Burton v. Mapco Express Inc

Filing 42

MEMORANDUM OPINION. Signed by Judge Madeline Hughes Haikala on 9/12/2014. Associated Cases: 5:13-cv-00919-MHH, 5:13-cv-01133-MHH, 5:13-cv-01141-MHH, 5:14-cv-00756-MHH, 5:14-cv-00806-MHH(AVC)

FILED
2014 Sep-12 PM 05:01
U.S. DISTRICT COURT
N.D. OF ALABAMA

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
NORTHEASTERN DIVISION
BRIAN BURTON,
Plaintiff,
v.
MAPCO EXPRESS, INC.,
Defendant.

)
)
)
)
)
)
)
)
)

Case No.: 5:13-cv-00919-MHH
LEAD CASE

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
NORTHEASTERN DIVISION
BROOKE DAVIS,
Plaintiff,
v.
MAPCO EXPRESS, INC.,
Defendant.

)
)
)
)
)
)
)
)
)

Case No.: 5:13-cv-01133-MHH
CONSOLIDATED

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
NORTHEASTERN DIVISION
IAN YEAGER,
Plaintiff,
v.

)
)
)
)
)

Case No.: 5:13-cv-01141-MHH

)
)
)
)

MAPCO EXPRESS, INC.,
Defendant.

CONSOLIDATED

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
NORTHEASTERN DIVISION
JOHNNY JAMES,

)
)
)
)
)
)
)
)
)

Plaintiff,
v.
MAPCO EXPRESS, INC.,
Defendant.

Case No.: 5:14-cv-00756-MHH
CONSOLIDATED

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
NORTHEASTERN DIVISION
KRISTA GUINN, et al.,

)
)
)
)
)
)
)
)
)

Plaintiffs,
v.
MAPCO EXPRESS, INC.,
Defendant.

2

Case No.: 5:14-cv-00806-MHH
CONSOLIDATED

MEMORANDUM OPINION
Defendants MAPCO Express, Inc. and Delek US Holdings, Inc. have asked
the Court to dismiss plaintiff Brian Burton’s amended complaint. (Docs. 20, 21).
Mr. Burton has been attempting to frame claims against MAPCO and Delek
relating to data breaches that MAPCO suffered over the course of 11 days between
March 19, 2013 and April 21, 2013. MAPCO acknowledges that on those 11 days,
third-party hackers breached MAPCO’s computer systems and accessed account
information concerning MAPCO customers. (Doc. 22, p. 1; Doc. 27, p. 3).
Under the pleading standard that the United States Supreme Court
enunciated in Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009), it is difficult for
consumers like Mr. Burton to assert a viable cause of action stemming from a data
breach because in the early stages of an action, it is challenging for a consumer to
plead facts that connect the dots between the data breach and an actual injury so as
to establish Article III standing. Mr. Burton’s amended complaint comes closer to
the mark than his original complaint, at least with respect to his negligence claim,
but the allegations in the amended complaint still fall short. Because litigation
relating to computer data breaches is a relatively new phenomenon, and the law in
this area is developing fairly quickly, the Court will give Mr. Burton one final
chance to amend his complaint to allege plausible facts that will enable him to
establish standing to assert his negligence claim against the defendants.
3

If Mr. Burton cannot establish standing, then the Court will lack subject
matter jurisdiction over his negligence claim, and the Court will dismiss that claim
pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure. The Court
dismisses the balance of Mr. Burton’s federal and state law claims pursuant to Rule
12(b)(6) because the facts that Mr. Burton has alleged do not state a claim upon
which relief may be granted.1
FACTUAL BACKGROUND
On behalf of a proposed nationwide class, Mr. Burton asserts claims against
the defendants concerning credit card and debit card data stolen from MAPCO’s
computer network in the spring of 2013. (Doc. 20, ¶ 8, 14). Mr. Burton alleges
that during the days on which the data breaches occurred, he used a debit card to
make purchases at one of Mapco’s convenience stores, and a third-party then used
his debit card account for unauthorized purchases from gas stations in Florida. The
unauthorized charges total just under $300.00.2 (Doc. 20, ¶¶ 4, 11).
1

Ms. Burton’s complaint is the first of five consumer actions against MAPCO that are pending
before the Court. (Docs. 30, 33, 34). Motions to dismiss filed in the consolidated cases are
duplicative of the pleadings in this, the lead action. Consequently, the Court has marked the
motions to dismiss in the consolidated cases as non-pending.

2

Few of the plaintiffs in the consolidated cases specifically alleges that his or her credit or debit
card numbers were stolen and that he or she incurred unauthorized charges on a credit or debit
account. See Yeager v. Mapco, 5:13-cv-1141-MHH, Complaint, ¶ 4 (alleging only that plaintiff
made debit card purchases at defendant’s retail facility in Northport, Alabama, and that his data
“was subject to release to unauthorized and unknown individuals); James v. Mapco, 5:14-cv756-MHH, Complaint, ¶ 4 (same); Davis v. Mapco, 5:13-cv-1133-MHH, Complaint, ¶ 4 (same).
In Guinn v. Mapco, the plaintiffs allege that they “made credit and/or debit purchases at
Defendants’ stores during the period that Defendants admit financial information was stolen” and
4

Based on this set of facts, Mr. Burton asserts claims for intentional violation
of the Fair Credit Reporting Act (Count I); negligent violation of the Fair Credit
Reporting Act (Count II); invasion of privacy by public disclosure of private facts
(Count III); and negligence (Count IV). According to Mr. Burton, putative
members of the proposed nationwide class similarly suffered damages because
“their personal information or what is known as their personal customer account
information [was] compromised, . . . their privacy rights [were] violated . . . [they
were] exposed to and [are] suffering the risk of fraud and identity theft and the
threat of fraud and identity theft, . . . [they were] the victims of fraud, and . . .
[they] otherwise suffered damages.” (Doc. 20, ¶ 1).
MAPCO moved to dismiss Mr. Burton’s original complaint for lack of
standing and for failure to state claim. (Doc. 4). MAPCO and Delek challenge
Mr. Burton’s amended complaint on the same grounds. (Doc. 22).2 Mr. Burton

that they have been damaged by either “actual unauthorized transactions or the threat of
unauthorized transactions.” Id., 5:14-cv-806-MHH, Complaint, ¶¶ 15-17.
2

Mr. Burton refers to his amended complaint as the “second amended complaint.” The Court
treats the pleading as his first amended complaint. Mr. Burton filed his original complaint on
May 14, 2013. (Doc. 1). MAPCO moved to dismiss the complaint on various grounds,
including lack of subject matter jurisdiction. (Doc. 4). While MAPCO’s motion to dismiss was
pending, Mr. Burton filed a motion for leave to correct or amend his complaint to add Delek as a
defendant. (Doc. 9). The Court deferred ruling on the motion, explaining that it had to resolve
the jurisdictional challenge before it would consider Mr. Burton’s motion to amend or correct.
(Doc. 12). The Court held that Mr. Burton’s original complaint did not allege facts sufficient to
establish standing. (See Doc. 16, p. 9). Rather than dismiss Mr. Burton’s claims, the Court
instructed Mr. Burton to file an amended complaint consistent with the Court’s standing analysis.
(Doc. 16, pp. 9-10). On January 8, 2014, Mr. Burton filed his amended complaint. (Doc. 20).
5

has asked the Court to stay these proceedings “pending the Court’s resolution of
Winsouth Credit Union’s motion to transfer this action to the U.S. District Court
for the Middle District of Tennessee” pursuant to 28 U.S.C. § 1407. (Doc. 37).
Winsouth seeks MDL treatment for purposes of discovery in the various consumer
and financial institution class actions pending against MAPCO. To secure the just
and efficient disposition of these proceedings, the Court resolves the defendants’
current motion to dismiss. See Fed. R. Civ. P. 1.
LEGAL ANALYSIS
A. Negligence
1. Jurisdiction
As the party invoking federal jurisdiction, Mr. Burton bears the burden of
establishing the Court’s jurisdiction over his claims. McCormick v. Aderholt, 293
F.3d 1254, 1257 (11th Cir. 2002) (“[T]he party invoking the court’s jurisdiction
bears the burden of proving, by a preponderance of the evidence, facts supporting
the existence of federal jurisdiction) (internal citation omitted). “Article III of the
United States Constitution limits the jurisdiction of federal courts to cases and
controversies. ‘[T]here are three strands of justiciability doctrine—standing,
ripeness, and mootness—that go to the heart of the Article III case or controversy

That amended complaint is the first amendment that the Court has allowed, and it currently is the
operative pleading in this matter.
6

requirement.’ Christian Coal. of Fla., Inc. v. United States, 662 F.3d 1182, 1189
(11th Cir. 2011).” Zinni v. ER Solutions, Inc., 692 F.3d 1162, 1166 (11th Cir.
2012) (one internal citation omitted).
To meet the requirements of Article III standing, a plaintiff must establish
that he has suffered an injury in fact, that the injury was causally connected to the
defendant’s actions, and that a judgment in the plaintiff’s favor will redress the
injury. Koziara v. City of Casselberry, 392 F.3d 1302, 1304 (11th Cir. 2004)
(citing Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992)); see also Resnick v.
AvMed, Inc., 693 F.3d 1317, 1323 (11th Cir. 2012). The ripeness doctrine also
requires an examination of the nature of the injury that the plaintiff alleges.
“‘Courts must resolve whether there is sufficient injury to meet Article III's
requirement of a case or controversy and, if so, whether the claim is sufficiently
mature, and the issues sufficiently defined and concrete, to permit effective
decisionmaking by the court.’” Yacht Club on the Intracoastal Condominium
Ass’n, Inc. v. Lexington Ins. Co., 509 Fed. Appx. 919, 922 (11th Cir. 2013)
(quoting Digital Properties, Inc. v. City of Plantation, 121 F.3d 586, 589 (11th Cir.
1997)).
“This case presents thorny standing issues regarding when, exactly, the loss
or theft of something as abstract as data becomes a concrete injury. That is, when
7

is a consumer actually harmed by a data breach—the moment data is lost or stolen,
or only after the data has been accessed or used by a third party?” In re Science
Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, 2014
WL 1858458, *1 (D.D.C. 2014). The SAIC court found that “the mere loss of
data—without evidence that it has been either viewed or misused—does not
constitute an injury sufficient to confer standing.” Id. The SAIC court permitted
only the two plaintiffs who “plausibly assert[ed] that their data was accessed or
abused” to “move forward with their claims.” Id.
Another court has required more than a plausible assertion that the plaintiff’s
account data was accessed or abused. In In re Barnes & Noble Pin Pad Litigation,
2013 WL 4759588 (N.D. Ill. 2013), the district court held that to plead an injury
adequately in a data theft case, a plaintiff must assert not only that an unauthorized
party had access to or abused his data but also that he (the plaintiff) suffered an
actual economic loss as a consequence. In Barnes & Noble, the district court
dismissed the plaintiffs’ claims for lack of standing because:
[o]nly [one plaintiff,] Winstead[,] suffered from actual fraudulent
activity, when a fraudulent charge was made to her credit card. This
fraudulent charge occurred after she shopped at the breached Barnes
& Noble store. Winstead was contacted by her credit card company
about a potentially fraudulent charge, she confirmed it was fraudulent;
her card was cancelled; and Winstead was unable to use her credit
card until a replacement card arrived.
8

Barnes & Noble Pin Pad Litigation, 2013 WL 4759588 at *2.

The court

continued:
[e]ven assuming the fraudulent charge is due to the actions or
inactions of Barnes & Noble, Winstead has not pled that actual injury
resulted and that she suffered any monetary loss due to the fraudulent
charge. She alleges she was without the use of her credit card for the
period of time it took to replace her card, but there is no indication of
how long this was, or any other facts regarding this period of time. In
order to have suffered an actual injury, she must have had an
unreimbursed charge on her credit card; the most that is alleged is a
time lag of an unknown length between learning of the fraudulent
charge and receiving a new credit card.
Id. at *6 (citing In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 527
(N.D.Ill. 2011) (“Plaintiffs suffered no actual injury ... if Plaintiffs were
reimbursed for all unauthorized withdrawals and bank fees and, thus, suffered no
out-of-pocket losses.”). The district court added, “[m]oreover, it is not directly
apparent that the fraudulent charge was in any way related to the security breach at
Barnes & Noble. For these reasons, there is no actual injury and therefore, no
standing.” 2013 WL 4759588 at *6.
To date, the Eleventh Circuit Court of Appeals has not weighed in on the
extent of the injury that a consumer who is a purported victim of a data breach
must allege to survive a motion to dismiss based on lack of standing. The Eleventh
Circuit considered the related topic of identity theft in Resnick v. AvMed, Inc., 693
F.3d 1317 (11th Cir. 2012). In that case, the plaintiffs alleged that they suffered
9

monetary damages as a consequence of identity theft after two laptop computers
containing the plaintiffs’ sensitive personal data were stolen from the defendant
health services provider. The Eleventh Circuit reversed a district court order
dismissing the plaintiffs’ claims for lack of standing. The Court held:
Whether a party claiming actual identity theft resulting from a data breach
has standing to bring suit is an issue of first impression in this Circuit.
Plaintiffs allege that they have become victims of identity theft and have
suffered monetary damages as a result. This constitutes an injury in fact
under the law.

Resnick, 693 F.3d at 1323. The Resnick Court acknowledged in dicta that in the
context of identity theft, some circuit courts of appeal, “have found that even the
threat of future identity theft is sufficient to confer standing in similar
circumstances. Krottner v. Starbucks Corp., 628 F.3d 1139, 1142–43 (9th Cir.
2010) (finding an injury in fact where plaintiffs alleged a data breach and threat of
identity theft, but no actual identity theft); Pisciotta v. Old Nat'l Bancorp, 499 F.3d
629, 634 (7th Cir. 2007) (same).” The Court reasoned that because the Resnick
plaintiffs “alleged only actual—not speculative—identity theft, we need not
address the issue of whether speculative identity theft would be sufficient to confer
standing.” Id. at 1323, n. 1. From this language, it is not entirely clear to this
Court whether the allegation of actual identify theft alone or the allegation actual
identity theft plus the allegation of monetary damages prompted the Resnick
10

majority to find that the Resnick plaintiffs had standing to pursue their identity
theft claims. 3
Because Resnick does not provide clear direction with respect to Mr.
Burton’s pleading obligation in this consumer data theft action and because
Alabama law governs Mr. Burton’s negligence claim, the Court turns to Alabama
law for guidance. 4 In the context of a statute of limitations analysis, the Alabama
Supreme Court has held:
The general principle at issue was well stated by Dean Prosser in explaining
that the fourth element of a cause of action for negligence, ‘actual loss or
damage,’ requires more than nominal damages. ‘[P]roof of damage [is] an
essential part of the plaintiff’s case. Nominal damages, to vindicate a
technical right, cannot be recovered in a negligence action, where no actual
loss has occurred. The threat of future harm, not yet realized, is not enough.’

3

Judge Pryor dissented in Resnick. He explained:
experience reveals that vast numbers of individuals, businesses, and
governmental bodies possess our sensitive information, e.g., our names, social
security numbers, health information, and other personal data. Technology allows
this information to be copied quickly and transmitted over the Internet in an
instant. Because of the nature of sensitive information—a social security number
and a name are the same regardless of who possesses that information—it may be
difficult to pinpoint the source of the sensitive information that is used to commit
identity theft. But that difficulty does not relieve Curry and Moore of their burden
under Rule 8 to plead a plausible basis for inferring that the sensitive information
used by the identity thieves was obtained from AvMed.

693 F.3d at 1332 (Pryor, J., dissenting).
4

Alabama substantive law governs Mr. Burton’s state law claims against the defendants. See
Guaranty Trust Co. v. York, 326 U.S. 99, 108–09 (1945) (a federal court exercising jurisdiction
over a claim under state law sits as a court of the forum state and is bound to apply its
substantive law).
11

Ex parte Stonebrook Development, L.L.C., 854 So. 2d 584, 589 (Ala. 2003)
(emphasis in opinion) (quoting William C. Prosser, Handbook of the Law of Torts,
§ 30 (4th ed.1971)). Elsewhere in Stonebrook Development, the Alabama Supreme
Court noted:
In actions such as the case at bar, the act complained of does not itself
inflict a legal injury at the time it is done, but plaintiff’s injury only follows
as a result and a subsequent development of the defendant’s act. “In such
cases, the cause of action ‘accrues,’ and the statute of limitations begins to
run, ‘when and only when, the damages are sustained.’ ”
Id. at 588–89 (emphasis in opinion).
The language quoted above goes to the heart of Article III’s case or
controversy requirement. Under Alabama law, a negligence claim is not ripe until
a plaintiff has incurred actual damages. Thus, whether framed as an issue of
standing or as an issue of ripeness, Mr. Burton cannot press forward unless he
plausibly alleges not only that fraudulent charges appeared on his debit account as
a consequence of the MAPCO data breach but also that he incurred damages as a
result. If he cannot plausibly allege and ultimately prove actual damages (for
example, an allegation that the charges on his account were not forgiven, and he
had to pay for the charges), then the Court must dismiss his negligence claim for
lack of subject matter jurisdiction because he cannot plead an Article III case or
controversy. His current allegation that his debit card was used for just under
12

$300.00 of unauthorized purchases at a gas station in Florida is not enough to
survive a Rule 12(b)(1) challenge to subject matter jurisdiction. 5
Because this is largely unchartered territory, the Court will offer Mr. Burton
one final opportunity to plead his negligence claim against the defendants. In
doing so, the Court brings to the parties’ attention one other issue with respect to
subject matter jurisdiction. Mr. Burton has alleged only one potentially plausible
statutory basis for subject matter jurisdiction in his amended complaint: 28 U.S.C.
§ 1332(d); as discussed below, none of Mr. Burton’s federal claims can survive a
motion to dismiss. The Court questions whether Mr. Burton plausibly can plead
that more than $5 million in actual damages is at issue with respect to consumer
losses, given the fact that financial institutions in two class actions have sued the
defendants, alleging that the defendants’ “failure to adequately safeguard customer
identification information and related data” and their “failure to maintain adequate
encryption, intrusion detection and prevention procedures in their computer
systems” caused the financial institutions to “incur[] significant losses associated
with . . . customer reimbursement for fraud losses” or “reversal of customer
charges.” Winsouth Credit Union v. MAPCO, 3:14-cv-01573 (M.D. Tenn. July 31,
5

The Stonebrook Development decision also makes clear that Mr. Burton cannot identify an
actual injury sufficient to establish an Article III case or controversy based on his allegations that
he must closely monitor and scrutinize his accounts, and he fears that he will lose money and
become a victim of identity theft.
13

2014), Doc. 1, ¶¶ 1, 2, 51; see also First National Community Bank v. Mapco,
4:14-cv-00031-HLM (N.D. Ga. February 19, 2014), Doc. 1, ¶¶ 1, 2, 52.6 If
consumers’ financial institutions have forgiven or reimbursed the vast majority of
the purported fraudulent charges on consumers’ accounts, then it is difficult to
imagine that a consumer plaintiff will be able to sustain jurisdiction over the long
haul under 28 U.S.C. § 1332(d), given the $ 5 million amount in controversy
requirement.
Accordingly, the Court denies the defendants’ motion to dismiss on
standing grounds. Consistent with this opinion, Mr. Burton may file a second
amended complaint within 14 days. If his allegations are not sufficient to plausibly
establish standing, then the Court may dismiss the complaint sua sponte for lack of
subject matter jurisdiction.

6

On August 27, 2014, Mr. Burton filed a motion to stay further proceedings in this action
pending resolution of Winsouth Credit Union’s motion for transfer to the Middle District of
Tennessee for coordinated pretrial proceedings pursuant to 28 U.S.C. § 1407. (Doc. 37). Five
days before Mr. Burton filed his motion to stay, the Court received from Winsouth Credit
Union’s counsel a copy of Winsouth’s § 1407 motion, a brief in support of the motion, a
schedule of cases, proof of service, and Winsouth’s complaint and related docket sheet. The
Court takes judicial notice of the related actions pending in Tennessee and Georgia. See Horne
v. Potter, 392 Fed. Appx. 800, 802 (11th Cir. 2010) (district court properly took judicial notice of
documents related to the plaintiff’s previous civil action because the documents “were public
records that were ‘not subject to reasonable dispute’ because they were ‘capable of accurate and
ready determination by resort to sources whose accuracy could not reasonably be questioned.’”)
(quoting Fed. R. Evid. 201(b); other internal citations omitted).
14

2. Rule 12(b)(6) analysis7
The defendants have presented a number of arguments in favor of dismissal
of Mr. Burton’s negligence claim under Rule 12(b)(6) and Iqbal. (Doc. 22).
Under Alabama law, the elements of a negligence claim are duty, breach of duty,
proximate cause, and damages. Prill v. Marrone, 23 So. 3d 1, 6 (Ala. 2009);
Sessions v. Nonnenmann, 842 So. 2d 649, 651 (Ala. 2002) (quoting Ex parte
Harold L. Martin Distrib. Co., 769 So. 2d 313, 314 (Ala. 2000) (quoting in turn
other authorities)). The Court already has discussed the damages issue in this case.
Mr. Burton alleges multiple duty theories in his amended complaint. (Doc. 20, ¶¶
63–73). He may, if he chooses, refine his allegations of duty and causation in his
second amended complaint. If Mr. Burton successfully pleads facts sufficient to
establish an Article III controversy in his second amended complaint, then the
Court will consider a Rule 12(b)(6) challenge to his negligence claim, should the

7

To survive a motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil Procedure, “a
complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is
plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). “The plausibility standard is not akin to a ‘probability
requirement,’ but it asks for more than a sheer possibility that defendant has acted unlawfully.”
Id. (quoting Twombly, 550 U.S. at 556). “Where a complaint pleads facts that are ‘merely
consistent with’ a defendant's liability, it ‘stops short of the line between possibility and
plausibility of entitlement to relief.’” Id. (quoting Twombly, 550 U.S. at 557). The Court accepts
as true all material allegations of the complaint, Grossman v. Nationsbank, N.A., 225 F.3d 1228,
1231 (11th Cir. 2000), and the Court draws all reasonable inferences in favor of Mr. Burton,
Watts v. Fla. Int’l Univ., 495 F.3d 1289, 1295 (11th Cir. 2007).
15

defendants wish to present one. The Court will resolve the jurisdictional issue
first.
B. Fair Credit Reporting Act Claims
Mr. Burton asserts that the defendants violated the Fair Credit Reporting Act
(“FRCA”) by improperly disposing or transferring consumer information. (Doc.
20, ¶ 23-24, 35). Congress enacted the FCRA “to require that consumer reporting
agencies adopt reasonable procedures for meeting the needs of commerce for
consumer credit, personnel, insurance, and other information in a manner which is
fair and equitable to the consumer, with regard to the confidentiality, accuracy,
relevancy, and proper utilization of such information ....” 15 U.S.C. § 1681(b)
(2012). “To achieve its purpose, the [Act] places distinct obligations on three
types of entities: consumer reporting agencies, users of consumer reports, and
furnishers of information to consumer reporting agencies.” Chipka v. Bank of Am.,
355 Fed. Appx. 380, 382 (11th Cir. 2009) (citing 15 U.S.C. §§ 1681b, 1681m, and
1681s–2).
Mr. Burton alleges that MAPCO is a “Consumer Reporting Agency.” (Doc.
20, ¶ 32). MAPCO disagrees. (Doc. 22, p. 6). A “consumer reporting agency” is
any person which, for monetary fees, dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice of
assembling or evaluating consumer credit information or other
information on consumers for the purpose of furnishing consumer
16

reports to third parties, and which uses any means or facility of
interstate commerce for the purpose of preparing or furnishing
consumer reports.
15 U.S.C. § 1681a(f). Mr. Burton argues that he has alleged both intentional and
negligent violations of the FCRA:
Plaintiff has alleged that the Defendants’ (sic) deliberate and reckless
conduct allowed third parties to steal, or otherwise access, the
personal and private information of the Plaintiff without the Plaintiffs’
or Class Members’ consent and for no permissible purpose under
FCRA. Allegations include Defendant’s violation of the FCRA.
Plaintiffs and class members have been damaged by Defendants’ (sic)
deliberate and/or reckless actions. (SAC ¶’s 23-55).
The standards of the FCRA are there to reduce the risk of consumer
frauds and related harms. A criminal attack was possible because of
Mapco’s intentional and negligent violations of the FCRA. The
severity of the attack was increased because MAPCO did not follow
all of the standards of the FCRA.
(Doc. 27, p. 8).
Mr. Burton offers no support for his assertion that the defendants are within
the requirements of FCRA, no support for his assertion that the defendants are a
“consumer reporting agency,” and no support for his assertion that the theft of
credit card information constitutes “furnishing consumer reports” or “disposal” of
consumer information for purposes of violation of the Act. Mr. Burton has not
identified a FCRA “standard” which the defendants purportedly violated.
When faced with a similar pleading, the Southern District of Ohio ruled:
17

Named Plaintiffs’ vague allegation that Defendant violated the
[FCRA] by “failing to adopt and maintain such protective procedures
...,” [], is insufficient to confer statutory standing because it fails to
allege Defendant violated one of the requirements of the subchapter.
In other words, the Complaint does not allege a specific requirement
in the FCRA that Defendant failed to perform or a specific prohibition
that Defendant ignored.
To hold otherwise would confer statutory standing on any plaintiff
who alleges a defendant violated the purpose of a statute regardless of
whether the defendant took or failed to take an action the statute
prohibited or required. The Court cannot find that Congress intended
to confer statutory standing in instances where a plaintiff alleges a
defendant violated a statute in a manner other than as provided by
Congress in the statute. Accordingly, Named Plaintiffs do not have
statutory standing to bring their FCRA claims because they have not
alleged injury arising from the violation of a particular statutory
requirement or prohibition set forth in the FCRA.
Galaria v. Nationwide Mut. Ins. Co., 2014 WL 689703, *4 (S.D.Ohio 2014). As
MAPCO notes, “Burton makes no serious attempt to save his FCRA claims.”
(Doc. 28, p. 1). Therefore, the Court will dismiss Counts I and II of the second
amended complaint.
C. Invasion of Privacy Claims
The tort of invasion of privacy under Alabama law covers a variety of
wrongs. See e.g, Butler v. Town of Argo, 871 So. 2d 1, 12 (Ala. 2003) (citation
omitted).

Mr. Burton alleges that the release of his financial information

constituted an invasion of privacy by public disclosure of private facts. Such a
claim requires at least an allegation of “publicity” – specifically, “making ...
18

public, by communicating it to the public at large, or to so many persons that the
matter must be regarded as substantially certain to become one of public
knowledge.” Ex parte Birmingham News, Inc., 778 So. 2d 814, 818 (Ala. 2000)
(quoting Comments to Restatement (Second) of Torts § 652). Mr. Burton does not
allege that the defendants gave “publicity” to his private information, a required
element of this claim. Mr. Burton offers no legal basis for his claim that a theft of
data from a merchant constitutes communication of the information stolen to the
public. Without such disclosure to the public at large, there is no tort. See e.g.,
McNeil v. Best Buy Co., Inc., 2014 WL 1316935 (E.D. Mo. 2014) (“Plaintiff fails
to identify any personal facts that were publicized, nor does he allege when such
facts were publicized or to whom.... The alleged threat of some future publication
is too speculative to state a claim ... and so Plaintiff’s claim for public disclosure of
private facts must be dismissed.”).
Even if Mr. Burton had alleged facts concerning public disclosure, his
invasion of privacy claim suffers from another fatal flaw. Under Alabama law,
invasion of privacy is an intentional tort. See e.g., Rosen v. Montgomery Surgical
Ctr., 825 So. 2d 735, 737 (Ala. 2001) (quoting Carter v. Innisfree Hotel, Inc., 661
So. 2d 1174, 1178 (Ala.1995) (“This Court defines the tort of invasion of privacy
as the intentional wrongful intrusion into one’s private activities in such a manner
19

as to outrage or cause mental suffering, shame, or humiliation to a person of
ordinary sensibilities.”)). Even if the defendants were negligent, as alleged, in
safeguarding Mr. Burton’s account information, such negligence does not morph
into an intentional act of divulging his confidential information. Mr. Burton has
alleged no plausible facts concerning intentional conduct.
Therefore, the Court will dismiss Count III of the second amended
complaint.
CONCLUSION
For the reasons outlined above, the Court GRANTS IN PART and
DENIES IN PART the defendants’ motion to dismiss. The Court will dismiss
with prejudice Mr. Burton’s Fair Credit Reporting Act claims (Counts I and II) and
Mr. Burton’s invasion of privacy claim (Count III). (Doc. 20). The Court will
permit Burton one final opportunity to amend his complaint to allege his
negligence claim. 8
DONE and ORDERED this September 12, 2014.

_________________________________
MADELINE HUGHES HAIKALA
UNITED STATES DISTRICT JUDGE

8

Due to technical difficulties, this opinion contains two footnotes numbered “2.” The Court deems the second
footnote “2.5”.
20