Wynne v. Audi of America

Background

Amy Wynne filed a proposed class action in Marin County Superior Court concerning the theft of personal information in a data breach. She later amended her complaint to add Audi of America, LLC; Sanctus LLC doing business as Shift Digital; Shift Digital, LLC; and Volkswagen Group of America, Inc. Wynne later dismissed Shift Digital, LLC from the lawsuit.

Wynne alleged that, sometime between August 2019 and May 2021, the defendants were targeted in a data breach and her personally identifiable information was accessed and compromised. The information allegedly included names, addresses, email addresses, driver’s license numbers, Social Security numbers, dates of birth, account and loan numbers, and tax identification numbers. She alleged that the defendants failed to use reasonable security procedures and that she and the proposed class faced an ongoing risk of identity theft-related harm.

Wynne asserted claims under California’s Unfair Competition Law and California Consumer Privacy Act. She sought statutory damages, injunctive and equitable relief, and attorney’s fees and costs.

Removal and Motion to Remand

Sanctus LLC doing business as Shift Digital removed the case to federal court under the Class Action Fairness Act, which can provide federal jurisdiction over certain proposed class actions. Wynne moved to remand, meaning she asked the federal court to return the case to state court. She argued that the federal court lacked subject-matter jurisdiction because she had not alleged a concrete injury sufficient for standing under Article III of the Constitution.

The removing defendant had the burden of showing that removal was proper. The court explained that Article III standing requires an injury in fact that is concrete and particularized, fairly traceable to the defendant’s conduct, and likely to be redressed by a favorable decision. The parties disputed only whether Wynne alleged a concrete injury; causation and redressability were not at issue.

Court’s Analysis

The court discussed Supreme Court decisions holding that a statutory violation alone does not necessarily create a concrete injury. A plaintiff cannot rely only on a bare procedural violation or a risk of future harm that has not materialized, at least in a damages action, unless the risk itself causes a separate concrete harm.

The removing defendant argued that Wynne had standing because the California Consumer Privacy Act protects a substantive privacy right and because she alleged an increased risk of identity theft or fraud and expenses for credit monitoring. The court rejected the argument that a statutory violation alone automatically establishes standing. But it concluded that the alleged theft and disclosure of Wynne’s sensitive personal information invaded her privacy. The court found that this injury was closely related to the traditionally recognized harm of disclosure of private information and therefore was concrete under Article III.

The court distinguished another data-breach case involving less sensitive information, including email addresses, phone numbers, usernames, dates of birth, and gaming-account passwords. In this case, the alleged information included Social Security numbers, driver’s license numbers, account and loan numbers, tax identification numbers, and other sensitive information. Because the court found that the alleged privacy violation itself was a concrete harm, it did not decide whether the alleged increased risk of identity theft or the credit-monitoring expenses were independently concrete injuries.

Disposition

The court concluded that Wynne had alleged a concrete injury and that the federal court had subject-matter jurisdiction. It denied Wynne’s motion to remand. The opinion addressed the federal court’s jurisdiction over the removed case, not the ultimate merits of Wynne’s California statutory claims.