Enslin v. Coca-Cola Co.

District Court, E.D. Pennsylvania
136 F.Supp.3d 654 (2015)

ELI5:

Rule of Law:

A plaintiff has Article III standing in a data breach case when they allege actual misuse of their stolen personal information resulting in concrete financial losses and time spent mitigating the harm, not merely a speculative risk of future identity theft.

Facts:

In 1996, Shane K. Enslin was hired by Keystone Coca-Cola Bottling Company ('Keystone Coke').
As a condition of employment, Enslin provided his Personal Identification Information (PII), including his Social Security number, bank account information, and credit card numbers, which Keystone Coke stored in an unencrypted format on laptop computers.
Enslin ended his employment with Keystone Coke in 2007.
Over a nearly six-year period between 2007 and 2013, fifty-five laptops containing the PII of Enslin and approximately 74,000 other current and former employees were stolen from a Coca-Cola subsidiary.
An employee, Thomas William Rogers, was later identified as responsible for the thefts.
Several months after being notified of the data breach in February 2014, Enslin became a victim of identity theft.
The identity theft included fraudulent purchases charged to Enslin's accounts, theft of funds from his checking account, attempts to open new credit cards in his name, and an individual using his identity to obtain a job at UPS.
These incidents caused Enslin to incur financial losses, including a $17 bank fee, and to expend numerous hours attempting to resolve the fraudulent activities.

Procedural Posture:

Shane K. Enslin filed a class action complaint against The Coca-Cola Company and several related entities ('the Coke Defendants') in the United States District Court for the Eastern District of Pennsylvania, a federal trial court.
The Coke Defendants filed a Motion to Dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction (standing) and 12(b)(6) for failure to state a claim.

Premium Content

Subscribe to Lexplug to view the complete brief

You're viewing a preview with Rule of Law, Facts, and Procedural Posture

Issue:

Does a plaintiff in a data breach case have Article III standing to sue when they allege that their stolen personal information was actually misused, resulting in financial loss and other concrete harms?

Opinions:

Majority - Joseph F. Leeson, Jr.

Yes, a plaintiff in a data breach case has Article III standing when they allege their stolen personal information was actually misused, resulting in financial loss and other concrete harms. The court held that Enslin suffered a sufficient injury-in-fact because his harms were not speculative or hypothetical future risks, but ongoing, palpable harms. Unlike plaintiffs in prior cases like Reilly v. Ceridian Corp., who only faced an increased risk of future harm, Enslin alleged actual theft of funds, unauthorized use of credit cards, and the unauthorized opening of new accounts. These constitute a concrete and particularized injury. The court also found a sufficient causal connection, reasoning that the harm was 'fairly traceable' to the Coke Defendants' loss of sensitive PII like Enslin's Social Security and bank account numbers. However, the court dismissed most of Enslin's substantive claims, including negligence (barred by the economic loss doctrine), fraud (failed to meet pleading particularity), and violation of the Driver's Privacy Protection Act (theft is not a 'knowing disclosure'). The court allowed Enslin's claims for breach of express contract, breach of implied contract, and unjust enrichment to proceed.

Analysis:

This decision clarifies the injury-in-fact requirement for standing in data breach litigation within the Third Circuit, drawing a distinct line between cases based on speculative future harm and those involving actual, realized identity theft. By distinguishing the facts from the precedent set in Reilly v. Ceridian Corp., the court provides a clear roadmap for plaintiffs on how to plead a concrete injury sufficient to survive a motion to dismiss. The opinion demonstrates that while establishing federal standing is possible for victims of actual identity theft, state law doctrines like the economic loss rule remain significant hurdles for tort-based claims seeking recovery for purely financial damages.

Gunnerbot

AI-powered case assistant

Loaded: Enslin v. Coca-Cola Co. (2015)

Try: "What was the holding?" or "Explain the dissent"