In Re FACEBOOK INTERNET TRACKING LITIGATION

Filing 130

STATEMENT OF RECENT DECISION pursuant to Civil Local Rule 7-3.d by Perrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery REQUEST FOR LEAVE to provide Anthem II as supplemental authority for the Courts consideration when deciding the Motion. (Attachments: #1 Exhibit A)(Straite, David) (Filed on 6/3/2016) Modified text on 6/3/2016,(incorrect event selected.) (cv, COURT STAFF).

Exhibit A

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION

9
10

Case No. 15-MD-02617-LHK

United States District Court
Northern District of California

11
12
IN RE ANTHEM, INC. DATA BREACH
LITIGATION

13
14
15
16

ORDER GRANTING IN PART AND
DENYING IN PART ANTHEM
DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND
DENYING IN PART NON-ANTHEM
DEFENDANTS’ SECOND MOTION TO
DISMISS, AND DENYING MOTION
FOR CLARIFICATION
[PUBLIC VERSION]
Re: Dkt. No. 483, 490, 496

17
Plaintiffs1 bring this putative class action against Anthem, Inc., 27 Anthem affiliates,2 Blue

18
19
20
21
22
23
24
25
26
27
28

1

All named Plaintiffs are identified in paragraphs 12 through 112 of the Second Consolidated
Amended Complaint. See ECF No. 473-3 (“SAC”) ¶¶ 12–112.
2
The Anthem affiliates are: Blue Cross and Blue Shield of Georgia; Blue Cross Blue Shield
Healthcare Plan of Georgia; Anthem Blue Cross and Blue Shield of Indiana; Anthem Blue Cross
of California; Anthem Blue Cross Life and Health Insurance Company; Anthem Blue Cross and
Blue Shield of Colorado and Anthem Blue Cross and Blue Shield of Nevada; Anthem Blue Cross
and Blue Shield of Connecticut; Anthem Blue Cross and Blue Shield of Kentucky; Anthem Blue
Cross and Blue Shield of Maine; Anthem Blue Cross and Blue Shield of Missouri (HMO
Missouri, Inc., RightChoice Managed Care, Inc. & Healthy Alliance Life Insurance Company);
Anthem Blue Cross and Blue Shield of New Hampshire; Empire Blue Cross and Blue Shield;
Anthem Blue Cross and Blue Shield of Ohio; Anthem Blue Cross and Blue Shield of Virginia
(Anthem Health Plans of Virginia & HMO HealthKeepers); Anthem Blue Cross and Blue Shield
of Wisconsin (Blue Cross Blue Shield of Wisconsin & Compcare Health Services Insurance
Corporation); Amerigroup Services; HealthLink; Unicare Life & Health Insurance Company;
CareMore Health Plan; the Anthem Companies; the Anthem Companies of California;
1
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Cross Blue Shield Association, and 14 non-Anthem Blue Cross Blue Shield Companies.3 The

2

Court refers to Anthem, Inc. and the Anthem affiliates as the “Anthem Defendants,” and Blue

3

Cross Blue Shield Association and the non-Anthem Blue Cross Blue Shield Companies as the

4

“Non-Anthem Defendants.” The Court refers to the Anthem and Non-Anthem Defendants

5

collectively as “Defendants.” The Court refers to Plaintiffs generally as “Plaintiffs,” unless

6

referring to Plaintiffs from a specific jurisdiction, such as California Plaintiffs or New York

7

Plaintiffs.

8

The Anthem Defendants filed one consolidated motion to dismiss the second consolidated

9

amended complaint (“SAC”). See ECF No. 473-3 (“SAC”); ECF No. 496 (“Anthem Mot.”). The
Non-Anthem Defendants also filed one consolidated motion to dismiss the SAC. ECF No. 490

11
United States District Court
Northern District of California

10

(“Non-Anthem Mot.”). The Non-Anthem Defendants have also filed a motion for clarification of

12

the Court’s First Motion to Dismiss Order. ECF No. 483. Having considered the parties’

13

submissions, the relevant law, and the record in this case, the Court GRANTS in part and DENIES

14

in part the Anthem Defendants’ motion to dismiss; GRANTS in part and DENIES in part the Non-

15

Anthem Defendants’ motion to dismiss; and DENIES the Non-Anthem Defendants’ motion for

16

clarification.

17

I.

18
19

BACKGROUND
A. Factual Background
Anthem, Inc. (“Anthem”) is one of the largest health benefits and health insurance

20

companies in the United States. SAC ¶ 158. Anthem serves its members through various Blue

21

Cross Blue Shield (“BCBS”) licensee affiliates and other non-BCBS affiliates. Id. Anthem also

22
23
24
25
26
27
28

Amerigroup Corporation; and the Amerigroup Kansas, Inc.
3
The non-Anthem BCBS Companies are: Blue Cross and Blue Shield of Alabama; Arkansas Blue
Cross and Blue Shield; Blue Shield of California; Blue Cross and Blue Shield of Illinois; Blue
Cross and Blue Shield of Florida; CareFirst BlueCross BlueShield; Blue Cross and Blue Shield of
Massachusetts; Blue Cross and Blue Shield of Michigan; Blue Cross and Blue Shield of
Minnesota; Horizon Blue Cross and Blue Shield of New Jersey; Blue Cross and Blue Shield of
North Carolina; Highmark Blue Shield; Blue Cross and Blue Shield of Texas; and Blue Cross and
Blue Shield of Vermont.
2
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

cooperates with the Blue Cross Blue Shield Association (“BCBSA”) and independent BCBS

2

licensees via the BlueCard program. Id. ¶ 159. “Under the BlueCard program, members of one

3

BCBS licensee may access another BCBS licensee’s provider networks and discounts when the

4

members are out of state.” Id.

5

In order to provide certain member services, the Anthem and Non-Anthem Defendants

6

“collect, receive, and access their customers’ and members’ extensive individually identifiable

7

health record information.” Id. ¶ 160. “These records include personal information (such as

8

names, dates of birth, Social Security numbers, health care ID numbers, home addresses, email

9

addresses, and employment information, including income data) and individually-identifiable
health information (pertaining to the individual claims process, medical history, diagnosis codes,

11
United States District Court
Northern District of California

10

payment and billing records, test records, dates of service, and all other health information that an

12

insurance company has or needs to have to process claims).” Id. The Court shall refer to

13

members’ personal and health information as Personal Identification Information, or “PII.”

14

Anthem maintains a common computer database which contains the PII of current and

15

former members of Anthem, Anthem’s affiliates, BCBSA, and independent BCBS licensees. Id. ¶

16

161. This database contains “information from former customers or members going back to

17

2004.” Id. ¶ 162. In total, Anthem’s database contains the PII of approximately 80 million

18

individuals. Id. ¶ 338. According to Plaintiffs, both the Anthem and Non-Anthem Defendants

19

promised their members that their PII would be protected through privacy notices, online website

20

representations, and other advertising. Plaintiffs aver, for instance, that all Defendants were

21

subject to Anthem’s privacy policy, which states the following:

22
23
24
25

Anthem Blue Cross and Blue Shield maintains policies that protect the
confidentiality of personal information, including Social Security numbers,
obtained from its members and associates in the course of its regular business
functions. Anthem Blue Cross and Blue Shield is committed to protecting
information about its customers and associates, especially the confidential nature
of their personal information.

26
27
28

3
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2
3

***
Anthem Blue Cross and Blue Shield has in place a minimum necessary policy
which states that associates may only access, use or disclose Social Security
numbers or personal information to complete a specific task and as allowed by
law.

4
5
6
7
8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

Anthem Blue Cross and Blue Shield safeguards Social Security numbers and
other personal information by having physical, technical, and administrative
safeguards in place.
Id. ¶ 165 (emphasis removed). Many Anthem-affiliated websites further refer to Defendants’
privacy obligations under the Health Insurance Portability and Accountability Act (“HIPAA”) as
well as other federal and state privacy laws. Id.
In February 2015, Anthem publicly announced that “cyberattackers had breached the
Anthem Database, and [had] accessed [the PII of] individuals in the Anthem Database.” Id. ¶ 337.
This was not the first time that Anthem had experienced problems with data security. In late 2009,
approximately 600,000 customers of Wellpoint (Anthem’s former trade name) “had their personal
information and protected healthcare information compromised due to a data breach.” Id. ¶ 328.
In addition, in 2013, the U.S. Department of Health and Human Services fined Anthem $1.7
million for various HIPAA violations relating to data security. Id. ¶ 329. Finally, in 2014, the
federal government informed Anthem and other healthcare companies of the possibility of
cyberattacks, and advised these companies to take appropriate measures, such as data encryption
and enhanced password protection. Id. ¶¶ 334–35.
Plaintiffs allege that Defendants did not sufficiently heed these warnings, which allowed
cyberattackers to extract massive amounts of data from Anthem’s database between December
2014 and January 2015. Id. ¶ 360. After Anthem discovered the extent of this data breach, it
proceeded to implement various containment measures. Id. ¶ 365–66 . The cyberattacks ceased
by January 31, 2015. Id. In addition, after learning of the cyberattacks, Anthem retained
Mandiant, a cybersecurity company, “to assist in assessing and responding to the Anthem Data
Breach and to assist in developing security protocols for Anthem.” Id. ¶ 341. Mandiant’s work
4
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

culminated in the production of an Intrusion Investigation Report (“Mandiant Report”), which

2

Mandiant provided to Anthem in July 2015. Id.

3

According to Plaintiffs, the Mandiant Report found that “Anthem and [its] Affiliates

4

[had] failed to implement basic industry-accepted data security tools to prevent cyberattackers

5

from accessing the Anthem Database.” Id. ¶ 343. Moreover, “[e]ven if the cyberattackers gained

6

access to the Anthem Database, Anthem could have and should have, but failed to, discover the

7

data breach before any data was exfiltrated.” Id. ¶ 345.

8
9

Additionally, “BCBSA and [the] non-Anthem BCBS [companies] allowed the [PII] that
their current and former customers and members had entrusted with them to be placed into the
Anthem Database even though there were multiple public indications and warnings that the

11
United States District Court
Northern District of California

10

Anthem and Anthem Affiliates’ computer systems and data security practices were inadequate.”

12

Id. ¶ 377. Plaintiffs further aver that although Anthem publicly disclosed the data breach in

13

February 2015, many affected customers were not personally informed until March 2015. Finally,

14

Plaintiffs contend that Anthem still has not disclosed whether it has made any changes to its

15

security practices to prevent a future cyberattack.

16
17

B. Procedural History
A number of lawsuits were filed against Defendants in the wake of the Anthem data

18

breach. In general, these lawsuits bring putative class action claims alleging (1) failure to

19

adequately protect Anthem’s data systems, (2) failure to disclose to customers that Anthem did not

20

have adequate security practices, and (3) failure to timely notify customers of the data breach.

21

In spring 2015, Plaintiffs in several lawsuits moved to centralize pretrial proceedings in a

22

single judicial district. See 28 U.S.C. § 1407(a) (“When civil actions involving one or more

23

common questions of fact are pending in different districts, such actions may be transferred to any

24

district for coordinated or consolidated pretrial proceedings.”). On June 12, 2015, the Judicial

25

Panel on Multidistrict Litigation (“JPML”) issued a transfer order selecting the undersigned judge

26

as the transferee court for “coordinated or consolidated pretrial proceedings” in the multidistrict

27
28

5
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

litigation (“MDL”) arising out of the Anthem data breach. See ECF No. 1 at 1–3.4

2

On September 10, 2015, the Court held a hearing to appoint Lead Plaintiffs counsel.

3

Following this hearing, the Court issued an order appointing Co-Lead Plaintiffs counsel and

4

requesting that counsel file a single consolidated amended complaint by October 19, 2015. ECF

5

No. 284 at 2. On October 19, 2015, Plaintiffs filed their consolidated amended complaint, which

6

organized Plaintiffs’ causes of action into thirteen different counts, with claims asserted pursuant

7

to various state and federal laws under each count. ECF No. 334-6 (“CAC”).

8

At the October 25, 2015 case management conference, the Court determined that the

9

Anthem and Non-Anthem Defendants would file separate motions to dismiss. Both motions
would be “limited to a combined total of 10 claims, with 5 claims selected by Plaintiffs, 3 claims

11
United States District Court
Northern District of California

10

selected by the Anthem Defendants, and 2 claims selected by the [Non-Anthem Defendants].”

12

ECF No. 326 at 2–3. At the November 10, 2015 case management conference, the parties

13

identified the 10 claims that would be addressed in Defendants’ motions to dismiss.
On November 23, 2015, the Anthem Defendants and Non-Anthem Defendants filed their

14
15

first round motions to dismiss. On February 14, 2016, the Court granted in part and denied in part

16

the first round motions to dismiss. ECF No. 468 (“First MTD Order.”). Specifically, the Court

17

granted with prejudice Defendants’ motions to dismiss Plaintiffs’ Indiana negligence, Kentucky

18

Consumer Protection Act, and Kentucky Data Breach Act claims. Id. at 81. The Court granted

19

with leave to amend Defendants’ motions to dismiss Plaintiffs’ California breach of contract, New

20

Jersey breach of contract, New York unjust enrichment, and Georgia Information and Privacy

21

Protection Act claims. Id. The Court denied Defendants’ motions to dismiss Plaintiffs’ California

22

Unfair Competition Law, New York General Business Law § 349, and federal law third party

23

beneficiary claims. Id. The Court also addressed standing and ERISA preemption in the First

24

Motion to Dismiss Order.

25
26
27
28

4

As of May 19, 2016, this MDL is comprised of 127 individual cases. ECF No. 514-1 at 5.
6

Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

In accordance with the Court’s First Motion to Dismiss Order, Plaintiffs filed the SAC on

1
2

March 11, 2016. The Anthem and Non-Anthem Defendants filed their second round motions to

3

dismiss on April 5, 2016. Plaintiffs filed their oppositions on April 26, 2016, and the Anthem

4

Defendants and Non-Anthem Defendants filed their replies on May 10, 2016. ECF No. 508

5

(“Anthem Opp’n”); ECF No. 507 (“Non-Anthem Opp’n”); ECF No. 511 (“Anthem Reply”); ECF

6

No. 512 (“Non-Anthem Reply”). In addition, on March 28, 2016, the Non-Anthem Defendants

7

filed a motion for clarification regarding the First Motion to Dismiss Order. ECF No. 483.

8

Plaintiffs filed a response on March 31, 2016, ECF No. 486, and the Non-Anthem Defendants

9

filed a reply on April 4, 2016, ECF No. 488.

10

United States District Court
Northern District of California

11
12

II.

LEGAL STANDARD
A. Motion to Dismiss
Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss an

13

action for failure to allege “enough facts to state a claim to relief that is plausible on its face.” Bell

14

Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the

15

plaintiff pleads factual content that allows the court to draw the reasonable inference that the

16

defendant is liable for the misconduct alleged. The plausibility standard is not akin to a

17

‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted

18

unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal citations omitted). For

19

purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s] factual allegations in the

20

complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving

21

party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).

22

Nonetheless, the Court is not required to “‘assume the truth of legal conclusions merely

23

because they are cast in the form of factual allegations.’” Fayer v. Vaughn, 649 F.3d 1061, 1064

24

(9th Cir. 2011) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere

25

“conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to

26

dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Iqbal, 556 U.S. at 678.

27
28

7
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Furthermore, “‘a plaintiff may plead [him]self out of court’” if he “plead[s] facts which establish

2

that he cannot prevail on his . . . claim.” Weisbuch v. Cnty. of L.A., 119 F.3d 778, 783 n.1 (9th Cir.

3

1997) (quoting Warzon v. Drew, 60 F.3d 1234, 1239 (7th Cir. 1995)).
For purposes of motions to dismiss, as with virtually all motions touching upon substantive

4
5

legal matters, the general rule “is that the MDL transferee court is generally bound by the same

6

substantive legal standards, if not always the same interpretation of them, as would have applied in

7

the transferor court.” In re Korean Air Lines Co., Ltd., 642 F.3d 685, 699 (9th Cir. 2011).

8

B. Leave to Amend

9

Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely
granted when justice so requires,” bearing in mind “the underlying purpose of Rule 15 to facilitate

11
United States District Court
Northern District of California

10

decision on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d

12

1122, 1127 (9th Cir. 2000) (en banc) (ellipses omitted). Generally, leave to amend shall be denied

13

only if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be

14

futile, or if the moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512

15

F.3d 522, 532 (9th Cir. 2008).

16

III.

17

DISCUSSION
A. Standing and Discovery

18

Before addressing the specific claims at issue, the Court examines the Non-Anthem

19

Defendants’ arguments regarding standing. These arguments also relate to the issues raised in the

20

Non-Anthem Defendants’ motion for clarification.

21

In the First Motion to Dismiss Order, the Court observed that there were ten Non-Anthem

22

Defendants against whom the CAC “fails to allege any specific facts” regarding the selected

23

claims at issue. First MTD Order at 8. Those Non-Anthem Defendants were: Blue Cross and

24

Blue Shield of Alabama; Blue Cross and Blue Shield of Arizona, Inc.; CareFirst of Maryland, Inc.;

25

Blue Cross and Blue Shield of Michigan; Blue Cross and Blue Shield of North Carolina, Inc.;

26

Highmark Health Services; Highmark West Virginia, Inc.; BlueCross BlueShield of Tennessee,

27
28

8
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Inc.; Blue Cross and Blue Shield of Vermont; and Blue Cross and Blue Shield of Illinois. Because

2

no factual allegations were made against these Non-Anthem Defendants as to the selected claims,

3

the Court dismissed the selected claims against these Non-Anthem Defendants on standing

4

grounds.

5

In reaching this decision, the Court found instructive the reasoning in In re Carrier IQ, 78

6

F. Supp. 3d 1051 (N.D. Cal. 2015), where the district court, after examining U.S. Supreme Court

7

precedent in Amchem Products, Inc. v. Windsor, 521 U.S. 591 (1997), and Ortiz v. Fibreboard

8

Corp., 527 U.S. 815 (1999), concluded that courts have discretion on when to address standing in

9

a nationwide class action—whether at the outset of litigation or at class certification. In exercising
such discretion, a court should consider factors such as the cost and burden of discovery, the

11
United States District Court
Northern District of California

10

breadth of the proposed class, and whether a named plaintiff’s claim is typical of individuals

12

whose claims arise under the laws of other states. First MTD Order at 10.

13

With these factors in mind, the Court expressed concern that some Non-Anthem

14

Defendants would remain in this case even though Plaintiffs might not, as a matter of law, be able

15

to pursue the selected claims against these Defendants. There were, for instance, no allegations in

16

the CAC to suggest that any Blue Cross and Blue Shield of Illinois customers resided in California

17

or New York. As such, it would make little sense to ask Blue Cross and Blue Shield of Illinois to

18

defend itself against Plaintiffs’ California Unfair Competition Law or New York General Business

19

Law § 349 claims.

20

The Court went on to distinguish the posture of this case from that in In re Target Corp.

21

Data Security Breach Litigation, 66 F. Supp. 3d 1154 (D. Minn. 2014). In In re Target, there

22

were “114 named Plaintiffs who reside[d] in every state in the union save four and the District of

23

Columbia.” Id. at 1160. “As Target undoubtedly knows, there are consumers in Delaware,

24

Maine, Rhode Island, Wyoming, and the District of Columbia whose personal financial

25

information was stolen in [a] 2013 [data] breach.” Id. “To force [p]laintiffs’ attorneys to search

26

out those individuals at [the motion to dismiss] stage serves no useful purpose.” Id. Here, on the

27
28

9
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

other hand, there was no indication from the CAC that Plaintiffs would be able to find an

2

individual to plead specific facts concerning the selected claims against ten Non-Anthem

3

Defendants.

4

The Non-Anthem Defendants’ first motion to dismiss was, however, granted with leave to

5

amend. In the second round motion to dismiss, the Non-Anthem Defendants once again argue for

6

dismissal of the selected claims against ten Non-Anthem Defendants. The list of Defendants has

7

changed somewhat since the Court’s First Motion to Dismiss Order. These changes reflect the

8

fact that Plaintiffs omitted three Non-Anthem Defendants from the SAC and that Non-Anthem

9

Defendants identified three additional Non-Anthem Defendants in the SAC against whom the
named Plaintiffs make no specific factual allegations as to the selected claims. Non-Anthem Mot.

11
United States District Court
Northern District of California

10

at 2–3 n.2. The updated list of ten Non-Anthem Defendants is: Blue Cross and Blue Shield of

12

Alabama; CareFirst of Maryland, Inc.; Blue Cross and Blue Shield of Michigan; Blue Cross and

13

Blue Shield of North Carolina, Inc.; Highmark Health Services; Blue Cross and Blue Shield of

14

Vermont; Blue Cross Blue Shield of Massachusetts; Arkansas Blue Cross and Blue Shield; Blue

15

Cross and Blue Shield of Minnesota; and Blue Cross and Blue Shield of Illinois. In addition, Non-

16

Anthem Defendants also request that the Court “dismiss every non-selected claim against every . .

17

. Defendant to the extent the named Plaintiff(s) asserting the claim does not allege he or she was

18

insured by . . . th[at] . . . Defendant.” Id. at 4 (emphasis removed). The Court addresses these

19

arguments in turn.

20

1. Selected Claims

21

The easiest way for Plaintiffs to have avoided dismissal would have been to find a named

22

Plaintiff to assert one of the seven remaining selected claims against the ten Non-Anthem

23

Defendants at issue. Plaintiffs have not done so. Instead of identifying new named Plaintiffs,

24

however, the SAC includes enrollment data on each Non-Anthem Defendant. This data “set[]

25

forth the number of residents of each state that were . . . enrolled” in “a health insurance of health

26

benefits plan” by each Non-Anthem Defendant. SAC ¶¶ 242–55. From the Court’s review of this

27
28

10
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

data, it appears that every Non-Anthem Defendant at issue enrolled residents from nearly every

2

state.5
The Court finds that this alternative method also addresses the Court’s concerns regarding

3

standing. Indeed, there was previously no indication that Blue Cross and Blue Shield of Illinois

5

enrolled any California or New York residents. Now, however, the SAC states that 208,945

6

California residents and 82,404 New York residents were enrolled in a Blue Cross and Blue Shield

7

of Illinois plan. Taken together, the number of California and New York residents enrolled in a

8

Blue Cross and Blue Shield of Illinois plan (291,349) actually exceeds the number of Illinois

9

residents enrolled in a Blue Cross and Blue Shield of Illinois plan (265,801). Id. ¶ 245. Thus,

10

208,945 individuals could bring a California Unfair Competition Law claim against Blue Cross

11
United States District Court
Northern District of California

4

and Blue Shield of Illinois, and 82,404 individuals could bring a New York General Business Law

12

§ 349 claim against Blue Cross and Blue Shield of Illinois.
Under such circumstances, Plaintiffs’ allegations are now more analogous to the facts in In

13
14

re Target. As in In re Target, the SAC shows that every Non-Anthem Defendant provided health

15

insurance or health benefits services to residents of nearly every state. The Court’s concerns

16

regarding whether any individuals could assert the selected claims against certain Defendants have

17

thus been sufficiently addressed. At this point in the litigation, “forc[ing] Plaintiffs’ [counsel] to

18

search out . . . individuals [to add as named Plaintiffs] at this stage serves no useful purpose.” In

19

re Target, 66 F. Supp. 3d at 1160. Moreover, dismissing the selected claims against the ten

20

Defendants at issue could prematurely preclude many individuals—such as the 208,945 Blue

21

Cross and Blue Shield of Illinois enrollees in California—from pursuing viable claims.
Accordingly, the Court, in its discretion, declines to dismiss the selected claims against the

22
23

ten Non-Anthem Defendants at issue. The Non-Anthem Defendants’ motion to dismiss on

24
25
26
27
28

5

There are exceptions. Blue Cross and Blue Shield of Vermont, for example, did not enroll any
Delaware, Hawaii, or North Dakota residents. SAC ¶ 255. The selected claims, however, do not
concern laws from these states.
11
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

standing grounds is therefore DENIED.
The Court cautions that today’s decision is not meant to give Plaintiffs a free pass on

2
3

standing. Although standing questions may be deferred until class certification in cases like this,

4

“[t]he question of standing is not subject to waiver.” United States v. Hays, 515 U.S. 737, 742

5

(1995). “This is no less true with respect to class actions than with respect to other suits.” Lewis

6

v. Casey, 518 U.S. 343, 357 (1996). “That a suit may be a class action adds nothing to the

7

question of standing,” id. (ellipses omitted), and if standing concerns remain at class certification,

8

the Non-Anthem Defendants are invited to re-raise them before this Court.
2. Non-Selected Claims

9

For substantially similar reasons, the Non-Anthem Defendants’ request to dismiss the non-

10

United States District Court
Northern District of California

11

selected claims against every Non-Anthem Defendant is also DENIED. As outlined above,

12

Plaintiffs have presented sufficient allegations to establish that every Non-Anthem Defendant

13

offered health insurance or health benefits services to residents of every state.

14

3. Motion for Clarification

15

Finally, the above analysis also answers the Non-Anthem Defendants’ motion for

16

clarification. The gist of this motion is that, based on the First Motion to Dismiss Order, ten Non-

17

Anthem “Defendants should be relieved of the burden of discovery until resolution of the selected

18

claims.” ECF No. 483 at 3. As dismissal of the selected claims against these ten Non-Anthem

19

Defendants on the basis of standing is unwarranted, the Non-Anthem Defendants’ request for a

20

pause in discovery against these ten Non-Anthem Defendants is also DENIED.
B. California Breach of Contract (against Anthem Defendants)6

21
22

“Under California law, to state a claim for breach of contract a plaintiff must plead [1] the

23

contract, [2] plaintiffs’ performance (or excuse for nonperformance), [3] defendant’s breach, and

24
25
26
27
28

6

Defendants also assert that ERISA preemption applies to some (but not all) of the named
Plaintiffs as to their California breach of contract, New York unjust enrichment, California Unfair
Competition Law, and New York General Business Law § 349 claims. All ERISA preemption
arguments are addressed at Section III.I.
12
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

[4] damage to plaintiff therefrom.” Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1028 (N.D. Cal.

2

2012) (internal quotation marks omitted). Here, California Plaintiffs allege that “Plaintiffs and

3

Class Members . . . entered into contracts with Anthem and its Affiliates that incorporated, either

4

by express provision or attachment, or incorporation by reference, Anthem’s . . . privacy policies

5

pertaining to personal and health-related information.” SAC ¶ 458. California Plaintiffs further

6

contend that, by allowing cyberattackers to access the Anthem Database, the Anthem Defendants

7

breached these contractual obligations. In moving to dismiss, the Anthem Defendants assert that

8

the SAC “fails to identify [the] contractual provisions that were breached” and “fails to show that

9

any breach caused contractual damages.” Anthem Mot. at 6, 11.

10

There are three specific types of contracts at issue, with each type operating somewhat

United States District Court
Northern District of California

11

differently. First, “many Plaintiffs . . . purchased individual insurance or health benefits policies

12

[directly] from Anthem and its Affiliates.” SAC ¶ 191. These individuals “entered into contracts

13

with Anthem and its Affiliates when they applied and paid for insurance and Anthem issued them

14

a policy.” Id. The Court refers to such contracts as “individual plan” contracts.

15

Second, some Plaintiffs entered into “group insurance policies” where Anthem “act[ed] as

16

the insurer of risk.” Id. ¶ 214. Under such contracts, a group—usually an employer—purchases

17

insurance from a regulated insurance company. “Typically, the employer pays a per-employee

18

premium to an insurance company, and the insurance company assumes the risk of providing

19

health coverage for insured events.” Mich. Catholic Conf. and Catholic Family Servs. v. Burwell,

20

807 F.3d 738, 742 (6th Cir. 2015) (internal quotation marks omitted). Similar to individual plan

21

contracts, under these group insurance policies, the Anthem Defendants act as the insurer and bear

22

any risks associated with insurance coverage. The Court refers to these plans as “fully-insured

23

group plan” contracts.

24

Third, many Plaintiffs were part of self-insured group plans. SAC ¶ 214. Under such

25

plans, the group “contract[s] with an insurance company . . . to administer the plan, but the [group]

26

bears the risk associated with offering health benefits.” Mich. Catholic Conf., 807 F.3d at 743.

27
28

13
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Unlike an individual plan or a fully-insured group plan, the Anthem Defendants act under these

2

contracts as an administrator rather than as an insurer. The Anthem Defendants do not bear the

3

risks associated with insurance coverage. The Court refers to these contracts as “administrative

4

services only” agreements or “ASO” agreements.
The SAC identifies eleven California Plaintiffs, eight of whom assert a breach of contract

5
6

claim against the Anthem Defendants. SAC ¶¶ 15–23. The remaining California Plaintiffs are

7

covered by a Non-Anthem Defendant. The situation of the eight California Plaintiffs asserting a

8

California breach of contract claim against an Anthem Defendant is documented below.

9
Name

Insurer/Administrator

Contract Type

11

Michael Bronzo

Individual Plan

12

Kenneth Solomon

13

Mary Ella Carter

Anthem Blue Cross of
California
Anthem Blue Cross Life and
Health Insurance Company
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California

United States District Court
Northern District of California

10

14

Kenneth Coonce

15
Daniel Randrup
16
17

Steve Kawai

18

Daniel Tharp

19

Kelly Tharp

20

Individual Plan
Fully-Insured Group Plan
Fully-Insured Group Plan
ASO Agreement
ASO Agreement
ASO Agreement
ASO Agreement

Because the legal architecture behind individual and fully-insured group plans (where the
21
Anthem Defendants act as the insurer) differs from the legal architecture behind ASO agreements
22
(where the Anthem Defendants act as the administrator), the Court addresses the Anthem
23

Defendants’ arguments regarding these plans separately.

24
1. Individual and Fully-Insured Group Plans
25
For California Plaintiffs covered by an individual or fully-insured group plan, the Anthem
26
27
28

14
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Defendants contend that, although “[t]he SAC asserts that various privacy notices and policies

2

became enforceable provisions of Plaintiffs’ health plan contracts,” the SAC “fails to allege facts

3

to support th[is] assertion.” Anthem Mot. at 6. California Plaintiffs, in response, assert that these

4

privacy provisions were part of their underlying contracts via incorporation by reference or

5

through express attachment.

6
7

a. Incorporation by Reference
As to incorporation by reference, California law provides that “[a] contract may validly

8

include the provisions of a document not physically a part of the basic contract.” Shaw v. Regents

9

of Univ. of Cal., 67 Cal. Rptr. 2d 850, 856 (Ct. App. 1997). “It is, of course, the law that the
parties may incorporate by reference into their contract the terms of some other document.” Id.

11
United States District Court
Northern District of California

10

“For the terms of another document to be incorporated into the document executed by the parties

12

[1] the reference must be clear and unequivocal, [2] the reference must be called to the attention of

13

the other party and he must consent thereto, and [3] the terms of the incorporated document must

14

be known or easily available to the contracting parties.” Id. “The contract need not recite that it

15

incorporates another document, so long as it guides the reader to the incorporated document.” Id.

16

(internal quotation marks and alteration omitted).

17

With these principles in mind, the California Court of Appeal determined, in Shaw v.

18

Regents of the University of California, that a college professor’s contract had incorporated by

19

reference the university’s patent policy. Id. at 852. As the court explained, “when [plaintiff]

20

signed the agreement, the parties intended it to incorporate the [University’s] Patent Policy.” Id. at

21

856. Specifically, “[plaintiff’s contract] (1) direct[ed] [plaintiff] to ‘Please read the Patent Policy .

22

. . ,’ and (2) state[d] that, in signing the patent agreement, [plaintiff was] ‘not waiving any rights to

23

a percentage of royalty payments received by University, as set forth in [the] University Policy

24

Regarding Patents.’” Id. (emphasis removed).

25
26
27
28

Following Shaw, the California Court of Appeal also determined that an arbitration clause
was sufficiently incorporated by reference in Wolschlager v. Fidelity National Title Insurance
15
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Company, 4 Cal. Rptr. 3d 179 (Ct. App. 2003). In Wolschlager, plaintiff received a preliminary

2

report from defendant, a title insurance company. Id. at 181. This report did not state that the

3

insurance policy was subject to an arbitration clause; indeed, the report did not even mention an

4

arbitration clause. Instead, the report included two sentences which stated that “[Complete]

5

[c]opies of the [entire insurance] policy . . . should be read. They are available from the office

6

which issued this Report.” Id. at 181–82. The full policy, which plaintiff later received after

7

agreeing to purchase insurance from defendant, contained an arbitration clause. Id. at 182.

8
9

The Wolschlager court acknowledged that defendant, by moving to enforce the arbitration
clause, sought to incorporate by reference “documents which were not attached” and “not
presented” to plaintiff “at the time” that plaintiff reviewed the preliminary report and signed the

11
United States District Court
Northern District of California

10

underlying contract. Id. Indeed, “[t]here was no substantive dispute that plaintiff did not actually

12

know about the arbitration clause.” Id. at 185. Nonetheless, the California Court of Appeal found

13

in defendant’s favor, with the court noting that “the Preliminary Report specifically identifies the

14

document incorporated as the policy, lists the form which is contemplated and tells the recipient

15

where they can find the policy.” Id. at 184–85. “This incorporation was both clear and

16

unequivocal.” Id. at 185. Moreover, “even if plaintiff did not know about the arbitration clause,

17

the [p]olicy with the clause was easily available to him. The preliminary report identified the

18

[p]olicy by name and directed . . . plaintiff to where he could inspect it.” Id. “Nothing further,”

19

the California Court of Appeal observed, “was needed.” Id.

20

Under Shaw and Wolschlager, the contracts entered into by Michael Bronzo (“Bronzo”),

21

Kenneth Solomon (“Solomon”), Mary Ella Carter (“Carter”), and Kenneth Coonce (“Coonce”)

22

sufficiently incorporate by reference the Anthem Defendants’ promises to protect individual

23

privacy. First, on whether the references were clear and unequivocal, Shaw, 67 Cal. Rptr. at 856,

24

each contract includes several specific references to Anthem’s privacy policies. Bronzo’s

25

contract, for instance, states that “You have the right to receive a copy of the Notice of Privacy

26

Practices. You may obtain a copy by calling our customer service department . . . or by accessing

27
28

16
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

our website.” ECF No. 473-5 at 28. At another point, Bronzo’s contract provides that Anthem’s

2

right to “receive from any Provider of service information about You” is “subject to all applicable

3

confidentiality requirements.” Id. at 29. Further, the next paragraph reads, in all caps, that “A

4

STATEMENT DESCRIBING OUR POLICIES AND PROCEDURES FOR PRESERVING THE

5

CONFIDENTIALITY OF MEDICAL RECORDS IS AVAILABLE AND WILL BE

6

FURNISHED TO YOU UPON REQUEST.” Id. The paragraph concludes by advising Bronzo to

7

contact Anthem’s customer service department for “a copy of our policies and procedures for

8

preserving Your medical record confidentiality.” Id. Thus, the Anthem Defendants, on multiple

9

instances, made clear and unequivocal references to Anthem’s privacy policies in Bronzo’s

10

United States District Court
Northern District of California

11

contract.
The Anthem Defendants made similar representations to Solomon, Carter, and Coonce.

12

Solomon’s contract, for instance, states: “You . . . have the right to receive a copy of the Notice of

13

Privacy Practices. You may obtain a copy by calling our customer service department . . . or by

14

accessing our web site.” ECF No. 473-7 at 22. Similarly, Carter’s plan booklet states that the

15

Anthem Defendants “will make every effort and take care to keep your medical data secret.” ECF

16

No. 473-5 at 40. “Medical data about you can only be given to others if you agree to it in writing

17

or if required by law.” Id. “A statement describing our policies and procedures for preserving the

18

confidentiality of medical records is available and will be furnished to you upon request.” Id.

19

Coonce’s plan booklet also directs Coonce to obtain a copy of Anthem’s “Notice of Privacy

20

Practices” either by calling Anthem’s customer service department or by accessing Anthem’s

21

website. ECF No. 473-6 at 6.

22

Second, “the references were called to the attention of” Bronzo, Solomon, Carter, and

23

Coonce. Shaw, 67 Cal. Rptr. at 856. As noted above, each governing contract or group plan

24

booklet called attention to the Anthem Defendants’ privacy policies and gave instructions on how

25

consumers could review these policies in greater detail.

26
27
28

Third, “the terms of the incorporated document [were] known or easily available to the
17
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

contracting parties.” Id. The SAC states that Anthem’s privacy obligations were codified in at

2

least three sets of documents: a “Personal Information (Including Social Security Number) Privacy

3

Policy,” (“PIPP”) which was posted on “the Anthem website and the website for every Anthem

4

BCBS Affiliate and . . . other Anthem Affilate[],” SAC ¶¶ 165–66; an Annual Notice of Privacy

5

Practices (“Annual Privacy Notice”), id. ¶ 169; and in other statements on Anthem’s website, id. ¶

6

168. The core message from these documents is the same: to take reasonable security measures to

7

protect customer PII. See ECF No. 473-5 at 2 (PIPP); ECF No. 473-5 at 16 (Annual Privacy

8

Notice). All of these documents, moreover, were “easily available,” Shaw, 67 Cal. Rptr. at 856,

9

either via a physical copy or online.

10

The references at issue in the instant case in fact go several steps further than the

United States District Court
Northern District of California

11

references in Wolschlager. In Wolschlager, plaintiff was simply advised that “[c]omplete [c]opies

12

of the [insurance] policy . . . should be read,” without making any reference to the arbitration

13

clause that was later disputed. 4 Cal. Rptr. 3d at 181. Here, on the other hand, the governing

14

documents all discussed Anthem’s obligation to protect privacy. In addition, these documents

15

specifically direct California Plaintiffs to review Anthem’s privacy policies in greater detail by

16

either calling Anthem’s customer service department or by visiting Anthem’s public website.

17

Under such circumstances, the Court finds that the Anthem Defendants’ privacy policies were

18

sufficiently incorporated by reference into the contracts of Bronzo, Solomon, Carter, and Coonce.

19

In response to Shaw and Wolschlager, the Anthem Defendants argue (1) that Amtower v.

20

Photon Dynamics, Inc., 71 Cal. Rptr. 3d 361 (Ct. App. 2008), compels a contrary result, (2) that

21

the integration clause in California Plaintiffs’ contracts precludes incorporation by reference of

22

Anthem’s privacy policies, and (3) that Anthem’s privacy policies only codify preexisting legal

23

duties and do not create independent contractual obligations.

24

The Anthem Defendants’ reliance upon Amtower is misguided. Amtower involved two

25

separate contracts governing two different sets of parties. The first contract, known as the

26

“Merger Agreement,” negotiated the process by which CR Technology, Inc. (“CRT”) would

27
28

18
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

merge with Photon Dynamics Inc. (“Photon”). Id. at 367–68. The only parties to the Merger

2

Agreement were CRT and Photon. Notably, the Merger Agreement included an attorney’s fees

3

provision. The second contract, known as the “Affiliate Agreement,” negotiated the rights of CRT

4

shareholders to “sell the Photon stock [that] they acquired through the [CRT and Photon] merger.”

5

Id. at 368. The parties to the Affiliate Agreement were CRT’s shareholders, which included

6

plaintiff, and Photon. The Affiliate Agreement did not include an attorney’s fees provision.

7

Plaintiff subsequently brought suit against Photon and Photon’s officers, “complaining that

8

he had been misled about the transferability of Photon stock” under the Affiliate Agreement. Id. at

9

369. Photon prevailed at trial and sought recovery of attorney’s fees. The crux of Photon’s
argument was that, although the Affiliate Agreement did not include an attorney’s fees provision,

11
United States District Court
Northern District of California

10

the Affiliate Agreement did mention the Merger Agreement, which meant that the Merger

12

Agreement’s attorney’s fees provision was incorporated by reference into the Affiliate Agreement.

13

See id. at 382–83. The California Court of Appeal rejected this argument.

14

As the California Court of Appeal observed, “[t]he parties to the Merger Agreement were

15

Photon and CRT.” Id. at 382. On the other hand, “[t]he parties to the Affiliate Agreement were

16

Photon and plaintiff.” Id. Thus, “unlike the facts in either Shaw or Wolschlager, the Merger

17

Agreement [was] a separate contract that plaintiff did not solicit and to which he was not a party.”

18

Id. at 385. “The Merger Agreement was not attached to the Affiliate Agreement and the Affiliate

19

Agreement did not refer to it as providing any rights or remedies to plaintiff.” Id. In other words,

20

the Amtower defendant sought to incorporate and enforce provisions from another contract to

21

which plaintiff was not a party.

22

These differences distinguish Amtower from the instant case. The agreements at issue here

23

all involve the same parties: Plaintiffs and the Anthem Defendants. Unlike in Amtower, there are

24

no other parties at issue: the Anthem Defendants agreed to provide health insurance to Plaintiffs,

25

and also agreed to protect Plaintiffs’ PII.

26
27
28

The Anthem Defendants’ reliance upon the contracts’ integration clause is similarly
19
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

inapposite. As the Anthem Defendants point out, for Coonce’s policy, for instance, one provision

2

states that “the entire Agreement consists of” the “Group Insurance Policy,” the “Combined

3

Evidence of Coverage and Disclosure Forms including any amendments, the group application,

4

the eligible persons’ individual applications, and the premium charge rate schedule.” ECF No.

5

473-6 at 17; Anthem Mot. at 7. This integration clause, the Anthem Defendants argue, does not

6

mention the Anthem Defendants’ privacy policies. Consequently, these privacy policies are not

7

part of Coonce’s contract. Id.

8

Generally, an integration clause “prohibits the introduction of any extrinsic evidence,

9

whether oral or written, to vary, alter or add to the terms of an integrated written instrument.”
Casa Herrera, Inc. v. Beydoun, 83 P.3d 497, 502 (Cal. 2004). However, “[t]he rule does not . . .

11
United States District Court
Northern District of California

10

prohibit the introduction of extrinsic evidence to explain the meaning of a written contract if the

12

meaning urged is one to which the written contract terms are reasonably susceptible.” Id. (internal

13

quotation marks, ellipses, and alteration omitted).

14

Here, the Anthem Defendants’ reliance upon the integration clause overlooks a critical

15

fact: Coonce’s Combined Evidence of Coverage and Disclosure Form—which the Anthem

16

Defendants acknowledge is part of the “entire Agreement”—incorporates by reference Anthem’s

17

privacy policies. Coonce’s Combined Evidence of Coverage and Disclosure Form, for instance,

18

states that “[y]ou . . . have the right to receive a copy of the Member Rights and Responsibilities

19

Statement and/or the Notice of Privacy Practices.” ECF No. 473-6 at 6. The form also directs

20

Coonce to contact the Anthem Defendants in order to obtain “[a] statement describing our policies

21

and procedures regarding the confidentiality of medical records.” Id. at 10.

22

The California Court of Appeal addressed an analogous situation in King v. Larsen Realty,

23

Inc., 175 Cal. Rptr. 226 (Ct. App. 1981). In King, the membership application for a local realtor

24

board required members “to abide by the constitution, bylaws, rules and regulations of the local

25

board and the state association.” Id. at 229. The bylaws, in turn, “impose[d] upon members the

26

duty to arbitrate on the terms set forth in the California Association of Realtors Arbitration

27
28

20
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Manual.” Id. at 229–30. “Hence,” the California Court of Appeal concluded, “the entire scheme

2

of interboard arbitration [in the California Association of Realtors Arbitration Manual] was

3

incorporated into the bylaws of the [local realtor board].” Id. at 230.

4

In like manner, in Ruffu v. California Physicians Service, 2002 WL 1352449 (Cal. Ct.

5

App. June 20, 2002), the California Court of Appeal rejected plaintiff’s argument that the

6

integration clause in a health insurance contract precluded the court from considering a Summary

7

of Benefits document. As the Ruffu court noted, the insurance contract incorporated the insurance

8

application; this application, in turn, referred to the Summary of Benefits document. “Thus, the

9

Summary of Benefits is incorporated by reference into the application, which in turn is
incorporated into the Agreement.” Id. at *4. The privacy policies here do the same thing: the

11
United States District Court
Northern District of California

10

integration clause incorporates the Combined Evidence of Coverage and Disclosure Form, which

12

in turn incorporates by reference Anthem’s privacy policies.

13

Finally, the Anthem Defendants argue that “[n]otices required by law that detail

14

preexisting legal obligations do not give rise to contractual rights.” Anthem Mot. at 8 (internal

15

quotation marks omitted). As noted in the First Motion to Dismiss Order, however, “Plaintiffs’

16

breach of contract claim reaches beyond mere violation of applicable laws.” MTD Order at 27.

17

Rather, the SAC, like the CAC, avers that the Anthem Defendants “violat[ed] their commitment to

18

maintain the confidentiality and security of [PII] compiled by Anthem and their Affiliates in the

19

Anthem Data Base; and by failing to comply with their own policies and applicable laws,

20

regulations and industry standards for data security and protecting the confidentiality of [PII].”

21

SAC ¶ 461.

22

Both the PIPP and the Annual Privacy Notice corroborate this allegation. The PIPP states

23

that “Anthem Blue Cross’s Privacy Policy imposes a number of standards to prohibit the unlawful

24

disclosure of Social Security number, and [to] guard the confidentiality of . . . other personal

25

information.” ECF No. 473-5 at 13 (emphasis added). Further, “Anthem Blue Cross safeguards

26

Social Security numbers and other personal information by having physical, technical, and

27
28

21
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

administrative safeguards in place.” Id. Similarly, the Annual Privacy Notice states that “[w]e are

2

dedicated to protecting your P[II], and have set up a number of policies and practices to help make

3

sure your P[II] is kept secure. We have to keep your P[II] private. If we believe your P[II] has

4

been breached, we must let you know.” ECF No. 473-5 at 18. These commitments do not refer to

5

any laws or preexisting legal obligations. Thus, consistent with the SAC, such statements could

6

be read to reflect a commitment by Anthem to implement privacy policies that complement (or go

7

beyond) Anthem’s preexisting legal duties.

8
9
10

United States District Court
Northern District of California

11
12

In sum, Bronzo, Solomon, Carter, and Coonce have sufficiently alleged that the Anthem
Defendants’ privacy policies were incorporated by reference into their contracts. As such, the
Court need not address California Plaintiffs’ express attachment theory.
b. Damages
The Court turns next to whether these California Plaintiffs have sufficiently pleaded

13

contractual damages. “To establish contractual damages, a [p]laintiff must establish ‘appreciable

14

and actual damage.’” Low, 900 F. Supp. 2d at 1028. “Nominal damages, speculative harm, or

15

threat of future harm do not suffice to show legally cognizable injury.” Id.

16

California Plaintiffs assert three damages theories. First, California Plaintiffs request

17

Benefit of the Bargain Losses. The SAC describes these losses as “the difference in value

18

between what Plaintiffs should have received from Defendants when they enrolled in and/or

19

purchased insurance from Defendants that Defendants represented, contractually and otherwise,

20

would be protected by reasonable data security, and Defendants’ partial, defective, and deficient

21

performance by failing to provide reasonable and adequate data security.” SAC ¶ 415. Second,

22

California Plaintiffs seek Loss of Value of PII, which Plaintiffs describe as “damages to and

23

diminution in value of their [PII] entrusted to Defendants.” Id. Third, California Plaintiffs request

24

Consequential Out of Pocket Expenses, which are “damages resulting from [Plaintiffs’] attempt to

25

ameliorate the effect of the breach of contract and subsequent Anthem Data Breach, including but

26

not limited to purchasing credit monitoring services or taking other steps to protect themselves

27
28

22
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2

from the loss of their” PII. Id. ¶ 464.
i. Benefit of the Bargain Losses

3

On Benefit of the Bargain Losses, the California Supreme Court has held that “[d]amages

4

are awarded in an action for breach of contract to give the injured party the benefit of his bargain

5

and insofar as possible to place him in the same position he would have been in had the promisor

6

performed the contract.” Coughlin v. Blair, 262 P.2d 305, 314 (Cal. 1953). Likewise, in New

7

West Charter Middle School v. Los Angeles Unified School District, 114 Cal. Rptr. 3d 504, 515

8

(Ct. App. 2010), the California Court of Appeal noted that “[c]ontract damages compensate a

9

plaintiff for its lost expectation interest.” “This,” the court observed, “is described as the benefit
of the bargain that full performance would have brought.” Id. When a “lessor fail[s] to deliver the

11
United States District Court
Northern District of California

10

promised premises,” for example, “the proper measure of damages is the difference between the

12

agreed rent and the rental value of the premises during the term of the lease.” Id. (internal

13

quotation marks omitted). Thus, both Coughlin and New West point in favor of Plaintiffs’ attempt

14

to recover Benefit of the Bargain Losses.

15

More recently, several federal courts have specifically upheld California breach of contract

16

claims for Benefit of the Bargain Losses in the privacy context. In Svenson v. Google Inc., 2015

17

WL 1503429, *4 (N.D. Cal. Apr. 1, 2015), plaintiff had signed a contract with Google under the

18

following terms: plaintiff “was to receive a payment processing service that would facilitate her

19

[App] purchase while keeping her private information confidential in all but specific

20

circumstances under which disclosure was authorized; and Google . . . was to retain a percentage

21

of the App’s purchase price.” “Google did obtain [plaintiff’s] personal information and did retain

22

a percentage of the purchase price of the . . . App,” but Google also, without plaintiff’s permission,

23

disclosed plaintiff’s personal information to a third party vendor. Id. On damages, the Svenson

24

court, citing New West, concluded that plaintiff had “alleged facts sufficient to show contract

25

damages under a benefit of the bargain theory.”

26
27
28

In an analogous context, this Court concluded that plaintiffs in In re Adobe Systems, Inc.
23
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Privacy Litigation, 66 F. Supp. 3d 1197, 1224 (N.D. Cal. 2014), had established economic injury

2

sufficient to defeat defendant’s motion to dismiss. As this Court observed, “Plaintiffs allege they

3

personally spent more on [defendant’s] products than they would had they known [defendant] was

4

not providing the reasonable security [defendant] represented it was providing.” Id. It is

5

“plausible that a company’s reasonable security practices reduce the risk of theft of customer’s

6

personal data and thus that a company’s security practices have economic value.” Id.

7

Accordingly, plaintiffs had “plausibly pleaded” that “they [had] personally lost money or property

8

as a result” of defendant’s actions. Id. at 1223–24 (internal quotation marks omitted).

9

In response to the line of decisions discussed above, the Anthem Defendants contend that
Plaintiffs’ “benefit of the bargain theory . . . fails because they do not allege facts showing that any

11
United States District Court
Northern District of California

10

alleged payments were earmarked for data security. Anthem Mot. at 11. Moreover, the Anthem

12

Defendants cite several out of circuit cases where courts have declined to award benefit of the

13

bargain damages. Both arguments are unavailing.

14

First, the Anthem Defendants have identified no California or Ninth Circuit authority to

15

suggest that an entity must precisely “earmark” what portion of Plaintiffs’ premiums went towards

16

protecting Plaintiffs’ data privacy. Indeed, California courts have consistently rejected such

17

arguments. In Lewis Jorge Construction Management, Inc. v. Pomona Unified School District,

18

102 P.3d 257, 266 (Cal. 2004), for instance, the California Supreme Court held that, although

19

contract “damages [must] be pled with [some degree of] particularity,” they need not be “proven .

20

. . with ‘mathematical precision.’” As such, “[w]here the fact of damages is certain, the amount of

21

damages need not be calculated with absolute certainty. The law requires only that some

22

reasonable basis of computation of damages be used, and the damages may be computed even [i]f

23

the result reached is an approximation.” Sargon Enterprises, Inc. v. Univ. of S. Cal., 288 P.3d

24

1237, 1254 (Cal. 2012) (internal quotation marks and citation omitted). “This is especially true

25

where it is the wrongful acts of the defendant that have created the difficulty in proving the

26

amount of loss.” Id. (ellipses omitted).

27
28

24
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Consistent with the reasoning in Lewis Jorge and Sargon, in the instant case, it is the

2

alleged wrongful acts of the Anthem Defendants—their inability to fulfill their privacy obligations

3

and their inability to set out the expected cost and value of these privacy obligations—which

4

forms the basis of Plaintiffs’ request for Benefit of the Bargain Losses. Put another way, the

5

Anthem Defendants can not evade liability because the Anthem Defendants did not provide, in

6

advance, a breakdown on how much of Plaintiffs’ premiums the Anthem Defendants allocated (or

7

should have allocated) to protecting Plaintiffs’ PII.
Second, the Court finds unavailing the Anthem Defendants’ reliance upon In re Science

9

Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, 45 F. Supp. 3d 14

10

(D.D.C. 2014), and Carlsen v. GameStop, 2015 WL 3538906 (D. Minn. June 4, 2015). Neither

11
United States District Court
Northern District of California

8

case addressed a California breach of contract claim. In fact, in In re SAIC, the district court

12

limited its discussion only to jurisdictional issues and did not even examine any substantive

13

claims. Instead, in a single sentence without citation, the district court concluded that, “[t]o the

14

extent that [p]laintiffs claim that some indeterminate part of their premiums went toward paying

15

for security measures, such a claim is too flimsy to support standing.” 45 F. Supp. 3d at 30.

16

The Carlsen court likewise did not examine a California breach of contract claim.

17

Moreover, defendant in Carlsen allowed users to sign up to receive either paid or free content;

18

defendant’s “Privacy Policy” applied to paying and non-paying users alike. 2015 WL 3538906,

19

*5. As the Carlsen court observed, “because non-paying and paying users received the same

20

Privacy Policy in this case, [p]laintiff cannot establish that the Privacy Policy has intrinsic

21

monetary value attributed to it that was paid for and not received.” Id. In contrast to Carlsen,

22

Plaintiffs here have all paid premiums to the Anthem Defendants. There are no “non-paying”

23

customers. Thus, Plaintiffs may be able to recover Benefit of the Bargain Losses in accordance

24

with their premium payments.

25
26
27
28

ii. Loss of Value of PII
Plaintiffs have also sufficiently pleaded damages for Loss of Value of PII. As the Court
25
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

explained in the First Motion to Dismiss Order, the Ninth Circuit and a number of district courts

2

have approved such damages theories. In In re Facebook Privacy Litigation, 572 F. App’x 494,

3

494 (9th Cir. 2014), for instance, “[p]laintiffs allege[d] that the information disclosed by

4

[defendant could] be used to obtain personal information about plaintiffs, and that they were

5

harmed both by the dissemination of their personal information and by losing the sales value of

6

that information.” These allegations, the Ninth Circuit determined, were “sufficient to show the

7

element of damages for [plaintiffs’] breach of contract and fraud claims.” Id.

8
9

In like manner, both this Court in In re Adobe and the district court in Corona v. Sony
Pictures Entertainment, Inc., 2015 WL 3916744 (N.D. Cal. June 15, 2015), concluded that
plaintiffs had sufficiently pleaded economic injury by claiming “that the[ir] PII was stolen and

11
United States District Court
Northern District of California

10

posted on file-sharing websites for identity thieves to download.” Corona, 2015 WL 3916744, *3;

12

see also In re Adobe, 66 F. Supp. 3d at 1214 (“[T]he risk that [p]laintiffs’ personal data will be

13

misused by the hackers who breached [defendant’s] network is immediate and very real.”).

14

Finally, in Svenson, the district court found that plaintiff’s “allegations of diminution in value of

15

her personal information are sufficient to show contract damages [under California law] for

16

pleading purposes.” 2015 WL 1503429, *5.

17

The Anthem Defendants, however, read these cases to effectively impose two pleading

18

requirements upon Plaintiffs: to plead “both that there was a ‘robust’ market for [Plaintiffs’ PII]

19

and that [P]laintiffs had been financially harmed by [the data breach by] usurping their ability to

20

sell that information themselves.” Anthem Mot. at 5 (quoting In re Google, Inc. Privacy Policy

21

Litig., 2015 WL 4317479, *4 (N.D. Cal. July 15, 2015)) (emphasis added). The Court declines to

22

adopt such an interpretation.

23

Indeed, even if both of these requirements were to apply, the SAC does aver that Plaintiffs’

24

PII “is such a valuable commodity to identity thieves that once the information has been

25

compromised, criminals often trade the information on the cyber black-market for years.” SAC ¶

26

412. Relatedly, “[w]ith access to an individual’s [PII], criminals can do more than just empty a

27
28

26
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

victim’s bank account—they can also commit various types of fraud . . . [they] may obtain a job

2

using the victim’s Social Security Number. Id ¶ 411. These allegations could be read to infer that

3

an economic market existed for Plaintiffs’ PII, and that the value of Plaintiffs’ PII decreased as a

4

result of the Anthem data breach. Indeed, in another data breach case, the Seventh Circuit

5

remarked: “Presumably, the purpose of [a] hack is, sooner or later, to make fraudulent charges or

6

assume those consumers’ identities.” Remijas v. Neiman Marcus Gp., LLC, 794 F.3d 688, 693

7

(7th Cir. 2015). “Why else would hackers break into a store’s database and steal consumers’

8

private information?” Id.

9

Moreover, setting aside the above allegations, the Court also finds that Plaintiffs are not
required to plead that there was a market for their PII and that they somehow also intended to sell

11
United States District Court
Northern District of California

10

their own PII. Not even the authority that the Anthem Defendants cite supports this proposition.

12

In In re Google, the district court observed that “[p]laintiffs do not allege economic injury from

13

any dissemination . . . or any injury in the form of loss of the [p]laintiffs’ ability to sell their own

14

information or its market value.” 2015 WL 4317479, *5 (emphasis added); see also id.

15

(“Plaintiffs plead neither the existence of a market for their email addresses and names nor any

16

impairment of their ability to participate in that market.”) (emphasis added). These statements

17

appear to require a plaintiff to allege that there was either an economic market for their PII or that

18

it would be harder to sell their own PII, not both.

19

In sum, In re Facebook, Corona, Svenson, or In re Google do not support the two part

20

requirement that the Anthem Defendants advocate. Accordingly, Plaintiffs have sufficiently

21

alleged Loss of Value of PII.

22
23

iii. Consequential Out of Pocket Expenses
Finally, the Anthem Defendants contend that Plaintiffs can not recover “Consequential Out

24

of Pocket Expenses” because “[t]here is an obvious alternative explanation for the injuries

25

Plaintiffs allege.” Anthem Mot. at 2 (internal quotation marks omitted). Namely, “[d]ozens of

26

major American businesses and the federal government have been the victims of cyberattacks in

27
28

27
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

recent years aimed at stealing millions of Americans’ PII.” Id. These data breaches have

2

“result[ed] in Americans becoming the victims of identity theft each year.” Id. at 2–3.

3

The Court found this argument meritless in the First Motion to Dismiss Order. It remains

4

meritless. As the Court has explained, “under Defendants’ theory, a company affected by a data

5

breach could simply contest causation by pointing to the fact that data breaches occur all the time,

6

against various private and public entities.” First MTD Order at 36. “This would, in turn, create a

7

perverse incentive for companies: so long as enough data breaches take place, individual

8

companies will never be found liable. No [California law], the relevant authority addressing

9

causation, or the specific facts of this case support such a legal theory.” Id.

10

On the instant motions to dismiss, the Court once again emphasizes: no court has ever

United States District Court
Northern District of California

11

accepted the Anthem Defendants’ argument in the data breach context. In fact, defendant in

12

Remijas made this exact same argument: “[Defendant] argues that these plaintiffs cannot show

13

that their injuries are traceable to the data incursion at the company rather than to one of several

14

other large-scale breaches that took place around the same time.” 794 F.3d at 696. In response,

15

the Seventh Circuit explained that “[t]he fact that . . . some other store might have caused . . .

16

plaintiffs’ private information to be exposed does nothing to negate . . . plaintiffs’ standing to

17

sue.” Id. “If there are multiple companies that could have exposed . . . plaintiffs’ private

18

information to the hackers, then the common law of torts has long shifted the burden of proof to

19

defendants to prove that their negligent actions were not the but-for cause of . . . plaintiff’s injury.”

20

Id. (internal quotation marks omitted). “It is enough at this stage of the litigation that [defendant]

21

admitted that 350,000 cards might have been exposed and that it contacted members of the class to

22

tell them they were at risk. Those admissions and actions by the store adequately raise the

23

plaintiffs’ right to relief above the speculative level.” Id.

24

Remijas is consistent with Ninth Circuit precedent. In Starr v. Baca, 652 F.3d 1202, 1216

25

(9th Cir. 2011), the Ninth Circuit held that, “[i]f there are two alternative explanations, one

26

advanced by defendant and the other advanced by plaintiff, both of which are plausible, plaintiff’s

27
28

28
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

complaint survives a motion to dismiss under Rule 12(b)(6).” The Starr court further held that a

2

plaintiff’s complaint “may be dismissed only when defendant’s plausible alternative explanation is

3

so convincing that plaintiff’s explanation is implausible.” Id.

4

Despite multiple rounds of briefing, the Anthem Defendants have failed to demonstrate

5

why the reasoning in Remijas and Starr should not govern the instant case. The Anthem

6

Defendants have never challenged the fact that (1) the Anthem Database was breached, (2) that

7

this breach exposed the PII of approximately 80 million individuals, and (3) that the Anthem

8

Database contained the PII of every single putative class member in the instant action. That is

9

sufficient for purposes of pleading consequential injury at this point in litigation.

10

As a final matter, the Anthem Defendants have also cited no binding precedent to suggest

United States District Court
Northern District of California

11

that Plaintiffs are precluded from recovering for specific types of Consequential Out of Pocket

12

Expenses, such as credit monitoring, under California contract law. The Court has found none in

13

its own research. In fact, some courts have suggested that an individual may recover “actual

14

damages” that were incurred in order “to mitigate” costs associated with being a “victim of

15

identity theft.” Ruiz v. Gap, Inc., 622 F. Supp. 2d 908, 918 (N.D. Cal. 2009). Plaintiffs have

16

sufficiently alleged such a relationship here. Coonce, for instance, alleges that he received a

17

notice from Anthem in March 2015 informing him that his PII had been compromised. Five

18

months later, Coonce “was notified . . . that his debit card number had been stolen and used for

19

unauthorized charges.” SAC ¶ 18. Consequently, Coonce spent $312 on identity theft and credit

20

monitoring services. Id. Thus, Coonce was notified that his PII had been stolen, Coonce later

21

learned that his financial information had been compromised, and, as a result, Coonce took actions

22

to prevent further financial damage.

23

In sum, the Court finds that Bronzo, Carter, Coonce, and Solomon, who had individual or

24

fully-insured group plan contracts with the Anthem Defendants, have sufficiently alleged a breach

25

of contract claim under California law.

26
27
28

2. ASO Agreements
29
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

The Court turns next to California Plaintiffs Daniel Randrup, Steve Kawai, Kelly Tharp,

2

and Daniel Tharp, who were enrolled in ASO agreements. Because the Anthem Defendants do

3

not act as the insurer in these agreements and because these agreements are between an employer

4

and an Anthem Defendant, Plaintiffs assert their California breach of contract claim as third party

5

beneficiaries. See SAC ¶ 454 (“The Plaintiffs and Class Members who enrolled in Self-Funded

6

Plans for whom Anthem provided only administrative services sue as third-party beneficiaries.”).

7

In California, “[a] third party beneficiary may enforce a contract made expressly for his or

8

her benefit.” Kaiser Eng’rs, Inc. v. Grinnell Fire Protection Sys. Co., 219 Cal. Rptr. 626, 629 (Ct.

9

App. 1985). “The intent of the contracting parties to benefit expressly that third party must appear
from the terms of the contract.” Id. Over time, the term “expressly” has come to mean “merely

11
United States District Court
Northern District of California

10

the negative of ‘incidentally.’” Id. “[T]he third person need not be named or identified

12

individually to be an express beneficiary. A third party may enforce a contract if it can be shown

13

that he or she is a member of the class for whose express benefit the contract was made.” Id.

14

“Generally, it is a question of fact whether a particular third person is an intended beneficiary of a

15

contract.” Prouty v. Gores Tech. Gp., 18 Cal. Rptr. 3d 178, 184 (Ct. App. 2004). With these

16

principles in mind, the Court addresses Randrup, Kawai, and the Tharps’ claims in turn.

17
18

a. Randrup
Randrup has failed to sufficiently allege a third party beneficiary claim, for two reasons.

19

First, Randrup’s ASO, on the first page, states that “[n]either SISC III [Randrup’s employer] nor

20

Anthem Blue Cross Life and Health intends this Agreement to confer any benefit on any persons

21

who are not parties to this Agreement.” ECF No. 473-7 at 6. The following page defines

22

“Parties” as “SISC III and Anthem Blue Cross Life and Health.” Id. at 7. Read together, these

23

provisions suggest that SISC III and Anthem Blue Cross Life and Health did not intend to confer

24

third party beneficiary status to Randrup. Indeed, in similar contexts, courts have read such

25

clauses to preclude litigants from asserting third party beneficiary claims. See, e.g., Balsam v.

26

Tucows Inc., 2009 WL 3463923, *3–*4 (N.D. Cal. Oct. 23, 2009) (finding that party could not

27
28

30
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

bring claim where agreement included term that read: “This Agreement shall not be construed to

2

create any obligation by either ICANN or Registrar to any non-party to this Agreement.”).

3

Second, although Plaintiffs contend that Randrup’s contract “incorporated privacy policies

4

that Anthem violated,” Anthem Opp’n at 7, the agreement between SISC III and Anthem Blue

5

Cross Life and Health does not support this contention. Unlike the contracts described above,

6

Randrup’s ASO agreement does not mention the PIPP or the Annual Privacy Notice. In fact, in

7

their briefing, Plaintiffs do not even point to a single instance in Randrup’s ASO agreement where

8

the Anthem Defendants promised to protect Randrup’s PII. Id.

9

After the Court’s own review of the agreement at issue, the Court has found only one
provision that could be taken to refer to the Anthem Defendants’ privacy obligations: “Anthem

11
United States District Court
Northern District of California

10

Blue Cross Life and Health . . . agrees that all individually identifiable information regarding

12

persons covered under the Plan . . . is confidential and shall be (i) used only in order to carry out

13

the provisions of this Agreement . . . and (ii) disclosed only as otherwise provided in this

14

Agreement or as required by law.” ECF No. 473-7 at 10. This statement differs markedly from

15

the statements made in the contracts of California Plaintiffs under individual and fully-insured

16

group plans. At no point in this statement do the parties refer to Anthem’s specific privacy

17

obligations. Nor does this statement direct Randrup to visit Anthem’s public website or contact

18

Anthem’s customer service department for a copy of Anthem’s privacy policies. Thus, the content

19

of this single statement, read together with the above statements disclaiming any third party rights,

20

demonstrate that Randrup may not pursue a breach of contract claim.

21

Prouty v. Gores Technology Group and Milmoe v. Gevity HR, Inc., 2006 WL 2691393

22

(N.D. Cal. Sept. 20, 2006), do not compel a contrary finding. Both Prouty and Milmoe addressed

23

whether an employee could assert a third party beneficiary claim in the context of a contract

24

between two companies that acted as co-employers. As other courts have noted, Prouty and

25

Milmoe created a limited exception to the general rule regarding contractual clauses that disclaim

26

third party beneficiary claims. Balsam, 2009 WL 3463923, *4. “[I]n Prouty, the ‘specific’ clause

27
28

31
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

that the third parties sought to enforce was an amendment to an agreement.” Id. “That the

2

amendment was added after the general no third party beneficiary statement was included in the

3

agreement was strong evidence of the parties’ intent to modify the original terms of the

4

agreement.” Id. Moreover, “the clause protecting the employees in Prouty was aimed at

5

protecting a narrow, specifically-identified class of people, namely employees of one party’s

6

subsidiary.” Id. Likewise, in Milmoe, “the plaintiff’s work and wages were the [express] subject

7

of the contract, thus making it entirely plausible that parts of the contract were intended for the

8

express benefit of the plaintiff.” Id. at *5.

9

Such circumstances are not at play here. Although Plaintiffs contend that “under
California law, a general ‘no third party beneficiary’ clause may be trumped by more specific

11
United States District Court
Northern District of California

10

contract provisions that create benefits for a specific group,” Plaintiffs have identified no such

12

specific provisions here. Anthem Opp’n at 7. As such, unlike Prouty and Milmoe, there is no

13

indication that the parties intended to allow Randrup to pursue a California breach of contract

14

claim against the Anthem Defendants. Accordingly, the Court finds that Randrup can not proceed

15

with his breach of contract claim against the Anthem Defendants.

16

Additionally, the Court denies Plaintiffs’ leave to amend Randrup’s claim. The Court may

17

grant leave to amend unless doing so would unduly prejudice the opposing party, cause undue

18

delay, or be futile, or if the moving party has acted in bad faith. These factors, however, are “not

19

given equal weight.” Bonin v. Calderon, 59 F.3d 815, 845 (9th Cir. 1995). “Futility of

20

amendment can, by itself, justify the denial of a motion for leave to amend.” Id. Amendment here

21

would be futile. Randrup’s ASO agreement expressly disclaims third party beneficiary claims and

22

includes only a single provision that discusses the Anthem Defendants’ privacy obligations. At no

23

point in Randrup’s agreement are the PIPP or Annual Privacy Notice mentioned. Furthermore, “a

24

district court has broad discretion to grant or deny leave to amend, particularly where the court has

25

already given a plaintiff one or more opportunities to amend his complaint.” Mir v. Forsburg, 646

26

F.2d 342, 347 (9th Cir. 1980). Plaintiffs have now had two opportunities to amend the complaint.

27
28

32
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

The SAC addresses the deficiencies identified in the First Motion to Dismiss Order for several

2

California Plaintiffs, but not for Randrup.

3

Turning briefly to the other relevant leave to amend factors, the Court finds that providing

4

leave to amend would also result in undue delay and could prejudice the Anthem Defendants. The

5

parties are proceeding apace with the case schedule, with fact discovery set to close on October

6

17, 2016 and expert discovery set to close on January 23, 2017. Providing Plaintiffs with leave to

7

amend, thus triggering another motion to dismiss, would delay the case schedule and prevent this

8

action from efficient resolution.

9
10

b. Kawai
Kawai was employed by the State of California and was enrolled in a CalPERS health plan

United States District Court
Northern District of California

11

administered by Anthem Blue Cross of California. SAC ¶ 19. The ASO agreement between

12

CalPERS and Anthem Blue Cross of California states that “[t]he California Legislature and

13

CalPERS have established an organized program for the provision of health benefits to State of

14

California Employees.” ECF No. 473-6 at 35. Unlike Randrup’s ASO agreement, Kawai’s ASO

15

agreement does not include a provision that expressly disclaims third beneficiary status.

16

Moreover, also unlike Randrup’s ASO agreement, Kawai’s ASO agreement includes 11

17

pages that describe the Anthem Defendants’ commitment to protect individual privacy. See id. at

18

39–42; 48–54. These obligations include a promise to “take all reasonable and necessary steps to

19

prevent the unauthorized disclosure, modification or destruction of the Disclosing Party’s

20

Information Assets.” Id. at 40. Anthem Blue Cross of California “must, at a minimum, use the

21

same degree of care to protect the Disclosing Party’s Information Assets that it uses to protect its

22

own Information Assets.” Id. Kawai’s ASO agreement further provides that Anthem Blue Cross

23

“will maintain the confidentiality of all information and documents relating to Members and will

24

ensure all Member information is kept strictly confidential, and, as applicable, in accordance with

25

federal and state law. All such information will be treated as sensitive and propriety in accordance

26

with CalPERS confidentiality laws, Contractor’s confidentiality policies and procedures,

27
28

33
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

applicable physician code of ethics, constitutional right of privacy, all applicable federal and state

2

law and requirements of all applicable accrediting bodies.” Id. at 41–42 (emphasis added). Taken

3

together, these statements appear to sufficiently incorporate by reference Anthem’s privacy

4

policies, such as its PIPP and Annual Privacy Notice.

5

Finally, Kawai’s ASO agreement includes, as an attachment, a Business Associate

6

Agreement, formed between CalPERS, the Plan Sponsor, and Anthem Blue Cross of California,

7

the Business Associate. “In order to share P[I]I with third parties, . . . HIPAA requires health care

8

plans and providers to enter into business associate agreements, [which are] contracts obligating

9

the third parties to abide by HIPAA’s restrictions on P[I]I disclosures.” Monarch Fire Prot. Dist.
of St. Louis Cnty, Mo. v. Freedom Consulting & Auditing Servs., Inc., 678 F. Supp. 2d 927, 932

11
United States District Court
Northern District of California

10

(E.D. Mo. 2009); see 45 C.F.R. § 164.502(e)(1)(i) (“A covered entity may disclose protected

12

health information to a business associate and may allow a business associate to create, receive,

13

maintain, or transmit protected health information on its behalf.”). Kawai’s Business Associate

14

Agreement sets forth detailed privacy provisions, which include a provision that Anthem Blue

15

Cross of California “implement administrative, physical, and technical safeguards (including

16

written policies and procedures) that reasonably and appropriately protect the confidentiality,

17

integrity, and availability of” PII. ECF No. 473-6 at 49.

18

In sum, the provisions in the main ASO agreement and the Business Associate Agreement

19

provide evidence that (1) Kawai was an intended third party beneficiary between CalPERS and

20

Anthem Blue Cross of California and that (2) provisions in the ASO agreement could be read to

21

allow Kawai to pursue a third party beneficiary claim.

22

The Anthem Defendants sole argument in response to this conclusion is that the purpose of

23

the Business Associate Agreement is to “implement safeguards to protect electronic health

24

information as required by the HIPAA Security Rule.” Anthem Mot. at 10. Consequently, the

25

Business Associate Agreement only memorializes certain preexisting legal obligations, which

26

“do[] not create contractual rights.” Id.

27
28

34
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

This contention is flawed in two respects. First, as outlined above, the attached Business

2

Associate Agreement does not contain all of Anthem Blue Cross of California’s privacy

3

obligations. Several obligations are included in the main ASO agreement, such as a promise to

4

“maintain the confidentiality of all information and documents relating to Members and will

5

ensure all Member information is kept strictly confidential.” ECF No. 473-6 at 41 (emphasis

6

added). Thus, even if the Court were to set the Business Associate Agreement aside, the Court

7

would nevertheless find that Kawai could maintain a third party beneficiary claim.

8

Second, very few courts have considered whether Business Associate Agreements create
independent contractual rights. There is at least some regulatory language and case law, however,

10

to suggest that they do. The regulations governing Business Associate Agreements state that “[a]

11
United States District Court
Northern District of California

9

business associate may use or disclose protected health information only as permitted or required

12

by its business associate contract or other arrangement pursuant to [45 C.F.R.] § 164.504(e) or as

13

required by law.” 45 C.F.R. § 164.502(a)(3) (emphasis added). The prevalent use of the word

14

“or” suggests that Business Associate Agreements may be implemented such that they cover more

15

ground than what would be required by federal law.

16

This interpretation is consistent with the understanding adopted by the Eastern District of

17

Missouri in Monarch Fire Protection. In that case, plaintiff asked an auditing firm, Freedom

18

Consulting & Auditing Services (“Freedom”), to review whether an individual had “use[d]

19

[plaintiff’s health] Plan for procedures that should not have been covered.” 678 F. Supp. 2d at

20

932. Plaintiff subsequently filed suit for breach of contract “because Freedom breached a number

21

of provisions of the [Business Associate Agreement] by, among other things, failing to

22

immediately remove P[I]I from documentation received for purposes of the audit, disclosing P[I]I

23

to [unauthorized third parties], and retaining P[I]I after completing the audit.” Id. at 935. After

24

reviewing the terms of the Business Associate Agreement, the Monarch Fire Protection court

25

concluded that plaintiff was “entitled to summary judgment that Freedom breached the [Business

26

Associate Agreement] by divulging P[I]I received in the audit process.” Id. at 938. The Eighth

27
28

35
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Circuit affirmed. Monarch Fire Prot. Dist. of St. Louis Cnty, Mo. v. Freedom Consulting &

2

Auditing Servs., Inc., 644 F.3d 633 (8th Cir. 2011). Plaintiff in Monarch Fire Department was

3

therefore able to prevail on a breach of contract claim based upon privacy obligations set forth in a

4

Business Associate Agreement. There is no reason why Kawai should not be able to do the same.

5

Thus, having concluded that Kawai has sufficiently alleged a third party beneficiary claim,

6

the Court turns finally to the Anthem Defendants’ remaining argument: whether Kawai may

7

recover damages. Here, the Anthem Defendants argue that damages are not recoverable because

8

“Plaintiffs’ employers, and not Plaintiffs, . . . made payments to the Anthem Defendants.”

9

Anthem Mot. at 12. Kawai, however, alleges that he paid premiums to CalPERS, which then used
these premiums to pay for services offered by the Anthem Defendants. Under California law,

11
United States District Court
Northern District of California

10

“when a plaintiff seeks to secure benefits under a contract as to which he is a third-party

12

beneficiary, he must take that contract as he finds it.” Marina Tenants Ass’n v. Deauville Marina

13

Dev’t Co., 226 Cal. Rptr. 321, 327 (Ct. App. 1986) (internal quotation marks and alterations

14

omitted). Applying this principle to the instant case, the Anthem Defendants do not contest that

15

CalPERS would be able to recover Benefit of the Bargain Losses, Loss of Value of PII, or

16

Consequential Out of Pocket Expenses. By asserting a third party beneficiary claim, Kawai seeks

17

to step into the shoes of CalPERS and recover the same damages that CalPERS would be able to

18

recover. Kawai has thus “take[n] th[e] contract as he finds it,” and has asserted rights

19

commensurate to what CalPERS could assert. Id. Accordingly, Kawai’s attempt to recover

20

contract damages does not warrant dismissal.

21

c. Daniel and Kelly Tharp

22

The Tharps’ ASO agreement is more analogous to Randrup’s than to Kawai’s. Indeed,

23

although the Tharps’ ASO agreement does not contain a clause that specifically disclaims third

24

party beneficiary claims, the agreement does include a No Assignment Clause: “Unless it has first

25

obtained the written consent of the other Party, neither Party may assign this Agreement to any

26

other person.” ECF No. 473-9 at 6. Although California courts have, in some instances, allowed

27
28

36
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

third parties to pursue a claim notwithstanding a no assignment clause, the general view is that

2

such a clause does not point in the Tharps’ favor. See Schauer v. Mandarin Gems of Cal., Inc., 23

3

Cal. Rptr. 3d 233, 237–40 (Ct. App. 2005).

4

More importantly, the Tharps’ ASO agreement barely mentions the Anthem Defendants’

5

privacy obligations. The agreement does not mention the PIPP or Annual Privacy Notice, nor

6

does it discuss any security measures that the Anthem Defendants must undertake. One specific

7

section states that the Anthem Defendants must comply with the legal requirements set forth under

8

HIPAA. ECF No. 473-8 at 15. Another section makes a vague commitment to comply with

9

Anthem’s standard policies and procedures, but does not mention whether these standard policies

10

United States District Court
Northern District of California

11

include Anthem’s privacy obligations. Id. at 8.
Although Plaintiffs appear to acknowledge these deficiencies, Plaintiffs nonetheless

12

contend that the Tharps’ ASO agreement “expressly committed to comply with HIPAA,” which,

13

Plaintiffs argue, provides the basis for a breach of contract claim. Anthem Opp’n at 7. The Court

14

disagrees. As noted in the First Motion to Dismiss Order, “plaintiffs must . . . do something more

15

to allege a breach of contract claim than merely point to allegations of a statutory violation.”

16

Wiebe v. NDEX West, LLC, 2010 WL 2035992, *3 (C.D. Cal. May 17, 2010) (quoting Berger v.

17

Home Depot U.S.A., Inc., 476 F. Supp. 2d 1174, 1177 (C.D. Cal. 2007)). A breach of contract

18

claim based solely upon a pre-existing legal obligation to comply with HIPAA can not survive

19

dismissal.

20

Having determined that the Tharps have not stated a viable third party beneficiary claim,

21

the Court also denies Plaintiffs’ leave to amend. As with Randrup, providing leave to amend

22

would be futile, would result in undue delay, and could prejudice the opposing party. Moreover,

23

Plaintiffs have already produced the Tharps’ ASO agreement, and the Court has determined, after

24

reviewing this agreement in detail, that it does not contain the provisions necessary to plead a third

25

party beneficiary claim.

26
27
28

In sum, the Anthem Defendants’ motion to dismiss Daniel Randrup, Kelly Tharp, and
37
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Daniel Tharp’s breach of contract claim is GRANTED with prejudice. The Anthem Defendants’

2

motion to dismiss the breach of contract claims of the remaining California Plaintiffs is DENIED.

3
4

C. New Jersey Breach of Contract (against Non-Anthem Defendants)
In order to state a claim for breach of contract under New Jersey law, Plaintiffs “must

5

allege (1) a contract between the parties; (2) a breach of that contract; (3) damages flowing

6

therefrom; and (4) that the party stating the claim performed its own contractual obligations.”

7

Frederico v. Home Depot, 507 F.3d 188, 203 (3d Cir. 2007). In moving to dismiss Plaintiffs’ New

8

Jersey breach of contract claim, the Non-Anthem Defendants contend that the SAC “fails to allege

9

facts identifying a contractual provision that allegedly was breached,” that Plaintiffs did not
“suffer[] any injury as a result of any alleged breach,” and that Plaintiffs’ “benefit of the bargain

11
United States District Court
Northern District of California

10

theory of injury” is barred by the filed rate doctrine. Non-Anthem Mot. at 6 (internal quotation

12

marks omitted). These contentions are discussed in turn.

13

1. Contractual Provisions

14

Because there is only one New Jersey Plaintiff, Elizabeth Ames (“Ames”), there is only

15

one set of contracts at issue. Ames avers that she “was enrolled in a Horizon Blue Cross Blue

16

Shield of New Jersey health plan,” and “was previously enrolled in a Blue Cross Blue Shield of

17

Florida health plan.” SAC ¶ 85. Ames was insured by Horizon Blue Cross Blue Shield of New

18

Jersey under an individual health plan and by Horizon Blue Cross Blue Shield of Florida under an

19

ASO agreement.

20

Horizon Blue Cross Blue Shield of Florida does not challenge whether Ames’s contract

21

included certain privacy provisions. Non-Anthem Mot. at 6 n.6. Horizon Blue Cross Blue Shield

22

of Florida is only challenging whether Ames can recover contractual damages. Id.

23

On the other hand, Horizon Blue Cross Blue Shield of New Jersey challenges whether

24

Ames’s contract included any privacy obligations. Plaintiffs assert that Anthem’s privacy policies

25

were part of Ames’s contract with Horizon Blue Cross Blue Shield of New Jersey either via

26

express attachment or via incorporation by reference. On express attachment, the parties agree

27
28

38
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

that the Court’s analysis should begin with the Benefits booklet that Horizon Blue Cross Blue

2

Shield of New Jersey provided to Ames. This booklet contains eight sections. Two are of

3

particular importance here: Section 7, “Important Notices,” and Section 8, “Your Policy.” ECF

4

No. 491-1 at 7.

5

In Section 7, Horizon Blue Cross Blue Shield of New Jersey outlines its “Notice of

6

information privacy practices.” Id. at 17. This Notice states that Horizon Blue Cross Blue Shield

7

of New Jersey “will abide by the statements made in this Notice,” and “want[s]” you to know that

8

[it] recognize[s] [its] obligation to keep information about you secure and confidential.” Id. The

9

Notice further provides that “[w]e also maintain appropriate administrative, technical and physical
safeguards to reasonably protect your [PII].” Id.; see also id. (“Our employees get training

11
United States District Court
Northern District of California

10

regarding the need to maintain your [PII] in the strictest confidence.”). The entirety of this Notice

12

is reproduced on Horizon Blue Cross Blue Shield of New Jersey’s website, and Ames’ Booklet

13

expressly directs Ames to “[g]o online” for further information on the Non-Anthem Defendants’

14

policies. See ECF No. 491-1 at 8; ECF No. 473-11 at 26–31.

15

Section 8, the “Your Policy” section, contains information on premiums, specialty case

16

management, and coordination of benefits. ECF No. 491-1 at 21–22. A provision of the “Your

17

Policy” section also contains a clause which states that “[t]his Policy, including the endorsements

18

and the attached papers, if any, constitutes the entire contract of insurance.” Id. at 24.

19

The core dispute is whether this clause excludes consideration of the privacy obligations

20

set forth in Section 7. According to the Non-Anthem Defendants, this integration clause restricts

21

Ames’ contract to include only those provisions in Section 8, the “Your Policy” section. Non-

22

Anthem Reply at 4. Plaintiffs, on the other hand, contend that the integration clause’s language—

23

“This Policy, including the endorsements and the attached papers, if any, constitutes the . . .

24

contract of insurance”—incorporates the privacy obligations in Section 7. As Plaintiffs note, “[i]t

25

defies logic and the plain meaning of ‘attached papers’ for Defendants to argue that this privacy

26

notice, which is physically ‘attached’ to the Policy in the preceding chapter of the same booklet, is

27
28

39
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2

not included in this contract.” Non-Anthem Opp’n at 8.
Under New Jersey law, “[w]hen the meaning of an integrated contract is ambiguous, the

3

surrounding circumstances may be introduced for the purpose of elucidation.” Driscoll Const.

4

Co., Inc. v. State, Dep’t of Transp., 853 A.2d 270, 278 (N.J. Super. Ct. App. Div. 2004).

5

However, “[e]ven when the contract on its face is free from ambiguity, evidence of the situation of

6

the parties and the surrounding circumstances and conditions is admissible in aid of

7

interpretation.” Id. Thus, “whether the clause under consideration is regarded as clear and certain,

8

or ambiguous and uncertain, if the intention of the parties is not to be gleaned from a reading of

9

the instrument as a whole, the plaintiff should have had the opportunity of presenting evidence of

10

United States District Court
Northern District of California

11

the facts and circumstances surrounding the execution of the [contract].” Id.
With this in mind, the Court finds more persuasive Plaintiffs’ reading of the integration

12

clause in Ames’ contract. What other meaning could “attached papers” have if not one that

13

includes papers that are literally attached to the Policy? The interpretation advocated by the Non-

14

Anthem Defendants would essentially render superfluous the “attached papers” provision. Such a

15

reading would contravene the New Jersey precedent discussed above, as well as run afoul of the

16

general rule that courts are to “give effect to all parts of the [contract], and an interpretation which

17

gives a reasonable meaning to all its provisions will be preferred to one which leaves a portion of

18

the writing useless or inexplicable.” Maryland Cas. Co. v. Hansen-Jensen, Inc., 83 A.2d 1, 4 (N.J.

19

Super Ct. App. Div. 1951).

20

Plaintiffs have thus sufficiently alleged that Ames’ contract expressly attached Horizon

21

Blue Cross Blue Shield of New Jersey’s privacy obligations, as contained in Section 7 of Ames’

22

booklet. Having determined that these obligations were expressly attached, the Court need not

23

examine whether these obligations were also incorporated by reference.

24
25
26
27
28

2. Damages
a. Benefit of the Bargain Losses
Ames seeks damages in the form of Benefit of the Bargain Losses, Loss of Value of PII,
40
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

and Consequential Out of Pocket Expenses. As to Benefit of the Bargain Losses, the Non-Anthem

2

Defendants’ primary contention is that such damages are barred by the filed rate doctrine. The

3

Non-Anthem Defendants state that this doctrine applies because Plaintiffs’ request for Benefit of

4

the Bargain Losses would require the Court to recalculate insurance premium rates and determine

5

what a reasonable rate would have been.

6

“The filed rate doctrine forbids a regulated entity [from] charg[ing] rates for its services
other than those properly filed with the appropriate federal [or state] regulatory authority.”

8

Weinberg v. Sprint Corp., 801 A.2d 281, 286 (N.J. 2002) (internal quotation marks omitted). “The

9

two core policy goals of the doctrine are (1) the non-discrimination strand, or the prevention of

10

price discrimination by carriers as among ratepayers; and (2) the non-justiciability strand, or the

11
United States District Court
Northern District of California

7

preservation of the role of regulatory agencies in approving reasonable rates and the exclusion of

12

the courts from the rate-making process.” Clark v. Prudential Ins. Co. of Am., 736 F. Supp. 2d

13

902, 913 (D.N.J. 2010). The doctrine “is a product of the deference which courts give to the

14

ratemaking and regulatory processes of administrative bodies.” Richardson v. Standard Guar. Ins.

15

Co., 853 A.2d 955, 961 (N.J. Super. Ct. App. Div. 2004).

16

As construed by the New Jersey Supreme Court, “the filed rate doctrine bars money

17

damages from [regulated entities] where the damage claims are premised on state contract

18

principles, consumer fraud, or other bases on which plaintiffs seek to enforce a rate other than the

19

filed rate.” Weinberg, 801 A.2d at 287. “[T]here is no fraud exception to the filed rate doctrine.”

20

AT & T Corp. v. JMC Telecom, LLC, 470 F.3d 525, 535 (3d Cir. 2006). Consequently, “any

21

remedy requiring a refund of a portion of the filed rate is barred by application of the filed rate

22

doctrine.” Smith v. SBC Commc’ns, 839 A.2d 850, 860 (N.J. 2004) (emphasis added).

23

The filed rate doctrine applies to the instant case. As an initial matter, although Plaintiffs

24

correctly assert that the filed rate doctrine was originally “grounded in federal preemption

25

principles,” both state and federal courts in New Jersey have determined that the doctrine also now

26

applies to industries subject to state regulation. See, e.g., Richardson¸ 853 A.2d at 963 (“[W]e

27
28

41
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

reject plaintiff’s argument that the doctrine does not apply to state ratemaking.”); Clark, 736 F.

2

Supp. 2d at 914 (“[T]he Court finds that the filed rate doctrine may be applied to rate-making by a

3

New Jersey regulatory agency.”).

4

Notably, in Clark, the district court applied the filed rate doctrine to bar various state law

5

claims asserted against a health insurer. Plaintiffs in Clark asserted causes of action under the

6

New Jersey Consumer Fraud Act and common law fraudulent misrepresentation, fraudulent

7

omission, and breach of the duty of good faith and fair dealing. Id. at 912. Specifically, plaintiffs

8

alleged that defendant, a health insurer, had “affirmatively misrepresented the reason[] for . . .

9

escalating premiums.” Id. at 909. According to plaintiffs, defendant had apparently stated that the
rising premiums were the result of general increases in medical costs rather than disclosing

11
United States District Court
Northern District of California

10

defendant’s decision to prevent new policyholders from joining the insurance plan. Id. at 908.

12

“With [the insurance plan] closed to new entrants, and an insufficient percentage of healthy

13

policyholders remaining to subsidize the costs of unhealthy policyholders,” defendant’s actions

14

caused the insurance plan to enter into an economically unsustainable “death spiral.” Id.

15

Defendant in Clark did not challenge the allegations of affirmative misrepresentation. Instead,

16

defendant focused on the fact that plaintiffs effectively sought “a refund of all moneys acquired by

17

means of unlawful practices”—a form of relief that defendant argued was barred by the filed rate

18

doctrine. Id. at 919.

19

The Clark court agreed. In reaching this decision, the district court rejected plaintiffs’

20

argument that the filed rate doctrine did not apply to health insurers. Relying upon the New Jersey

21

Superior Court Appellate Division’s Richardson decision, the Clark court noted that “(1) many

22

other jurisdictions ha[ve] applied the doctrine to insurance industry rate-making; (2) the insurance

23

industry in New Jersey is heavily regulated; and (3) the statutory framework governing rate-

24

making for [health] insurance in New Jersey is meaningful and extensive.” Id. at 915. Notably,

25

all health insurance premiums in New Jersey must be “submitted and approved by the New Jersey

26

Department of Banking and Insurance (DOBI), the state agency specifically authorized by New

27
28

42
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Jersey law to regulate insurance rates.” Id.

2

Both Richardson and Clark apply here. Indeed, as in both cases, the Non-Anthem

3

Defendants “filed with [DOBI]” the “rates applicable to Ames health plan . . . as required by state

4

law.” Non-Anthem Opp’n at 10. Moreover, Plaintiffs’ request for Benefit of the Bargain Losses

5

constitutes an attempt to “enforce a rate other than the filed rate.” Weinberg, 801 A.2d at 287. As

6

the New Jersey Supreme Court has stated, “any remedy requiring a refund of a portion of the filed

7

rate is barred by application of the filed rate doctrine.” Smith, 839 A.2d at 860 (emphasis added).

8

Here, Plaintiffs’ request for Benefit of the Bargain Losses naturally represents a refund for the

9

portion of Plaintiffs’ premiums that should have, but did not, go towards data security. In
opposing the instant motion, Plaintiffs in fact acknowledge that their request for such losses

11
United States District Court
Northern District of California

10

“could involve a refund of some portion of premiums to compensate Plaintiffs for data security

12

that was promised but not delivered.” Non-Anthem Opp’n at 15.

13

In an attempt to distinguish Clark and Richardson, Plaintiffs argue that they are not

14

“challeng[ing] the intrinsic reasonableness of the rates Non-Anthem Defendants charged for health

15

insurance.” Id. Instead, “Plaintiffs contend that . . . they should be compensated for Defendants’

16

failure to provide what was promised.” Id.

17

This argument, however, has already been considered and rejected. As the Clark court

18

explained, such a request “would [inevitably] require the Court to determine what rate would have

19

been reasonable and thereby interfere with DOBI’s rate-making process.” 736 F. Supp. 2d at 919.

20

“[C]laims for compensatory damages or refund based on insurance premiums [plaintiff] paid in

21

previous years are barred by the filed rate doctrine.” Id. Similarly, in Richardson, the Appellate

22

Division of the New Jersey Superior Court has held that the filed rate “doctrine precludes a claim

23

for damages which would indirectly cause the application of rates different from the filed rates.”

24

853 A.2d at 967 (emphasis added). That is exactly what would happen here: by asking for an

25

across-the-board premium refund to putative class members, Plaintiffs would “indirectly cause the

26

application of rates different from the filed rates.” Id. Finally, in JMC Telecom, the Third Circuit,

27
28

43
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

of which New Jersey is a part, has determined that “the filed rate doctrine has been expanded to

2

exclude claims of insufficient and poor-quality service.” 470 F.3d at 532. In the instant case,

3

Plaintiffs’ basic contention is that Defendants provided poor quality data security rather than

4

reasonable data security, as Defendants promised to do.

5

To be fair, the filed rate doctrine is not without criticism. The U.S. Supreme Court has

6

called the doctrine “harsh,” a sentiment shared by the Third Circuit. Am. Tel. and Tel. Co. v. Cent.

7

Ofc. Tel., Inc., 524 U.S. 214, 223 (1998) (stating that “the filed rate doctrine may seem harsh in

8

some circumstances,” but nonetheless applying doctrine to reverse Ninth Circuit decision); JMC

9

Telecom, 470 F.3d at 533 n.11 (“Although the filed rate doctrine produces harsh results in this
case as alleged, such equitable concerns have been rejected by the Supreme Court. . . . This is true

11
United States District Court
Northern District of California

10

regardless of [a defendant’s] ulterior motives.”). Likewise, various New Jersey judges have

12

described the doctrine as “controversial” and “a legal fiction whose days . . . are numbered.”

13

Richardson, 853 A.2d at 962 (quoting Weinberg, 801 A.2d at 294 (Verniero, J., dissenting)).

14

However, an MDL transferee court is “bound by the same substantive legal standards . . . as would

15

have applied in the transferor court.” In re Korean Air, 642 F.3d at 699. Those standards, as

16

stated by state and federal courts in New Jersey, provide a clear answer to the issue at hand.

17

Accordingly, the Court finds that Plaintiffs’ can not recover Benefit of the Bargain Losses under

18

their New Jersey breach of contract claim.

19

In addition, the Court denies Plaintiffs’ leave to amend, as amendment would be futile.

20

The rules governing the filed rate doctrine have been set forth by federal and state courts in New

21

Jersey. These principles demonstrate that Plaintiffs’ request for Benefit of the Bargain Losses

22

inextricably implicates the filed rate doctrine. Plaintiffs are barred from recovering such damages,

23

and amendment would not change this holding.

24
25
26
27
28

b. Loss of Value of PII
As to Loss of Value of PII, neither party has identified any authority addressing whether a
party may recover for such damages in New Jersey. The Court has found none in its own
44
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

research. In the absence of such authority, the Court finds dismissal of Plaintiffs’ claim for Loss

2

of Value of PII unwarranted.

3

Two reasons counsel in favor of this finding. First, courts have noted that “California and

4

New Jersey [contract] law are substantially similar” to one another. N.J. Best Phone Cards, Corp.

5

v. NobelTel, LLC, 2013 WL 5937422, *3 (D.N.J. Nov. 4, 2013). As noted above, California

6

Plaintiffs may recover for Loss of Value of PII, and there is no reason why this holding should not

7

also apply to the New Jersey breach of contract claim.

8

Second, there is at least some case law to suggest that New Jersey courts would be
receptive to Loss of Value of PII damages. In Canessa v. J.I. Kislak, Inc., 235 A.2d 62 (N.J.

10

Super. Ct. Law. Div. 1967), plaintiff had his family’s picture taken for a local news story by

11
United States District Court
Northern District of California

9

defendant, a local real estate company. After the news story was published, defendant began

12

reprinting and distributing the family’s picture without plaintiff’s permission. Id. at 65. Plaintiff

13

objected, and sued for invasion of privacy. Defendant argued that plaintiff could not recover

14

damages. Id.

15

The New Jersey Superior Court disagreed. As the court outlined, plaintiff’s “names and

16

likenesses belong to them. As such they are property. They are things of value. Defendant has

17

made them so, for it has taken them for its own commercial benefit.” Id. at 76. The Canessa

18

court continued, “New Jersey has always enjoined the use of plaintiff’s likeness and name on the

19

specific basis that it was a protected property right. . . . If it is sufficiently a right of ‘property’ to

20

prevent its use, why should it not also be such a right when damages are sought? For the latter

21

wrong there should likewise be a remedy, i.e., damages.” Id. (citation omitted). Here, as in

22

Canessa, Plaintiffs allege that their PII had economic value, which was diminished because the

23

Non-Anthem Defendants did not take the necessary steps to protect Plaintiffs’ PII.

24

c. Consequential Out of Pocket Expenses

25

As to Consequential Out of Pocket Expenses, the SAC states that “Ames has spent

26

numerous hours addressing issues arising from the Anthem data breach.” SAC ¶ 85. That

27
28

45
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

allegation, the Non-Anthem Defendants argue, is “not enough to state a breach of contract claim.”

2

Non-Anthem Mot. at 9. No New Jersey state courts have ruled on the issue of whether such costs

3

are recoverable. Nor has the Third Circuit or a district court in the Third Circuit provided any

4

guidance.
There are, however, a growing number of courts that have recognized that damages

6

associated with time spent monitoring one’s PII are recoverable. First, in Lewert v. P.F. Chang’s

7

China Bistro, Inc., 2016 WL 1459226, *1 (7th Cir. Apr. 14, 2016), plaintiff alleged that, “after

8

[defendant] initially announced [a data] breach in June 2014,” plaintiff “spent time and effort

9

monitoring his card statements and his credit report to ensure that no fraudulent charges had been

10

made on that card and that no fraudulent accounts had been opened in his name.” Like Ames, the

11
United States District Court
Northern District of California

5

Lewert plaintiff did not actually spend money on credit monitoring services. Moreover, at the

12

time that defendant in Lewert announced the data breach, the parties “did not know how many

13

consumers were affected, whether the breach was general or limited to specific locations, or how

14

long the breach lasted.” Id. Further investigation revealed that plaintiff in Lewert had not even

15

dined at “[t]he only affected restaurant” in plaintiff’s state. Thus, there was no risk that plaintiff’s

16

personal information would be compromised as a result of the data breach. Nevertheless, the

17

Seventh Circuit concluded that “the time and effort” the plaintiff had spent “monitoring both his

18

card statements and his other financial information” was “sufficient” to “support standing based

19

on [plaintiff’s] injuries.” Id. at *1, *3; see also id. (finding “time and money customers spent

20

protecting against future identity theft or fraudulent charges” constitute “injuries sufficient for

21

standing”).

22

Lewert relied significantly upon the Seventh Circuit’s decision in Remijas, a case discussed

23

above. On Consequential Out of Pocket Expenses, the Remijas court specifically concluded that

24

“[m]itigation expenses . . . qualify as [an] actual injur[y]” because the harm was imminent:

25

defendant’s data had been breached, and this event “made the risk of identity theft and fraudulent

26

charges sufficiently immediate to justify mitigation efforts.” Remijas, 794 F.3d at 694.

27
28

46
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Consistent with Lewert and Remijas, the Middle District of Alabama recently denied a

2

motion to dismiss in Smith v. Triad of Alabama, LLC, 2015 WL 5793318 (M.D. Ala. Sept. 29,

3

2015), another data breach case. As the district court summarized, plaintiffs “aver that because of

4

the data breach, they will be required to spend money and time mitigating its effects.” Id. at *8.

5

The district court rejected defendant’s argument that, “in order to establish standing, [p]laintiffs

6

must allege . . . that they suffered some un-reimbursed or out of pocket expense.” Id. After

7

canvassing relevant Eleventh Circuit precedent, the district court concluded that “[t]here is no

8

precedent binding on this court stating that for standing purposes, a victim of identity

9

theft must allege that he or she suffered economic damages or that he/she suffered an un-

10

United States District Court
Northern District of California

11

reimbursed or out-of-pocket expense, and this court will not so hold.” Id. at *9.
Finally, this Court’s In re Adobe decision also supports Plaintiffs’ position. As in Lewert,

12

Remijas, and Smith, this Court held that a data breach creates a “threatened harm” that is

13

“sufficiently concrete and imminent to satisfy” standing. In re Adobe, 66 F. Supp. 3d at 1214.

14

Here, Plaintiffs attempts to respond to this imminent threat—whether by paying out of pocket for

15

credit monitoring or by using their own time for credit monitoring—resulted in damages that may

16

be recoverable.

17

The Non-Anthem Defendants’ reliance upon Holmes v. Countrywide Financial Corp.,

18

2012 WL 2873892 (W.D. Ky. July 12, 2012), is unpersuasive. Plaintiffs in Holmes did assert a

19

New Jersey breach of contract claim arising out of a data breach. Plaintiffs also argued that the

20

time spent “monitoring their credit, researching identity theft, and learning about this case” may

21

“form the foundation for a compensable injury.” Id. at *11. The Holmes court disagreed. The

22

Holmes court, however, found no relevant New Jersey state court or Third Circuit decision on

23

point. Instead, the Holmes court relied entirely upon four federal district court opinions, and

24

provided no independent reasoning outside of a citation to these decisions. Holmes—and all the

25

decisions upon which Holmes relies—predate the Seventh Circuit’s decisions in Lewert and

26

Remijas, the Middle District of Alabama’s decision in Smith, and this Court’s decision in In re

27
28

47
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Adobe. As such, Holmes does not reflect the growing recognition amongst courts of Loss of

2

Value of PII damages. In light of such circumstances, the Court finds Lewert, Remijas, Smith, and

3

In re Adobe more instructive, and thus declines to follow Holmes.

4

In sum, the Non-Anthem Defendants’ motion to dismiss the request for Benefit of the

5

Bargain Losses as to Plaintiffs’ New Jersey breach of contract claim is GRANTED with prejudice.

6

The Non-Anthem Defendants’ motion to dismiss Plaintiffs’ New Jersey breach of contract claim is

7

otherwise DENIED.

8
9

D. New York Unjust Enrichment (against Anthem and Non-Anthem Defendants)
The SAC asserts against all Defendants an unjust enrichment claim, brought under New
York law. SAC ¶¶ 526–34. According to the SAC, Plaintiffs “conferred a monetary benefit on”

11
United States District Court
Northern District of California

10

Defendants, Defendants “appreciated or had knowledge of the benefits conferred upon them by

12

Plaintiffs,” and “[u]nder principals [sic] of equity and good conscience, Defendants . . . should not

13

be permitted to retain the money belonging to Plaintiffs . . . because Defendant[s] failed to

14

implement (or adequately implement) the data privacy and security practices and procedures that

15

Plaintiffs . . . paid for.” Id. ¶¶ 528, 529, 532.

16

Defendants seek dismissal of Plaintiffs’ New York unjust enrichment claim on two

17

grounds. First, Defendants contend that “[t]here can be no unjust enrichment claim under New

18

York law where an express contract governs the same subject manner.” Anthem Mot. at 13.

19

Second, Plaintiffs’ claim “fails because the SAC does not allege facts showing the New York

20

Plaintiffs conferred a benefit on the Anthem Defendants such that they could have been unjustly

21

enriched.” Id. at 14. These arguments are addressed in turn.

22

1. Overlap with Express Contract

23

On the issue of Plaintiffs’ express contracts with Defendants, the New York Court of

24

Appeals has noted, “[a] ‘quasi contract’ only applies in the absence of an express agreement, and

25

is not really a contract at all, but rather a legal obligation imposed in order to prevent a party’s

26

unjust enrichment.” Clark-Fitzpatrick, Inc. v. Long Island R.R. Co., 516 N.E.2d 190, 193 (N.Y.

27
28

48
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

1987) (emphasis added). “It is impermissible . . . to seek damages in an action sounding in quasi

2

contract where the suing party has fully performed on a valid written agreement, the existence of

3

which is undisputed, and the scope of which clearly covers the dispute between the parties.” Id.;

4

accord Corsello v. Verizon N.Y., Inc., 967 N.E.2d 1177, 1185 (N.Y. 2012) (“An unjust enrichment

5

claim is not available where it simply duplicates, or replaces, a conventional contract . . . claim.”).

6

Consistent with Clark-Fitzpatrick and Corsello, the parties agree that Plaintiffs’ New York

7

unjust enrichment claim is duplicative of Plaintiffs’ New York breach of contract claim. Anthem

8

Mot. at 13; Anthem Opp’n at 12. In other words, if New York Plaintiffs can obtain relief via

9

contract, then New York Plaintiffs may not seek relief via unjust enrichment.

10

However, the parties have not designated a New York breach of contract claim as one of

United States District Court
Northern District of California

11

the selected claims, and there has been no briefing as to the scope and breadth of New York

12

Plaintiffs’ contracts. As a result, the parties did not include the New York Plaintiffs’ contracts in

13

the record.

14

The parties have, however, selected a California breach of contract claim. Several courts

15

have held that California and New York contract law are similar to one another. See, e.g., Be In,

16

Inc. v. Google, Inc.¸ 2013 WL 5568706, *6 (N.D. Cal. Oct. 9, 2013) (“[T]he Court agrees that the

17

contract formation law of both California and New York is substantively similar.”); Berkson v.

18

Gogo LLC, 97 F. Supp. 3d 359, 388 (E.D.N.Y. 2015) (“In the instant case, the substantive

19

contractual laws of New York, California, and Illinois are at issue. These states laws are

20

substantively similar with respect to the issue of contract formation.”); cf. First Hill Partners, LLC

21

v. BlueCrest Capital Mgmt. Ltd., 52 F. Supp. 3d 625, 634 (S.D.N.Y. 2014) (“[T]here is no actual

22

conflict between the law governing unjust enrichment claims in New York and in California.

23

Under both New York and California law, an unjust enrichment claim is precluded if a valid

24

contract covers the subject matter of the dispute.”) (citations and footnote omitted).

25

As discussed above, on Plaintiffs’ California breach of contract claim, the parties disagree

26

over whether Defendants’ privacy policies were incorporated into Plaintiffs’ contracts. The Court

27
28

49
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

agreed with the Anthem Defendants on the claims brought by California Plaintiffs Daniel

2

Randrup, Kelly Tharp, and Daniel Tharp, but agreed with Plaintiffs as to the remaining California

3

Plaintiffs. Without an opportunity to review the specific contracts at issue for New York

4

Plaintiffs, it is uncertain whether Defendants’ privacy obligations were also sufficiently

5

incorporated by reference into New York Plaintiffs’ contracts.

6

Under similar factual circumstances, New York courts have denied motions to dismiss

7

unjust enrichment claims. In Joseph Sternberg, Inc. v. Walber 36th St. Assocs., 187 A.D.2d 225,

8

228 (N.Y. App. Div. 1993), the New York Supreme Court Appellate Division noted that “where

9

there is a bona fide dispute as to the existence of a contract or where the contract does not cover
the dispute in issue, plaintiff may proceed upon a theory of quantum meruit and will not be

11
United States District Court
Northern District of California

10

required to elect his or her remedies.” The court subsequently determined that the contract at issue

12

was ambiguous, and that, at the motion to dismiss stage, dismissal was unwarranted.

13

The Southern District of New York also denied defendant’s motion to dismiss in Union

14

Bank, N.A. v. CBS Corp., 2009 WL 1675087 (S.D.N.Y. June 10, 2009). Akin to the instant case,

15

plaintiff in Union Bank asserted a breach of contract and an unjust enrichment claim. After

16

examining the evidence, the district court concluded that it could not “determine as a matter of law

17

and at the inception of this litigation that this dispute will be resolved through application of the

18

[parties’ written contracts].” Id. at *8. Citing Joseph Sternberg, the Union Bank court thus

19

decided that plaintiff’s unjust enrichment claim should not be dismissed. Id. at *9.

20

Following Sternberg and Union Bank, the Court finds that, it is unclear whether New York

21

Plaintiffs’ contract claim is duplicative of, and thus precludes, New York Plaintiffs’ unjust

22

enrichment claim. Thus, the Court denies Defendants’ motions to dismiss based on their

23

contention that Plaintiffs’ New York unjust enrichment claim overlaps with Plaintiffs’ New York

24

contract claim.

25

2. Conferral of Benefit

26

As to Defendants’ other contention—that Plaintiffs did not confer a monetary benefit on

27
28

50
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

Defendants—the Court finds instructive Georgia Malone & Co., Inc. v. Rieder, 973 N.E.2d 743,

2

746 (N.Y. 2012). In Georgia Malone, the New York Court of Appeals stated that, for purposes of

3

an unjust enrichment claim, “[a] plaintiff must allege that (1) the other party was enriched, (2) at

4

that party’s expense, and (3) that it is against equity and good conscience to permit the other party

5

to retain what is sought to be recovered.” Id. (internal quotation marks omitted). “[A] plaintiff

6

need not be in privity with the defendant to state a claim for unjust enrichment.” Id. There must

7

only “exist a relationship or connection between the parties that is not too attenuated.” Id.

8

(internal quotation marks omitted). At first blush, the SAC appears to meet all three of these

9

requirements: Plaintiffs aver (1) that they paid premiums or fees that went to Defendants, (2) that

10

Defendants knew of these payments, and (3) that Defendants should return a portion of what was

11
United States District Court
Northern District of California

1

paid. SAC ¶¶ 528, 529, 532.

12

Defendants, however, contend that Plaintiffs do not “allege any facts showing [that] their

13

premiums were in fact paid to Anthem.” Anthem Mot. at 15. According to Defendants, all New

14

York Plaintiffs were covered under ASO agreements; as such, Plaintiffs’ employers, and not

15

Plaintiffs, paid Defendants.

16

The Court disagrees with Defendants as to New York Plaintiffs Barbara Gold (“Gold”),

17

Matthew Gates (“Gates”), and Juan Carlos Cerro (“Cerro”). Gold, Gates, and Cerro all state that

18

they paid health insurance premiums on a regular basis. SAC ¶¶ 87–89. These premiums were

19

aggregated by their respective employers, who then paid Defendants. Thus, Defendants knew or

20

should have known that some portion of Gold, Gates, and Cerro’s insurance expenses had been

21

paid by the premiums that Gold, Gates, and Cerro paid. That is all that Gold, Gates, and Cerro

22

need to plead to avoid dismissal.

23

Mandarin Trading Ltd. v. Wildenstein, 944 N.E.2d 1104 (N.Y. 2011), does not hold to the

24

contrary. In that case, the New York Court of Appeals again emphasized that “privity is not

25

required for an unjust enrichment claim.” Id. at 1111. The court, however, dismissed the unjust

26

enrichment claim at issue because there were no allegations of even “an awareness by [defendant]

27
28

51
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

of [plaintiff’s] existence.” Id. Such circumstances do not apply here. By virtue of collecting

2

Plaintiffs’ PII, maintaining a nationwide database of Plaintiffs’ PII, and providing administrative

3

services to Plaintiffs, Defendants were aware of Gold, Gates, and Cerro’s existence. The

4

relationship between Gold, Gates, and Cerro and Defendants is thus “not too attenuated” to state a

5

New York unjust enrichment claim. Rieder, 973 N.E. 2d at 746; Mandarin Trading, 944 N.E. 2d

6

at 1111. Defendants’ motions to dismiss the New York unjust enrichment claims of Gold, Gates,

7

and Cerro are therefore DENIED.

8
9

The Court, however, finds Defendants’ arguments more relevant as to New York Plaintiff
Marne Onderdonk (“Onderdonk”). The SAC states that “Onderdonk was enrolled in the New
York State Health Insurance Program (NYSHIP) for Government Employees.” SAC ¶ 90.

11
United States District Court
Northern District of California

10

Empire BlueCross Blue Shield provided administrative services to NYSHIP. Id. The SAC,

12

however, does not state that Onderdonk paid premiums, rates, or any other fees to NYSHIP or

13

Empire BlueCross Blue Shield. Indeed, based on the SAC, it is unclear whether there is any

14

economic relationship between Onderdonk, NYSHIP, and Empire BlueCross Blue Shield. Such

15

allegations do not pass muster under Mandarin Trading. Accordingly, Defendants’ motion to

16

dismiss Onderdonk’s New York unjust enrichment claim is GRANTED. However, Plaintiffs shall

17

have leave to amend Onderdonk’s claim. It is possible that, after amendment, Plaintiffs will be

18

able to plead a sufficiently close economic relationship between Onderdonk and Empire

19

BlueCross Blue Shield. Amendment therefore may not be futile.

20

E. California Unfair Competition Law (against Anthem and Non-Anthem Defendants)

21

California’s Unfair Competition Law (“UCL”) provides a cause of action for business

22

practices that are (1) unlawful, (2) unfair, or (3) fraudulent. Cal. Bus & Prof. Code § 17200, et

23

seq. “The UCL’s coverage is sweeping, and its standard for wrongful business conduct

24

intentionally broad.” Moore v. Apple, Inc., 73 F. Supp. 3d 1191, 1204 (N.D. Cal. 2014) (internal

25

quotation marks omitted). “Although the UCL targets a wide range of misconduct, its remedies

26

are limited because UCL actions are equitable in nature.” Pom Wonderful LLC v. Welch Foods,

27
28

52
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Inc., 2009 WL 5184422, *2 (C.D. Cal. Dec. 21, 2009). “Remedies for private individuals bringing

2

suit under the UCL are limited to restitution and injunctive relief.” Id.
Each prong of the UCL provides a separate and distinct theory of liability, Lozano v. AT&T

3
4

Wireless Servs., Inc., 504 F.3d 718, 731 (9th Cir. 2007), and Plaintiffs assert that Defendants’

5

conduct was unlawful, unfair, and fraudulent, see SAC ¶ 542. Before addressing whether

6

Plaintiffs have sufficiently pleaded liability under these prongs, however, the Court must

7

determine whether Plaintiffs have standing to bring suit. In order to establish standing under the

8

UCL, “a plaintiff must make a twofold showing: he or she must demonstrate injury in fact and a

9

loss of money or property caused by unfair competition.” Susilo v. Wells Fargo Bank, N.A., 796

10

F. Supp. 2d 1177, 1195–96 (C.D. Cal. 2011) (internal quotation marks omitted).

United States District Court
Northern District of California

11

1. Standing

12

As to whether Plaintiffs have demonstrated “injury in fact” and “a loss of money or

13

property caused by unfair competition,” id., the California Supreme Court has stated that “[t]here

14

are innumerable ways in which economic injury from unfair competition may be shown,” Kwikset

15

Corp. v. Superior Court, 246 P.3d 877, 885 (Cal. 2011). A plaintiff may, for instance,

16

(1) surrender in a transaction more, or acquire in a transaction less, than he or she
otherwise would have; (2) have a present or future property interest diminished;
(3) be deprived of money or property to which he or she has a cognizable claim;
or (4) be required to enter into a transaction, costing money or property, that
would otherwise have been unnecessary

17
18
19
20

Id. at 885–86. Here, Plaintiffs seek recovery under the UCL for two forms of economic injury:
Benefit of the Bargain Losses and Consequential Out of Pocket Expenses.7

21
22
23
24

The Court has already determined that California Plaintiffs Michael Bronzo, Mary Ella
Carter, Kenneth Coonce, Steve Kawai, and Kenneth Solomon may recover Benefit of the Bargain
Losses under their California breach of contract claim. As Defendants acknowledge, that finding
also means that those California Plaintiffs’ have sufficiently alleged economic injury for purposes

25
26
27
28

7

Plaintiffs do not seek Loss of Value of PII under the UCL. ECF No. 424 at 14 n.16.
53

Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

of the UCL. Anthem Mot. at 15. Whether the remaining California Plaintiffs—Daniel Randrup,

2

Kelly Tharp, Daniel Tharp, Joseph Blanchard, Lillian Brisko, and Alvin Lawson—have

3

sufficiently alleged UCL standing is a closer call. Answering this question requires the Court to

4

examine (a) the differences between Article III standing and UCL standing, and (b) the differences

5

between California contract law and the UCL.

6
7

a. Relationship Between Article III Standing and UCL Standing
“Although the requirements of federal standing under Article III and the requirements of
standing under California’s consumer protection statutes overlap, there are important differences.”

9

In re Sony Gaming Networks and Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 965

10

(S.D. Cal. 2012) (citing Troyk v. Farmers Grp., Inc., 90 Cal. Rptr. 3d 589, 625 n.31 (Ct. App.

11
United States District Court
Northern District of California

8

2009)). “For example, under Article III a plaintiff must allege: (1) an injury in fact; (2) causation;

12

and (3) likelihood that the injury will be redressed by a favorable decision.” Id. On the other

13

hand, for purposes of the UCL, a plaintiff need meet only “the first element (i.e., an injury in

14

fact).” Id. (internal quotation marks omitted).

15

However, under the UCL, a party must show that he has lost money or property in order to

16

satisfy this injury in fact requirement. Ehret v. Uber Technologies, Inc., 68 F. Supp. 3d 1121,

17

1132 (N.D. Cal. 2014) (“Whereas a federal plaintiff’s injury in fact may be intangible and need

18

not involve lost money or property, . . . a UCL plaintiff’s injury in fact [must] specifically involve

19

lost money or property.”) (internal quotation marks omitted).

20

This “lost money or property” requirement may, in some circumstances, impose a more

21

stringent standard for standing under the UCL as compared to Article III. Id. Nevertheless,

22

California Plaintiffs have met this more stringent standard. Each California Plaintiff states that

23

they paid money for health insurance premiums, which were used to pay for services offered by

24

Defendants. See, e.g., SAC ¶ 16 (“Plaintiff Daniel Randrup . . . was enrolled in a health plan . . .

25

that was administered by . . . Anthem Blue Cross of California, and [Randrup] paid premiums on a

26

regular basis.”). Thus, each California Plaintiff has “lost money or property,” as required under

27
28

54
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2
3

the UCL.
b. Relationship Between Contract Law and UCL
There are also a number of important distinctions between California contract law and the

4

UCL. In general, the UCL sweeps more broadly. See, e.g., Hale v. Sharp Healthcare, 108 Cal.

5

Rptr. 3d 669, 675–81 (Ct. App. 2010) (upholding UCL claim but dismissing breach of contract

6

claim); Ehret, 68 F. Supp. 3d at 1139–41 (same). Two particular differences help explain the

7

UCL’s broader scope, and are of relevance to the instant motions.

8
9

First, under the UCL, a plaintiff may bring suit against a third party even if the plaintiff is
not an intended third party beneficiary. Compare Bus. to Bus. Mkts., Inc. v. Zurich Specialties, 37
Cal. Rptr. 3d 295, 298 (Ct. App. 2005) (stating, in a breach of contract case, that a party owes

11
United States District Court
Northern District of California

10

duties to intended, but not incidental, third party beneficiaries), with Ferrington v. McAfee, Inc.,

12

2010 WL 3910169, *8 (N.D. Cal. Oct. 5, 2010) (“[T]he UCL permits restitution from a defendant

13

whose unfair business practices caused plaintiff to pay money to a third party, as long as it is

14

reasonable to infer that the defendant indirectly received that money from the third party.”).

15

On this point, Defendants make much of the California Supreme Court’s statement in

16

Korea Supply Co. v. Lockheed Martin Corp., 63 P.3d 937, 947 (Cal. 2003), that “[a]ny award that

17

plaintiff would recover from defendants [under the UCL] would not be restitutionary as it would

18

not replace any money or property that defendants took directly from plaintiff.” Non-Anthem

19

Mot. at 12; Anthem Mot. at 10 n.15. This statement, Defendants argue, demonstrates that

20

Plaintiffs can not seek restitution under the UCL if a Plaintiff is covered by an ASO agreement, as

21

such Plaintiffs did not pay Defendants directly. Applied here, this argument would, in practice, set

22

a higher bar for UCL standing than under a conventional breach of contract claim, as no Plaintiff

23

under an ASO agreement could bring a UCL claim.

24

California courts, however, have rejected the reading of Korea Supply that Defendants

25

have advocated. In Shersher v. Superior Court, 65 Cal. Rptr. 3d 634, 636 (Ct. App. 2007),

26

defendant Microsoft Corporation (“Microsoft”) argued that plaintiff could not seek restitution

27
28

55
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

because plaintiff “purchased Microsoft’s product from a retailer.” Thus, plaintiff did not “pa[y]

2

money directly to” Microsoft. Id. The California Court of Appeal rejected this argument and

3

found Microsoft’s reliance upon Korea Supply misplaced. After reviewing the facts in Korea

4

Supply, the California Court of Appeal concluded that the case’s holding was “a narrow one”:

5

namely, “the holding of Korea Supply on the issue of restitution is that the remedy the plaintiff

6

seeks must be truly ‘restitutionary in nature’—that is, it must represent the return of money or

7

property the defendant acquired through its unfair practices.” Id. at 639. Importantly, “[n]othing

8

in the language of Korea Supply suggests that the [California] Supreme Court intended to preclude

9

consumers from seeking the return of money they paid for a product that turned out to be not as

10

United States District Court
Northern District of California

11

represented.” Id. (emphasis added).
In Troyk, a case decided after Shersher, the California Court of Appeal once again

12

reiterated that “Korea Supply [was] inapposite . . . and does not hold that a plaintiff who paid a

13

third party money (i.e., money in which the plaintiff had a vested interest) may not seek UCL

14

restitution from a defendant whose unlawful business practice caused the plaintiff to pay that

15

money.” Troyk, 90 Cal. Rptr. 3d at 616; see People v. Sarpas, 172 Cal. Rptr. 3d 25, 43–48 (Ct.

16

App. 2014) (canvassing decisions that have criticized Korea Supply).

17

Following Shersher and Troyk, federal courts—including this Court—have generally

18

declined to adopt Defendants’ reading of Korea Supply. See, e.g., Lopez v. United Parcel Serv.,

19

Inc., 2010 WL 728205, *10 (N.D. Cal. 2010) (rejecting reliance upon direct payment argument

20

and stating that “UPS’s suggestion that Korea Supply is in any way apposite to the present case is

21

flatly wrong.”); McAfee, 2010 WL 3910169, *7 (“[A]s the California Court of Appeals has noted,

22

[the holding in Korea Supply] was directed to the particular facts of [the case], which involved

23

plaintiffs who never had an ownership interest in the money allegedly obtained through

24

defendant’s unfair business practices.”).

25
26
27
28

In accord with this line of cases, the Court does not adopt Defendants’ reading of Korea
Supply here. Although California Plaintiffs might not have paid Defendants directly, they
56
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

nonetheless paid premiums which were then used to pay Defendants. Defendants’ alleged failure

2

to provide certain services led Plaintiffs, via the UCL, to seek “the return of money or property

3

[that Defendants] acquired through its unfair practices.” Shersher, 65 Cal. Rptr. 3d at 639.

4

A second notable difference between contract law and the UCL is that the UCL provides

5

for liability under three separate prongs: the unlawful, the unfair, and the fraudulent prong. As

6

explained by the district court in Ehret, a “UCL claim . . . is [thus] not limited to the structures of

7

the alleged contractual terms.” Ehret, 68 F. Supp. 3d at 1141. The UCL’s “prescriptions are

8

aimed at unlawful or unfair [or fraudulent] business practices (wherein a violation may be found

9

even if conduct violates no specific law [or contract]).” Id.

10

This distinction is critical to understanding why all California Plaintiffs have alleged

United States District Court
Northern District of California

11

economic injury sufficient to establish UCL standing. California Plaintiffs, for instance, claim

12

that Defendants engaged in unlawful business practices by violating HIPAA, the Gramm-Leach-

13

Bliley Act, the Federal Trade Commission Act (“FTC Act”), California’s Unfair Insurance

14

Practice Statutes, California’s Insurance Information and Privacy Protection Act (“CIIPA”),

15

California’s Confidentiality of Medical Information Act (“CMIA”), and Cal. Civ. Code § 1798.2.

16

SAC ¶ 316, 317, 542. Defendants do not contest that the contracts or agreements for California

17

Plaintiffs included provisions agreeing to comply with some (or all) of these laws.

18

As the Court has noted, for purposes of bringing a breach of contract claim, California

19

Plaintiffs “must . . . do something more . . . than merely point to allegations of a statutory

20

violation.” Berger, 476 F. Supp. 2d at 1177. Plaintiffs need not, though, do anything more to

21

allege an unlawful claim under the UCL. “By proscribing any unlawful business practice,” the

22

UCL “borrows violations of other laws and treats them as unlawful practices that the UCL makes

23

independently actionable.” Rose v. Bank of Am., N.A., 304 P.3d 181, 185 (Cal. 2013) (internal

24

quotation marks and alteration omitted). In other words, the UCL’s unlawful prong creates causes

25

of action for statutory violations that might not otherwise be actionable via private contract.

26
27
28

Taken together, the three features discussed above—that a plaintiff must show lost money
57
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

or property, that a plaintiff need not be an intended third party beneficiary to bring a UCL claim,

2

and that UCL liability is often broader than contract liability—provide an answer to the standing

3

inquiry here. All California Plaintiffs paid premiums, which were in turn used to pay for services

4

by Defendants. As part of these services, Defendants were, at minimum, required to comply with

5

certain privacy laws, which Defendants allegedly did not do. California Plaintiffs have thus

6

established economic injury because they have “surrender[ed] in a transaction more, or acquire[d]

7

in a transaction less, than he or she otherwise would have,” Kwikset, 246 P.3d at 885, because of

8

Defendants’ unlawful, unfair, or fraudulent conduct.
2. Unlawful

9

As discussed above, Plaintiffs allege that Defendants violated seven statutes: HIPAA, the

10

United States District Court
Northern District of California

11

Gramm-Leach-Bliley Act, the FTC Act, California’s Unfair Insurance Practice Statutes, CIIPA,

12

CMIA, and Cal. Civ. Code § 1798.82. Defendants contend that Plaintiffs have failed to state a

13

claim under three statutes: CMIA, CIIPA, and Cal. Civ. Code § 1798.82. Defendants do not

14

challenge Plaintiffs’ allegations as to the remaining statutes. Thus, even if the Court were to grant

15

Defendants’ motion, Plaintiffs’ UCL claim under the unlawful prong would still survive.
This is effectively the position Plaintiffs have taken in their own briefing. Instead of

16
17

developing specific arguments to challenge Defendants’ contentions, Plaintiffs urge the Court to

18

defer ruling on Defendants’ arguments, as Plaintiffs would have a viable claim under the unlawful

19

prong in any event. As Defendants point out, however, a decision from the Court now could help

20

“determine the scope of this case going forward,” particularly as to the breadth of fact and expert

21

discovery and the issues to be decided at summary judgment. Anthem Reply at 10.
Accordingly, because Plaintiffs have not challenged Defendants’ arguments as to the

22
23

CMIA, CIIPA, and Cal. Civ. Code § 1798.82, Defendants’ motion to dismiss these statutes under

24

the UCL’s unlawful prong is GRANTED with prejudice.8

25
26
27
28

8

The Court emphasizes that its decision is based upon the parties’ respective positions and is not a
substantive ruling on whether Defendants violated the statutes at issue. In fact, Defendants’
58
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

3. Unfair

2

“The ‘unfair’ prong of the UCL creates a cause of action for a business practice that is

3

unfair even if not proscribed by some other law.” In re Adobe, 66 F. Supp. 3d at 1226. “The UCL

4

does not define the term ‘unfair.’ . . . [And] the proper definition of ‘unfair’ conduct against

5

consumers ‘is currently in flux’ among California courts.” Id.

6

Some California courts apply a balancing approach, which requires courts to “weigh the

7

utility of the defendant’s conduct against the gravity of the harm to the alleged victim.” Davis v.

8

HSBC Bank Nevada, N.A., 691 F.3d 1152, 1169 (9th Cir. 2012) (internal quotation marks

9

omitted). Other California courts have held that “unfairness must be tethered to some legislatively
declared policy or proof of some actual or threatened impact on competition.” Lozano, 504 F.3d

11
United States District Court
Northern District of California

10

at 735 (internal quotation marks omitted). Finally, one California court has adopted the three-part

12

test set forth in § 5 of the Federal Trade Commission Act: “(1) the consumer injury must be

13

substantial; (2) the injury must not be outweighed by any countervailing benefits to consumers or

14

competition; and (3) it must be an injury that consumers themselves could not reasonably have

15

avoided.” Camacho v. Auto. Club of Southern California, 48 Cal. Rptr. 3d 770, 777 (Ct. App.

16

2006). The Court refers to these tests as the “balancing test,” the “tethering test,” and the “FTC

17

test,” respectively.

18

In the First Motion to Dismiss Order, the Court concluded that “dismissal of Plaintiffs’

19

UCL claim under the unfair prong [was] unwarranted.” First MTD Order at 40. “In In re Adobe,

20

this Court observed that various California statutes—including several statutes upon which

21

Plaintiffs rely here—reflect California’s public policy of protecting customer data.” Id. (internal

22

quotation marks omitted). “Whether Defendants’ public policy violation is outweighed by the

23
24
25
26
27
28

claims that the SAC does not allege the theft of medical information and that the CMIA protects
only medical information are incorrect. Anthem Mot. at 17. For example, the SAC alleges the
theft of the following information, among others, from the Anthem Database: dates of birth, Social
Security numbers, and confidential medical records. SAC ¶¶ 3, 360. Moreover, the CMIA
protects the privacy of “medical information” and defines that term to include individually
identifiable information. Cal. Civ. Code § 56.05(j).
59
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

utility of their conduct under the balancing test is a question to be resolved at a later stage in this

2

litigation.” Id. Thus, “based on the balancing test alone,” Defendants’ first round motions to

3

dismiss were denied. Id. (emphasis added).

4

In the instant motions, Defendants request that the Court find that several statutes listed in

5

the SAC do not support an unfair claim. Anthem Mot. at 18. These statutes include the ones

6

discussed above (CMIA, CIIPA, and Cal. Civ. Code §1798.82), as well as the Gramm-Leach-

7

Bliley Act and the California Data Breach Statute. Id. Defendants argue that Plaintiffs can not

8

prove that Defendants violated these statutes. Id. Thus, Defendants argue, dismissal is warranted

9

because an unfair prong claim must be based upon a public policy that is “‘tethered’ to specific
constitutional, statutory, or regulatory provisions.” Anthem Reply at 11 (quoting Gregory v.

11
United States District Court
Northern District of California

10

Albertson’s Inc., 128 Cal. Rptr. 2d 389, 395 (Ct. App. 2002)).

12

These arguments are misdirected. Whether or not Plaintiffs can establish that Defendants

13

violated a particular statute concerns the UCL’s unlawful prong, not the unfair prong. Compare

14

Aleksick v. 7-Eleven, Inc., 140 Cal. Rptr. 3d 796, 801 (Ct. App. 2012) (discussing a UCL claim

15

brought under the unlawful prong and holding that “[w]hen a statutory claim fails, a derivative

16

UCL claim also fails.”), with Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 973 P.2d

17

527, 561 (Cal. 1999) (“It would be impossible to draft in advance detailed plans and specifications

18

of all acts and conduct to be prohibited, since unfair . . . business practices [under the UCL] may

19

run the gamut of human ingenuity and chicanery.”) (citation and alteration omitted). Put another

20

way, whether Defendants’ violated a particular statute does not necessarily mean that the statute

21

does not reflect a public policy to protect consumer privacy.

22

More importantly, Defendants’ arguments regarding the unfair prong, as Defendants note,

23

address the tethering test. However, in the First Motion to Dismiss Order, the Court concluded

24

that Plaintiffs had sufficiently alleged an unfair prong violation based on the balancing test alone.

25

First MTD Order at 40. Defendants’ briefing does not mention, much less discuss, the balancing

26

test—the basis of the Court’s original decision. Accordingly, Defendants’ motion to dismiss

27
28

60
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Plaintiffs’ UCL claim under the unfair prong is DENIED.

2

4. Fraud

3

“To state a claim under the ‘fraud’ prong of [the UCL], a plaintiff must allege facts
showing that members of the public are likely to be deceived by the alleged fraudulent business

5

practice.” Antman v. Uber Technologies, Inc., 2015 WL 6123054, *6 (N.D. Cal. Oct. 19, 2015).

6

Claims under the fraud prong of the UCL are subject to the particularity requirements of Federal

7

Rule of Civil Procedure 9(b). Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 2009).

8

Under this Rule, “[i]n alleging fraud or mistake, a party must state with particularity the

9

circumstances constituting fraud or mistake.” Fed. R. Civ. P. 9(b). Plaintiffs must include “an

10

account of the time, place, and specific content of the false representations” at issue. Swartz v.

11
United States District Court
Northern District of California

4

KPMG LLP, 476 F.3d 756, 764 (9th Cir. 2007) (internal quotation marks omitted). Additionally,

12

“a plaintiff stating a claim under the ‘fraud’ prong must plead actual reliance.” In re Carrer IQ,

13

Inc., 78 F. Supp. 3d at 1111.

14

In the First Motion to Dismiss Order, the Court dismissed Plaintiffs’ UCL claim under the

15

fraud prong. The Court observed that although Defendants allegedly “promised to carry out

16

reasonable security measures, but ultimately failed to carry through with this promise,” Plaintiffs

17

had not included the time that any misrepresentations or omissions had been made, as required by

18

Rule 9(b). First MTD Order at 41.

19

The SAC seeks to cure this particular deficiency. The SAC, for instance, includes copies

20

of the 2014 Annual Privacy Notice, which was made available prior to the Anthem data breach.

21

See ECF No. 473-5 at 16–22 (copy of 2014 Annual Privacy Notice). Plaintiffs also allege that

22

Anthem’s Personal Information (Including Social Security Number) Privacy Protection Policy has

23

not changed since 2010, and has been publicly available on Anthem’s website since that time.

24

SAC ¶ 165. Finally, Plaintiffs allege that Defendants violated the UCL’s fraud prong under both

25

an affirmative misrepresentation and fraudulent omission theory of liability. Id. ¶ 542. Under

26

either liability theory, Plaintiffs state that they “would not have enrolled in Defendants’ insurance

27
28

61
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

and health benefit services . . . had [they] known about Defendants’ substandard data security

2

practices.” Id.

3

In response, Defendants claim that “[n]o Plaintiff [has] allege[d] that he or she reviewed or

4

relied on any Anthem data security practices at the time he or she enrolled or re-enrolled in an

5

Anthem plan.” Anthem Mot. at 16. Plaintiffs’ apparent failure to comply with this actual reliance

6

requirement, Defendants argue, is fatal to their UCL claim. Because the actual reliance

7

requirement operates somewhat differently for omission and misrepresentation claims, the Court

8

considers these claims separately.

9
10

a. Fraudulent Omission
In most cases, “a plaintiff in a fraud by omission suit will not be able to specify the time,

United States District Court
Northern District of California

11

place, and specific content of an omission as precisely as would a plaintiff in a false representation

12

claim.” Falk v. Gen. Motors Corp., 496 F. Supp. 2d 1088, 1098–99 (N.D. Cal. 2007); see also

13

Gold v. Lumber Liquidators, Inc., 2015 WL 7888906, *10 (N.D. Cal. Nov. 30, 2015) (same).

14

Accordingly, “a fraud by omission or fraud by concealment claim can succeed without the same

15

level of specificity required by a normal fraud claim.” Baggett v. Hewlett-Packard Co., 582 F.

16

Supp. 2d 1261, 1267 (C.D. Cal. 2007) (internal quotation marks omitted); accord MacDonald v.

17

Ford Motor Co., 37 F. Supp. 3d 1087, 1096 (N.D. Cal. 2014) (“[C]laims based on an omission can

18

succeed without the same level of specificity required by a normal fraud claim[,] . . . [b]ecause the

19

plaintiffs are alleging a failure to act instead of an affirmative act.”) (internal quotation marks and

20

alteration omitted); Montich v. Miele USA, Inc., 849 F. Supp. 2d 439, 451 (D.N.J. 2012) (“[The]

21

heightened [pleading] standard [under Rule 9(b)] is somewhat relaxed in a case based on a

22

fraudulent omission.”).

23

The natural consequence of such reasoning is, as the California Court of Appeal has stated,

24

that “[r]eliance can be prove[n] in a fraudulent omission case by establishing that had the omitted

25

information been disclosed, the plaintiff would have been aware of it and behaved differently.”

26

Hoffman v. 162 North Wolfe LLC, 175 Cal. Rptr. 3d 820, 833–34 (Ct. App. 2014). In In re

27
28

62
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Carrier IQ, a consumer class action involving an omission of “a material fact exclusively in

2

[d]efendant’s knowledge,” the district court determined that the actual reliance test, as stated in

3

Hoffman, could be met based on two factors. 78 F. Supp. 3d at 1114.
First, “[p]laintiffs have alleged that had they been aware of the [material fact], they would

4

not have purchased [their] affected mobile devices.” Id.; see also Elias v. Hewlett-Packard Co.,

6

2014 WL 493034, *6 (N.D. Cal. Feb. 5, 2014) (“Plaintiff has adequately pleaded materiality by

7

alleging that he would have acted differently by not purchasing the computer as ordered had he

8

known about the insufficiency.”). Second, the In re Carrier IQ complaint “contain[ed] extensive

9

allegations regarding the public outcry regarding the [material fact] once its existence became

10

public knowledge—including media reports and Senator Franken sending letters of inquiry to

11
United States District Court
Northern District of California

5

mobile carriers. The intensity of their outcry underscores the materiality of the alleged omission.”

12

78 F. Supp. 3d at 1114.
Both of these factors are also at play in the instant case. Here, the SAC alleges that

13
14

“Plaintiffs would not have enrolled in Defendants’ insurance and health benefit services if they

15

had known about Defendants’ substandard data security practices.” SAC ¶ 542; see also id. ¶ 185

16

(same). Moreover, the public response following the Anthem data breach has been as extensive as

17

the response in In re Carrier IQ. Approximately 80 million Americans have been affected by the

18

breach, at least 130 individual cases have been brought in state and federal court, and several state

19

attorneys general have written letters to Anthem requesting that Anthem take more immediate

20

measures to address the fallout from the breach. SAC ¶ 384 n.21.
Thus, under the reasoning of Hoffman and In re Carrier IQ, the Court finds that Plaintiffs

21
22

have sufficiently pleaded actual reliance for purposes of stating a UCL violation based on

23

Defendants’ alleged fraudulent omissions.9

24
25
26
27
28

9

Some courts have suggested that the actual reliance requirement also applies to unlawful and
unfair claims “to the extent [that] the predicate unlawful [or unfair] conduct is based on
misrepresentations.” Doe v. SuccessfulMatch.Com, 70 F. Supp. 3d 1066, 1075–76 (N.D. Cal.
2014) (internal quotation marks omitted). Although the California Supreme Court has not yet
63
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

b. Affirmative Misrepresentation

1
2

Determining whether Plaintiffs’ have sufficiently alleged actual reliance for purposes of

3

affirmative misrepresentation liability is a harder question—and one that has caused significant

4

disagreement amongst courts in this district. Compare, e.g., Opperman v. Path, Inc., 84 F. Supp.

5

3d 962, 978 (N.D. Cal. 2015) (“If a plaintiff sufficiently alleges exposure to a long-term

6

advertising campaign [for purposes of a misrepresentation claim], she need not plead specific

7

reliance on an individual representation.”), with Yastrab v. Apple Inc.¸ 2016 WL 1169424, *6

8

(N.D. Cal. Mar. 25, 2016) (“[T]he court disagrees with Opperman to the extent it holds that a . . .

9

plaintiff is . . . excused from complying with Rule 9(b) when pleading a long-term advertising

10

United States District Court
Northern District of California

11

campaign.”).
The heart of this disagreement lies in how the California Supreme Court’s opinion in In re

12

Tobacco II Cases should be interpreted. In In re Tobacco II, 207 P.3d 20, 28 (Cal. 2009),

13

plaintiffs sought to represent a class comprised of all “people [who] smoked in California one or

14

more cigarettes during the applicable class period and were exposed to Defendants’ marketing and

15

advertising activities in California.” While the In re Tobacco II case was pending in trial court,

16

California voters enacted Proposition 64, which imposed “an actual reliance requirement on

17

plaintiffs prosecuting a private enforcement action under the UCL’s fraud prong.” Id. at 39.

18

In interpreting this requirement in the affirmative misrepresentation context, the California

19

Supreme Court noted that, “[w]hile a plaintiff must show that the misrepresentation was an

20

immediate cause of the injury-producing conduct” for purposes of actual reliance, “the plaintiff

21

need not demonstrate [that] it was the only cause.” Id. “It is enough that the representation has

22

played a substantial part, and so had been a substantial factor, in influencing his decision.” Id.

23

Moreover, a plaintiff does not necessarily “need to demonstrate individualized reliance on specific

24
25
26
27
28

addressed this issue, because Plaintiffs have sufficiently alleged actual reliance for purposes of
fraudulent omissions liability, Plaintiffs have also sufficiently alleged actual reliance under the
unfair and unlawful prongs.
64
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

misrepresentations to satisfy the reliance requirement.” Id. at 40. Instead, “where, as here, a

2

plaintiff alleges exposure to a long-term advertising campaign, the plaintiff is not required to plead

3

with an unrealistic degree of specificity that the plaintiff relied on particular advertisements or

4

statements.” Id. The In re Tobacco II court summarized its conclusions thusly: “a plaintiff must

5

plead and prove actual reliance to satisfy the standing requirement of [the UCL] but, consistent

6

with the principles set forth above, is not required to necessarily plead and prove individualized

7

reliance on specific misrepresentations or false statements where . . . those misrepresentations and

8

false statements were part of an extensive and long-term advertising campaign.” Id. at 40–41.

9

Although In re Tobacco II appeared to relax Rule 9(b)’s requirements when a defendant’s
misrepresentations are “extensive and long-term,” there has been considerable uncertainty over the

11
United States District Court
Northern District of California

10

scope of this exception. In Mazza v. American Honda Motor Co., Inc., 666 F.3d 581, 595–96 (9th

12

Cir. 2012), for example, the Ninth Circuit held that a series of “product brochures and TV

13

commercials” fell “short of the extensive and long-term fraudulent advertising campaign at issue

14

in Tobacco II.” Id. at 596 (internal quotation marks and alteration omitted).

15

In an attempt to bring clarity to In re Tobacco II, U.S. District Judge Jon Tigar, in

16

Opperman v. Path, “identified six factors from the prior case law that bear on whether a plaintiff

17

has pleaded an advertising campaign in accordance with Tobacco II.” 84 F. Supp. 3d at 976.

18

Those factors are as follows:

19
20
21
22
23
24
25
26
27
28

First, a plaintiff must allege that she actually saw or heard the defendant’s
advertising campaign. Second, the advertising campaign must be sufficiently
lengthy in duration, and widespread in dissemination, that it would be unrealistic
to require the plaintiff to plead each misrepresentation she saw and relied upon.
Third, the plaintiff must describe in the complaint, and preferably attach to it, a
representative sample of the advertisements at issue so as to adequately notify the
defendant of the precise nature of the misrepresentation claim—what, in
particular, defendant is alleged to have said, and how it was misleading. Fourth,
the plaintiff must allege, and the court must evaluate, the degree to which the
alleged misrepresentations contained within the advertising campaign are similar
to each other. Fifth, each plaintiff must plead with particularity, and separately,
when and how they were exposed to the advertising campaign, so as to ensure the
advertisements were representations consumers were likely to have viewed, rather
65
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2
3
4

than representations that were isolated or more narrowly disseminated. And
finally, sixth, the court must be able to determine when a plaintiff made his or her
purchase or otherwise relied on defendant’s advertising campaign, so as to
determine which portion of that campaign is relevant.
Id. at 976–77. Other courts, including this Court, have followed the Opperman test in whole or in
part. See, e.g., Phillips v. Apple Inc., 2016 WL 1579693, *7 (N.D. Cal. Apr. 19, 2016) (citing

5

Opperman for the principle that a misrepresentation “claim requires plaintiffs to plead reliance on

6

at least some misleading partial representations.”) (alteration omitted); People for the Ethical

7
8
9
10

United States District Court
Northern District of California

11

Treatment of Animals v. Whole Foods Mkt. Cal., Inc., 2016 WL 362229, *5 (N.D. Cal. Jan. 29,
2016) (applying Opperman). On the other hand, some courts, as noted above, have found the
Opperman analysis to be in conflict with the more demanding pleading requirements of Rule 9(b).
See, e.g., Yastrab, 2016 WL 1169424, *5–*6 (citing cases).
In any event, the Court need not decide whether the six factor test in Opperman applies

12

here because, even if it did, the SAC’s allegations would be unable to sufficiently establish actual

13

reliance as to Plaintiffs’ affirmative misrepresentation claim. Indeed, Plaintiffs have failed to

14

satisfy the first Opperman factor: “a plaintiff must allege that she actually saw or heard the

15

defendant’s advertising campaign.” 84 F. Supp. 3d at 976. There are eleven California Plaintiffs.

16

None allege that they saw, read, or—for that matter—even knew about Anthem’s privacy policies

17
18
19

prior to the data breach. After examining the nearly 300 pages in the SAC, the Court has
identified a single sentence that refers to reliance: “In reliance upon [Defendants’ negligent]
misrepresentations, Plaintiffs . . . purchased insurance or health benefits services from

20

Defendants.” SAC ¶ 523. This is the sort of sentence that even the Opperman court found

21

insufficient for purposes of UCL liability. 84 F. Supp. 3d at 978 (stating that the “single and bare

22

allegation that [p]laintiffs viewed Apple’s website, saw in-store advertisements, and/or were aware

23

of Apple’s representations regarding the safety and security of the iDevices prior to purchasing

24
25
26
27
28

their own iDevices” does not satisfy In re Tobacco II) (internal quotation marks omitted).
Consequently, Defendants’ motions to dismiss Plaintiffs’ UCL claim under the fraud prong
as it relates to a misrepresentation theory of liability is GRANTED. Plaintiffs, though, shall have
66
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

leave to amend. It is possible that, after amendment, California Plaintiffs will be able to allege

2

that they viewed, heard, or read Defendants’ privacy policies, and thus relied upon these policies

3

to purchase insurance or health benefits services. Amendment would thus not be futile.

4
5
6
7

F. New York General Business Law § 349 (against Anthem and Non-Anthem
Defendants)
New York General Business Law (“GBL”) § 349 prohibits “[d]eceptive acts or practices in
the conduct of any business, trade or commerce or in the furnishing of any service.” N.Y. Gen.
Bus. § 349(a). To successfully assert a claim under this section, “a plaintiff must allege that a

8
defendant has engaged in (1) consumer-oriented conduct that is (2) materially misleading and that
9
(3) plaintiff suffered injury as a result of the allegedly deceptive act or practice.” Orlander v.
10

United States District Court
Northern District of California

11
12
13

Staples, Inc., 802 F.3d 289, 300 (2d Cir. 2015). In moving to dismiss Plaintiffs’ GBL § 349 claim,
Defendants contend, as to (3), that Plaintiffs have failed to “state with particularity the time that
the specific misrepresentations [at issue] occurred,” and that Plaintiffs have “not alleged any actual
harm,” Anthem Mot. at 18, 20. The Court addresses these arguments in turn.

14
1. Rule 9(b) and GBL § 349
15
As to whether Plaintiffs have pleaded their GBL § 349 claim with sufficient particularity,
16
17

Defendants’ contention rests upon the fact that the Court should have, in the First Motion to
Dismiss Order, applied Rule 9(b) to Plaintiffs’ GBL § 349 claim.

18
This argument is problematic in two respects. First, GBL § 349 is a New York state law,
19
and New York is in the Second Circuit. The Second Circuit has expressly held that Rule 9(b) does
20
21

not apply to GBL § 349 claims. Pelman ex rel. Pelman v. McDonald’s Corp, 396 F.3d 508, 511
(2d Cir. 2005) (“[A]n action under § 349 is not subject to the pleading-with-particularity

22
requirements of Rule 9(b), but need only meet the bare-bones notice-pleading requirements of
23
24

Rule 8(a).”) (citation omitted). This Court, as the MDL transferee court, “is generally bound by
the same substantive legal standards . . . as would have applied in the transferor court.” In re

25
Korean Air, 642 F.3d at 699. Thus, had this suit stayed in or been transferred to New York,
26
27
28

67
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Defendants do not dispute that the New York federal district court would not have applied Rule

2

9(b) to Plaintiffs’ GBL § 349 claim. Second, the Ninth Circuit has never held that Rule 9(b)

3

should apply to GBL § 349. The only courts to have done so are district courts in the Central and

4

Northern Districts of California, and these courts did so with little analysis or review of pertinent

5

New York or Second Circuit precedent.

6

In any event, the Court need not decide whether Rule 9(b) applies to Plaintiffs’ GBL § 349
claim. As Defendants acknowledge, Plaintiffs’ GBL § 349 claim rises and falls with Plaintiffs’

8

UCL claim brought under the fraud prong. Anthem Mot. at 19 (“The Court’s Rule 9(b) analysis

9

under the UCL . . . applies here [to Plaintiffs’ GBL § 349 claim] with equal force.”) (internal

10

quotation marks omitted). Because the Court has determined that Plaintiffs’ UCL fraud claim

11
United States District Court
Northern District of California

7

under a fraudulent omissions theory satisfies the requirements of Rule 9(b), Plaintiffs’ GBL § 349

12

claim also survives dismissal.

13

2. Damages

14

Next, Defendants contend that Plaintiffs can not seek Loss of Value of PII and that the

15

Court misread the Second Circuit’s decision in Orlander v. Staples in finding, in the First Motion

16

to Dismiss Order, that Plaintiffs could seek Benefit of the Bargain Losses. Anthem Mot. at 20.

17

Both arguments lack merit. As outlined above, Plaintiffs may recover damages for Loss of

18

Value of PII as to their California breach of contract and New Jersey breach of contract claims.

19

Defendants have identified no authority as to why this holding should not also apply to Plaintiffs’

20

GBL § 349 claim. In addition, the Court did not misread Orlander. In Orlander, the Second

21

Circuit determined that plaintiff had “sufficiently alleged an injury stemming from [a] misleading

22

practice” by stating that “he would not have purchased [a set of services] had he known that

23

[d]efendant intended to decline to provide him any [such] services” during the first year of his

24

contract. 802 F.3d at 301. That reasoning, the Court determined, “directly govern[ed] Plaintiffs’

25

claim” for Benefit of the Bargain Losses. First MTD Order at 48. This conclusion regarding

26

Orlander continues to apply: Defendants promised to implement certain security measures,

27
28

68
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Defendants allegedly failed to implement such measures, and Plaintiffs would not have entrusted

2

their PII to Defendants had Defendants disclosed Defendants’ alleged failure to implement such

3

measures.
However, as noted above, New York Plaintiff Marne Onderdonk has not alleged that she

4
5

paid premiums or fees for health services. Thus, based on the allegations in the SAC, Onderdonk

6

can not recover Benefit of the Bargain Losses. Consistent with the Court’s ruling on Onderdonk’s

7

unjust enrichment claim, Plaintiffs shall have leave to amend Onderdonk’s GBL § 349 claim, as

8

amendment may not be futile. The Court thus GRANTS with leave to amend Defendants’

9

motions to dismiss Onderdonk’s claim for Benefit of the Bargain Losses under GBL § 349.

10

Defendants’ motions to dismiss Plaintiffs’ GBL § 349 claim are otherwise DENIED.

United States District Court
Northern District of California

11

G. Georgia Insurance Information and Privacy Protection Act (against Anthem
Defendants)

12

The Georgia Insurance Information and Privacy Protection Act (“IIPA”) states that “[a]n

13
insurance institution, agent, or insurance-support organization shall not disclose any personal or
14
privileged information about an individual collected or received in connection with an insurance
15
transaction” unless the disclosure falls under a set of specific exceptions. Ga. Code Ann. § 33-3916
14.
17
18

In the First Motion to Dismiss Order, the Court dismissed Plaintiffs’ IIPA claim with leave
to amend. The Court determined that the parties had presented “an issue of first impression:

19
whether the IIPA, which proscribes the unlawful disclosure of personal information, also applies
20

to the theft of one’s personal information.” First MTD Order at 59. After examining the statutory

21
text, case law, and other canons of statutory interpretation, the Court answered this question in the
22

negative. Id. at 59–65. As the Court noted, disclosure under the IIPA means “an active, voluntary

23
decision by the information holder to provide data to an unauthorized third party.” Id. at 63. That
24
25

is not what happened here: Plaintiffs’ PII was stolen by a group of cyberattackers.
In the SAC, Plaintiffs now assert that “

26
27
28

69
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
” SAC ¶ 1002. The parties dispute whether this new allegation

2
3

sufficiently satisfies the IIPA’s disclosure requirement. Additionally, the Anthem Defendants

4

argue that, even if Plaintiffs’ PII was affirmatively disclosed, Plaintiffs’ claim “fails because the

5

SAC does not allege facts showing the Georgia Plaintiffs incurred any actual damages.” Anthem

6

Mot. at 21. The Court need not address this damages argument because, after again examining the

7

IIPA’s text and pertinent case law, the Court finds that Plaintiffs’ new allegations fail to state a

8

claim for relief.

9
10

1. Statutory Text
As to the statutory text, the IIPA states that “[a]n insurance institution, agent, or insurance-

United States District Court
Northern District of California

11

support organization shall not disclose any personal or privileged information . . . unless the

12

disclosure” falls under a set of 18 exceptions. These exceptions allow the insurance institution,

13

agent, or insurance-support organization to disclose an individual’s personal information “[t]o a

14

medical-care institution or medical professional,” Ga. Code Ann. § 33-39-14(4), “[t]o an insurance

15

regulatory authority,” Ga. Code Ann. § 33-39-14(5), and “[t]o a law enforcement or other

16

governmental authority,” Ga. Code Ann. § 33-39-14(6), among other entities. The apparent

17

principle behind these exceptions is that the insurance institution, agent, or insurance-support

18

organization must intentionally provide an individual’s personal information to a third party:

19

disclosure, in other words, is meant to be intentional, not unintentional or unknowing.

20

Two other IIPA provisions lend support to this reading. First, Ga. Code Ann. § 33-39-22

21

states that “[n]o cause of action in the nature of . . . negligence shall arise against any person for

22

disclosing personal or privileged information in accordance with this chapter.” Ga. Code Ann. §

23

33-39-22 (emphasis added). However, Ga. Code Ann. § 33-39-22 goes on to note that “this Code

24

section shall provide no immunity for disclosing or furnishing false information with malice or

25

willful intent to injure any person.” Id. (emphasis added). Thus, Ga. Code Ann. § 33-39-22

26

clearly draws a distinction between negligent, unintentional acts and willful, intentional acts. The

27
28

70
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2

IIPA does not punish negligent, unintentional conduct; it punishes willful, intentional conduct.
Second, Ga. Code Ann. § 33-39-19, a section entitled “Monetary Penalties,” states: “[i]n

3

any case where a hearing . . . results in the finding of a knowing violation of this chapter, the

4

Commissioner [of Insurance of the State of Georgia] may . . . order payment of a monetary penalty

5

of not more than $500.00 for each violation but not to exceed $10,000.00 in the aggregate for

6

multiple violations.” Ga. Code Ann. § 33-39-19 (emphasis added). Again, consistent with Ga.

7

Code Ann. § 33-39-22, Ga. Code Ann. § 33-39-19 seeks to penalize knowing conduct, not

8

unknowing conduct.

9

Considered together, Ga. Code Ann. § 33-39-14, Ga. Code Ann. § 33-39-22, and Ga. Code
Ann. § 33-39-19 evince an intent by the Georgia Legislature to prevent willful and knowing

11
United States District Court
Northern District of California

10

disclosure. The allegations in the SAC simply do not rise to this level. As the SAC states, “

12
13
14
15

” SAC ¶ 349. Nowhere in these allegations do Plaintiffs

16

aver that the Amerigroup employee knowingly or intentionally sought to disclose Plaintiffs’ PII.

17

Indeed, the SAC’s next paragraph states that “[t]he

18

and Anthem Affiliates did not . . .

attack occurred because Anthem

19

.” Id. ¶ 350 (emphasis added).

20

Plaintiffs also analogize the Anthem Defendants’ actions as being akin to “a company negligently

21

le[aving] the ‘bank vault’ open”—the exact sort of negligent conduct that the IIPA does not look

22

to punish. Id. ¶ 6; Ga. Code Ann. § 33-39-22.

23

The reasonable inference to draw from these allegations is that the employee in question

24

did not know that the

25

Database because Defendants did not provide

26

Thus, based on the statutory text, the SAC fails to state a claim under the IIPA.

27
28

would allow cyberattackers to access the Anthem
due to Defendants’ negligence.

71
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

2. Case Law

2

Case law lends additional weight to this conclusion. As the Court noted in its First Motion

3

to Dismiss Order, the Federal Privacy Act defines “disclosure” to “mean[] providing personal

4

review of a record, or a copy thereof, to someone other than the data subject or the data subject’s

5

authorized representative.” 5 C.F.R. § 297.102. First MTD Order at 61. The First Motion to

6

Dismiss Order went on to observe that courts have restricted this definition to situations where

7

information holders have willfully provided data to an unauthorized third party.

8
9

In Walia v. Chertoff, 2008 WL 5246014, *6 (E.D.N.Y. Dec. 17, 2008), for instance,
plaintiff’s medical and legal records were placed in an unlocked credenza located in the office of
plaintiff’s supervisor. Other employees, including those not authorized to review plaintiff’s

11
United States District Court
Northern District of California

10

medical and legal records, had access to this office. Upon learning these facts, plaintiff brought

12

suit against his employer. The Walia court rejected plaintiff’s Federal Privacy Act claim and held

13

that plaintiff’s claim rested on “the accessibility of [plaintiff’s] medical and legal records to

14

individuals in the office.” Id. at *11. Mere accessibility, however, is insufficient to constitute

15

“willful or intentional disclosure by the agency, a required element of a [Federal Privacy Act]

16

claim.” Id. As in Walia, Plaintiffs’ IIPA claim continues to pivot around the idea of access and

17

accessibility, and not willful and active disclosure. See SAC ¶ 1002 (“Anthem . . . allowed the

18

cyberattackers to see and obtain individually-identifiable [PII].”).

19

In re SAIC, another case that the Court discussed in its First Motion to Dismiss Order, also

20

suggests that disclosure requires some sort of knowledge or intent. See, e.g., 45 F. Supp. 3d at 29

21

(describing disclosure as the “imparting of information which . . . was previously unknown to the

22

person to whom it was imparted.”).

23

Finally, in the First Motion to Dismiss Order, the Court found inapposite Plaintiffs’

24

reliance upon Shames-Yeakel v. Citizens Financial Bank, 677 F. Supp. 2d 994, 1008 (N.D. Ill.

25

2009). In Shames-Yeakel, the district court stated that “[i]f th[e] duty not to disclose customer

26

information is to have any weight in the age of online banking, then banks must certainly employ

27
28

72
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

sufficient security measures to protect their customers’ online accounts.” Id. This holding,

2

however, was problematic in two ways. First, the decision was, “at the very least, in tension with”

3

binding Seventh Circuit precedent. First MTD Order at 63. The Shames-Yeakel court did not

4

discuss or refer to the Seventh Circuit’s opinion in Pisciotta v. Old National Bancorp, 499 F.3d

5

629 (7th Cir. 2007), which would have precluded plaintiffs in Shames-Yeakel from proceeding

6

with their claims as a matter of law. Second, and of importance to the instant motion, “with

7

respect to the specific statement quoted by Plaintiffs—that a bank’s duty not to disclose must

8

include a duty to protect customers’ personal information—the Shames-Yeakel court did not

9

discuss, refer to, or cite any supporting authority.” First MTD Order at 64. “In the nearly six and
a half years since the Shames-Yeakel decision, no federal or state court has cited Shames-Yeakel

11
United States District Court
Northern District of California

10

for this proposition.” Id. That fact remains unchanged since the First Motion to Dismiss Order

12

was issued on February 14, 2016.

13
14

As alleged in the SAC, Plaintiffs’ IIPA claim is little more than an attempt to have the
Court adopt Shames-Yeakel in substance if not in name. Indeed, as Plaintiffs state, “[t]he

15

attack occurred because Anthem and Anthem Affiliates did not use [data security]

16

practices consistent with industry standards.” SAC ¶ 350 (emphasis added). What the Anthem

17

Defendants should have done, according to Plaintiffs, is “
.” Id. That request for

18
19

relief is no different from the finding in Shames-Yeakel that the “duty to disclose” requires banks

20

to “employ sufficient security measures to protect their customers’ online accounts.” 677 F. Supp.

21

2d at 1008. The Court declined to follow Shames-Yeakel in the First Motion to Dismiss Order,

22

and declines now to adopt a reading of the IIPA that would essentially adopt Shames-Yeakel in

23

substance. Walia and In re SAIC remain more persuasive, and argue against Plaintiffs’ reading of

24

the IIPA.

25

Accordingly, the Court GRANTS Anthem Defendants’ motion to dismiss Plaintiffs’ IIPA

26

claim. In addition, the Court declines to provide Plaintiffs leave to amend, as amendment would

27
28

73
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

be futile. The Court has already provided Plaintiffs an opportunity to amend. However, Plaintiffs

2

have not—in either the CAC or the SAC—alleged that the Anthem Defendants intentionally or

3

knowingly allowed cyberattackers to access the Anthem Database. Rather, the gist of Plaintiffs’

4

case is that “Defendants failed to implement basic industry-accepted data security tools to prevent

5

cyberattackers from accessing the Anthem Database.” SAC ¶ 5. In fact, according to Plaintiffs,

6

Defendants’ data security was so lacking that Defendants did not even know that the Anthem

7

Database had been breached until January 27, 2015—more than two months after cyberattackers

8

connected to the Anthem Database. Id. ¶¶ 355, 366. In sum, Plaintiffs’ case does not provide for

9

IIPA liability. The Anthem Defendants’ motion to dismiss Plaintiffs’ IIPA claim is therefore

10

United States District Court
Northern District of California

11
12

GRANTED with prejudice.
H. Federal Law Third Party Beneficiary (against Non-Anthem Defendants)
The Court turns next to Plaintiffs’ third party beneficiary claim for breach of contract

13

under federal law. On this claim, Plaintiffs assert that Blue Cross Blue Shield Association

14

(“BCBSA”) “had a valid, binding, and enforceable express contract with OPM [the Office of

15

Personnel Management] to provide insurance and other benefits to those [Federal Employee]

16

Plaintiffs who received health insurance and related benefits under the Federal BCBSA Plan.”

17

SAC ¶ 503. This contract is hereinafter referred to as the “Federal BCBSA contract.”

18

The Court denied the Non-Anthem Defendants’ motion to dismiss this claim in the First

19

Motion to Dismiss Order. See First MTD Order 65–80. In reaching this determination, the Court

20

found that the Federal Employee Plaintiffs were “intended third party beneficiaries of the Federal

21

BCBSA contract,” id. at 66; that the Federal Employee Plaintiffs’ claim was not a claim for

22

“health benefits,” id. at 70; and that OPM did not have exclusive enforcement authority over a

23

breach of the Federal BCBSA contract, id. at 72–76.

24

The Non-Anthem Defendants do not challenge any of these conclusions. Instead, the Non-

25

Anthem Defendants’ arguments largely repeat those addressed in earlier portions of the instant

26

Order: (1) that Plaintiffs can not recover Benefit of the Bargain Losses because OPM—and not

27
28

74
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Plaintiffs—“paid money to BCBSA,” (2) that Plaintiffs can not recover for Loss of Value of PII,

2

(3) and that time spent “addressing issues arising from the Anthem data breach” is “insufficient to

3

show cognizable contract damages.” Non-Anthem Mot. at 13–14. For the reasons stated below,

4

the Court finds these arguments are unavailing.

5

“When the United States enters into contract relations, its rights and duties therein are

6

governed generally by the law applicable to contracts between private individuals.” Mobil Oil

7

Expl. & Producing Se., Inc. v. United States, 530 U.S. 604, 607 (2000); see also Interface Kanner,

8

LLC v. JPMorgan Chase Bank, N.A., 704 F.3d 927, 932 (11th Cir. 2013) (“When interpreting

9

contracts under federal law, courts look to general common law on contracts.”). In determining
the nature of the general common law on contracts, the U.S. Supreme Court has previously looked

11
United States District Court
Northern District of California

10

to the Restatement of Contracts. Mobil Oil, 530 U.S. at 608 (“The Restatement of Contracts

12

reflects many of the principles of contract law that are applicable to this action.”).

13

On damages, the Restatement allows parties to recover expectation, reliance, and

14

restitution damages. Restatement (Second) of Contracts § 344. The Restatement defines

15

expectation damages as a party’s “interest in having the benefit of his bargain by being put in as

16

good a position as he would have been in had the contract been performed.” Id. Reliance

17

damages are a party’s “interest in being reimbursed for loss caused by reliance on the contract by

18

being put in as good a position as he would have been in had the contract not been made.” Id.

19

Finally, restitution damages “restore[] to [a party] any benefit that he has conferred on the other

20

party.” Id. Where possible, “contract damages” should “protect an injured party’s ‘expectation

21

interest’—that is, the interest in having the benefit of the bargain.” ATACS Corp. v. Trans World

22

Commc’ns, Inc., 155 F.3d 659, 669 (3d Cir. 1998). However, “other theories of damages provide

23

alternative avenues for contract enforcement” where the expectation interest may be uncertain. Id.

24

1. Benefit of the Bargain Losses

25

Plaintiffs’ request for Benefit of the Bargain Losses plainly constitutes a request for

26

expectation damages. Such damages, as noted above, are the preferred basis for contract recovery.

27
28

75
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

The Non-Anthem Defendants do not contest this point. Instead, the Non-Anthem Defendants

2

argue only that OPM bargained with BCBSA, and that therefore only OPM can recover for

3

Benefit of the Bargain Losses.

4

General contract law principles, however, do not support this contention. As the Court has

5

previously determined, the Federal Employee Plaintiffs are intended third party beneficiaries who

6

may assert against BCBSA a breach of contract claim. In the context of such third party

7

beneficiary claims, courts have repeatedly held that the beneficiary may seek to enforce rights and

8

recover damages that were available to the contracting party. See, e.g., Beckett v. Air Line Pilots

9

Ass’n, 995 F.2d 280, 286 (D.C. Cir. 1993) (“[I]t is a fundamental principle of contract law that
parties to a contract may create enforceable contract rights in a third party beneficiary.”); Gen. Ins.

11
United States District Court
Northern District of California

10

Co. of Am. v. Interstate Serv. Co., 701 A.2d 1213, 1218 (Md. Ct. Spec. App. 1997) (holding that

12

“the third party beneficiary rule followed by the majority of jurisdictions in this country” allows

13

“third party beneficiary[] rights [that] are [as] extensive [as] those rights provided by the express

14

terms of the contract”) (alteration omitted); Restatement (Second) of Contracts § 304 (“A promise

15

in a contract creates a duty in the promisor to any intended beneficiary to perform the promise, and

16

the intended beneficiary may enforce the duty.”). Thus, under these principles, Plaintiffs may, as

17

intended third party beneficiaries, recover Benefit of the Bargain Losses.

18

The Non-Anthem Defendants’ attempt to obscure the financial relationship between

19

Plaintiffs and BCBSA is inapposite. Specifically, the Non-Anthem Defendants state that BCBSA

20

“do[es] not receive premiums as they are paid into [the Employees Health Benefits] Fund.” Non-

21

Anthem Reply at 10. Instead, all “premiums are placed in a special letter of credit account.” Id.

22

BCBSA then “draw[s] directly from the letter of credit account to pay for benefit claims and . . .

23

administrative expenses.” Id. This sort of arrangement does nothing to change the financial

24

relationship between Plaintiffs and BCBSA. Plaintiffs paid premiums, which were placed in an

25

account, from which BCBSA drew to pay expenses. The fundamental relationship stays the same:

26

Plaintiffs paid the Non-Anthem Defendants for services, and Plaintiffs now allege that the Non-

27
28

76
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Anthem Defendants did not perform these services as promised. Plaintiffs may recover Benefit of

2

the Bargain Losses for the alleged breach by bringing suit as an intended third party beneficiary.

3

2. Loss of Value of PII

4

Next, as to Loss of Value of PII, such damages implicate the reliance interest, defined as a
party’s “interest in being reimbursed for loss[es] caused by reliance on the contract by being put in

6

as good a position as he would have been in had the contract not been made.” Restatement

7

(Second) of Contracts § 344. Reliance damages are recoverable where the expectation interest is

8

difficult to ascertain. See, e.g., Glendale Fed. Bank, FSB v. United States, 239 F.3d 1374, 1380–

9

1383 (Fed. Cir. 2001) (awarding reliance damages after concluding that expectation interest would

10

be too difficult to quantify). Here, it remains unclear whether Plaintiffs will be able to sufficiently

11
United States District Court
Northern District of California

5

calculate their expectation or Benefit of the Bargain damages. Furthermore, a growing number of

12

federal courts have now recognized Loss of Value of PII as a viable damages theory, perhaps

13

indirectly acknowledging the difficulty in calculating Benefit of the Bargain Losses. See, e.g., In

14

re Facebook, 572 F. App’x at 494. Accordingly, given the uncertainty in this case as to Plaintiffs’

15

Benefit of the Bargain Losses and the trend towards recognizing Loss of Value of PII, Plaintiffs’

16

request for Loss of Value of PII does not warrant dismissal.

17

3. Consequential Out of Pocket Expenses

18

Lastly, Plaintiffs’ request for Consequential Out of Pocket Expenses also implicates the

19

reliance interest. See Boulevard Assocs. v. Sovereign Hotels, Inc., 861 F. Supp. 1132 (D. Conn.

20

1994) (stating that consequential damages are reliance damages). As with Plaintiffs’ request for

21

Loss of Value of PII, a growing number of courts now recognize that individuals may be able to

22

recover Consequential Out of Pocket Expenses that are incurred because of a data breach,

23

including for time spent reviewing one’s credit accounts. See, e.g., Lewert, 2016 WL 1459226,

24

*3. The Court found these authorities persuasive as to Plaintiffs’ California and New Jersey

25

breach of contract claims, and does the same here. Accordingly, the Non-Anthem Defendants’

26

motion to dismiss Plaintiffs’ third party beneficiary claim under federal law is DENIED.

27
28

77
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2
3
4
5
6
7
8
9
10

I. ERISA Preemption (against Anthem and Non-Anthem Defendants)
Finally, Defendants contend that some (but not all) of the claims brought by certain
Plaintiffs are subject to ERISA preemption. Anthem Mot. at 23–25; Non-Anthem Mot. at 11–12.
The specific claims at issue are detailed below.
Named Plaintiff
Kenneth Coonce
Joseph Blanchard
Daniel Tharp
Kelly Tharp
Lillian Brisko
Matthew Gates

Claims at Issue
California UCL
California Breach of Contract
California UCL
California UCL
California UCL
California UCL
New York GBL § 349
New York Unjust Enrichment

The Court finds Defendants’ contentions unavailing, because (1) Defendants are precluded

United States District Court
Northern District of California

11

from asserting an ERISA preemption defense as to Plaintiffs’ UCL claims, (2) the presumption

12

against preemption applies, (3) Defendants’ privacy obligations are not “benefits” for purposes of

13

ERISA express or complete preemption, and (4) even if Defendants’ privacy obligations were

14

considered “benefits,” there is a genuine dispute concerning whether Plaintiffs’ ERISA employee

15
16
17
18
19
20
21
22
23
24
25

benefit plan incorporated these obligations. These reasons are discussed in detail below.
1. Waiver
In the first round motions to dismiss, Defendants asserted ERISA preemption as to the
California breach of contract claims of Kenneth Coonce, Daniel Tharp, and Kelly Tharp.
Defendants also asserted ERISA preemption as to the New York unjust enrichment and GBL §
349 claims of Matthew Gates. ECF No. 410 at 11–12; 22. Defendants did not, however, assert
ERISA preemption as to Plaintiffs’ UCL claim.
Federal Rule of Civil Procedure 12(g)(2) states that “[e]xcept as provided in Rule 12(h)(2)
or (3), a party that makes a motion under this rule must not make another motion under this rule
raising a defense or objection that was available to the party but omitted from its earlier motion.”
Federal Rule of Civil Procedure 12(h)(2), in turn, provides that arguments which pertain to a

26
27
28

78
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

plaintiff’s “[f]ailure to state a claim upon which relief can be granted . . . may be raised: (A) in any

2

pleading allowed or ordered under Rule 7(a); (B) by a motion under Rule 12(c); or (C) at trial.”10

3

To summarize, under Rule 12(g)(2) and Rule 12(h)(2), a party that seeks to assert a defense that

4

was available but omitted from an earlier Rule 12 motion can only do so in a pleading, a Rule

5

12(c) motion, or at trial.

6

Here, Defendants have asserted, for the first time, an ERISA preemption defense as to

7

Plaintiffs’ UCL claim, which Defendants did not assert in their first round motions to dismiss.

8

Defendants have not asserted this defense in a pleading, a Rule 12(c) motion, or at trial—the only

9

exceptions listed under Rule 12(g)(2). Instead, Defendants have asserted this defense in a second
round motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). Defendants are

11
United States District Court
Northern District of California

10

foreclosed from doing so because of Rule 12(g)(2) and Rule 12(h)(2).
Indeed, despite two rounds of briefing, Defendants have not explained why they did not

12
13

assert ERISA preemption as to Plaintiffs’ UCL claim in their first round motions to dismiss. Like

14

the SAC, the CAC included enrollment information on the health insurance or health services

15

plans for each California Plaintiff. See, e.g., ECF No. 334-6 ¶¶ 15–24. Moreover, the fact that

16

Defendants asserted ERISA preemption as to the California breach of contract claims of Kenneth

17

Coonce, Daniel Tharp, and Kelly Tharp suggests that Defendants knew which Plaintiffs were

18

enrolled in ERISA plans.
A number of cases lend additional support to the Court’s application of waiver here. First,

19
20

in Herron v. Best Buy Stores, LP, 2013 WL 4432019, *4 (E.D. Cal. Aug. 16, 2013), defendant

21

Toshiba had “failed to squarely raise [an] argument in its initial dismissal motion, even though the

22

argument was available to Toshiba when it originally sought to dismiss Plaintiff’s complaint.”

23

Accordingly, “this portion of Toshiba’s dismissal motion [was] not considered.” Id. Similarly, in

24
25
26
27
28

10

Rule 12(h)(3), another exception to Rule 12(g)(2), does not apply to the instant claims. Rule
12(h)(3) allows parties to challenge subject matter jurisdiction at any point in litigation. Fed. R.
Civ. P. 12(h)(3). Subject matter jurisdiction is not at dispute here.
79
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Federal Agricultural Mortgage Corp. v. It’s A Jungle Out There, Inc., 2005 WL 3325051, *5

2

(N.D. Cal. Dec. 7, 2005), the district court stated that, “[a]lthough the Ninth Circuit has not had

3

occasion to apply this principle, the weight of authority outside this circuit holds that where the

4

complaint is amended after the defendant has filed a Rule 12(b) motion, the defendant may not

5

thereafter file a second Rule 12(b) motion asserting objections or defenses that could have been

6

asserted in the first motion.” See also Wright & Miller, 5C Federal Practice & Procedure § 1388,

7

491–95 (3d ed. 2004) (citing cases applying Rule 12(g)(2) and Rule 12(h)(2)).

8
9

Finally, this Court recently applied Rule 12(g)(2) and Rule 12(h)(2) in a substantially
similar situation in Northstar Financial Advisors Inc. v. Schwab Investments, 135 F. Supp. 3d
1059 (N.D. Cal. 2015). In Northstar, defendants had asserted a preemption defense based on the

11
United States District Court
Northern District of California

10

Securities Litigation and Uniform Securities Act (“SLUSA”) in moving to dismiss the second

12

amended complaint. Defendants did not assert SLUSA preclusion in moving to dismiss the third

13

amended complaint. Later, in moving to dismiss the fourth amended complaint, defendants once

14

again sought to assert SLUSA preclusion. As in the instant action, defendants did not provide an

15

explanation as to why they had previously abandoned their SLUSA preclusion defense. Id. at

16

1071–72. This Court concluded that defendants in Northstar could not assert SLUSA preclusion

17

in moving to dismiss the fourth amended complaint. Id. at 1072. Several courts have cited this

18

holding from Northstar with approval. See, e.g., Jaeger v. Howmedica Osteonics Corp., 2016 WL

19

520985, *4–*6 (N.D. Cal. Feb. 10, 2016); Johnson v. Serenity Transp., Inc., 2016 WL 270952, *7

20

(N.D. Cal. Jan. 22, 2016).

21
22

Accordingly, based on the authority above, the Court finds that Defendants are precluded
from asserting ERISA preemption as to Plaintiffs’ UCL claim.

23

2. Governing Principles Regarding ERISA Preemption

24

Defendants asserted ERISA preemption as to Coonce’s California breach of contract and

25

Gates’ New York unjust enrichment and GBL § 349 claims in their first round motions to dismiss.

26

In the First Motion to Dismiss Order, the Court dismissed with leave to amend Plaintiffs’

27
28

80
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

California breach of contract and New York unjust enrichment claims without reaching the

2

question of ERISA preemption, and requested additional briefing from the parties on whether

3

ERISA preemption apples to Gates’ GBL § 349 claim.

4

With this background in mind, the Court begins its ERISA preemption analysis on

5

Coonce’s California breach of contract and Gates’ New York unjust enrichment and GBL § 349

6

claims by taking note of two important considerations: the presumption against preemption and

7

the two forms of ERISA preemption.11
a. Presumption Against Preemption

8

First, the U.S. Supreme Court has repeatedly emphasized that there is a presumption

10

against federal preemption of state laws. See generally Wyeth v. Levine, 555 U.S. 555, 565 (2009)

11
United States District Court
Northern District of California

9

(“In all pre-emption cases . . . we start with the assumption that the historic police powers of the

12

States were not to be superseded by the Federal Act unless that was the clear and manifest purpose

13

of Congress.”) (quoting Medtronic, Inc. v. Lohr, 518 U.S. 470, 485 (1996)). As discussed at

14

greater length below, that presumption applies with equal force to cases involving ERISA

15

preemption. See, e.g., N.Y. State Conference of Blue Cross & Blue Shield Plans v. Travelers Ins.

16

Co., 514 U.S. 645, 654 (1995) (applying presumption against preemption in ERISA case). Indeed,

17

in De Buono v. NYSA-ILA Med. and Clinical Services Fund, 520 U.S. 806, 813–14 (1997), the

18

U.S. Supreme Court went so far as to remark that, “[i]n order to evaluate whether the normal

19

presumption against pre-emption has been overcome in a particular [ERISA] case,” a court “must

20

go beyond the unhelpful text [of ERISA] . . . and look instead to the objectives of the ERISA

21

statute as a guide to the scope of the state law that Congress understood would [or would not]

22

survive.”
b. Express and Complete Preemption

23
24
25
26
27
28

11

Although Rule 12(g)(2) and Rule 12(h)(2) apply to Defendants’ arguments as to the UCL, the
Court finds that the following reasons apply with equal force to Defendants’ ERISA preemption
arguments as to the UCL.
81
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Next, “[t]here are two strands of ERISA preemption: (1) ‘express’ preemption under

2

ERISA § 514(a), 29 U.S.C. § 1144(a); and (2) preemption due to a ‘conflict’ with ERISA’s

3

exclusive remedial scheme set forth in [ERISA § 502(a),] 29 U.S.C. § 1132(a).” Fossen v. Blue

4

Cross & Blue Shield of Mont., Inc., 660 F.3d 1102, 1107 (9th Cir. 2011). Most courts refer to this

5

latter form of preemption as “complete preemption.” Marin Gen. Hosp. v. Modesto & Empire

6

Traction Co., 581 F.3d 941, 944 (9th Cir. 2009); Wurtz v. Rawlings Co., 761 F.3d 232, 241 (2nd

7

Cir. 2014). The Court has also referred to ERISA § 502(a) preemption as “complete preemption”

8

in prior Orders, and does the same in the instant Order. See, e.g., In re Anthem, Inc. Data Breach

9

Litig.¸ 2015 WL 7443779, *3 (N.D. Cal. Nov. 24, 2015).

10

“Under § 514(a), ERISA broadly preempts any and all State laws insofar as they may now

United States District Court
Northern District of California

11

or hereafter relate to any covered employee benefit plan.” Fossen, 660 F.3d at 1108 (internal

12

quotation marks and alteration omitted) (emphasis added). “[T]he words ‘relate to,’” however,

13

“cannot be taken too literally.” Roach v. Mail Handlers Benefit Plan, 298 F.3d 847, 849 (9th Cir.

14

2002). “If ‘relate to’ were taken to extend to the furthest stretch of its indeterminacy, then for all

15

practical purposes pre-emption would never run its course, for ‘really, universally, relations stop

16

nowhere.’’” Travelers, 514 U.S. at 655 (alteration omitted). Instead, “relates to” must be “read in

17

the context of the presumption that in fields of traditional state regulation the historic police

18

powers of the States are not to be superseded by a Federal Act unless that was the clear and

19

manifest purpose of Congress.” Roach, 298 F.3d at 850 (internal quotation marks and alterations

20

omitted).

21

Under ERISA § 502(a), on the other hand, a civil enforcement action may be brought:

22

(1) by a participant or beneficiary— . . . (B) to recover benefits due to him under
the terms of his plan, to enforce his rights under the terms of the plan, or to clarify
his rights to future benefits under the terms of the plan.

23
24

29 U.S.C. § 1132(a). Pursuant to this provision, a “state-law cause of action that duplicates,

25

supplements, or supplants the ERISA civil enforcement remedy” is preempted because it

26

“conflicts with the clear congressional intent to make the ERISA remedy exclusive.” Aetna
82

27
28

Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2

Health Inc. v. Davila, 542 U.S. 200, 209 (2004).
Under U.S. Supreme Court precedent, both forms of ERISA preemption are subject to the

3

presumption against preemption. See Travelers, 514 U.S. at 655–56 (applying presumption to

4

ERISA express preemption); Rush Prudential HMO, Inc. v. Moran, 536 U.S. 355, 377–80, 387

5

(2002) (reviewing ERISA complete preemption precedent and concluding that “in the field of

6

health care, a subject of traditional state regulation, there is no ERISA preemption without clear

7

manifestation of congressional purpose.”) (alteration omitted). Both the Second and Ninth

8

Circuits, the circuits where Gates and Coonce respectively reside, are in accord. See, e.g.,

9

Stevenson v. Bank of N.Y. Co., Inc., 609 F.3d 56, 59 (2nd Cir. 2010) (“This circuit has previously
held that the analysis of ERISA preemption must start with the presumption that Congress does

11
United States District Court
Northern District of California

10

not intend to supplant state law.”) (internal quotation marks omitted); Wurtz, 761 F.3d at 237–38

12

(same). Indeed, as the Ninth Circuit observed in Dishman v. Unum Life Insurance Co. of America,

13

269 F.3d 974, 984 (9th Cir. 2001), “[w]e are certain that the objective of Congress in crafting

14

[ERISA § 514(a)] was not to provide ERISA administrators with blanket immunity from garden

15

variety torts which only peripherally impact daily plan administration.”

16

With the foregoing framework in mind, the Court notes also that no circuit court has ever

17

applied ERISA preemption—express or complete—to preclude a plaintiff from moving forward

18

with state law claims arising out of a data breach. Thus, by asking the Court to find Plaintiffs’

19

claims to be both expressly and completely preempted, Defendants have essentially requested that

20

the Court break new ground to find that the presumption against preemption is overcome in a field

21

where it has never been applied before. For the reasons that follow, the Court finds that

22

Defendants have failed to carry this burden.

23
24
25
26
27
28

3. Data Privacy and ERISA Express or Complete Preemption
a. Complete Preemption
ERISA § 502(a) completely preempts actions based upon state law “[1] to recover benefits
due to him under the terms of his plan, [2] to enforce his rights under the terms of the plan, or [3]
83
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2

to clarify his rights to future benefits under the terms of the plan.” 29 U.S.C. § 1132(a).
The parties have not cited any case law interpreting the meaning of [2], “to enforce his

3

rights under the terms of the plan,” and the Court has not found any Second or Ninth Circuit case

4

law on point. In fact, based on the Court’s review, the most pertinent discussion of this provision

5

appears to have been by the en banc Fifth Circuit in Arana v. Ochsner Health Plan, 338 F.3d 433

6

(5th Cir. 2003) (en banc). In Arana, the Fifth Circuit noted that, “one could [also] say that

7

[plaintiff] seeks to enforce his rights under the terms of the plan, for he seeks to determine his

8

entitlement to retain the benefits based on the terms of the plan.” Id. at 438.

9

With Arana in mind, the key inquiry here is thus whether Coonce and Gates’s claims are
for ERISA benefits, as all three parts of ERISA § 502(a) refer to benefits: recovering benefits

11
United States District Court
Northern District of California

10

owed, enforcing rights to retain benefits, and clarifying terms of future benefits. 29 U.S.C.

12

§ 1132(a), Arana, 338 F.3d at 438. To put it another way, ERISA complete preemption applies

13

where ERISA benefits are at issue, and does not apply when ERISA benefits are not at issue.

14

ERISA’s statutory text does not define the term “benefit.” However, several statutory

15

subsections suggest that benefits must concern payments for healthcare-related services. Under 29

16

U.S.C. § 1191b, for instance, a subsection addressing rules governing group health plans, the

17

subsection lists some examples of benefits, such as “[c]overage for on-site medical clinics,”

18

“dental or vision benefits,” and “[h]ospital indemnity or other fixed indemnity insurance.” 29

19

U.S.C. § 1191b. Likewise, 29 U.S.C. § 1133, the subsection that addresses claims processing,

20

requires all ERISA plans to “provide adequate notice in writing to any participant or beneficiary

21

whose claim for benefits under the plan has been denied” and to “afford a reasonable opportunity

22

[to be heard] to any participant whose claim for benefits has been denied.” 29 U.S.C. § 1133.

23

Notably, of the numerous mentions of the term “benefit” in ERISA, none suggest that protecting

24

customer PII should be considered an ERISA benefit.

25
26
27
28

Both the Second and Ninth Circuits have adopted a similar understanding. In Stevenson,
for example, the Second Circuit described ERISA’s “central” purpose as concerning “the
84
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

determination of eligibility for benefits, amounts of benefits, or means of securing unpaid

2

benefits.” 609 F.3d at 59. Laws that “tend to control or supersede” this central purpose “have

3

typically been found to be preempted.” Id. Similarly, in Wurtz, the Second Circuit determined

4

that tort damages that a plaintiff receives from an automobile accident, which may in fact overlap

5

or supplement the medical benefits that a plaintiff receives, should not be considered “benefits”

6

for purposes of ERISA § 502. 761 F.3d at 242–43. The Second Circuit counseled courts to read

7

“benefits” narrowly, and expressly disapproved of the district court’s “expansive interpretation of

8

complete preemption.” Id. at 242.
In reaching its decision, the Wurtz court cited the Ninth Circuit’s decision in Marin

10

General Hospital with approval. Id. at 244. In that case, the Ninth Circuit also read “benefits” in

11
United States District Court
Northern District of California

9

a limited manner, and found that not even a medical reimbursement claim was subject to ERISA

12

complete preemption. 581 F.3d at 950. The Marin General Hospital court, moreover, stated that

13

“[i]t is not enough for complete preemption that the contract and tort claims ‘relate to’ the

14

underlying ERISA plan, or that ERISA § 502(a)(1)(B) may provide a similar remedy.” Id. at 950.

15

Thus, Defendants’ point in the instant motions that individuals may obtain partial premium

16

refunds as a remedy under ERISA § 502(a) does not, standing by itself, mean that ERISA

17

complete preemption applies.

18

Although plaintiffs’ claims in Stevenson, Wurtz, and Marin General Hospital did appear to

19

relate to plaintiffs’ healthcare expenses (e.g., claims for medical reimbursement, tort damages

20

arising from medical injuries), the circuit courts in these cases nonetheless declined to apply

21

ERISA complete preemption. Instead, all three courts emphasized the importance of construing

22

ERISA benefits in a narrow manner. Here, unlike in Stevenson, Wurtz, and Marin General

23

Hospital, Plaintiffs’ claims do not even implicate medical or healthcare expenses. Plaintiffs

24

instead bring suit because Defendants failed to comply with certain privacy obligations—a legal

25

area where ERISA is silent.

26
27
28

As a final matter, in Marin General Hospital, the Ninth Circuit drew upon its reasoning in
85
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

Cedars-Sinai Medical Center v. National League of Postmasters of the United States, 497 F.3d

2

972 (9th Cir. 2007). See 581 F.3d at 950. In Cedars-Sinai, the Ninth Circuit declined to find that

3

a claim for “breach of contract and negligent misrepresentation in connection with partial

4

reimbursement of claims for medical treatment” was preempted by the Federal Employee Health

5

Benefits Act (“FEHBA”). Id. Although the Marin General Hospital court acknowledged that

6

“FEHBA and ERISA are different federal statutes,” id., it noted that “their preemption provisions

7

are analytically similar,” and are often interpreted together. Id.

8

This discussion of the interplay between FEHBA and ERISA provides yet another reason
to support the Court’s finding that Plaintiffs’ claims are not claims for ERISA benefits. In the

10

First Motion to Dismiss Order, the Court examined whether “Plaintiffs’ third party beneficiary

11
United States District Court
Northern District of California

9

claims [under FEHBA] constitute[d] health benefits claims” for purposes of the Federal BCBSA

12

contract. First MTD Order at 68. After examining federal regulations, case law, and the Federal

13

BCBSA contract’s text, the Court determined that “Plaintiffs’ third party beneficiary claim [was]

14

not a ‘health benefits claim.’” Id. at 70. Health benefits claims are expenses that concern one’s

15

medical care or health coverage, not one’s data privacy. Defendants have not challenged the

16

Court’s interpretation of FEHBA. Given the similarity between FEHBA and ERISA preemption,

17

it would make little sense for the Court to adopt a different understanding of the term “benefit” for

18

purposes of ERISA preemption.

19
20
21
22

Accordingly, for the reasons stated above, the Court finds that Coonce and Gates’s claims
are not completely preempted by ERISA.
b. Express Preemption
On express preemption, the Court must determine whether Coonce and Gates’s claims

23

“relate to” their ERISA benefit plans. 29 U.S.C. § 1144(a). As noted above, the U.S. Supreme

24

Court has emphasized that this term can not be read literally: “[i]f ‘relate to’ were taken to extend

25

to the furthest stretch of its indeterminacy, then for all practical purposes pre-emption would never

26

run its course, for really, universally, relations stop nowhere.” Travelers, 514 U.S. at 655

27
28

86
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

(alteration and internal quotation marks omitted). Such an interpretation would “read the

2

presumption against pre-emption out of the law,” id. and is “a result [that] no sensible person

3

could have intended,” Gobeille v. Liberty Mut. Ins. Co., 136 S. Ct. 936, 943 (2016) (internal

4

quotation marks omitted).

5

As such, U.S. Supreme Court precedent “to date has described two categories of state laws

6

that ERISA [expressly] pre-empts.” Id. “First, ERISA pre-empts a state law if it has a ‘reference

7

to’ ERISA plans. To be more precise, where a State’s law acts immediately and exclusively upon

8

ERISA plans or where the existence of ERISA plans is essential to the law’s operation, that

9

‘reference’ will result in pre-emption.” Id. (internal quotation marks, citation, ellipses, and
alterations omitted). “Second, ERISA pre-empts a state law that has an impermissible ‘connection

11
United States District Court
Northern District of California

10

with’ ERISA plans, meaning a state law that governs a central matter of plan administration or

12

interferes with nationally uniform plan administration.” Id. (internal quotation marks and ellipses

13

omitted).

14

The claims at issue do not fall under either of these categories. The “reference to” prong

15

analysis is straightforward. In Liberty Mutual Insurance Co. v. Donegan, 746 F.3d 497, 500 (2d

16

Cir. 2014), the Second Circuit was presented with a Vermont law that required all state health

17

insurers, health care providers, health care facilities, and governmental agencies to file certain

18

reports with the Vermont government. On the “reference to” prong, the Second Circuit concluded

19

that “[t]he Vermont statute and regulation lack reference to an ERISA plan because they apply to

20

all health care payers and do not act exclusively upon ERISA plans.” Id. at 508 n.9 (internal

21

quotation marks omitted). Here, too, California contract law, New York unjust enrichment law,

22

and GBL § 349 do not “act exclusively upon ERISA plans,” id., nor are “the existence of ERISA

23

plans . . . essential to the [their] operation,” Gobeille, 136 S. Ct. at 943. These laws are laws of

24

general application, and do not focus exclusively (or, for that matter, even primarily) upon ERISA

25

plan administration.

26
27
28

The analysis of the “connection with” prong is more demanding, but the result remains the
87
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

same. On this prong, the U.S. Supreme Court has advised courts to consider “the objectives of the

2

ERISA statute as a guide to the scope of the state law that Congress understood would survive and

3

the nature of the effect of the state law on ERISA plans.” Gobeille, 136 S. Ct. at 943 (internal

4

quotation marks and citation omitted). A number of cases have discussed “the objectives of the

5

ERISA statute” in some detail. Id. In Travelers, for instance, the U.S. Supreme Court stated that

6

in enacting ERISA’s express preemption provision, “Congress intended to ensure that plans and

7

plan sponsors would be subject to a uniform body of benefits law.” 514 U.S. at 656 (internal

8

quotation marks omitted) (emphasis added). Citing Travelers, the Ninth Circuit held in Dishman

9

that “ERISA preempts state laws that mandate employee benefit structures or their
administration.” 269 F.3d at 981 (internal quotation marks and alteration omitted) (emphasis

11
United States District Court
Northern District of California

10

added). Thus, if a “statute governs the payment of benefits, a central matter of plan

12

administration,” it will be found to be expressly preempted. Id. at 982 (internal quotation marks

13

omitted). Finally, in Gerosa v. Savasta & Co., 329 F.3d 317, 324 (2nd Cir. 2003), the Second

14

Circuit observed that “state laws that . . . tend to control or supersede central ERISA functions—

15

such as state laws affecting the determination of eligibility for benefits, amounts of benefits, or

16

means of securing unpaid benefits—have typically been found to be preempted.” Even in Wise v.

17

Verizon Communications Inc., 600 F.3d 1180, 1190 (9th Cir. 2010), a case upon which

18

Defendants rely, the Ninth Circuit determined that plaintiff’s claim was expressly preempted

19

because it was a “claim for recovery of past and future benefits.” Namely, plaintiff sought to

20

recover lost disability insurance benefits, not damages related to a data breach.

21

The general thrust of Travelers, Dishman, Gerosa, and Wise is that laws that implicate the

22

administration of ERISA benefits are subject to express preemption, and laws that do not are not

23

preempted. See Dishman, 269 F.3d at 984 (finding that invasion of privacy claim not subject to

24

ERISA preemption). As noted above, the claims here do not implicate ERISA “benefits.”

25

Consequently, Coonce and Gates’s claims are not expressly preempted.

26
27
28

88
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1

4. Dispute Regarding Scope of ERISA Plans

2

As a final matter, the Court notes the parties’ disagreement as to whether Coonce and

3

Gates’s contracts also constitute the “written ERISA plan instrument.” Anthem Opp’n at 25. The

4

crux of Plaintiffs’ argument is that the official ERISA plan documents and the written contracts

5

are not the same documents, and that further discovery is needed to determine what documents

6

form the set of official ERISA plan documents. Defendants challenge this argument. Such a

7

dispute again highlights why dismissal as a matter of law is inappropriate at this time: further

8

discovery is necessary to determine which documents constitute the ERISA plan documents.
For all the reasons stated above, Defendants’ motions to dismiss certain claims as

9

preempted by ERISA are DENIED.

11
United States District Court
Northern District of California

10

IV.

CONCLUSION

12

To conclude:

13

1. The Court GRANTS with prejudice the Anthem Defendants’ motion to dismiss the

14

California breach of contract claim as to Plaintiffs Daniel Randrup, Kelly Tharp, and

15

Daniel Tharp.

16

3. The Court GRANTS with prejudice the Non-Anthem Defendants’ motion to dismiss

17

Plaintiffs’ request for Benefit of the Bargain Losses under the New Jersey breach of

18

contract claim.

19
20
21

4. The Court GRANTS with leave to amend Defendants’ motions to dismiss the New
York unjust enrichment claim as to Plaintiff Marne Onderdonk.
5. The Court GRANTS with prejudice Defendants’ motions to dismiss the California

22

Unfair Competition Law claim as to the unlawful prong as that prong relates to the

23

California Insurance Information and Privacy Protection Act, the California

24

Confidentiality of Medical Information Act, and Cal. Civ. Code § 1798.82.

25
26
27
28

6. The Court GRANTS with leave to amend Defendants’ motions to dismiss the California
Unfair Competition Law claim as to the fraud prong as that prong relates to a
89
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION

1
2
3
4
5
6

misrepresentation theory of liability.
7. The Court GRANTS with leave to amend Defendants’ motions to dismiss the New
York General Business Law § 349 as to Plaintiff Marne Onderdonk.
8. The Court GRANTS with prejudice the Anthem Defendants’ motion to dismiss the
Georgia Information and Privacy Protect Act claim.
The second round motions to dismiss are otherwise DENIED. Should Plaintiffs elect to

7

file an amended complaint curing the deficiencies identified herein, Plaintiffs shall do so by July

8

11, 2016, the deadline to which the parties have stipulated for the addition of parties. Failure to

9

meet the July 11, 2016 deadline to file an amended complaint or failure to cure the deficiencies
identified in this Order will result in a dismissal with prejudice of the deficient claims or theories.

11
United States District Court
Northern District of California

10

Plaintiffs may not add new causes of actions or parties without leave of the Court or stipulation of

12

the parties pursuant to Federal Rule of Civil Procedure 15.

13

IT IS SO ORDERED.

14

Dated: May 27, 2016

15
16

______________________________________
LUCY H. KOH
United States District Judge

17
18
19
20
21
22
23
24
25
26
27
28

90
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION