Massachusetts Court Dismisses Lawsuit Alleging Failure to Adequately Safeguard Personal Information — Katz v. Pershing

[Post by Venkat Balasubramani]

Katz v. Pershing, LLC, 10-12227-RGS (D. Mass. Aug 23, 2011)

Background: Katz maintained an account at National Planning Corporation, an “introducing firm” for which Pershing provides brokerage clearing services. Pershing’s services are provided on a proprietary exchange known as “NetExchange Pro,” and this platform allows firms and their customers to access account information, stock quotes, etc. Katz alleged that up to 100,000 users have electronic access to customers’ non-public personal information, including social security numbers, taxpayer identification numbers, and bank account numbers. Katz alleged that the security deficiencies rendered this information susceptible to being compromised. She claimed that NPC paid Pershing fees to protect the data and these fees were passed on by NPC to Katz and other putative class members.

She filed a lawsuit bringing claims under the Massachusetts deceptive trade practices statute, breach of contract, negligence, and unjust enrichment. Pershing initially moved to dismiss and the court granted the motion before Katz had an opportunity to respond. Katz filed a motion to reconsider. On reconsideration, the court dismisses the case.

Discussion: The court dismisses the based on standing (lack or jurisdiction) and on the merits.

Standing: Pershing argued that Katz did not allege that any of her protected data was actually compromised. The court agrees, noting that several cases have dismissed data loss claims on Article III standing grounds, finding that the increased risk of identity theft is insufficient to create standing. Katz argued that her claims were distinguishable from the other increased risk cases because she brought claims under Massachusetts statutes and for breach of contract.

Massachusetts Data breach statute: The court pointed out that Katz’s claims under the Massachusetts unfair trade practices statute needed a statutory predicate–some statute or policy which was enacted for the benefit of the public which the defendant failed to comply with. Katz argued that here, Pershing failed to comply with Massachusetts’ data breach statute, which was enacted in the wake of the well-publicized TJX data breach. The court rejects this argument, finding that the data breach statute defines a “breach of security” to include an “unauthorized acquisition or unauthorized use” of encrypted data. While breaches that create a substantial risk of identity theft trigger the statute, there must be a breach in the first place, and there was none alleged by Katz here. There was a second problem with Katz’s argument. The Massachusetts data breach statute does not provide for a private cause of action. The statute is intended to be enforced by the attorney general. Therefore, Katz’s claim of unfair trade practice based on a violation of the Massachusetts data breach statute fails.

Breach of contract claim: The court rejects Katz’s breach of contract claim because it is based on the agreement between NPC and Pershing, and Katz argued that she was an intended third party beneficiary to this agreement. The court pointed to language in the NPC-Pershing agreement which states that the agreement was “not intended to confer any benefits on third-parties including, but not limited to, customers of [NPC].” Katz argued that the contract was superseded by marketing representations made by Pershing, but the NPC-Pershing agreement contained an integration clause, and Katz could not introduce additional terms to vary the agreement. The court also rejects Katz’s implied contract claim because it was not supported by valid consideration. If, as Katz alleged, Pershing promised to NPC to safeguard Katz’s personal information, “any alleged promise to Katz to do the same would not amount to valid consideration.”

Unjust enrichment: The court also rejects Katz’s claim for unjust enrichment on the basis that Katz did not allege that she conferred a specific benefit on Pershing or that Pershing was ever aware of this benefit.

__

Courts have rejected claims from data breach plaintiffs where the plaintiffs have not suffered any out of pocket loss. Here, the plaintiff sued before the breach even occurred, and the court rejects the claims. Out of necessity, plaintiffs have gotten creative and tried every angle imaginable, but so far they have had no luck.

As in the Ikon Solutions case, the plaintiff in this case tried to rely on the data breach statute but the court found that it was inapplicable. To my knowledge, no state has enacted a data breach statute which provides for a private cause of action or damages. The Massachusetts statute primarily requires notification of an alleged breach. The court’s two conclusions with respect to the data breach statute are not surprising, but they are significant.

Related posts:

Starbucks Data Breach Plaintiffs Rebuffed by Ninth Circuit

9th Circuit Affirms Rejection of Data Breach Claims Against Gap

The [Non]enforceability of Privacy Promises

Acxiom Not Liable for Security Breach

When Does a Privacy Policy Breach Support a Breach of Contract Claim?

Ikon Office Solutions Had no Duty to Disclose That Office Equipment Retained Data