On August 21, 2017, the U.S. Court of Appeals for the Eighth Circuit concluded, in Kuhns v. Scottrade, Inc. , No. 16-3426, 2017 WL 3584046, at *1 (8th Cir. Aug. 21, 2017), that although a data breach plaintiff had Article III standing to pursue his contract-related claims, his complaint lacked sufficient factual support to state any claims upon which relief could be granted. Hackers stole the personal identifying information (“PII”) of over 4.6 million customers of Scottrade, Inc. , a securities brokerage firm. Matthew Kuhns and three others affected by the hack initiated putative class actions against Scottrade. The plaintiffs contended, among other things, that because the hack occurred, Scottrade violated its contractual obligation to keep its PII secure. Eventually, the actions were consolidated, and the plaintiffs filed a consolidated class action complaint that alleged, among other things, breach of contract, breach of implied contract, and unjust enrichment.
The district court determined that the plaintiffs lacked Article III standing because they had not suffered an injury-in-fact. Because the plaintiffs lacked Article III standing, the district court dismissed the consolidated complaint, with prejudice, for lack of subject matter jurisdiction. Kuhns, but not the other plaintiffs, appealed the district court’s decision.
On appeal, Kuhns challenged the district court’s standing determination. He argued that part of his bargain with Scottrade was that the company would protect his PII. When Scottrade allegedly failed to protect Kuhns’ PII—by not preventing the data breach—he received services that were less valuable than the ones he had bargained for with Scottrade. According to Kuhns, the difference in value between the services he had bargained for and the ones he received was an injury-in-fact.
The Eighth Circuit agreed with Kuhns’ standing argument with regard to his contract-related claims. According to the circuit court, a party to an allegedly breached contract has a judicially cognizable interest for the purposes of Article III standing, regardless of the merits of the alleged breach. The Eighth Circuit, therefore, concluded that Kuhns had Article III standing to pursue his contract-related claims, regardless of how strong they were on the merits.
Although Kuhns cleared the Article III standing hurdle, the Eighth Circuit concluded that the consolidated complaint failed to state any claims upon which relief could be granted. The circuit court decided that the consolidated complaint could not survive Rule 12(b) for a variety of reasons, but two are especially noteworthy.
First, although the Eighth Circuit concluded that Kuhns had satisfied Article III’s injury-in-fact requirement, he failed to allege actual damage, which is a requirement of a breach of contract claim. Kuhns did not contest Scottrade’s contention that between the more than two years between the data breach and the filing of the consolidated complaint, not one customer affected by the data breach had suffered financial loss because their PII was stolen. According to the circuit court, “[m]assive class action litigation should be based on more than allegations of worry and inconvenience.”
Second, Kuhns did not sufficiently explain how Scottrade failed to satisfy whatever obligations it had to protect his PII. According to the Eighth Circuit, Kuhns’ “implied premise that because data was hacked Scottrade’s protections must have been inadequate” was a “naked assertion devoid of further factual enhancement” that could not “survive a motion to dismiss.” For those reasons, among others, the Eighth Circuit affirmed the district court’s dismissal of the consolidated complaint.
A copy of the Kuhns v. Scottrade decision is available here.
