Greco v. Syracuse ASC, LLC

Greco v Syracuse ASC, LLC (2023 NY Slip Op 03987) Greco v Syracuse ASC, LLC 2023 NY Slip Op 03987 Decided on July 28, 2023 Appellate Division, Fourth Department Published by New York State Law Reporting Bureau pursuant to Judiciary Law § 431. This opinion is uncorrected and subject to revision before publication in the Official Reports. Decided on July 28, 2023 SUPREME COURT OF THE STATE OF NEW YORK Appellate Division, Fourth Judicial Department PRESENT: SMITH, J.P., LINDLEY, CURRAN, AND OGDEN, JJ. 228 CA 22-01218 [*1]GRETCHEN GRECO, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED, PLAINTIFF-RESPONDENT, v SYRACUSE ASC, LLC, DOING BUSINESS AS SPECIALTY SURGERY CENTER OF CENTRAL NEW YORK, DEFENDANT-APPELLANT. (APPEAL NO. 1.) WILSON ELSER MOSKOWITZ EDELMAN & DICKER LLP, WHITE PLAINS (MELISSA A. MURPHY-PETROS OF COUNSEL), FOR DEFENDANT-APPELLANT. FINKELSTEIN, BLANKENSHIP, FREI-PEARSON & GARBER, LLP, WHITE PLAINS (DOUGLAS G. BLANKENSHIP OF COUNSEL), FOR PLAINTIFF-RESPONDENT. Appeal from an order of the Supreme Court, Onondaga County (Donald A. Greenwood, J.), entered June 28, 2022. The order, insofar as appealed from, denied the motion of defendant to dismiss the complaint. It is hereby ORDERED that the order insofar as appealed from is unanimously reversed on the law without costs, the motion to dismiss the complaint is granted and the complaint is dismissed. Memorandum: Plaintiff commenced this putative class action seeking to recover damages allegedly arising when an unknown third party gained unauthorized access to certain personal information belonging to plaintiff and others, which was stored on defendant's computer system. Defendant moved to dismiss the complaint on the ground that, inter alia, plaintiff lacked standing to bring the action because she had not alleged an injury-in-fact. In appeal No. 1, defendant appeals, as limited by its brief, from that part of an order denying its motion to dismiss the complaint. In appeal No. 2, defendant appeals from a subsequent order denying its motion to stay all proceedings pending this Court's resolution of appeal No. 1. In appeal No. 1, we agree with defendant that Supreme Court erred in denying its motion to dismiss the complaint. In order to possess standing, plaintiff was required, inter alia, to have suffered "an injury-in-fact" (Matter of Association for a Better Long Is., Inc. v New York State Dept. of Envtl. Conservation, 23 NY3d 1, 6 [2014]; see Matter of Sheive v Holley Volunteer Fire Co., Inc., 170 AD3d 1589, 1590 [4th Dept 2019]). The injury-in-fact requirement necessitates a showing that the party has "an actual legal stake in the matter being adjudicated" (Society of Plastics Indus. v County of Suffolk, 77 NY2d 761, 772 [1991]; see Matter of Mental Hygiene Legal Serv. v Daniels, 33 NY3d 44, 50 [2019]) and that the party has suffered a cognizable harm that is not " 'tenuous,' 'ephemeral,' or 'conjectural,' " but is, instead, "sufficiently concrete and particularized to warrant judicial intervention" (Daniels, 33 NY3d at 50; see New York State Assn. of Nurse Anesthetists v Novello, 2 NY3d 207, 211, 214 [2004]; Matter of Festa v Town of Oyster Bay, 210 AD3d 678, 679-680 [2d Dept 2022]). An alleged injury will not confer standing if it is based on speculation about what might occur in the future or what future harm might be incurred (see Frankel v J.P. Morgan Chase & Co., 193 AD3d 689, 690 [2d Dept 2021]; Matter of Niagara County v Power Auth. of State of N.Y., 82 AD3d 1597, 1599 [4th Dept 2011], lv dismissed in part & denied in part 17 NY3d 838 [2011]; Matter of Brewster v Wright, 45 AD3d 1369, 1370 [4th Dept 2007]). The parties correctly note that this is the first time the Appellate Division has been asked to address the issue of standing in this context, i.e., in a case brought by an individual whose information was involved in a larger electronic data breach or whose personal data was otherwise involved in the unauthorized access of electronic files stored on a computer system. Although the rise of unauthorized access to secure electronic systems, resulting in third parties obtaining the information stored thereon, is a relatively modern issue, the injury-in-fact requirement recognized in other contexts applies equally here. Thus, the novel issue presented is simply what circumstances, specific to this context, create an injury that is "sufficiently concrete" and non-speculative to constitute an injury-in-fact (Daniels, 33 NY3d at 50). Analyzing similar issues, New York trial courts have looked to certain considerations, such as the type of personal information that was compromised; whether hackers or cybercriminals were involved and whether the attack was targeted; whether personal information was exfiltrated, published, or otherwise disseminated; whether the data has actually been misused; and the length of time that has elapsed since the data breach without misuse of the personal information at issue (see Keach v BST & Co. CPAs, LLP, 71 Misc 3d 1204[A], 2021 NY Slip Op 50273[U], *4 [Sup Ct, Albany County 2021]; see also Smahaj v Retrieval-Masters Creditors Bur., Inc., 69 Misc 3d 597, 602-604 [Sup Ct, Westchester County 2020]; Lynch v Johnson, 2018 NY Slip Op 32962 [U], *3-4 [Sup Ct, NY County 2018]; Manning v Pioneer Sav. Bank, 56 Misc 3d 790, 796-797 [Sup Ct, Rensselaer County 2016]). Addressing the issue under the distinct Federal standing analysis (see Society of Plastics, 77 NY2d at 772), the Second Circuit has looked to conceptually similar considerations, such as whether the data was accessed via a targeted attack or an inadvertent disclosure, whether some of the data accessed has actually been misused even if plaintiff's data has not yet been specifically misused, and whether the type of data at issue has exposed plaintiff to a greater risk (see McMorris v Carlos Lopez & Assocs., LLC, 995 F3d 295, 301-302 [2d Cir 2021]). Given the numerous circumstances under which such data breaches may occur, many of those considerations may not apply in all cases and additional considerations may become relevant. Nevertheless, the core of the analysis remains the same: whether plaintiff has suffered a "sufficiently concrete" and non-speculative injury to satisfy the injury-in-fact requirement (Daniels, 33 NY3d at 50). Here, having considered all relevant circumstances as alleged in the complaint, we conclude that plaintiff has not alleged an injury-in-fact and thus lacks standing. Perhaps most importantly, plaintiff has not alleged that any of the information purportedly accessed by the unknown third party has actually been misused. Plaintiff has not alleged that her own information has been misused or that the data of any similarly situated person has been misused in the over one-year period between the alleged data breach and the issuance of the trial court's decision. Further, the complaint itself alleges that a third party accessed health information only. It does not allege that a third party accessed data more readily used for financial crimes such as dates of birth, credit card numbers, or social security numbers. Indeed, other than a general concern that certain of plaintiff's health information may have been illegally accessed by a third party, plaintiff does not allege any direct harm flowing from the breach of defendant's electronic system. We conclude that plaintiff failed to allege an injury-in-fact inasmuch as the potential for future misuse of her data and possible economic harm is too "conjectural, tenuous [and] hypothesized" to constitute an interest that is sufficiently concrete to confer standing (Niagara County, 82 AD3d at 1599; see Daniels, 33 NY3d at 50). To the extent that plaintiff also contends that she established an injury-in-fact by virtue of the cost of identity protection and other mitigation efforts, we conclude that such mitigation efforts cannot confer standing absent a sufficiently concrete injury-in-fact legitimizing or warranting such efforts. A plaintiff "cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending" (Matter of Practicefirst Data Breach Litig., 2022 WL 354544 at *4 [WDNY 2022]). Reviewing the complaint, we conclude that plaintiff has not otherwise alleged an injury-in-fact that would confer standing to bring this action. In light of our determination, we do not address defendant's remaining contentions in appeal No. 1. The appeal from the order in appeal No. 2 is dismissed because it has been rendered moot by our determination in appeal No. 1 (see Fasano v J.C. Penney Corp., 59 AD3d 1103, 1103 [4th Dept 2009]; Mercer v Pal Energy Corp., 280 AD2d 896, 897 [4th Dept 2001]). Entered: July 28, 2023 Ann Dillon Flynn Clerk of the Court