Hoffmann v. Major Model Management, Inc.

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------------------------x STEPHANIE HOFFMANN, individually and on behalf of all others similarly situated, Plaintiff, -v- No. 1:20-CV-6941-LTS-JLC MAJOR MODEL MANAGEMENT, INC., Defendant. -------------------------------------------------------x MEMORANDUM ORDER Plaintiff Stephanie Hoffmann (“Plaintiff”), on behalf of herself and all others similarly situated, brings this putative class action against Major Model Management, Inc. (“MMMI” or “Defendant”), asserting claims of negligence, breach of contract, and breach of fiduciary duty, arising from a data breach of Defendant’s webserver which allegedly resulted in the compromise of Plaintiff’s personally identifiable information (“PII”). The Court has subject matter jurisdiction of this action pursuant to 28 U.S.C. sections 1332 (d) and 1367(a). Now before the Court is Defendant’s motion, pursuant to Federal Rule of Civil Procedure 12(b)(6), to dismiss the Amended Class Action Complaint (docket entry no. 15 (“Am. Compl.”)) for failure to state a claim. (Docket entry no. 23.) The Court has reviewed the parties’ submissions thoroughly, and, for the following reasons, the motion is granted in part and denied in part. BACKGROUND The following facts are taken as true for purposes of this motion practice. On July 30, 2015, Plaintiff, a contract fashion model, entered into an agreement with Defendant, an entity engaged in the business of fashion model management. (Am. Compl. ¶¶ 7, 13-14.) Among other things, the parties’ Agency and Management Agreement (docket entry no. 16-6 (“Mgmt. Ag.”)) designated Defendant as Plaintiff’s attorney-in-fact “to act for her in connection with services to be rendered by MMMI,” including “the copyright, license, use, and publication of Plaintiff’s name, photograph, likeness and voice.” (Am. Compl. ¶¶ 17-18.) In connection with the Management Agreement, Plaintiff executed a one-page “Waiver of Liability and Hold Harmless Agreement.” (Docket entry no. 26-2 at ECF page 10, (“Waiver Ag.”).) In that agreement, Plaintiff agreed: “I hereby Release, Waive, Discharge and Covenant Not To Sue [MMMI], their agents, managers, or employees . . . from any liability claims, demands, actions and causes of action whatsoever.” (Id.) In connection with the Management Agreement, Plaintiff was also “required” to complete and provide to Defendant a Registration Form, containing her “place of birth, date of birth, nationality, permanent address, cell number, email address, social security number, signature, passport number and visa number,” and to attach copies of her social security card and passport. (Am. Compl. ¶ 21.) Defendant then stored that PII, as well as the PII of other models, on its “Apache” webserver. (Id. ¶ 23.) Beginning no later than June 19, 2020, due to a server misconfiguration, the PII Defendant stored on its webserver was readable by “everyone” through the webserver’s directory listing. (Id. ¶¶ 22-30.) August 25, 2021—after remediating the vulnerability two days earlier— MMMI served a notice on Plaintiff (and other models) which read, in relevant part: We at Major Models value your privacy and respect the right to keep your information private, which is why, as a precautionary measure, we are writing to let you know about a data security incident that may involve your personal information. Over this past weekend, from approximately August 22 to August 23, Major Models’ website was hacked in an attack wherein some past and present models contracting information was made accessible to third parties who breached Major Models’ industry leading website security protocols. To our knowledge, this data breach only affected a very small number of models and within hours of being made aware of this issue, Major’s technology and security department rectified the hack and any surrounding issues. (Am. Compl. ¶¶ 31-32.) Plaintiff alleges that the data breach affected “at least 500 current and former fashion models whose PII was made accessible to third parties and the public via the MMMI Website.” (Id. ¶ 33.) Based on alleged harms stemming from the data breach, Plaintiff brings this action on behalf of herself and all others similarly situated, asserting claims of negligence, breach of contract, and breach of fiduciary duty. (Id. ¶¶ 59-104.) DISCUSSION In determining whether a plaintiff has set forth the “short and plain statement of the claim showing that [she is] entitled to relief” required by the Federal Rules (see Fed. R. Civ. P. 8(a)(2)), the Court looks to whether the allegations in the complaint establish the “facial plausibility” of the plaintiff’s claims. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007)). Such a showing “must be enough to raise a right to relief above the speculative level,” requiring “more than labels and conclusions, [or] a formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555 . In deciding a Rule 12(b)(6) motion to dismiss, the Court assumes the truth of the facts asserted in the complaint and draws all reasonable inferences from those facts in favor of the plaintiff. See Harris v. Mills, 572 F.3d 66, 71 (2d Cir. 2009) (citation omitted). In this case, Defendant moves, pursuant to Federal Rule of Procedure 12(b)(6), to dismiss each of Plaintiff’s three causes of action. In opposition, Plaintiff withdraws her claim for breach of contract (see docket entry no. 22 (“Pl. Opp.”) at 14-15)—which the Court will therefore deem withdrawn and voluntarily dismissed—leaving only Plaintiff’s negligence and breach of fiduciary duty claims for consideration in connection with this motion. Defendant presents two arguments as to why Plaintiff’s tort claims should be dismissed. Defendant’s first argument is that Plaintiff waived her right to sue Defendant in tort when she executed the Waiver Agreement. (See docket entry no. 24 (“Def. Mem.”) at 4-5; docket entry no. 29 (“Reply”) at 2-4.) While contractual clauses exculpating a party from its own negligence may be enforceable under New York law in some circumstances, they are subject to “close judicial scrutiny,” and will not be enforced “unless the intention of the parties is expressed in unmistakable language,” i.e., with reference to “negligence” or “words conveying a similar import.” Gross v. Sweet, 49 N.Y.2d 102, 106-08 (1979). See also Oliver v. Cent. Park Sightseeing, LLC, 171 A.D.3d 508 , 508 (1st Dep’t 2019) (“The bicycle rental agreement relied upon by defendant did not reflect a clear and unequivocal intent to limit its liability for its own negligence[.]”); Kalinkina v. Martino Cartier Enters., LLC, No. 16-CV-8331-RWS, 2017 WL 2670751 , at *3 (S.D.N.Y. June 20, 2017) (collecting cases following Gross and explaining that “agreements to release parties from ‘any and all responsibility or liability of any nature whatsoever’ will not bar claims based on ordinary negligence” (citation omitted)). The exculpatory clause in this case is precisely the sort of broad release New York courts have found insufficiently plain and precise to bar a plaintiff’s ordinary negligence claims, see, e.g., Trummer v. Niewisch, 17 A.D.3d 349, 349 (2d Dep’t 2005) (“[T]he broad, sweeping language of the release was not sufficiently clear and specific to relieve them of liability arising from their own negligence.”); Delaney v. City of Mount Vernon, 28 A.D.3d 416, 417 (2d Dep’t 2006) (same), especially where, as here (see Pl. Opp. at 7), the defendant is alleged to be the drafter of the parties’ agreement. Kalinkina, 2017 WL 2670751 , at *4 (“Having found that the necessary ‘plain and precise’ language regarding the Defendants’ exemption of itself from liability for its own negligence is lacking, and because any ambiguities must be resolved against the party who drafted the agreement, the Court concludes that the Release does not preclude this action for ordinary negligence.” (internal citations and editorial marks omitted)). On reply, Defendant relies at length on Lago v. Krollage, 78 N.Y.2d 95 (1991), arguing that in that case, “the court enforced a very broad provision, because it did not violate a public policy and the provision was clear.” (Reply at 2-4.) In Lago, the plaintiff brought a negligence and wrongful death action arising out of the death of the plaintiff’s decedent resulting from injuries sustained by the decedent while working at a stock car racing event. Unlike here, the releases in Lago explicitly provided that the plaintiff would hold the releasees harmless from all causes of action “including negligence . . . from every and any loss damage and injury (including death) that may be sustained by my person,” and therefore did not implicate the doctrine set forth in Gross and its progeny. 78 N.Y.2d at 98-99 . Moreover, the principal question presented in Lago was whether “General Obligations Law § 5-326 render[ed] these releases void as against public policy and wholly unenforceable,” id. at 100; the plaintiff “assert[ed] no basis other than the provisions of” that statute “upon which to deny enforcement” of the releases at issue. Id. at 101. Indeed, Lago reiterated the rule that an exculpatory agreement will relieve a defendant of liability for the defendant’s ordinary negligence only where “the exculpatory agreement expresses in unequivocal terms the intention of the parties” to do so. Id. at 100-01. In this case, the exculpatory clause did not. The Court therefore concludes that the parties’ Waiver Agreement does not bar Plaintiff’s negligence claim in this case.1 1 The parties’ briefs do not address the question whether the doctrine in Gross requires the parties to explicitly refer to claims for breach of fiduciary duty (or words conveying a similar import) in an exculpatory clause in order for that clause to serve as a bar to such claims. However, at least one New York court has extended the rationale in Gross to Defendant’s second argument in favor of dismissal of Plaintiff’s two tort claims is that Plaintiff fails to allege that Defendant owed Plaintiff an “independent” duty, “apart from the terms of the contract.” (Def. Mem. at 5-6 (“Here, the entire relationship between Plaintiff and MMMI is contractual. . . . Plaintiff makes no allegation supporting a duty arising from any source other than the contract.”); Reply at 4-8.) Stated otherwise, Defendant argues that Plaintiff’s tort claims are “but a breach of contract in other clothing.” Banc of Am. Com. Fin. Corp. v. Issacharoff, 188 Misc. 2d 790, 796 (N.Y. Co. Sup. Ct. 2000). In Sommer v. Fed. Signal Corp., 79 N.Y.2d 540, 551 (1992), the New York Court of Appeals identified several “guideposts for separating tort from contract claims”: In North Shore Bottling Co. v Schmidt & Sons ( 22 NY2d 171, 179 ), we recognized that “a contracting party may be charged with a separate tort liability arising from a breach of a duty distinct from, or in addition to, the breach of contract.” A tort may arise from the breach of a legal duty independent of the contract, but merely alleging that the breach of a contract duty arose from a lack of due care will not transform a simple breach of contract into a tort [ ]. A legal duty independent of contractual obligations may be imposed by law as an incident to the parties’ relationship. Professionals, common carriers and bailees, for example, may be subject to tort liability for failure to exercise reasonable care, irrespective of their contractual duties [ ]. In these instances, it is policy, not the parties’ contract, that gives rise to a duty of due care [ ]. In disentangling tort and contract claims, we have also considered the nature of the injury, the manner in which the injury occurred and the claims for legal malpractice, see Swift v. Choe, 242 A.D.2d 188, 194 (1st Dep’t 1998) (“The terms of the release signed by Carl do not unmistakably express that a potential claim for malpractice is being waived. Consequently, the malpractice cause of action was not waived.”), and, under New York law, “[e]xculpatory clauses should be strictly construed against the person seeking exemption from liability.” HealthExtras, Inc. v. SG Cowen Sec. Corp., No. 02-CV-9613-RO, 2004 WL 97699 , at *2 (S.D.N.Y. Jan. 20, 2004). “Given the narrow construction to be given a release,” Berlin v. Jakobson, 137 A.D.3d 659, 660 (1st Dep’t 2016) (rejecting argument that plaintiffs’ fiduciary duty claims were barred by the parties’ releases), the Court concludes that Defendant has not shown its entitlement to judgment in its favor on Plaintiff’s fiduciary duty claim by virtue of the Waiver Agreement. resulting harm [ ]. Thus, where plaintiff is essentially seeking enforcement of the bargain, the action should proceed under a contract theory [ ]. Sommer, 79 N.Y.2d at 551-52 . In this case, it cannot be said that Plaintiff is “essentially seeking enforcement of the bargain,” Sommer, 79 N.Y.2 at 552, given that Plaintiff has withdrawn her breach of contract claim, Defendant itself argues that Plaintiff has not “identif[ied] a single contractual provision alleged to have been breached” (Def. Mem. at 7-8), and the parties’ agreement is silent on the issue of Defendant’s alleged duty to safeguard Plaintiff’s PII.2 Nor is the mere existence of the parties’ contract a bar to the existence of such a duty. Bayerische Landesbank, New York Branch v. Aladdin Cap. Mgmt. LLC, 692 F.3d 42, 58 (2d Cir. 2012) (“Where an independent tort duty is present, a plaintiff may maintain both tort and contract claims arising out of the same allegedly wrongful conduct.”); Regan v. Conway, 768 F. Supp. 2d 401, 411 (E.D.N.Y. 2011) (“Even if the parties are involved in a contractual relationship, there can be a separate and distinct fiduciary relationship. A contractual relationship and a fiduciary relationship can coexist at the same time and between the same parties.”). Moreover, Plaintiff has proffered case law for the proposition that New York law imposes a common law duty upon a contracting party to reasonably protect the confidential personal information provided to that party by its individual counterparty. See Daly v. Metro. Life Ins. Co., 4 Misc. 3d 887, 893 (N.Y. Co. Sup. Ct. 2004) (“this court is convinced that Met Life had a duty to protect the confidential personal information provided by the plaintiffs”) (denying motion for summary judgment on plaintiffs’ negligence claim); Jones v. Com. Bancorp, 2 This distinguishes Defendant’s leading case, Alitalia Linee Aeree Italiane, S.p.A. v. Airline Tariff Pub. Co., 580 F. Supp. 2d 285 (S.D.N.Y. 2008), where the dispute “between sophisticated parties” concerned the defendant’s allegedly negligent performance of obligations called for by the parties’ agreement. Id. at 287 & 293-94. Inc., No. 06-CV-835-HB, 2006 WL 1409492 , at *2 (S.D.N.Y. May 23, 2006) (“[P]laintiff has alleged that she provided certain personal information to Commerce in order to open her account. . . . She has also alleged that Commerce ‘warranted to their customers generally, and to [plaintiff] in particular, that account information would be safeguarded and limited to authorized parties.’ . . . These allegations are sufficient to establish a duty by Commerce to protect plaintiff’s personal information.”) (citing Daly and concluding that plaintiff adequately alleged both negligence and a breach of fiduciary duty); see also Toretto v. Donnelley Fin. Sols., Inc., No. 1:20-CV-2667-GHW, 2022 WL 348412 , at *12 (S.D.N.Y. Feb. 4, 2022) (“Data breach jurisprudence has developed significantly in the last twelve years. Numerous courts applying New York law have denied motions to dismiss negligence claims in data breach cases.”) (collecting cases).3 Defendant contends that Daly is distinguishable, in that the Court in Daly “infer[red] a duty, but [did] so based on defendant’s representations that ‘they took great care in safeguarding their customers’ personal information.’” (Reply at 7.) However, the defendant’s representation in Daly, though “prior to issuance” of the relevant life insurance policy, came “after” the plaintiff completed her application for that policy and agreed to provide her sensitive personal information to Met Life in connection with that application. Daly, 4 Misc. 3d at 888 - 89; see also id. at 893 (“When Ms. Daly wished to purchase a life insurance policy from Met Life, she was required to, and agreed to, supply Met Life with highly sensitive personal 3 See also Daly, 4 Misc. 3d at 892 (“[I]t is well established under New York law that ‘a fiduciary duty arises, even in a commercial transaction, where one party reposed trust and confidence in another who exercises discretionary functions for the party’s benefit or possesses superior expertise on which the party relied’ . . . . While this concept has never before been applied to issues surrounding the protection of confidential personal information, perhaps in the absence of appropriate legislative action, it should.”) (citations omitted). information including her full name, her Social Security number, and her date of birth. Implicit in this agreement was a covenant to safeguard this information. Met Life, in fact, recognized that obligation, and issued a privacy notice to their customers stating that they took great care in safeguarding their customers’ personal information.”) (emphasis added).4 Daly did not limit its holding to cases involving a defendant’s prior warranty about its privacy policies, and Defendant has identified no case law explicitly limiting the common law duty identified in Daly to that circumstance. In light of Daly and the cases following it, the Court concludes that Plaintiff has adequately alleged that Defendant owed Plaintiff a duty independent of the parties’ agreement.5 The Court therefore declines to reach the parties’ dispute regarding whether New York’s Stop Hacks and Improve Electronic Data Security Act separately imposes any such duty upon the Defendant. (See Opp. at 11-14; Reply at 5-6.)6 4 In this case, Plaintiff alleges that Defendant made a similar warranty, albeit after the parties entered into their agreement, in the context of Defendant’s August 25, 2020, notice. (Am. Compl. ¶ 32 (“We at Major Models value your privacy and respect the right to keep your information private . . . . Major Models’ website was hacked in an attack wherein some past and present models[’] contracting information was made accessible to third parties who breached Major Models’ industry leading website security protocols.”).) 5 Defendant’s motion sought dismissal of both of Plaintiff’s tort claims on the basis that Plaintiff failed to allege any duty owed to her by Defendant independent of the parties’ agreement. (Def. Mem. at 5-6.) To the extent Defendant’s motion could be construed to separately seek dismissal of Plaintiff’s breach of fiduciary claim for failure to plausibly allege a fiduciary duty, the Court finds that duty alleged adequately in Plaintiff’s assertion that the attorney-in-fact relationship created by the contract (see Am. Compl. ¶¶ 17, 93-94) imposed on Defendant a “fiduciary duty requiring reasonable care, undivided loyalty, confidentiality, full disclosure, and a duty to account” (id.), and that Plaintiff’s provision of her PII to Defendant resulted in a “power imbalance, which placed Plaintiff [ ] in a position where [her] trust might be abused by MMMI” (id. ¶ 95), in light of Daly and its progeny, as well as the “fiduciary duties that courts have historically imposed on attorneys-in-fact.” In re Est. of Ferrara, 7 N.Y.3d 244, 254 (2006). See also Jones, 2006 WL 1409492 , at *3 (“plaintiff has adequately alleged a breach of fiduciary duty”). 6 On reply, Defendant requests that Plaintiff’s breach of contract claim “be dismissed with CONCLUSION For the reasons discussed above, Defendant MMMI’s motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) is granted to the extent that Plaintiff’s breach of contract claim is deemed withdrawn and dismissed without prejudice, and is otherwise denied. This case remains referred to Magistrate Judge Cott for general pretrial management. This Memorandum Order resolves docket entry no. 23. SO ORDERED. Dated: March 31, 2022 New York, New York /s/ Laura Taylor Swain LAURA TAYLOR SWAIN Chief United States District Judge prejudice, and MMMI be awarded its legal fees,” due to Plaintiff’s refusal to withdraw that claim in connection with Defendant’s pre-motion efforts, made pursuant to Rule A(2)(b)(i) of this Court’s Individual Practices, to resolve informally Defendant’s anticipated motion to dismiss that claim. Defendant identifies no legal authority for the sanctions it requests, and, on these facts, the Court declines to invoke its inherent authority in order to impose them.