News Stream

Court opens road to class action against national testing body over data breach

When a Chase Amazon Visa card arrived in her mail in 2016, optometrist Nicole Mizrahi was surprised because she had never applied for the card. But the card’s use of her maiden name was a tipoff, she eventually realized; the personal information she supplied to take her optometry licensure examination 18 years earlier was compromised, she believed, due to a data breach at the National Board of Examiners in Optometry (NBEO).

In a June 12 ruling, the U.S. Fourth Circuit Court of Appeals held that that optometrist, Nicole Mizrahi, and two others had filed legally sufficient pleadings against the NBEO and have standing to file a class action suit against the national testing body over the alleged data breach (Hutton v. Nat’l Bd. of Exam’rs in Optometry, Inc. and Mizrahi v. Nat’l Bd. of Exam’rs in Optometry, Inc.).

Rhonda Hutton and Tawny Kaeochinda are the other optometrists who also filed suit after discovering that Chase Amazon Visa credit cards had been fraudulently opened using their maiden names.

After conversation in a shared Facebook page, Hutton, Kaeochinda, and Mizrahi realized that among their shared organizational memberships, only the NBEO possessed both their maiden names and social security numbers— prerequisites to opening a credit card.

In response to this burgeoning discussion, in August 2016 the NBEO issued a statement on Facebook asserting that its databases had not been breached. Two days later, the NBEO retracted its earlier statement and instead asserted it was investigating whether any data had been stolen. Three weeks later, the NBEO stated again on Facebook that its internal investigation was still underway and could take several more weeks to complete.

Hutton and Kaeochinda joined in a class action complaint against the NBEO asserting five claims, including negligence, breach of contract, and breach of implied contract arising from NBEO’s alleged failure to adequately safeguard personal information of the plaintiffs. In September, Mizrahi brought a similar class action complaint against the NBEO, asserting the same claims as Hutton and adding a claim of unjust enrichment.

In her complaint, Hutton stated that she had spent time and money putting credit freezes in place, and faces an imminent threat of future harm from identity theft and fraud. Mizrahi stated she received a notice from her bank that her credit score was dropped 11 points due to fraudulent activity under her name.

In defense, the NBEO filed a motion on October 22 to dismiss the complaints pursuant to Federal Rules of Civil Procedure 12(b) (1) , for lack of Article III (Constitutional) standing to sue. The NBEO also successfully moved to consolidate the Hutton and Mizrahi complaints. In 2017, the District Court issued an opinion dismissing both complaints for lack of subject matter jurisdiction.

The Fourth Circuit Court of Appeals vacated and remanded this holding because the District Court improperly applied the Fourth Circuit’s rule concerning a 12(b) (1) dismissal.

Applying the Fourth Circuit’s rule from Beck v. McDonald, the Court of Appeals held that the plaintiffs possessed good Article III standing because they met the following elements: 1) they suffered an injury-in-fact when their sensitive information was stolen, suffered damage to their credit scores, and had to spend time undoing the damage; 2) there is a causal connection between the injury and the defendant’s conduct since both complaints make a clear logical connection as to why stolen information from the NBEO damaged the plaintiffs; and 3) the injury was likely redressable by a favorable judicial decision.

Overall, the Court of Appeal’s decision was weighed in favor of the plaintiffs because the trial is still at the pleading stage. At this point in evaluating whether to dismiss a complaint, a court must view factual allegations in the most favorable light to the plaintiff. Verification of any damaging conduct may be carried out during the subsequent discovery phase. Thus, the plaintiffs met the necessary burden to move from the pleading phase to the discovery phase.