Owen-Brooks v. DISH Network Corporation

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO Judge Regina M. Rodriguez Civil Action No. 1:23-cv-01168-RMR-SBP SUSAN OWEN-BROOKS, et al., individually and on behalf of all others similarly situated, Plaintiffs, v. DISH NETWORK CORPORATION and DISH NETWORK LLC, Defendants. And all related actions. ORDER ADOPTING MAGISTRATE JUDGE RECOMMENDATION This matter is before the Court on the Recommendation of United States Magistrate Judge Susan Prose entered August 23, 2024, ECF No. 61, addressing Defendants’ Motion to Dismiss Consolidated Amended Complaint (“Motion to Dismiss”), ECF No. 46. Magistrate Judge Prose recommends that the Motion to Dismiss be granted in part and denied in part. On September 6, 2024, Defendants timely filed an Objection to the Recommendation. ECF No. 62. Plaintiffs filed a response at ECF No. 67. Also before the Court is Plaintiffs’ Motion to Stay Ruling on Defendants’ Objection (“Motion to Stay”), ECF No. 64. Plaintiffs move to stay further proceedings regarding the Defendants’ Objection pending Plaintiffs’ filing of a first amended complaint, ECF No. 64. Defendants’ oppose staying the proceedings. ECF No. 65. For the reasons stated below, the Court OVERRULES Defendants’ Objection and ADOPTS the Recommendation. The Court DENIES Plaintiffs’ Motion to Stay and GRANTS Plaintiffs leave to file their First Amended Consolidated Complaint. I. LEGAL STANDARD The Court is required to make a de novo determination of those portions of a magistrate judge’s recommendation to which a specific, timely objection has been made, and it may accept, reject, or modify any or all of the magistrate judge’s findings or recommendations. 28 U.S.C. § 636 (b)(1) (“A judge of the court shall make a de novo determination of those portions of the report or specified proposed findings or recommendations to which objection is made.”); Fed. R. Civ. P. 72(b)(3) (“The district judge must determine de novo any part of the magistrate judge’s disposition that has been properly objected to.”). “[A] party’s objections to the magistrate judge’s report and recommendation must be both timely and specific to preserve an issue for de novo review by the district court or for appellate review.” United States v. One Parcel of Real Property, 73 F.3d 1057, 1060 (10th Cir. 1996). II. ANALYSIS The parties do not object to the factual or procedural background discussed in the Recommendation. Accordingly, the Court adopts and incorporates the factual and procedural background included within the Recommendation as if set forth herein. Magistrate Judge Prose has presented the Court with a thorough analysis of the issues presented. Her recommended disposition of the underlying Motion to Dismiss is well supported and cogent. Magistrate Judge Prose properly found that Plaintiffs Clark, Vest, and Cardenas have Article III standing. The Tenth Circuit has not addressed Article III standing in data breach cases., Magistrate Judge Prose used a three-factor test endorsed by other circuits in her analysis as follows: 1) whether the data breach was intentional; 2) the nature of the information at issue─is it fraud-sensitive data; and 3) whether the data was actually misused and is the misuse fairly traceable to the data breach. See Clemens v. ExecuPharm Inc., 48 F.4th 146, 153-154 (3d Cir. 2022) (collecting cases from the Second, Seventh, Ninth, and D.C. Circuits). Magistrate Judge Prose concluded the only factor at issue was the third factor of alleged harm. Defendants object, arguing that the first factor, the intentionality factor, is also disputed. Defendants concede this was not raised in either party’s briefing or at the hearing. Thus, it is waived. Arguments raised for the first time in an Objection are deemed waived. See Marshall v. Chater, 75 F.3d 1421, 1426 (10th Cir. 1996); see, e.g., Stout v. Seitz, No. 17-cv-01904CMA-STV, 2018 WL 2948222 , *4 (D. Colo. June 13, 2018) (declining to consider arguments regarding dismissal under Rule 12(b)(6) where the plaintiff raised them for the first time in her objections to a recommendation). Even if the Court were to consider this Objection, Defendants’ argument is flawed. Defendants cite to In re Practicefirst Data Breach Litig., 2022 WL 354544 , at *5 (W.D.N.Y. Feb. 2, 2022) as support for the proposition that the intentionality factor weighs against standing here. However, Practicefirst is distinguishable because the data was not used for identity theft purposes, but instead access to the data was withheld for payment. Id. Defendants argue the same is true here because they received confirmation that the extracted data was deleted. However, in Practicefirst, the plaintiffs failed to allege that out of the 1.2 million people affected by the data breach, there was a single instance of identity theft or similar type of fraud. Id. Here, at the very least, Plaintiffs have plausibly alleged that Plaintiffs Clark, Vest, and Cardenas were victims of fraud or attempted fraud as a result of the data breach. At this early stage that is enough. Discovery is needed to confirm the data was indeed deleted before any of it was misused. Keeping that in mind, this Court finds Plaintiffs have provided enough information regarding traceable misuse to make Article III standing plausible at this early stage of the proceedings. Defendants also object to Magistrate Judge Prose’s conclusion that Plaintiffs’ implied contract, negligence, and negligence per se claims should proceed. Defendants argue the allegations are insufficient to allege the existence of a contract and damages. Its Objection rehashes the parties’ arguments regarding DISH’s Privacy Policy for customers and its Employee Privacy Notice created specifically for its California employees. Magistrate Judge Prose only considered the Defendants’ Privacy Policy in its analysis of Plaintiffs’ express contract claim, which she recommended be dismissed. ECF No. 61 at 27. Defendants’ objection fails to address the conclusion that Plaintiffs allegations adequately allege that an implied contract was created because of the employee relationship. Under Colorado law, express contracts are manifested by written or oral words. Tuttle v. ANR Freight Sys., Inc., 797 P.2d 825, 829 (Colo. App. 1990). Implied contracts arise from the conduct of the parties. Id. Whether a contract, implied or express, exists is a question for the trier of fact. Id. Plaintiffs have adequately pled facts of an implied contract of safekeeping when employees provide their confidential data as part of their employment to survive a motion to dismiss. Defendants also object to the finding that the three Plaintiffs with standing have plausibly alleged damages. Defendants argue that the Magistrate Judge Prose conflated the actual misuse factor required for Article III standing in a data breach case and economic contract damages. Facts alleged for actual misuse can also be used to plausibly allege contract damages. This Court agrees with Magistrate Judge Prose that Plaintiffs have plausibly alleged damages under an implied contract theory. Next Defendants argue Magistrate Judge Prose erred in not specifying a legal duty, one of the essential elements of a negligence claim. Magistrate Judge Prose held that additional argument and discovery are needed to determine whether a special relationship of employer/employee recognized by the Colorado Supreme Court applies, N.M. ex rel Lopez v. Trujillo, 397 P.3d 370, 374 (Colo. 2017), or whether as a matter of law the Court should find Defendants owed a legal duty to protect Plaintiffs against injury, HealthONE v. Rodriguez ex rel. Rodriguez, 50 P.3d 879, 888 (Colo. 2002). “In determining whether a duty should be recognized, a court must consider many factors, including (1) the risk involved, (2) the foreseeability and likelihood of injury as weighed against the social utility of the actor's conduct, (3) the magnitude of the burden guarding against injury or harm, and (4) the consequences of placing the burden upon the actor.” Id. Defendants argue that there is no common law duty in Colorado to safeguard Personally Identifiable Information (“PII”) outside an employee-based relationship, but Defendants do not specify whether an employer has a duty to protect an employee’s PII. This Court agrees with Magistrate Judge Prose─additional information is needed to determine whether a legal duty exists. Plaintiffs have sufficiently pled the elements of negligence to put the Defendants on notice of a negligence claim, which is all that is needed at this stage. Defendants also argue Plaintiffs do not allege an injury because they fail to allege “serious physical manifestation.” ECF No. 62 at 9; see Atsepoyi v. Tandy Corp., 51 F. Supp. 2d 1120, 1127 (D. Colo. 1999) (“[T]o have a cause of action under negligent infliction of emotional distress, plaintiff has to allege, at a minimum, he “suffered emotional distress which resulted in serious physical manifestations or mental illness.”). In Atesepoyi, the court recognizes that there “is no precise definition of what constitutes a ‘serious physical manifestation or mental illness.’” Courts have found generalized symptoms such as headaches, insomnia, crying spells, vomiting and diarrhea are insufficient.” Id. Given that Plaintiff Clark alleges physical conditions from anxiety, a mental illness, and migraines, this Court agrees that Plaintiffs have plausibly alleged an injury. Finally, Defendants object to Magistrate Judge Prose’s recommendation to allow Plaintiffs’ negligence per se claims based on the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. §§ 1301 , et seq., and regulations promulgated thereunder in 45 C.F.R. § 164.402 , as well as Section 5 of the Federal Trade Commission Act (the “FTC” Act) proceed. Colorado law has recognized that a statute may provide evidence of the standard of care for a negligence per se claim even if the statute does not allow for a private right of action. Dolin v. Contemp. Fin. Sols., Inc., 622 F. Supp. 2d 1077, 1085 (D. Colo. 2009). Defendants point to two cases in this district where plaintiffs' negligence per se claims in a data breach case, premised on the FTC Act, were dismissed because plaintiffs failed to demonstrate they were members of the groups the statute was intended to protect. Bellwether Cmty. Credit Union v. Chipotle Mexican Grill, Inc., 353 F. Supp. 3d 1070, 1086 (D. Colo. 2018); SELCO Cmty. Credit Union v. Noodles & Co., 267 F. Supp. 3d 1288, 1297 (D. Colo. 2017). Magistrate Judge Prose found a more recent case from the District of New Mexico, still within the Tenth Circuit, more persuasive. Charlie v. Rehoboth McKinley Christian Health Care Servs., 598 F. Supp. 3d 1145 , 1159 (D.N.M. 2022). In Charlie, the court found that patients' allegations that a healthcare provider violated the FTC Act were sufficient to state a claim for negligence per se arising from the exposure of their private data in a ransom cyberattack. Id. New Mexico’s negligence per se law is similar to Colorado’s, allowing a regulation of statute to create a duty if the duty is distinguishable from the ordinary standard of care. See id. The plaintiffs in SELCO and Bellwether were financial institutions, which is distinguishable from the patients in Charlie and the employees here. Magistrate Judge Prose questioned whether HIPAA would apply to Defendants and welcomed future briefing on the issue. This Court agrees with the Magistrate Judge Prose’s analysis and finds that at this early stage of the proceedings, Plaintiffs have sufficiently pled a negligence per se claim. III. CONCLUSION For the reasons set forth above, and in the Recommendation, Defendants’ Motion to Dismiss is GRANTED in part and DENIED in part. The Motion to Dismiss is granted as to the claims of Plaintiffs Dougherty, Abraham, Cruse, Jenkins, Turley, Cook, Bane, and Looney because of a lack of Article III standing. The Motion to Dismiss is also granted as to the express contract and unjust enrichment claims. Plaintiffs have represented to the Court that they do not intend to re-plead their claims for express contract or unjust enrichment, so those claims will be dismissed with prejudice. ECF No. 64 at 2. The Motion to Dismiss is denied as to the claims of Plaintiffs Clark, Vest, and Cardenas for negligence, negligence per se, implied contract, and declaratory relief. Plaintiffs will be granted leave to amend their complaint to add factual allegations to strengthen standing claims for all the named Plaintiffs. Accordingly, the Court ORDERS: 1. Defendants’ Objections to the Recommendation, ECF No. 62 is OVERRULED; 2. The Recommendation, ECF No. 61, is ACCEPTED and ADOPTED; 3. Defendants’ Motion to Dismiss, ECF No. 46, is GRANTED in part and DENIED in part; 4. Plaintiffs express contract and unjust enrichment claims are DENIED WITH PREJUDICE; 5. Plaintiffs Dougherty, Abraham, Cruse, Jenkins, Turley, Cook, Bane, and Looney’s claims are DENIED WITHOUT PREJUDICE; 6. Plaintiffs’ Motion to Stay, ECF No. 64, is GRANTED in part and DENIED in part. To the extent the Motion requests a stay in proceedings, the motion is DENIED. To the extent, the Motion requests leave to file an amended complaint, the Motion is GRANTED; and 7. Plaintiffs may FILE their Amended Consolidated Complaint two weeks from this Order. DATED: September 27, 2024 BY THE COURT: Ue United States District Judge