George D. v. NCS Pearson, Inc.

Background

George D. sued NCS Pearson, Inc. and Pearson Education, Inc., doing business as Pearson Clinical Assessment, after a cyberattack involving the AIMSweb educational assessment platform. The attack had occurred in November 2018, and the Federal Bureau of Investigation notified the defendants in March 2019. The attack allowed an unknown person or entity to access some 13,000 school and university accounts. The accessed information may have included students’ names, birthdates, and email addresses.

George D. alleged that information belonging to his minor child, G.D., was among the data stolen. He asserted claims for negligence, breach of express and implied contract, intrusion upon seclusion, and violation of the Georgia Fair Business Practices Act. He brought the claims on behalf of himself, G.D., and a proposed class of similarly situated people.

Standing Analysis

The defendants moved to dismiss on several grounds, including lack of standing, lack of personal jurisdiction over Pearson Education, Inc., and failure to state a claim. They also sought to strike the proposed nationwide and Georgia classes.

The court focused on standing, which is the requirement that a plaintiff show a concrete injury connected to the defendant’s conduct and capable of being addressed by the requested relief. The court considered George D.’s allegations of stolen personal information, invasion of privacy, reduced value of personal information, increased risk of identity theft, and time and costs spent protecting against identity theft.

The court found that the alleged present injuries were not adequately pleaded. It also concluded that the complaint did not establish a current injury or a sufficiently substantial risk of future identity theft. The court relied on binding Eighth Circuit precedent holding that generalized allegations and reports about possible future misuse of stolen information were insufficient. The court noted that the complaint did not specifically establish that G.D.’s birthdate had been stolen and concluded that, even if it had been stolen, a birthdate alone did not create a substantial risk of identity theft.

The court further held that time and costs spent protecting against identity theft could not create standing when the alleged future identity theft itself was only speculative. Because the court concluded that George D. lacked standing, it granted the defendants’ motion to dismiss for lack of standing.

Disposition

The court granted the defendants’ motion to dismiss for lack of standing. It dismissed George D.’s amended complaint without prejudice, meaning the complaint was dismissed in a manner that did not bar refiling. The court also denied the intervenor plaintiff’s motion to intervene as moot. The opinion does not state a ruling on the defendants’ other asserted grounds for dismissal or their requests to strike the proposed classes.