out their causes of action.
The only aspect of the proposed class definitions that could arguably call for
a legal conclusion is the requirement that class members’ PPI be compromised as a
“direct and proximate result” of the Innovak data breach. Whether some event
proximately caused the harm of which a plaintiff complains is a question that
requires a legal conclusion. But the definitions offered in Plaintiffs’ complaint do
not venture so far as to inquire whether, as a matter of law, the Innovak data breach
proximately caused the ultimate harm the putative class member suffered. Instead,
they ask whether the Innovak data breach caused the putative class member’s PPI to
be compromised, which is a question that can be answered without engaging in a
final adjudication of the merits of the putative class member’s claim for liability
against Innovak. The definitions merely require the finding that the putative class
member’s data was rendered insecure as a result of the data breach. And Plaintiffs
allege that Innovak’s own records will confirm which end users were affected by the
breach.
The class, as alleged, is otherwise sufficiently ascertainable to survive Rule
12(b)(6) scrutiny. Plaintiffs contend that Innovak maintains PPI in a centralized
9

location, that its records will indicate which PPI was compromised as a result of the
breach, that there is a finite number of end users whose data could have been
compromised, and that all end users were affected by the breach. Taking these
allegations as true, the complaint is sufficient to indicate that class members can be
ascertained by administratively feasible objective criteria.

See Karhu v. Vital

Pharm., Inc., 621 F. App’x 945, 948 (11th Cir. 2015) (holding that the class is
ascertainable where the proponent of class certification can establish that the class
members can be identified by reference to records that are in the defendant’s control
and are useful for identification purposes). The discovery process will ultimately
reveal whether Innovak’s records provide a feasible means of identifying all end
users whose PPI was compromised. And the parties can move for a final decision
on the issue of class certification after this period for investigation.
For purposes of the instant motion to dismiss, however, it cannot be said that
the alleged class is impossible to certify. Accordingly, to the extent Innovak seeks
to dismiss the complaint for failure to comply with Rule 23, its motion is due to be
denied.
B.

The Complaint Will Not Be Dismissed for Failure to State a Claim.
Innovak also argues generally that the complaint should be dismissed for

failure to state a claim. See Fed. R. Civ. P. 12(b)(6). Innovak’s only argument on
10

this point is that Plaintiffs’ complaint does not specify what measures or steps
Innovak should have taken to prevent the data security breach. (Doc. # 14, at 12.)
The complaint contains sufficient factual matter, however, to support a plausible
claim for relief. See Iqbal, 556 U.S. at 678.
Plaintiffs allege that Innovak was aware of the vulnerabilities in its data
storage system and that it failed to take reasonable steps to prevent a breach. They
further allege that Innovak chose not to “lockdown its internet portal” or notify its
end users that their PPI had been compromised. (Doc. # 1, at 11.) In its motion,
Innovak offers no authority supporting the proposition that Plaintiffs must
specifically allege which protective action Innovak should have taken to prevent the
breach. Taken together, the allegations in the complaint constitute a plain statement
showing that Plaintiffs are entitled to relief. See Fed. R. Civ. P. 8(a)(2). Applying
the Rule 12(b)(6) standard, the factual allegations support the plausible inference
that Innovak is liable for the claims asserted.

See Iqbal, 556 U.S. at 678.

Accordingly, to the extent Innovak seeks to dismiss the complaint pursuant to Rule
12(b)(6), its motion is due to be denied.
C.

Plaintiffs Will Not Be Ordered to Provide A More Definite Statement.
Innovak finally argues that Plaintiffs should be ordered to provide a more

definite statement pursuant to Rule 12.
11

It cannot be said, however, that the

allegations are so vague or ambiguous that Innovak cannot prepare a response. See
Fed. R. Civ. P. 12(e). The factual allegations are neither vague nor ambiguous.
Plaintiffs specifically identify the grounds for their relief such that Innovak is in a
position to prepare its answer. Innovak’s motion for a more definite statement is
thus due to be denied.
V. CONCLUSION
Accordingly, it is ORDERED that Defendant’s motion to dismiss (Doc. # 8)
is DENIED. It is further ORDERED that Defendant’s motion for a more definite
statement (Doc. # 8) is DENIED.
DONE this 4th day of August, 2016.
/s/ W. Keith Watkins
CHIEF UNITED STATES DISTRICT JUDGE

12