RAUHALA v. GREATER NEW YORK MUTUAL INSURANCE, INC.

Background

Ritva Rauhala filed a proposed class action in Pennsylvania state court against Greater New York Mutual Insurance, Inc. (“GNY”). She alleged that, while settling a personal-injury lawsuit against GNY’s insured, she provided GNY with her Social Security number, date of birth, address, medical records, billing records, and banking information.

While that lawsuit was pending, unauthorized individuals accessed GNY’s information-technology system from May 23 through June 1, 2021. GNY later notified Rauhala and others that cybercriminals had used PYSA ransomware to access personally identifiable information and protected health information. GNY could not rule out that the information had been taken from its system.

Rauhala sued on behalf of herself and approximately 34,000 people allegedly affected by the data breach. She asserted state-law claims for negligence, unjust enrichment, and invasion of privacy. She alleged that GNY failed to protect the information and failed to give timely and adequate notice of the breach. She sought damages and court-ordered security improvements, audits, monitoring procedures, and at least five years of credit monitoring.

GNY removed the case to federal court under the Class Action Fairness Act (“CAFA”), a federal law allowing certain interstate class actions to be heard in federal court. Rauhala moved to remand, meaning she asked the court to return the case to state court. She argued that GNY had not shown that she suffered an injury sufficient to establish Article III standing, the constitutional requirement that a plaintiff show a concrete injury that can be addressed by a court.

Court’s Analysis

The court explained that CAFA jurisdiction requires minimal diversity, at least 100 class members, and more than $5 million in controversy. The court stated that GNY had satisfied those requirements: Rauhala and GNY were citizens of different states, the proposed class allegedly included about 34,000 people, and the requested credit monitoring would cost more than $20 million.

The disputed issue was injury-in-fact. The court applied the rule that an injury must be concrete, particularized, and actual or imminent, and must be traceable to the defendant’s conduct and likely capable of being remedied by a favorable decision. Relying on Third Circuit precedent concerning data breaches, the court stated that a plaintiff exposed to a substantial risk of identity theft or fraud can show a concrete injury by alleging present harms caused by that risk.

The court accepted the complaint’s allegations as true for purposes of the remand motion. It concluded that Rauhala had alleged concrete harms, including actual identity theft, compromise or theft of her information, out-of-pocket expenses to prevent or address identity theft and fraud, loss of value in her information, and increased spam calls. The court also noted her allegations of anxiety, emotional distress, and loss of privacy resulting from the risk that her information would be publicly disclosed.

The court held that Rauhala did not have to wait until she was actually victimized by identity theft or fraud because an imminent injury can support standing. It concluded that her alleged out-of-pocket expenses alone satisfied the injury-in-fact requirement.

Disposition

The court held that Rauhala had Article III standing and that GNY had established CAFA jurisdiction. Judge Savage therefore denied Rauhala’s motion to remand.