Stoll v. Musculoskeletal Institute, Chartered

UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION RAY STOLL and HEIDI IMHOF, individually and o/b/o all others similarly situated, Plaintiffs, v. Case No.: 8:20-cv-1798-T-36AAS MUSCULOSKELETAL INSTITUTE, CHARTERED d/b/a FLORIDA ORTHOPAEDIC INSTITUTE, Defendant. ________________________________________/ ORDER Musculoskeletal Institute Chartered d/b/a Florida Orthopaedic Institute (Florida Orthopaedic) moves to strike a portion of the plaintiffs’ Amended Initial Disclosures. (Doc. 29). The plaintiffs oppose the motion. (Doc. 34). I. BACKGROUND The plaintiffs filed a state court putative class action arising from a data breach due to a ransomware attack against Florida Orthopaedic. (Doc. 1, Ex. 1). The plaintiffs allege common law and Florida state law claims against Florida Orthopaedic. (Id. at ¶¶ 91–217). Florida Orthopaedic removed the case to federal court. (Doc. 1). On September 14, 2020, the plaintiffs served Florida Orthopaedic with their Initial Disclosures. (Doc. 29, Ex. A). Florida Orthopaedic requested the plaintiffs — 1 — amend their initial disclosures to specify damages suffered by the named plaintiffs and not just the possible damages for the proposed class. (Doc. 29, ¶ 5). On October 1, 2020, the plaintiffs served their Amended Initial Disclosures. (Doc. 29, Ex. C). In the plaintiffs’ Amended Initial Disclosures, the plaintiffs include these fourteen damages categories: (a) actual identity theft; (b) unauthorized use and misuse of their PII; (c) the loss of opportunity to control how their PII is used; (d) the diminution in value of their PII; (e) the compromise, publication, and/or theft of their PII; (f) out-of-pocket costs associated with the prevention, detection, recovery, and remediation from identity theft or fraud; (g) the lost opportunity costs and lost wages associated with effort expended and the loss of productivity from addressing and attempting to mitigate the actual and future consequences of the Data Breach; (h) costs associated with placing freezes on credit reports; (i) delay in receipt of tax refund monies; (j) the diminished value of Defendant’s goods and services Plaintiffs and Class members received; (k) the lost opportunity and benefits of electronically filing of income tax returns; (l) the imminent and certain impending injury flowing from potential fraud and identity theft posed by their PII being placed in the hands of criminals; (m) the continued risk to their PII, which remains in the possession of Defendant and is subject to further breaches so long as Defendant fails to undertake appropriate measures to protect the PII in their possession; and (n) current and future costs in terms of time, effort, and money that will be expended to prevent, detect, contest, remediate, and repair the impact of the Data Breach for the remainder of Plaintiffs’ and Class members’ lives. (Doc. 29, Ex. C). Florida Orthopaedic requests an order striking the plaintiffs’ damages section — 2 — in their Amended Initial Disclosures. (Doc. 29, p. 6). Florida Orthopaedic also requests the order require the plaintiffs to amend their damages disclosures, and to provide all documents supporting those calculations. (Id.). Florida Orthopaedic also requests a stay of its obligation to respond to the plaintiffs’ discovery requests until the plaintiffs provide updated damages disclosures. (Id. at p. 7). Florida Orthopaedic argues the plaintiffs’ amended disclosures are incomplete because they provide no factual or evidentiary support for those damages and do not attribute the damages to a cause of action. (Id. at p. 5). Florida Orthopaedic argues the plaintiffs must provide the documents supporting their damages rather than delay until a protective order is agreed to between the parties. (Id. at p. 6). The plaintiffs argue they have complied with Rule 26 by providing the categories of damages that are susceptible to computation. (Doc. 34, p. 4). The plaintiffs argue they cannot at this time provide a complete computation of damages for eight categories1 because those categories depend on the extent of the data breach. (Id. at pp. 5–6). The plaintiffs argue four other categories2 have no fixed standard for their measurement and do not fall under the mandates of the Rule 26(a)(1)(iii). (Id. at p. 6). The plaintiffs assert those categories are novel, developing theories of damages. (Id.). 1 Those eight categories from the list above are: (a), (b), (h), (i), (j), (l), (m), and (n). 2 Those four categories from the list above are: (c), (d), (e), and (k). — 3 — II. ANALYSIS Under Fed. R. Civ. P. 12(f), “[t]he court may strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter.” Florida Orthopaedic does not seek to strike a pleading but rather the plaintiffs’ Amended Initial Disclosures. Because Rule 12(f) is inapplicable to discovery, the court will construe Florida Orthopaedic’s motion as a motion to compel more complete initial disclosures from the plaintiffs under Rule 37(b). The parties must disclose, without requesting, “a computation of each category of damages claimed by the disclosing party—who must also make available for inspection and copying as under Rule 34 the documents or other evidentiary material, unless privileged or protected from disclosure, on which each computation is based, including materials bearing on the nature and extent of injuries suffered.” Fed. R. Civ. P. 26(a)(1)(iii ). The requirements of Rule 26(a) are mandatory. Altheim v. GEICO Gen. Ins. Co., No. 8:10-cv-156-T-24TBM, 2010 WL 11508155 , at *1 (M.D. Fla. May 17, 2010). “The goal of the initial disclosure requirement is to accelerate the exchange of basic information about the case.” King v. City of Waycross, Ga., No. 5:14-cv-32, 2015 WL 5468646 , at *2 (S.D. Ga. Sept. 17, 2015) (citation omitted). The “disclosure provision applies only with respect to materials available to the party seeking monetary relief, and where the materials necessary for the computation are not in this party’s possession,” the disclosure requirement does not apply. 8A Wright & Miller Fed. Prac. & Proc. Civ. § 2053 (3d ed.). The disclosure — 4 — obligation is also subject to a duty to supplement under Rule 26(e)(1). At this point, the plaintiffs do not know the full extent of the data breach of Florida Orthopaedic’s system. Because the plaintiffs have not received discovery about the extent of the data breach of Florida Orthopaedic’s system, they do not yet know the extent of all of their alleged damages. However, as discovery progresses, the plaintiffs must supplement their initial disclosures to address the eight categories it states depends on the extent of the data breach. See LeBlanc v. Unifund CCR Partners, G.P., No. 8:06-cv-1216-T-TBM, 2007 WL 2446900 , at *1 (M.D. Fla. Aug. 23, 2007) (The disclosing party must make “a good faith estimate of damages and methods of calculations based on the information available at this stage of the litigation while reserving the right to amend his calculation.”). Although the plaintiffs have not provided damage calculations for the remaining categories,3 the plaintiffs presented their developing theories of damages to Florida Orthopaedic. Because these theories are developing, the plaintiffs will conduct discovery to determine whether those theories create a remedy and possible fixed standard for damages. But see Mee Indus. v. Dow Chem. Co., 608 F.3d 1202, 1221 (11th Cir. 2010) (finding that the district court did not abuse discretion to exclude undisclosed theories of damages and evidence not disclosed during discovery). Even though there are no specific damage calculations, Florida Orthopaedic knows what theories the plaintiffs are seeking damages for, thus eliminating the likelihood 3 The plaintiffs provided damage calculations for categories (f) and (g) for their named plaintiffs. — 5 — of surprise later in the litigation which the Rules aim to prevent. See Shelak v. White Motor Co., 581 F.2d 1155, 1159 (5th Cir. 1978)4 (The Federal Rules of Civil Procedure are designed to “narrow and clarify the issues,” “give the parties mutual knowledge of all relevant facts,” and “prevent[ ] surprise.”). As the plaintiffs conduct discovery and develop their models for their damages, if any, the plaintiffs must supplement their disclosures to reflect the damages, if any, they are seeking under each theory. Florida Orthopaedic requests documentation to support the calculation of damages provided by the plaintiffs. (Doc. 29, p. 6). Apparently, because of the ransomware attack on Florida Orthopaedic, the plaintiffs worry the information they provide through their counsel to opposing counsel will somehow not be protected. (Doc. 34, p. 4 n.2). “A party claiming damages or other monetary relief must, in addition to disclosing the calculation of such damages, make available the supporting documents for inspection and copying as if a request for such material had been made under Rule 34.” Fed. R. Civ. P. 26 (Advisory Committee Notes to 1993 Amendment). The plaintiffs and their counsel have commonplace litigation tools available to mollify any confidentiality concerns and must work with Florida Orthopaedic to address how to protect the confidential documents the plaintiffs must produce. The plaintiffs chose to bring this action and must provide documentation to support their request for damages. See Am. Enters. Collison Ctr., Inc. v. Travelers Prop. & Cas. Co., No. 2:09- cv-443-FtM-29SPC, 2010 WL 11507335 , at *3–4 (M.D. Fla Sept. 17, 2010) (requiring 4 The former Fifth Circuit’s decisions are binding precedent. Bonner v. City of Prichard, 661 F.2d 1206, 1207 (11th Cir. 1981) (en banc). — 6 — compliance with the rule to provide documentation to support the damages calculation). Florida Orthopaedic would like an order preventing the plaintiffs from asserting damages at a mediation, a hearing, or trial if the damages have not been disclosed in compliance with Rule 26(a). (Doc. 29, p. 7). Although Fed. R. Civ. P. 37(c)(1) prevents a party from using information the party did not properly disclose, Florida Orthopaedic’s request is premature. The court entered the case management and scheduling order on October 26, 2020, and discovery does not conclude until November 2021. (Doc. 35). Thus, the parties have just started the discovery process and are under the continuing obligation to supplement their initial disclosures, including claims for damages. See Fed. R. Civ. P. 26(e)(1). Finally, Florida Orthopaedic asks for a stay of its deadline to respond to the plaintiffs’ discovery requests until Florida Orthopaedic receives second amended initial disclosures from the plaintiffs. (Doc. 29, p. 7). Florida Orthopaedic’s responsibility to respond to already served discovery requests does not stop while seeking more complete responses and documentation supporting initial disclosures. See Rivers v. Asplundh Tree Expert Co., No. 5:08cv61/RS/EMT, 2008 WL 5111300 , at *4 (N.D. Fla. Dec. 3, 2008) (“[T]he fact that Plaintiff believed he could not fully answer Defendant’s discovery requests until he received Defendant’s responses to his reciprocal requests does not excuse his failure to respond.”). — 7 — HiIl. CONCLUSION Thus, the following is ORDERED: 1. Florida Orthopaedic’s motion to strike a portion of the plaintiffs’ Amended Initial Disclosures (Doc. 29) is DENIED. 2. Florida Orthopaedic’s construed motion to compel more complete responses to the plaintiffs’ Amended Initial Disclosures is GRANTED in part and DENIED in part. a. The plaintiffs do not have to amend their Amended Initial Disclosures, but they must continually supplement their disclosure to accurately reflect the damages they will seek at trial. b. By December 2, 2020, the plaintiffs must provide documentation for their damages. Before that deadline, the parties are directed to confer further about entering into a confidentiality agreement or protective order. 3. Florida Orthopaedic’s request for a stay to respond to the plaintiffs’ discovery requests (Doc. 29) is DENIED. ENTERED in Tampa, Florida on November 18, 2020. Aranda Are h Sanne AMANDA ARNOLD SANSONE United States Magistrate Judge