Melancon v. Louisiana Office of Student Financial Assistance

ORDER AND REASONS CARL J. BARBIER, District Judge. Before the Court is Defendant Iron Mountain, Incorporated’s (“Iron Mountain”) Motion for Summary Judgment (Rec.Doc.40). This motion, which is opposed, was set for hearing on May 14, 2008 on the briefs. Upon review of the record, the memoranda of counsel, and the appli *874 cable law, this Court now finds, for the reasons set forth below, that Iron Mountain’s motion should be granted. Background Facts This matter involves purported class action claims that arise out of the loss on September 19, 2007 of backup electronic media belonging to the Louisiana Office of Student Financial Assistance (“LOSFA”) from a truck operated by Iron Mountain. 1 The lost media includes personal information on individuals participating in or considered for participation in programs for financial assistance and certain scholarship programs of higher education. The two putative class actions based on this incident (Melancon and Bradley) have been consolidated by this Court. The Parties’ Arguments The crux of Iron Mountain’s argument is that it is an undisputed fact that Plaintiffs suffered no actual injury resulting from the loss of the electronic data. Therefore, according to Iron Mountain, absent any actual harm to Plaintiffs, Louisiana law compels the conclusion that Iron Mountain is entitled to judgment as a matter of law. Plaintiffs herein have alleged state law negligence-based claims. To analyze such claims, Louisiana courts employ the duty/ risk analysis. See Mathieu v. Imperial Toy Corp., 646 So.2d 318, 321-22 (La. 1994). Specifically, Plaintiffs must prove the following elements: (1) the defendant had a duty to conform his or her conduct to a specific standard of care; (2) the defendant failed to conform his or her conduct to the appropriate standard; (3) the defendant’s substandard conduct was the cause-in-fact of the plaintiffs injuries; (4) the defendant’s substandard conduct was a legal cause of the plaintiffs injuries; and (5) actual damages. According to Iron Mountain, nowhere in the complaints do Plaintiffs allege any actual injuries. Furthermore, no evidence has been presented to show that the electronic data, although lost, have been misused or compromised. Plaintiffs allege injuries in the form of: (1) “invasion of privacy, identity theft, fear of identity theft, harassment, [and] nuisance”; 2 (2) “fear, anxiety, emotional distress, [the] need to close bank accounts and register with fraud alert programs”; 3 and (3) “anxiety, emotional distress, [and] loss of privacy.” 4 Iron Mountain argues that no invasion of privacy, identity theft, harassment, or nuisance has actually occurred. What remains are claims by Plaintiffs regarding increased risk of future identity theft, fear, anxiety, and emotional distress. According to Iron Mountain, such concerns do not rise to the level of harm necessary to support any recovery since, generally, under Louisiana law, “if the defendant’s conduct is merely negligent and causes only mental disturbance, without accompanying physical injury, illness, or other physical consequences, the defendant is not liable for such emotional disturbance.” Nesom v. Tri Hawk Int’l, 985 F.2d 208, 211 (5th Cir.1993) (quoting Moresi v. Dept. of Wildlife & Fisheries, 567 So.2d 1081, 1095-96 (La.1990)). A limited exception to this rule which permits recovery for emotional distress absent physical *875 injury exists when there are “special circumstances” which serve as a guarantee that the claim is not spurious. Moresi, 567 So.2d at 1096. Consequently, “more than minimal inconvenience and worry must be shown.” Rivera v. United Gas Pipeline Co., 697 So.2d 327, 338 (La.App. 5th Cir.1997). In the context of Louisiana negligence law requiring actual injury, Iron Mountain cites to a recent case involving data loss filed in the Middle District of Louisiana. In that case, Judge Brady determined (on a failure to state a claim basis) that allegations of mere emotional disturbance are insufficient to prevail on a negligence claim. Ponder v. Pfizer, Inc., 522 F.Supp.2d 793 (M.D.La.2007). In Ponder, private data on thousands of Pfizer employees left the confines of a Pfizer hard drive and escaped into an unauthorized domain. Id. A class action was filed against Pfizer asserting such damages as “fear and apprehension of fraud, loss of money, and identity theft; the burden and cost of credit monitoring; the burden and the cost of closing compromised credit accounts and opening new accounts; the burden of scrutinizing credit card statements and other statements for unauthorized transactions; damage to credit; loss of privacy and other economic damages.” Id. at 795. Defendant moved to dismiss the claim, arguing that the alleged damages were “inherently speculative and not recoverable under Louisiana law, which requires that damages be established to a ‘legal certainty.’ ” Id. at 797. As this was an issue of first impression in Louisiana, Judge Brady reviewed and found persuasive the reasoning and decisions of other federal and state courts. 5 As such, he determined that under Louisiana law, the damages alleged were merely speculative rather than actual damages. 6 Id. Iron Mountain goes on to cite several other cases that considered other instances of data loss involving no actual misuse of personal information. Such cases, according to Iron Mountain, support the proposition that lack of misuse of personal data constitutes the absence of actual harm. See Key v. DSW, Inc., 454 F.Supp.2d 684, 691 (S.D.Ohio 2006) (holding that, in the *876 context of a standing analysis, no claim exists “when the alleged injury is dependent upon the perceived risk of future actions of third parties not before the Court”). In opposition, Plaintiffs argue that they have been exposed to the real threat of identity theft and offer the affidavit of Evan Hendricks, a “nationally recognized expert on identity theft and credit monitoring issues,” in support. 7 Plaintiffs cite to Arcilla v. Adidas Promotional Retail Operations, Inc. for the proposition that courts have expressly recognized the heightened risk of identity theft to be a legally cognizable injury. 488 F.Supp.2d 965, 972 (C.D.Cal.2007). 8 Plaintiffs also cite to the factors set forth in Bourgeois v. A.P. Green Indus., Inc. having to do with the recovery of medical monitoring damages. 716 So.2d 355 (La.1998). In Bourgeois, the court determined that monetary damages for medical monitoring, even in the absence of physical injury, were recoverable. Id. Relying on the reasoning in Bourgeois, Plaintiffs argue that damages for credit monitoring services are akin to medical monitoring damages and, as such, are recoverable under La. C.C. articles 2315 and 2316. Plaintiffs acknowledge that the Louisiana Legislature amended La. C.C. article 2315 following the Bourgeois decision, but state that this amendment was specific to claims for medical monitoring damages only. Plaintiffs also argue that Ponder is not controlling, particularly as the court did not consider damages for credit monitoring in the context of Bourgeois. In reply, Iron Mountain argues that Ar-cilla is not relevant to the instant analysis as that case construes the federal Fair and Accurate Credit Transactions Act, not Louisiana law. In this case, no statutory penalty is at issue as Plaintiffs’ claims sound in negligence under Louisiana law, where actual harm, not a statutory penalty or fine, remains a legal requirement. Furthermore, Iron Mountain argues that Bourgeois has been legislatively overruled and other cases have refused to recognize an analogy between credit monitoring and medical monitoring as credit monitoring does not involve the same issues regarding human health and safety. Even if this analogy worked, Plaintiffs have provided no evidence that their personal information was ever actually “exposed” to any unauthorized party, which is one of the criteria set forth in Bourgeois. Plaintiffs also state in opposition that Iron Mountain cannot prove that it complied with all statutory requirements requiring notice to the persons affected by its negligence under La. R.S. 51:3074. As such, Plaintiffs argue that Iron Mountain is not entitled to judgment as a matter of law. In reply, Iron Mountain argues that it did comply with statutory duties as Iron Mountain’s only responsibility was to immediately notify the owner of the data whose security was breached (LOSFA), at which point it becomes the duty of the owner to notify persons that were affected. Iron Mountain promptly notified LOSFA. Finally, Plaintiffs argue that since the filing of Iron Mountain’s motion, “significant factual issues” have arisen that raise *877 genuine issues of material fact sufficient to preclude summary judgment. These include the fact that evidence has been obtained that Iron Mountain has found the lost container but not the disks themselves and that a named plaintiff (Bradley) informed her attorney that an unauthorized transaction was attempted on one of her credit cards. According to Plaintiffs, who seek relief under Buie 56(f) of the Federal Rules of Civil Procedure, investigation needs to be done to determine the effect of these developments on the instant case. In reply, Iron Mountain argues that Plaintiffs merely mention the alleged misuse of Plaintiff Bradley’s credit card and make no effort to link the misuse to the loss of LOSFA data. In fact, Iron Mountain argues that no such link can be made as no credit card information was provided to LOSFA. Therefore, no discovery is needed on this issue. And as to the retrieval of the lost container, Iron Mountain argues that counsel for Plaintiffs have failed to provide an explanatory affidavit stating what information they hope to obtain through further discovery of this issue. As a result, Plaintiffs have failed to comply with and should not be able to rely upon Rule 56(f). Discussion Summary judgment is appropriate if “there is no genuine issue as to any material fact and the moving party is entitled to judgment as a matter of law.” Fed.R.Civ.P. 56(c). The moving party bears the initial burden of demonstrating the absence of a genuine issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). If that burden has been met, the nonmoving party must then come forward and establish the specific material facts in dispute to survive summary judgment. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 588, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986). As articulated by Iron Mountain and as determined by Judge Brady in Ponder, the mere possibility that personal information may be at increased risk does not constitute actual injury sufficient to maintain a claim for negligence under the current state of Louisiana law. In this case, it is undisputed that no personal data has been compromised and Plaintiffs have failed to offer evidence that any third party has gained access to the data. As such, Plaintiffs allege damages that are purely speculative rather than asserting any actual, cognizable losses. Plaintiffs, therefore, lack the ability to prove an essential element of their negligence claim against Iron Mountain and as a result, Iron Mountain is entitled to summary judgment as a matter of law. Accordingly, IT IS ORDERED that Iron Mountain’s Motion for Summary Judgment (Rec. Doc.40) is hereby GRANTED and that Plaintiffs claims against Iron Mountain are hereby DISMISSED. Footnotes [1] There are two putative class actions involved: (1) Jason Melancon, et al v. Louisiana Office of Student Financial Assistance, et al, No. 07-7712; and (2) Christine M. Bradley, et al v. Iron Mountain Incorporated, et al, No. 07-9158. [2] See Melancon Class Action Complaint. [3] See Melancon First Amended and Supplemental Class Action Complaint. [4] See Bradley first Supplemental and Amended Class Action Complaint. [5] In Pisciotta v. Old Nat’l Bancorp, the Seventh Circuit disallowed claims for “compensation for past and future credit monitoring services” and damages for "emotional distress and worry that third parties will use [the plaintiffs’] confidential personal information to cause them economic harm, or sell their confidential information to others who will in turn cause them economic harm.” 499 F.3d 629 (7th Cir.2007). In Hendricks v. DSW Shoe Warehouse, Inc., a federal district court in Michigan dismissed a plaintiff's complaint for identity theft because the plaintiff's alleged damages, the cost of a credit monitoring product, “were not actual damages or a cognizable loss.' ” 444 F.Supp.2d 775 (W.D.Mich.2006). In Forbes v. Wells Fargo Bank, N.A., a federal district court in Minnesota rejected the plaintiff’s negligence claims, finding that the plaintiffs' "expenditure of time and money” in “monitoring their credit” does not constitute injury or damages because it "was not the result of any present injury, but rather the anticipation of future injury that has not materialized.” 420 F.Supp.2d 1018 (D.Minn.2006). Finally, in Kahle v. Litton Loan Servicing, LP, a federal district court in Ohio held that plaintiff's alleged damages, the cost of a credit monitoring product and the time spent monitoring credit, “were not recoverable as a matter of law because 'no unauthorized use of [Plaintiff's] personal information has occurred' and, thus, 'any injury of Plaintiff is purely speculative.' " 486 F.Supp.2d 705 (S.D.Ohio 2007). [6] Judge Brady went on to state that the injury from theft of personal information accrues only when the compromised data are actually used by a third party to steal someone's identity, rather than when the data are exposed, and become obtained by a third party. Id. at n. 5. [7] Plaintiffs submit Mr. Hendricks as an expert on identity theft and credit monitoring for purposes of summary judgment. [8] In Arcilla, the plaintiffs alleged that a retailer failed to truncate customers’ credit card numbers and to obscure the expiration dates as required by the Fair Credit Transactions Act (“FCRA”). 488 F.Supp.2d 965. In denying the defendant’s motion to dismiss, the court held that although plaintiff's loss was “hard to quantify,” plaintiffs properly alleged "actual harm” in the form of heightened risk of identity theft. Id. at 967.