Whitaker et al v. Health Net of California Inc et al

Filing 61

ORDER signed by Judge Kimberly J. Mueller on 1/19/12 ORDERING, IBM's motion to dismiss is GRANTED insofar as it alleges lack of subject matter jurisdiction, IBM's motion to dismiss is denied as moot insofar as it alleges failure to state a claim, Health Net's motion to dismiss is denied as moot, and this action is dismissed with leave to amend. Plaintiffs may file a second amended complaint within thirty (30) days, taking into account the contents of this order. (Becknal, R)

1
2
3
4
5
6
7
8

IN THE UNITED STATES DISTRICT COURT

9

FOR THE EASTERN DISTRICT OF CALIFORNIA

10

DWIGHT WHITAKER; et al.,
Plaintiffs,

11
vs.

12
13

No. CIV S-11-0910 KJM-DAD

HEALTH NET OF CALIFORNIA, INC.; et al.,

ORDER

Defendants.

14

/

15

This matter comes before the court upon the separate motions to dismiss

16
17

plaintiffs’ amended complaint filed by defendants Health Net of California, Inc. (“Health Net”)

18

and International Business Machines Corporation (“IBM”). The court heard these motions on

19

November 9, 2011; C. Brooks Cutter, Michael Ram, Todd Schneider, Geoffrey Munroe, Tina

20

Wolfson and Robert Buccola appeared for plaintiffs; Ethan Schulman and Steven Wilson

21

appeared for Health Net; and Karin Kramer and Steven Madison appeared for IBM. For the

22

following reasons, IBM’s motion to dismiss is GRANTED insofar as it alleges lack of subject

23

matter jurisdiction, IBM’s motion to dismiss is denied as moot insofar as it alleges failure to

24

state a claim, Health Net’s motion to dismiss is denied as moot, and this action is dismissed

25

without prejudice.

26

/////
1

1

I. FACTS AND PROCEDURAL HISTORY

2

Plaintiffs are all California citizens residing in California. (Am. Compl. ¶¶ 7-16,

3

ECF 32.) Health Net is a California corporation with its principal place of business in Woodland

4

Hills, California; IBM is a New York corporation with its principal place of business in

5

Woodland Hills, California. (Id. ¶¶ 17, 18.) IBM manages Health Net’s information technology

6

infrastructure and had access to Health Net members’ information during the time period at

7

issue. (Id. ¶ 1.) On January 21, 2011, IBM informed Health Net that it had lost nine Health Net

8

server drives consisting of more than 800,000 California residents’ personal and medical

9

information, including plaintiffs’ information. (Id. ¶¶ 1, 4.) Plaintiffs and other Health Net

10

members received a letter from the Chief Operating Officer of Health Net’s parent company in

11

mid-March 2011, informing them that IBM had lost the information. (Id. ¶¶ 21-23.) Three of

12

the nine server drives have since been located; however, the other six, including the four

13

containing plaintiffs’ information, remain missing. (Pl.’s Opp’n to Health Net’s Mot. to Dismiss

14

at 4 n.2, ECF 47.)

15

Plaintiff Dwight Whitaker filed his putative class action complaint on April 5,

16

2011. (ECF 1.) On July 15, 2011, Dwight Whitaker was joined by nine additional plaintiffs in

17

filing the operative amended complaint, alleging three causes of action: 1) violation of the

18

Confidentiality of Medical Information Act (“CMIA”), Cal. Civ. Code § 56, et seq. against

19

Health Net; 2) violation of the CMIA against IBM; and 3) violation of the Customer Records Act

20

(“CRA”), Cal. Civ. Code § 1798.82 against Health Net. (ECF 32.) Plaintiffs seek to represent

21

“[a]ll current or former members of Health Net of California, Inc. who were notified . . . that

22

their health information was included on missing Health Net server drives.” (Id. ¶ 31.)

23

Both Health Net and IBM filed their motions to dismiss in lieu of answers on

24

August 29, 2011. (ECF 34, 38.) Plaintiffs filed their oppositions on September 28, 2011. (ECF

25

47, 48.) Health Net filed its reply on October 13, 2011 (ECF 54) and IBM filed its reply on

26

/////
2

1

October 14, 2011 (ECF 56). IBM filed a notice of supplemental authority on December 13,

2

2011. (ECF 60.)

3

II. ANALYSIS

4

A.

5

Standard
“To demonstrate standing, a plaintiff must (1) have suffered an injury in fact – an

6

invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or

7

imminent, not conjectural or hypothetical; (2) there must be a causal connection between the

8

injury and the conduct complained of – the injury has to be fairly . . . traceable to the challenged

9

action of the defendant, and not . . . the result [of] the independent action of some third party not

10

before the court; and (3) it must be likely, as opposed to merely speculative, that the injury will

11

be redressed by a favorable decision.” Pritikin v. Dep’t of Energy, 254 F.3d 791, 796-97 (9th

12

Cir. 2001) (internal quotations and citations omitted) (alterations in original). “If a plaintiff

13

faces ‘a credible threat of harm,’ and that harm is ‘both real and immediate, not conjectural or

14

hypothetical,’ the plaintiff has met the injury-in-fact requirement for standing under Article III.”

15

Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (citations omitted). “The party

16

asserting federal jurisdiction bears the burden of establishing these requirements at every stage

17

of the litigation . . . .” Id. at 1141. After a defendant moves to dismiss a case under Federal Rule

18

of Civil Procedure 12(b)(1), “[i]t then becomes necessary for the party opposing the motion to

19

present affidavits or any other evidence necessary to satisfy its burden of establishing that the

20

court, in fact, possesses subject matter jurisdiction.” Colwell v. Dep’t of Health & Human Servs.,

21

558 F.3d 1112, 1121 (9th Cir. 2009) (internal quotation marks omitted) (citing St. Clair, 880

22

F.2d at 201). Indeed, if the party moving for dismissal under Rule 12(b)(1) “denies or

23

controverts the pleader’s allegations of jurisdiction, then he is deemed to be challenging the

24

actual existence of subject matter jurisdiction, and the allegations of the complaint are not

25

controlling.” Trentacosta v. Frontier Pac. Aircraft Indus., 813 F.2d 1553, 1559 (9th Cir. 1987)

26

/////
3

1

(citation omitted). At that point, “the nonmoving party [must] present evidence outside his

2

pleadings in opposition to a motion to dismiss for lack of subject matter jurisdiction.” Id.

3

B.

4

Application
IBM moves to dismiss the amended complaint for lack of standing. (IBM’s Mem.

5

P&A in Support of Mot. to Dismiss (“IBM’s Mot.”) at 4, ECF 39.) IBM specifically contends

6

that plaintiffs lack standing because they have not asserted that they suffered any injury. (Id. at

7

14.) Plaintiffs contend they have standing because of the threat posed by the loss of their

8

information. (Pls.’ Opp’n to IBM’s Mot. to Dismiss at 6-7, ECF 48.)

9

Plaintiffs lack standing to proceed with this action. Plaintiffs nowhere allege they

10

have suffered an injury in fact. At the hearing and in their opposition plaintiffs argued they

11

satisfy the standard for standing established by the Ninth Circuit in Krottner v. Starbucks Corp.

12

and Ruiz v. Gap, Inc., No. 09-15971, 380 F. Appx. 689 (9th Cir. May 28, 2010), based on the

13

loss of their data alone; in essence, they say, it naturally follows that they face the threat of harm.

14

Krottner and Ruiz each arose from the theft of information, not its loss. The Krottner court

15

found that the plaintiffs had “alleged a credible threat of real and immediate harm stemming

16

from the theft of a laptop containing their unencrypted personal data.” 628 F.3d at 1143. The

17

Ruiz court similarly found that the plaintiff had standing where he alleged that he was at a great

18

risk of identity theft based on the theft of a laptop computer containing his Social Security

19

Number. 380 Fed. Appx. at 691. Plaintiffs argue there is no difference between theft and loss.

20

Even if that is so, plaintiffs do not explain how the loss here has actually harmed them or

21

threatens to harm them, or that third parties have accessed their data.1 Any harm stemming from

22

their loss thus is precisely the type of conjectural and hypothetical harm that is insufficient to

23

allege standing. See Birdsong v. Apple, Inc., 590 F.3d 955, 961 (9th Cir. 2009) (plaintiffs lacked

24
25
26

1

In their opposition, plaintiffs avoid arguing there is a concrete and particularized threat
of harm and instead only broadly assert that the general “threat posed by lost medical data is in
some ways more severe than stolen personal data.” (ECF 48 at 6.)
4

1

standing where they did not claim they have suffered or were substantially certain to suffer harm

2

but asserted only there was a possibility they could suffer harm). The Ninth Circuit in Krottner

3

provided this scenario as an example of a less credible threat: where “no laptop had been stolen,

4

and Plaintiffs had sued based on the risk that it would be stolen at some point in the future.”

5

Krottner, 628 F.3d at 1143.

6

Recently, in Low v. LinkedIn Corp., the Northern District of California found the

7

named plaintiff lacked standing where the plaintiff failed to allege any present harm and his

8

allegations of possible future harm were “too theoretical to support injury-in-fact for the

9

purposes of Article III standing.” Low v. LinkedIn Corp., No. 11-CV-01468-LHK, 2011 U.S.

10

Dist. LEXIS 130840, at *9 (N.D. Cal. Nov. 11, 2011). The Low plaintiff’s specific allegations

11

were that the defendant essentially disclosed its members’ private information to third parties;

12

however, the plaintiff did not allege what information was actually disclosed to third parties that

13

caused the plaintiff’s alleged harm, that his private information was actually transmitted to any

14

third parties, how third parties would be able to infer his personal identity from the information

15

allegedly transmitted, how the information was transmitted to third parties, and how the

16

defendant actually caused him harm. See id. at *8-9. The court in Low distinguished that case

17

from Krottner as follows: “Low . . . has not yet articulated or alleged a particularized and

18

concrete harm as the plaintiffs did in Krottner . . . . The plaintiffs in Krottner . . . were concerned

19

with the harm that arose from the actual publication or theft of their highly sensitive personal

20

data. Low has not alleged that his credit card number, address, and social security number have

21

been stolen or published or that he is a likely target of identity theft as a result of LinkedIn’s

22

practices. Nor has Low alleged that his sensitive personal information has been exposed to the

23

public.” Id. at *14-15; see also Reilly v. Ceridian Corp., No. 11-1738, 2011 U.S. App. LEXIS

24

24561, at *5 (3d Cir. Dec. 12, 2011) (threatened harm in Krottner imminent and impending

25

where plaintiffs’ names, addresses and social security numbers were stored on a laptop that was

26

/////
5

1

stolen and someone had attempted to open a bank account with a plaintiff’s information

2

following the theft).

3

Here, the only allegation of particularized, real and immediate harm alleged is in

4

paragraph 30 of the amended complaint, in which plaintiffs allege that one of them received a

5

letter informing them their minor daughter’s Social Security Number has been misused. The

6

minor is not a named plaintiff in this action. “‘That a suit may be a class action . . . adds nothing

7

to the question of standing, for even named plaintiffs who represent a class must allege and show

8

that they personally have been injured, not that the injury has been suffered by other,

9

unidentified members of the class to which they belong and which they purport to represent.’”

10

Lewis v. Casey, 518 U.S. 343, 357 (1996) (quoting Simon v. Eastern Ky. Welfare Rights Org.,

11

426 U.S. 26, 40 n.20 (1976) (internal quotation omitted)); see also Blum v. Yaretsky, 457 U.S.

12

991, 999 (1982) (“It is axiomatic that the judicial power conferred by Art. III may not be

13

exercised unless the plaintiff shows that he personally has suffered some actual or threatened

14

injury as a result of the putatively illegal conduct of the defendant. [internal citation] It is not

15

enough that the conduct of which the plaintiff complains will injure someone. The complaining

16

party must also show that he is within the class of persons who will be concretely affected.”); see

17

also Low, 2011 U.S. Dist. LEXIS 130840, at *7 (quoting Lierboe v. State Farm Mut. Auto Ins.

18

Co., 350 F.3d 1018, 1022 (9th Cir. 2003) (“‘[I]f none of the named plaintiffs purporting to

19

represent a class establishes the requisite of a case or controversy with the defendants, none may

20

seek relief on behalf of himself or any other member of the class.’”)).

21

Here, the threat plaintiffs allege is wholly conjectural and hypothetical; plaintiffs

22

lack standing to bring these claims.

23

III. CONCLUSION

24

For the foregoing reasons, IBM’s motion to dismiss is GRANTED insofar as it

25

alleges lack of subject matter jurisdiction, IBM’s motion to dismiss is denied as moot insofar as

26

it alleges failure to state a claim, Health Net’s motion to dismiss is denied as moot, and this
6

1

action is dismissed with leave to amend. Plaintiffs may file a second amended complaint within

2

thirty (30) days, taking into account the contents of this order.

3
4

IT IS SO ORDERED.
DATED: January 19, 2012.

5
6

UNITED STATES DISTRICT JUDGE

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
7