McCoy v. Fisher et al

Filing 43

MEMORANDUM OPINION. Signed by Judge Paula Xinis on 10/18/2016. (kns, Deputy Clerk)(c/m 10/18/16)

Download PDF
IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND ANTONIO MCCOY Plaintiff, v. * * * Civil Action No. PX 16-324 * JEFFREY B. FISHER et al., * Defendants. ****** MEMORANDUM OPINION I. BACKGROUND Plaintiff Antonio McCoy (“Plaintiff”) and his former wife, LaAngela McCoy held title to real property located at 4813 Ocean Gateway, Vienna, Maryland. ECF No. 37-1. On June 19, 2007, LaAngela executed a Note in the amount of $90,000 to HSBC Mortgage Corporation (“HSBC”). ECF No. 37-2. The Note was secured by a Deed of Trust to HSBC executed by LaAngela and Plaintiff on the same date, and which was recorded among the Land Records of Dorchester County, Maryland. ECF No. 37-3. LaAngela and Plaintiff eventually defaulted on the Note and Deed of Trust. On April 6, 2015, Defendants Jeffrey Fisher and The Fisher Law Group, acting as substitute trustees for HSBC, commenced a foreclosure action in the Dorchester County Circuit Court against LaAngela and Plaintiff. ECF No. 37-4. During the foreclosure action, the Fisher Law Group and Jeffrey Fisher attached an Affidavit of Debt to one of their filings which Plaintiff alleges included his loan number and social security number.1 Pursuant to Maryland Rule 1-322.1, the filer of any paper or electronic 1 Jeffrey Fisher and The Fisher Law Group vigorously dispute that they disclosed Plaintiff’s social security number. They allege that the circuit court documents only revealed LaAngela McCoy’s personal information because she 1 filing with a Maryland court must redact or omit certain “personal identifier information” from the document before it is filed, including an individual’s social security number. The Fisher Law Group and Jeffrey Fisher admit that they failed to redact personal identifier information from the Affidavit of Debt before filing it with the Dorchester County Circuit Court. ECF No. 37 at 8. On May 29, 2015, the Fisher Law Group sent Plaintiff a letter notifying him of the inadvertent disclosure of his personal information, and stated that the unredacted documents “may have included your loan number and your social security number.” ECF No. 33-1. HSBC sent its own letter to Plaintiff on June 1st, acknowledging that its law firm “filed documents with the court which inadvertently contained information that should have been hidden.” ECF No. 33-2. On June 5, 2015, the substitute trustees filed a motion with the circuit court to restrict access to the circuit court’s file also seeking a protective order. The circuit court granted the motion by order on June 8, 2015. ECF No. 37-4 at 6. As a result of Defendants’ acknowledged mistake, Plaintiff filed a Complaint in this Court against Jeffrey B. Fisher, the Fisher Law Group, and HSBC on February 4, 2016. ECF No. 1. He filed an Amended Complaint on June 29, 2016 alleging six causes of action. ECF No. 32. The first two Counts allege that HSBC, Jeffrey Fisher, and The Fisher Law Group violated what appears to be a section of the Gramm-Leach-Bliley Act: “Title V-Privacy Subtitle A Disclosure of Non-Public Personal Information.” Counts three and four allege that Jeffrey Fisher and The Fisher Law Group violated the Ninth Amendment of the United States Constitution. Counts five and six allege that Jeffrey Fisher and the Fisher Law Group acted negligently in submitting the Affidavit of Debt without redacting Plaintiff’s personal information. On July 19, 2016, was the sole Note holder. For the purpose of deciding this motion, however, the Court will accept Plaintiff’s allegation as true. 2 Defendants Jeffrey Fisher and The Fisher Law Group (hereinafter, “Defendants”) moved to dismiss Plaintiff’s Amended Complaint.2 ECF No. 37. II. STANDARD OF REVIEW Defendants move to dismiss Plaintiff’s Amended Complaint pursuant to Fed. R. Civ. P. 12(b), without specifying a particular subsection, and Fed. R. Civ. P. 54. This Opinion addresses only Defendants’ challenge to Plaintiff’s standing, or lack thereof, which is an element of subject matter jurisdiction. White Tail Park, Inc. v. Stroube, 413 F.3d 451, 459 (4th Cir. 2005); ECF No. 37 at 10–13. Thus, Defendants’ motion to dismiss should be treated under Rule 12(b)(1). Under this Rule, the plaintiff bears the burden of proving that subject matter jurisdiction properly exists in the federal court. See Evans v. B.F. Perkins Co., a Div. of Standex Int’l Corp., 166 F.3d 642, 647 (4th Cir. 1999). In a 12(b)(1) motion, the court “may consider evidence outside the pleadings” to help determine whether it has jurisdiction over the case before it. Richmond, Fredericksburg & Potomac R.R. Co. v. United States, 945 F.2d 765, 768 (4th Cir. 1991); see also Evans, 166 F.3d at 647. The court should grant the 12(b)(1) motion “only if the material jurisdictional facts are not in dispute and the moving party is entitled to prevail as a matter of law.” Richmond, 945 F.2d at 768. Occasionally, jurisdictional facts are so intertwined with the merits of a claim that the jury is the proper trier of contested facts. U.S. ex rel. Vuyyuru v. Jadhav, 555 F.3d 337, 348 (4th Cir. 2009). III. ANALYSIS A. Standing To prove standing, a plaintiff must establish (1) an injury in fact (2) fairly traceable to the challenged conduct (3) that is likely to be “redressed by a favorable judicial decision.” Hollingsworth v. Perry, 133 S. Ct. 2652, 2661 (2013). Here, the Defendants argue that Plaintiff 2 As explained below, HSBC has not responded to Plaintiff’s Complaint. 3 has failed to establish the first element, injury in fact, because he alleges only a risk of possible future identity theft. See, e.g., ECF No. 37 at 11 (explaining that nowhere in Plaintiff’s Amended Complaint does he allege that disclosure of plaintiff’s personal information actually occurred). An injury in fact requires “an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (citations omitted). However, the United States Supreme Court in Clapper v. Amnesty International USA, 133 S. Ct. 1138 (2013) recently acknowledged that standing can be based on the “substantial risk” that harm will occur, so long as the future injury is “certainly impending.” Allegations of “possible future injury are not sufficient.” Id. at 1147 (emphasis in original). See also Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016), as revised (May 24, 2016) (noting that “the risk of real harm” may satisfy the concreteness requirement of the injury-in-fact prong). Plaintiff alleges that the documents improperly provided to the circuit court included his name, mailing address, social security number, and other personal information. ECF No. 32 at 3. He believes that Defendants’ disclosure of his information “subject[s] plaintiff to identity theft for the rest of his life.” ECF No. 32 at 3. This disclosure “will cost plaintiff thousands of dollars to take the necessary steps to prevent identity theft.” See, e.g., id. at 7. However, Plaintiff never alleges that his personal information has been stolen or misused. The Fourth Circuit has yet to address whether standing is conferred based on the potential for future victimization of identity theft, but our lower court has recently addressed standing in the data breach context. See Khan v. Children’s Nat’l Health Sys., No. TDC-15-2125, 2016 WL 2946165, at *3 (D. Md. May 19, 2016); Chambliss v. Carefirst, Inc, No. RDB-15-2288, 2016 WL 3055299, at *4 (D. Md. May 27, 2016). In Khan v. Children’s National Health System, 4 hackers gained access through phishing emails to the accounts of certain hospital employees. The email accounts contained patient names, addresses, dates of birth, social security numbers, telephone numbers and private health care information. The named plaintiff in Khan alleged she was injured because of the concern that her “personal information will be misused.” But she did not “claim that she or anyone else affected by the data breach has learned of any misuse to date.” Id. at *1. After a thorough analysis, the Khan Court concluded that “in the data breach context, plaintiffs have properly alleged an injury in fact arising from increased risk of identity theft if they put forth facts that provide either (1) actual examples of the use of the fruits of the data breach for identity theft, even if involving other victims; or (2) a clear indication that the data breach was for the purpose of using the plaintiffs’ personal data to engage in identity fraud.” Khan, 2016 WL 2946165, at *5. Based on this framework, the Court found that the named plaintiff could not prove injury in fact because the plaintiff failed to allege “facts indicating that the hackers have attempted to engage in any misuse of [the hospital] patients’ personal information since the breach was discovered.” Id. See also Chambliss, 2016 WL 3055299, at *4 (“‘the mere loss of data—without any evidence that it has been either viewed or misused—does not constitute an injury sufficient to confer standing.’”) (quoting In re Science Applications Int’l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 19 (D.D.C. 2014)) (listing cases in accord). In this case, Plaintiff has failed to plead sufficient facts to demonstrate that future injuries are anything more than remote and speculative at best. First, and perhaps most fatally, Plaintiff’s personal information was not compromised as a result of individuals actively seeking and obtaining his information for personal gain. At most, Plaintiff alleges that his information was accidently made publicly available for a period of time, introducing the risk that a bad actor 5 could obtain such information. Thus, the risk of harm here is far more remote than in Khan, where hackers actively sought and obtained the victim’s personal information. Second, Plaintiff does not allege his information was obtained by a third party or misused in any way. Plaintiff’s personal information remained publicly available for just two months. Sixteen months have passed since the circuit court granted Defendants’ motion to restrict access to the unredacted document. Yet, to this day, Plaintiff posits no facts that his personal information has been misused or that such misuse is impending. See Chambliss, 2016 WL 3055299, at *3–4 (finding instructive that plaintiff had suffered no injury since the data breaches occurred one to two years earlier); In re Davis, 430 B.R. 902, 907 (Bankr. D. Colo. 2010) (“[T]here is no evidence that Plaintiff’s personal information has been accessed or misused by an unauthorized third party during the six days when it was viewable by the public on PACER, nor that it will be.”). Indeed, Plaintiff’s theory of harm depends on a chain of events that may never occur. See Chambliss, 2016 WL 3055299, at *4 (citing In re SuperValu, Inc., No. 14-MD-2586 ADM/TNL, 2016 WL 81792, at *5 (D. Minn. Jan. 7, 2016)). Plaintiff’s allegations assume that a third party (1) accessed the circuit court documents that contained Plaintiff’s personal information during that time that information was publicly available; (2) intends to commit future fraudulent or criminal acts with that information; and (3) to the determinant of Plaintiff. But without particularized facts to support a claim of future harm, Plaintiff’s complaint is far too speculative to confer Article III standing. Accordingly, Plaintiff’s complaint must be dismissed. B. Service of Process with Respect to HSBC Mortgage Services Inc. On February 22, 2016, Plaintiff mailed a copy of the summons and original complaint to “HSBC Mortgage Services Inc., 2929 Walden Avenue, Depew, New York, 14043.” ECF No. 9. 6 As the Court explained in its July 14th Memorandum Opinion and Order, ECF No. 35, HSBC is a Delaware Corporation headquartered in New York City, New York. Rule 4(h)(1) of the Federal Rules of Civil Procedure requires that a domestic corporation “must be served”: ... (A) in the manner prescribed by Rule 4(e)(1) for serving an individual; or (B) by delivering a copy of the summons and of the complaint to an officer, a managing or general agent, or any other agent authorized by appointment or by law to receive service of process . . . . Fed. R. Civ. P. 4(h)(1)(A)–(B). Rule 4(e) permits service pursuant to “state law for serving a summons in an action brought in courts of general jurisdiction in the state where the district court is located or where service is made.” Fed. R. Civ. P. 4(e). Accordingly, Plaintiff must serve HSBC either in compliance with New York law, Maryland law, or Rule 4(h)(1)(B). Service upon a corporation pursuant to Section 311 of the New York Civil Practice Law & Rules (CPLR) requires “delivering the summons . . . upon any domestic or foreign corporation, to an officer, director, managing or general agent, or cashier or assistant cashier or to any other agent authorized by appointment or by law to receive service.” N.Y. C.P.L.R. § 311 (Mckinney 1999). Service upon a corporation pursuant to Maryland Rule 2-124(d) requires “serving its resident agent, president, secretary or treasurer,” and if no resident agent exists or cannot be found, upon “the manager, any director, vice president, assistant secretary, assistant treasurer, or other person expressly or impliedly authorized to receive service of process.” Md. Rules 2-124(d). The Court also explained that Plaintiff’s affidavit of service with respect to HSBC did not demonstrate that service was proper under any of the above-enumerated options. The Court then 7 ordered Plaintiff to show good cause why the Complaint should not be dismissed as to HSBC without prejudice, and pursuant Fed. R. Civ. P. 4(m) and Local Rule 103.8.a. ECF No. 36. Plaintiff responded to the Court’s show cause Order on July 27th, arguing that he did properly effectuate service on HSBC and did attach an appropriate affidavit of service. ECF No. 39. Attached to Plaintiff’s response is a copy his original affidavit of service, which still does not demonstrate whether Plaintiff sent the summons and complaint to the appropriate address or whether it was addressed to a person designated to receive process on behalf of HSBC. ECF No. 39-4. Accordingly, the Amended Complaint will be dismissed with respect to HSBC. IV. CONCLUSION For the reasons stated above, the Defendants’ motion to dismiss will be granted. The Amended Complaint will also be dismissed with respect to HSBC for Plaintiff’s failure to properly serve process. A separate order will follow. 10/18/2016 Date /S/ Paula Xinis United States District Judge 8

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?