Mulkey v. RoundPoint Mortgage Servicing Corporation

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF OHIO EASTERN DIVISION CHAD T. MULKEY, et al., ) Case No. 1:21 CV 01058 ) ) Plaintiffs, ) JUDGE DONALD C. NUGENT ) VS. ) ) MEMORANDUM OPINION ) AND ORDER ROUNDPOINT MORTGAGE ) SERVICING CORPORATION, ) ) Defendant. ) This matter is before the Court on the Motion of Defendant Roundpoint Mortgage Servicing Corporation (“RoundPoint”) to Dismiss Plaintiffs’ Complaint pursuant to Fed. R. Civ. P. 12(c). (ECF #10). Plaintiffs have filed a brief in opposition and Defendant has filed a reply brief in support. (ECF # 17, 18). For the reasons that follow Defendant’s Motion to Dismiss is GRANTED in part and DENIED in part. Factual and Procedural History On May 22, 2018, Plaintiffs executed a mortgage with NVR Mortgage Finance, Inc. for the property located at 5573 Coverdale Way, Medina, OH 44256. The mortgage granted NVR Mortgage Finance, Inc., its successors and assigns, a security interest in the property. Roundpoint On or about February 20, 2021, Plaintiffs received a notice from Roundpoint dated February 19, 2021, informing them that on November 24, 2020, a payoff quote intended for them was faxed to unauthorized third parties. (ECF #1, J 22). According to the notice, the information contained in the payoff quote includes Plaintiffs’ full names, loan numbers, property and mailing addresses, as well as loan financial information. (ECF #1, { 24). Plaintiffs allege that in addition to the information stated in the notice, Plaintiffs’ social security numbers, phone numbers, tax ID numbers, date of birth, and/or financial account information was also shared. (ECF #1, § 36). As a result of the breach of information, Plaintiffs allege they have suffered emotional distress from the consistent fear and anxiety of the release of their personal information. (ECF #1, { 14). On April 15, 2021 Plaintiffs filed a class action lawsuit against Defendant asserting six causes of action: (1) Negligence, (2) Negligent Entrustment, (3) Bailment, (4) Breach of Implied Contract, (5) Violations of the Ohio Residential Mortgage Loan Act (RMLA), and (6) Invasion of Privacy. (ECF # 1). On July 9, 2021, Defendant filed a Motion to Dismiss the Complaint pursuant to Fed. R. Civ. P. 12(c). (ECF # 10). Plaintiffs filed a brief in opposition indicating they would dismiss Counts 2 and 3, and Defendant filed a reply brief. (ECF # 17, 18). ' Standard of Review The standard of review used by a district court to rule on a motion for judgment on the pleadings pursuant to Fed. R. Civ. P. 12(c) is the same as the standard used to rule on Rule 12(b)(6) motions. See Grindstaff v. Green, 133 F.3d 416, 421 (6th Cir. Tenn. 1998). A motion to dismiss under Federal Rule of Civil Procedure 12(b)(6) allows a defendant to test the legal sufficiency of a complaint without being subject to discovery. See Yuhasz v. Brush Wellman, Inc., 341 F.3d 559, 566 (6" Cir. Ohio 2003). In evaluating a motion to dismiss, the court must 1. Accordingly, with Plintifs’ consent, Defendant’s motion to dismiss is granted as to Counts 2 and 3 of aintiffe? Camnlaint construe the complaint in the light most favorable to the plaintiff, accept its factual allegations as true, and draw reasonable inferences in favorable of the plaintiff. See Directv, Inc. v. Treesh, 487 F.3d 471, 476 (6" Cir. Ky. 2007). The court will not, however, accept conclusions of law or unwarranted inferences cast in the form of factual allegations. See Gregory v. Shelby County, 220 F.3d 433, 446 (6" Cir. Tenn. 2000). In order to survive a motion to dismiss, a complaint must provide the grounds of the entitlement to relief, which requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action. See Bell Atl. Corp. v. Twombly, 127 S. Ct. 1955, 1964-65 (2007). That is, “[flactual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Jd. (internal citation omitted); see Association of Cleveland Fire Fighters v. City of Cleveland, No. 06-3823, 2007 WL 2768285 , at *2 □□□ Cir. Ohio Sept. 25, 2007) (recognizing that the Supreme Court “disavowed the oft-quoted Rule 12(b)(6) standard of Conley v. Gibson, 355 U.S. 41, 45-46 , 78 S. Ct. 99 , 2 L. Ed.2d 80 (1957)”). Accordingly, the claims set forth in a complaint must be plausible, rather than conceivable. See Twombly, 127 S. Ct. at 1974 . On a motion brought under Rule 12(b)(6), the court’s inquiry is limited to the content of the complaint, although matters of public record, orders, items appearing in the record of the case, and exhibits attached to the complaint may also be taken into account. See Amini v. Oberlin College, 259 F.3d 493, 502 (6™ Cir. Ohio 2001). Discussion Defendant asserts Plaintiffs’ Complaint should be dismissed for three reasons: (1) the information disclosed by defendant is not considered personal identifying information; (2) Plaintiffs’ tort claims are barred by the Economic-Loss Doctrine; and (3) Plaintiffs fail to plead a claim for which relief can be granted. 1. Plaintiffs’ Successfully Allege PII Dislcosure Plaintiffs’ Complaint alleges that Defendant revealed sensitive personal identifying information (PII). (ECF #1, § 4). Specifically, the Complaint alleges that Plaintiffs’ “names, social security numbers, residential addresses, phone numbers, tax ID numbers, date of births, and/or financial account information was disclosed to unknown persons.” (ECF #1, § 36). Defendant does not deny that information was disclosed, rather it denies that any PII was released. Defendant contends that the only information revealed in the disclosure were Plaintiffs’ names, address, loan number, and their current loan balance. According to Defendant, this does not constitute PII. Ohio law does not clearly define PII; instead, the definition varies statute by statute depending on the area of interest. See Ohio Rev. Code Ann. § 2913.49 (A); Ohio Rev. Code Ann. § 149.45 (A); Ohio Rev. Code Ann. § 1349.19 (7)(A). What is undisputed between these statutes is that information including an individual’s social security may be considered PIL. Defendant does not contend that a social security number is not PI. Plaintiffs’ Complaint alleges that Defendant’s disclosure included Plaintiffs’ social security number. (ECF #1, § 36). Under the applicable standard of review of a motion to dismiss and in construing a Complaint in light most favorable to the Plaintiffs, the Court accepts such factual allegations as true. As such, Plaintiffs have adequately pled that Defemdant shared their PIT with unauthorized parties. 2. Economic Loss Doctrine Defendant argues that Plaintiffs’ tort claims are barred by the economic loss doctrine. Specifically, Defendant states that Plaintiffs’ claims of non-of-economic loss are speculative and unsupported by documentary evidence. Plaintiffs reject Defendant’s arguments contending that they have alleged both economic and non economic losses. Plaintiffs have alleged: (1) loss of time and money based on the time and money that Plaintiffs must expend to monitor their credit and accounts; and (2) emotional distress. Under Ohio law, the economic loss rule prevents recovery of tort damages for purely economic loss. Chemtrol Adhesives, Inc. v. AM. Mfrs. Mut. Ins. Co. (1989), 42 Ohio St.3d 40, 45 , 537 N.E.2d 624 . Tort law is not meant to compensate parties for losses suffered through a breach of duties within an agreement, but rather this form of relief falls under the law of contracts. Corporex Dev. & Constr. Mgt., Inc. v. Shook, Inc., 2005-Ohio-5409 , { 6, 106 Ohio St. 3d 412, 414 , 835 N.E.2d 701 , 704, quoting Floor Craft, 54 Ohio St.3d at 7, 560 N.E.2d 206 . While Plaintiffs’ claims of non-economic damages may not survive summary judgment, the Court is unable to evaluate the legitimacy of Plaintiffs’ non-economic damage claims at this point in the proceedings. Defendant’s position that Plaintiffs’ allegations of noneconomic loss are too speculative to withstand dismissal because they are not supported by documentary evidence is premature. So long as the allegations raise a right to relief above a speculative level, the Court must deny a motion to dismiss. Bell Atl. Corp., 127 8. Ct. 1955. Here, Plaintiffs’ allegation of non-economic damages are plausible. 3. The Complaint Provides Sufficient Facts to State a Claim for Which Relief May be Granted T actly Defendant states that even if PIL was involved, Plaintiffs' claims fail to provide sufficient grounds for relief to be granted. A. Negligence . Defendant first asserts that Plaintiffs fail to state a claim of negligence. Specifically, Defendant states they owe no duty to protect and safeguard Plaintiffs’ PII and Plaintiffs fail to show proximate cause and damages. To establish a claim of negligence, a plaintiff must show (1) a duty of care, (2) a breach of that duty, and (3) an injury proximately resulting therefrom. Armstrong v. Best Buy Co., Inc., 788 N.E.2d 1088, 1090 (Ohio 2003). Under Ohio law, the "general ‘common-law duty of care is that degree of care which an ordinarily reasonable and prudent person exercises, or is accustomed to exercising, under the same or similar circumstances." In short, "[a] person is to exercise that care necessary to avoid injury to others." Mowry v. United States, No. 5:19-CV-00627, 2021 WL 1857132 , at *1 (N.D. Ohio May 10, 2021) citing Mussivand v. David, 45 Ohio St.3d 314, 318-19 , 544 N.E.2d 265 (1989). Here, Plaintiffs allege a duty exists between them and Defendant to safeguard their PIL. (ECF #1, 65). Plaintiffs assert Defendant violated that duty by voluntarily faxing Plaintiffs PII to unknown third parties, failing to exercise necessary care. (ECF #1, 71). Lastly, Plaintiffs state they were injured by Defendant's actions. (ECF #1, 73). While Ohio law does not explicitly impose a duty to protect PII on businesses that collect such information, it does provide a safe harbor statute. Under Ohio law, an affirmative defense exists for businesses against breach of data tort claims when they create certain protections for stored data, specifically PII. Ohio Rev. Code Ann. § 1354.01 (West). Therefore, the fact that a statute provides a statutory defense against breach of data implies that the law also presumes that such covered businesses have a duty to protect such data. Accordingly, Plaintiffs’ argument that Defendant owed them a duty to keep their PII safe is plausible. Defendant also asserts that Plaintiffs have failed to allege facts supporting proximate causation. "Proximate cause is an act or failure to act which, in a natural and continuous sequence, directly produces the injury and without which it would not have occurred." Brott Mardis & Co. v. Camp, 147 Ohio App.3d 71, 75 , 768 N.E.2d 1191 (2001). "A party's negligence is a proximate cause of an injury if the injury is a natural and foreseeable result of the party's act or failure to act." Wheeler v. Estes Exp. Lines, 53 F. Supp. 3d 1032, 1040 (N.D. Ohio 2014). Here, Plaintiffs allege that by faxing PI to unauthorized third parties, Defendant's actions were the proximate cause for their injury. (ECF #1, 72). Defendant contends that the information faxed was not PII. However, as noted above, Plaintiffs’ Complaint asserts that the information faxed included Plaintiffs’ PIL, specifically, their social security number. If PI. was sent and certain harm or damages were a result, then Plaintiffs would have sufficient grounds to demonstrate proximate cause. A dismissal of Plaintiffs’ Complaint at this stage would be premature. Defendant asserts that Plaintiffs fail sufficiently to plead damages in support of their claim. Specifically, Defendant argues that Plaintiffs fail to show that actual injury has occurred, merely that they might be harmed in the future. However, Plaintiffs’ Complaint alleges that Plaintiffs have experienced emotional distress and will continue to experience emotional distress and lost time from their need to continually monitor their credit and accounts. (ECF #1, 73). The Complaint alleges facts sufficient to a plausible claim of negligence. B. Breach of Implied Contract Defendant asserts no implied contract exists between Plaintiffs and Defendant. (ECF #10, 18). Plaintiffs' Complaint asserts an implied contract was created between the parties which provides that Defendant would safeguard and protect Plaintiffs’ information, including their PIL, in exchange for providing services to Plaintiffs. (ECF #1, 89). Plaintiffs state they fulfilled the contract by providing Defendant with their personal information and Defendant breached the agreement by disclosing the personal information. (ECF #1, 96). However, Defendant alleges there is an express contract between the parties and Plaintiffs should not be entitled to relief under a breach of implied contract claim. Id. Here, Defendant provides evidence of an express contract through a note and mortgage agreement between NVR Mortgage Finance, Inc. and Plaintiffs. Defendant does not appear to be a party to the note or mortgage agreement. Since Defendant is not one of the parties to the express contract, the note and mortgage would not be a bar to an implied contract claim. However, even if Defendant were a party to the agreement, courts have recognized the existence of implied duties not implicitly stated in an agreement such as the implied duty of good faith and fair dealing. Whether such an implied duty exists requiring Defendant to protect Plaintiffs' PII is an issue the Court cannot determine at this time. C. RMLA Defendant also argues that Plaintiffs fail to state a claim for relief under the Ohio Residential Mortgage Lending Act (RMLA). (ECF #10). Specifically, Defendant contends that Plaintiffs fail to allege a violation of RMLA or plead damages in support of a RMLA violation. RMLA states that an entity covered under the act cannot make false or misleading statements of material facts or false promises regarding a material fact. Ohio Rev. Code Ann. § 1322.40 (B). Additionally, the statute states an entity cannot "engage in conduct that constitutes improper, fraudulent, or dishonest dealings." Ohio Rev. Code Ann. § 1322.40 (C). To succeed on a RMLA claim, Plaintiff must show they were injured by the violation. Ohio Rev. Code Ann. § 1322.52 (A)(1). Plaintiffs allege in their Complaint that Defendant violated the Act by engaging in improper, fraudulent, and dishonest dealings. (ECF #1, 106). Specifically, Plaintiffs state Defendant failed to take reasonable care in protecting Plaintiffs’ PII, delayed the notification of unauthorized PII disclosure, and did not disclose to Plaintiffs the full range of information compromised. (ECF #1, 109). While Defendant denies these allegations and states they made no false or misleading statements, such defenses may be raised in a summary judgment motion. At this point in time, Plaintiffs Complaint alleges a plausible cause of action under RMLA. 4. Intrusion Upon Plaintiffs’ Seclusion or Privacy Finally, Defendant argues that Plaintiffs fail to establish they are entitled to relief for intrusion of their seclusion and privacy. Under Ohio law, an intrusion into seclusion claim occurs when " '[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Lazette vy. Kulmatycki, 949 F. Supp. 2d 748, 760 (N.D. Ohio 2013). To establish wrongful intrusion, a plaintiff must show they had a reasonable expectation of privacy in the area allegedly intruded. Id. Here, Plaintiffs assert in their Complaint they had an expectation of privacy when they provided Defendant their PII and that expectation was intruded when Defendants disclosed their data. (ECF #1, 115). Defendant denies there was an intrusion of privacy because no PII was ever released. Defendant asserts only public information was released and Plaintiffs’ privacy was not intruded by the disclosure of public knowledge. As discussed above, Plaintiffs have alleged that information, including their social security numbers were disclosed by Defendant. Defendant's denial that Plaintiffs’ social security numbers were disclosed cannot be established on a motion to dismiss. Relying on the facts alleged in Plaintiffs' Complaint, an intrusion upon seclusion claim is plausible and will not be dismissed at this juncture. Conclusion For the reasons stated above, Roundpoint's Motion to Dismiss Plaintiffs’ Complaint (ECF #10) is GRANTED as to Counts 2 and 3 (Negligent Entrustment and Bailment) and DENIED as to Counts 1,4,5 and 6 (Negligence, Breach of Implied Contract, RMLA Violation, and Intrusion or Invasion Upon Plaintiffs’ Seclusion or Privacy). IT IS SO ORDERED DONALD C.NUGENP, Senior United States Ristrict Judge DATE: hls hOke