McNeil v. Best Buy Co., Inc.: Data Breach Case

Administrator
Site Admin
Posts: 11757
Joined: Tue Jul 26, 2005 4:15 am

McNeil v. Best Buy Co., Inc.: Data Breach Case

Postby Administrator » Tue Oct 28, 2014 2:18 pm

McNeil v. Best Buy Co., Inc.
Slip Copy, 2014 WL 1316935
E.D.Mo.,2014.
April 02, 2014


MEMORANDUM AND ORDER

JEAN C. HAMILTON, District Judge.

*1 This matter is before the Court on Defendant Best Buy Stores, LP's Motion to Dismiss, Motion to Strike, and Motion for More Definite Statement, filed January 28, 2014. (ECF No. 32). The motion is fully briefed and ready for disposition.



BACKGROUND

Plaintiff Eric McNeil alleges that in order to facilitate his switch from a Dell computer to an Apple computer, he contracted to have Best Buy Company, Inc. (“Best Buy Company”) and/or Best Buy Stores, LP (“Best Buy Stores”) “transfer” and then “recover” his personal, family, and business information and data. According to Plaintiff, in the course of providing the “data transfer” and “data recovery” services, Best Buy Company and/or Best Buy Stores inadvertently and negligently lost Plaintiff's Dell computer, information and data, and then failed timely to notify Plaintiff of such loss. As a result, Plaintiff maintains he suffered great personal and business economic loss, and further was subjected to the risk that the security of his data and information would be compromised.


On or about July 31, 2013, Plaintiff filed a Petition in the Circuit Court for St. Louis County, Missouri (“Complaint”), asserting claims for, inter alia, breach of contract and violations of the Missouri Merchandising Practices Act (“MMPA”) against Best Buy Company. Best Buy Company removed the Complaint to this Court on September 4, 2013, on the basis of diversity jurisdiction. (ECF No. 1). It then moved to dismiss Plaintiff's Complaint, claiming the computer work at issue was performed by employees of its subsidiary, Best Buy Stores. (ECF No. 7).


In an Order entered November 4, 2013, the Court granted Best Buy Company's Motion to Dismiss, finding Plaintiff had shown no reason to hold it liable for Best Buy Stores' alleged actions under an agency theory, nor had he established cause to pierce the corporate veil between the two entities. (ECF No. 13). The Court granted Plaintiff leave to file an Amended Complaint, however, in order to set forth more clearly the alleged relationship between the two companies and the asserted basis for holding Best Buy Company liable for the damages alleged in his case, and/or to name an entity other than Best Buy Company as a Defendant if the circumstances so indicated.


Plaintiff filed his Amended Petition (“Amended Complaint”) on November 25, 2013, naming as Defendants both Best Buy Company and Best Buy Stores. (ECF No. 14).FN1 Best Buy Stores was served on January 9, 2014, and counsel entered an appearance on its behalf on January 27, 2014. (ECF Nos. 24, 31). As stated above, Best Buy Stores filed the instant motion on January 28, 2014, asserting (1) all of Plaintiff's claims against it are barred by the applicable statute of limitations, and (2) certain of Plaintiff's claims must be dismissed for failure to state a claim. (ECF No. 32).


FN1. In an Order entered this day, the Court dismissed Best Buy Company as a Defendant.





STANDARD FOR MOTION TO DISMISS

In ruling on a motion dismiss, the Court must view the allegations in the complaint in the light most favorable to Plaintiff. Eckert v. Titan Tire Corp., 514 F.3d 801, 806 (8th Cir.2008). The Court, “must accept the allegations contained in the complaint as true and draw all reasonable inferences in favor of the nonmoving party.” Coons v. Mineta, 410 F.3d 1036, 1039 (8th Cir.2005) (citation omitted). The Complaint's factual allegations must be sufficient “to raise a right to relief above the speculative level,” however, and the motion to dismiss must be granted if the Complaint does not contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (abrogating the “no set of facts” standard for Fed.R.Civ.P. 12(b)(6) found in Conley v. Gibson, 355 U.S. 41, 45–46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957)). Furthermore, “the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions. Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) (citing Twombly, 550 U.S. at 555 (pleading offering only “labels and conclusions” or “a formulaic recitation of the elements of a cause of action” will not do)).



DISCUSSION

I. Statute Of Limitations

*2 In its motion, Best Buy Stores first asserts Plaintiff's claims against it must be dismissed, as they are barred by the statute of limitations. Specifically, Best Buy Stores notes that although Plaintiff complains of no events or interactions involving it taking place after August 1, 2008, Plaintiff did not amend his Complaint to include it as a Defendant until November 25, 2013, more than five years later.FN2 In response, Plaintiff asserts his claims against Best Buy Stores relate back to the timely filing of his original Complaint pursuant to Federal Rule of Civil Procedure 15(c), which provides in relevant part that an amendment to a pleading relates back to the date of the original pleading when:


FN2. Best Buy Stores assumes all claims in this action are governed by Mo.Rev.Stat. § 516.120, which provides a five year statute of limitations for “[a]ll actions upon contracts, obligations or liabilities, express or implied.” Upon consideration the Court agrees, as the ten year statute of limitations provided for in Mo.Rev.Stat. § 516.110 applies only to “every breach of contract action in which the plaintiff seeks a judgment from the defendant for payment of money the defendant agreed to pay in a written contract.” Hughes Development Co. v. Omega Realty Co., 951 S.W.2d 615, 617 (Mo. banc 1997); see also Collins v. Narup, 57 S.W.3d 872, 874 (Mo.App.2001).




(B) the amendment asserts a claim or defense that arose out of the conduct, transaction, or occurrence set out—or attempted to be set out—in the original pleading; or

(C) the amendment changes the party or the naming of the party against whom a claim is asserted, if Rule 15(c)(1)(B) is satisfied and if, within the period provided by Rule 4(m) for serving the summons and complaint, the party to be brought in by amendment:



(i) received such notice of the action that it will not be prejudiced in defending on the merits FN3; and



FN3. The notice required by Rule 15(c) may be either actual or constructive, and need not be formal. See Beverly v. MEVA Formwork Systems, Inc., 500 Fed.Appx. 391, 394 (6th Cir.2012); Krupski v. Costa Crociere S.p.A., 560 U.S. 538, 554 n. 5, 130 S.Ct. 2485, 177 L.Ed.2d 48 (2010).




(ii) knew or should have known that the action would have been brought against it, but for a mistake concerning the proper party's identity.
Fed.R.Civ.P. 15(c)(1).


Best Buy Stores does not dispute that the claims against it arose out of the same occurrence set forth in Plaintiff's original Complaint, thus satisfying subpart (B) of Rule 15(c)(1). Instead, Best Buy Stores contends that relation back is inappropriate under subpart (C)(i), as it did not receive notice of the suit within the period prescribed by Rule 4(m), i.e., 120 days after the Complaint was filed. Best Buy Stores maintains that neither the subsidiary-parent relationship between it and the original Defendant, Best Buy Company, nor the fact that the two entities now share counsel, is sufficient to impute the required notice to Best Buy Stores.


Upon consideration, the Court finds the allegations in Plaintiff's Amended Complaint do not preclude the possibility that through discovery he can meet the requirements for relation back under Rule 15(c)(1)(C). The Court therefore will deny this portion of Best Buy Stores' Motion to Dismiss at this stage of the litigation, without prejudice to its right to reassert the argument on summary judgment.


II. Missouri Merchandising Practices Act Claims

In Counts II, IV, and V of his Amended Complaint, Plaintiff asserts violations of the MMPA. The MMPA prohibits the “act, use or employment by any person of any deception, fraud, false pretense, false promise, misrepresentation, unfair practice or the concealment, suppression, or omission of any material fact in connection with the sale or advertisement of any merchandise FN4 in trade or commerce.” Mo.Rev.Stat. § 407.020.1. It further provides that, “[a]ny person who purchases or leases merchandise primarily for personal, family or household purposes and thereby suffers an ascertainable loss of money or property, real or personal, as a result of the use or employment by another person of a method, act or practice declared unlawful by section 407.020, may bring a private civil action in either the circuit court of the county in which the seller or lessor resides or in which the transaction complained of took place, to recover actual damages.” Mo.Rev. St. § 407.025.1. Thus, in order to succeed on an MMPA claim, “a plaintiff must prove: (1) the act, use or employment of; (2) a deception, fraud, false pretense, false promise, misrepresentation, unfair practice, or a concealment, suppression or omission of a material fact; (3) occurring in connection with the sale or advertisement of any merchandise in trade or commerce; (4) resulting in an ascertainable loss of money or real or personal property; (5) occurring to a person who purchases or leases merchandise primarily for personal family or household purposes.” Nixon v. Enterprise Car Sales Co., 2011 WL 4857941, at * 6 (E.D.Mo. Oct.13, 2011) (citations omitted).


FN4. “Merchandise” is defined as “any objects, wares, goods, commodities, intangibles, real estate or services.” Mo.Rev.St. § 407.010(4).




*3 In its Motion to Dismiss, Best Buy Stores asserts Plaintiff's MMPA claims fail because the transaction at issue, relating to the transfer, preservation and recovery of Plaintiff's data, was mainly commercial in nature, and thus did not involve merchandise purchased primarily for personal, family or household purposes. Upon consideration the Court agrees, for two reasons. First, in describing the data he contracted with Best Buy Stores to transfer and then recover, Plaintiff listed twenty-seven categories of confidential business records, including 200+ bank statements, 200+ vendor list, 9000+ five year client list, 300+ balance sheets, 5000+ confidential professional culinary art signature recipes and family culinary art recipes, and 3000 research papers. (Amended Compl., ¶ 35). By way of contrast, Plaintiff listed only eight categories of stored personal records, including 250+ extended family members' names, birth dates, etc., 600+ family members' photographs, 250+ family members' correspondence, personal and immediate family members' financial records, and video recordings. ( Id., ¶ 40). Second, the allegations in Plaintiff's first MM PA Count itself belie the fact that the merchandise was purchased primarily for personal, family or household purposes; rather, Plaintiff specifically alleges he was a “consumer, who purchased goods and services from Defendant BEST BUY primarily for business and personal purposes.” ( Id., ¶ 73 (emphasis added)). Under these circumstances, Best Buy Stores' Motion to Dismiss Counts II, IV and V must be granted.FN5


FN5. In light of the above ruling, the Court need not consider Best Buy Stores' second contention in favor of dismissal, i.e., that Plaintiff cannot demonstrate an “ascertainable loss of money or real or personal property” stemming from the alleged violations.




III. Invasion Of Privacy/Disclosure Of Private Facts Claim

In Count III of his Amended Complaint, Plaintiff alleges Best Buy Stores' failure to secure and protect his business, personal and family information and data resulted in the public disclosure of such private information. “Invasion of privacy is a general term used to describe four different torts, including wrongful appropriation of name or likeness, false light, intrusion into seclusion, and public disclosure of private facts.” Maxwell v. Express Scripts, Inc., 2012 WL 996651, at * 6 (E.D.Mo. Mar.22, 2012). In order to state a claim for public disclosure of private facts, Plaintiff had to plead that there was: “(1) publication or publicity by the defendant, to a large number of persons; (2) the absence of a grant to the defendant of any waiver or privilege; (3) the disclosure of private matters in which the public has no legitimate concern; and (4) disclosure in such a way as to bring shame or humiliation to an individual of ordinary sensibilities.” Id. at *7, citing Y.G. v. Jewish Hosp. of St. Louis, 795 S.W.2d 488, 498–99 (Mo.Ct.App.1990). “Under the first element, publication means communication to the public in general or to a large number of persons, as distinguished from one individual or a few.” Doe v. Young, 2009 WL 3680988, at *8 (E.D.Mo. Oct.30, 2009) (internal quotation marks and citations omitted).


*4 Upon consideration, the Court agrees with Best Buy Stores that in his Amended Complaint, Plaintiff fails to identify any personal facts that were publicized, nor does he allege when such facts were publicized or to whom. ( See, e.g., Amended Compl., ¶ 44 (“To present date, Plaintiff McNEIL has no knowledge of who has had previous and future access to Plaintiff McNEIL's business, personal, and family information and data, that was stored on Plaintiff McNEIL's Dell Computer and Western Digital External Hard Drive.”). The alleged threat of some future publication is too speculative to state a claim, see, e.g., Robinson v. Morgan Stanley, 2008 WL 4874459, at * 6 (N.D.Ill. Jun.18, 2008) and Wynn v. Wachovia Bank, N.A., 2009 WL 1255464, at *4 (E.D.Va. May 6, 2009) (both addressing the tort of defamation), and so Plaintiff's claim for public disclosure of private facts must be dismissed.


IV. Missouri Data Breach Notification Law Claim FN6

FN6. Although Plaintiff does not bring a separate Count alleging a violation of the Missouri Data Breach Notification Law, he implies such a claim as follows: “Such notification (of the fact that Plaintiff's business, personal, and family information and data was breached and/or compromised) is required by the Missouri Data Breach Notification Law pursuant to, Section 407.1500 of the Missouri Revised Statutes.” (Amended Compl., ¶ 47).




Best Buy Stores finally asserts Plaintiff's claim for a violation of the Missouri Data Breach Notification Law must be dismissed, as the statute itself provides that only the Missouri Attorney General may bring such a claim. Upon consideration, the Court agrees. See, e.g., Mo.Rev.Stat. § 407.1500.4 (“The attorney general shall have exclusive authority to bring an action to obtain actual damages for a willful and knowing violation of this section ...”); Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1056 (E.D.Mo.2009) ( “To the extent the Missouri legislature has subsequently enacted a data breach notification law, Mo.Rev.Stat. § 407.1500, such legislation nevertheless did not create a private cause of action. Instead, the Missouri Attorney General has exclusive authority in bringing claims against data handlers for a violation of the notice requirements.”).



CONCLUSION

Accordingly,


IT IS HEREBY ORDERED that Best Buy Stores, LP's Motion to Dismiss (ECF No. 32) is GRANTED in part and DENIED without prejudice in part, in accordance with the foregoing.


IT IS FURTHER ORDERED that Best Buy Stores, LP's Motion to Strike, and Motion for More Definite Statement (ECF No. 32) are DENIED.


IT IS FURTHER ORDERED that Best Buy Stores, LP is granted until Wednesday, April 16, 2014, within which to file its Answer to the remaining allegations in Plaintiff's Amended Complaint.


E.D.Mo.,2014.
McNeil v. Best Buy Co., Inc.
Slip Copy, 2014 WL 1316935 (E.D.Mo.)
David A. Szwak
Bodenheimer, Jones & Szwak, LLC
416 Travis Street, Suite 1404, Mid South Tower
Shreveport, Louisiana 71101
318-424-1400 / Fax 221-6555
President, Bossier Little League
Chairman, Consumer Protection Section, Louisiana State Bar Association

Return to “Standing and Statutes of Limitations”

Who is online

Users browsing this forum: No registered users and 2 guests