Hoffmann v. Major Model Management, Inc.

Background

Stephanie Hoffmann brought a proposed class action against Major Model Management, Inc. (MMMI), asserting negligence, breach of contract, and breach of fiduciary duty based on a data breach. Hoffmann alleged that, under the parties’ management agreement, MMMI required her to provide sensitive personal information, including her Social Security number, passport number, visa number, address, and date of birth, along with copies of her Social Security card and passport.

Hoffmann alleged that MMMI stored this information, along with information belonging to other models, on an Apache webserver. Because of a server misconfiguration, the information was allegedly readable by everyone through the server’s directory listing. Hoffmann alleged that at least 500 current and former models were affected.

Hoffmann had also signed a waiver releasing MMMI and related persons from “any liability claims, demands, actions and causes of action whatsoever.”

Motion and governing standard

MMMI moved under Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not plausibly state a legal claim. In deciding that motion, the court accepted the complaint’s factual allegations as true and drew reasonable inferences for Hoffmann.

In opposition to the motion, Hoffmann withdrew her breach-of-contract claim. The court therefore treated that claim as withdrawn and voluntarily dismissed it.

Waiver of tort claims

MMMI argued that the waiver barred Hoffmann’s negligence and breach-of-fiduciary-duty claims. Applying New York law, the court explained that a provision releasing a party from its own negligence must use unmistakable, plain, and precise language. The court found that the waiver’s broad language did not clearly refer to MMMI’s own negligence and therefore did not bar the negligence claim.

The court also concluded that MMMI had not shown that the waiver barred the breach-of-fiduciary-duty claim. The opinion noted that the parties’ briefs did not address whether a release must expressly refer to fiduciary-duty claims, or similar language, to bar such claims. The court applied New York’s rule that releases are narrowly construed against the party seeking protection from liability.

Independent duty

MMMI also argued that Hoffmann’s tort claims were really contract claims because the parties’ relationship was contractual and Hoffmann had not identified an independent legal duty. The court rejected that argument at the pleading stage. It reasoned that Hoffmann was not seeking simply to enforce a contractual promise, particularly because the agreement was silent about MMMI’s alleged duty to safeguard her personal information.

The court found that Hoffmann had plausibly alleged that New York law imposed a duty independent of the contract to reasonably protect confidential personal information entrusted to MMMI. The court also found that, to the extent MMMI separately challenged the existence of a fiduciary duty, Hoffmann adequately alleged one based on the attorney-in-fact relationship, the alleged power imbalance, and the trust she placed in MMMI.

The court declined to decide whether New York’s Stop Hacks and Improve Electronic Data Security Act independently imposed a duty on MMMI.

Disposition

Judge Laura Taylor Swain granted in part and denied in part MMMI’s Rule 12(b)(6) motion. The breach-of-contract claim was deemed withdrawn and dismissed without prejudice. The motion was otherwise denied, so Hoffmann’s negligence and breach-of-fiduciary-duty claims were not dismissed. The case remained referred to Magistrate Judge Cott for general pretrial management.