United States District Court, D. Colorado
TODD GORDON, MARC MERCER, KRISTEN MERCER, KRISTIN BAKER MICHELLE FOWLER, GREG LAWSON and JUDY CONARD, Plaintiffs,
v.
CHIPOTLE MEXICAN GRILL, INC., Defendant.
ORDER AFFIRMING IN PART AND REJECTING IN PART THE
AUGUST 1, 2018 RECOMMENDATION OF UNITED STATES MAGISTRATE
JUDGE AND GRANTING IN PART AND DENYING IN PART
DEFENDANT'S MOTION TO DISMISS
CHRISTINE M. ARGUELLO, UNITED STATES DISTRICT JUDGE
This
matter is before the Court on the August 1, 2018
Recommendation by United States Magistrate Judge Mark L.
Carman (Doc. # 73), in which he recommended that the Court
grant in part and deny in part Defendant Chipotle Mexican
Grill, Inc.'s Motion to Dismiss (Doc. # 43). Plaintiffs,
a putative class of Defendant's customers, and Defendant
object to portions to the Recommendation. (Doc. ## 76, 77.)
For the reasons described below, the Court adopts in part and
rejects in part the Recommendation and grants in part and
denies in part Defendant's Motion to Dismiss.
I.
BACKGROUND
Defendant
operates more than 2, 000 fast-casual Chipotle burrito
restaurants across the United States and two quick-serve
Pizzeria Locale pizza locations in Colorado. (Doc. # 36 at
11.) It is incorporated in Delaware and maintains its
principal place of business in Denver, Colorado.
(Id.) Defendant experienced a data breach in early
2017, see (Doc. # 43 at 2); between March 24, 2017,
and April 18, 2017, hackers utilized malicious software to
access the point-of-sale systems at Defendant's locations
and stole customers' payment card information and other
personal information (the “Chipotle Data Breach”)
(id.). Defendant issued a security notice on April
25, 2017, to alert its customers to the Chipotle Data Breach:
We want to make our customers aware that we recently detected
unauthorized activity on the network that supports payment
processing for purchases made in our restaurants. . . . We
anticipate providing notification to any affected customers
as we get further clarity about the specific timeframes and
restaurant locations that may have been affected. Consistent
with good practices, consumers should closely monitor their
payment card statements. If anyone sees an unauthorized
charge, they should immediately notify the bank that issued
the card. Payment card network rules generally state that
cardholders are not responsible for such charges.
(Doc. # 36 at 13-14.)
Plaintiffs
allege that they used payment cards at Defendant's
restaurants in the states in which they reside[1] during the
Chipotle Data Breach and that their personally identifiable
information (“PII”) was compromised by the
breach. (Id. at 1-2.) Plaintiffs bring this action
“individually and on behalf of others similarly
situated” and seek to recover damages for their alleged
loss of time and money “resolving fraudulent charges .
. . [and] obtaining protections against future identity
theft, ” loss of control “over the value of
personal information, and financial losses “related to
purchases made at Chipotle that Plaintiffs . . . would have
never made, ” to “fraudulent charges, ” and
to “exceeding credit and debit card limits and
balances.” (Id. at 29.) They bring several
tort, contract, statutory, and equitable claims, apparently
under the laws of the states in which they reside and made
their purchases:
1. Negligence (id. at 40-42);
2. Negligence per se (id. at 42-44);
3. Violation of the Colorado Consumer Protection Act, C.R.S.
§ 6-1-105(1)(I), et seq., (id. at 45-50);
4. Breach of implied contract (id. at 50-52);
5. Unjust enrichment (id. at 52-53);
6. Violation of the Arizona Consumer Fraud Act, Ariz. Rev.
Stat. §§ 44-1521, et seq., by Plaintiff Gordon
(id. at 53-56);
7. Violation of the California Customer Records Act, Cal.
Civ. Code § 1798.80, et seq, by Plaintiffs Baker and
Conard and the Mercer Plaintiffs (id. at 57-59);
8. Violation of the California Unfair Competition Law, Cal
Bus. & Prof. Code § 17200, et seq, by Plaintiffs
Baker and Conard and the Mercer Plaintiffs (id. at
59-63);
9. Violation of the California Consumers Legal Remedies Act,
Cal. Civ. Code §§ 1750, et seq., by Plaintiffs
Baker and Conard and the Mercer Plaintiffs (id. at
63-66);
10. Violation of the Illinois Consumer Fraud and Deceptive
Practices Act, 815 Ill. Comp. Stat. §§ 505/1, et
seq., by Plaintiff Fowler (id. at 66-70);
11. Violations of the Illinois Uniform Deceptive Trade
Practices Act, 815 Ill. Comp. Stat. §§ 510/1, et
seq., by Plaintiff Fowler (id. at 70-71); and
12. Violation of the Missouri Merchandising Practices Act,
Mo. Ann. Stat. § 407.020(1), et seq., by Plaintiff
Lawson (id. at 71-73).
Plaintiffs
will presumably seek class certification pursuant to Federal
Rule of Civil Procedure 23.[2] See (id. at 34-35.)
Defendant
filed its Motion to Dismiss on January 22, 2018. (Doc. # 43.)
First, Defendant asserts that Plaintiffs Baker and Lawson do
not have standing because they have not alleged an injury in
fact and must be dismissed pursuant to Rule 12(b)(1).
(Id. at 3-8.) Second, it asserts that the remaining
Plaintiffs' claims fail to state a claim for relief and
must be dismissed pursuant to Rule 12(b)(6). (Id. at
8-26.) Plaintiffs filed their Response on February 21, 2018
(Doc. # 57), to which Defendant replied on March 14, 2018
(Doc. # 64.)
Magistrate
Judge Carman issued his Recommendation on Defendant's
Motion to Dismiss on August 1, 2018. (Doc. # 73.) As the
Court will discuss in further detail, Magistrate Judge Carman
recommended:
• Granting in part and denying in part the motion to
dismiss Plaintiffs Baker and Lawson for lack of standing, to
dismiss only the allegations of independent value in
Plaintiffs' stolen PII and overpayment;
• Granting the motion to dismiss Counts 1, 2, 3, and 11;
• Denying the motion to dismiss Counts 4, 6, 9, 10, and
12, and
• Granting in part and denying in part the motion to
dismiss Counts 5, 7, and 8.
(Id. at 60.) Both Plaintiffs and Defendant filed
Objections to the Recommendation on August 15, 2018. (Doc. ##
76, 77.) They timely responded to one another's
Objections on August 29, 2018. (Doc. ## 80, 81.)
II.
APPLICABLE LEGAL PRINCIPLES
A.
STANDARD OF REVIEW: REVIEW OF A RECOMMENDATION
When a
magistrate judge issues a recommendation on a dispositive
matter, Federal Rule of Civil Procedure 72(b)(3) requires
that the district judge “determine de novo any
part of the magistrate judge's [recommended] disposition
that has been properly objected to.” An objection is
properly made if it is both timely and specific. United
States v. One Parcel of Real Property Known As 2121 East 30th
Street, 73 F.3d 1057, 1059 (10th Cir. 1996). In
conducting its review, “[t]he district judge may
accept, reject, or modify the recommended disposition;
receive further evidence; or return the matter to the
magistrate judge with instructions.” Fed.R.Civ.P.
72(b)(3).
B.
RULE 12(B)(1)
Dismissal
pursuant to Rule 12(b)(1) is appropriate if the Court lacks
subject matter jurisdiction over claims for relief asserted
in the complaint. “The burden of establishing subject
matter jurisdiction is on the party asserting
jurisdiction.” Port City Props. v. Union Pac. R.R.
Co.24, 518 F.3d 1186, 1189 (10th Cir. 2008). Rule
12(b)(1) challenges are generally presented in one of two
forms: “[t]he moving party may (1) facially attack the
complaint's allegations as to the existence of subject
matter jurisdiction, or (2) go beyond allegations contained
in the complaint by presenting evidence to challenge the
factual basis upon which subject matter jurisdiction
rests.” Merrill Lynch Bus. Fin. Servs., Inc. v.
Nudell, 363 F.3d 1072, 1074 (10th Cir. 2004) (quoting
Maestas v. Lujan, 351 F.3d 1001, 1013 (10th Cir.
2003)); see Ruiz v. McDonnell, 299 F.3d 1173, 1180
(10th Cir. 2002). When reviewing a facial attack, a court
takes the allegations in the complaint as true, but when in
reviewing a factual attack, the court does not presume the
truthfulness of the complaint's factual allegations and
may consider affidavits or other documents to resolve
jurisdictional facts. Holt v. United States, 46 F.3d
1000, 1002-03 (10th Cir. 1995). Defendant's Motion to
Dismiss launches a facial attack on this Court's subject
matter jurisdiction. See (Doc. # 73 at 4.)
Defendant
takes issue with the standing of Plaintiffs Baker and Lawson.
(Doc. # 43 at 3.) Article III of the United States
Constitution restricts the federal courts to the adjudication
of “Cases” and “Controversies.” U.S.
Const. art. III, § 2, cl. 1; Steel Co. v. Citizens
for a Better Env't, 523 U.S. 83, 102 (1998). The
standing inquiry ensures that a plaintiff has a sufficient
personal stake in the dispute to ensure the existence of a
live case or controversy that renders judicial resolution
appropriate. See Allen v. Wright, 468 U.S. 737,
750-51 (1984). To establish Article III standing, a plaintiff
must show that: (1) he has suffered an “injury in
fact”; (2) the injury is fairly traceable to the
challenged action of the defendant; and (3) it is likely, as
opposed to merely speculative, that the injury will be
redressed by the relief requested. Friends of the Earth,
Inc. v. Laidlaw Envtl. Servs., Inc., 528 U.S. 167, 180
(2000). Defendant contends that Plaintiffs Baker and Lawson
cannot satisfy the first element of standing-injury in fact.
See (Doc. # 43 at 3.)
To
establish injury in fact, a plaintiff is required to show an
injury that is (a) concrete and particularized, and (b)
actual or imminent, not conjectural or hypothetical.
Tandy v. City of Wichita, 380 F.3d 1277, 1283 (10th
Cir. 2004). The plaintiff must be suffering a continuing
injury or be under a real and immediate threat of being
injured in the future. City of Los Angeles v. Lyons,
461 U.S. 95, 101-02, 107 n.8 (1983). A threatened injury must
be “certainly impending” or
“likely”-not merely speculative. See
Tandy, 380 F.3d at 1283; see also Clinton v. City of
New York, 524 U.S. 417, 433 (1998). While general
factual allegations of injury may suffice, Lujan v.
Defenders of Wildlife, 504 U.S. 555, 561 (1992),
conclusory allegations are insufficient; the plaintiff
“must adequately allege a plausible claim of injury,
” COPE v. Kan. State Bd. of Educ., 821 F.3d
1215, 1221 (10th Cir. 2016).
C.
RULE 12(B)(6)
The
Court may dismiss a complaint for failure to state a claim
upon which relief can be granted. Fed. R. Civ. Pro. 12(b)(6).
To withstand a Rule 12(b)(6) motion to dismiss, “a
complaint must contain sufficient factual matter, accepted as
true, to ‘state a claim to relief that is plausible on
its face.'” Ashcroft v. Iqbal, 556 U.S.
662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly,
550 U.S. 544, 570 (2007)). A claim is facially plausible
“when the plaintiff pleads factual content that allows
the court to draw the reasonable inference that the defendant
is liable for the misconduct alleged.” Id.
(citing Twombly, 550 U.S. at 556). The scope of the
allegations may not be “so general that they encompass
a wide swath of conduct, much of it innocent” or else
the plaintiff has “‘not nudged [his] claims
across the line from conceivable to plausible.'”
Robbins v. Oklahoma, 519 F.3d 1242, 1247 (10th Cir.
2008) (quoting Twombly, 550 U.S. at 570). A
plaintiff may not rely on mere labels or conclusions,
“and a formulaic recitation of the elements of a cause
of action will not do.” Twombly, 550 U.S. at
555. The ultimate duty of the court is to “determine
whether the complaint sufficiently alleges facts supporting
all the elements necessary to establish an entitlement to
relief under the legal theory proposed.” Forest
Guardians v. Forsgren, 478 F.3d 1149, 1160 (10th Cir.
2007).
III.
ANALYSIS
Between
Plaintiffs' Objections (Doc. # 76) and Defendant's
Objections (Doc. # 77), the parties object to Magistrate
Judge Carman's analysis of nine of the twelve claims. The
Court will begin by addressing the standing of Plaintiffs
Baker and Lawson under Rule 12(b)(1) and will then address
each claim under Rule 12(b)(6) in the order that Plaintiffs
assert them.
A.
RULE 12(B)(1) MOTION: STANDING OF PLAINTIFFS BAKER AND
LAWSON
Plaintiff
Baker alleges in the Complaint that a few days after she used
her debit card to purchase food at a Chipotle restaurant,
“fraudulent activity appeared on the same debit card
account.” (Doc. # 36 at 7.) She states:
On April 3, 2017, three unauthorized charges were attempted
on Plaintiff [Baker]'s debit card. She learned about the
attempts via email alerts from her bank, for online purchases
of $69.99, $19.99, and $49.99, respectively. The charge of
$49.99 went through, but the others were declined.
Ultimately, Plaintiff [Baker]'s bank refunded the
unauthorized charge.
(Id.)
Plaintiff
Lawson similarly alleges that he used his debit card,
“the primary card [he] uses for daily expenditures
because of the cash back rewards program, ” to purchase
food at a Chipotle restaurant. (Id. at 9.) He
explains:
Within a few weeks of this visit, Plaintiff Lawson was
contacted by the issuing bank and advised that his debit card
had been compromised as a result of the Chipotle Data Breach.
The bank informed Plaintiff Lawson that it would be closing
the account, opening a new account, and re-issuing a new
debit card. Because Plaintiff Lawson had upcoming travel
plans, he paid $45 to have the new debit card expedited to
him. Unfortunately, despite the attempt to expedite and the
money expenditure, a new card did not arrive before he left
town. Therefore, Plaintiff Lawson did not have his debit card
to use for his travel expenses as he planned. As a result of
having been victimized by the Chipotle Data Breach, Plaintiff
Lawson has been required to spend time communicating with his
bank regarding his compromised card, account transfer, and
replacement card.
(Id. at 9-10.)
Additionally,
all Plaintiffs allege losses “[a]s a direct and
proximate result” of the Chipotle Data Breach,
including:
loss of time and money resolving fraudulent charges; loss of
time and money obtaining protections against future identity
theft; financial losses related to the purchases made at
Chipotle that Plaintiffs and Class members would have never
made had they known of Chipotle's careless approach to
cybersecurity; lost control over the value of personal
information; unreimbursed losses relating to fraudulent
charges; losses and fees relating to exceeding credit and
debit card limits and balances, and bounced transactions;
harm resulting from damaged credit scores and information;
and other harm resulting from the unauthorized use or threat
of unauthorized use of stolen Card Information.
(Id. at 29-30.)
Defendant
argues in its Motion to Dismiss that Plaintiffs Baker and
Lawson “have not suffered an injury in fact that is
fairly traceable to [Defendant's] ...