Opinion
No. 01–12–01177–CV.
2014-01-7
BLISS & GLENNON INC., Appellant v. Eugene Lyle ASHLEY and Ashley General Agency, LLC, Appellees.
Bret Strong, Adam Looney, The Strong Firm P.C., The Woodlands, TX, for Appellant. Mo Taherzadeh, Allyson L. Mihalick, Taherzadeh Law Firm, Houston, TX, for Appellees.
Bret Strong, Adam Looney, The Strong Firm P.C., The Woodlands, TX, for Appellant. Mo Taherzadeh, Allyson L. Mihalick, Taherzadeh Law Firm, Houston, TX, for Appellees.
Panel consists of Chief Justice RADACK and Justices BLAND and HUDDLE.
OPINION
SHERRY RADACK, Chief Justice.
Appellant brings this interlocutory appeal from the trial court's order certifying a nationwide class. We reverse.
BACKGROUND
A. The Parties
Plaintiff/appellant Bliss & Glennon, Inc. (B & G) is an insurance broker. Essentially, it serves as the middle-man in the residual insurance market, i.e., it brokers hard-to-place policies that cannot be purchased in the standard insurance market. B & G's customers are insurance agents that represent insureds, and B & G's suppliers are various insurance companies.
Defendant/appellee Lyle Ashley worked for B & G until June 2008. He then founded defendant/appellee Ashley General Agency, LLC. Ashley is also a part owner of the commercial building that housed B & G's Conroe office until March 2011. B & G and Ashley have been involved in prior litigation involving allegations by B & G that Ashley misappropriated trade secrets and violated various agreements when he left B & G.
B. Bliss & Glennon's claims
In the underlying suit, B & G sued Ashley and Ashley General seeking a temporary restraining order and injunctive relief.
B & G's petition alleged that when Ashley left B & G's employment and formed competing business Ashley General, he solicited B & G's employees to join him. On May 20, 2011, Ashley's attorney contacted B & G's attorney to notify B & G that one of Ashley General's employees, later identified as Justin Langston, had removed several of B & G's CDs, hard drives, and other business information from the dumpster that was onsite when B & G moved out of its Conroe office in March 2001. B & G had moved out of the offices on March 18, Ashley noticed items in the dumpster on March 19, and Langston went and retrieved the items from the dumpster on March 20. Ashley's counsel indicated to B & G that the CDs and computer drives contained business information that B & G had claimed was confidential in prior litigation between the parties, and sensitive third-party data, including the social security numbers of various employees and other individuals.
Langston was the IT department head for B & G's Conroe office before he left to work for Ashley General.
Although B & G maintained that it did not discard confidential or sensitive information in the trash, it requested the immediate return of any such items. Ashley refused to return them. Shortly thereafter, B & G received a call from a senior executive with one of its largest customers explaining that Ashley had called him to report that B & G disclosed that customer's confidential information, failed to inform that customer, and had taken no protective steps to safeguard the information. Ashley also told that customer that Ashley had a recent fraudulent charge on his credit card that he believed was related to B & G's data breach.
In response, B & G filed its petition in the underlying cause stating, B & G seeks a Temporary Restraining Order prohibiting the use or disclosure to anyone other than B & G of all B & G information Defendants found in B & G's trash, or which Defendants have represented was found in B & G's trash, as well as the immediate return of such information to B & G. B & G needs to know what information Mr. Ashley has allegedly found for many reasons, not the least of which is its duty to advise persons whose information has been disclosed, if that is the case. B & G also seeks damages for Mr. Ashley's use of B & G confidential information, his tortious interference with B & G customer relationships, and defamation.
In addition to injunctive relief, B & G sought damages for conversion, misappropriation of trade secrets and confidential information, unfair competition, business disparagement, and defamation.
C. The Temporary Restraining Order
On May 31, 2011, the trial court granted a TRO ordering Ashley and Ashley Agency to “[i]mmediately cease and desist from using, communicating, disclosing, divulging or making available to any person or entity, directly or indirectly, the contends of any information found in the trash.” Two weeks later, the court signed an Agreed TRO containing the same provision, and B & G was finally provided a copy of the items allegedly found in the dumpster. The trial court's order, which it entered without hearing evidence or making any “determination as to the substance or validity of either parties' claims,” but only to maintain the parties' “interest in the subject property” until trial, provided,
1. The property making the basis for the claims in this suit is to remain in the care, custody, and control of the Counsel for Defendants. Counsel is to ensure that said property is not accessed by either party for any reason. Counsel for Defendants is to preserve said property in its current form and disallow any access to said property until further order of this Court.
2. Counsel for Defendants is to obtain affidavits, within thirty (30) days, from any person who has had direct access to said property that indicate no additional copies of the subject property are in existence. Counsel is not required to obtain such affidavits from anyone who has already testified to such information.
3. Should Counsel for Defendants learn of anyone in possession of copies of the subject property, they are to take possession of the copies, immediately. In the event of such a discovery, Counsel for Defendants is to notify Counsel for Plaintiffs and Court, with the identity and contact information of the person in possession of a copy.
D. Ashley's and Ashley General's Counterclaims
On May 30, 2012, Ashley and Ashley General filed counterclaims against B & G, asserting, and seeking damages for, negligent protection of personal and other sensitive information, invasion of privacy by public disclosure of private information, business disparagement, and defamation. Ashley asserted that, after the discovery of B & G's information in the dumpster, he was “told of a fraud alert on his personal credit card.” Ashley and Ashley General also sought sanctions and attorneys' fees, based on the contention that B & G's claims were frivolous and brought in bad faith for the purpose of harassment.
E. Ashley's Class–Action Claims
On October 22, 2012, defendants/counter-plaintiffs Ashley and Ashley General amended their counterclaim petition to add class-action claims. Their petition asserted that Ashley had already appeared in the suit “as an individual and in his capacity as representative of a class of similarly situated persons.” The petition alleged that defendants' claims satisfy the applicable standards for certifying a class,
Ashley brings this class action pursuant to Rule 42 of the Texas Rules of Civil Procedure because (1) the class is so numerous (in this case, likely to exceed 7000 individuals) that joinder of all members is impracticable, (2) there are questions of law or fact common to the class, (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class, and (4) Ashley, as class representative, will fairly and adequately protect the interests of the class. Ashley, individually and as representative of the class, seeks certification of the following class (the “Class”):
All individuals whose personal, sensitive information was stored on electronic mediums, including hard drives, that Defendants placed in the dumpster and cannot either account for and/or did not have proper control, custody, or possession for a period of time.
The class-action petition requested, on behalf of the class, all damages arising from B & G's actions, including “expenses for credit monitoring and identity theft insurance, out-of-pocket expenses, anxiety, emotional distress, loss of privacy, and other economic and non-economic harm—for which they are entitled to compensation.” Defendants also sought attorneys' fees, sanctions, and an injunction “compelling B & G to issue notices to all members of the Class regarding the breaches of duty regarding their personal information.”
F. The Class Certification
In addition to its petition, Ashley filed three documents in support of certification: (1) a Motion for Class Certification with three exhibits (deposition excerpt from B & G employee, B & G's original petition, and an email from American Express to Ashley), (2) a Brief in Support of Class Certification, and (3) a proposed order and trial plan. B & G objected to Ashley's motion for certification as being untimely, and filed a response challenging Ashley's standing and ability to satisfy the requirements for class certification with two exhibits (deposition excerpt from B & G employee and deposition excerpt from Ashley).
The materials allegedly found in the dumpster are not in the record, and the record does not contain a very good description of the data involved. Ashley has pleaded that the “information placed in the dumpster contains personal and business information—including names, account numbers, tax numbers, e-mail addresses, billing addresses, phone numbers, and social security numbers—belonging to countless (Ashley believes the number of such individuals is over 7,000) persons and businesses.”
The parties' trial-court briefing on class certification and the evidence attached, however, reveal that the crux of the parties' dispute revolves around a hard drive Ashley alleges was found in the dumpster, and around the existence of another potentially missing duplicate hard drive. B & G's corporate representative, Ms. Bowers, testified in her deposition that—at some point when Langford was still employed by B & G—another company named “Willis” (also referred to elsewhere as “H.R.H.”) erroneously sent a computer file to B & G containing a list of social security numbers and other personal information. That email was received by Langford. Bowers testified that although Langford knew that the information was sent to him in error, he now claims that he backed up the information onto two different hard drives. Langford claims that he retrieved one of those hard drives from the dumpster two days after B & G moved out of its office. Bowers testified that B & G does not know anything about a second hard drive existing; nor does it possess such a hard drive.
The parties do not appear to dispute that the CDs found in the dumpster did not contain confidential information, but instead contain software updates. There were some paper copies of insurance policies in dumpster that would usually be shredded instead of thrown away under B & G's internal policies, but the parties also appear to agree that these papers do not contain confidential personal or business information. The class was thus defined in terms of individuals with personal or sensitive information stored on “electronic mediums.”
According to Bowers, B & G conducted an immediate investigation when it was contacted by Ashley about the materials allegedly found in the dumpster. B & G disputes that any hard drive was thrown away (as its IT personal deny discarding such items), and B & G had a data disposal company on hand with its move that shredded paper and drilled holes in hard drives before taking them off-site to discard. B & G's thus believes that Ashley and/or Langford wrongfully obtained the materials at issue from its office (rather than from a dumpster, as claimed) and are skeptical of Langford's claim that a duplicate hard drive exists and is missing.
Over B & G's objections, and following an unrecorded hearing, the trial court certified the requested class with Ashley as the class representative, and ordered B & G to give notice to class members at its own expense. B & G timely brought this interlocutory appeal.
ISSUES ON APPEAL
B & G brings forth the following issues here:
1. Whether the Trial Court erred in failing to dismiss the Class Claims for want of jurisdiction based on Lyle Ashley's failure to carry his burden to establish standing since: (1) Ashley and his counsel have had custody and control of the confidential information at issue since Ashley and his colleague allegedly removed it from a trash dumpster two years ago; and (2) Ashley failed to establish the required causal connection between his alleged injury of fraudulent charges on his personal credit card and B & G's alleged conduct, especially given the lack of evidence that the credit card information was included in the confidential information?
2. Whether the Trial Court erred in certifying a nationwide class action asserting common law claims where Ashley failed to carry his burden of proving the predominance and superiority aspects of Rule 42(b)(3), as well as the requirements of commonality (Rule 42(a)(2)), typicality (Rule 42(a)(3)), and adequacy (Rule 42(a)(4))?
RULE 42—CLASS ACTIONS
Class action suits are governed by Rule 42 of the Texas Rules of Civil Procedure.
Rule 42. Class Actions
(a) Prerequisites to a Class Action. One or more members of a class may sue or be sued as representative parties on behalf of all only if (1) the class is so numerous that joinder of all members is impracticable, (2) there are questions of law, or fact common to the class, (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class, and (4) the representative parties will fairly and adequately protect the interests of the class.
(b) Class Actions Maintainable. An action may be maintained as a class action if the prerequisites of subdivision (a) are satisfied, and in addition:
(1) the prosecution of separate actions by or against individual members of the class would create a risk of
(A) inconsistent or varying adjudications with respect to individual members of the class which would establish incompatible standards of conduct for the party opposing the class, or
(B) adjudications with respect to individual members of the class which would as a practical matter be dispositive of the interests of the other members not parties to the adjudications or substantially impair or impede their ability to protect their interests; or
(2) the party opposing the class has acted or refused to act on grounds generally applicable to the class, thereby making appropriate final injunctive relief or corresponding declaratory relief with respect to the class as a whole; or
(3) the questions of law or fact common to the members of the class predominate over any questions affecting only individual members, and a class action is superior to other available methods for the fair and efficient adjudication of the controversy. The matters pertinent to these issues include:
(A) the interest of members of the class in individually controlling the prosecution or defense of separate actions;
(B) the extent and nature of any litigation concerning the controversy already commenced by or against members of the class;
(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and
(D) the difficulties likely to be encountered in the management of a class action.
(c) Determining by Order Whether to Certify a Class Action; Notice and Membership in Class.
(1)(A) When a person sues or is sued as a representative of a class, the court must—at an early practicable time—determine by order whether to certify the action as a class action.
(B) An order certifying a class action must define the class and the class claims, issues, or defenses, and must appoint class counsel under Rule 42(g).
(C) An order under Rule 42(c)(1) may be altered or amended before final judgment. The court may order the naming of additional parties in order to insure the adequacy of representation.
(D) An order granting or denying certification under Rule 42(b)(3) must state:
(i) the elements of each claim or defense asserted in the pleadings;
(ii) any issues of law or fact common to the class members;
(iii) any issues of law or fact affecting only individual class members;
(iv) the issues that will be the object of most of the efforts of the litigants and the court;
(v) other available methods of adjudication that exist for the controversy;
(vi) why the issues common to the members of the class do or do not predominate over individual issues;
(vii) why a class action is or is not superior to other available methods for the fair and efficient adjudication of the controversy; and
(viii) if a class is certified, how the class claims and any issues affecting only individual members, raised by the claims or defenses asserted in the pleadings, will be tried in a manageable, time efficient manner.
(2)(A) For any class certified under Rule 42(b)(1) or (2), the court may direct appropriate notice to the class.
(B) For any class certified under Rule 42(b)(3), the court must direct to class members the best notice practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort. The notice must concisely and clearly state in plain, easily understood language:
(i) the nature of the action;
(ii) the definition of the class certified;
(iii) the class claims, issues, or defenses;
(iv) that a class member may enter an appearance through counsel if the member so desires;
(v) that the court will exclude from the class any member who requests exclusion, stating when and how members may elect to be excluded; and
(vi) the binding effect of a class judgment on class members under Rule 42(c)(3).
....
Tex.R. Civ. P. 42.
“Courts must perform a rigorous analysis before ruling on class certification to determine whether all prerequisites to certification have been met.” Sw. Ref. Co. v. Bernal, 22 S.W.3d 425, 435 (Tex.2000) (citation and internal quotation marks omitted). In so doing, courts “may look beyond the pleadings.” Intratex Gas Co. v. Beeson, 22 S.W.3d 398, 404 (Tex.2000). “Because class determinations generally involve considerations that are enmeshed in the factual and legal issues comprising the plaintiff's cause of action, the trial court must be able to make a reasoned determination of the certification issues.” Exxon Mobil Corp. v. Gill, 299 S.W.3d 124, 126 (Tex.2009) (quoting Beeson, 22 S.W.3d at 404). And while “[d]eciding the merits of the suit in order to determine ... its maintainability as a class action is not appropriate,” Beeson, 22 S.W.3d at 404, “the substantive law ... must be taken into consideration in determining whether the purported class can meet the certification prerequisites under Rule 42,” Union Pac. Res. Grp., Inc. v. Hankins, 111 S.W.3d 69, 72–73 (Tex.2003).
Our review of an interlocutory appeal from a class certification order is limited to determining whether the trial court's order constituted an abuse of discretion. Ford Motor Co. v. Ocanas, 138 S.W.3d 447, 451 (Tex.App.-Corpus Christi 2004, no pet.); see also Henry Schein, Inc. v. Stromboe, 102 S.W.3d 675, 690–91 (Tex.2003). Typically, under this standard of review, the appellate court must indulge every presumption favorable to the trial court's ruling. See Graebel/Houston Movers, Inc. v. Chastain, 26 S.W.3d 24, 29 (Tex.App.-Houston [1st Dist.] 2000, pet dism'd w.o.j.). On certification issues, however, the appellate court is not bound by this presumption and must independently determine whether the requirements of rule 42 have been fully satisfied. See Ford Motor Co., 138 S.W.3d at 451;see also Stonebridge Life Ins. Co. v. Pitts, 236 S.W.3d 201, 205 (Tex.2007) (“Actual conformance with Rule 42 is indispensable, and compliance with the rule must be demonstrated, not presumed.”); Bernal, 22 S.W.3d at 435 (actual compliance with rule 42 “must be demonstrated; it cannot be presumed”).
Applying these standards, we conclude that the trial court accepted disputed facts as agreed and thus failed to hold Ashley to his burden of affirmatively establishing each prerequisite to class certification. Accordingly, while we reject B & G's argument that Ashley has failed to establish individual standing, we nonetheless reverse the trial court's class certification order.
I. Standing
Preliminarily B & G argues that Ashley has failed to demonstrate standing to represent a class because, it asserts, Ashley lacks individual standing. It points to the supreme court's holding that “a named plaintiff's lack of individual standing at the time suit is filed deprives the court of subject matter jurisdiction over the plaintiff's individual claims and claims on behalf of a class.” M.D. Anderson Cancer Ctr. v. Novak, 52 S.W.3d 704, 711 (Tex.2001). Citing recent Texas Supreme Court precedent, B & G contends that “Ashley was required to prove three essential elements for standing: injury, causation, and redressability”:
We begin with an individual standing inquiry, because “before Rule 42's requirements are considered, a named plaintiff must first satisfy the threshold requirement of individual standing at the time suit is filed, without regard to class claims.” Sw. Bell Tel. Co. v. Mktg. on Hold Inc., 308 S.W.3d 909, 915 (Tex.2010) (holding, on interlocutory appeal of class certification order, that plaintiff had standing, but nonetheless had not established that it could adequately represent the class); see also Solotko v. LegalZoom.com, Inc., No. 03–10–00755–CV, 2013 WL 3724770, at *2 (Tex.App.-Austin July 11, 2013, pet. filed) (mem. op.) (noting that named representative's individual standing was “threshold matter” in interlocutory appeal of order denying class certification); Magic Valley Elec. Coop. v. City of Edcouch, No. 13–05–202–CV, 2006 WL 733960, at *1 (Tex.App.-Corpus Christi March 23, 2006, pet. dism'd) (mem. op.) (examining proposed class representative's individual standing on interlocutory appeal from class certification order because plaintiff's individual standing is a “prerequisite to class certification”).
First, “a plaintiff must be personally aggrieved, his alleged injury must be concrete and particularized, actual or imminent, not hypothetical.” DaimlerChrysler Cor. v. Inman, 252 S.W.3d 299, 304–05 (Tex.2008); accord Heckman [v. Williamson Cnty.], 369 S.W.3d [137,] 154 [ (Tex.2012) ]. Second, “there must be a causal connection between the injury and the conduct complained of—the injury has to be fairly ... trace[able] to the challenged action of the defendant, and not ... th[e] result [of] the independent action of some third party not before the court.” Heckman, 369 S.W.3d at 154 (internal quotations and citations omitted). Third, “it must be ‘likely,’ as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a favorable decision.’ ” Id. at 154–55. If the named class representative lacks standing, then the purported class action must be dismissed for want of jurisdiction. M.D. Anderson, 52 S.W.3d at 711.
According to B & G, Ashley failed to satisfy these standing requirements for four reasons: (1) Ashley and his counsel have had custody of the materials at issue since they were allegedly removed from the dumpster, (2) Ashley has not presented evidence that data fell into the hands of someone who intends to misuse it, (3) Ashley has not presented evidence that his credit card information was contained in the property allegedly discarded by B & G, and (4) Ashley has not shown that the fraudulent charges on his credit card were caused by B & G's actions.
Ashley responds that this case is different than the data-breach cases in which the pleaded risk of harm is purely hypothetical. In this case, Ashley points out, he has alleged that fraudulent activity occurred on his American Express account because of B & G's alleged breach, and that he has already incurred mitigation expenses. Ashley contends that B & G is attempting to “substitute[e] a sufficiency of the evidence argument for one challenging standing by asking this Court to reweigh evidence of ‘causal connection’ similar to a merits-based appeal.” Ashley asserts that this is inappropriate, as a “plaintiff does not lack standing simply because he cannot prevail on the merits of his claim; he lacks standing because his claim of injury is too slight for a court to afford redress.” DaimlerChrysler Corp. v. Inman, 252 S.W.3d 299, 305 (Tex.2008).
We agree with Ashley that he has alleged a particularized harm that satisfies the requirement that he must “be personally aggrieved [and] his alleged injury must be concrete and particularized, actual or imminent, not hypothetical.” Id. at 304–05. Ashley pleaded that B & G voluntarily discarded his private information, his American Express account has since been compromised as a result, and that he has suffered “expenses for credit monitoring and identity theft insurance, out-of-pocket expenses, anxiety, emotional distress, loss of privacy, and other economic and non-economic harm.”
For the reasons B & G articulates, it may ultimately be determined at the summary-judgment or trial stage that Ashley cannot present sufficient evidence of a data breach, causation, or damages. But for purposes of our standing inquiry here, we are not conducting a sufficiency review; rather, we look to see whether Ashley, as an individual plaintiff, has articulated a sufficient harm that is subject to redress. Heckman, 369 S.W.3d at 155 (plaintiff “must plead facts demonstrating that he, himself (rather than a third party or the public at large), suffered the injury” (emphasis added)). Because Ashley pleads a specific, redressable harm, the cases relied upon by B & G concluding that the persons seeking class certification had not alleged a sufficient and particularized harm to demonstrate individual standing are inopposite. See Novak, 52 S.W.3d at 706 (plaintiff complaining of allegedly misleading letter soliciting donations did not have standing because he did not contribute money so he was not harmed); DaimlerChrysler Corp., 252 S.W.3d at 307 (plaintiffs lacked standing because allegations of risk of harm from alleged manufacturing defect was so “extremely remote” that plaintiffs “cannot show more than the merest possibility of injury to themselves”).
Similarly, we note that “whether the named plaintiff is a proper class representative is not part of the standing inquiry,” Southwestern Bell Tel. Co., 308 S.W.3d at 919, and the corollary that determination that a particular plaintiff has standing to bring an individual claim is not a determination that plaintiff is a proper class representative.
B & G also contends that “the fear of future fraudulent use of personal information” is not a cognizable harm, and that “[f]ederal courts have rejected this speculative alleged harm as being insufficient to confer standing because there is no actual or imminent injury.” In support, it cites the following excerpt from a Third Circuit case,
In this increasingly digitized world, a number of courts have had occasion to decide whether the “risk of future harm” posed by data security breaches confers standing on persons whose information may have been accessed. Most courts have held that such plaintiffs lack standing because the harm is too speculative. See Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1051–1053 (E.D.Mo.2009); see also Key v. DSW Inc., 454 F.Supp.2d 684, 690 (S.D.Ohio 2006). We agree with the holdings in those cases. Here, no evidence suggests that the data has been—or will ever be—misused. The present test is actuality, not hypothetical speculations concerning the possibility of future injury. Appellants' allegations of an increased risk of identity theft resulting from a security breach are therefore insufficient to secure standing. See Whitmore, 495 U.S. 149, 158, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990) (“[A]llegations of possible future injury do not satisfy the requirements of Art. III.”).
Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir.2011).
Reilly involved allegations that an unknown hacker infiltrated Ceridian's payroll system and “potentially gained access to personal and financial information belonging to [plaintiffs] and approximately 27,000 employees at 1,900 companies.” Id. at 40. It was “not known whether the hacker read, copied, or understood the data.” Id. Ceridian sent notice of the breach to potential victims. Id. Plaintiffs then sued, seeking class status and alleging that “they: (1) have an increased risk of identity theft, (2) incurred costs to monitor their credit activity, and (3) suffered from emotional distress.” Id. Before a motion to certify the class was heard, the court granted Ceridian's motion to dismiss for failure to state a claim. Affirming that dismissal, the Third Circuit emphasized that the plaintiffs' “contentions rely on speculation that the hacker: (1) read, copied, and understood their personal information; (2) intends to commit future criminal acts by misusing the information; and (3) is able to use such information to the detriment of [plaintiffs] by making unauthorized transactions in [plaintiffs'] names.” Id.; see also Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1053 (E.D.Mo.2009) (“Assuming plaintiff's allegation of security breach to be true, plaintiff alleges that he would be injured ‘if’ his personal information was compromised, and ‘if’ such information was obtained by an unauthorized third party, and ‘if’ his identity was stolen as a result, and ‘if’ the use of his stolen identity caused him harm. These multiple ‘if's' squarely place plaintiff's claimed injury in the realm of the hypothetical.”).
Although B & G accurately quotes Reilly, the question of what a plaintiff must allege to establish standing in data-breach cases is far from settled under federal law. See, e.g., Amburgy, 671 F.Supp.2d at 1051 (“Subsequent to the Seventh Circuit's decision in Pisciotta [v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir.2007) (holding plaintiffs' allegation of increased risk of identity theft conferred standing) ], district courts have consistently determined that claims of increased risk of identity theft resulting from security breaches sufficiently allege an injury-in-fact to confer Article III standing to those persons bringing such claims.”); see also Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir.2012) (recognizing that the federal “courts of appeals have evidenced some disarray about the applicability of this sort of ‘increased risk’ theory in data privacy cases” as it relates to standing).
In any event, unlike the plaintiff in Reilly, Ashley has alleged that his data was actually misused. Compare Reilly, 664 F.3d at 44 (“Appellants have alleged no misuse, and therefore, no injury”). We thus conclude that—even if Reilly's analysis concluding that the hypothetical threat of a data breach and identity theft is insufficient to convey standing were applicable—the facts here are distinguishable.
The Reilly court distinguished its facts from Krottner v. Starbucks Corp., 628 F.3d 1139, 1142 (9th Cir.2010), a case in which a laptop containing encrypted employees' information was stolen, and the plaintiff alleged that someone later unsuccessfully tried to open a bank account in the employee's name with his social security number. Reilly, 664 F.3d at 44 (“[In] Krottner, the threatened harms were significantly more ‘imminent’ and ‘certainly impending’ than the alleged harm here.”).
Because we have concluded that Ashley pleadings are sufficient to establish his individual standing, we overrule B & G's first issue and turn to the question of whether Ashley's proposed class claims satisfy Rule 42.
II. Class Certification
Ashley's request for class certification was premised on its repeated assertion that “B & G has judicially admitted its legal obligations to give notice to Class members of their actual and potential harms relating to the loss of personal information, including social security numbers.” It contends that the “B & G has judicially admitted all aspects of class treatment,” and that “the identity of the Class Members, the theory of liability, and the relief sought here are all eminently suitable for class treatment.” Alternatively, he argues that the trial court correctly determined that his pleadings establish each element of class certification.
B & G contends that Ashley has not demonstrated commonality among claims, and that the trial court erred in determining that commonality was judicially admitted by B & G. B & G argues that Ashley presented no evidence in support of its conclusory claim of commonality, and notes recent precedent under Federal Rule of Civil Procedure 23 rejecting the premise that commonality of claims can be decided on pleadings rather than evidence. Stukenberg v. Perry, 675 F.3d 832, 841 (5th Cir.2012) (holding that district court erred in finding commonality, where court's discussion “contained no reference to any of the three causes of action advanced on behalf of the proposed class, nor did the district court ‘look beyond the pleadings to understand the claims, defenses, relevant facts, and applicable substantive law in order to make a meaningful determination” about commonality). Finally, B & G argues that the trial court erred in not examining possible dissimilarities within the proposed class. Wal–Mart v. Dukes, ––– U.S. ––––, 131 S.Ct. 2541, 2551, 180 L.Ed.2d 374 (2011).
Relatedly, B & G contends that Ashley failed to demonstrate that his individual claims are typical of the purported class, or that he can adequately represent the class. SeeTex.R. Civ. P. 42(a). “Typicality and adequacy of representation are closely related, for demanding typicality on the part of the representative helps insure her adequacy of representation.” Supportkids, Inc. v. Morris, 167 S.W.3d 422, 425 (Tex.App.-Houston [14th Dist.] 2005, pet. dism'd w.o.j.) (citing Horton v. Goose Creek Indep. Sch. Dist., 690 F.2d 470, 486 n. 27 (5th Cir.1982)). Just as circumstances unique to a particular plaintiff can destroy commonality, “[o]rdinarily, the presence of even an arguable defense peculiar to the named plaintiff destroys the typicality of the class.” Id. at 425–26 (citing Spera v. Fleming, Hovenkamp & Grayson, P.C., 4 S.W.3d 805, 812 (Tex.App.-Houston [14th Dist.] 1999, no pet.)).
A. Judicial Admission
We begin by examining Ashley's contention, accepted by the trial court, that B & G judicially admitted the facts necessary to render class certification appropriate. Ashley contends that the “commonality prerequisite is easily met here,” as “B & G itself has already admitted the legal question, namely its legal duties under statutory (e.g. Chapter 521 of the Texas Business and Commerce Code) and common law.” Specifically, Ashley cites section 521.053 of the Texas Business and Commerce Code, entitled “Notification Required Following Breach of Security of Computerized Data,” as the source of B & G's duty to give such notice, which it claims B & G has “judicially admitted”:
Ashley likewise contends that B & G's own “petition acknowledges the typicality of the class members.”
(a) In this section, “breach of system security” means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data ....
(b) A person who conducts business in this state and owns or licenses computerized data that includes sensitive personal information shall disclose any breach of system security, after discovering or receiving notification of the breach, to any individual whose sensitive personal information was, or is reasonably believed to have been, acquired by an unauthorized person ....
Tex. Bus. & Com.Code Ann. § 521.053 (West Supp.2013). This section is part of the Texas' Identity Theft Enforcement and Protection Act.
According to Ashley, “B & G's sworn pleading, supported by two affidavits, one by its very own general counsel, admits that regardless of how its information found its way into the dumpster, B & G had a legal duty to notify all those who were impacted by the loss of data. ” Thus, it argues, the “trial court class certification order must be affirmed because (1) of the uncontroverted proof of harm to the class representative (Ashley); (2) no dispute exists about B & G's legal obligations; and (3) B & G did not follow through with those legal obligations.”
Ashley cites the following statements as B & G's “admissions”:
B & G's Original Petition & Application for TRO:
• “Although B & G believes that it did not discard any documents or CDs containing confidential information as alleged by Mr. Ashley, it determined it should assume that Mr. Ashley's allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information.”
• “B & G sent Mr. Ashley a letter through his legal counsel requesting the immediate return of ‘all Bliss & Glennon CDs and other information that was found in the trash.’ B & G also requested ‘a list of people to whom the information referenced above was disclosed so that we can take action with respect to any information that has been disclosed.”
• “Mr. Ashley has refused to return the alleged CDs and purported confidential information to B & G so that B & G can ascertain the extent of the supposed data release and next course of action to protect further disclosure of such information.”
• “B & G also seeks the return of the information at issue, so that it can comply with the duties mandated by Texas' Identity Theft Enforcement and Protection Act. The Act requires B & G to take ‘appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business in the regular course of business.’ ”
• “To date, Defendants have refused to permit B & G to comply with this law while at the same time complaining to B & G's customers that B & G is doing nothing to comply. Unless the court enters the requested Temporary Restraining Order, B & G will be unable to take ‘appropriate corrective action’ as required by the Identity Theft Enforcement and Protection Act. In addition, B & G may be required to provide notice to all those who many have been harmed by the disclosure of the information at issue.”
Affidavit in Support of Application for TRO (Vice–President, General Counsel, and Secretary of B & G's Parent Company)
• “Although B & G believes it did not discard any documents or CDs containing confidential information, we determined we should assume that Mr. Ashley's allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information. As a result we demanded return of the information allegedly found by Mr. Ashley in B & G's trash.”
Affidavit in Support of Application for TRO (B & G's Regional Vice President)
• “Although B & G believes it did not discard any documents or CDs containing confidential information, it has determined it was ethically required to assume that Mr. Ashley's allegations were true for the purpose of notifying any persons who might have been harmed by the alleged disclosure of information.”
“A judicial admission is a formal waiver of proof that dispenses with the production of evidence on an issue and bars the admitting party from disputing it.” Sherman v. Merit Office Portfolio, Ltd., 106 S.W.3d 135, 140 (Tex.App.-Dallas 2003, pet. denied). As long as the statement stands unretracted, it must be taken as true by the court and jury; it is binding on the declarant, and the declarant cannot introduce evidence to contradict it. Lee v. Lee, 43 S.W.3d 636, 641 (Tex.App.-Fort Worth 2001, no pet.). “Elements required for a judicial admission are: (1) a statement made during the course of a judicial proceeding; (2) that is contrary to an essential fact or defense asserted by the person making the admission; (3) that is deliberate, clear, and unequivocal; (4) that, if given conclusive effect, would be consistent with public policy; and (5) that is not destructive of the opposing party's theory of recovery.” Sherman, 106 S.W.3d at 140 (citing Lee, 43 S.W.3d at 641–42;United States Fid. & Guar. Co. v. Carr, 242 S.W.2d 224, 229 (Tex.Civ.App.-San Antonio 1951, writ ref'd)). It is the nature of an admission that by intention it be an act of waiver, and not merely a statement of assertion or concession, made for some independent purpose. United States Fid., 242 S.W.2d at 228.
“A judicial admission must be clear, deliberate, and unequivocal.” In re Spooner, 333 S.W.3d 759, 764 (Tex.App.-Houston [1st Dist.] 2010, orig. proceeding [mand. denied] ) (citing Regency Advantage Ltd. P'ship v. Bingo Idea—Watauga, Inc., 936 S.W.2d 275, 278 (Tex.1996)). To determine whether a statement is a judicial admission, it must be evaluated in context. Id.
Here, the petition and supporting affidavits containing what Ashley claims are judicial admissions of B & G's notification duties under Chapter 521 contain additional statements making clear that B & G disputes Ashley's entire version of events and does not “disavow or otherwise abandon [its] general denial of liability.” Id.
• “Although B & G denied that such information could have been found as represented, B & G nonetheless requested the immediate return of such information; however, Mr. Ashley, through his legal counsel, refused to return the information.”
• “B & G makes a great effort to protect the integrity of all information in its possession. In addition, when B & G vacated the property owned by Mr. Ashley, it had a document disposal company waiting on-site to properly destroy copies of confidential information, if necessary, during the move.”
• “After conducting a thorough investigation regarding Mr. Ashley's dumpster diving story, B & G determined that such confidential information could not have been disclosed as represented by Mr. Ashley, especially since: (1) B & G operates a virtually paperless workplace, (2) B & G's policies prohibit confidential information from being stored onto portable storage devices, including CDs, (3) B & G did not burn confidential information onto CDs in the normal courts eo fits operations, (4) the kind of information reported was not the kind of information that would have been available or used by employees in their normal business operations, and (5) B & G disabled the CD drives of employee computers as soon as they were installed.”
Among other things, the Texas Identity Theft Enforcement and Protection Act (1) defines “personal identifying information” and “sensitive personal information,” (2) imposed duties on certain types of businesses to implement and maintain reasonable procedures for protecting certain information and, (3) requires that notice be given to individuals if certain types of data are acquired by unauthorized persons. Tex. Bus. & Com.Code Ann. § 521.002–.053 (West 2009 & West Supp.2013). B & G's petition was filed after Ashley announced that it had found items containing sensitive and/or confidential information belonging to B & G in the dumpster and steadfastly refused to identify for B & G what the materials were or return them. Given this fact, and taking all of the above statements in context, B & G's petition reveals nothing more than its desire to take a prudent approach to ascertaining what data had been compromised, if any, and protect and notify those impacted if necessary. B & G was not in a position to know what materials, if any, would be covered by Chapter 521, much less unequivocally commit to a legal duty to give anyone notice under that statute. Accordingly, we conclude that—taking B & G's statements in context—B & G did not judicially admit that it committed a data breach, or that it is required to give a particular form of notice.
The trial court accepted Ashley's characterization of B & G's acquiescence, relying heavily on B & G's “admissions” in deeming class certification appropriate. For example, the court's order states,
• “B & G's sworn Original Petition acknowledged its legal obligations to give notice to the Class Members. See, e.g., Shepherd v. Ledford, 962 S.W.2d 28, 33 (Tex.1998) (stating by stipulating to the existence of a legal effect of acts the parties judicially admitted that conclusion).”
• “Any monetary relief ... is incidental to the injunctive relief, which B & G has acknowledged it is obligated to perform.”
• “All Class claims for relief rest on the same elements: (a) B & G was in possession of the personal and other sensitive information belonging to Ashley and the Class; and (b) B & G failed to protect that information from disclosure and/or loss. Neither of the contentions is challenged by B & G. Indeed, the lynchpin of this case is that B & G has judicially admitted both the fact of the disclosure and/or loss and its legal obligations to the Class.”
• “[T]his Court has reviewed B & G's opposition to the Motion for Certification, which rested on a number of generalities, many of which rely on the merits-based allegation that Ashley is responsible for the data being found in the dumpster. Of course, B & G's own sworn petition claims that for the purpose of its legal obligation to provide notice to hose individuals and business whose data was thrown away, it has assumed that Ashley did not take the information wrongfully, so B & G's allegation is a non-starter.... B & G's erroneous challenge to the typicality requirement under Rule 42 rests on the same faulty reasoning.”
• “[B]eyond not raising the issue of [choice-of-law] in any meaningful way, B & G's Original Petition presumed its obligation to give notice to those impacted by the data breach, without regard to whether the substantive law of multiple jurisdictions applied.”
• “No issues of law or fact would affect only individual Class Members due to the fact all Class members are entitled to receive notice of the data breach and B & G has acknowledged that fact.”
• “The issue that will be the object of most of the efforts of the litigants and the Court will be determination of the measures required to protect the Class Members from future harm from the data breach.”
• “This matter can be resolved in a unitary proceeding and in the following manner: As noted earlier, B & G has acknowledged its obligation to give notice to the Class members and an order is appropriate to compel B & G to give notice of the data breach and the remedies afforded the Class members. Accordingly, and pursuant to Texas Rule of Procedure 42(b)(2), this Court exercises its discretion and orders that within 60 days of the date of this Order, that B & G issue, at its own expense, a Class Notice, as approved by this Court.”
There are two primary flaws in the trial court's reliance on what it characterizes as B & G's admissions. First, as explained above, B & G did not judicially admit its duty to give notice under Chapter 521. Second, even if B & G were required to give notice under Chapter 521 (an issue not before us), the court's order erroneously conflates section 521 notice with the class notice provided under Rule 42 of the of the Texas Rules of Civil Procedure.
Chapter 521 imposes a notice obligation, under certain circumstances, on a person or business responsible for disclosure of particular types of third-party sensitive information to an unauthorized person. Tex. Bus. & Com.Code Ann. § 521.053. In contrast, Rule 42 imposes an obligation on the party seeking class treatment for its claims to provide individual notice and certain information about the claims and class to each identifiable member of that class at the expense of the party seeking class certification. Am. Express Travel Related Servs. Co., Inc. v. Walton, 883 S.W.2d 703, 709 (Tex.App.-Dallas 1994, no pet.) (“[R]ule 42's plain language requires the party claiming the class to provide notice to class members. Tex.R. Civ. P. 42(c)(2). We interpret this directive to include paying the costs of notice.”).
The person responsible for notice under section 521.053 and rule 42 is different, the contents and purpose of the notice under section 521.053 and rule 42 is different, the stage in the proceedings for giving notice under section 521.053 and rule 42 is different, and the appropriate person to bear the cost of notice under section 521.053 and rule 42 is different. The trial court's determination that an obligation to give notice under section 521.053 equates to an obligation to give Class Notice under rule 42 was thus erroneous.
B. Evidence of Commonality, Typicality and Adequacy of Representation
Having rejected the argument that Ashley was excused from meeting his burden to satisfy the requisite prerequisites to class certification by B & G's alleged judicial admission, we examine the record and the trial court's class certification order to determine if the evidence demonstrates that class certification was appropriate. See Riemer v. State, 392 S.W.3d 635, 639 (Tex.2012) (court must “apply a rigorous analysis to determine” if class certification requirements have been satisfied). Because the evidence does not affirmatively demonstrate commonality or typicality of claims, and because the unique relationship and background between B & G and Ashley renders him inadequate to represent a class, we conclude that the trial court erred in certifying a class and appointing Ashley as class representative.
The parties' briefing contains various and conflicting characterizations about the data allegedly found in the dumpster, but there is no evidence about the actual data in the record from which commonality could be assessed. Ashley's motion contains one sentence in support of commonality—i.e., “The vast majority of the Class members are made up of employees of B & G and its predecessors, hence the confidential and fiduciary relationship between the Class and B & G is beyond dispute.” The court's order likewise does not cite evidence, but refers only to Ashley's allegations regarding commonality, stating: “Ashley alleged facts that give rise to common questions of both fact and law that are central to the Class members' claims. These include B & G's failure to adequately protect their information and the resulting harm.”
The trial court was required to look beyond Ashley's pleaded facts in assessing commonality. E.g., Wal–Mart Stores, 131 S.Ct. at 2551 (interpreting federal Rule 23 governing class actions). It could not do so on this record, as there is no evidence about the members of the proposed class, or about their circumstances, their information compromised, or their possible injury. Moreover, the trial court is required to assess potential dissimilarities within the class in determining commonality. Id. B & G cites potential dissimilarities that both demonstration a potential lack of commonality, and exemplify why, even if the record were more developed, Ashley cannot establish typicality or adequacy of representation.
“Because Rule 42 is patterned after Federal Rule of Civil Procedure 23, federal decisions and authorities interpreting current federal class action requirements are instructive.” Riemer, 392 S.W.3d at 640.
B & G notes potential dissimilarities that include “(1) class members residing in different states with different laws, (2) class members who have not suffered the sort of consequential damages that Ashley seeks, such as out-of-pocket damages and/or emotional distress; (3) class members who want to file claims against Ashley and Langston for their actions; and (4) class members who, in contrast to Ashley's allegations, have not experienced any actual fraudulent activity with their accounts or identity.” B & G cites similar consideration in asserting that typicality of claims is lacking, and that Ashley cannot adequately represent the class: “(1) Ashley is subject to a unique defense; (2) Ashley has a bitter and litigious history with B & G; and (3) Ashley has conflicts with the class members that go to the heart of this litigation.”
Ashley is a former employee who has been accused of poaching employees from B & G, including Langston (the former B & G employee who allegedly found the data at issue in the dumpster). The parties have been in prior litigation over the use and control of business data. Ashley now runs a business in direct competition with B & G. B & G's contends that, by his own admission, Ashley violated laws in having Langston allegedly retrieve items from the trash dumpster, and that Ashley is in fact the one responsible for the information falling into third parties' hands. B & G has pending claims against Ashley claiming that he wrongfully used B & G's confidential information to interfere with its relationships with customers.
Ashley's claims cannot be typical, given that one of the issues to be resolved by the factfinder is how the alleged missing data came to be in Ashley's hands. For the same reasons, he cannot be said to “fairly and adequately protect the interests of the class” members (who would have claims against Ashley under B & G's theory of the case). Emp'rs Cas. Co. v. Tex. Ass'n of Sch. Bds. Workers' Comp. Self–Ins. Fund, 886 S.W.2d 470, 475 (Tex.App.-Austin 1994, writ dim's w.o.j.) (“[T]he interests of the class representatives must not be antagonistic to those of the rest of the class. In this sense, this issue is often collapsed into the typicality analysis.”); see also E & V Slack, Inc. v. Shell Oil Co., 969 S.W.2d 565, 568 (Tex.App.-Austin 1998, no pet.) (in suit against Shell Oil Co., named representatives—who were former Shell dealers that currently own stations that compete with Shell—could not adequately represent current Shell dealers).
CONCLUSION
The trial court certified a nationwide class action, relying in large part on what it deemed a judicial admission by B & G of liability and duty to give class notice. We reject the argument that B & G judicially admitted liability, and hold that Ashley has not presented any evidence demonstrating commonality or typicality, or that Ashley could fairly and adequately protect the interest of the class. We sustain B & G's second issue, reverse the trial court's class certification order, and remand for further proceedings.