NEVILLE MCFARLANE v. USA

Background

This putative class action arose from a November 2019 phishing attack against Altice USA, Inc. Criminals obtained access to employee email accounts. One downloaded mailbox contained a password-protected but unencrypted document listing the names, employment information, birth dates, Social Security numbers, and, in some cases, driver’s-license numbers of 52,846 current and former Altice employees. Altice sent breach notices and offered one year of identity and credit monitoring.

The nine named plaintiffs were current or former employees of Altice or related companies. All alleged that they had spent time responding to the breach and expected continuing costs and efforts to monitor their identities and credit. Neville McFarlane, Shariq Mehfooz, and Steven Paniccia alleged that identity thieves used their information to open fraudulent credit cards; McFarlane also alleged an attempted address change. The plaintiffs asserted negligence, negligence per se, New York Labor Law claims, Cable Communications Act claims, breach of implied contract, and requests for declaratory and injunctive relief.

Altice filed three relevant motions: a motion under Rule 12(b)(1) to dismiss for lack of subject-matter jurisdiction based on lack of Article III standing; a motion under the Federal Arbitration Act to compel seven plaintiffs to arbitrate; and a motion under Rule 12(b)(6) to dismiss the New York Labor Law, related negligence per se, and implied-contract claims.

Standing

The court denied Altice’s motion to dismiss for lack of standing. Article III standing requires an injury in fact, a connection between the injury and the defendant’s conduct, and a likelihood that a favorable decision would remedy the injury. The court held that all nine plaintiffs plausibly alleged an injury in fact. Three alleged actual identity theft, while the other six plausibly alleged a substantial risk of future identity theft because criminals had accessed their Social Security numbers and other identifying information.

The court also held that the plaintiffs adequately connected their alleged injuries to Altice’s failure to protect their information. Potential damages for reasonable costs incurred to mitigate or avoid future identity theft could provide a remedy. The court therefore concluded that the plaintiffs met their burden to establish Article III standing.

Arbitration

Altice sought to compel seven plaintiffs to arbitrate under arbitration provisions in the general terms and conditions for Altice cable service, rather than under employment agreements. The provision stated that it covered all disputes between a subscriber and Altice and related entities, including disputes arising before or after the agreement and disputes unrelated to the cable services.

The court held that, under New York law, the provision could not be applied to claims lacking a connection to the cable-service agreement. The court reached that conclusion both as a matter of contract formation and, alternatively, because enforcing the provision literally against unrelated claims would be unconscionable—that is, grossly unreasonable and unenforceable under generally applicable contract law.

The court did not finally grant or deny the motion to compel arbitration. The plaintiffs’ complaint suggested that some claims were brought by cable subscribers, while their opposition stated that the claims arose from their employment and not their cable service. The court deferred judgment and gave the plaintiffs twenty-one days either to amend the complaint to clarify that position and submit a supporting memorandum, or to submit a supplemental memorandum addressing whether and to what extent the claims were subject to arbitration. Altice was permitted to respond, and its deadline to answer was extended until three weeks after resolution of the arbitration motion.

New York Labor Law and Negligence Per Se

The court granted Altice’s motion to dismiss the direct New York Labor Law claims and the related negligence per se claims. The plaintiffs relied on provisions prohibiting employers from placing Social Security numbers in files with unrestricted access or communicating employees’ identifying information to the general public.

The court held that the first theory failed because the stolen document was password-protected and therefore was not a file with unrestricted access. The second theory failed because Altice did not communicate the information to anyone; criminals stole it after obtaining access through the phishing attack. The court declined to grant leave to amend these claims because it viewed their defects as substantive and amendment as futile.

Implied Contract

The court denied Altice’s motion to dismiss the breach-of-implied-contract claim. An implied-in-fact contract is an agreement inferred from the parties’ conduct rather than formally stated. The plaintiffs alleged that providing their personal information as a condition of employment created an implied agreement requiring Altice to protect that information using reasonable industry standards.

The plaintiffs also identified alleged failures supporting the claim, including inadequate email filtering and cybersecurity training, failure to encrypt the stolen document, and retention of former employees’ information. The court held that these allegations plausibly stated a claim that Altice breached an implied contract.

Disposition

The court denied Altice’s motion to dismiss for lack of subject-matter jurisdiction. It granted Altice’s motion to dismiss the New York Labor Law and related negligence per se claims, denied that motion as to the breach-of-implied-contract claim, and deferred judgment on the motion to compel arbitration pending supplemental submissions. The court directed the clerk to terminate the two motion entries identified in the order.