PERKINS

v.

WELLDYNERX, LLC

Defendant. ________________________________/

ORDER GRANTING IN PART “DEFENDANT’S MOTION TO DISMISS PLAINTIFF’S CLASS ACTION COMPLAINT”

This matter is before the Court on “Defendant’s Motion to Dismiss Plaintiff’s Class Action Complaint and Memorandum of Law in Support,” filed November 9, 2022. (Doc. 12). Plaintiff filed his response in opposition on January 13, 2023. (Doc. 25). After reviewing the motion, response, court file, and record, the Court finds as follows: Background¹ Defendant WellDyneRx, LLC is a pharmacy benefit manager that assists consumers with their prescription medication needs, filling more than 15 million prescriptions each year. On December², 2021, Defendant became aware of a

2021. In April 2022, Defendant began notifying potentially affected individuals about the incident. On September 6, 2022, Plaintiff Ernest Perkins filed this purported class action complaint alleging that some of his sensitive personal information was impacted by the data breach. He asserts that he has spent considerable time and effort monitoring his accounts to protect himself from identity theft, and that he is experiencing feelings of anxiety, sleep disruption, stress, and fear for his personal security amidst uncertainty over what financial and medical information was revealed in the data breach. The complaint asserts four claims: negligence, negligence per se, breach of implied contract, and unjust enrichment. Defendant moves to dismiss the complaint for lack of standing. Legal Standard Federal Rule of Civil Procedure 8(a) requires that a complaint contain “a short and plain statement of the claim showing the [plaintiff] is entitled to relief.” Fed. R. Civ. P. 8(a). While Rule 8(a) does not demand “detailed factual allegations,” it does require “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In order to survive a motion to dismiss, factual allegations must be sufficient “to state a claim to relief that is plausible on its face.” Id. at 570. When deciding a Rule 12(b)(6) motion, review is generally limited to the four corners of the complaint. Rickman v. Precisionaire, Inc., 902 F. Supp. 232, 233 (M.D. Fla. 1995). Furthermore, when reviewing a complaint for facial sufficiency, a court “must accept [a] [p]laintiff’s well pleaded facts as true, and construe the [c]omplaint in the light most favorable to the [p]laintiff.” Id. (citing Scheuer v. Rhodes, 416 U.S. 232, 236 (1974)). “[A] motion to dismiss should concern only the complaint’s legal sufficiency, and is not a procedure for resolving factual questions or addressing the merits of the case.” Am. Int’l Specialty Lines Ins. Co. v. Mosaic Fertilizer, LLC, 8:09-cv-1264-T-26TGW, 2009 WL 10671157, at *2 (M.D. Fla. Oct. 9, 2009) (Lazzara, J.). Analysis In its motion, Defendant argues that the Court lacks subject matter jurisdiction because the constitutional standing requirements of Article III are not satisfied. To have standing, “[t]he plaintiff must have (1) suffered an injury in fact,

(2) that is traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). Here, Defendant challenges whether Plaintiff has stated a cognizable injury in fact. “Only an alleged harm that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical’ is enough to show that a party ‘has a case or controversy rather than, say, a strong and abiding interest in an issue, or a desire to obtain attorney’s fees.’” Hunstein v. Preferred Collection and Mgmt. Servs., Inc., 48 F. 4th 1236, 1242 (11th Cir. 2022) (quoting TransUnion LLC v. Ramirez, 141

S. Ct. 2190, 2206 (2021)). Upon review, the allegations of the complaint do not describe an injury in fact that supports Article III standing. Plaintiff asserts only that a data breach occurred, but “[e]vidence of a mere data breach does not, standing alone, satisfy the requirements of Article III standing.” Holmes v. Villages Tri-County Medical Ctr., Inc., No. 5:21-cv-508-JA-PRL, 2023 WL 315019, at *3 (M.D. Fla. Jan 19, 2023) (quoting Tsao v. Captiva MVP Rest. Partners, LLC, 986 F. 3d 1332, 1344 (11th Cir. 2021)). The generalities and speculations alleged in the complaint, such as the increased risk of identity theft and other crimes, does not establish injury-in-fact. See id. at *4. Importantly, Plaintiff claims that he has been exposed to an increased risk of identity theft, but he only speculates as to whether his or anyone else’s information was accessed and does not allege any facts to show that this risk is

“certainly impending.” See id. Although Plaintiff is not required to allege actual misuse to establish standing after a data breach, “without specific evidence of some misuse of class members’ data, a named plaintiff’s burden to plausibly plead factual allegations sufficient to show that the threatened harm of future identity theft was ‘certainly impending’ – or that there was a ‘substantial risk’ of such harm – will be difficult to meet.” Id. at *4 (quoting Tsao, 986 F. 3d at 1343-44). Plaintiff “cannot rely on a risk of future harm for [his] damages claims ‘unless the exposure to the risk of future harm itself causes a separate concrete harm.’” Id. at *5 (quoting TransUnion, 141 S. Ct. at 2211). Plaintiff does not allege a separate concrete harm here, and he has not sufficiently asserted any substantial and imminent risk of future harm. Plaintiff asserts he has been damaged by the loss of value of his PHI and PII. But he does not explain how his personal information has lost value nor could he, without knowing whether ransomware attackers or others actually possess that information. See id. And he asserts neither the actual use nor attempted use of his or anyone else’s personal information. See id. Plaintiff also attempts to allege harm by having to take action to protect against future identity theft, but he “cannot manufacture standing merely by inflicting harm on [himself] based on [his] fears of hypothetical future harm that is not certainly impending.”² Id. (quoting Clapper v. Amnesty Intern. USA, 568 U.S. 398, 416 (2013)). In the response in opposition, Plaintiff argues that the disclosure of medical information is similar to the common law tort of “disclosure of private information,” which could amount to a concrete injury. However, “finding a common law analog for harm is part of the analysis in cases involving ‘bare’ statutory violations . . . not cases like this one where the [plaintiff’s] claims are already common law causes of

a A Yh ( -TOMBARBER i (asstsi‘“‘<‘:;

UNITED STATES DISTRICT JUDGE