The Akron Legal News

Login | March 28, 2024

Split appellate court rules against Nationwide in data breach case

ANNIE YAMSON
Special to the Legal News

Published: September 28, 2016

The 6th U.S. Circuit Court of Appeals was divided when it ruled recently that the parties to a class action suit had standing to bring claims against Nationwide Mutual Insurance Company after a data breach resulted in stolen information.

The judgment reversed the ruling of the U.S. District Court for the Southern District of Ohio which dismissed the class action suit based on a lack of standing and failure to state a claim.

The suit was brought as a putative class action by plaintiffs Mohammad Galaria and Anthony Hancox after hackers breached Nationwide’s computer network and stole their personal information and that of 1.1 million others.

Galaria and Hancox, in their complaints, alleged claims for invasion of privacy, negligence, bailment and violations of the Fair Credit Reporting Act.

After the district court dismissed the claims, Galaria and Hancox appealed to the 6th Circuit court, challenging the dismissal of the negligence, bailment and FCRA claims.

“Because we conclude that plaintiffs have Article III standing and that the district court erred in dismissing the FCRA claims for lack of subject-matter jurisdiction, we reverse and remand for further proceedings,” Judge Helene White wrote on behalf of the circuit court’s three-judge appellate panel.

According to a case summary, Nationwide informed its clients of a data breach in 2012 and advised taking steps to prevent and mitigate fraud.

To that end, the company offered a year of free credit monitoring and identity fraud protection of up to $1 million.

Nationwide also suggested that its clients place a fraud alert and security freeze on their credit reports, which typically costs between five and 20 dollars and impedes consumers’ ability to obtain credit. The company did not offer to pay for the expenses associated with this freeze.

In their complaints, Galaria and Hancox asserted that Nationwide willfully and negligently failed to protect them against the wrongful dissemination of their data.

They also accused the company of failing to secure the data against a breach.

The plaintiffs stated that the average victim of identity fraud typically spends “hundreds of hours in personal time and hundreds of dollars in personal funds” to mitigate risk and they alleged that they “have suffered and will continue to suffer” both “financial and temporal costs” associated with that risk.

“The complaints seek damages for, among other things, the increased risk of fraud, expenses incurred in mitigating risk including the cost of credit freezes, insurance, monitoring and other mitigation products, and time spent on mitigation efforts,” court documents state.

Under Article III of the Constitution, plaintiffs have standing to bring a suit if they have “suffered an injury in fact that is fairly traceable to the challenged conduct of a defendant and that is likely to be redressed by a favorable judicial decision.”

The district court ruled that the plaintiffs did not have standing when it dismissed the suit but the 6th Circuit court held that the “injury” to Galaria and Hancox in the form of costs incurred to mitigate imminent harm, was traceable to Nationwide’s conduct.

“Although hackers are the direct cause of plaintiffs’ injuries, the hackers were able to access plaintiffs’ data only because Nationwide allegedly failed to secure sensitive personal information entrusted to its custody,” White wrote. “In other words, but for Nationwide’s allegedly lax security, the hackers would not have been able to steal plaintiffs’ data.”

In her dissent, Judge Alice Batchelder wrote that there was no connection between Nationwide’s alleged inaction and the injury suffered by Galaria and Hancox.

“If Galaria and Hancox suffered injury, it was at the hands of criminal third-party actors, and their complaints do not make the factual allegations necessary to fairly trace that injury to Nationwide,” Batchelder wrote.

Judge Sheryl Lipman, who sat by designation, joined White to form the majority.

The case will be sent back to the district court for it to consider the suit again, though it may still dismiss for failure to state a claim if it concludes that the plaintiffs do not have a cause of action under the FCRA.

The case is cited Galaria et al. v. Nationwide Mutual Insurance Co., case Nos. 15-3386/3387.

Copyright © 2016 The Daily Reporter - All Rights Reserved


[Back]