In Re FACEBOOK INTERNET TRACKING LITIGATION
Filing
130
STATEMENT OF RECENT DECISION pursuant to Civil Local Rule 7-3.d by Perrin Aikens Davis, Brian K. Lentz, Cynthia D. Quinn, Matthew J. Vickery REQUEST FOR LEAVE to provide Anthem II as supplemental authority for the Courts consideration when deciding the Motion. (Attachments: #1 Exhibit A)(Straite, David) (Filed on 6/3/2016) Modified text on 6/3/2016,(incorrect event selected.) (cv, COURT STAFF).
Exhibit A
1
2
3
4
5
6
7
8
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
SAN JOSE DIVISION
9
10
Case No. 15-MD-02617-LHK
United States District Court
Northern District of California
11
12
IN RE ANTHEM, INC. DATA BREACH
LITIGATION
13
14
15
16
ORDER GRANTING IN PART AND
DENYING IN PART ANTHEM
DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND
DENYING IN PART NON-ANTHEM
DEFENDANTS’ SECOND MOTION TO
DISMISS, AND DENYING MOTION
FOR CLARIFICATION
[PUBLIC VERSION]
Re: Dkt. No. 483, 490, 496
17
Plaintiffs1 bring this putative class action against Anthem, Inc., 27 Anthem affiliates,2 Blue
18
19
20
21
22
23
24
25
26
27
28
1
All named Plaintiffs are identified in paragraphs 12 through 112 of the Second Consolidated
Amended Complaint. See ECF No. 473-3 (“SAC”) ¶¶ 12–112.
2
The Anthem affiliates are: Blue Cross and Blue Shield of Georgia; Blue Cross Blue Shield
Healthcare Plan of Georgia; Anthem Blue Cross and Blue Shield of Indiana; Anthem Blue Cross
of California; Anthem Blue Cross Life and Health Insurance Company; Anthem Blue Cross and
Blue Shield of Colorado and Anthem Blue Cross and Blue Shield of Nevada; Anthem Blue Cross
and Blue Shield of Connecticut; Anthem Blue Cross and Blue Shield of Kentucky; Anthem Blue
Cross and Blue Shield of Maine; Anthem Blue Cross and Blue Shield of Missouri (HMO
Missouri, Inc., RightChoice Managed Care, Inc. & Healthy Alliance Life Insurance Company);
Anthem Blue Cross and Blue Shield of New Hampshire; Empire Blue Cross and Blue Shield;
Anthem Blue Cross and Blue Shield of Ohio; Anthem Blue Cross and Blue Shield of Virginia
(Anthem Health Plans of Virginia & HMO HealthKeepers); Anthem Blue Cross and Blue Shield
of Wisconsin (Blue Cross Blue Shield of Wisconsin & Compcare Health Services Insurance
Corporation); Amerigroup Services; HealthLink; Unicare Life & Health Insurance Company;
CareMore Health Plan; the Anthem Companies; the Anthem Companies of California;
1
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Cross Blue Shield Association, and 14 non-Anthem Blue Cross Blue Shield Companies.3 The
2
Court refers to Anthem, Inc. and the Anthem affiliates as the “Anthem Defendants,” and Blue
3
Cross Blue Shield Association and the non-Anthem Blue Cross Blue Shield Companies as the
4
“Non-Anthem Defendants.” The Court refers to the Anthem and Non-Anthem Defendants
5
collectively as “Defendants.” The Court refers to Plaintiffs generally as “Plaintiffs,” unless
6
referring to Plaintiffs from a specific jurisdiction, such as California Plaintiffs or New York
7
Plaintiffs.
8
The Anthem Defendants filed one consolidated motion to dismiss the second consolidated
9
amended complaint (“SAC”). See ECF No. 473-3 (“SAC”); ECF No. 496 (“Anthem Mot.”). The
Non-Anthem Defendants also filed one consolidated motion to dismiss the SAC. ECF No. 490
11
United States District Court
Northern District of California
10
(“Non-Anthem Mot.”). The Non-Anthem Defendants have also filed a motion for clarification of
12
the Court’s First Motion to Dismiss Order. ECF No. 483. Having considered the parties’
13
submissions, the relevant law, and the record in this case, the Court GRANTS in part and DENIES
14
in part the Anthem Defendants’ motion to dismiss; GRANTS in part and DENIES in part the Non-
15
Anthem Defendants’ motion to dismiss; and DENIES the Non-Anthem Defendants’ motion for
16
clarification.
17
I.
18
19
BACKGROUND
A. Factual Background
Anthem, Inc. (“Anthem”) is one of the largest health benefits and health insurance
20
companies in the United States. SAC ¶ 158. Anthem serves its members through various Blue
21
Cross Blue Shield (“BCBS”) licensee affiliates and other non-BCBS affiliates. Id. Anthem also
22
23
24
25
26
27
28
Amerigroup Corporation; and the Amerigroup Kansas, Inc.
3
The non-Anthem BCBS Companies are: Blue Cross and Blue Shield of Alabama; Arkansas Blue
Cross and Blue Shield; Blue Shield of California; Blue Cross and Blue Shield of Illinois; Blue
Cross and Blue Shield of Florida; CareFirst BlueCross BlueShield; Blue Cross and Blue Shield of
Massachusetts; Blue Cross and Blue Shield of Michigan; Blue Cross and Blue Shield of
Minnesota; Horizon Blue Cross and Blue Shield of New Jersey; Blue Cross and Blue Shield of
North Carolina; Highmark Blue Shield; Blue Cross and Blue Shield of Texas; and Blue Cross and
Blue Shield of Vermont.
2
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
cooperates with the Blue Cross Blue Shield Association (“BCBSA”) and independent BCBS
2
licensees via the BlueCard program. Id. ¶ 159. “Under the BlueCard program, members of one
3
BCBS licensee may access another BCBS licensee’s provider networks and discounts when the
4
members are out of state.” Id.
5
In order to provide certain member services, the Anthem and Non-Anthem Defendants
6
“collect, receive, and access their customers’ and members’ extensive individually identifiable
7
health record information.” Id. ¶ 160. “These records include personal information (such as
8
names, dates of birth, Social Security numbers, health care ID numbers, home addresses, email
9
addresses, and employment information, including income data) and individually-identifiable
health information (pertaining to the individual claims process, medical history, diagnosis codes,
11
United States District Court
Northern District of California
10
payment and billing records, test records, dates of service, and all other health information that an
12
insurance company has or needs to have to process claims).” Id. The Court shall refer to
13
members’ personal and health information as Personal Identification Information, or “PII.”
14
Anthem maintains a common computer database which contains the PII of current and
15
former members of Anthem, Anthem’s affiliates, BCBSA, and independent BCBS licensees. Id. ¶
16
161. This database contains “information from former customers or members going back to
17
2004.” Id. ¶ 162. In total, Anthem’s database contains the PII of approximately 80 million
18
individuals. Id. ¶ 338. According to Plaintiffs, both the Anthem and Non-Anthem Defendants
19
promised their members that their PII would be protected through privacy notices, online website
20
representations, and other advertising. Plaintiffs aver, for instance, that all Defendants were
21
subject to Anthem’s privacy policy, which states the following:
22
23
24
25
Anthem Blue Cross and Blue Shield maintains policies that protect the
confidentiality of personal information, including Social Security numbers,
obtained from its members and associates in the course of its regular business
functions. Anthem Blue Cross and Blue Shield is committed to protecting
information about its customers and associates, especially the confidential nature
of their personal information.
26
27
28
3
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
3
***
Anthem Blue Cross and Blue Shield has in place a minimum necessary policy
which states that associates may only access, use or disclose Social Security
numbers or personal information to complete a specific task and as allowed by
law.
4
5
6
7
8
9
10
United States District Court
Northern District of California
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Anthem Blue Cross and Blue Shield safeguards Social Security numbers and
other personal information by having physical, technical, and administrative
safeguards in place.
Id. ¶ 165 (emphasis removed). Many Anthem-affiliated websites further refer to Defendants’
privacy obligations under the Health Insurance Portability and Accountability Act (“HIPAA”) as
well as other federal and state privacy laws. Id.
In February 2015, Anthem publicly announced that “cyberattackers had breached the
Anthem Database, and [had] accessed [the PII of] individuals in the Anthem Database.” Id. ¶ 337.
This was not the first time that Anthem had experienced problems with data security. In late 2009,
approximately 600,000 customers of Wellpoint (Anthem’s former trade name) “had their personal
information and protected healthcare information compromised due to a data breach.” Id. ¶ 328.
In addition, in 2013, the U.S. Department of Health and Human Services fined Anthem $1.7
million for various HIPAA violations relating to data security. Id. ¶ 329. Finally, in 2014, the
federal government informed Anthem and other healthcare companies of the possibility of
cyberattacks, and advised these companies to take appropriate measures, such as data encryption
and enhanced password protection. Id. ¶¶ 334–35.
Plaintiffs allege that Defendants did not sufficiently heed these warnings, which allowed
cyberattackers to extract massive amounts of data from Anthem’s database between December
2014 and January 2015. Id. ¶ 360. After Anthem discovered the extent of this data breach, it
proceeded to implement various containment measures. Id. ¶ 365–66 . The cyberattacks ceased
by January 31, 2015. Id. In addition, after learning of the cyberattacks, Anthem retained
Mandiant, a cybersecurity company, “to assist in assessing and responding to the Anthem Data
Breach and to assist in developing security protocols for Anthem.” Id. ¶ 341. Mandiant’s work
4
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
culminated in the production of an Intrusion Investigation Report (“Mandiant Report”), which
2
Mandiant provided to Anthem in July 2015. Id.
3
According to Plaintiffs, the Mandiant Report found that “Anthem and [its] Affiliates
4
[had] failed to implement basic industry-accepted data security tools to prevent cyberattackers
5
from accessing the Anthem Database.” Id. ¶ 343. Moreover, “[e]ven if the cyberattackers gained
6
access to the Anthem Database, Anthem could have and should have, but failed to, discover the
7
data breach before any data was exfiltrated.” Id. ¶ 345.
8
9
Additionally, “BCBSA and [the] non-Anthem BCBS [companies] allowed the [PII] that
their current and former customers and members had entrusted with them to be placed into the
Anthem Database even though there were multiple public indications and warnings that the
11
United States District Court
Northern District of California
10
Anthem and Anthem Affiliates’ computer systems and data security practices were inadequate.”
12
Id. ¶ 377. Plaintiffs further aver that although Anthem publicly disclosed the data breach in
13
February 2015, many affected customers were not personally informed until March 2015. Finally,
14
Plaintiffs contend that Anthem still has not disclosed whether it has made any changes to its
15
security practices to prevent a future cyberattack.
16
17
B. Procedural History
A number of lawsuits were filed against Defendants in the wake of the Anthem data
18
breach. In general, these lawsuits bring putative class action claims alleging (1) failure to
19
adequately protect Anthem’s data systems, (2) failure to disclose to customers that Anthem did not
20
have adequate security practices, and (3) failure to timely notify customers of the data breach.
21
In spring 2015, Plaintiffs in several lawsuits moved to centralize pretrial proceedings in a
22
single judicial district. See 28 U.S.C. § 1407(a) (“When civil actions involving one or more
23
common questions of fact are pending in different districts, such actions may be transferred to any
24
district for coordinated or consolidated pretrial proceedings.”). On June 12, 2015, the Judicial
25
Panel on Multidistrict Litigation (“JPML”) issued a transfer order selecting the undersigned judge
26
as the transferee court for “coordinated or consolidated pretrial proceedings” in the multidistrict
27
28
5
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
litigation (“MDL”) arising out of the Anthem data breach. See ECF No. 1 at 1–3.4
2
On September 10, 2015, the Court held a hearing to appoint Lead Plaintiffs counsel.
3
Following this hearing, the Court issued an order appointing Co-Lead Plaintiffs counsel and
4
requesting that counsel file a single consolidated amended complaint by October 19, 2015. ECF
5
No. 284 at 2. On October 19, 2015, Plaintiffs filed their consolidated amended complaint, which
6
organized Plaintiffs’ causes of action into thirteen different counts, with claims asserted pursuant
7
to various state and federal laws under each count. ECF No. 334-6 (“CAC”).
8
At the October 25, 2015 case management conference, the Court determined that the
9
Anthem and Non-Anthem Defendants would file separate motions to dismiss. Both motions
would be “limited to a combined total of 10 claims, with 5 claims selected by Plaintiffs, 3 claims
11
United States District Court
Northern District of California
10
selected by the Anthem Defendants, and 2 claims selected by the [Non-Anthem Defendants].”
12
ECF No. 326 at 2–3. At the November 10, 2015 case management conference, the parties
13
identified the 10 claims that would be addressed in Defendants’ motions to dismiss.
On November 23, 2015, the Anthem Defendants and Non-Anthem Defendants filed their
14
15
first round motions to dismiss. On February 14, 2016, the Court granted in part and denied in part
16
the first round motions to dismiss. ECF No. 468 (“First MTD Order.”). Specifically, the Court
17
granted with prejudice Defendants’ motions to dismiss Plaintiffs’ Indiana negligence, Kentucky
18
Consumer Protection Act, and Kentucky Data Breach Act claims. Id. at 81. The Court granted
19
with leave to amend Defendants’ motions to dismiss Plaintiffs’ California breach of contract, New
20
Jersey breach of contract, New York unjust enrichment, and Georgia Information and Privacy
21
Protection Act claims. Id. The Court denied Defendants’ motions to dismiss Plaintiffs’ California
22
Unfair Competition Law, New York General Business Law § 349, and federal law third party
23
beneficiary claims. Id. The Court also addressed standing and ERISA preemption in the First
24
Motion to Dismiss Order.
25
26
27
28
4
As of May 19, 2016, this MDL is comprised of 127 individual cases. ECF No. 514-1 at 5.
6
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
In accordance with the Court’s First Motion to Dismiss Order, Plaintiffs filed the SAC on
1
2
March 11, 2016. The Anthem and Non-Anthem Defendants filed their second round motions to
3
dismiss on April 5, 2016. Plaintiffs filed their oppositions on April 26, 2016, and the Anthem
4
Defendants and Non-Anthem Defendants filed their replies on May 10, 2016. ECF No. 508
5
(“Anthem Opp’n”); ECF No. 507 (“Non-Anthem Opp’n”); ECF No. 511 (“Anthem Reply”); ECF
6
No. 512 (“Non-Anthem Reply”). In addition, on March 28, 2016, the Non-Anthem Defendants
7
filed a motion for clarification regarding the First Motion to Dismiss Order. ECF No. 483.
8
Plaintiffs filed a response on March 31, 2016, ECF No. 486, and the Non-Anthem Defendants
9
filed a reply on April 4, 2016, ECF No. 488.
10
United States District Court
Northern District of California
11
12
II.
LEGAL STANDARD
A. Motion to Dismiss
Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss an
13
action for failure to allege “enough facts to state a claim to relief that is plausible on its face.” Bell
14
Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the
15
plaintiff pleads factual content that allows the court to draw the reasonable inference that the
16
defendant is liable for the misconduct alleged. The plausibility standard is not akin to a
17
‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted
18
unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal citations omitted). For
19
purposes of ruling on a Rule 12(b)(6) motion, the Court “accept[s] factual allegations in the
20
complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving
21
party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008).
22
Nonetheless, the Court is not required to “‘assume the truth of legal conclusions merely
23
because they are cast in the form of factual allegations.’” Fayer v. Vaughn, 649 F.3d 1061, 1064
24
(9th Cir. 2011) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). Mere
25
“conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to
26
dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004); accord Iqbal, 556 U.S. at 678.
27
28
7
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Furthermore, “‘a plaintiff may plead [him]self out of court’” if he “plead[s] facts which establish
2
that he cannot prevail on his . . . claim.” Weisbuch v. Cnty. of L.A., 119 F.3d 778, 783 n.1 (9th Cir.
3
1997) (quoting Warzon v. Drew, 60 F.3d 1234, 1239 (7th Cir. 1995)).
For purposes of motions to dismiss, as with virtually all motions touching upon substantive
4
5
legal matters, the general rule “is that the MDL transferee court is generally bound by the same
6
substantive legal standards, if not always the same interpretation of them, as would have applied in
7
the transferor court.” In re Korean Air Lines Co., Ltd., 642 F.3d 685, 699 (9th Cir. 2011).
8
B. Leave to Amend
9
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely
granted when justice so requires,” bearing in mind “the underlying purpose of Rule 15 to facilitate
11
United States District Court
Northern District of California
10
decision on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d
12
1122, 1127 (9th Cir. 2000) (en banc) (ellipses omitted). Generally, leave to amend shall be denied
13
only if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be
14
futile, or if the moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ’g, 512
15
F.3d 522, 532 (9th Cir. 2008).
16
III.
17
DISCUSSION
A. Standing and Discovery
18
Before addressing the specific claims at issue, the Court examines the Non-Anthem
19
Defendants’ arguments regarding standing. These arguments also relate to the issues raised in the
20
Non-Anthem Defendants’ motion for clarification.
21
In the First Motion to Dismiss Order, the Court observed that there were ten Non-Anthem
22
Defendants against whom the CAC “fails to allege any specific facts” regarding the selected
23
claims at issue. First MTD Order at 8. Those Non-Anthem Defendants were: Blue Cross and
24
Blue Shield of Alabama; Blue Cross and Blue Shield of Arizona, Inc.; CareFirst of Maryland, Inc.;
25
Blue Cross and Blue Shield of Michigan; Blue Cross and Blue Shield of North Carolina, Inc.;
26
Highmark Health Services; Highmark West Virginia, Inc.; BlueCross BlueShield of Tennessee,
27
28
8
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Inc.; Blue Cross and Blue Shield of Vermont; and Blue Cross and Blue Shield of Illinois. Because
2
no factual allegations were made against these Non-Anthem Defendants as to the selected claims,
3
the Court dismissed the selected claims against these Non-Anthem Defendants on standing
4
grounds.
5
In reaching this decision, the Court found instructive the reasoning in In re Carrier IQ, 78
6
F. Supp. 3d 1051 (N.D. Cal. 2015), where the district court, after examining U.S. Supreme Court
7
precedent in Amchem Products, Inc. v. Windsor, 521 U.S. 591 (1997), and Ortiz v. Fibreboard
8
Corp., 527 U.S. 815 (1999), concluded that courts have discretion on when to address standing in
9
a nationwide class action—whether at the outset of litigation or at class certification. In exercising
such discretion, a court should consider factors such as the cost and burden of discovery, the
11
United States District Court
Northern District of California
10
breadth of the proposed class, and whether a named plaintiff’s claim is typical of individuals
12
whose claims arise under the laws of other states. First MTD Order at 10.
13
With these factors in mind, the Court expressed concern that some Non-Anthem
14
Defendants would remain in this case even though Plaintiffs might not, as a matter of law, be able
15
to pursue the selected claims against these Defendants. There were, for instance, no allegations in
16
the CAC to suggest that any Blue Cross and Blue Shield of Illinois customers resided in California
17
or New York. As such, it would make little sense to ask Blue Cross and Blue Shield of Illinois to
18
defend itself against Plaintiffs’ California Unfair Competition Law or New York General Business
19
Law § 349 claims.
20
The Court went on to distinguish the posture of this case from that in In re Target Corp.
21
Data Security Breach Litigation, 66 F. Supp. 3d 1154 (D. Minn. 2014). In In re Target, there
22
were “114 named Plaintiffs who reside[d] in every state in the union save four and the District of
23
Columbia.” Id. at 1160. “As Target undoubtedly knows, there are consumers in Delaware,
24
Maine, Rhode Island, Wyoming, and the District of Columbia whose personal financial
25
information was stolen in [a] 2013 [data] breach.” Id. “To force [p]laintiffs’ attorneys to search
26
out those individuals at [the motion to dismiss] stage serves no useful purpose.” Id. Here, on the
27
28
9
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
other hand, there was no indication from the CAC that Plaintiffs would be able to find an
2
individual to plead specific facts concerning the selected claims against ten Non-Anthem
3
Defendants.
4
The Non-Anthem Defendants’ first motion to dismiss was, however, granted with leave to
5
amend. In the second round motion to dismiss, the Non-Anthem Defendants once again argue for
6
dismissal of the selected claims against ten Non-Anthem Defendants. The list of Defendants has
7
changed somewhat since the Court’s First Motion to Dismiss Order. These changes reflect the
8
fact that Plaintiffs omitted three Non-Anthem Defendants from the SAC and that Non-Anthem
9
Defendants identified three additional Non-Anthem Defendants in the SAC against whom the
named Plaintiffs make no specific factual allegations as to the selected claims. Non-Anthem Mot.
11
United States District Court
Northern District of California
10
at 2–3 n.2. The updated list of ten Non-Anthem Defendants is: Blue Cross and Blue Shield of
12
Alabama; CareFirst of Maryland, Inc.; Blue Cross and Blue Shield of Michigan; Blue Cross and
13
Blue Shield of North Carolina, Inc.; Highmark Health Services; Blue Cross and Blue Shield of
14
Vermont; Blue Cross Blue Shield of Massachusetts; Arkansas Blue Cross and Blue Shield; Blue
15
Cross and Blue Shield of Minnesota; and Blue Cross and Blue Shield of Illinois. In addition, Non-
16
Anthem Defendants also request that the Court “dismiss every non-selected claim against every . .
17
. Defendant to the extent the named Plaintiff(s) asserting the claim does not allege he or she was
18
insured by . . . th[at] . . . Defendant.” Id. at 4 (emphasis removed). The Court addresses these
19
arguments in turn.
20
1. Selected Claims
21
The easiest way for Plaintiffs to have avoided dismissal would have been to find a named
22
Plaintiff to assert one of the seven remaining selected claims against the ten Non-Anthem
23
Defendants at issue. Plaintiffs have not done so. Instead of identifying new named Plaintiffs,
24
however, the SAC includes enrollment data on each Non-Anthem Defendant. This data “set[]
25
forth the number of residents of each state that were . . . enrolled” in “a health insurance of health
26
benefits plan” by each Non-Anthem Defendant. SAC ¶¶ 242–55. From the Court’s review of this
27
28
10
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
data, it appears that every Non-Anthem Defendant at issue enrolled residents from nearly every
2
state.5
The Court finds that this alternative method also addresses the Court’s concerns regarding
3
standing. Indeed, there was previously no indication that Blue Cross and Blue Shield of Illinois
5
enrolled any California or New York residents. Now, however, the SAC states that 208,945
6
California residents and 82,404 New York residents were enrolled in a Blue Cross and Blue Shield
7
of Illinois plan. Taken together, the number of California and New York residents enrolled in a
8
Blue Cross and Blue Shield of Illinois plan (291,349) actually exceeds the number of Illinois
9
residents enrolled in a Blue Cross and Blue Shield of Illinois plan (265,801). Id. ¶ 245. Thus,
10
208,945 individuals could bring a California Unfair Competition Law claim against Blue Cross
11
United States District Court
Northern District of California
4
and Blue Shield of Illinois, and 82,404 individuals could bring a New York General Business Law
12
§ 349 claim against Blue Cross and Blue Shield of Illinois.
Under such circumstances, Plaintiffs’ allegations are now more analogous to the facts in In
13
14
re Target. As in In re Target, the SAC shows that every Non-Anthem Defendant provided health
15
insurance or health benefits services to residents of nearly every state. The Court’s concerns
16
regarding whether any individuals could assert the selected claims against certain Defendants have
17
thus been sufficiently addressed. At this point in the litigation, “forc[ing] Plaintiffs’ [counsel] to
18
search out . . . individuals [to add as named Plaintiffs] at this stage serves no useful purpose.” In
19
re Target, 66 F. Supp. 3d at 1160. Moreover, dismissing the selected claims against the ten
20
Defendants at issue could prematurely preclude many individuals—such as the 208,945 Blue
21
Cross and Blue Shield of Illinois enrollees in California—from pursuing viable claims.
Accordingly, the Court, in its discretion, declines to dismiss the selected claims against the
22
23
ten Non-Anthem Defendants at issue. The Non-Anthem Defendants’ motion to dismiss on
24
25
26
27
28
5
There are exceptions. Blue Cross and Blue Shield of Vermont, for example, did not enroll any
Delaware, Hawaii, or North Dakota residents. SAC ¶ 255. The selected claims, however, do not
concern laws from these states.
11
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
standing grounds is therefore DENIED.
The Court cautions that today’s decision is not meant to give Plaintiffs a free pass on
2
3
standing. Although standing questions may be deferred until class certification in cases like this,
4
“[t]he question of standing is not subject to waiver.” United States v. Hays, 515 U.S. 737, 742
5
(1995). “This is no less true with respect to class actions than with respect to other suits.” Lewis
6
v. Casey, 518 U.S. 343, 357 (1996). “That a suit may be a class action adds nothing to the
7
question of standing,” id. (ellipses omitted), and if standing concerns remain at class certification,
8
the Non-Anthem Defendants are invited to re-raise them before this Court.
2. Non-Selected Claims
9
For substantially similar reasons, the Non-Anthem Defendants’ request to dismiss the non-
10
United States District Court
Northern District of California
11
selected claims against every Non-Anthem Defendant is also DENIED. As outlined above,
12
Plaintiffs have presented sufficient allegations to establish that every Non-Anthem Defendant
13
offered health insurance or health benefits services to residents of every state.
14
3. Motion for Clarification
15
Finally, the above analysis also answers the Non-Anthem Defendants’ motion for
16
clarification. The gist of this motion is that, based on the First Motion to Dismiss Order, ten Non-
17
Anthem “Defendants should be relieved of the burden of discovery until resolution of the selected
18
claims.” ECF No. 483 at 3. As dismissal of the selected claims against these ten Non-Anthem
19
Defendants on the basis of standing is unwarranted, the Non-Anthem Defendants’ request for a
20
pause in discovery against these ten Non-Anthem Defendants is also DENIED.
B. California Breach of Contract (against Anthem Defendants)6
21
22
“Under California law, to state a claim for breach of contract a plaintiff must plead [1] the
23
contract, [2] plaintiffs’ performance (or excuse for nonperformance), [3] defendant’s breach, and
24
25
26
27
28
6
Defendants also assert that ERISA preemption applies to some (but not all) of the named
Plaintiffs as to their California breach of contract, New York unjust enrichment, California Unfair
Competition Law, and New York General Business Law § 349 claims. All ERISA preemption
arguments are addressed at Section III.I.
12
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
[4] damage to plaintiff therefrom.” Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1028 (N.D. Cal.
2
2012) (internal quotation marks omitted). Here, California Plaintiffs allege that “Plaintiffs and
3
Class Members . . . entered into contracts with Anthem and its Affiliates that incorporated, either
4
by express provision or attachment, or incorporation by reference, Anthem’s . . . privacy policies
5
pertaining to personal and health-related information.” SAC ¶ 458. California Plaintiffs further
6
contend that, by allowing cyberattackers to access the Anthem Database, the Anthem Defendants
7
breached these contractual obligations. In moving to dismiss, the Anthem Defendants assert that
8
the SAC “fails to identify [the] contractual provisions that were breached” and “fails to show that
9
any breach caused contractual damages.” Anthem Mot. at 6, 11.
10
There are three specific types of contracts at issue, with each type operating somewhat
United States District Court
Northern District of California
11
differently. First, “many Plaintiffs . . . purchased individual insurance or health benefits policies
12
[directly] from Anthem and its Affiliates.” SAC ¶ 191. These individuals “entered into contracts
13
with Anthem and its Affiliates when they applied and paid for insurance and Anthem issued them
14
a policy.” Id. The Court refers to such contracts as “individual plan” contracts.
15
Second, some Plaintiffs entered into “group insurance policies” where Anthem “act[ed] as
16
the insurer of risk.” Id. ¶ 214. Under such contracts, a group—usually an employer—purchases
17
insurance from a regulated insurance company. “Typically, the employer pays a per-employee
18
premium to an insurance company, and the insurance company assumes the risk of providing
19
health coverage for insured events.” Mich. Catholic Conf. and Catholic Family Servs. v. Burwell,
20
807 F.3d 738, 742 (6th Cir. 2015) (internal quotation marks omitted). Similar to individual plan
21
contracts, under these group insurance policies, the Anthem Defendants act as the insurer and bear
22
any risks associated with insurance coverage. The Court refers to these plans as “fully-insured
23
group plan” contracts.
24
Third, many Plaintiffs were part of self-insured group plans. SAC ¶ 214. Under such
25
plans, the group “contract[s] with an insurance company . . . to administer the plan, but the [group]
26
bears the risk associated with offering health benefits.” Mich. Catholic Conf., 807 F.3d at 743.
27
28
13
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Unlike an individual plan or a fully-insured group plan, the Anthem Defendants act under these
2
contracts as an administrator rather than as an insurer. The Anthem Defendants do not bear the
3
risks associated with insurance coverage. The Court refers to these contracts as “administrative
4
services only” agreements or “ASO” agreements.
The SAC identifies eleven California Plaintiffs, eight of whom assert a breach of contract
5
6
claim against the Anthem Defendants. SAC ¶¶ 15–23. The remaining California Plaintiffs are
7
covered by a Non-Anthem Defendant. The situation of the eight California Plaintiffs asserting a
8
California breach of contract claim against an Anthem Defendant is documented below.
9
Name
Insurer/Administrator
Contract Type
11
Michael Bronzo
Individual Plan
12
Kenneth Solomon
13
Mary Ella Carter
Anthem Blue Cross of
California
Anthem Blue Cross Life and
Health Insurance Company
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
Anthem Blue Cross of
California
United States District Court
Northern District of California
10
14
Kenneth Coonce
15
Daniel Randrup
16
17
Steve Kawai
18
Daniel Tharp
19
Kelly Tharp
20
Individual Plan
Fully-Insured Group Plan
Fully-Insured Group Plan
ASO Agreement
ASO Agreement
ASO Agreement
ASO Agreement
Because the legal architecture behind individual and fully-insured group plans (where the
21
Anthem Defendants act as the insurer) differs from the legal architecture behind ASO agreements
22
(where the Anthem Defendants act as the administrator), the Court addresses the Anthem
23
Defendants’ arguments regarding these plans separately.
24
1. Individual and Fully-Insured Group Plans
25
For California Plaintiffs covered by an individual or fully-insured group plan, the Anthem
26
27
28
14
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Defendants contend that, although “[t]he SAC asserts that various privacy notices and policies
2
became enforceable provisions of Plaintiffs’ health plan contracts,” the SAC “fails to allege facts
3
to support th[is] assertion.” Anthem Mot. at 6. California Plaintiffs, in response, assert that these
4
privacy provisions were part of their underlying contracts via incorporation by reference or
5
through express attachment.
6
7
a. Incorporation by Reference
As to incorporation by reference, California law provides that “[a] contract may validly
8
include the provisions of a document not physically a part of the basic contract.” Shaw v. Regents
9
of Univ. of Cal., 67 Cal. Rptr. 2d 850, 856 (Ct. App. 1997). “It is, of course, the law that the
parties may incorporate by reference into their contract the terms of some other document.” Id.
11
United States District Court
Northern District of California
10
“For the terms of another document to be incorporated into the document executed by the parties
12
[1] the reference must be clear and unequivocal, [2] the reference must be called to the attention of
13
the other party and he must consent thereto, and [3] the terms of the incorporated document must
14
be known or easily available to the contracting parties.” Id. “The contract need not recite that it
15
incorporates another document, so long as it guides the reader to the incorporated document.” Id.
16
(internal quotation marks and alteration omitted).
17
With these principles in mind, the California Court of Appeal determined, in Shaw v.
18
Regents of the University of California, that a college professor’s contract had incorporated by
19
reference the university’s patent policy. Id. at 852. As the court explained, “when [plaintiff]
20
signed the agreement, the parties intended it to incorporate the [University’s] Patent Policy.” Id. at
21
856. Specifically, “[plaintiff’s contract] (1) direct[ed] [plaintiff] to ‘Please read the Patent Policy .
22
. . ,’ and (2) state[d] that, in signing the patent agreement, [plaintiff was] ‘not waiving any rights to
23
a percentage of royalty payments received by University, as set forth in [the] University Policy
24
Regarding Patents.’” Id. (emphasis removed).
25
26
27
28
Following Shaw, the California Court of Appeal also determined that an arbitration clause
was sufficiently incorporated by reference in Wolschlager v. Fidelity National Title Insurance
15
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Company, 4 Cal. Rptr. 3d 179 (Ct. App. 2003). In Wolschlager, plaintiff received a preliminary
2
report from defendant, a title insurance company. Id. at 181. This report did not state that the
3
insurance policy was subject to an arbitration clause; indeed, the report did not even mention an
4
arbitration clause. Instead, the report included two sentences which stated that “[Complete]
5
[c]opies of the [entire insurance] policy . . . should be read. They are available from the office
6
which issued this Report.” Id. at 181–82. The full policy, which plaintiff later received after
7
agreeing to purchase insurance from defendant, contained an arbitration clause. Id. at 182.
8
9
The Wolschlager court acknowledged that defendant, by moving to enforce the arbitration
clause, sought to incorporate by reference “documents which were not attached” and “not
presented” to plaintiff “at the time” that plaintiff reviewed the preliminary report and signed the
11
United States District Court
Northern District of California
10
underlying contract. Id. Indeed, “[t]here was no substantive dispute that plaintiff did not actually
12
know about the arbitration clause.” Id. at 185. Nonetheless, the California Court of Appeal found
13
in defendant’s favor, with the court noting that “the Preliminary Report specifically identifies the
14
document incorporated as the policy, lists the form which is contemplated and tells the recipient
15
where they can find the policy.” Id. at 184–85. “This incorporation was both clear and
16
unequivocal.” Id. at 185. Moreover, “even if plaintiff did not know about the arbitration clause,
17
the [p]olicy with the clause was easily available to him. The preliminary report identified the
18
[p]olicy by name and directed . . . plaintiff to where he could inspect it.” Id. “Nothing further,”
19
the California Court of Appeal observed, “was needed.” Id.
20
Under Shaw and Wolschlager, the contracts entered into by Michael Bronzo (“Bronzo”),
21
Kenneth Solomon (“Solomon”), Mary Ella Carter (“Carter”), and Kenneth Coonce (“Coonce”)
22
sufficiently incorporate by reference the Anthem Defendants’ promises to protect individual
23
privacy. First, on whether the references were clear and unequivocal, Shaw, 67 Cal. Rptr. at 856,
24
each contract includes several specific references to Anthem’s privacy policies. Bronzo’s
25
contract, for instance, states that “You have the right to receive a copy of the Notice of Privacy
26
Practices. You may obtain a copy by calling our customer service department . . . or by accessing
27
28
16
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
our website.” ECF No. 473-5 at 28. At another point, Bronzo’s contract provides that Anthem’s
2
right to “receive from any Provider of service information about You” is “subject to all applicable
3
confidentiality requirements.” Id. at 29. Further, the next paragraph reads, in all caps, that “A
4
STATEMENT DESCRIBING OUR POLICIES AND PROCEDURES FOR PRESERVING THE
5
CONFIDENTIALITY OF MEDICAL RECORDS IS AVAILABLE AND WILL BE
6
FURNISHED TO YOU UPON REQUEST.” Id. The paragraph concludes by advising Bronzo to
7
contact Anthem’s customer service department for “a copy of our policies and procedures for
8
preserving Your medical record confidentiality.” Id. Thus, the Anthem Defendants, on multiple
9
instances, made clear and unequivocal references to Anthem’s privacy policies in Bronzo’s
10
United States District Court
Northern District of California
11
contract.
The Anthem Defendants made similar representations to Solomon, Carter, and Coonce.
12
Solomon’s contract, for instance, states: “You . . . have the right to receive a copy of the Notice of
13
Privacy Practices. You may obtain a copy by calling our customer service department . . . or by
14
accessing our web site.” ECF No. 473-7 at 22. Similarly, Carter’s plan booklet states that the
15
Anthem Defendants “will make every effort and take care to keep your medical data secret.” ECF
16
No. 473-5 at 40. “Medical data about you can only be given to others if you agree to it in writing
17
or if required by law.” Id. “A statement describing our policies and procedures for preserving the
18
confidentiality of medical records is available and will be furnished to you upon request.” Id.
19
Coonce’s plan booklet also directs Coonce to obtain a copy of Anthem’s “Notice of Privacy
20
Practices” either by calling Anthem’s customer service department or by accessing Anthem’s
21
website. ECF No. 473-6 at 6.
22
Second, “the references were called to the attention of” Bronzo, Solomon, Carter, and
23
Coonce. Shaw, 67 Cal. Rptr. at 856. As noted above, each governing contract or group plan
24
booklet called attention to the Anthem Defendants’ privacy policies and gave instructions on how
25
consumers could review these policies in greater detail.
26
27
28
Third, “the terms of the incorporated document [were] known or easily available to the
17
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
contracting parties.” Id. The SAC states that Anthem’s privacy obligations were codified in at
2
least three sets of documents: a “Personal Information (Including Social Security Number) Privacy
3
Policy,” (“PIPP”) which was posted on “the Anthem website and the website for every Anthem
4
BCBS Affiliate and . . . other Anthem Affilate[],” SAC ¶¶ 165–66; an Annual Notice of Privacy
5
Practices (“Annual Privacy Notice”), id. ¶ 169; and in other statements on Anthem’s website, id. ¶
6
168. The core message from these documents is the same: to take reasonable security measures to
7
protect customer PII. See ECF No. 473-5 at 2 (PIPP); ECF No. 473-5 at 16 (Annual Privacy
8
Notice). All of these documents, moreover, were “easily available,” Shaw, 67 Cal. Rptr. at 856,
9
either via a physical copy or online.
10
The references at issue in the instant case in fact go several steps further than the
United States District Court
Northern District of California
11
references in Wolschlager. In Wolschlager, plaintiff was simply advised that “[c]omplete [c]opies
12
of the [insurance] policy . . . should be read,” without making any reference to the arbitration
13
clause that was later disputed. 4 Cal. Rptr. 3d at 181. Here, on the other hand, the governing
14
documents all discussed Anthem’s obligation to protect privacy. In addition, these documents
15
specifically direct California Plaintiffs to review Anthem’s privacy policies in greater detail by
16
either calling Anthem’s customer service department or by visiting Anthem’s public website.
17
Under such circumstances, the Court finds that the Anthem Defendants’ privacy policies were
18
sufficiently incorporated by reference into the contracts of Bronzo, Solomon, Carter, and Coonce.
19
In response to Shaw and Wolschlager, the Anthem Defendants argue (1) that Amtower v.
20
Photon Dynamics, Inc., 71 Cal. Rptr. 3d 361 (Ct. App. 2008), compels a contrary result, (2) that
21
the integration clause in California Plaintiffs’ contracts precludes incorporation by reference of
22
Anthem’s privacy policies, and (3) that Anthem’s privacy policies only codify preexisting legal
23
duties and do not create independent contractual obligations.
24
The Anthem Defendants’ reliance upon Amtower is misguided. Amtower involved two
25
separate contracts governing two different sets of parties. The first contract, known as the
26
“Merger Agreement,” negotiated the process by which CR Technology, Inc. (“CRT”) would
27
28
18
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
merge with Photon Dynamics Inc. (“Photon”). Id. at 367–68. The only parties to the Merger
2
Agreement were CRT and Photon. Notably, the Merger Agreement included an attorney’s fees
3
provision. The second contract, known as the “Affiliate Agreement,” negotiated the rights of CRT
4
shareholders to “sell the Photon stock [that] they acquired through the [CRT and Photon] merger.”
5
Id. at 368. The parties to the Affiliate Agreement were CRT’s shareholders, which included
6
plaintiff, and Photon. The Affiliate Agreement did not include an attorney’s fees provision.
7
Plaintiff subsequently brought suit against Photon and Photon’s officers, “complaining that
8
he had been misled about the transferability of Photon stock” under the Affiliate Agreement. Id. at
9
369. Photon prevailed at trial and sought recovery of attorney’s fees. The crux of Photon’s
argument was that, although the Affiliate Agreement did not include an attorney’s fees provision,
11
United States District Court
Northern District of California
10
the Affiliate Agreement did mention the Merger Agreement, which meant that the Merger
12
Agreement’s attorney’s fees provision was incorporated by reference into the Affiliate Agreement.
13
See id. at 382–83. The California Court of Appeal rejected this argument.
14
As the California Court of Appeal observed, “[t]he parties to the Merger Agreement were
15
Photon and CRT.” Id. at 382. On the other hand, “[t]he parties to the Affiliate Agreement were
16
Photon and plaintiff.” Id. Thus, “unlike the facts in either Shaw or Wolschlager, the Merger
17
Agreement [was] a separate contract that plaintiff did not solicit and to which he was not a party.”
18
Id. at 385. “The Merger Agreement was not attached to the Affiliate Agreement and the Affiliate
19
Agreement did not refer to it as providing any rights or remedies to plaintiff.” Id. In other words,
20
the Amtower defendant sought to incorporate and enforce provisions from another contract to
21
which plaintiff was not a party.
22
These differences distinguish Amtower from the instant case. The agreements at issue here
23
all involve the same parties: Plaintiffs and the Anthem Defendants. Unlike in Amtower, there are
24
no other parties at issue: the Anthem Defendants agreed to provide health insurance to Plaintiffs,
25
and also agreed to protect Plaintiffs’ PII.
26
27
28
The Anthem Defendants’ reliance upon the contracts’ integration clause is similarly
19
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
inapposite. As the Anthem Defendants point out, for Coonce’s policy, for instance, one provision
2
states that “the entire Agreement consists of” the “Group Insurance Policy,” the “Combined
3
Evidence of Coverage and Disclosure Forms including any amendments, the group application,
4
the eligible persons’ individual applications, and the premium charge rate schedule.” ECF No.
5
473-6 at 17; Anthem Mot. at 7. This integration clause, the Anthem Defendants argue, does not
6
mention the Anthem Defendants’ privacy policies. Consequently, these privacy policies are not
7
part of Coonce’s contract. Id.
8
Generally, an integration clause “prohibits the introduction of any extrinsic evidence,
9
whether oral or written, to vary, alter or add to the terms of an integrated written instrument.”
Casa Herrera, Inc. v. Beydoun, 83 P.3d 497, 502 (Cal. 2004). However, “[t]he rule does not . . .
11
United States District Court
Northern District of California
10
prohibit the introduction of extrinsic evidence to explain the meaning of a written contract if the
12
meaning urged is one to which the written contract terms are reasonably susceptible.” Id. (internal
13
quotation marks, ellipses, and alteration omitted).
14
Here, the Anthem Defendants’ reliance upon the integration clause overlooks a critical
15
fact: Coonce’s Combined Evidence of Coverage and Disclosure Form—which the Anthem
16
Defendants acknowledge is part of the “entire Agreement”—incorporates by reference Anthem’s
17
privacy policies. Coonce’s Combined Evidence of Coverage and Disclosure Form, for instance,
18
states that “[y]ou . . . have the right to receive a copy of the Member Rights and Responsibilities
19
Statement and/or the Notice of Privacy Practices.” ECF No. 473-6 at 6. The form also directs
20
Coonce to contact the Anthem Defendants in order to obtain “[a] statement describing our policies
21
and procedures regarding the confidentiality of medical records.” Id. at 10.
22
The California Court of Appeal addressed an analogous situation in King v. Larsen Realty,
23
Inc., 175 Cal. Rptr. 226 (Ct. App. 1981). In King, the membership application for a local realtor
24
board required members “to abide by the constitution, bylaws, rules and regulations of the local
25
board and the state association.” Id. at 229. The bylaws, in turn, “impose[d] upon members the
26
duty to arbitrate on the terms set forth in the California Association of Realtors Arbitration
27
28
20
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Manual.” Id. at 229–30. “Hence,” the California Court of Appeal concluded, “the entire scheme
2
of interboard arbitration [in the California Association of Realtors Arbitration Manual] was
3
incorporated into the bylaws of the [local realtor board].” Id. at 230.
4
In like manner, in Ruffu v. California Physicians Service, 2002 WL 1352449 (Cal. Ct.
5
App. June 20, 2002), the California Court of Appeal rejected plaintiff’s argument that the
6
integration clause in a health insurance contract precluded the court from considering a Summary
7
of Benefits document. As the Ruffu court noted, the insurance contract incorporated the insurance
8
application; this application, in turn, referred to the Summary of Benefits document. “Thus, the
9
Summary of Benefits is incorporated by reference into the application, which in turn is
incorporated into the Agreement.” Id. at *4. The privacy policies here do the same thing: the
11
United States District Court
Northern District of California
10
integration clause incorporates the Combined Evidence of Coverage and Disclosure Form, which
12
in turn incorporates by reference Anthem’s privacy policies.
13
Finally, the Anthem Defendants argue that “[n]otices required by law that detail
14
preexisting legal obligations do not give rise to contractual rights.” Anthem Mot. at 8 (internal
15
quotation marks omitted). As noted in the First Motion to Dismiss Order, however, “Plaintiffs’
16
breach of contract claim reaches beyond mere violation of applicable laws.” MTD Order at 27.
17
Rather, the SAC, like the CAC, avers that the Anthem Defendants “violat[ed] their commitment to
18
maintain the confidentiality and security of [PII] compiled by Anthem and their Affiliates in the
19
Anthem Data Base; and by failing to comply with their own policies and applicable laws,
20
regulations and industry standards for data security and protecting the confidentiality of [PII].”
21
SAC ¶ 461.
22
Both the PIPP and the Annual Privacy Notice corroborate this allegation. The PIPP states
23
that “Anthem Blue Cross’s Privacy Policy imposes a number of standards to prohibit the unlawful
24
disclosure of Social Security number, and [to] guard the confidentiality of . . . other personal
25
information.” ECF No. 473-5 at 13 (emphasis added). Further, “Anthem Blue Cross safeguards
26
Social Security numbers and other personal information by having physical, technical, and
27
28
21
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
administrative safeguards in place.” Id. Similarly, the Annual Privacy Notice states that “[w]e are
2
dedicated to protecting your P[II], and have set up a number of policies and practices to help make
3
sure your P[II] is kept secure. We have to keep your P[II] private. If we believe your P[II] has
4
been breached, we must let you know.” ECF No. 473-5 at 18. These commitments do not refer to
5
any laws or preexisting legal obligations. Thus, consistent with the SAC, such statements could
6
be read to reflect a commitment by Anthem to implement privacy policies that complement (or go
7
beyond) Anthem’s preexisting legal duties.
8
9
10
United States District Court
Northern District of California
11
12
In sum, Bronzo, Solomon, Carter, and Coonce have sufficiently alleged that the Anthem
Defendants’ privacy policies were incorporated by reference into their contracts. As such, the
Court need not address California Plaintiffs’ express attachment theory.
b. Damages
The Court turns next to whether these California Plaintiffs have sufficiently pleaded
13
contractual damages. “To establish contractual damages, a [p]laintiff must establish ‘appreciable
14
and actual damage.’” Low, 900 F. Supp. 2d at 1028. “Nominal damages, speculative harm, or
15
threat of future harm do not suffice to show legally cognizable injury.” Id.
16
California Plaintiffs assert three damages theories. First, California Plaintiffs request
17
Benefit of the Bargain Losses. The SAC describes these losses as “the difference in value
18
between what Plaintiffs should have received from Defendants when they enrolled in and/or
19
purchased insurance from Defendants that Defendants represented, contractually and otherwise,
20
would be protected by reasonable data security, and Defendants’ partial, defective, and deficient
21
performance by failing to provide reasonable and adequate data security.” SAC ¶ 415. Second,
22
California Plaintiffs seek Loss of Value of PII, which Plaintiffs describe as “damages to and
23
diminution in value of their [PII] entrusted to Defendants.” Id. Third, California Plaintiffs request
24
Consequential Out of Pocket Expenses, which are “damages resulting from [Plaintiffs’] attempt to
25
ameliorate the effect of the breach of contract and subsequent Anthem Data Breach, including but
26
not limited to purchasing credit monitoring services or taking other steps to protect themselves
27
28
22
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
from the loss of their” PII. Id. ¶ 464.
i. Benefit of the Bargain Losses
3
On Benefit of the Bargain Losses, the California Supreme Court has held that “[d]amages
4
are awarded in an action for breach of contract to give the injured party the benefit of his bargain
5
and insofar as possible to place him in the same position he would have been in had the promisor
6
performed the contract.” Coughlin v. Blair, 262 P.2d 305, 314 (Cal. 1953). Likewise, in New
7
West Charter Middle School v. Los Angeles Unified School District, 114 Cal. Rptr. 3d 504, 515
8
(Ct. App. 2010), the California Court of Appeal noted that “[c]ontract damages compensate a
9
plaintiff for its lost expectation interest.” “This,” the court observed, “is described as the benefit
of the bargain that full performance would have brought.” Id. When a “lessor fail[s] to deliver the
11
United States District Court
Northern District of California
10
promised premises,” for example, “the proper measure of damages is the difference between the
12
agreed rent and the rental value of the premises during the term of the lease.” Id. (internal
13
quotation marks omitted). Thus, both Coughlin and New West point in favor of Plaintiffs’ attempt
14
to recover Benefit of the Bargain Losses.
15
More recently, several federal courts have specifically upheld California breach of contract
16
claims for Benefit of the Bargain Losses in the privacy context. In Svenson v. Google Inc., 2015
17
WL 1503429, *4 (N.D. Cal. Apr. 1, 2015), plaintiff had signed a contract with Google under the
18
following terms: plaintiff “was to receive a payment processing service that would facilitate her
19
[App] purchase while keeping her private information confidential in all but specific
20
circumstances under which disclosure was authorized; and Google . . . was to retain a percentage
21
of the App’s purchase price.” “Google did obtain [plaintiff’s] personal information and did retain
22
a percentage of the purchase price of the . . . App,” but Google also, without plaintiff’s permission,
23
disclosed plaintiff’s personal information to a third party vendor. Id. On damages, the Svenson
24
court, citing New West, concluded that plaintiff had “alleged facts sufficient to show contract
25
damages under a benefit of the bargain theory.”
26
27
28
In an analogous context, this Court concluded that plaintiffs in In re Adobe Systems, Inc.
23
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Privacy Litigation, 66 F. Supp. 3d 1197, 1224 (N.D. Cal. 2014), had established economic injury
2
sufficient to defeat defendant’s motion to dismiss. As this Court observed, “Plaintiffs allege they
3
personally spent more on [defendant’s] products than they would had they known [defendant] was
4
not providing the reasonable security [defendant] represented it was providing.” Id. It is
5
“plausible that a company’s reasonable security practices reduce the risk of theft of customer’s
6
personal data and thus that a company’s security practices have economic value.” Id.
7
Accordingly, plaintiffs had “plausibly pleaded” that “they [had] personally lost money or property
8
as a result” of defendant’s actions. Id. at 1223–24 (internal quotation marks omitted).
9
In response to the line of decisions discussed above, the Anthem Defendants contend that
Plaintiffs’ “benefit of the bargain theory . . . fails because they do not allege facts showing that any
11
United States District Court
Northern District of California
10
alleged payments were earmarked for data security. Anthem Mot. at 11. Moreover, the Anthem
12
Defendants cite several out of circuit cases where courts have declined to award benefit of the
13
bargain damages. Both arguments are unavailing.
14
First, the Anthem Defendants have identified no California or Ninth Circuit authority to
15
suggest that an entity must precisely “earmark” what portion of Plaintiffs’ premiums went towards
16
protecting Plaintiffs’ data privacy. Indeed, California courts have consistently rejected such
17
arguments. In Lewis Jorge Construction Management, Inc. v. Pomona Unified School District,
18
102 P.3d 257, 266 (Cal. 2004), for instance, the California Supreme Court held that, although
19
contract “damages [must] be pled with [some degree of] particularity,” they need not be “proven .
20
. . with ‘mathematical precision.’” As such, “[w]here the fact of damages is certain, the amount of
21
damages need not be calculated with absolute certainty. The law requires only that some
22
reasonable basis of computation of damages be used, and the damages may be computed even [i]f
23
the result reached is an approximation.” Sargon Enterprises, Inc. v. Univ. of S. Cal., 288 P.3d
24
1237, 1254 (Cal. 2012) (internal quotation marks and citation omitted). “This is especially true
25
where it is the wrongful acts of the defendant that have created the difficulty in proving the
26
amount of loss.” Id. (ellipses omitted).
27
28
24
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Consistent with the reasoning in Lewis Jorge and Sargon, in the instant case, it is the
2
alleged wrongful acts of the Anthem Defendants—their inability to fulfill their privacy obligations
3
and their inability to set out the expected cost and value of these privacy obligations—which
4
forms the basis of Plaintiffs’ request for Benefit of the Bargain Losses. Put another way, the
5
Anthem Defendants can not evade liability because the Anthem Defendants did not provide, in
6
advance, a breakdown on how much of Plaintiffs’ premiums the Anthem Defendants allocated (or
7
should have allocated) to protecting Plaintiffs’ PII.
Second, the Court finds unavailing the Anthem Defendants’ reliance upon In re Science
9
Applications International Corp. (SAIC) Backup Tape Data Theft Litigation, 45 F. Supp. 3d 14
10
(D.D.C. 2014), and Carlsen v. GameStop, 2015 WL 3538906 (D. Minn. June 4, 2015). Neither
11
United States District Court
Northern District of California
8
case addressed a California breach of contract claim. In fact, in In re SAIC, the district court
12
limited its discussion only to jurisdictional issues and did not even examine any substantive
13
claims. Instead, in a single sentence without citation, the district court concluded that, “[t]o the
14
extent that [p]laintiffs claim that some indeterminate part of their premiums went toward paying
15
for security measures, such a claim is too flimsy to support standing.” 45 F. Supp. 3d at 30.
16
The Carlsen court likewise did not examine a California breach of contract claim.
17
Moreover, defendant in Carlsen allowed users to sign up to receive either paid or free content;
18
defendant’s “Privacy Policy” applied to paying and non-paying users alike. 2015 WL 3538906,
19
*5. As the Carlsen court observed, “because non-paying and paying users received the same
20
Privacy Policy in this case, [p]laintiff cannot establish that the Privacy Policy has intrinsic
21
monetary value attributed to it that was paid for and not received.” Id. In contrast to Carlsen,
22
Plaintiffs here have all paid premiums to the Anthem Defendants. There are no “non-paying”
23
customers. Thus, Plaintiffs may be able to recover Benefit of the Bargain Losses in accordance
24
with their premium payments.
25
26
27
28
ii. Loss of Value of PII
Plaintiffs have also sufficiently pleaded damages for Loss of Value of PII. As the Court
25
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
explained in the First Motion to Dismiss Order, the Ninth Circuit and a number of district courts
2
have approved such damages theories. In In re Facebook Privacy Litigation, 572 F. App’x 494,
3
494 (9th Cir. 2014), for instance, “[p]laintiffs allege[d] that the information disclosed by
4
[defendant could] be used to obtain personal information about plaintiffs, and that they were
5
harmed both by the dissemination of their personal information and by losing the sales value of
6
that information.” These allegations, the Ninth Circuit determined, were “sufficient to show the
7
element of damages for [plaintiffs’] breach of contract and fraud claims.” Id.
8
9
In like manner, both this Court in In re Adobe and the district court in Corona v. Sony
Pictures Entertainment, Inc., 2015 WL 3916744 (N.D. Cal. June 15, 2015), concluded that
plaintiffs had sufficiently pleaded economic injury by claiming “that the[ir] PII was stolen and
11
United States District Court
Northern District of California
10
posted on file-sharing websites for identity thieves to download.” Corona, 2015 WL 3916744, *3;
12
see also In re Adobe, 66 F. Supp. 3d at 1214 (“[T]he risk that [p]laintiffs’ personal data will be
13
misused by the hackers who breached [defendant’s] network is immediate and very real.”).
14
Finally, in Svenson, the district court found that plaintiff’s “allegations of diminution in value of
15
her personal information are sufficient to show contract damages [under California law] for
16
pleading purposes.” 2015 WL 1503429, *5.
17
The Anthem Defendants, however, read these cases to effectively impose two pleading
18
requirements upon Plaintiffs: to plead “both that there was a ‘robust’ market for [Plaintiffs’ PII]
19
and that [P]laintiffs had been financially harmed by [the data breach by] usurping their ability to
20
sell that information themselves.” Anthem Mot. at 5 (quoting In re Google, Inc. Privacy Policy
21
Litig., 2015 WL 4317479, *4 (N.D. Cal. July 15, 2015)) (emphasis added). The Court declines to
22
adopt such an interpretation.
23
Indeed, even if both of these requirements were to apply, the SAC does aver that Plaintiffs’
24
PII “is such a valuable commodity to identity thieves that once the information has been
25
compromised, criminals often trade the information on the cyber black-market for years.” SAC ¶
26
412. Relatedly, “[w]ith access to an individual’s [PII], criminals can do more than just empty a
27
28
26
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
victim’s bank account—they can also commit various types of fraud . . . [they] may obtain a job
2
using the victim’s Social Security Number. Id ¶ 411. These allegations could be read to infer that
3
an economic market existed for Plaintiffs’ PII, and that the value of Plaintiffs’ PII decreased as a
4
result of the Anthem data breach. Indeed, in another data breach case, the Seventh Circuit
5
remarked: “Presumably, the purpose of [a] hack is, sooner or later, to make fraudulent charges or
6
assume those consumers’ identities.” Remijas v. Neiman Marcus Gp., LLC, 794 F.3d 688, 693
7
(7th Cir. 2015). “Why else would hackers break into a store’s database and steal consumers’
8
private information?” Id.
9
Moreover, setting aside the above allegations, the Court also finds that Plaintiffs are not
required to plead that there was a market for their PII and that they somehow also intended to sell
11
United States District Court
Northern District of California
10
their own PII. Not even the authority that the Anthem Defendants cite supports this proposition.
12
In In re Google, the district court observed that “[p]laintiffs do not allege economic injury from
13
any dissemination . . . or any injury in the form of loss of the [p]laintiffs’ ability to sell their own
14
information or its market value.” 2015 WL 4317479, *5 (emphasis added); see also id.
15
(“Plaintiffs plead neither the existence of a market for their email addresses and names nor any
16
impairment of their ability to participate in that market.”) (emphasis added). These statements
17
appear to require a plaintiff to allege that there was either an economic market for their PII or that
18
it would be harder to sell their own PII, not both.
19
In sum, In re Facebook, Corona, Svenson, or In re Google do not support the two part
20
requirement that the Anthem Defendants advocate. Accordingly, Plaintiffs have sufficiently
21
alleged Loss of Value of PII.
22
23
iii. Consequential Out of Pocket Expenses
Finally, the Anthem Defendants contend that Plaintiffs can not recover “Consequential Out
24
of Pocket Expenses” because “[t]here is an obvious alternative explanation for the injuries
25
Plaintiffs allege.” Anthem Mot. at 2 (internal quotation marks omitted). Namely, “[d]ozens of
26
major American businesses and the federal government have been the victims of cyberattacks in
27
28
27
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
recent years aimed at stealing millions of Americans’ PII.” Id. These data breaches have
2
“result[ed] in Americans becoming the victims of identity theft each year.” Id. at 2–3.
3
The Court found this argument meritless in the First Motion to Dismiss Order. It remains
4
meritless. As the Court has explained, “under Defendants’ theory, a company affected by a data
5
breach could simply contest causation by pointing to the fact that data breaches occur all the time,
6
against various private and public entities.” First MTD Order at 36. “This would, in turn, create a
7
perverse incentive for companies: so long as enough data breaches take place, individual
8
companies will never be found liable. No [California law], the relevant authority addressing
9
causation, or the specific facts of this case support such a legal theory.” Id.
10
On the instant motions to dismiss, the Court once again emphasizes: no court has ever
United States District Court
Northern District of California
11
accepted the Anthem Defendants’ argument in the data breach context. In fact, defendant in
12
Remijas made this exact same argument: “[Defendant] argues that these plaintiffs cannot show
13
that their injuries are traceable to the data incursion at the company rather than to one of several
14
other large-scale breaches that took place around the same time.” 794 F.3d at 696. In response,
15
the Seventh Circuit explained that “[t]he fact that . . . some other store might have caused . . .
16
plaintiffs’ private information to be exposed does nothing to negate . . . plaintiffs’ standing to
17
sue.” Id. “If there are multiple companies that could have exposed . . . plaintiffs’ private
18
information to the hackers, then the common law of torts has long shifted the burden of proof to
19
defendants to prove that their negligent actions were not the but-for cause of . . . plaintiff’s injury.”
20
Id. (internal quotation marks omitted). “It is enough at this stage of the litigation that [defendant]
21
admitted that 350,000 cards might have been exposed and that it contacted members of the class to
22
tell them they were at risk. Those admissions and actions by the store adequately raise the
23
plaintiffs’ right to relief above the speculative level.” Id.
24
Remijas is consistent with Ninth Circuit precedent. In Starr v. Baca, 652 F.3d 1202, 1216
25
(9th Cir. 2011), the Ninth Circuit held that, “[i]f there are two alternative explanations, one
26
advanced by defendant and the other advanced by plaintiff, both of which are plausible, plaintiff’s
27
28
28
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
complaint survives a motion to dismiss under Rule 12(b)(6).” The Starr court further held that a
2
plaintiff’s complaint “may be dismissed only when defendant’s plausible alternative explanation is
3
so convincing that plaintiff’s explanation is implausible.” Id.
4
Despite multiple rounds of briefing, the Anthem Defendants have failed to demonstrate
5
why the reasoning in Remijas and Starr should not govern the instant case. The Anthem
6
Defendants have never challenged the fact that (1) the Anthem Database was breached, (2) that
7
this breach exposed the PII of approximately 80 million individuals, and (3) that the Anthem
8
Database contained the PII of every single putative class member in the instant action. That is
9
sufficient for purposes of pleading consequential injury at this point in litigation.
10
As a final matter, the Anthem Defendants have also cited no binding precedent to suggest
United States District Court
Northern District of California
11
that Plaintiffs are precluded from recovering for specific types of Consequential Out of Pocket
12
Expenses, such as credit monitoring, under California contract law. The Court has found none in
13
its own research. In fact, some courts have suggested that an individual may recover “actual
14
damages” that were incurred in order “to mitigate” costs associated with being a “victim of
15
identity theft.” Ruiz v. Gap, Inc., 622 F. Supp. 2d 908, 918 (N.D. Cal. 2009). Plaintiffs have
16
sufficiently alleged such a relationship here. Coonce, for instance, alleges that he received a
17
notice from Anthem in March 2015 informing him that his PII had been compromised. Five
18
months later, Coonce “was notified . . . that his debit card number had been stolen and used for
19
unauthorized charges.” SAC ¶ 18. Consequently, Coonce spent $312 on identity theft and credit
20
monitoring services. Id. Thus, Coonce was notified that his PII had been stolen, Coonce later
21
learned that his financial information had been compromised, and, as a result, Coonce took actions
22
to prevent further financial damage.
23
In sum, the Court finds that Bronzo, Carter, Coonce, and Solomon, who had individual or
24
fully-insured group plan contracts with the Anthem Defendants, have sufficiently alleged a breach
25
of contract claim under California law.
26
27
28
2. ASO Agreements
29
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
The Court turns next to California Plaintiffs Daniel Randrup, Steve Kawai, Kelly Tharp,
2
and Daniel Tharp, who were enrolled in ASO agreements. Because the Anthem Defendants do
3
not act as the insurer in these agreements and because these agreements are between an employer
4
and an Anthem Defendant, Plaintiffs assert their California breach of contract claim as third party
5
beneficiaries. See SAC ¶ 454 (“The Plaintiffs and Class Members who enrolled in Self-Funded
6
Plans for whom Anthem provided only administrative services sue as third-party beneficiaries.”).
7
In California, “[a] third party beneficiary may enforce a contract made expressly for his or
8
her benefit.” Kaiser Eng’rs, Inc. v. Grinnell Fire Protection Sys. Co., 219 Cal. Rptr. 626, 629 (Ct.
9
App. 1985). “The intent of the contracting parties to benefit expressly that third party must appear
from the terms of the contract.” Id. Over time, the term “expressly” has come to mean “merely
11
United States District Court
Northern District of California
10
the negative of ‘incidentally.’” Id. “[T]he third person need not be named or identified
12
individually to be an express beneficiary. A third party may enforce a contract if it can be shown
13
that he or she is a member of the class for whose express benefit the contract was made.” Id.
14
“Generally, it is a question of fact whether a particular third person is an intended beneficiary of a
15
contract.” Prouty v. Gores Tech. Gp., 18 Cal. Rptr. 3d 178, 184 (Ct. App. 2004). With these
16
principles in mind, the Court addresses Randrup, Kawai, and the Tharps’ claims in turn.
17
18
a. Randrup
Randrup has failed to sufficiently allege a third party beneficiary claim, for two reasons.
19
First, Randrup’s ASO, on the first page, states that “[n]either SISC III [Randrup’s employer] nor
20
Anthem Blue Cross Life and Health intends this Agreement to confer any benefit on any persons
21
who are not parties to this Agreement.” ECF No. 473-7 at 6. The following page defines
22
“Parties” as “SISC III and Anthem Blue Cross Life and Health.” Id. at 7. Read together, these
23
provisions suggest that SISC III and Anthem Blue Cross Life and Health did not intend to confer
24
third party beneficiary status to Randrup. Indeed, in similar contexts, courts have read such
25
clauses to preclude litigants from asserting third party beneficiary claims. See, e.g., Balsam v.
26
Tucows Inc., 2009 WL 3463923, *3–*4 (N.D. Cal. Oct. 23, 2009) (finding that party could not
27
28
30
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
bring claim where agreement included term that read: “This Agreement shall not be construed to
2
create any obligation by either ICANN or Registrar to any non-party to this Agreement.”).
3
Second, although Plaintiffs contend that Randrup’s contract “incorporated privacy policies
4
that Anthem violated,” Anthem Opp’n at 7, the agreement between SISC III and Anthem Blue
5
Cross Life and Health does not support this contention. Unlike the contracts described above,
6
Randrup’s ASO agreement does not mention the PIPP or the Annual Privacy Notice. In fact, in
7
their briefing, Plaintiffs do not even point to a single instance in Randrup’s ASO agreement where
8
the Anthem Defendants promised to protect Randrup’s PII. Id.
9
After the Court’s own review of the agreement at issue, the Court has found only one
provision that could be taken to refer to the Anthem Defendants’ privacy obligations: “Anthem
11
United States District Court
Northern District of California
10
Blue Cross Life and Health . . . agrees that all individually identifiable information regarding
12
persons covered under the Plan . . . is confidential and shall be (i) used only in order to carry out
13
the provisions of this Agreement . . . and (ii) disclosed only as otherwise provided in this
14
Agreement or as required by law.” ECF No. 473-7 at 10. This statement differs markedly from
15
the statements made in the contracts of California Plaintiffs under individual and fully-insured
16
group plans. At no point in this statement do the parties refer to Anthem’s specific privacy
17
obligations. Nor does this statement direct Randrup to visit Anthem’s public website or contact
18
Anthem’s customer service department for a copy of Anthem’s privacy policies. Thus, the content
19
of this single statement, read together with the above statements disclaiming any third party rights,
20
demonstrate that Randrup may not pursue a breach of contract claim.
21
Prouty v. Gores Technology Group and Milmoe v. Gevity HR, Inc., 2006 WL 2691393
22
(N.D. Cal. Sept. 20, 2006), do not compel a contrary finding. Both Prouty and Milmoe addressed
23
whether an employee could assert a third party beneficiary claim in the context of a contract
24
between two companies that acted as co-employers. As other courts have noted, Prouty and
25
Milmoe created a limited exception to the general rule regarding contractual clauses that disclaim
26
third party beneficiary claims. Balsam, 2009 WL 3463923, *4. “[I]n Prouty, the ‘specific’ clause
27
28
31
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
that the third parties sought to enforce was an amendment to an agreement.” Id. “That the
2
amendment was added after the general no third party beneficiary statement was included in the
3
agreement was strong evidence of the parties’ intent to modify the original terms of the
4
agreement.” Id. Moreover, “the clause protecting the employees in Prouty was aimed at
5
protecting a narrow, specifically-identified class of people, namely employees of one party’s
6
subsidiary.” Id. Likewise, in Milmoe, “the plaintiff’s work and wages were the [express] subject
7
of the contract, thus making it entirely plausible that parts of the contract were intended for the
8
express benefit of the plaintiff.” Id. at *5.
9
Such circumstances are not at play here. Although Plaintiffs contend that “under
California law, a general ‘no third party beneficiary’ clause may be trumped by more specific
11
United States District Court
Northern District of California
10
contract provisions that create benefits for a specific group,” Plaintiffs have identified no such
12
specific provisions here. Anthem Opp’n at 7. As such, unlike Prouty and Milmoe, there is no
13
indication that the parties intended to allow Randrup to pursue a California breach of contract
14
claim against the Anthem Defendants. Accordingly, the Court finds that Randrup can not proceed
15
with his breach of contract claim against the Anthem Defendants.
16
Additionally, the Court denies Plaintiffs’ leave to amend Randrup’s claim. The Court may
17
grant leave to amend unless doing so would unduly prejudice the opposing party, cause undue
18
delay, or be futile, or if the moving party has acted in bad faith. These factors, however, are “not
19
given equal weight.” Bonin v. Calderon, 59 F.3d 815, 845 (9th Cir. 1995). “Futility of
20
amendment can, by itself, justify the denial of a motion for leave to amend.” Id. Amendment here
21
would be futile. Randrup’s ASO agreement expressly disclaims third party beneficiary claims and
22
includes only a single provision that discusses the Anthem Defendants’ privacy obligations. At no
23
point in Randrup’s agreement are the PIPP or Annual Privacy Notice mentioned. Furthermore, “a
24
district court has broad discretion to grant or deny leave to amend, particularly where the court has
25
already given a plaintiff one or more opportunities to amend his complaint.” Mir v. Forsburg, 646
26
F.2d 342, 347 (9th Cir. 1980). Plaintiffs have now had two opportunities to amend the complaint.
27
28
32
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
The SAC addresses the deficiencies identified in the First Motion to Dismiss Order for several
2
California Plaintiffs, but not for Randrup.
3
Turning briefly to the other relevant leave to amend factors, the Court finds that providing
4
leave to amend would also result in undue delay and could prejudice the Anthem Defendants. The
5
parties are proceeding apace with the case schedule, with fact discovery set to close on October
6
17, 2016 and expert discovery set to close on January 23, 2017. Providing Plaintiffs with leave to
7
amend, thus triggering another motion to dismiss, would delay the case schedule and prevent this
8
action from efficient resolution.
9
10
b. Kawai
Kawai was employed by the State of California and was enrolled in a CalPERS health plan
United States District Court
Northern District of California
11
administered by Anthem Blue Cross of California. SAC ¶ 19. The ASO agreement between
12
CalPERS and Anthem Blue Cross of California states that “[t]he California Legislature and
13
CalPERS have established an organized program for the provision of health benefits to State of
14
California Employees.” ECF No. 473-6 at 35. Unlike Randrup’s ASO agreement, Kawai’s ASO
15
agreement does not include a provision that expressly disclaims third beneficiary status.
16
Moreover, also unlike Randrup’s ASO agreement, Kawai’s ASO agreement includes 11
17
pages that describe the Anthem Defendants’ commitment to protect individual privacy. See id. at
18
39–42; 48–54. These obligations include a promise to “take all reasonable and necessary steps to
19
prevent the unauthorized disclosure, modification or destruction of the Disclosing Party’s
20
Information Assets.” Id. at 40. Anthem Blue Cross of California “must, at a minimum, use the
21
same degree of care to protect the Disclosing Party’s Information Assets that it uses to protect its
22
own Information Assets.” Id. Kawai’s ASO agreement further provides that Anthem Blue Cross
23
“will maintain the confidentiality of all information and documents relating to Members and will
24
ensure all Member information is kept strictly confidential, and, as applicable, in accordance with
25
federal and state law. All such information will be treated as sensitive and propriety in accordance
26
with CalPERS confidentiality laws, Contractor’s confidentiality policies and procedures,
27
28
33
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
applicable physician code of ethics, constitutional right of privacy, all applicable federal and state
2
law and requirements of all applicable accrediting bodies.” Id. at 41–42 (emphasis added). Taken
3
together, these statements appear to sufficiently incorporate by reference Anthem’s privacy
4
policies, such as its PIPP and Annual Privacy Notice.
5
Finally, Kawai’s ASO agreement includes, as an attachment, a Business Associate
6
Agreement, formed between CalPERS, the Plan Sponsor, and Anthem Blue Cross of California,
7
the Business Associate. “In order to share P[I]I with third parties, . . . HIPAA requires health care
8
plans and providers to enter into business associate agreements, [which are] contracts obligating
9
the third parties to abide by HIPAA’s restrictions on P[I]I disclosures.” Monarch Fire Prot. Dist.
of St. Louis Cnty, Mo. v. Freedom Consulting & Auditing Servs., Inc., 678 F. Supp. 2d 927, 932
11
United States District Court
Northern District of California
10
(E.D. Mo. 2009); see 45 C.F.R. § 164.502(e)(1)(i) (“A covered entity may disclose protected
12
health information to a business associate and may allow a business associate to create, receive,
13
maintain, or transmit protected health information on its behalf.”). Kawai’s Business Associate
14
Agreement sets forth detailed privacy provisions, which include a provision that Anthem Blue
15
Cross of California “implement administrative, physical, and technical safeguards (including
16
written policies and procedures) that reasonably and appropriately protect the confidentiality,
17
integrity, and availability of” PII. ECF No. 473-6 at 49.
18
In sum, the provisions in the main ASO agreement and the Business Associate Agreement
19
provide evidence that (1) Kawai was an intended third party beneficiary between CalPERS and
20
Anthem Blue Cross of California and that (2) provisions in the ASO agreement could be read to
21
allow Kawai to pursue a third party beneficiary claim.
22
The Anthem Defendants sole argument in response to this conclusion is that the purpose of
23
the Business Associate Agreement is to “implement safeguards to protect electronic health
24
information as required by the HIPAA Security Rule.” Anthem Mot. at 10. Consequently, the
25
Business Associate Agreement only memorializes certain preexisting legal obligations, which
26
“do[] not create contractual rights.” Id.
27
28
34
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
This contention is flawed in two respects. First, as outlined above, the attached Business
2
Associate Agreement does not contain all of Anthem Blue Cross of California’s privacy
3
obligations. Several obligations are included in the main ASO agreement, such as a promise to
4
“maintain the confidentiality of all information and documents relating to Members and will
5
ensure all Member information is kept strictly confidential.” ECF No. 473-6 at 41 (emphasis
6
added). Thus, even if the Court were to set the Business Associate Agreement aside, the Court
7
would nevertheless find that Kawai could maintain a third party beneficiary claim.
8
Second, very few courts have considered whether Business Associate Agreements create
independent contractual rights. There is at least some regulatory language and case law, however,
10
to suggest that they do. The regulations governing Business Associate Agreements state that “[a]
11
United States District Court
Northern District of California
9
business associate may use or disclose protected health information only as permitted or required
12
by its business associate contract or other arrangement pursuant to [45 C.F.R.] § 164.504(e) or as
13
required by law.” 45 C.F.R. § 164.502(a)(3) (emphasis added). The prevalent use of the word
14
“or” suggests that Business Associate Agreements may be implemented such that they cover more
15
ground than what would be required by federal law.
16
This interpretation is consistent with the understanding adopted by the Eastern District of
17
Missouri in Monarch Fire Protection. In that case, plaintiff asked an auditing firm, Freedom
18
Consulting & Auditing Services (“Freedom”), to review whether an individual had “use[d]
19
[plaintiff’s health] Plan for procedures that should not have been covered.” 678 F. Supp. 2d at
20
932. Plaintiff subsequently filed suit for breach of contract “because Freedom breached a number
21
of provisions of the [Business Associate Agreement] by, among other things, failing to
22
immediately remove P[I]I from documentation received for purposes of the audit, disclosing P[I]I
23
to [unauthorized third parties], and retaining P[I]I after completing the audit.” Id. at 935. After
24
reviewing the terms of the Business Associate Agreement, the Monarch Fire Protection court
25
concluded that plaintiff was “entitled to summary judgment that Freedom breached the [Business
26
Associate Agreement] by divulging P[I]I received in the audit process.” Id. at 938. The Eighth
27
28
35
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Circuit affirmed. Monarch Fire Prot. Dist. of St. Louis Cnty, Mo. v. Freedom Consulting &
2
Auditing Servs., Inc., 644 F.3d 633 (8th Cir. 2011). Plaintiff in Monarch Fire Department was
3
therefore able to prevail on a breach of contract claim based upon privacy obligations set forth in a
4
Business Associate Agreement. There is no reason why Kawai should not be able to do the same.
5
Thus, having concluded that Kawai has sufficiently alleged a third party beneficiary claim,
6
the Court turns finally to the Anthem Defendants’ remaining argument: whether Kawai may
7
recover damages. Here, the Anthem Defendants argue that damages are not recoverable because
8
“Plaintiffs’ employers, and not Plaintiffs, . . . made payments to the Anthem Defendants.”
9
Anthem Mot. at 12. Kawai, however, alleges that he paid premiums to CalPERS, which then used
these premiums to pay for services offered by the Anthem Defendants. Under California law,
11
United States District Court
Northern District of California
10
“when a plaintiff seeks to secure benefits under a contract as to which he is a third-party
12
beneficiary, he must take that contract as he finds it.” Marina Tenants Ass’n v. Deauville Marina
13
Dev’t Co., 226 Cal. Rptr. 321, 327 (Ct. App. 1986) (internal quotation marks and alterations
14
omitted). Applying this principle to the instant case, the Anthem Defendants do not contest that
15
CalPERS would be able to recover Benefit of the Bargain Losses, Loss of Value of PII, or
16
Consequential Out of Pocket Expenses. By asserting a third party beneficiary claim, Kawai seeks
17
to step into the shoes of CalPERS and recover the same damages that CalPERS would be able to
18
recover. Kawai has thus “take[n] th[e] contract as he finds it,” and has asserted rights
19
commensurate to what CalPERS could assert. Id. Accordingly, Kawai’s attempt to recover
20
contract damages does not warrant dismissal.
21
c. Daniel and Kelly Tharp
22
The Tharps’ ASO agreement is more analogous to Randrup’s than to Kawai’s. Indeed,
23
although the Tharps’ ASO agreement does not contain a clause that specifically disclaims third
24
party beneficiary claims, the agreement does include a No Assignment Clause: “Unless it has first
25
obtained the written consent of the other Party, neither Party may assign this Agreement to any
26
other person.” ECF No. 473-9 at 6. Although California courts have, in some instances, allowed
27
28
36
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
third parties to pursue a claim notwithstanding a no assignment clause, the general view is that
2
such a clause does not point in the Tharps’ favor. See Schauer v. Mandarin Gems of Cal., Inc., 23
3
Cal. Rptr. 3d 233, 237–40 (Ct. App. 2005).
4
More importantly, the Tharps’ ASO agreement barely mentions the Anthem Defendants’
5
privacy obligations. The agreement does not mention the PIPP or Annual Privacy Notice, nor
6
does it discuss any security measures that the Anthem Defendants must undertake. One specific
7
section states that the Anthem Defendants must comply with the legal requirements set forth under
8
HIPAA. ECF No. 473-8 at 15. Another section makes a vague commitment to comply with
9
Anthem’s standard policies and procedures, but does not mention whether these standard policies
10
United States District Court
Northern District of California
11
include Anthem’s privacy obligations. Id. at 8.
Although Plaintiffs appear to acknowledge these deficiencies, Plaintiffs nonetheless
12
contend that the Tharps’ ASO agreement “expressly committed to comply with HIPAA,” which,
13
Plaintiffs argue, provides the basis for a breach of contract claim. Anthem Opp’n at 7. The Court
14
disagrees. As noted in the First Motion to Dismiss Order, “plaintiffs must . . . do something more
15
to allege a breach of contract claim than merely point to allegations of a statutory violation.”
16
Wiebe v. NDEX West, LLC, 2010 WL 2035992, *3 (C.D. Cal. May 17, 2010) (quoting Berger v.
17
Home Depot U.S.A., Inc., 476 F. Supp. 2d 1174, 1177 (C.D. Cal. 2007)). A breach of contract
18
claim based solely upon a pre-existing legal obligation to comply with HIPAA can not survive
19
dismissal.
20
Having determined that the Tharps have not stated a viable third party beneficiary claim,
21
the Court also denies Plaintiffs’ leave to amend. As with Randrup, providing leave to amend
22
would be futile, would result in undue delay, and could prejudice the opposing party. Moreover,
23
Plaintiffs have already produced the Tharps’ ASO agreement, and the Court has determined, after
24
reviewing this agreement in detail, that it does not contain the provisions necessary to plead a third
25
party beneficiary claim.
26
27
28
In sum, the Anthem Defendants’ motion to dismiss Daniel Randrup, Kelly Tharp, and
37
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Daniel Tharp’s breach of contract claim is GRANTED with prejudice. The Anthem Defendants’
2
motion to dismiss the breach of contract claims of the remaining California Plaintiffs is DENIED.
3
4
C. New Jersey Breach of Contract (against Non-Anthem Defendants)
In order to state a claim for breach of contract under New Jersey law, Plaintiffs “must
5
allege (1) a contract between the parties; (2) a breach of that contract; (3) damages flowing
6
therefrom; and (4) that the party stating the claim performed its own contractual obligations.”
7
Frederico v. Home Depot, 507 F.3d 188, 203 (3d Cir. 2007). In moving to dismiss Plaintiffs’ New
8
Jersey breach of contract claim, the Non-Anthem Defendants contend that the SAC “fails to allege
9
facts identifying a contractual provision that allegedly was breached,” that Plaintiffs did not
“suffer[] any injury as a result of any alleged breach,” and that Plaintiffs’ “benefit of the bargain
11
United States District Court
Northern District of California
10
theory of injury” is barred by the filed rate doctrine. Non-Anthem Mot. at 6 (internal quotation
12
marks omitted). These contentions are discussed in turn.
13
1. Contractual Provisions
14
Because there is only one New Jersey Plaintiff, Elizabeth Ames (“Ames”), there is only
15
one set of contracts at issue. Ames avers that she “was enrolled in a Horizon Blue Cross Blue
16
Shield of New Jersey health plan,” and “was previously enrolled in a Blue Cross Blue Shield of
17
Florida health plan.” SAC ¶ 85. Ames was insured by Horizon Blue Cross Blue Shield of New
18
Jersey under an individual health plan and by Horizon Blue Cross Blue Shield of Florida under an
19
ASO agreement.
20
Horizon Blue Cross Blue Shield of Florida does not challenge whether Ames’s contract
21
included certain privacy provisions. Non-Anthem Mot. at 6 n.6. Horizon Blue Cross Blue Shield
22
of Florida is only challenging whether Ames can recover contractual damages. Id.
23
On the other hand, Horizon Blue Cross Blue Shield of New Jersey challenges whether
24
Ames’s contract included any privacy obligations. Plaintiffs assert that Anthem’s privacy policies
25
were part of Ames’s contract with Horizon Blue Cross Blue Shield of New Jersey either via
26
express attachment or via incorporation by reference. On express attachment, the parties agree
27
28
38
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
that the Court’s analysis should begin with the Benefits booklet that Horizon Blue Cross Blue
2
Shield of New Jersey provided to Ames. This booklet contains eight sections. Two are of
3
particular importance here: Section 7, “Important Notices,” and Section 8, “Your Policy.” ECF
4
No. 491-1 at 7.
5
In Section 7, Horizon Blue Cross Blue Shield of New Jersey outlines its “Notice of
6
information privacy practices.” Id. at 17. This Notice states that Horizon Blue Cross Blue Shield
7
of New Jersey “will abide by the statements made in this Notice,” and “want[s]” you to know that
8
[it] recognize[s] [its] obligation to keep information about you secure and confidential.” Id. The
9
Notice further provides that “[w]e also maintain appropriate administrative, technical and physical
safeguards to reasonably protect your [PII].” Id.; see also id. (“Our employees get training
11
United States District Court
Northern District of California
10
regarding the need to maintain your [PII] in the strictest confidence.”). The entirety of this Notice
12
is reproduced on Horizon Blue Cross Blue Shield of New Jersey’s website, and Ames’ Booklet
13
expressly directs Ames to “[g]o online” for further information on the Non-Anthem Defendants’
14
policies. See ECF No. 491-1 at 8; ECF No. 473-11 at 26–31.
15
Section 8, the “Your Policy” section, contains information on premiums, specialty case
16
management, and coordination of benefits. ECF No. 491-1 at 21–22. A provision of the “Your
17
Policy” section also contains a clause which states that “[t]his Policy, including the endorsements
18
and the attached papers, if any, constitutes the entire contract of insurance.” Id. at 24.
19
The core dispute is whether this clause excludes consideration of the privacy obligations
20
set forth in Section 7. According to the Non-Anthem Defendants, this integration clause restricts
21
Ames’ contract to include only those provisions in Section 8, the “Your Policy” section. Non-
22
Anthem Reply at 4. Plaintiffs, on the other hand, contend that the integration clause’s language—
23
“This Policy, including the endorsements and the attached papers, if any, constitutes the . . .
24
contract of insurance”—incorporates the privacy obligations in Section 7. As Plaintiffs note, “[i]t
25
defies logic and the plain meaning of ‘attached papers’ for Defendants to argue that this privacy
26
notice, which is physically ‘attached’ to the Policy in the preceding chapter of the same booklet, is
27
28
39
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
not included in this contract.” Non-Anthem Opp’n at 8.
Under New Jersey law, “[w]hen the meaning of an integrated contract is ambiguous, the
3
surrounding circumstances may be introduced for the purpose of elucidation.” Driscoll Const.
4
Co., Inc. v. State, Dep’t of Transp., 853 A.2d 270, 278 (N.J. Super. Ct. App. Div. 2004).
5
However, “[e]ven when the contract on its face is free from ambiguity, evidence of the situation of
6
the parties and the surrounding circumstances and conditions is admissible in aid of
7
interpretation.” Id. Thus, “whether the clause under consideration is regarded as clear and certain,
8
or ambiguous and uncertain, if the intention of the parties is not to be gleaned from a reading of
9
the instrument as a whole, the plaintiff should have had the opportunity of presenting evidence of
10
United States District Court
Northern District of California
11
the facts and circumstances surrounding the execution of the [contract].” Id.
With this in mind, the Court finds more persuasive Plaintiffs’ reading of the integration
12
clause in Ames’ contract. What other meaning could “attached papers” have if not one that
13
includes papers that are literally attached to the Policy? The interpretation advocated by the Non-
14
Anthem Defendants would essentially render superfluous the “attached papers” provision. Such a
15
reading would contravene the New Jersey precedent discussed above, as well as run afoul of the
16
general rule that courts are to “give effect to all parts of the [contract], and an interpretation which
17
gives a reasonable meaning to all its provisions will be preferred to one which leaves a portion of
18
the writing useless or inexplicable.” Maryland Cas. Co. v. Hansen-Jensen, Inc., 83 A.2d 1, 4 (N.J.
19
Super Ct. App. Div. 1951).
20
Plaintiffs have thus sufficiently alleged that Ames’ contract expressly attached Horizon
21
Blue Cross Blue Shield of New Jersey’s privacy obligations, as contained in Section 7 of Ames’
22
booklet. Having determined that these obligations were expressly attached, the Court need not
23
examine whether these obligations were also incorporated by reference.
24
25
26
27
28
2. Damages
a. Benefit of the Bargain Losses
Ames seeks damages in the form of Benefit of the Bargain Losses, Loss of Value of PII,
40
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
and Consequential Out of Pocket Expenses. As to Benefit of the Bargain Losses, the Non-Anthem
2
Defendants’ primary contention is that such damages are barred by the filed rate doctrine. The
3
Non-Anthem Defendants state that this doctrine applies because Plaintiffs’ request for Benefit of
4
the Bargain Losses would require the Court to recalculate insurance premium rates and determine
5
what a reasonable rate would have been.
6
“The filed rate doctrine forbids a regulated entity [from] charg[ing] rates for its services
other than those properly filed with the appropriate federal [or state] regulatory authority.”
8
Weinberg v. Sprint Corp., 801 A.2d 281, 286 (N.J. 2002) (internal quotation marks omitted). “The
9
two core policy goals of the doctrine are (1) the non-discrimination strand, or the prevention of
10
price discrimination by carriers as among ratepayers; and (2) the non-justiciability strand, or the
11
United States District Court
Northern District of California
7
preservation of the role of regulatory agencies in approving reasonable rates and the exclusion of
12
the courts from the rate-making process.” Clark v. Prudential Ins. Co. of Am., 736 F. Supp. 2d
13
902, 913 (D.N.J. 2010). The doctrine “is a product of the deference which courts give to the
14
ratemaking and regulatory processes of administrative bodies.” Richardson v. Standard Guar. Ins.
15
Co., 853 A.2d 955, 961 (N.J. Super. Ct. App. Div. 2004).
16
As construed by the New Jersey Supreme Court, “the filed rate doctrine bars money
17
damages from [regulated entities] where the damage claims are premised on state contract
18
principles, consumer fraud, or other bases on which plaintiffs seek to enforce a rate other than the
19
filed rate.” Weinberg, 801 A.2d at 287. “[T]here is no fraud exception to the filed rate doctrine.”
20
AT & T Corp. v. JMC Telecom, LLC, 470 F.3d 525, 535 (3d Cir. 2006). Consequently, “any
21
remedy requiring a refund of a portion of the filed rate is barred by application of the filed rate
22
doctrine.” Smith v. SBC Commc’ns, 839 A.2d 850, 860 (N.J. 2004) (emphasis added).
23
The filed rate doctrine applies to the instant case. As an initial matter, although Plaintiffs
24
correctly assert that the filed rate doctrine was originally “grounded in federal preemption
25
principles,” both state and federal courts in New Jersey have determined that the doctrine also now
26
applies to industries subject to state regulation. See, e.g., Richardson¸ 853 A.2d at 963 (“[W]e
27
28
41
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
reject plaintiff’s argument that the doctrine does not apply to state ratemaking.”); Clark, 736 F.
2
Supp. 2d at 914 (“[T]he Court finds that the filed rate doctrine may be applied to rate-making by a
3
New Jersey regulatory agency.”).
4
Notably, in Clark, the district court applied the filed rate doctrine to bar various state law
5
claims asserted against a health insurer. Plaintiffs in Clark asserted causes of action under the
6
New Jersey Consumer Fraud Act and common law fraudulent misrepresentation, fraudulent
7
omission, and breach of the duty of good faith and fair dealing. Id. at 912. Specifically, plaintiffs
8
alleged that defendant, a health insurer, had “affirmatively misrepresented the reason[] for . . .
9
escalating premiums.” Id. at 909. According to plaintiffs, defendant had apparently stated that the
rising premiums were the result of general increases in medical costs rather than disclosing
11
United States District Court
Northern District of California
10
defendant’s decision to prevent new policyholders from joining the insurance plan. Id. at 908.
12
“With [the insurance plan] closed to new entrants, and an insufficient percentage of healthy
13
policyholders remaining to subsidize the costs of unhealthy policyholders,” defendant’s actions
14
caused the insurance plan to enter into an economically unsustainable “death spiral.” Id.
15
Defendant in Clark did not challenge the allegations of affirmative misrepresentation. Instead,
16
defendant focused on the fact that plaintiffs effectively sought “a refund of all moneys acquired by
17
means of unlawful practices”—a form of relief that defendant argued was barred by the filed rate
18
doctrine. Id. at 919.
19
The Clark court agreed. In reaching this decision, the district court rejected plaintiffs’
20
argument that the filed rate doctrine did not apply to health insurers. Relying upon the New Jersey
21
Superior Court Appellate Division’s Richardson decision, the Clark court noted that “(1) many
22
other jurisdictions ha[ve] applied the doctrine to insurance industry rate-making; (2) the insurance
23
industry in New Jersey is heavily regulated; and (3) the statutory framework governing rate-
24
making for [health] insurance in New Jersey is meaningful and extensive.” Id. at 915. Notably,
25
all health insurance premiums in New Jersey must be “submitted and approved by the New Jersey
26
Department of Banking and Insurance (DOBI), the state agency specifically authorized by New
27
28
42
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Jersey law to regulate insurance rates.” Id.
2
Both Richardson and Clark apply here. Indeed, as in both cases, the Non-Anthem
3
Defendants “filed with [DOBI]” the “rates applicable to Ames health plan . . . as required by state
4
law.” Non-Anthem Opp’n at 10. Moreover, Plaintiffs’ request for Benefit of the Bargain Losses
5
constitutes an attempt to “enforce a rate other than the filed rate.” Weinberg, 801 A.2d at 287. As
6
the New Jersey Supreme Court has stated, “any remedy requiring a refund of a portion of the filed
7
rate is barred by application of the filed rate doctrine.” Smith, 839 A.2d at 860 (emphasis added).
8
Here, Plaintiffs’ request for Benefit of the Bargain Losses naturally represents a refund for the
9
portion of Plaintiffs’ premiums that should have, but did not, go towards data security. In
opposing the instant motion, Plaintiffs in fact acknowledge that their request for such losses
11
United States District Court
Northern District of California
10
“could involve a refund of some portion of premiums to compensate Plaintiffs for data security
12
that was promised but not delivered.” Non-Anthem Opp’n at 15.
13
In an attempt to distinguish Clark and Richardson, Plaintiffs argue that they are not
14
“challeng[ing] the intrinsic reasonableness of the rates Non-Anthem Defendants charged for health
15
insurance.” Id. Instead, “Plaintiffs contend that . . . they should be compensated for Defendants’
16
failure to provide what was promised.” Id.
17
This argument, however, has already been considered and rejected. As the Clark court
18
explained, such a request “would [inevitably] require the Court to determine what rate would have
19
been reasonable and thereby interfere with DOBI’s rate-making process.” 736 F. Supp. 2d at 919.
20
“[C]laims for compensatory damages or refund based on insurance premiums [plaintiff] paid in
21
previous years are barred by the filed rate doctrine.” Id. Similarly, in Richardson, the Appellate
22
Division of the New Jersey Superior Court has held that the filed rate “doctrine precludes a claim
23
for damages which would indirectly cause the application of rates different from the filed rates.”
24
853 A.2d at 967 (emphasis added). That is exactly what would happen here: by asking for an
25
across-the-board premium refund to putative class members, Plaintiffs would “indirectly cause the
26
application of rates different from the filed rates.” Id. Finally, in JMC Telecom, the Third Circuit,
27
28
43
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
of which New Jersey is a part, has determined that “the filed rate doctrine has been expanded to
2
exclude claims of insufficient and poor-quality service.” 470 F.3d at 532. In the instant case,
3
Plaintiffs’ basic contention is that Defendants provided poor quality data security rather than
4
reasonable data security, as Defendants promised to do.
5
To be fair, the filed rate doctrine is not without criticism. The U.S. Supreme Court has
6
called the doctrine “harsh,” a sentiment shared by the Third Circuit. Am. Tel. and Tel. Co. v. Cent.
7
Ofc. Tel., Inc., 524 U.S. 214, 223 (1998) (stating that “the filed rate doctrine may seem harsh in
8
some circumstances,” but nonetheless applying doctrine to reverse Ninth Circuit decision); JMC
9
Telecom, 470 F.3d at 533 n.11 (“Although the filed rate doctrine produces harsh results in this
case as alleged, such equitable concerns have been rejected by the Supreme Court. . . . This is true
11
United States District Court
Northern District of California
10
regardless of [a defendant’s] ulterior motives.”). Likewise, various New Jersey judges have
12
described the doctrine as “controversial” and “a legal fiction whose days . . . are numbered.”
13
Richardson, 853 A.2d at 962 (quoting Weinberg, 801 A.2d at 294 (Verniero, J., dissenting)).
14
However, an MDL transferee court is “bound by the same substantive legal standards . . . as would
15
have applied in the transferor court.” In re Korean Air, 642 F.3d at 699. Those standards, as
16
stated by state and federal courts in New Jersey, provide a clear answer to the issue at hand.
17
Accordingly, the Court finds that Plaintiffs’ can not recover Benefit of the Bargain Losses under
18
their New Jersey breach of contract claim.
19
In addition, the Court denies Plaintiffs’ leave to amend, as amendment would be futile.
20
The rules governing the filed rate doctrine have been set forth by federal and state courts in New
21
Jersey. These principles demonstrate that Plaintiffs’ request for Benefit of the Bargain Losses
22
inextricably implicates the filed rate doctrine. Plaintiffs are barred from recovering such damages,
23
and amendment would not change this holding.
24
25
26
27
28
b. Loss of Value of PII
As to Loss of Value of PII, neither party has identified any authority addressing whether a
party may recover for such damages in New Jersey. The Court has found none in its own
44
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
research. In the absence of such authority, the Court finds dismissal of Plaintiffs’ claim for Loss
2
of Value of PII unwarranted.
3
Two reasons counsel in favor of this finding. First, courts have noted that “California and
4
New Jersey [contract] law are substantially similar” to one another. N.J. Best Phone Cards, Corp.
5
v. NobelTel, LLC, 2013 WL 5937422, *3 (D.N.J. Nov. 4, 2013). As noted above, California
6
Plaintiffs may recover for Loss of Value of PII, and there is no reason why this holding should not
7
also apply to the New Jersey breach of contract claim.
8
Second, there is at least some case law to suggest that New Jersey courts would be
receptive to Loss of Value of PII damages. In Canessa v. J.I. Kislak, Inc., 235 A.2d 62 (N.J.
10
Super. Ct. Law. Div. 1967), plaintiff had his family’s picture taken for a local news story by
11
United States District Court
Northern District of California
9
defendant, a local real estate company. After the news story was published, defendant began
12
reprinting and distributing the family’s picture without plaintiff’s permission. Id. at 65. Plaintiff
13
objected, and sued for invasion of privacy. Defendant argued that plaintiff could not recover
14
damages. Id.
15
The New Jersey Superior Court disagreed. As the court outlined, plaintiff’s “names and
16
likenesses belong to them. As such they are property. They are things of value. Defendant has
17
made them so, for it has taken them for its own commercial benefit.” Id. at 76. The Canessa
18
court continued, “New Jersey has always enjoined the use of plaintiff’s likeness and name on the
19
specific basis that it was a protected property right. . . . If it is sufficiently a right of ‘property’ to
20
prevent its use, why should it not also be such a right when damages are sought? For the latter
21
wrong there should likewise be a remedy, i.e., damages.” Id. (citation omitted). Here, as in
22
Canessa, Plaintiffs allege that their PII had economic value, which was diminished because the
23
Non-Anthem Defendants did not take the necessary steps to protect Plaintiffs’ PII.
24
c. Consequential Out of Pocket Expenses
25
As to Consequential Out of Pocket Expenses, the SAC states that “Ames has spent
26
numerous hours addressing issues arising from the Anthem data breach.” SAC ¶ 85. That
27
28
45
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
allegation, the Non-Anthem Defendants argue, is “not enough to state a breach of contract claim.”
2
Non-Anthem Mot. at 9. No New Jersey state courts have ruled on the issue of whether such costs
3
are recoverable. Nor has the Third Circuit or a district court in the Third Circuit provided any
4
guidance.
There are, however, a growing number of courts that have recognized that damages
6
associated with time spent monitoring one’s PII are recoverable. First, in Lewert v. P.F. Chang’s
7
China Bistro, Inc., 2016 WL 1459226, *1 (7th Cir. Apr. 14, 2016), plaintiff alleged that, “after
8
[defendant] initially announced [a data] breach in June 2014,” plaintiff “spent time and effort
9
monitoring his card statements and his credit report to ensure that no fraudulent charges had been
10
made on that card and that no fraudulent accounts had been opened in his name.” Like Ames, the
11
United States District Court
Northern District of California
5
Lewert plaintiff did not actually spend money on credit monitoring services. Moreover, at the
12
time that defendant in Lewert announced the data breach, the parties “did not know how many
13
consumers were affected, whether the breach was general or limited to specific locations, or how
14
long the breach lasted.” Id. Further investigation revealed that plaintiff in Lewert had not even
15
dined at “[t]he only affected restaurant” in plaintiff’s state. Thus, there was no risk that plaintiff’s
16
personal information would be compromised as a result of the data breach. Nevertheless, the
17
Seventh Circuit concluded that “the time and effort” the plaintiff had spent “monitoring both his
18
card statements and his other financial information” was “sufficient” to “support standing based
19
on [plaintiff’s] injuries.” Id. at *1, *3; see also id. (finding “time and money customers spent
20
protecting against future identity theft or fraudulent charges” constitute “injuries sufficient for
21
standing”).
22
Lewert relied significantly upon the Seventh Circuit’s decision in Remijas, a case discussed
23
above. On Consequential Out of Pocket Expenses, the Remijas court specifically concluded that
24
“[m]itigation expenses . . . qualify as [an] actual injur[y]” because the harm was imminent:
25
defendant’s data had been breached, and this event “made the risk of identity theft and fraudulent
26
charges sufficiently immediate to justify mitigation efforts.” Remijas, 794 F.3d at 694.
27
28
46
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Consistent with Lewert and Remijas, the Middle District of Alabama recently denied a
2
motion to dismiss in Smith v. Triad of Alabama, LLC, 2015 WL 5793318 (M.D. Ala. Sept. 29,
3
2015), another data breach case. As the district court summarized, plaintiffs “aver that because of
4
the data breach, they will be required to spend money and time mitigating its effects.” Id. at *8.
5
The district court rejected defendant’s argument that, “in order to establish standing, [p]laintiffs
6
must allege . . . that they suffered some un-reimbursed or out of pocket expense.” Id. After
7
canvassing relevant Eleventh Circuit precedent, the district court concluded that “[t]here is no
8
precedent binding on this court stating that for standing purposes, a victim of identity
9
theft must allege that he or she suffered economic damages or that he/she suffered an un-
10
United States District Court
Northern District of California
11
reimbursed or out-of-pocket expense, and this court will not so hold.” Id. at *9.
Finally, this Court’s In re Adobe decision also supports Plaintiffs’ position. As in Lewert,
12
Remijas, and Smith, this Court held that a data breach creates a “threatened harm” that is
13
“sufficiently concrete and imminent to satisfy” standing. In re Adobe, 66 F. Supp. 3d at 1214.
14
Here, Plaintiffs attempts to respond to this imminent threat—whether by paying out of pocket for
15
credit monitoring or by using their own time for credit monitoring—resulted in damages that may
16
be recoverable.
17
The Non-Anthem Defendants’ reliance upon Holmes v. Countrywide Financial Corp.,
18
2012 WL 2873892 (W.D. Ky. July 12, 2012), is unpersuasive. Plaintiffs in Holmes did assert a
19
New Jersey breach of contract claim arising out of a data breach. Plaintiffs also argued that the
20
time spent “monitoring their credit, researching identity theft, and learning about this case” may
21
“form the foundation for a compensable injury.” Id. at *11. The Holmes court disagreed. The
22
Holmes court, however, found no relevant New Jersey state court or Third Circuit decision on
23
point. Instead, the Holmes court relied entirely upon four federal district court opinions, and
24
provided no independent reasoning outside of a citation to these decisions. Holmes—and all the
25
decisions upon which Holmes relies—predate the Seventh Circuit’s decisions in Lewert and
26
Remijas, the Middle District of Alabama’s decision in Smith, and this Court’s decision in In re
27
28
47
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Adobe. As such, Holmes does not reflect the growing recognition amongst courts of Loss of
2
Value of PII damages. In light of such circumstances, the Court finds Lewert, Remijas, Smith, and
3
In re Adobe more instructive, and thus declines to follow Holmes.
4
In sum, the Non-Anthem Defendants’ motion to dismiss the request for Benefit of the
5
Bargain Losses as to Plaintiffs’ New Jersey breach of contract claim is GRANTED with prejudice.
6
The Non-Anthem Defendants’ motion to dismiss Plaintiffs’ New Jersey breach of contract claim is
7
otherwise DENIED.
8
9
D. New York Unjust Enrichment (against Anthem and Non-Anthem Defendants)
The SAC asserts against all Defendants an unjust enrichment claim, brought under New
York law. SAC ¶¶ 526–34. According to the SAC, Plaintiffs “conferred a monetary benefit on”
11
United States District Court
Northern District of California
10
Defendants, Defendants “appreciated or had knowledge of the benefits conferred upon them by
12
Plaintiffs,” and “[u]nder principals [sic] of equity and good conscience, Defendants . . . should not
13
be permitted to retain the money belonging to Plaintiffs . . . because Defendant[s] failed to
14
implement (or adequately implement) the data privacy and security practices and procedures that
15
Plaintiffs . . . paid for.” Id. ¶¶ 528, 529, 532.
16
Defendants seek dismissal of Plaintiffs’ New York unjust enrichment claim on two
17
grounds. First, Defendants contend that “[t]here can be no unjust enrichment claim under New
18
York law where an express contract governs the same subject manner.” Anthem Mot. at 13.
19
Second, Plaintiffs’ claim “fails because the SAC does not allege facts showing the New York
20
Plaintiffs conferred a benefit on the Anthem Defendants such that they could have been unjustly
21
enriched.” Id. at 14. These arguments are addressed in turn.
22
1. Overlap with Express Contract
23
On the issue of Plaintiffs’ express contracts with Defendants, the New York Court of
24
Appeals has noted, “[a] ‘quasi contract’ only applies in the absence of an express agreement, and
25
is not really a contract at all, but rather a legal obligation imposed in order to prevent a party’s
26
unjust enrichment.” Clark-Fitzpatrick, Inc. v. Long Island R.R. Co., 516 N.E.2d 190, 193 (N.Y.
27
28
48
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
1987) (emphasis added). “It is impermissible . . . to seek damages in an action sounding in quasi
2
contract where the suing party has fully performed on a valid written agreement, the existence of
3
which is undisputed, and the scope of which clearly covers the dispute between the parties.” Id.;
4
accord Corsello v. Verizon N.Y., Inc., 967 N.E.2d 1177, 1185 (N.Y. 2012) (“An unjust enrichment
5
claim is not available where it simply duplicates, or replaces, a conventional contract . . . claim.”).
6
Consistent with Clark-Fitzpatrick and Corsello, the parties agree that Plaintiffs’ New York
7
unjust enrichment claim is duplicative of Plaintiffs’ New York breach of contract claim. Anthem
8
Mot. at 13; Anthem Opp’n at 12. In other words, if New York Plaintiffs can obtain relief via
9
contract, then New York Plaintiffs may not seek relief via unjust enrichment.
10
However, the parties have not designated a New York breach of contract claim as one of
United States District Court
Northern District of California
11
the selected claims, and there has been no briefing as to the scope and breadth of New York
12
Plaintiffs’ contracts. As a result, the parties did not include the New York Plaintiffs’ contracts in
13
the record.
14
The parties have, however, selected a California breach of contract claim. Several courts
15
have held that California and New York contract law are similar to one another. See, e.g., Be In,
16
Inc. v. Google, Inc.¸ 2013 WL 5568706, *6 (N.D. Cal. Oct. 9, 2013) (“[T]he Court agrees that the
17
contract formation law of both California and New York is substantively similar.”); Berkson v.
18
Gogo LLC, 97 F. Supp. 3d 359, 388 (E.D.N.Y. 2015) (“In the instant case, the substantive
19
contractual laws of New York, California, and Illinois are at issue. These states laws are
20
substantively similar with respect to the issue of contract formation.”); cf. First Hill Partners, LLC
21
v. BlueCrest Capital Mgmt. Ltd., 52 F. Supp. 3d 625, 634 (S.D.N.Y. 2014) (“[T]here is no actual
22
conflict between the law governing unjust enrichment claims in New York and in California.
23
Under both New York and California law, an unjust enrichment claim is precluded if a valid
24
contract covers the subject matter of the dispute.”) (citations and footnote omitted).
25
As discussed above, on Plaintiffs’ California breach of contract claim, the parties disagree
26
over whether Defendants’ privacy policies were incorporated into Plaintiffs’ contracts. The Court
27
28
49
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
agreed with the Anthem Defendants on the claims brought by California Plaintiffs Daniel
2
Randrup, Kelly Tharp, and Daniel Tharp, but agreed with Plaintiffs as to the remaining California
3
Plaintiffs. Without an opportunity to review the specific contracts at issue for New York
4
Plaintiffs, it is uncertain whether Defendants’ privacy obligations were also sufficiently
5
incorporated by reference into New York Plaintiffs’ contracts.
6
Under similar factual circumstances, New York courts have denied motions to dismiss
7
unjust enrichment claims. In Joseph Sternberg, Inc. v. Walber 36th St. Assocs., 187 A.D.2d 225,
8
228 (N.Y. App. Div. 1993), the New York Supreme Court Appellate Division noted that “where
9
there is a bona fide dispute as to the existence of a contract or where the contract does not cover
the dispute in issue, plaintiff may proceed upon a theory of quantum meruit and will not be
11
United States District Court
Northern District of California
10
required to elect his or her remedies.” The court subsequently determined that the contract at issue
12
was ambiguous, and that, at the motion to dismiss stage, dismissal was unwarranted.
13
The Southern District of New York also denied defendant’s motion to dismiss in Union
14
Bank, N.A. v. CBS Corp., 2009 WL 1675087 (S.D.N.Y. June 10, 2009). Akin to the instant case,
15
plaintiff in Union Bank asserted a breach of contract and an unjust enrichment claim. After
16
examining the evidence, the district court concluded that it could not “determine as a matter of law
17
and at the inception of this litigation that this dispute will be resolved through application of the
18
[parties’ written contracts].” Id. at *8. Citing Joseph Sternberg, the Union Bank court thus
19
decided that plaintiff’s unjust enrichment claim should not be dismissed. Id. at *9.
20
Following Sternberg and Union Bank, the Court finds that, it is unclear whether New York
21
Plaintiffs’ contract claim is duplicative of, and thus precludes, New York Plaintiffs’ unjust
22
enrichment claim. Thus, the Court denies Defendants’ motions to dismiss based on their
23
contention that Plaintiffs’ New York unjust enrichment claim overlaps with Plaintiffs’ New York
24
contract claim.
25
2. Conferral of Benefit
26
As to Defendants’ other contention—that Plaintiffs did not confer a monetary benefit on
27
28
50
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
Defendants—the Court finds instructive Georgia Malone & Co., Inc. v. Rieder, 973 N.E.2d 743,
2
746 (N.Y. 2012). In Georgia Malone, the New York Court of Appeals stated that, for purposes of
3
an unjust enrichment claim, “[a] plaintiff must allege that (1) the other party was enriched, (2) at
4
that party’s expense, and (3) that it is against equity and good conscience to permit the other party
5
to retain what is sought to be recovered.” Id. (internal quotation marks omitted). “[A] plaintiff
6
need not be in privity with the defendant to state a claim for unjust enrichment.” Id. There must
7
only “exist a relationship or connection between the parties that is not too attenuated.” Id.
8
(internal quotation marks omitted). At first blush, the SAC appears to meet all three of these
9
requirements: Plaintiffs aver (1) that they paid premiums or fees that went to Defendants, (2) that
10
Defendants knew of these payments, and (3) that Defendants should return a portion of what was
11
United States District Court
Northern District of California
1
paid. SAC ¶¶ 528, 529, 532.
12
Defendants, however, contend that Plaintiffs do not “allege any facts showing [that] their
13
premiums were in fact paid to Anthem.” Anthem Mot. at 15. According to Defendants, all New
14
York Plaintiffs were covered under ASO agreements; as such, Plaintiffs’ employers, and not
15
Plaintiffs, paid Defendants.
16
The Court disagrees with Defendants as to New York Plaintiffs Barbara Gold (“Gold”),
17
Matthew Gates (“Gates”), and Juan Carlos Cerro (“Cerro”). Gold, Gates, and Cerro all state that
18
they paid health insurance premiums on a regular basis. SAC ¶¶ 87–89. These premiums were
19
aggregated by their respective employers, who then paid Defendants. Thus, Defendants knew or
20
should have known that some portion of Gold, Gates, and Cerro’s insurance expenses had been
21
paid by the premiums that Gold, Gates, and Cerro paid. That is all that Gold, Gates, and Cerro
22
need to plead to avoid dismissal.
23
Mandarin Trading Ltd. v. Wildenstein, 944 N.E.2d 1104 (N.Y. 2011), does not hold to the
24
contrary. In that case, the New York Court of Appeals again emphasized that “privity is not
25
required for an unjust enrichment claim.” Id. at 1111. The court, however, dismissed the unjust
26
enrichment claim at issue because there were no allegations of even “an awareness by [defendant]
27
28
51
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
of [plaintiff’s] existence.” Id. Such circumstances do not apply here. By virtue of collecting
2
Plaintiffs’ PII, maintaining a nationwide database of Plaintiffs’ PII, and providing administrative
3
services to Plaintiffs, Defendants were aware of Gold, Gates, and Cerro’s existence. The
4
relationship between Gold, Gates, and Cerro and Defendants is thus “not too attenuated” to state a
5
New York unjust enrichment claim. Rieder, 973 N.E. 2d at 746; Mandarin Trading, 944 N.E. 2d
6
at 1111. Defendants’ motions to dismiss the New York unjust enrichment claims of Gold, Gates,
7
and Cerro are therefore DENIED.
8
9
The Court, however, finds Defendants’ arguments more relevant as to New York Plaintiff
Marne Onderdonk (“Onderdonk”). The SAC states that “Onderdonk was enrolled in the New
York State Health Insurance Program (NYSHIP) for Government Employees.” SAC ¶ 90.
11
United States District Court
Northern District of California
10
Empire BlueCross Blue Shield provided administrative services to NYSHIP. Id. The SAC,
12
however, does not state that Onderdonk paid premiums, rates, or any other fees to NYSHIP or
13
Empire BlueCross Blue Shield. Indeed, based on the SAC, it is unclear whether there is any
14
economic relationship between Onderdonk, NYSHIP, and Empire BlueCross Blue Shield. Such
15
allegations do not pass muster under Mandarin Trading. Accordingly, Defendants’ motion to
16
dismiss Onderdonk’s New York unjust enrichment claim is GRANTED. However, Plaintiffs shall
17
have leave to amend Onderdonk’s claim. It is possible that, after amendment, Plaintiffs will be
18
able to plead a sufficiently close economic relationship between Onderdonk and Empire
19
BlueCross Blue Shield. Amendment therefore may not be futile.
20
E. California Unfair Competition Law (against Anthem and Non-Anthem Defendants)
21
California’s Unfair Competition Law (“UCL”) provides a cause of action for business
22
practices that are (1) unlawful, (2) unfair, or (3) fraudulent. Cal. Bus & Prof. Code § 17200, et
23
seq. “The UCL’s coverage is sweeping, and its standard for wrongful business conduct
24
intentionally broad.” Moore v. Apple, Inc., 73 F. Supp. 3d 1191, 1204 (N.D. Cal. 2014) (internal
25
quotation marks omitted). “Although the UCL targets a wide range of misconduct, its remedies
26
are limited because UCL actions are equitable in nature.” Pom Wonderful LLC v. Welch Foods,
27
28
52
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Inc., 2009 WL 5184422, *2 (C.D. Cal. Dec. 21, 2009). “Remedies for private individuals bringing
2
suit under the UCL are limited to restitution and injunctive relief.” Id.
Each prong of the UCL provides a separate and distinct theory of liability, Lozano v. AT&T
3
4
Wireless Servs., Inc., 504 F.3d 718, 731 (9th Cir. 2007), and Plaintiffs assert that Defendants’
5
conduct was unlawful, unfair, and fraudulent, see SAC ¶ 542. Before addressing whether
6
Plaintiffs have sufficiently pleaded liability under these prongs, however, the Court must
7
determine whether Plaintiffs have standing to bring suit. In order to establish standing under the
8
UCL, “a plaintiff must make a twofold showing: he or she must demonstrate injury in fact and a
9
loss of money or property caused by unfair competition.” Susilo v. Wells Fargo Bank, N.A., 796
10
F. Supp. 2d 1177, 1195–96 (C.D. Cal. 2011) (internal quotation marks omitted).
United States District Court
Northern District of California
11
1. Standing
12
As to whether Plaintiffs have demonstrated “injury in fact” and “a loss of money or
13
property caused by unfair competition,” id., the California Supreme Court has stated that “[t]here
14
are innumerable ways in which economic injury from unfair competition may be shown,” Kwikset
15
Corp. v. Superior Court, 246 P.3d 877, 885 (Cal. 2011). A plaintiff may, for instance,
16
(1) surrender in a transaction more, or acquire in a transaction less, than he or she
otherwise would have; (2) have a present or future property interest diminished;
(3) be deprived of money or property to which he or she has a cognizable claim;
or (4) be required to enter into a transaction, costing money or property, that
would otherwise have been unnecessary
17
18
19
20
Id. at 885–86. Here, Plaintiffs seek recovery under the UCL for two forms of economic injury:
Benefit of the Bargain Losses and Consequential Out of Pocket Expenses.7
21
22
23
24
The Court has already determined that California Plaintiffs Michael Bronzo, Mary Ella
Carter, Kenneth Coonce, Steve Kawai, and Kenneth Solomon may recover Benefit of the Bargain
Losses under their California breach of contract claim. As Defendants acknowledge, that finding
also means that those California Plaintiffs’ have sufficiently alleged economic injury for purposes
25
26
27
28
7
Plaintiffs do not seek Loss of Value of PII under the UCL. ECF No. 424 at 14 n.16.
53
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
of the UCL. Anthem Mot. at 15. Whether the remaining California Plaintiffs—Daniel Randrup,
2
Kelly Tharp, Daniel Tharp, Joseph Blanchard, Lillian Brisko, and Alvin Lawson—have
3
sufficiently alleged UCL standing is a closer call. Answering this question requires the Court to
4
examine (a) the differences between Article III standing and UCL standing, and (b) the differences
5
between California contract law and the UCL.
6
7
a. Relationship Between Article III Standing and UCL Standing
“Although the requirements of federal standing under Article III and the requirements of
standing under California’s consumer protection statutes overlap, there are important differences.”
9
In re Sony Gaming Networks and Customer Data Sec. Breach Litig., 903 F. Supp. 2d 942, 965
10
(S.D. Cal. 2012) (citing Troyk v. Farmers Grp., Inc., 90 Cal. Rptr. 3d 589, 625 n.31 (Ct. App.
11
United States District Court
Northern District of California
8
2009)). “For example, under Article III a plaintiff must allege: (1) an injury in fact; (2) causation;
12
and (3) likelihood that the injury will be redressed by a favorable decision.” Id. On the other
13
hand, for purposes of the UCL, a plaintiff need meet only “the first element (i.e., an injury in
14
fact).” Id. (internal quotation marks omitted).
15
However, under the UCL, a party must show that he has lost money or property in order to
16
satisfy this injury in fact requirement. Ehret v. Uber Technologies, Inc., 68 F. Supp. 3d 1121,
17
1132 (N.D. Cal. 2014) (“Whereas a federal plaintiff’s injury in fact may be intangible and need
18
not involve lost money or property, . . . a UCL plaintiff’s injury in fact [must] specifically involve
19
lost money or property.”) (internal quotation marks omitted).
20
This “lost money or property” requirement may, in some circumstances, impose a more
21
stringent standard for standing under the UCL as compared to Article III. Id. Nevertheless,
22
California Plaintiffs have met this more stringent standard. Each California Plaintiff states that
23
they paid money for health insurance premiums, which were used to pay for services offered by
24
Defendants. See, e.g., SAC ¶ 16 (“Plaintiff Daniel Randrup . . . was enrolled in a health plan . . .
25
that was administered by . . . Anthem Blue Cross of California, and [Randrup] paid premiums on a
26
regular basis.”). Thus, each California Plaintiff has “lost money or property,” as required under
27
28
54
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
3
the UCL.
b. Relationship Between Contract Law and UCL
There are also a number of important distinctions between California contract law and the
4
UCL. In general, the UCL sweeps more broadly. See, e.g., Hale v. Sharp Healthcare, 108 Cal.
5
Rptr. 3d 669, 675–81 (Ct. App. 2010) (upholding UCL claim but dismissing breach of contract
6
claim); Ehret, 68 F. Supp. 3d at 1139–41 (same). Two particular differences help explain the
7
UCL’s broader scope, and are of relevance to the instant motions.
8
9
First, under the UCL, a plaintiff may bring suit against a third party even if the plaintiff is
not an intended third party beneficiary. Compare Bus. to Bus. Mkts., Inc. v. Zurich Specialties, 37
Cal. Rptr. 3d 295, 298 (Ct. App. 2005) (stating, in a breach of contract case, that a party owes
11
United States District Court
Northern District of California
10
duties to intended, but not incidental, third party beneficiaries), with Ferrington v. McAfee, Inc.,
12
2010 WL 3910169, *8 (N.D. Cal. Oct. 5, 2010) (“[T]he UCL permits restitution from a defendant
13
whose unfair business practices caused plaintiff to pay money to a third party, as long as it is
14
reasonable to infer that the defendant indirectly received that money from the third party.”).
15
On this point, Defendants make much of the California Supreme Court’s statement in
16
Korea Supply Co. v. Lockheed Martin Corp., 63 P.3d 937, 947 (Cal. 2003), that “[a]ny award that
17
plaintiff would recover from defendants [under the UCL] would not be restitutionary as it would
18
not replace any money or property that defendants took directly from plaintiff.” Non-Anthem
19
Mot. at 12; Anthem Mot. at 10 n.15. This statement, Defendants argue, demonstrates that
20
Plaintiffs can not seek restitution under the UCL if a Plaintiff is covered by an ASO agreement, as
21
such Plaintiffs did not pay Defendants directly. Applied here, this argument would, in practice, set
22
a higher bar for UCL standing than under a conventional breach of contract claim, as no Plaintiff
23
under an ASO agreement could bring a UCL claim.
24
California courts, however, have rejected the reading of Korea Supply that Defendants
25
have advocated. In Shersher v. Superior Court, 65 Cal. Rptr. 3d 634, 636 (Ct. App. 2007),
26
defendant Microsoft Corporation (“Microsoft”) argued that plaintiff could not seek restitution
27
28
55
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
because plaintiff “purchased Microsoft’s product from a retailer.” Thus, plaintiff did not “pa[y]
2
money directly to” Microsoft. Id. The California Court of Appeal rejected this argument and
3
found Microsoft’s reliance upon Korea Supply misplaced. After reviewing the facts in Korea
4
Supply, the California Court of Appeal concluded that the case’s holding was “a narrow one”:
5
namely, “the holding of Korea Supply on the issue of restitution is that the remedy the plaintiff
6
seeks must be truly ‘restitutionary in nature’—that is, it must represent the return of money or
7
property the defendant acquired through its unfair practices.” Id. at 639. Importantly, “[n]othing
8
in the language of Korea Supply suggests that the [California] Supreme Court intended to preclude
9
consumers from seeking the return of money they paid for a product that turned out to be not as
10
United States District Court
Northern District of California
11
represented.” Id. (emphasis added).
In Troyk, a case decided after Shersher, the California Court of Appeal once again
12
reiterated that “Korea Supply [was] inapposite . . . and does not hold that a plaintiff who paid a
13
third party money (i.e., money in which the plaintiff had a vested interest) may not seek UCL
14
restitution from a defendant whose unlawful business practice caused the plaintiff to pay that
15
money.” Troyk, 90 Cal. Rptr. 3d at 616; see People v. Sarpas, 172 Cal. Rptr. 3d 25, 43–48 (Ct.
16
App. 2014) (canvassing decisions that have criticized Korea Supply).
17
Following Shersher and Troyk, federal courts—including this Court—have generally
18
declined to adopt Defendants’ reading of Korea Supply. See, e.g., Lopez v. United Parcel Serv.,
19
Inc., 2010 WL 728205, *10 (N.D. Cal. 2010) (rejecting reliance upon direct payment argument
20
and stating that “UPS’s suggestion that Korea Supply is in any way apposite to the present case is
21
flatly wrong.”); McAfee, 2010 WL 3910169, *7 (“[A]s the California Court of Appeals has noted,
22
[the holding in Korea Supply] was directed to the particular facts of [the case], which involved
23
plaintiffs who never had an ownership interest in the money allegedly obtained through
24
defendant’s unfair business practices.”).
25
26
27
28
In accord with this line of cases, the Court does not adopt Defendants’ reading of Korea
Supply here. Although California Plaintiffs might not have paid Defendants directly, they
56
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
nonetheless paid premiums which were then used to pay Defendants. Defendants’ alleged failure
2
to provide certain services led Plaintiffs, via the UCL, to seek “the return of money or property
3
[that Defendants] acquired through its unfair practices.” Shersher, 65 Cal. Rptr. 3d at 639.
4
A second notable difference between contract law and the UCL is that the UCL provides
5
for liability under three separate prongs: the unlawful, the unfair, and the fraudulent prong. As
6
explained by the district court in Ehret, a “UCL claim . . . is [thus] not limited to the structures of
7
the alleged contractual terms.” Ehret, 68 F. Supp. 3d at 1141. The UCL’s “prescriptions are
8
aimed at unlawful or unfair [or fraudulent] business practices (wherein a violation may be found
9
even if conduct violates no specific law [or contract]).” Id.
10
This distinction is critical to understanding why all California Plaintiffs have alleged
United States District Court
Northern District of California
11
economic injury sufficient to establish UCL standing. California Plaintiffs, for instance, claim
12
that Defendants engaged in unlawful business practices by violating HIPAA, the Gramm-Leach-
13
Bliley Act, the Federal Trade Commission Act (“FTC Act”), California’s Unfair Insurance
14
Practice Statutes, California’s Insurance Information and Privacy Protection Act (“CIIPA”),
15
California’s Confidentiality of Medical Information Act (“CMIA”), and Cal. Civ. Code § 1798.2.
16
SAC ¶ 316, 317, 542. Defendants do not contest that the contracts or agreements for California
17
Plaintiffs included provisions agreeing to comply with some (or all) of these laws.
18
As the Court has noted, for purposes of bringing a breach of contract claim, California
19
Plaintiffs “must . . . do something more . . . than merely point to allegations of a statutory
20
violation.” Berger, 476 F. Supp. 2d at 1177. Plaintiffs need not, though, do anything more to
21
allege an unlawful claim under the UCL. “By proscribing any unlawful business practice,” the
22
UCL “borrows violations of other laws and treats them as unlawful practices that the UCL makes
23
independently actionable.” Rose v. Bank of Am., N.A., 304 P.3d 181, 185 (Cal. 2013) (internal
24
quotation marks and alteration omitted). In other words, the UCL’s unlawful prong creates causes
25
of action for statutory violations that might not otherwise be actionable via private contract.
26
27
28
Taken together, the three features discussed above—that a plaintiff must show lost money
57
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
or property, that a plaintiff need not be an intended third party beneficiary to bring a UCL claim,
2
and that UCL liability is often broader than contract liability—provide an answer to the standing
3
inquiry here. All California Plaintiffs paid premiums, which were in turn used to pay for services
4
by Defendants. As part of these services, Defendants were, at minimum, required to comply with
5
certain privacy laws, which Defendants allegedly did not do. California Plaintiffs have thus
6
established economic injury because they have “surrender[ed] in a transaction more, or acquire[d]
7
in a transaction less, than he or she otherwise would have,” Kwikset, 246 P.3d at 885, because of
8
Defendants’ unlawful, unfair, or fraudulent conduct.
2. Unlawful
9
As discussed above, Plaintiffs allege that Defendants violated seven statutes: HIPAA, the
10
United States District Court
Northern District of California
11
Gramm-Leach-Bliley Act, the FTC Act, California’s Unfair Insurance Practice Statutes, CIIPA,
12
CMIA, and Cal. Civ. Code § 1798.82. Defendants contend that Plaintiffs have failed to state a
13
claim under three statutes: CMIA, CIIPA, and Cal. Civ. Code § 1798.82. Defendants do not
14
challenge Plaintiffs’ allegations as to the remaining statutes. Thus, even if the Court were to grant
15
Defendants’ motion, Plaintiffs’ UCL claim under the unlawful prong would still survive.
This is effectively the position Plaintiffs have taken in their own briefing. Instead of
16
17
developing specific arguments to challenge Defendants’ contentions, Plaintiffs urge the Court to
18
defer ruling on Defendants’ arguments, as Plaintiffs would have a viable claim under the unlawful
19
prong in any event. As Defendants point out, however, a decision from the Court now could help
20
“determine the scope of this case going forward,” particularly as to the breadth of fact and expert
21
discovery and the issues to be decided at summary judgment. Anthem Reply at 10.
Accordingly, because Plaintiffs have not challenged Defendants’ arguments as to the
22
23
CMIA, CIIPA, and Cal. Civ. Code § 1798.82, Defendants’ motion to dismiss these statutes under
24
the UCL’s unlawful prong is GRANTED with prejudice.8
25
26
27
28
8
The Court emphasizes that its decision is based upon the parties’ respective positions and is not a
substantive ruling on whether Defendants violated the statutes at issue. In fact, Defendants’
58
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
3. Unfair
2
“The ‘unfair’ prong of the UCL creates a cause of action for a business practice that is
3
unfair even if not proscribed by some other law.” In re Adobe, 66 F. Supp. 3d at 1226. “The UCL
4
does not define the term ‘unfair.’ . . . [And] the proper definition of ‘unfair’ conduct against
5
consumers ‘is currently in flux’ among California courts.” Id.
6
Some California courts apply a balancing approach, which requires courts to “weigh the
7
utility of the defendant’s conduct against the gravity of the harm to the alleged victim.” Davis v.
8
HSBC Bank Nevada, N.A., 691 F.3d 1152, 1169 (9th Cir. 2012) (internal quotation marks
9
omitted). Other California courts have held that “unfairness must be tethered to some legislatively
declared policy or proof of some actual or threatened impact on competition.” Lozano, 504 F.3d
11
United States District Court
Northern District of California
10
at 735 (internal quotation marks omitted). Finally, one California court has adopted the three-part
12
test set forth in § 5 of the Federal Trade Commission Act: “(1) the consumer injury must be
13
substantial; (2) the injury must not be outweighed by any countervailing benefits to consumers or
14
competition; and (3) it must be an injury that consumers themselves could not reasonably have
15
avoided.” Camacho v. Auto. Club of Southern California, 48 Cal. Rptr. 3d 770, 777 (Ct. App.
16
2006). The Court refers to these tests as the “balancing test,” the “tethering test,” and the “FTC
17
test,” respectively.
18
In the First Motion to Dismiss Order, the Court concluded that “dismissal of Plaintiffs’
19
UCL claim under the unfair prong [was] unwarranted.” First MTD Order at 40. “In In re Adobe,
20
this Court observed that various California statutes—including several statutes upon which
21
Plaintiffs rely here—reflect California’s public policy of protecting customer data.” Id. (internal
22
quotation marks omitted). “Whether Defendants’ public policy violation is outweighed by the
23
24
25
26
27
28
claims that the SAC does not allege the theft of medical information and that the CMIA protects
only medical information are incorrect. Anthem Mot. at 17. For example, the SAC alleges the
theft of the following information, among others, from the Anthem Database: dates of birth, Social
Security numbers, and confidential medical records. SAC ¶¶ 3, 360. Moreover, the CMIA
protects the privacy of “medical information” and defines that term to include individually
identifiable information. Cal. Civ. Code § 56.05(j).
59
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
utility of their conduct under the balancing test is a question to be resolved at a later stage in this
2
litigation.” Id. Thus, “based on the balancing test alone,” Defendants’ first round motions to
3
dismiss were denied. Id. (emphasis added).
4
In the instant motions, Defendants request that the Court find that several statutes listed in
5
the SAC do not support an unfair claim. Anthem Mot. at 18. These statutes include the ones
6
discussed above (CMIA, CIIPA, and Cal. Civ. Code §1798.82), as well as the Gramm-Leach-
7
Bliley Act and the California Data Breach Statute. Id. Defendants argue that Plaintiffs can not
8
prove that Defendants violated these statutes. Id. Thus, Defendants argue, dismissal is warranted
9
because an unfair prong claim must be based upon a public policy that is “‘tethered’ to specific
constitutional, statutory, or regulatory provisions.” Anthem Reply at 11 (quoting Gregory v.
11
United States District Court
Northern District of California
10
Albertson’s Inc., 128 Cal. Rptr. 2d 389, 395 (Ct. App. 2002)).
12
These arguments are misdirected. Whether or not Plaintiffs can establish that Defendants
13
violated a particular statute concerns the UCL’s unlawful prong, not the unfair prong. Compare
14
Aleksick v. 7-Eleven, Inc., 140 Cal. Rptr. 3d 796, 801 (Ct. App. 2012) (discussing a UCL claim
15
brought under the unlawful prong and holding that “[w]hen a statutory claim fails, a derivative
16
UCL claim also fails.”), with Cel-Tech Commc’ns, Inc. v. Los Angeles Cellular Tel. Co., 973 P.2d
17
527, 561 (Cal. 1999) (“It would be impossible to draft in advance detailed plans and specifications
18
of all acts and conduct to be prohibited, since unfair . . . business practices [under the UCL] may
19
run the gamut of human ingenuity and chicanery.”) (citation and alteration omitted). Put another
20
way, whether Defendants’ violated a particular statute does not necessarily mean that the statute
21
does not reflect a public policy to protect consumer privacy.
22
More importantly, Defendants’ arguments regarding the unfair prong, as Defendants note,
23
address the tethering test. However, in the First Motion to Dismiss Order, the Court concluded
24
that Plaintiffs had sufficiently alleged an unfair prong violation based on the balancing test alone.
25
First MTD Order at 40. Defendants’ briefing does not mention, much less discuss, the balancing
26
test—the basis of the Court’s original decision. Accordingly, Defendants’ motion to dismiss
27
28
60
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Plaintiffs’ UCL claim under the unfair prong is DENIED.
2
4. Fraud
3
“To state a claim under the ‘fraud’ prong of [the UCL], a plaintiff must allege facts
showing that members of the public are likely to be deceived by the alleged fraudulent business
5
practice.” Antman v. Uber Technologies, Inc., 2015 WL 6123054, *6 (N.D. Cal. Oct. 19, 2015).
6
Claims under the fraud prong of the UCL are subject to the particularity requirements of Federal
7
Rule of Civil Procedure 9(b). Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 2009).
8
Under this Rule, “[i]n alleging fraud or mistake, a party must state with particularity the
9
circumstances constituting fraud or mistake.” Fed. R. Civ. P. 9(b). Plaintiffs must include “an
10
account of the time, place, and specific content of the false representations” at issue. Swartz v.
11
United States District Court
Northern District of California
4
KPMG LLP, 476 F.3d 756, 764 (9th Cir. 2007) (internal quotation marks omitted). Additionally,
12
“a plaintiff stating a claim under the ‘fraud’ prong must plead actual reliance.” In re Carrer IQ,
13
Inc., 78 F. Supp. 3d at 1111.
14
In the First Motion to Dismiss Order, the Court dismissed Plaintiffs’ UCL claim under the
15
fraud prong. The Court observed that although Defendants allegedly “promised to carry out
16
reasonable security measures, but ultimately failed to carry through with this promise,” Plaintiffs
17
had not included the time that any misrepresentations or omissions had been made, as required by
18
Rule 9(b). First MTD Order at 41.
19
The SAC seeks to cure this particular deficiency. The SAC, for instance, includes copies
20
of the 2014 Annual Privacy Notice, which was made available prior to the Anthem data breach.
21
See ECF No. 473-5 at 16–22 (copy of 2014 Annual Privacy Notice). Plaintiffs also allege that
22
Anthem’s Personal Information (Including Social Security Number) Privacy Protection Policy has
23
not changed since 2010, and has been publicly available on Anthem’s website since that time.
24
SAC ¶ 165. Finally, Plaintiffs allege that Defendants violated the UCL’s fraud prong under both
25
an affirmative misrepresentation and fraudulent omission theory of liability. Id. ¶ 542. Under
26
either liability theory, Plaintiffs state that they “would not have enrolled in Defendants’ insurance
27
28
61
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
and health benefit services . . . had [they] known about Defendants’ substandard data security
2
practices.” Id.
3
In response, Defendants claim that “[n]o Plaintiff [has] allege[d] that he or she reviewed or
4
relied on any Anthem data security practices at the time he or she enrolled or re-enrolled in an
5
Anthem plan.” Anthem Mot. at 16. Plaintiffs’ apparent failure to comply with this actual reliance
6
requirement, Defendants argue, is fatal to their UCL claim. Because the actual reliance
7
requirement operates somewhat differently for omission and misrepresentation claims, the Court
8
considers these claims separately.
9
10
a. Fraudulent Omission
In most cases, “a plaintiff in a fraud by omission suit will not be able to specify the time,
United States District Court
Northern District of California
11
place, and specific content of an omission as precisely as would a plaintiff in a false representation
12
claim.” Falk v. Gen. Motors Corp., 496 F. Supp. 2d 1088, 1098–99 (N.D. Cal. 2007); see also
13
Gold v. Lumber Liquidators, Inc., 2015 WL 7888906, *10 (N.D. Cal. Nov. 30, 2015) (same).
14
Accordingly, “a fraud by omission or fraud by concealment claim can succeed without the same
15
level of specificity required by a normal fraud claim.” Baggett v. Hewlett-Packard Co., 582 F.
16
Supp. 2d 1261, 1267 (C.D. Cal. 2007) (internal quotation marks omitted); accord MacDonald v.
17
Ford Motor Co., 37 F. Supp. 3d 1087, 1096 (N.D. Cal. 2014) (“[C]laims based on an omission can
18
succeed without the same level of specificity required by a normal fraud claim[,] . . . [b]ecause the
19
plaintiffs are alleging a failure to act instead of an affirmative act.”) (internal quotation marks and
20
alteration omitted); Montich v. Miele USA, Inc., 849 F. Supp. 2d 439, 451 (D.N.J. 2012) (“[The]
21
heightened [pleading] standard [under Rule 9(b)] is somewhat relaxed in a case based on a
22
fraudulent omission.”).
23
The natural consequence of such reasoning is, as the California Court of Appeal has stated,
24
that “[r]eliance can be prove[n] in a fraudulent omission case by establishing that had the omitted
25
information been disclosed, the plaintiff would have been aware of it and behaved differently.”
26
Hoffman v. 162 North Wolfe LLC, 175 Cal. Rptr. 3d 820, 833–34 (Ct. App. 2014). In In re
27
28
62
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Carrier IQ, a consumer class action involving an omission of “a material fact exclusively in
2
[d]efendant’s knowledge,” the district court determined that the actual reliance test, as stated in
3
Hoffman, could be met based on two factors. 78 F. Supp. 3d at 1114.
First, “[p]laintiffs have alleged that had they been aware of the [material fact], they would
4
not have purchased [their] affected mobile devices.” Id.; see also Elias v. Hewlett-Packard Co.,
6
2014 WL 493034, *6 (N.D. Cal. Feb. 5, 2014) (“Plaintiff has adequately pleaded materiality by
7
alleging that he would have acted differently by not purchasing the computer as ordered had he
8
known about the insufficiency.”). Second, the In re Carrier IQ complaint “contain[ed] extensive
9
allegations regarding the public outcry regarding the [material fact] once its existence became
10
public knowledge—including media reports and Senator Franken sending letters of inquiry to
11
United States District Court
Northern District of California
5
mobile carriers. The intensity of their outcry underscores the materiality of the alleged omission.”
12
78 F. Supp. 3d at 1114.
Both of these factors are also at play in the instant case. Here, the SAC alleges that
13
14
“Plaintiffs would not have enrolled in Defendants’ insurance and health benefit services if they
15
had known about Defendants’ substandard data security practices.” SAC ¶ 542; see also id. ¶ 185
16
(same). Moreover, the public response following the Anthem data breach has been as extensive as
17
the response in In re Carrier IQ. Approximately 80 million Americans have been affected by the
18
breach, at least 130 individual cases have been brought in state and federal court, and several state
19
attorneys general have written letters to Anthem requesting that Anthem take more immediate
20
measures to address the fallout from the breach. SAC ¶ 384 n.21.
Thus, under the reasoning of Hoffman and In re Carrier IQ, the Court finds that Plaintiffs
21
22
have sufficiently pleaded actual reliance for purposes of stating a UCL violation based on
23
Defendants’ alleged fraudulent omissions.9
24
25
26
27
28
9
Some courts have suggested that the actual reliance requirement also applies to unlawful and
unfair claims “to the extent [that] the predicate unlawful [or unfair] conduct is based on
misrepresentations.” Doe v. SuccessfulMatch.Com, 70 F. Supp. 3d 1066, 1075–76 (N.D. Cal.
2014) (internal quotation marks omitted). Although the California Supreme Court has not yet
63
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
b. Affirmative Misrepresentation
1
2
Determining whether Plaintiffs’ have sufficiently alleged actual reliance for purposes of
3
affirmative misrepresentation liability is a harder question—and one that has caused significant
4
disagreement amongst courts in this district. Compare, e.g., Opperman v. Path, Inc., 84 F. Supp.
5
3d 962, 978 (N.D. Cal. 2015) (“If a plaintiff sufficiently alleges exposure to a long-term
6
advertising campaign [for purposes of a misrepresentation claim], she need not plead specific
7
reliance on an individual representation.”), with Yastrab v. Apple Inc.¸ 2016 WL 1169424, *6
8
(N.D. Cal. Mar. 25, 2016) (“[T]he court disagrees with Opperman to the extent it holds that a . . .
9
plaintiff is . . . excused from complying with Rule 9(b) when pleading a long-term advertising
10
United States District Court
Northern District of California
11
campaign.”).
The heart of this disagreement lies in how the California Supreme Court’s opinion in In re
12
Tobacco II Cases should be interpreted. In In re Tobacco II, 207 P.3d 20, 28 (Cal. 2009),
13
plaintiffs sought to represent a class comprised of all “people [who] smoked in California one or
14
more cigarettes during the applicable class period and were exposed to Defendants’ marketing and
15
advertising activities in California.” While the In re Tobacco II case was pending in trial court,
16
California voters enacted Proposition 64, which imposed “an actual reliance requirement on
17
plaintiffs prosecuting a private enforcement action under the UCL’s fraud prong.” Id. at 39.
18
In interpreting this requirement in the affirmative misrepresentation context, the California
19
Supreme Court noted that, “[w]hile a plaintiff must show that the misrepresentation was an
20
immediate cause of the injury-producing conduct” for purposes of actual reliance, “the plaintiff
21
need not demonstrate [that] it was the only cause.” Id. “It is enough that the representation has
22
played a substantial part, and so had been a substantial factor, in influencing his decision.” Id.
23
Moreover, a plaintiff does not necessarily “need to demonstrate individualized reliance on specific
24
25
26
27
28
addressed this issue, because Plaintiffs have sufficiently alleged actual reliance for purposes of
fraudulent omissions liability, Plaintiffs have also sufficiently alleged actual reliance under the
unfair and unlawful prongs.
64
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
misrepresentations to satisfy the reliance requirement.” Id. at 40. Instead, “where, as here, a
2
plaintiff alleges exposure to a long-term advertising campaign, the plaintiff is not required to plead
3
with an unrealistic degree of specificity that the plaintiff relied on particular advertisements or
4
statements.” Id. The In re Tobacco II court summarized its conclusions thusly: “a plaintiff must
5
plead and prove actual reliance to satisfy the standing requirement of [the UCL] but, consistent
6
with the principles set forth above, is not required to necessarily plead and prove individualized
7
reliance on specific misrepresentations or false statements where . . . those misrepresentations and
8
false statements were part of an extensive and long-term advertising campaign.” Id. at 40–41.
9
Although In re Tobacco II appeared to relax Rule 9(b)’s requirements when a defendant’s
misrepresentations are “extensive and long-term,” there has been considerable uncertainty over the
11
United States District Court
Northern District of California
10
scope of this exception. In Mazza v. American Honda Motor Co., Inc., 666 F.3d 581, 595–96 (9th
12
Cir. 2012), for example, the Ninth Circuit held that a series of “product brochures and TV
13
commercials” fell “short of the extensive and long-term fraudulent advertising campaign at issue
14
in Tobacco II.” Id. at 596 (internal quotation marks and alteration omitted).
15
In an attempt to bring clarity to In re Tobacco II, U.S. District Judge Jon Tigar, in
16
Opperman v. Path, “identified six factors from the prior case law that bear on whether a plaintiff
17
has pleaded an advertising campaign in accordance with Tobacco II.” 84 F. Supp. 3d at 976.
18
Those factors are as follows:
19
20
21
22
23
24
25
26
27
28
First, a plaintiff must allege that she actually saw or heard the defendant’s
advertising campaign. Second, the advertising campaign must be sufficiently
lengthy in duration, and widespread in dissemination, that it would be unrealistic
to require the plaintiff to plead each misrepresentation she saw and relied upon.
Third, the plaintiff must describe in the complaint, and preferably attach to it, a
representative sample of the advertisements at issue so as to adequately notify the
defendant of the precise nature of the misrepresentation claim—what, in
particular, defendant is alleged to have said, and how it was misleading. Fourth,
the plaintiff must allege, and the court must evaluate, the degree to which the
alleged misrepresentations contained within the advertising campaign are similar
to each other. Fifth, each plaintiff must plead with particularity, and separately,
when and how they were exposed to the advertising campaign, so as to ensure the
advertisements were representations consumers were likely to have viewed, rather
65
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
3
4
than representations that were isolated or more narrowly disseminated. And
finally, sixth, the court must be able to determine when a plaintiff made his or her
purchase or otherwise relied on defendant’s advertising campaign, so as to
determine which portion of that campaign is relevant.
Id. at 976–77. Other courts, including this Court, have followed the Opperman test in whole or in
part. See, e.g., Phillips v. Apple Inc., 2016 WL 1579693, *7 (N.D. Cal. Apr. 19, 2016) (citing
5
Opperman for the principle that a misrepresentation “claim requires plaintiffs to plead reliance on
6
at least some misleading partial representations.”) (alteration omitted); People for the Ethical
7
8
9
10
United States District Court
Northern District of California
11
Treatment of Animals v. Whole Foods Mkt. Cal., Inc., 2016 WL 362229, *5 (N.D. Cal. Jan. 29,
2016) (applying Opperman). On the other hand, some courts, as noted above, have found the
Opperman analysis to be in conflict with the more demanding pleading requirements of Rule 9(b).
See, e.g., Yastrab, 2016 WL 1169424, *5–*6 (citing cases).
In any event, the Court need not decide whether the six factor test in Opperman applies
12
here because, even if it did, the SAC’s allegations would be unable to sufficiently establish actual
13
reliance as to Plaintiffs’ affirmative misrepresentation claim. Indeed, Plaintiffs have failed to
14
satisfy the first Opperman factor: “a plaintiff must allege that she actually saw or heard the
15
defendant’s advertising campaign.” 84 F. Supp. 3d at 976. There are eleven California Plaintiffs.
16
None allege that they saw, read, or—for that matter—even knew about Anthem’s privacy policies
17
18
19
prior to the data breach. After examining the nearly 300 pages in the SAC, the Court has
identified a single sentence that refers to reliance: “In reliance upon [Defendants’ negligent]
misrepresentations, Plaintiffs . . . purchased insurance or health benefits services from
20
Defendants.” SAC ¶ 523. This is the sort of sentence that even the Opperman court found
21
insufficient for purposes of UCL liability. 84 F. Supp. 3d at 978 (stating that the “single and bare
22
allegation that [p]laintiffs viewed Apple’s website, saw in-store advertisements, and/or were aware
23
of Apple’s representations regarding the safety and security of the iDevices prior to purchasing
24
25
26
27
28
their own iDevices” does not satisfy In re Tobacco II) (internal quotation marks omitted).
Consequently, Defendants’ motions to dismiss Plaintiffs’ UCL claim under the fraud prong
as it relates to a misrepresentation theory of liability is GRANTED. Plaintiffs, though, shall have
66
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
leave to amend. It is possible that, after amendment, California Plaintiffs will be able to allege
2
that they viewed, heard, or read Defendants’ privacy policies, and thus relied upon these policies
3
to purchase insurance or health benefits services. Amendment would thus not be futile.
4
5
6
7
F. New York General Business Law § 349 (against Anthem and Non-Anthem
Defendants)
New York General Business Law (“GBL”) § 349 prohibits “[d]eceptive acts or practices in
the conduct of any business, trade or commerce or in the furnishing of any service.” N.Y. Gen.
Bus. § 349(a). To successfully assert a claim under this section, “a plaintiff must allege that a
8
defendant has engaged in (1) consumer-oriented conduct that is (2) materially misleading and that
9
(3) plaintiff suffered injury as a result of the allegedly deceptive act or practice.” Orlander v.
10
United States District Court
Northern District of California
11
12
13
Staples, Inc., 802 F.3d 289, 300 (2d Cir. 2015). In moving to dismiss Plaintiffs’ GBL § 349 claim,
Defendants contend, as to (3), that Plaintiffs have failed to “state with particularity the time that
the specific misrepresentations [at issue] occurred,” and that Plaintiffs have “not alleged any actual
harm,” Anthem Mot. at 18, 20. The Court addresses these arguments in turn.
14
1. Rule 9(b) and GBL § 349
15
As to whether Plaintiffs have pleaded their GBL § 349 claim with sufficient particularity,
16
17
Defendants’ contention rests upon the fact that the Court should have, in the First Motion to
Dismiss Order, applied Rule 9(b) to Plaintiffs’ GBL § 349 claim.
18
This argument is problematic in two respects. First, GBL § 349 is a New York state law,
19
and New York is in the Second Circuit. The Second Circuit has expressly held that Rule 9(b) does
20
21
not apply to GBL § 349 claims. Pelman ex rel. Pelman v. McDonald’s Corp, 396 F.3d 508, 511
(2d Cir. 2005) (“[A]n action under § 349 is not subject to the pleading-with-particularity
22
requirements of Rule 9(b), but need only meet the bare-bones notice-pleading requirements of
23
24
Rule 8(a).”) (citation omitted). This Court, as the MDL transferee court, “is generally bound by
the same substantive legal standards . . . as would have applied in the transferor court.” In re
25
Korean Air, 642 F.3d at 699. Thus, had this suit stayed in or been transferred to New York,
26
27
28
67
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Defendants do not dispute that the New York federal district court would not have applied Rule
2
9(b) to Plaintiffs’ GBL § 349 claim. Second, the Ninth Circuit has never held that Rule 9(b)
3
should apply to GBL § 349. The only courts to have done so are district courts in the Central and
4
Northern Districts of California, and these courts did so with little analysis or review of pertinent
5
New York or Second Circuit precedent.
6
In any event, the Court need not decide whether Rule 9(b) applies to Plaintiffs’ GBL § 349
claim. As Defendants acknowledge, Plaintiffs’ GBL § 349 claim rises and falls with Plaintiffs’
8
UCL claim brought under the fraud prong. Anthem Mot. at 19 (“The Court’s Rule 9(b) analysis
9
under the UCL . . . applies here [to Plaintiffs’ GBL § 349 claim] with equal force.”) (internal
10
quotation marks omitted). Because the Court has determined that Plaintiffs’ UCL fraud claim
11
United States District Court
Northern District of California
7
under a fraudulent omissions theory satisfies the requirements of Rule 9(b), Plaintiffs’ GBL § 349
12
claim also survives dismissal.
13
2. Damages
14
Next, Defendants contend that Plaintiffs can not seek Loss of Value of PII and that the
15
Court misread the Second Circuit’s decision in Orlander v. Staples in finding, in the First Motion
16
to Dismiss Order, that Plaintiffs could seek Benefit of the Bargain Losses. Anthem Mot. at 20.
17
Both arguments lack merit. As outlined above, Plaintiffs may recover damages for Loss of
18
Value of PII as to their California breach of contract and New Jersey breach of contract claims.
19
Defendants have identified no authority as to why this holding should not also apply to Plaintiffs’
20
GBL § 349 claim. In addition, the Court did not misread Orlander. In Orlander, the Second
21
Circuit determined that plaintiff had “sufficiently alleged an injury stemming from [a] misleading
22
practice” by stating that “he would not have purchased [a set of services] had he known that
23
[d]efendant intended to decline to provide him any [such] services” during the first year of his
24
contract. 802 F.3d at 301. That reasoning, the Court determined, “directly govern[ed] Plaintiffs’
25
claim” for Benefit of the Bargain Losses. First MTD Order at 48. This conclusion regarding
26
Orlander continues to apply: Defendants promised to implement certain security measures,
27
28
68
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Defendants allegedly failed to implement such measures, and Plaintiffs would not have entrusted
2
their PII to Defendants had Defendants disclosed Defendants’ alleged failure to implement such
3
measures.
However, as noted above, New York Plaintiff Marne Onderdonk has not alleged that she
4
5
paid premiums or fees for health services. Thus, based on the allegations in the SAC, Onderdonk
6
can not recover Benefit of the Bargain Losses. Consistent with the Court’s ruling on Onderdonk’s
7
unjust enrichment claim, Plaintiffs shall have leave to amend Onderdonk’s GBL § 349 claim, as
8
amendment may not be futile. The Court thus GRANTS with leave to amend Defendants’
9
motions to dismiss Onderdonk’s claim for Benefit of the Bargain Losses under GBL § 349.
10
Defendants’ motions to dismiss Plaintiffs’ GBL § 349 claim are otherwise DENIED.
United States District Court
Northern District of California
11
G. Georgia Insurance Information and Privacy Protection Act (against Anthem
Defendants)
12
The Georgia Insurance Information and Privacy Protection Act (“IIPA”) states that “[a]n
13
insurance institution, agent, or insurance-support organization shall not disclose any personal or
14
privileged information about an individual collected or received in connection with an insurance
15
transaction” unless the disclosure falls under a set of specific exceptions. Ga. Code Ann. § 33-3916
14.
17
18
In the First Motion to Dismiss Order, the Court dismissed Plaintiffs’ IIPA claim with leave
to amend. The Court determined that the parties had presented “an issue of first impression:
19
whether the IIPA, which proscribes the unlawful disclosure of personal information, also applies
20
to the theft of one’s personal information.” First MTD Order at 59. After examining the statutory
21
text, case law, and other canons of statutory interpretation, the Court answered this question in the
22
negative. Id. at 59–65. As the Court noted, disclosure under the IIPA means “an active, voluntary
23
decision by the information holder to provide data to an unauthorized third party.” Id. at 63. That
24
25
is not what happened here: Plaintiffs’ PII was stolen by a group of cyberattackers.
In the SAC, Plaintiffs now assert that “
26
27
28
69
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
” SAC ¶ 1002. The parties dispute whether this new allegation
2
3
sufficiently satisfies the IIPA’s disclosure requirement. Additionally, the Anthem Defendants
4
argue that, even if Plaintiffs’ PII was affirmatively disclosed, Plaintiffs’ claim “fails because the
5
SAC does not allege facts showing the Georgia Plaintiffs incurred any actual damages.” Anthem
6
Mot. at 21. The Court need not address this damages argument because, after again examining the
7
IIPA’s text and pertinent case law, the Court finds that Plaintiffs’ new allegations fail to state a
8
claim for relief.
9
10
1. Statutory Text
As to the statutory text, the IIPA states that “[a]n insurance institution, agent, or insurance-
United States District Court
Northern District of California
11
support organization shall not disclose any personal or privileged information . . . unless the
12
disclosure” falls under a set of 18 exceptions. These exceptions allow the insurance institution,
13
agent, or insurance-support organization to disclose an individual’s personal information “[t]o a
14
medical-care institution or medical professional,” Ga. Code Ann. § 33-39-14(4), “[t]o an insurance
15
regulatory authority,” Ga. Code Ann. § 33-39-14(5), and “[t]o a law enforcement or other
16
governmental authority,” Ga. Code Ann. § 33-39-14(6), among other entities. The apparent
17
principle behind these exceptions is that the insurance institution, agent, or insurance-support
18
organization must intentionally provide an individual’s personal information to a third party:
19
disclosure, in other words, is meant to be intentional, not unintentional or unknowing.
20
Two other IIPA provisions lend support to this reading. First, Ga. Code Ann. § 33-39-22
21
states that “[n]o cause of action in the nature of . . . negligence shall arise against any person for
22
disclosing personal or privileged information in accordance with this chapter.” Ga. Code Ann. §
23
33-39-22 (emphasis added). However, Ga. Code Ann. § 33-39-22 goes on to note that “this Code
24
section shall provide no immunity for disclosing or furnishing false information with malice or
25
willful intent to injure any person.” Id. (emphasis added). Thus, Ga. Code Ann. § 33-39-22
26
clearly draws a distinction between negligent, unintentional acts and willful, intentional acts. The
27
28
70
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
IIPA does not punish negligent, unintentional conduct; it punishes willful, intentional conduct.
Second, Ga. Code Ann. § 33-39-19, a section entitled “Monetary Penalties,” states: “[i]n
3
any case where a hearing . . . results in the finding of a knowing violation of this chapter, the
4
Commissioner [of Insurance of the State of Georgia] may . . . order payment of a monetary penalty
5
of not more than $500.00 for each violation but not to exceed $10,000.00 in the aggregate for
6
multiple violations.” Ga. Code Ann. § 33-39-19 (emphasis added). Again, consistent with Ga.
7
Code Ann. § 33-39-22, Ga. Code Ann. § 33-39-19 seeks to penalize knowing conduct, not
8
unknowing conduct.
9
Considered together, Ga. Code Ann. § 33-39-14, Ga. Code Ann. § 33-39-22, and Ga. Code
Ann. § 33-39-19 evince an intent by the Georgia Legislature to prevent willful and knowing
11
United States District Court
Northern District of California
10
disclosure. The allegations in the SAC simply do not rise to this level. As the SAC states, “
12
13
14
15
” SAC ¶ 349. Nowhere in these allegations do Plaintiffs
16
aver that the Amerigroup employee knowingly or intentionally sought to disclose Plaintiffs’ PII.
17
Indeed, the SAC’s next paragraph states that “[t]he
18
and Anthem Affiliates did not . . .
attack occurred because Anthem
19
.” Id. ¶ 350 (emphasis added).
20
Plaintiffs also analogize the Anthem Defendants’ actions as being akin to “a company negligently
21
le[aving] the ‘bank vault’ open”—the exact sort of negligent conduct that the IIPA does not look
22
to punish. Id. ¶ 6; Ga. Code Ann. § 33-39-22.
23
The reasonable inference to draw from these allegations is that the employee in question
24
did not know that the
25
Database because Defendants did not provide
26
Thus, based on the statutory text, the SAC fails to state a claim under the IIPA.
27
28
would allow cyberattackers to access the Anthem
due to Defendants’ negligence.
71
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2. Case Law
2
Case law lends additional weight to this conclusion. As the Court noted in its First Motion
3
to Dismiss Order, the Federal Privacy Act defines “disclosure” to “mean[] providing personal
4
review of a record, or a copy thereof, to someone other than the data subject or the data subject’s
5
authorized representative.” 5 C.F.R. § 297.102. First MTD Order at 61. The First Motion to
6
Dismiss Order went on to observe that courts have restricted this definition to situations where
7
information holders have willfully provided data to an unauthorized third party.
8
9
In Walia v. Chertoff, 2008 WL 5246014, *6 (E.D.N.Y. Dec. 17, 2008), for instance,
plaintiff’s medical and legal records were placed in an unlocked credenza located in the office of
plaintiff’s supervisor. Other employees, including those not authorized to review plaintiff’s
11
United States District Court
Northern District of California
10
medical and legal records, had access to this office. Upon learning these facts, plaintiff brought
12
suit against his employer. The Walia court rejected plaintiff’s Federal Privacy Act claim and held
13
that plaintiff’s claim rested on “the accessibility of [plaintiff’s] medical and legal records to
14
individuals in the office.” Id. at *11. Mere accessibility, however, is insufficient to constitute
15
“willful or intentional disclosure by the agency, a required element of a [Federal Privacy Act]
16
claim.” Id. As in Walia, Plaintiffs’ IIPA claim continues to pivot around the idea of access and
17
accessibility, and not willful and active disclosure. See SAC ¶ 1002 (“Anthem . . . allowed the
18
cyberattackers to see and obtain individually-identifiable [PII].”).
19
In re SAIC, another case that the Court discussed in its First Motion to Dismiss Order, also
20
suggests that disclosure requires some sort of knowledge or intent. See, e.g., 45 F. Supp. 3d at 29
21
(describing disclosure as the “imparting of information which . . . was previously unknown to the
22
person to whom it was imparted.”).
23
Finally, in the First Motion to Dismiss Order, the Court found inapposite Plaintiffs’
24
reliance upon Shames-Yeakel v. Citizens Financial Bank, 677 F. Supp. 2d 994, 1008 (N.D. Ill.
25
2009). In Shames-Yeakel, the district court stated that “[i]f th[e] duty not to disclose customer
26
information is to have any weight in the age of online banking, then banks must certainly employ
27
28
72
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
sufficient security measures to protect their customers’ online accounts.” Id. This holding,
2
however, was problematic in two ways. First, the decision was, “at the very least, in tension with”
3
binding Seventh Circuit precedent. First MTD Order at 63. The Shames-Yeakel court did not
4
discuss or refer to the Seventh Circuit’s opinion in Pisciotta v. Old National Bancorp, 499 F.3d
5
629 (7th Cir. 2007), which would have precluded plaintiffs in Shames-Yeakel from proceeding
6
with their claims as a matter of law. Second, and of importance to the instant motion, “with
7
respect to the specific statement quoted by Plaintiffs—that a bank’s duty not to disclose must
8
include a duty to protect customers’ personal information—the Shames-Yeakel court did not
9
discuss, refer to, or cite any supporting authority.” First MTD Order at 64. “In the nearly six and
a half years since the Shames-Yeakel decision, no federal or state court has cited Shames-Yeakel
11
United States District Court
Northern District of California
10
for this proposition.” Id. That fact remains unchanged since the First Motion to Dismiss Order
12
was issued on February 14, 2016.
13
14
As alleged in the SAC, Plaintiffs’ IIPA claim is little more than an attempt to have the
Court adopt Shames-Yeakel in substance if not in name. Indeed, as Plaintiffs state, “[t]he
15
attack occurred because Anthem and Anthem Affiliates did not use [data security]
16
practices consistent with industry standards.” SAC ¶ 350 (emphasis added). What the Anthem
17
Defendants should have done, according to Plaintiffs, is “
.” Id. That request for
18
19
relief is no different from the finding in Shames-Yeakel that the “duty to disclose” requires banks
20
to “employ sufficient security measures to protect their customers’ online accounts.” 677 F. Supp.
21
2d at 1008. The Court declined to follow Shames-Yeakel in the First Motion to Dismiss Order,
22
and declines now to adopt a reading of the IIPA that would essentially adopt Shames-Yeakel in
23
substance. Walia and In re SAIC remain more persuasive, and argue against Plaintiffs’ reading of
24
the IIPA.
25
Accordingly, the Court GRANTS Anthem Defendants’ motion to dismiss Plaintiffs’ IIPA
26
claim. In addition, the Court declines to provide Plaintiffs leave to amend, as amendment would
27
28
73
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
be futile. The Court has already provided Plaintiffs an opportunity to amend. However, Plaintiffs
2
have not—in either the CAC or the SAC—alleged that the Anthem Defendants intentionally or
3
knowingly allowed cyberattackers to access the Anthem Database. Rather, the gist of Plaintiffs’
4
case is that “Defendants failed to implement basic industry-accepted data security tools to prevent
5
cyberattackers from accessing the Anthem Database.” SAC ¶ 5. In fact, according to Plaintiffs,
6
Defendants’ data security was so lacking that Defendants did not even know that the Anthem
7
Database had been breached until January 27, 2015—more than two months after cyberattackers
8
connected to the Anthem Database. Id. ¶¶ 355, 366. In sum, Plaintiffs’ case does not provide for
9
IIPA liability. The Anthem Defendants’ motion to dismiss Plaintiffs’ IIPA claim is therefore
10
United States District Court
Northern District of California
11
12
GRANTED with prejudice.
H. Federal Law Third Party Beneficiary (against Non-Anthem Defendants)
The Court turns next to Plaintiffs’ third party beneficiary claim for breach of contract
13
under federal law. On this claim, Plaintiffs assert that Blue Cross Blue Shield Association
14
(“BCBSA”) “had a valid, binding, and enforceable express contract with OPM [the Office of
15
Personnel Management] to provide insurance and other benefits to those [Federal Employee]
16
Plaintiffs who received health insurance and related benefits under the Federal BCBSA Plan.”
17
SAC ¶ 503. This contract is hereinafter referred to as the “Federal BCBSA contract.”
18
The Court denied the Non-Anthem Defendants’ motion to dismiss this claim in the First
19
Motion to Dismiss Order. See First MTD Order 65–80. In reaching this determination, the Court
20
found that the Federal Employee Plaintiffs were “intended third party beneficiaries of the Federal
21
BCBSA contract,” id. at 66; that the Federal Employee Plaintiffs’ claim was not a claim for
22
“health benefits,” id. at 70; and that OPM did not have exclusive enforcement authority over a
23
breach of the Federal BCBSA contract, id. at 72–76.
24
The Non-Anthem Defendants do not challenge any of these conclusions. Instead, the Non-
25
Anthem Defendants’ arguments largely repeat those addressed in earlier portions of the instant
26
Order: (1) that Plaintiffs can not recover Benefit of the Bargain Losses because OPM—and not
27
28
74
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Plaintiffs—“paid money to BCBSA,” (2) that Plaintiffs can not recover for Loss of Value of PII,
2
(3) and that time spent “addressing issues arising from the Anthem data breach” is “insufficient to
3
show cognizable contract damages.” Non-Anthem Mot. at 13–14. For the reasons stated below,
4
the Court finds these arguments are unavailing.
5
“When the United States enters into contract relations, its rights and duties therein are
6
governed generally by the law applicable to contracts between private individuals.” Mobil Oil
7
Expl. & Producing Se., Inc. v. United States, 530 U.S. 604, 607 (2000); see also Interface Kanner,
8
LLC v. JPMorgan Chase Bank, N.A., 704 F.3d 927, 932 (11th Cir. 2013) (“When interpreting
9
contracts under federal law, courts look to general common law on contracts.”). In determining
the nature of the general common law on contracts, the U.S. Supreme Court has previously looked
11
United States District Court
Northern District of California
10
to the Restatement of Contracts. Mobil Oil, 530 U.S. at 608 (“The Restatement of Contracts
12
reflects many of the principles of contract law that are applicable to this action.”).
13
On damages, the Restatement allows parties to recover expectation, reliance, and
14
restitution damages. Restatement (Second) of Contracts § 344. The Restatement defines
15
expectation damages as a party’s “interest in having the benefit of his bargain by being put in as
16
good a position as he would have been in had the contract been performed.” Id. Reliance
17
damages are a party’s “interest in being reimbursed for loss caused by reliance on the contract by
18
being put in as good a position as he would have been in had the contract not been made.” Id.
19
Finally, restitution damages “restore[] to [a party] any benefit that he has conferred on the other
20
party.” Id. Where possible, “contract damages” should “protect an injured party’s ‘expectation
21
interest’—that is, the interest in having the benefit of the bargain.” ATACS Corp. v. Trans World
22
Commc’ns, Inc., 155 F.3d 659, 669 (3d Cir. 1998). However, “other theories of damages provide
23
alternative avenues for contract enforcement” where the expectation interest may be uncertain. Id.
24
1. Benefit of the Bargain Losses
25
Plaintiffs’ request for Benefit of the Bargain Losses plainly constitutes a request for
26
expectation damages. Such damages, as noted above, are the preferred basis for contract recovery.
27
28
75
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
The Non-Anthem Defendants do not contest this point. Instead, the Non-Anthem Defendants
2
argue only that OPM bargained with BCBSA, and that therefore only OPM can recover for
3
Benefit of the Bargain Losses.
4
General contract law principles, however, do not support this contention. As the Court has
5
previously determined, the Federal Employee Plaintiffs are intended third party beneficiaries who
6
may assert against BCBSA a breach of contract claim. In the context of such third party
7
beneficiary claims, courts have repeatedly held that the beneficiary may seek to enforce rights and
8
recover damages that were available to the contracting party. See, e.g., Beckett v. Air Line Pilots
9
Ass’n, 995 F.2d 280, 286 (D.C. Cir. 1993) (“[I]t is a fundamental principle of contract law that
parties to a contract may create enforceable contract rights in a third party beneficiary.”); Gen. Ins.
11
United States District Court
Northern District of California
10
Co. of Am. v. Interstate Serv. Co., 701 A.2d 1213, 1218 (Md. Ct. Spec. App. 1997) (holding that
12
“the third party beneficiary rule followed by the majority of jurisdictions in this country” allows
13
“third party beneficiary[] rights [that] are [as] extensive [as] those rights provided by the express
14
terms of the contract”) (alteration omitted); Restatement (Second) of Contracts § 304 (“A promise
15
in a contract creates a duty in the promisor to any intended beneficiary to perform the promise, and
16
the intended beneficiary may enforce the duty.”). Thus, under these principles, Plaintiffs may, as
17
intended third party beneficiaries, recover Benefit of the Bargain Losses.
18
The Non-Anthem Defendants’ attempt to obscure the financial relationship between
19
Plaintiffs and BCBSA is inapposite. Specifically, the Non-Anthem Defendants state that BCBSA
20
“do[es] not receive premiums as they are paid into [the Employees Health Benefits] Fund.” Non-
21
Anthem Reply at 10. Instead, all “premiums are placed in a special letter of credit account.” Id.
22
BCBSA then “draw[s] directly from the letter of credit account to pay for benefit claims and . . .
23
administrative expenses.” Id. This sort of arrangement does nothing to change the financial
24
relationship between Plaintiffs and BCBSA. Plaintiffs paid premiums, which were placed in an
25
account, from which BCBSA drew to pay expenses. The fundamental relationship stays the same:
26
Plaintiffs paid the Non-Anthem Defendants for services, and Plaintiffs now allege that the Non-
27
28
76
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Anthem Defendants did not perform these services as promised. Plaintiffs may recover Benefit of
2
the Bargain Losses for the alleged breach by bringing suit as an intended third party beneficiary.
3
2. Loss of Value of PII
4
Next, as to Loss of Value of PII, such damages implicate the reliance interest, defined as a
party’s “interest in being reimbursed for loss[es] caused by reliance on the contract by being put in
6
as good a position as he would have been in had the contract not been made.” Restatement
7
(Second) of Contracts § 344. Reliance damages are recoverable where the expectation interest is
8
difficult to ascertain. See, e.g., Glendale Fed. Bank, FSB v. United States, 239 F.3d 1374, 1380–
9
1383 (Fed. Cir. 2001) (awarding reliance damages after concluding that expectation interest would
10
be too difficult to quantify). Here, it remains unclear whether Plaintiffs will be able to sufficiently
11
United States District Court
Northern District of California
5
calculate their expectation or Benefit of the Bargain damages. Furthermore, a growing number of
12
federal courts have now recognized Loss of Value of PII as a viable damages theory, perhaps
13
indirectly acknowledging the difficulty in calculating Benefit of the Bargain Losses. See, e.g., In
14
re Facebook, 572 F. App’x at 494. Accordingly, given the uncertainty in this case as to Plaintiffs’
15
Benefit of the Bargain Losses and the trend towards recognizing Loss of Value of PII, Plaintiffs’
16
request for Loss of Value of PII does not warrant dismissal.
17
3. Consequential Out of Pocket Expenses
18
Lastly, Plaintiffs’ request for Consequential Out of Pocket Expenses also implicates the
19
reliance interest. See Boulevard Assocs. v. Sovereign Hotels, Inc., 861 F. Supp. 1132 (D. Conn.
20
1994) (stating that consequential damages are reliance damages). As with Plaintiffs’ request for
21
Loss of Value of PII, a growing number of courts now recognize that individuals may be able to
22
recover Consequential Out of Pocket Expenses that are incurred because of a data breach,
23
including for time spent reviewing one’s credit accounts. See, e.g., Lewert, 2016 WL 1459226,
24
*3. The Court found these authorities persuasive as to Plaintiffs’ California and New Jersey
25
breach of contract claims, and does the same here. Accordingly, the Non-Anthem Defendants’
26
motion to dismiss Plaintiffs’ third party beneficiary claim under federal law is DENIED.
27
28
77
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
3
4
5
6
7
8
9
10
I. ERISA Preemption (against Anthem and Non-Anthem Defendants)
Finally, Defendants contend that some (but not all) of the claims brought by certain
Plaintiffs are subject to ERISA preemption. Anthem Mot. at 23–25; Non-Anthem Mot. at 11–12.
The specific claims at issue are detailed below.
Named Plaintiff
Kenneth Coonce
Joseph Blanchard
Daniel Tharp
Kelly Tharp
Lillian Brisko
Matthew Gates
Claims at Issue
California UCL
California Breach of Contract
California UCL
California UCL
California UCL
California UCL
New York GBL § 349
New York Unjust Enrichment
The Court finds Defendants’ contentions unavailing, because (1) Defendants are precluded
United States District Court
Northern District of California
11
from asserting an ERISA preemption defense as to Plaintiffs’ UCL claims, (2) the presumption
12
against preemption applies, (3) Defendants’ privacy obligations are not “benefits” for purposes of
13
ERISA express or complete preemption, and (4) even if Defendants’ privacy obligations were
14
considered “benefits,” there is a genuine dispute concerning whether Plaintiffs’ ERISA employee
15
16
17
18
19
20
21
22
23
24
25
benefit plan incorporated these obligations. These reasons are discussed in detail below.
1. Waiver
In the first round motions to dismiss, Defendants asserted ERISA preemption as to the
California breach of contract claims of Kenneth Coonce, Daniel Tharp, and Kelly Tharp.
Defendants also asserted ERISA preemption as to the New York unjust enrichment and GBL §
349 claims of Matthew Gates. ECF No. 410 at 11–12; 22. Defendants did not, however, assert
ERISA preemption as to Plaintiffs’ UCL claim.
Federal Rule of Civil Procedure 12(g)(2) states that “[e]xcept as provided in Rule 12(h)(2)
or (3), a party that makes a motion under this rule must not make another motion under this rule
raising a defense or objection that was available to the party but omitted from its earlier motion.”
Federal Rule of Civil Procedure 12(h)(2), in turn, provides that arguments which pertain to a
26
27
28
78
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
plaintiff’s “[f]ailure to state a claim upon which relief can be granted . . . may be raised: (A) in any
2
pleading allowed or ordered under Rule 7(a); (B) by a motion under Rule 12(c); or (C) at trial.”10
3
To summarize, under Rule 12(g)(2) and Rule 12(h)(2), a party that seeks to assert a defense that
4
was available but omitted from an earlier Rule 12 motion can only do so in a pleading, a Rule
5
12(c) motion, or at trial.
6
Here, Defendants have asserted, for the first time, an ERISA preemption defense as to
7
Plaintiffs’ UCL claim, which Defendants did not assert in their first round motions to dismiss.
8
Defendants have not asserted this defense in a pleading, a Rule 12(c) motion, or at trial—the only
9
exceptions listed under Rule 12(g)(2). Instead, Defendants have asserted this defense in a second
round motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). Defendants are
11
United States District Court
Northern District of California
10
foreclosed from doing so because of Rule 12(g)(2) and Rule 12(h)(2).
Indeed, despite two rounds of briefing, Defendants have not explained why they did not
12
13
assert ERISA preemption as to Plaintiffs’ UCL claim in their first round motions to dismiss. Like
14
the SAC, the CAC included enrollment information on the health insurance or health services
15
plans for each California Plaintiff. See, e.g., ECF No. 334-6 ¶¶ 15–24. Moreover, the fact that
16
Defendants asserted ERISA preemption as to the California breach of contract claims of Kenneth
17
Coonce, Daniel Tharp, and Kelly Tharp suggests that Defendants knew which Plaintiffs were
18
enrolled in ERISA plans.
A number of cases lend additional support to the Court’s application of waiver here. First,
19
20
in Herron v. Best Buy Stores, LP, 2013 WL 4432019, *4 (E.D. Cal. Aug. 16, 2013), defendant
21
Toshiba had “failed to squarely raise [an] argument in its initial dismissal motion, even though the
22
argument was available to Toshiba when it originally sought to dismiss Plaintiff’s complaint.”
23
Accordingly, “this portion of Toshiba’s dismissal motion [was] not considered.” Id. Similarly, in
24
25
26
27
28
10
Rule 12(h)(3), another exception to Rule 12(g)(2), does not apply to the instant claims. Rule
12(h)(3) allows parties to challenge subject matter jurisdiction at any point in litigation. Fed. R.
Civ. P. 12(h)(3). Subject matter jurisdiction is not at dispute here.
79
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Federal Agricultural Mortgage Corp. v. It’s A Jungle Out There, Inc., 2005 WL 3325051, *5
2
(N.D. Cal. Dec. 7, 2005), the district court stated that, “[a]lthough the Ninth Circuit has not had
3
occasion to apply this principle, the weight of authority outside this circuit holds that where the
4
complaint is amended after the defendant has filed a Rule 12(b) motion, the defendant may not
5
thereafter file a second Rule 12(b) motion asserting objections or defenses that could have been
6
asserted in the first motion.” See also Wright & Miller, 5C Federal Practice & Procedure § 1388,
7
491–95 (3d ed. 2004) (citing cases applying Rule 12(g)(2) and Rule 12(h)(2)).
8
9
Finally, this Court recently applied Rule 12(g)(2) and Rule 12(h)(2) in a substantially
similar situation in Northstar Financial Advisors Inc. v. Schwab Investments, 135 F. Supp. 3d
1059 (N.D. Cal. 2015). In Northstar, defendants had asserted a preemption defense based on the
11
United States District Court
Northern District of California
10
Securities Litigation and Uniform Securities Act (“SLUSA”) in moving to dismiss the second
12
amended complaint. Defendants did not assert SLUSA preclusion in moving to dismiss the third
13
amended complaint. Later, in moving to dismiss the fourth amended complaint, defendants once
14
again sought to assert SLUSA preclusion. As in the instant action, defendants did not provide an
15
explanation as to why they had previously abandoned their SLUSA preclusion defense. Id. at
16
1071–72. This Court concluded that defendants in Northstar could not assert SLUSA preclusion
17
in moving to dismiss the fourth amended complaint. Id. at 1072. Several courts have cited this
18
holding from Northstar with approval. See, e.g., Jaeger v. Howmedica Osteonics Corp., 2016 WL
19
520985, *4–*6 (N.D. Cal. Feb. 10, 2016); Johnson v. Serenity Transp., Inc., 2016 WL 270952, *7
20
(N.D. Cal. Jan. 22, 2016).
21
22
Accordingly, based on the authority above, the Court finds that Defendants are precluded
from asserting ERISA preemption as to Plaintiffs’ UCL claim.
23
2. Governing Principles Regarding ERISA Preemption
24
Defendants asserted ERISA preemption as to Coonce’s California breach of contract and
25
Gates’ New York unjust enrichment and GBL § 349 claims in their first round motions to dismiss.
26
In the First Motion to Dismiss Order, the Court dismissed with leave to amend Plaintiffs’
27
28
80
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
California breach of contract and New York unjust enrichment claims without reaching the
2
question of ERISA preemption, and requested additional briefing from the parties on whether
3
ERISA preemption apples to Gates’ GBL § 349 claim.
4
With this background in mind, the Court begins its ERISA preemption analysis on
5
Coonce’s California breach of contract and Gates’ New York unjust enrichment and GBL § 349
6
claims by taking note of two important considerations: the presumption against preemption and
7
the two forms of ERISA preemption.11
a. Presumption Against Preemption
8
First, the U.S. Supreme Court has repeatedly emphasized that there is a presumption
10
against federal preemption of state laws. See generally Wyeth v. Levine, 555 U.S. 555, 565 (2009)
11
United States District Court
Northern District of California
9
(“In all pre-emption cases . . . we start with the assumption that the historic police powers of the
12
States were not to be superseded by the Federal Act unless that was the clear and manifest purpose
13
of Congress.”) (quoting Medtronic, Inc. v. Lohr, 518 U.S. 470, 485 (1996)). As discussed at
14
greater length below, that presumption applies with equal force to cases involving ERISA
15
preemption. See, e.g., N.Y. State Conference of Blue Cross & Blue Shield Plans v. Travelers Ins.
16
Co., 514 U.S. 645, 654 (1995) (applying presumption against preemption in ERISA case). Indeed,
17
in De Buono v. NYSA-ILA Med. and Clinical Services Fund, 520 U.S. 806, 813–14 (1997), the
18
U.S. Supreme Court went so far as to remark that, “[i]n order to evaluate whether the normal
19
presumption against pre-emption has been overcome in a particular [ERISA] case,” a court “must
20
go beyond the unhelpful text [of ERISA] . . . and look instead to the objectives of the ERISA
21
statute as a guide to the scope of the state law that Congress understood would [or would not]
22
survive.”
b. Express and Complete Preemption
23
24
25
26
27
28
11
Although Rule 12(g)(2) and Rule 12(h)(2) apply to Defendants’ arguments as to the UCL, the
Court finds that the following reasons apply with equal force to Defendants’ ERISA preemption
arguments as to the UCL.
81
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Next, “[t]here are two strands of ERISA preemption: (1) ‘express’ preemption under
2
ERISA § 514(a), 29 U.S.C. § 1144(a); and (2) preemption due to a ‘conflict’ with ERISA’s
3
exclusive remedial scheme set forth in [ERISA § 502(a),] 29 U.S.C. § 1132(a).” Fossen v. Blue
4
Cross & Blue Shield of Mont., Inc., 660 F.3d 1102, 1107 (9th Cir. 2011). Most courts refer to this
5
latter form of preemption as “complete preemption.” Marin Gen. Hosp. v. Modesto & Empire
6
Traction Co., 581 F.3d 941, 944 (9th Cir. 2009); Wurtz v. Rawlings Co., 761 F.3d 232, 241 (2nd
7
Cir. 2014). The Court has also referred to ERISA § 502(a) preemption as “complete preemption”
8
in prior Orders, and does the same in the instant Order. See, e.g., In re Anthem, Inc. Data Breach
9
Litig.¸ 2015 WL 7443779, *3 (N.D. Cal. Nov. 24, 2015).
10
“Under § 514(a), ERISA broadly preempts any and all State laws insofar as they may now
United States District Court
Northern District of California
11
or hereafter relate to any covered employee benefit plan.” Fossen, 660 F.3d at 1108 (internal
12
quotation marks and alteration omitted) (emphasis added). “[T]he words ‘relate to,’” however,
13
“cannot be taken too literally.” Roach v. Mail Handlers Benefit Plan, 298 F.3d 847, 849 (9th Cir.
14
2002). “If ‘relate to’ were taken to extend to the furthest stretch of its indeterminacy, then for all
15
practical purposes pre-emption would never run its course, for ‘really, universally, relations stop
16
nowhere.’’” Travelers, 514 U.S. at 655 (alteration omitted). Instead, “relates to” must be “read in
17
the context of the presumption that in fields of traditional state regulation the historic police
18
powers of the States are not to be superseded by a Federal Act unless that was the clear and
19
manifest purpose of Congress.” Roach, 298 F.3d at 850 (internal quotation marks and alterations
20
omitted).
21
Under ERISA § 502(a), on the other hand, a civil enforcement action may be brought:
22
(1) by a participant or beneficiary— . . . (B) to recover benefits due to him under
the terms of his plan, to enforce his rights under the terms of the plan, or to clarify
his rights to future benefits under the terms of the plan.
23
24
29 U.S.C. § 1132(a). Pursuant to this provision, a “state-law cause of action that duplicates,
25
supplements, or supplants the ERISA civil enforcement remedy” is preempted because it
26
“conflicts with the clear congressional intent to make the ERISA remedy exclusive.” Aetna
82
27
28
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
Health Inc. v. Davila, 542 U.S. 200, 209 (2004).
Under U.S. Supreme Court precedent, both forms of ERISA preemption are subject to the
3
presumption against preemption. See Travelers, 514 U.S. at 655–56 (applying presumption to
4
ERISA express preemption); Rush Prudential HMO, Inc. v. Moran, 536 U.S. 355, 377–80, 387
5
(2002) (reviewing ERISA complete preemption precedent and concluding that “in the field of
6
health care, a subject of traditional state regulation, there is no ERISA preemption without clear
7
manifestation of congressional purpose.”) (alteration omitted). Both the Second and Ninth
8
Circuits, the circuits where Gates and Coonce respectively reside, are in accord. See, e.g.,
9
Stevenson v. Bank of N.Y. Co., Inc., 609 F.3d 56, 59 (2nd Cir. 2010) (“This circuit has previously
held that the analysis of ERISA preemption must start with the presumption that Congress does
11
United States District Court
Northern District of California
10
not intend to supplant state law.”) (internal quotation marks omitted); Wurtz, 761 F.3d at 237–38
12
(same). Indeed, as the Ninth Circuit observed in Dishman v. Unum Life Insurance Co. of America,
13
269 F.3d 974, 984 (9th Cir. 2001), “[w]e are certain that the objective of Congress in crafting
14
[ERISA § 514(a)] was not to provide ERISA administrators with blanket immunity from garden
15
variety torts which only peripherally impact daily plan administration.”
16
With the foregoing framework in mind, the Court notes also that no circuit court has ever
17
applied ERISA preemption—express or complete—to preclude a plaintiff from moving forward
18
with state law claims arising out of a data breach. Thus, by asking the Court to find Plaintiffs’
19
claims to be both expressly and completely preempted, Defendants have essentially requested that
20
the Court break new ground to find that the presumption against preemption is overcome in a field
21
where it has never been applied before. For the reasons that follow, the Court finds that
22
Defendants have failed to carry this burden.
23
24
25
26
27
28
3. Data Privacy and ERISA Express or Complete Preemption
a. Complete Preemption
ERISA § 502(a) completely preempts actions based upon state law “[1] to recover benefits
due to him under the terms of his plan, [2] to enforce his rights under the terms of the plan, or [3]
83
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
to clarify his rights to future benefits under the terms of the plan.” 29 U.S.C. § 1132(a).
The parties have not cited any case law interpreting the meaning of [2], “to enforce his
3
rights under the terms of the plan,” and the Court has not found any Second or Ninth Circuit case
4
law on point. In fact, based on the Court’s review, the most pertinent discussion of this provision
5
appears to have been by the en banc Fifth Circuit in Arana v. Ochsner Health Plan, 338 F.3d 433
6
(5th Cir. 2003) (en banc). In Arana, the Fifth Circuit noted that, “one could [also] say that
7
[plaintiff] seeks to enforce his rights under the terms of the plan, for he seeks to determine his
8
entitlement to retain the benefits based on the terms of the plan.” Id. at 438.
9
With Arana in mind, the key inquiry here is thus whether Coonce and Gates’s claims are
for ERISA benefits, as all three parts of ERISA § 502(a) refer to benefits: recovering benefits
11
United States District Court
Northern District of California
10
owed, enforcing rights to retain benefits, and clarifying terms of future benefits. 29 U.S.C.
12
§ 1132(a), Arana, 338 F.3d at 438. To put it another way, ERISA complete preemption applies
13
where ERISA benefits are at issue, and does not apply when ERISA benefits are not at issue.
14
ERISA’s statutory text does not define the term “benefit.” However, several statutory
15
subsections suggest that benefits must concern payments for healthcare-related services. Under 29
16
U.S.C. § 1191b, for instance, a subsection addressing rules governing group health plans, the
17
subsection lists some examples of benefits, such as “[c]overage for on-site medical clinics,”
18
“dental or vision benefits,” and “[h]ospital indemnity or other fixed indemnity insurance.” 29
19
U.S.C. § 1191b. Likewise, 29 U.S.C. § 1133, the subsection that addresses claims processing,
20
requires all ERISA plans to “provide adequate notice in writing to any participant or beneficiary
21
whose claim for benefits under the plan has been denied” and to “afford a reasonable opportunity
22
[to be heard] to any participant whose claim for benefits has been denied.” 29 U.S.C. § 1133.
23
Notably, of the numerous mentions of the term “benefit” in ERISA, none suggest that protecting
24
customer PII should be considered an ERISA benefit.
25
26
27
28
Both the Second and Ninth Circuits have adopted a similar understanding. In Stevenson,
for example, the Second Circuit described ERISA’s “central” purpose as concerning “the
84
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
determination of eligibility for benefits, amounts of benefits, or means of securing unpaid
2
benefits.” 609 F.3d at 59. Laws that “tend to control or supersede” this central purpose “have
3
typically been found to be preempted.” Id. Similarly, in Wurtz, the Second Circuit determined
4
that tort damages that a plaintiff receives from an automobile accident, which may in fact overlap
5
or supplement the medical benefits that a plaintiff receives, should not be considered “benefits”
6
for purposes of ERISA § 502. 761 F.3d at 242–43. The Second Circuit counseled courts to read
7
“benefits” narrowly, and expressly disapproved of the district court’s “expansive interpretation of
8
complete preemption.” Id. at 242.
In reaching its decision, the Wurtz court cited the Ninth Circuit’s decision in Marin
10
General Hospital with approval. Id. at 244. In that case, the Ninth Circuit also read “benefits” in
11
United States District Court
Northern District of California
9
a limited manner, and found that not even a medical reimbursement claim was subject to ERISA
12
complete preemption. 581 F.3d at 950. The Marin General Hospital court, moreover, stated that
13
“[i]t is not enough for complete preemption that the contract and tort claims ‘relate to’ the
14
underlying ERISA plan, or that ERISA § 502(a)(1)(B) may provide a similar remedy.” Id. at 950.
15
Thus, Defendants’ point in the instant motions that individuals may obtain partial premium
16
refunds as a remedy under ERISA § 502(a) does not, standing by itself, mean that ERISA
17
complete preemption applies.
18
Although plaintiffs’ claims in Stevenson, Wurtz, and Marin General Hospital did appear to
19
relate to plaintiffs’ healthcare expenses (e.g., claims for medical reimbursement, tort damages
20
arising from medical injuries), the circuit courts in these cases nonetheless declined to apply
21
ERISA complete preemption. Instead, all three courts emphasized the importance of construing
22
ERISA benefits in a narrow manner. Here, unlike in Stevenson, Wurtz, and Marin General
23
Hospital, Plaintiffs’ claims do not even implicate medical or healthcare expenses. Plaintiffs
24
instead bring suit because Defendants failed to comply with certain privacy obligations—a legal
25
area where ERISA is silent.
26
27
28
As a final matter, in Marin General Hospital, the Ninth Circuit drew upon its reasoning in
85
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
Cedars-Sinai Medical Center v. National League of Postmasters of the United States, 497 F.3d
2
972 (9th Cir. 2007). See 581 F.3d at 950. In Cedars-Sinai, the Ninth Circuit declined to find that
3
a claim for “breach of contract and negligent misrepresentation in connection with partial
4
reimbursement of claims for medical treatment” was preempted by the Federal Employee Health
5
Benefits Act (“FEHBA”). Id. Although the Marin General Hospital court acknowledged that
6
“FEHBA and ERISA are different federal statutes,” id., it noted that “their preemption provisions
7
are analytically similar,” and are often interpreted together. Id.
8
This discussion of the interplay between FEHBA and ERISA provides yet another reason
to support the Court’s finding that Plaintiffs’ claims are not claims for ERISA benefits. In the
10
First Motion to Dismiss Order, the Court examined whether “Plaintiffs’ third party beneficiary
11
United States District Court
Northern District of California
9
claims [under FEHBA] constitute[d] health benefits claims” for purposes of the Federal BCBSA
12
contract. First MTD Order at 68. After examining federal regulations, case law, and the Federal
13
BCBSA contract’s text, the Court determined that “Plaintiffs’ third party beneficiary claim [was]
14
not a ‘health benefits claim.’” Id. at 70. Health benefits claims are expenses that concern one’s
15
medical care or health coverage, not one’s data privacy. Defendants have not challenged the
16
Court’s interpretation of FEHBA. Given the similarity between FEHBA and ERISA preemption,
17
it would make little sense for the Court to adopt a different understanding of the term “benefit” for
18
purposes of ERISA preemption.
19
20
21
22
Accordingly, for the reasons stated above, the Court finds that Coonce and Gates’s claims
are not completely preempted by ERISA.
b. Express Preemption
On express preemption, the Court must determine whether Coonce and Gates’s claims
23
“relate to” their ERISA benefit plans. 29 U.S.C. § 1144(a). As noted above, the U.S. Supreme
24
Court has emphasized that this term can not be read literally: “[i]f ‘relate to’ were taken to extend
25
to the furthest stretch of its indeterminacy, then for all practical purposes pre-emption would never
26
run its course, for really, universally, relations stop nowhere.” Travelers, 514 U.S. at 655
27
28
86
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
(alteration and internal quotation marks omitted). Such an interpretation would “read the
2
presumption against pre-emption out of the law,” id. and is “a result [that] no sensible person
3
could have intended,” Gobeille v. Liberty Mut. Ins. Co., 136 S. Ct. 936, 943 (2016) (internal
4
quotation marks omitted).
5
As such, U.S. Supreme Court precedent “to date has described two categories of state laws
6
that ERISA [expressly] pre-empts.” Id. “First, ERISA pre-empts a state law if it has a ‘reference
7
to’ ERISA plans. To be more precise, where a State’s law acts immediately and exclusively upon
8
ERISA plans or where the existence of ERISA plans is essential to the law’s operation, that
9
‘reference’ will result in pre-emption.” Id. (internal quotation marks, citation, ellipses, and
alterations omitted). “Second, ERISA pre-empts a state law that has an impermissible ‘connection
11
United States District Court
Northern District of California
10
with’ ERISA plans, meaning a state law that governs a central matter of plan administration or
12
interferes with nationally uniform plan administration.” Id. (internal quotation marks and ellipses
13
omitted).
14
The claims at issue do not fall under either of these categories. The “reference to” prong
15
analysis is straightforward. In Liberty Mutual Insurance Co. v. Donegan, 746 F.3d 497, 500 (2d
16
Cir. 2014), the Second Circuit was presented with a Vermont law that required all state health
17
insurers, health care providers, health care facilities, and governmental agencies to file certain
18
reports with the Vermont government. On the “reference to” prong, the Second Circuit concluded
19
that “[t]he Vermont statute and regulation lack reference to an ERISA plan because they apply to
20
all health care payers and do not act exclusively upon ERISA plans.” Id. at 508 n.9 (internal
21
quotation marks omitted). Here, too, California contract law, New York unjust enrichment law,
22
and GBL § 349 do not “act exclusively upon ERISA plans,” id., nor are “the existence of ERISA
23
plans . . . essential to the [their] operation,” Gobeille, 136 S. Ct. at 943. These laws are laws of
24
general application, and do not focus exclusively (or, for that matter, even primarily) upon ERISA
25
plan administration.
26
27
28
The analysis of the “connection with” prong is more demanding, but the result remains the
87
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
same. On this prong, the U.S. Supreme Court has advised courts to consider “the objectives of the
2
ERISA statute as a guide to the scope of the state law that Congress understood would survive and
3
the nature of the effect of the state law on ERISA plans.” Gobeille, 136 S. Ct. at 943 (internal
4
quotation marks and citation omitted). A number of cases have discussed “the objectives of the
5
ERISA statute” in some detail. Id. In Travelers, for instance, the U.S. Supreme Court stated that
6
in enacting ERISA’s express preemption provision, “Congress intended to ensure that plans and
7
plan sponsors would be subject to a uniform body of benefits law.” 514 U.S. at 656 (internal
8
quotation marks omitted) (emphasis added). Citing Travelers, the Ninth Circuit held in Dishman
9
that “ERISA preempts state laws that mandate employee benefit structures or their
administration.” 269 F.3d at 981 (internal quotation marks and alteration omitted) (emphasis
11
United States District Court
Northern District of California
10
added). Thus, if a “statute governs the payment of benefits, a central matter of plan
12
administration,” it will be found to be expressly preempted. Id. at 982 (internal quotation marks
13
omitted). Finally, in Gerosa v. Savasta & Co., 329 F.3d 317, 324 (2nd Cir. 2003), the Second
14
Circuit observed that “state laws that . . . tend to control or supersede central ERISA functions—
15
such as state laws affecting the determination of eligibility for benefits, amounts of benefits, or
16
means of securing unpaid benefits—have typically been found to be preempted.” Even in Wise v.
17
Verizon Communications Inc., 600 F.3d 1180, 1190 (9th Cir. 2010), a case upon which
18
Defendants rely, the Ninth Circuit determined that plaintiff’s claim was expressly preempted
19
because it was a “claim for recovery of past and future benefits.” Namely, plaintiff sought to
20
recover lost disability insurance benefits, not damages related to a data breach.
21
The general thrust of Travelers, Dishman, Gerosa, and Wise is that laws that implicate the
22
administration of ERISA benefits are subject to express preemption, and laws that do not are not
23
preempted. See Dishman, 269 F.3d at 984 (finding that invasion of privacy claim not subject to
24
ERISA preemption). As noted above, the claims here do not implicate ERISA “benefits.”
25
Consequently, Coonce and Gates’s claims are not expressly preempted.
26
27
28
88
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
4. Dispute Regarding Scope of ERISA Plans
2
As a final matter, the Court notes the parties’ disagreement as to whether Coonce and
3
Gates’s contracts also constitute the “written ERISA plan instrument.” Anthem Opp’n at 25. The
4
crux of Plaintiffs’ argument is that the official ERISA plan documents and the written contracts
5
are not the same documents, and that further discovery is needed to determine what documents
6
form the set of official ERISA plan documents. Defendants challenge this argument. Such a
7
dispute again highlights why dismissal as a matter of law is inappropriate at this time: further
8
discovery is necessary to determine which documents constitute the ERISA plan documents.
For all the reasons stated above, Defendants’ motions to dismiss certain claims as
9
preempted by ERISA are DENIED.
11
United States District Court
Northern District of California
10
IV.
CONCLUSION
12
To conclude:
13
1. The Court GRANTS with prejudice the Anthem Defendants’ motion to dismiss the
14
California breach of contract claim as to Plaintiffs Daniel Randrup, Kelly Tharp, and
15
Daniel Tharp.
16
3. The Court GRANTS with prejudice the Non-Anthem Defendants’ motion to dismiss
17
Plaintiffs’ request for Benefit of the Bargain Losses under the New Jersey breach of
18
contract claim.
19
20
21
4. The Court GRANTS with leave to amend Defendants’ motions to dismiss the New
York unjust enrichment claim as to Plaintiff Marne Onderdonk.
5. The Court GRANTS with prejudice Defendants’ motions to dismiss the California
22
Unfair Competition Law claim as to the unlawful prong as that prong relates to the
23
California Insurance Information and Privacy Protection Act, the California
24
Confidentiality of Medical Information Act, and Cal. Civ. Code § 1798.82.
25
26
27
28
6. The Court GRANTS with leave to amend Defendants’ motions to dismiss the California
Unfair Competition Law claim as to the fraud prong as that prong relates to a
89
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
1
2
3
4
5
6
misrepresentation theory of liability.
7. The Court GRANTS with leave to amend Defendants’ motions to dismiss the New
York General Business Law § 349 as to Plaintiff Marne Onderdonk.
8. The Court GRANTS with prejudice the Anthem Defendants’ motion to dismiss the
Georgia Information and Privacy Protect Act claim.
The second round motions to dismiss are otherwise DENIED. Should Plaintiffs elect to
7
file an amended complaint curing the deficiencies identified herein, Plaintiffs shall do so by July
8
11, 2016, the deadline to which the parties have stipulated for the addition of parties. Failure to
9
meet the July 11, 2016 deadline to file an amended complaint or failure to cure the deficiencies
identified in this Order will result in a dismissal with prejudice of the deficient claims or theories.
11
United States District Court
Northern District of California
10
Plaintiffs may not add new causes of actions or parties without leave of the Court or stipulation of
12
the parties pursuant to Federal Rule of Civil Procedure 15.
13
IT IS SO ORDERED.
14
Dated: May 27, 2016
15
16
______________________________________
LUCY H. KOH
United States District Judge
17
18
19
20
21
22
23
24
25
26
27
28
90
Case No. 15-MD-02617-LHK
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ SECOND MOTION TO
DISMISS, GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ SECOND
MOTION TO DISMISS, AND DENYING MOTION FOR CLARIFICATION
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?