Gordon v. Chipotle Mexican Grill, Inc.

          ORDER AFFIRMING IN PART AND REJECTING IN PART THE AUGUST 1, 2018 RECOMMENDATION OF UNITED STATES MAGISTRATE JUDGE AND GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS

          CHRISTINE M. ARGUELLO, UNITED STATES DISTRICT JUDGE

         This matter is before the Court on the August 1, 2018 Recommendation by United States Magistrate Judge Mark L. Carman (Doc. # 73), in which he recommended that the Court grant in part and deny in part Defendant Chipotle Mexican Grill, Inc.'s Motion to Dismiss (Doc. # 43). Plaintiffs, a putative class of Defendant's customers, and Defendant object to portions to the Recommendation. (Doc. ## 76, 77.) For the reasons described below, the Court adopts in part and rejects in part the Recommendation and grants in part and denies in part Defendant's Motion to Dismiss.

         I. BACKGROUND

         Defendant operates more than 2, 000 fast-casual Chipotle burrito restaurants across the United States and two quick-serve Pizzeria Locale pizza locations in Colorado. (Doc. # 36 at 11.) It is incorporated in Delaware and maintains its principal place of business in Denver, Colorado. (Id.) Defendant experienced a data breach in early 2017, see (Doc. # 43 at 2); between March 24, 2017, and April 18, 2017, hackers utilized malicious software to access the point-of-sale systems at Defendant's locations and stole customers' payment card information and other personal information (the “Chipotle Data Breach”) (id.). Defendant issued a security notice on April 25, 2017, to alert its customers to the Chipotle Data Breach:

We want to make our customers aware that we recently detected unauthorized activity on the network that supports payment processing for purchases made in our restaurants. . . . We anticipate providing notification to any affected customers as we get further clarity about the specific timeframes and restaurant locations that may have been affected. Consistent with good practices, consumers should closely monitor their payment card statements. If anyone sees an unauthorized charge, they should immediately notify the bank that issued the card. Payment card network rules generally state that cardholders are not responsible for such charges.

(Doc. # 36 at 13-14.)

         Plaintiffs allege that they used payment cards at Defendant's restaurants in the states in which they reside^[1] during the Chipotle Data Breach and that their personally identifiable information (“PII”) was compromised by the breach. (Id. at 1-2.) Plaintiffs bring this action “individually and on behalf of others similarly situated” and seek to recover damages for their alleged loss of time and money “resolving fraudulent charges . . . [and] obtaining protections against future identity theft, ” loss of control “over the value of personal information, and financial losses “related to purchases made at Chipotle that Plaintiffs . . . would have never made, ” to “fraudulent charges, ” and to “exceeding credit and debit card limits and balances.” (Id. at 29.) They bring several tort, contract, statutory, and equitable claims, apparently under the laws of the states in which they reside and made their purchases:

1. Negligence (id. at 40-42);

2. Negligence per se (id. at 42-44);

3. Violation of the Colorado Consumer Protection Act, C.R.S. § 6-1-105(1)(I), et seq., (id. at 45-50);

4. Breach of implied contract (id. at 50-52);

5. Unjust enrichment (id. at 52-53);

6. Violation of the Arizona Consumer Fraud Act, Ariz. Rev. Stat. §§ 44-1521, et seq., by Plaintiff Gordon (id. at 53-56);

7. Violation of the California Customer Records Act, Cal. Civ. Code § 1798.80, et seq, by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 57-59);

8. Violation of the California Unfair Competition Law, Cal Bus. & Prof. Code § 17200, et seq, by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 59-63);

9. Violation of the California Consumers Legal Remedies Act, Cal. Civ. Code §§ 1750, et seq., by Plaintiffs Baker and Conard and the Mercer Plaintiffs (id. at 63-66);

10. Violation of the Illinois Consumer Fraud and Deceptive Practices Act, 815 Ill. Comp. Stat. §§ 505/1, et seq., by Plaintiff Fowler (id. at 66-70);

11. Violations of the Illinois Uniform Deceptive Trade Practices Act, 815 Ill. Comp. Stat. §§ 510/1, et seq., by Plaintiff Fowler (id. at 70-71); and

12. Violation of the Missouri Merchandising Practices Act, Mo. Ann. Stat. § 407.020(1), et seq., by Plaintiff Lawson (id. at 71-73).

         Plaintiffs will presumably seek class certification pursuant to Federal Rule of Civil Procedure 23.^[2] See (id. at 34-35.)

         Defendant filed its Motion to Dismiss on January 22, 2018. (Doc. # 43.) First, Defendant asserts that Plaintiffs Baker and Lawson do not have standing because they have not alleged an injury in fact and must be dismissed pursuant to Rule 12(b)(1). (Id. at 3-8.) Second, it asserts that the remaining Plaintiffs' claims fail to state a claim for relief and must be dismissed pursuant to Rule 12(b)(6). (Id. at 8-26.) Plaintiffs filed their Response on February 21, 2018 (Doc. # 57), to which Defendant replied on March 14, 2018 (Doc. # 64.)

         Magistrate Judge Carman issued his Recommendation on Defendant's Motion to Dismiss on August 1, 2018. (Doc. # 73.) As the Court will discuss in further detail, Magistrate Judge Carman recommended:

• Granting in part and denying in part the motion to dismiss Plaintiffs Baker and Lawson for lack of standing, to dismiss only the allegations of independent value in Plaintiffs' stolen PII and overpayment;

• Granting the motion to dismiss Counts 1, 2, 3, and 11;

• Denying the motion to dismiss Counts 4, 6, 9, 10, and 12, and

• Granting in part and denying in part the motion to dismiss Counts 5, 7, and 8.

(Id. at 60.) Both Plaintiffs and Defendant filed Objections to the Recommendation on August 15, 2018. (Doc. ## 76, 77.) They timely responded to one another's Objections on August 29, 2018. (Doc. ## 80, 81.)

         II. APPLICABLE LEGAL PRINCIPLES

         A. STANDARD OF REVIEW: REVIEW OF A RECOMMENDATION

         When a magistrate judge issues a recommendation on a dispositive matter, Federal Rule of Civil Procedure 72(b)(3) requires that the district judge “determine de novo any part of the magistrate judge's [recommended] disposition that has been properly objected to.” An objection is properly made if it is both timely and specific. United States v. One Parcel of Real Property Known As 2121 East 30th Street, 73 F.3d 1057, 1059 (10th Cir. 1996). In conducting its review, “[t]he district judge may accept, reject, or modify the recommended disposition; receive further evidence; or return the matter to the magistrate judge with instructions.” Fed.R.Civ.P. 72(b)(3).

         B. RULE 12(B)(1)

         Dismissal pursuant to Rule 12(b)(1) is appropriate if the Court lacks subject matter jurisdiction over claims for relief asserted in the complaint. “The burden of establishing subject matter jurisdiction is on the party asserting jurisdiction.” Port City Props. v. Union Pac. R.R. Co.24, 518 F.3d 1186, 1189 (10th Cir. 2008). Rule 12(b)(1) challenges are generally presented in one of two forms: “[t]he moving party may (1) facially attack the complaint's allegations as to the existence of subject matter jurisdiction, or (2) go beyond allegations contained in the complaint by presenting evidence to challenge the factual basis upon which subject matter jurisdiction rests.” Merrill Lynch Bus. Fin. Servs., Inc. v. Nudell, 363 F.3d 1072, 1074 (10th Cir. 2004) (quoting Maestas v. Lujan, 351 F.3d 1001, 1013 (10th Cir. 2003)); see Ruiz v. McDonnell, 299 F.3d 1173, 1180 (10th Cir. 2002). When reviewing a facial attack, a court takes the allegations in the complaint as true, but when in reviewing a factual attack, the court does not presume the truthfulness of the complaint's factual allegations and may consider affidavits or other documents to resolve jurisdictional facts. Holt v. United States, 46 F.3d 1000, 1002-03 (10th Cir. 1995). Defendant's Motion to Dismiss launches a facial attack on this Court's subject matter jurisdiction. See (Doc. # 73 at 4.)

         Defendant takes issue with the standing of Plaintiffs Baker and Lawson. (Doc. # 43 at 3.) Article III of the United States Constitution restricts the federal courts to the adjudication of “Cases” and “Controversies.” U.S. Const. art. III, § 2, cl. 1; Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 102 (1998). The standing inquiry ensures that a plaintiff has a sufficient personal stake in the dispute to ensure the existence of a live case or controversy that renders judicial resolution appropriate. See Allen v. Wright, 468 U.S. 737, 750-51 (1984). To establish Article III standing, a plaintiff must show that: (1) he has suffered an “injury in fact”; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by the relief requested. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc., 528 U.S. 167, 180 (2000). Defendant contends that Plaintiffs Baker and Lawson cannot satisfy the first element of standing-injury in fact. See (Doc. # 43 at 3.)

         To establish injury in fact, a plaintiff is required to show an injury that is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical. Tandy v. City of Wichita, 380 F.3d 1277, 1283 (10th Cir. 2004). The plaintiff must be suffering a continuing injury or be under a real and immediate threat of being injured in the future. City of Los Angeles v. Lyons, 461 U.S. 95, 101-02, 107 n.8 (1983). A threatened injury must be “certainly impending” or “likely”-not merely speculative. See Tandy, 380 F.3d at 1283; see also Clinton v. City of New York, 524 U.S. 417, 433 (1998). While general factual allegations of injury may suffice, Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992), conclusory allegations are insufficient; the plaintiff “must adequately allege a plausible claim of injury, ” COPE v. Kan. State Bd. of Educ., 821 F.3d 1215, 1221 (10th Cir. 2016).

         C. RULE 12(B)(6)

         The Court may dismiss a complaint for failure to state a claim upon which relief can be granted. Fed. R. Civ. Pro. 12(b)(6). To withstand a Rule 12(b)(6) motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). The scope of the allegations may not be “so general that they encompass a wide swath of conduct, much of it innocent” or else the plaintiff has “‘not nudged [his] claims across the line from conceivable to plausible.'” Robbins v. Oklahoma, 519 F.3d 1242, 1247 (10th Cir. 2008) (quoting Twombly, 550 U.S. at 570). A plaintiff may not rely on mere labels or conclusions, “and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555. The ultimate duty of the court is to “determine whether the complaint sufficiently alleges facts supporting all the elements necessary to establish an entitlement to relief under the legal theory proposed.” Forest Guardians v. Forsgren, 478 F.3d 1149, 1160 (10th Cir. 2007).

         III. ANALYSIS

         Between Plaintiffs' Objections (Doc. # 76) and Defendant's Objections (Doc. # 77), the parties object to Magistrate Judge Carman's analysis of nine of the twelve claims. The Court will begin by addressing the standing of Plaintiffs Baker and Lawson under Rule 12(b)(1) and will then address each claim under Rule 12(b)(6) in the order that Plaintiffs assert them.

         A. RULE 12(B)(1) MOTION: STANDING OF PLAINTIFFS BAKER AND LAWSON

         Plaintiff Baker alleges in the Complaint that a few days after she used her debit card to purchase food at a Chipotle restaurant, “fraudulent activity appeared on the same debit card account.” (Doc. # 36 at 7.) She states:

On April 3, 2017, three unauthorized charges were attempted on Plaintiff [Baker]'s debit card. She learned about the attempts via email alerts from her bank, for online purchases of $69.99, $19.99, and $49.99, respectively. The charge of $49.99 went through, but the others were declined. Ultimately, Plaintiff [Baker]'s bank refunded the unauthorized charge.

(Id.)

         Plaintiff Lawson similarly alleges that he used his debit card, “the primary card [he] uses for daily expenditures because of the cash back rewards program, ” to purchase food at a Chipotle restaurant. (Id. at 9.) He explains:

Within a few weeks of this visit, Plaintiff Lawson was contacted by the issuing bank and advised that his debit card had been compromised as a result of the Chipotle Data Breach. The bank informed Plaintiff Lawson that it would be closing the account, opening a new account, and re-issuing a new debit card. Because Plaintiff Lawson had upcoming travel plans, he paid $45 to have the new debit card expedited to him. Unfortunately, despite the attempt to expedite and the money expenditure, a new card did not arrive before he left town. Therefore, Plaintiff Lawson did not have his debit card to use for his travel expenses as he planned. As a result of having been victimized by the Chipotle Data Breach, Plaintiff Lawson has been required to spend time communicating with his bank regarding his compromised card, account transfer, and replacement card.

(Id. at 9-10.)

         Additionally, all Plaintiffs allege losses “[a]s a direct and proximate result” of the Chipotle Data Breach, including:

loss of time and money resolving fraudulent charges; loss of time and money obtaining protections against future identity theft; financial losses related to the purchases made at Chipotle that Plaintiffs and Class members would have never made had they known of Chipotle's careless approach to cybersecurity; lost control over the value of personal information; unreimbursed losses relating to fraudulent charges; losses and fees relating to exceeding credit and debit card limits and balances, and bounced transactions; harm resulting from damaged credit scores and information; and other harm resulting from the unauthorized use or threat of unauthorized use of stolen Card Information.

(Id. at 29-30.)

         Defendant argues in its Motion to Dismiss that Plaintiffs Baker and Lawson “have not suffered an injury in fact that is fairly traceable to [Defendant's] ...