IN RE: GE/CBPS DATA BREACH LITIGATION

Background

A breach of an email account maintained by Canon Business Process Services, Inc. allegedly allowed an unauthorized third party to access personally identifiable information belonging to current and former General Electric Company employees and their beneficiaries. Fowler, a former GE employee, sued GE and Canon on behalf of himself and proposed classes of similarly situated people. He alleged that the breach caused or threatened identity theft, fraud, loss of confidentiality, mitigation expenses, and other harm.

Fowler’s complaint asserted claims for negligence, negligence per se, breach of express contract, breach of implied contract, violation of New York General Business Law Section 349, and breach of fiduciary duty. The defendants moved to dismiss for lack of subject-matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a legally sufficient claim under Rule 12(b)(6).

Standing

The court denied the defendants’ Rule 12(b)(1) motion. It held that Fowler had adequately shown Article III standing, which requires a concrete injury caused by the defendants and likely to be remedied by the requested relief.

The court relied on allegations that the breach resulted from a phishing attack, which was a targeted attempt to obtain the data; that some exposed data had allegedly been misused, including through phishing and scam communications and alleged harm to other proposed class members; and that Fowler’s exposed name, addresses, telephone number, email address, and employee identification number could be used to facilitate identity theft or fraud. The court also found that causation and redressability were adequately alleged.

Rule 12(b)(6) Claims

The court granted in part and denied in part the defendants’ Rule 12(b)(6) motion.

Claims allowed to proceed

The court denied the motion as to negligence. Applying New York law, it found that Fowler plausibly alleged that GE and Canon owed a duty to use reasonable care to safeguard employees’ personal information, breached that duty by failing to use appropriate data-security measures, and caused cognizable damages, including mitigation expenses, time spent responding to the breach, economic harm, and the threat of identity theft and fraud.

The court also denied the motion as to breach of implied contract. It found that GE’s policies and representations, together with the requirement that employees provide personal information as a condition of employment, plausibly supported an implied promise to protect that information. Fowler also adequately alleged performance, breach, and damages.

Claims dismissed

The court granted the motion as to negligence per se. Fowler based that claim on Section 5 of the Federal Trade Commission Act, but the court held that the Act gives enforcement authority to the Federal Trade Commission and does not create a private right of action. Allowing the claim to proceed would therefore conflict with the statutory scheme.

The court granted the motion as to breach of express contract. It concluded that GE’s policy documents lacked the usual features of an express contract and were insufficient to establish a written agreement to safeguard Fowler’s information.

The court granted the motion as to the New York General Business Law Section 349 claim. Fowler did not identify where the alleged deceptive conduct occurred, so he did not adequately show the required connection between that conduct and New York. The court therefore did not address the claim’s other requirements, including consumer-oriented conduct and injury.

The court granted the motion as to breach of fiduciary duty because the claim duplicated the implied-contract claim. The allegations supporting both claims were materially identical, and the court treated the fiduciary-duty claim as a restatement of the alleged contractual obligations.

Disposition

The court denied the Rule 12(b)(1) motion. It granted in part and denied in part the Rule 12(b)(6) motion: negligence and breach of implied contract remained, while negligence per se, breach of express contract, violation of New York General Business Law Section 349, and breach of fiduciary duty were dismissed. The court also denied Fowler’s request for leave to amend because he did not explain how he would correct the dismissed claims. The defendants were ordered to file a responsive pleading by August 27, 2021, and the parties were ordered to submit a proposed case-management plan by September 3, 2021.