Prutsman v. Nonstop Administration and Insurance Services, Inc.

Background

The plaintiffs brought claims against Nonstop arising from an alleged data breach. Nonstop moved to dismiss several counts under the rules governing whether a complaint adequately states a claim. The court ruled on the challenged counts but did not decide the ultimate facts or liability.

Rulings on the challenged claims

- Count III—breach of fiduciary duty: The court dismissed the claim because the plaintiffs’ only supporting allegation was that Nonstop became a fiduciary through its handling and protection of personal and health information. The court found that allegation inadequate and conclusory. - Count VII—privacy claims: In the numbered discussion, the court dismissed the claims for intrusion upon seclusion and invasion of privacy under the California Constitution. It reasoned that the complaint suggested, at most, negligent and passive conduct, rather than the intentional intrusion or serious invasion required for these claims. The court rejected the plaintiffs’ reliance on a different data-breach decision. However, the order’s concluding paragraph says that the motion was denied as to Count VII. The opinion therefore gives conflicting dispositions for Count VII. - Count X—restitution under California’s Unfair Competition Law: The court dismissed the claim because the complaint did not allege profits or improper gains that Nonstop could be required to return. - Count VIII—California Consumer Privacy Act: The court denied dismissal. Although the complaint did little more than repeat the statutory criteria for coverage, the court found that it adequately suggested Nonstop was subject to the Act. The court also rejected Nonstop’s argument that the alleged violations had already been corrected. - Count IX—California Confidentiality of Medical Information Act: The court denied dismissal. The complaint alleged that Nonstop held confidential medical information, that a data breach occurred, and that unauthorized third parties accessed medical treatment and diagnosis information. The court found it plausible that confidential medical information was among the data viewed. - Count XI—California Customer Records Act: The court denied dismissal. The plaintiffs alleged inadequate encryption, insufficient monitoring, inadequate employee training, and a delay between Nonstop’s discovery of the cyberattack and its notification of plaintiffs. The court found these allegations sufficient at the pleading stage, although it described them as not conclusive. - Count VI—Alaska Personal Information Protection Act: The court dismissed the claim after the plaintiffs conceded that the statute did not provide a private right of action. - Counts XII and XIV—Colorado and New York breach-notification statutes: The court dismissed these claims, concluding that the statutes authorized enforcement by the attorney general and did not create private rights of action for the plaintiffs. - Counts V, XIII, and XV—Alaska, Colorado, and New York consumer-protection claims: The court dismissed these claims because the plaintiffs did not allege fraud with the required level of detail.

The order’s final summary states that the motion was granted as to Counts III, V, VI, VII, X, XII, XIII, XIV, and XV, and denied as to Counts VII, IX, and XI. This conflicts with both the numbered ruling dismissing Count VII and the numbered ruling denying dismissal of Count VIII. The court also said discovery could proceed on Counts I, II, and IV, which Nonstop had not challenged, and on the claims it identified as continuing.

Disposition and amendment

The motion to dismiss was granted in part and denied in part. The court did not state that any dismissal was with or without prejudice. It said the plaintiffs could seek permission to amend later if discovery revealed facts supporting dismissed claims. If they chose to amend immediately, they had to file an amended complaint within 21 days of the order, after which Nonstop’s response would be due within 21 days.

Judge

The order was signed by Vince Chhabria, United States District Judge, on August 16, 2023.