Hammer et al v. Sam's East, Inc. et al

Filing 51

MEMORANDUM AND ORDER granting 13 Motion to Dismiss. IT IS FURTHER ORDERED that plaintiffs claims are dismissed without prejudice for lack of jurisdiction. Signed by District Judge Carlos Murguia on 7/16/2013. (mh)

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF KANSAS
STEVEN E. HAMMER, and
MICHAEL D. WHITE,
individually and on behalf of all others
similarly situated,
Plaintiffs,
v.

SAM’S EAST, INC.,
d/b/a/ SAM’S CLUB, et al.,
Defendants.

)
)
)
)
)
)
)
)
)
)
)
)
)
)
)

Case No. 12-cv-2618-CM

MEMORANDUM AND ORDER
This matter is before the court on defendants’ motion to dismiss (Doc. 13). Defendants move
to dismiss plaintiffs’ complaint under Federal Rule of Civil Procedure 12(b)(1) because plaintiffs lack
Article III standing, and under 12(b)(6) because plaintiffs failed to state a claim upon which relief can
be granted.1 For the following reasons, the court grants defendants’ motion.
I.

Factual Background
Steven E. Hammer and Michael D. White (“plaintiffs”), individually, and on behalf of all

others similarly situated2, bring suit against defendants Sam’s East, Inc., Sam’s West, Inc., and WalMart Stores, Inc., all doing business as Sam’s Club (“defendants”), alleging violations of the Kansas
Consumer Protection Act (“KCPA”). Plaintiffs are members of Sam’s Club and allege that defendants
made numerous misrepresentations on their website regarding the security of confidential and private

1

Because the court lacks jurisdiction to hear plaintiffs’ claims, it does not address defendants’ arguments made
under Federal Rule of Civil Procedure 12(b)(6).

2

The matter of class certification has not been determined in this case.

-1-

information of Sam’s Club members. Specifically, plaintiffs allege that defendants violated the KCPA
by misrepresenting to Sam’s Club members on the Sam’s Club website that: (1) account information is
password protected; (2) first and last names must be entered exactly as they appear on the membership
card; (3) Sam’s Club membership numbers must be entered exactly as they appear on the membership
card; (4) Sam’s Club protects payment card information collected during transactions; (5) defendants
use reasonable security measures on the Sam’s Club website; and (6) defendants comply with industry
standards that require safeguards for handling and securing member information.
Plaintiffs ask for the following relief: (1) declaratory judgment, issued pursuant to Kan. Stat.
Ann. § 50-634(c), establishing that defendants’ practices are deceptive and/or unconscionable; and (2)
injunctive relief, issued pursuant to the same statute, enjoining defendants from making these same
statements. Plaintiffs make no allegation that their personal information has been stolen,
compromised, or fraudulently used. Plaintiffs also do not allege that a security breach has occurred.
Instead, plaintiffs argue that defendants’ actions and misrepresentations have exposed and continue to
expose their customers to increased risk of fraud and identity theft by failing to adequately protect the
private personal information of customers.
II.

Legal Standard
Dismissal pursuant to Federal Rule of Civil Procedure 12(b)(1) is appropriate when the court

lacks subject matter jurisdiction over a claim for relief. The party asserting jurisdiction has the burden
of establishing subject matter jurisdiction. Port City Props. v. Union Pac. R.R. Co., 518 F.3d 1186,
1189 (10th Cir. 2008). A motion under this rule attacks the existence of jurisdiction rather than the
allegations of the complaint and, therefore, dismissal under this rule is not a judgment on the merits of
the claims. Brereton v. Bountiful City Corp., 434 F.3d 1213, 1218 (10th Cir. 2006).

-2-

III.

Analysis
Under Article III of the United States Constitution, the jurisdiction of federal courts is limited

to actual cases or controversies. Summers v. Earth Island Inst., 555 U.S. 488, 492–93 (2009); Dias v.
City & Cnty. of Denver, 567 F.3d 1169, 1176 (10th Cir. 2009). A party seeking relief in federal court
must have standing to sue. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). To have
standing, a plaintiff bears the burden of showing that (1) he suffered an injury in fact that is (a)
concrete and particularized and (b) actual and imminent, not merely conjectural or hypothetical; (2) the
injury is fairly traceable to the defendant’s conduct; and (3) a favorable decision is likely to redress his
alleged injuries. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180–81
(2000) (citing Lujan, 504 U.S. at 560–61).
The injury-in-fact requirement differs depending upon whether a plaintiff seeks prospective or
retrospective relief. Tandy v. City of Wichita, 380 F.3d 1277, 1283–84 (10th Cir. 2004) (citing City of
Los Angeles v. Lyons, 461 U.S. 95, 101–02 (1983)). When seeking prospective relief, a plaintiff must
suffer a continuing injury or be under a real and immediate threat of being injured in the future. Id. at
1283. Moreover, the threatened injury must be “certainly impending” as opposed to merely
speculative. Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147 (2013); Tandy, 380 F.3d at 1283.
“A claimed injury that is contingent upon speculation or conjecture is beyond the bounds of a federal
court’s jurisdiction.” Tandy, 380 F.3d at 1283–84 (citing Whitmore v. Arkansas, 495 U.S. 149, 158
(1990)). To analyze standing, the court considers the facts existing at the time the complaint was filed.
Id.
Defendants argue that plaintiffs lack standing for three reasons. First, defendants contend that
plaintiffs’ awareness of defendants’ alleged misrepresentations means they already believe the

-3-

statements to be false and, therefore, are not at risk of future injury. Second, defendants argue that the
only harm alleged by plaintiffs—increased risk of identity theft or fraud—cannot be redressed by the
relief plaintiffs seek. Third, defendants contend that an increased risk of identity theft or fraud is too
remote and speculative to confer Article III standing. Because the court agrees with defendants’ third
argument, it does not address the first two arguments.
As noted by the parties, in dealing with similar “loss of data” cases, federal courts have split on
the issue of whether an alleged increased risk of identity theft and fraud is an injury in fact sufficient to
support standing. Compare, e.g., Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046, 1052–53
(E.D. Mo. 2009); Randolph v. ING Life Ins. & Annuity Co., 486 F. Supp. 2d 1, 8 (D.D.C. 2007); Key v.
DSW, Inc., 454 F. Supp. 2d 684, 690 (S.D. Ohio 2006); Bell v. Acxiom Corp., No. 4:06Cv485-WRW,
2006 WL 2850042, at *2 (E.D. Ark. Oct. 3, 2006); Giordano v. Wachovia Sec., LLC, No. 06-476
(JBS), 2006 WL 2177036, at *4–5 (D.N.J. July 31, 2006) (finding no standing), with, e.g., Pisciotta v.
Old Nat’l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007);3 Ruiz v. Gap, Inc., 622 F. Supp. 2d 908, 912
(N.D. Cal. 2009), aff’d, 380 F. App’x 689 (9th Cir. 2010); McLoughlin v. People’s United Bank, Inc.,
No. 08-cv-00944 (VLB), 2009 WL 2843269, at *4 (D. Conn. Aug. 31, 2009); Krottner v. Starbucks
Corp., No. 09-0216-RAJ, 2009 WL 7382290, at *4–6 (W.D. Wash. Aug. 14, 2009), aff’d in part, 628
F.3d 1139 (9th Cir. 2010); Caudle v. Towers, Perrin, Forster & Crosby, Inc., 580 F. Supp. 2d 273, 280
(S.D.N.Y. 2008) (finding standing).4
But the key fact in those cases—whether or not the courts found standing was met—is that the
plaintiffs’ personal data had in fact been stolen or compromised, or some type of security breach had
3

See Amburgy, 671 F. Supp. 2d at 1051 (discussing the Seventh Circuit’s reliance on factually distinct cases from
other circuits addressing increased risk of future medical injury and increased risk of future environmental injury
in finding standing).

4

For a more thorough discussion of “loss of data” cases and the split in authority among courts regarding standing,
see Hammond v. Bank of New York Mellon Corp., No. 08 Civ. 6060 (RMB)(RLE), 2010 WL 2643307, at *1–2, 8
(S.D.N.Y. June 25, 2010) .

-4-

occurred. That is not the case here. As defendants point out, no court has found that a mere increased
risk of identity theft or fraud constitutes an injury in fact for standing purposes without some alleged
theft of personal data or security breach. See, e.g., Katz v. Pershing, 672 F.3d 64, 79 (1st Cir. 2012)
(finding under similar circumstances that plaintiff lacked standing when she failed to allege a data
breach or that her personal information “ha[d] been accessed by any unauthorized person”). This court
will not be the first. Plaintiffs’ failure to allege that their personal data has been stolen or
compromised in any way means plaintiffs have suffered no injury in fact.5
Plaintiffs argue that they have a “continuing injury” in that their personal data “can be accessed
without any adequate protections or controls” and that “[d]efendants are affirmatively misrepresenting
the security of [p]laintiffs’ information and concealing material facts related to website security.”
(Doc. 26 at 14.) Plaintiffs describe this situation as “a current ongoing concern.” (Id.) But these
“future-oriented, hypothetical, and conjectural” claims do not represent a case or controversy. See
Hammond, 2010 WL 2643307, at *7; see also Whitmore, 495 U.S. at 158 (“Allegations of possible
future injury do not satisfy the requirements of Art[icle] III.”).
In their response, plaintiffs request that—should the court determine their pleadings are
deficient—they be given leave to amend their complaint. Although plaintiffs do list some areas in
which they could elaborate further, plaintiffs’ request does not give the court adequate notice of the
basis of the proposed amendment. And, even assuming that all the information contained in plaintiffs’

5

In their response, plaintiffs also argue that they have standing based on the payment of their Sam’s Club
membership dues. They argue that the value of the Sam’s Club membership purchased (wherein personal
information is protected as promised) is much higher than the actual value (wherein such information is not
protected). However, plaintiffs’ complaint failed to allege that plaintiffs purchased Sam’s Club memberships.
The complaint also contained no allegations of any economic injury or diminution in the value of plaintiffs’
memberships. Plaintiffs’ attempt to theorize their harm in this manner is rejected. See McLoughlin, 2009 WL
2843269, at *4 (“‘[T]he jurisdiction of a federal court must affirmatively and distinctly appear and cannot be
helped by presumptions or by argumentative inferences drawn from the pleadings.’”) (quoting Norton v. Larney,
266 U.S. 511, 515 (1925)); see also Randolph, 486 F. Supp. 2d at 9–10 (“[I]t is axiomatic that a complaint may not
be amended by the briefs in opposition to a motion to dismiss.”) (citations omitted).

-5-

response appeared in the complaint (e.g., details of how Sam’s Club memberships work, the value of
memberships with and without security protections, the risks of having personal information easily
accessed, and how the Sam’s Club website can be accessed by an individual typing in the name
“Identity Thief”), plaintiffs still fail to establish that they have standing.6 To the extent plaintiffs argue
they could allege additional information not contained in their response, this court is not required to
“read the minds of litigants to determine if information justifying an amendment exists . . . .” See Hall
v. Witteman, 584 F.3d 859, 868 (10th Cir. 2009) (citation omitted). Moreover, plaintiffs wholly fail to
comply with Local Rule 15.1 in properly seeking leave to amend. The court denies plaintiffs’ request.
Because plaintiffs lack standing, the court dismisses plaintiffs’ claims without prejudice for
lack of jurisdiction. Defendants’ motion to dismiss is granted.
IT IS THEREFORE ORDERED that Defendants’ Motion to Dismiss (Doc. 13) is granted.
IT IS FURTHER ORDERED that plaintiffs’ claims are dismissed without prejudice for lack
of jurisdiction.
Dated this 16th day of July, 2013, at Kansas City, Kansas.

s/ Carlos Murguia
CARLOS MURGUIA
United States District Judge

6

Even if plaintiffs were to amend their complaint to include information about the value of their memberships with
and without security protections, plaintiffs could not show that the relief they request (a declaration and injunction
under Kan. Stat. Ann. § 50-634(c) of the KCPA) would remedy any alleged financial loss. Thus, redressibility—a
necessary requirement of standing—cannot be met. In addition, Kan. Stat. Ann. §§ 50-634(b)–(c) prohibit
recovery of damages in a class action.

-6-