# Oral argument — Rhonda Hutton v. National Board of Examiners > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/argument%3A34285 ## Record - **Collection:** Oral argument - **Document type:** Oral argument - **Published:** January 23, 2018 ## Text May it please the Court, good morning. Norman Siegel for the Plaintiff Appellants Drs. Hutton, Kachinda and Mizrahi. We'll refer to the defendant appellee here as the NBEO as we've done throughout the litigation. That may help us along, Your Honor. You could just call them the board. We could also call them the board, that's right. The District Court made two fundamental and reversible errors in dismissing this data breach case below. First, the District Court committed error in holding that plaintiffs had not satisfied the traceability requirement of Article III standing by looking at other potential methods by which this breach could have occurred and weighing one against the other. That was error number one with respect to traceability. Thank you on that one. Could not the data have been stolen by an employee on a thumb drive and given to the employee's boyfriend or girlfriend? And the allegations about whether there was hacking, whether they denied it and then agreed to investigate further, while that could be considered a 12 v. 6 issue, it's also an issue of whether the whole lawsuit is speculative. In other words, what we have basically is data outside of the company. And that's it. And there's speculation that there was a hack. But zero allegations to support that as opposed to a theft, as opposed to some other mechanism by which it happened. I think that's where the court was focusing on that. Judge Niemeyer, I think you're right. And I think the traceability determination, the consideration that the District Court made, leached into its analysis of the second error, which was whether there was injury. It was plainly injury because all of our clients experienced identity theft when they had credit cards through Amazon Chase applied for in their name. That's identity theft. But to your question, we don't agree that there were no allegations that would support that MBO was the source of this breach. No, no, I agree. Well, not about the source of the breach. The data came from the board. Because of the coincidence. You get to prove your case on that. But the question is, is this something attributable to a hack or an internal theft by an employee or whatever? Which makes the case fairly speculative. You go around and all of a sudden you find your data out in the public. Yahoo lost a lot of its data. Target, all these other people. So the data's out there. There are lots of breaches. But the courts that have considered this, whether there can be, what if there's lots of breaches. We had the Equifax breach not too long ago. What the Seventh Circuit said in the Nieman Market case, what Judge Koh looked very closely at in the Anthem case is certainly at the pleading stage. It is not the obligation of the plaintiff, Judge Niemeyer, to exclude other potential mechanisms of breach. It is the plaintiff's obligation to plead plausibly that the MBO had this information, including social security numbers, names, addresses, maiden names, that were used to commit fraud. And that information was compromised because it was used in a data breach. Does it matter how it was compromised? It doesn't. It doesn't. I thought the judge's concern was the complaint didn't plausibly allege that the data was actually mined or breached through the board. There may have been some other entity that might have caused that. The question is how plausible does the allegation have to be? As I understand the allegation here, these optometrists got together on Facebook or some other social media, and there were a sufficient number of them that had the same common denominator with respect to the breach. So is that enough? It is. It's more than that. They all have the same identity fraud. It's all within the same time period. They all conclude, based on the characteristics of the information provided to the handful of optometry organizations out there, that the only source of the information could have been the MBO. And so what the court concluded, we think erroneously, was that that wasn't plausibly pled to be traceable to MBO. Now, Judge Niemeyer asked, as opposed to some other entity, and we know from this court's precedent that the idea of weighing whether it was MBO or some other source is not proper at the pleading stage for purposes of determining plausibility. We look at plausibility on the facts alleged, and here we have a group of main plaintiffs citing information from hundreds of other plaintiffs that say, we've all had the same thing happen to us. The characteristics of this breach indicate it could have only come from MBO. And to Judge Niemeyer's question, the plaintiffs allege, in both cases, that MBO has a non-delegable duty to protect this information. And that's the case, really, in any data breach where you're entrusting your information with an organization like MBO for purposes of taking a board exam. So if it was an employee, because they didn't adequately monitor their employee, or a Russian hacker, or the Chinese government, whomever hacked in or whoever obtained the information, the fault lies, the negligence lies, in the first instance, with MBO, who had an obligation to protect this sensitive information. And as we allege, they should not have been keeping it as long as they were keeping it. So that traceability issue, it's just a plausibility statement. And we think one that's met here. And the summary of allegations supports that. What the court latched onto was a claim that MBO denied that they suffered a data breach. And the court said, well, why shouldn't the MBO's denial be treated the same as these other organizations who denied a data breach? And there's good reasons for that. One is the plaintiffs allege that after initially denying that there was a data breach, the MBO said, wait a minute, we're investigating. That's what the complaints allege. And at the time this was briefed and submitted to the court, there was an ongoing investigation by MBO, not a unqualified denial of breach. But that really doesn't matter because the underlying allegations of breach from MBO are plausibly alleged by these doctors. The other organizations, plaintiffs allege, did not collect Social Security numbers. So even though we think HALC and Woods prevent this weighing of alternative plausible theories of traceability, we think there's more than enough facts to meet the plausibility standard with respect to traceability. So there are both factual problems in that it was not a straight denial from MBO. We established where we pled. MBO is the only one of these organizations that collects Social Security numbers. And there is a legal problem, and that's the HALC-Woods cases that recently emphasized that the court at the pleading stage should not engage in this idea that we're going to weigh alternative explanations or try to determine whether one cause is more probable than another for purposes of determining traceability. And that's where the court failed here with respect to traceability, both on a factual level, but also this legal exercise of weighing alternative theories. The second error was the court's conclusion that the plaintiffs had not adequately alleged injury. And this gets to the Beck case, Judge Diaz. And I think Beck is in a long now extending line of cases trying to put their finger on what injury would be sufficient for data breach. And, of course, the court made that determination in the Fourth Circuit last year. And plaintiff clearly plausibly alleged because of these identity theft that they suffered harm. And what the court ultimately did in Beck was come up basically and looked at all the cases that came before it and said it looks like our sister circuits have basically come up with this standard. Either the plaintiff must plausibly allege that the information was used to commit a fraud or that the target of the intrusion was the data. In Beck you had the laptop, always in the stolen laptop cases, seen a lot of these. Do they want the laptop? Do they want the data? And so the court has this two-part test. It's essentially the same test Judge Schwong came out with in Kahn that said, look, we either need to show there's been harm by use of the data or there was an intent to steal the data. And that's what Beck said. And here we have harm. We have a plausibly alleged identity theft through the application of these Chase Amazon credit cards in our clients' names and hundreds of others. If you look at how the Fourth Circuit in comparing in Beck when it was comparing the Starbucks case, which was another laptop case, it said, look, the Ninth Circuit in that Croter case, the Starbucks case, said, yeah, in Starbucks it was a stolen laptop, but two weeks after the laptop was stolen, a plaintiff alleges his identity was stolen. And, therefore, it met the test that was sort of laid out, if you read Beck and Kahn together, that met the standard to establish injury for Article III purposes. This is a bit of an unusual case, though, because is there really an identity theft? I mean, the card was actually issued in the names of the plaintiffs. There's no question there's identity theft. And I think the district court got tripped up on this as well. It's a crime for me to take your Honor's Social Security number and name and apply for a credit card in your name. I've committed a crime. You are a victim of that crime. There's no question about it. If you read Addias, it's the latest court that talks about the impairment, the D.C. Circuit case, which we submitted as supplemental authority. That expanded beyond Beck, admittedly. It said any time a Social Security number is stolen, it's reasonable to presume there is harm, injury, and for sufficiency of standing under Article III. But Addias also talks about the fact that if somebody's applying for credit in your name, you've suffered a harm. And what happens when somebody applies for credit in your name? Well, the same thing that happened to our plaintiffs. You would put a freeze on your credit. You would spend money to do that. You would probably have to get a PIN number to file your taxes with the IRS. There is a series of damages and harm that I don't think any of these courts, any circuit court, would say does not meet the standard for harm under Article III. So there is very much a harm to these plaintiffs when their identity is stolen through the application of a card. It means that. It's not just that the card showed up in their mail and, wait, I didn't apply for that card, and I think that's what the district court got tripped up on in some of the footnotes in the opinion. He actually seemed to think that it was a good thing. Not a good thing because what it means is that a criminal has your information, went and applied. The criminal did it because they were getting a $50 immediate credit on Amazon. They could buy it, ship it to any address, and this was done serially. And we know, and had discovery allowed in this case, there's much more that follows that type of harm. But the question for this court, as it was in the district court, is have we met our obligation to plausibly allege traceability and injury? And there's little doubt that those allegations, including these applications for credit cards, meet that standard. There's Resnick v. Avmed, another case, which said, look, if you suffer identity theft of this nature, you suffered harm sufficient for Article III. Again, I would refer the court to the recent Addias case, where it makes clear that if your Social Security number is out there, there's credit applied in your name, you suffered a harm sufficient for Article III standing. They tether it to the concept that we don't need to abandon our common sense when we're looking at standing principles under Article III from Twombly and Iqbal. So if you read Beck, and this is completely consistent with Beck, because, again, Beck says either establish that the intent of the intrusion was stealing data. It's assumed in many circuits now, including recently Addias, that says, look, and this is the Seventh Circuit started this in the Neiman Marcus case, and they said, why else is somebody stealing the data if not to commit this type of harm on plaintiffs in our situation? But in Beck, to satisfy that test, you have to show intrusion for purposes of causing harm or actual harm. Here, we would allege we have both, but we certainly have the latter. It's in the disjunctive. You need either or. We clearly have a theft of data used for the purpose of committing identity theft for which our clients are victims. If there's no questions, I'll reserve the rest of my time. Thank you, Mr. Speaker. Ms. McCarrick. I'll just pull this down a little. Good morning, Your Honors. I'm Claudia McCarrick. I represent the National Board of Examiners and Optometry, who we also call MBEO or the board. Traceability is a significant issue in this case. What distinguishes this case from every other reported data privacy class action standing decision is that in those cases, there was an acknowledged data breach. MBEOs. Are you saying that that's an absolute requirement in every case? No, I'm not, Your Honor. And there certainly would be a circumstance where a defendant may not have acknowledged the breach, but when you look at the circumstances, the facts, the other facts applied in the complaint, you can still make the connection. You can still find sufficient facts in the complaint that would demonstrate that nexus between the conduct, the alleged injury and the conduct of the complaint. Right. And that's what Mr. Siegel has just argued and presented to us. What's missing there? What's missing is, in this case, putting aside all the allegations of what people have said on Facebook, sometimes anonymously, and setting aside paragraphs and paragraphs about the general evils of data breach and identity theft. What you have specifically pled by these named plaintiffs, and the named plaintiffs must establish standing. They cannot look to the members of the punitive class. What you have is their account of being caught up in a scheme by criminals to abuse a promotion by Chase Bank and Amazon. That's alleged in the complaint. They flush it out a bit in a footnote to one of their briefs saying there was a promotion whereby if you submitted an application to Chase Bank for an Amazon branded credit card, you would get a $50 credit with Amazon. It's not on the card. It's an actual credit with Amazon. And that was the scheme that these bad actors took advantage of. They submitted applications. They got the $50. That was the point of the scheme. And that's why – So tell me, why isn't it relevant if the plaintiffs, and I'm not suggesting that the allegations are as comprehensive as this, but if they have gone out and surveyed a thousand optometrists, all members of the board, and all victimized by the same scheme and made that allegation, you don't think that's enough? I wouldn't think that's enough because you may be able to go out and interview thousands of lawyers, architects, trash collectors, teachers. If the scheme is broad enough, it's going to encompass optometrists and every other person in every other walk of life. But that doesn't rule out your client as a potential defendant in the case, and all we're getting at here is plausibility, that the issue is that liabilities were later discovered. There is nothing other than the fact that optometrists discussing what happened to optometrists made them see it as an optometry problem. That's not a logical inference. If NBEO may seem like the logical target to a bunch of optometrists, the ABA would be the logical defendant here for a bunch of lawyers who got together on Facebook. That is not a logical inference unless you can make some other nexus to NBEO, and their nexus is the use of Dr. Hutton's maiden name, the use of former married names. Again, there isn't a rational inference that NBEO was the only possessor of that information. We certainly know that NBEO was not the only possessor of name, address, social security number, mother's maiden name. They have to exclude every other possibility in order to make the claim. The problem here is obviously they don't have access to discovery. They have what they have, but you're not suggesting they have to exclude every other possibility. No, but they have to have a rational reason to include NBEO, and that's what's lacking here, a rational reason to include us. The fact that we had a maiden name, every person who Dr. Hutton dealt with in her entire life until she was married had her maiden name. Every institution of higher learning, every bank, every credit card company, even your cable company has your social security number. So saying that NBEO possessed that information does not make them the logical source of this information that was used to apply for the Amazon Chase Visa cards. It doesn't – if NBEO is the logical defendant here, if there's a reasonable inference that this fraud that was perpetrated against Amazon using the identities of these plaintiffs, then any defendant could be hauled into court. Nothing about what the National Board has in its databases supports them as the likely choice for the source of this breach, and that's what makes it different from other cases. You could pick anyone, any organization that collects that information and substitute them for the National Board, and that institution, like the National Board, would be facing the juggernaut of class action litigation. I do want to correct a few statements that have been made before I stood up today. One is that there are allegations that hundreds of cards were issued to members of the optometry profession. That's not in the allegations of these complaints. What the allegations of these complaints say that, as a bare assertion, based on Facebook rumor and suggestion, is that hundreds, perhaps thousands, have had their information exposed. That's a very different allegation than telling the court that there were actually hundreds of false credit cards issued by means of fraud against optometrists. We don't have that allegation. The other understanding about this fraud... If I understand your argument, it is the reason that the plaintiffs point at the board is because the plaintiffs as a group talk to each other, and that if you had lawyers talking to each other, they wouldn't aim it at the board. They'd aim it at some other source that was common to lawyers or bankers or whatever. You're saying it's a coincidence that the Facebook participants happen to be talking to each other because they are optometrists. That's correct, Your Honor. Is that your argument? That is our argument, Your Honor. That's part of their perspective. The universe of affected people by this scheme may be quite broad, and they simply fit into a social community on Facebook that's all about optometry. So they see it as a fraud that was perpetrated against optometrists. Well, all that means is potentially other organizations might have had their information compromised as well. That doesn't necessarily exclude your client from that possibility. Or it means that there was a totally different source for this information. The other assumption that's being made here is that when criminals commit identity theft, they get the information that they use from a single source. There's no reason for them to do that. When we're talking about the difference between speculation and reasonable inferences based on facts, and you start making those inferences based on the supposed conduct of criminals, not just third parties not present before the court, but thieves and criminals, we are kidding ourselves if we think that there are rational inferences we can make about their conduct. In this case, all that is known from the specific facts in this complaint is that criminals used identity information, personal information, to obtain $50 from Amazon. It doesn't appear that their purpose was to actually injure any plaintiff that's been named here. We know that because Dr. Hutton got the credit card. If the point was to harm, to inflict economic harm and fraud on these plaintiffs, these criminals had the wherewithal to change the address to which that credit card was sent. They didn't bother to do that. If we were going to infer anything from the conduct that is actually pled, it's that there was a scheme to make quick money from Amazon to get that $50 before the applications were determined to be fraudulent and rejected, or the cards were canceled and moved on. That does not lead to any type of inference about the board. Was this part of a large fraud scheme that's publicly known, or was this, in other words, if your theory is right, then Chase would have experienced applications from a broad group of people, not just this group of psychologists. There are other reports of this exact fraud. Chase has had this problem, and it has been reported in various news outlets that this particular scheme was one that was run against them and this Amazon offering. And that fact is why the narrow view that's being presented by the optometrists to one another is skewed. They don't have the big picture. But based on... Well, none of that, obviously, is alleged in the complaint, so you're outside of the complaint at this point. I agree, Your Honor. I would not have brought that up. I appreciate that. No, and I appreciate it, too. But let me ask, so you're saying that there's no injury. In addition to this traceability problem, you're saying that the act of opening up an unauthorized credit card was not an injury? That is what I'm saying, Your Honor. And I understand that what constitutes an actual injury in these cases is a determination that has split the circuits. It is yet to be, I think, completely worked to a conclusion. There's no economic harm on the plaintiffs from false charges that they had to make good on. What about the impact on a credit score? So Dr. Masradi had reports in her complaint that she had an 11-point drop in her credit score. She tells us that she was told it would be 60 days before it was corrected. There's no other information in her complaint about that. We don't know if it took her from a high excellent to a so-so excellent. We don't know if it took her from good to fair. She does not tell us that she... You'd find all that out in discovery, wouldn't you? But at this point, she needs to plead actual harm. An 11-point drop in your credit score. It went down. The drop was down. Which may, but may have no consequences, Judge King. None at all. Not with the account that she didn't open. Judge King, I would say it appears that the application had an impact, but that's not the same as harm. There's no indication that she suffered any harm from that temporary 11-point decline. And certainly, there are other cases where allegations are made of harm from a credit score drop. A change in an interest rate on a mortgage. Something to that effect. A real economic consequence. Dr. Misrati does not allege that in this case. The question about what constitutes actual harm in these data breach cases runs the gamut. Obviously, there are cases that require actual economic impact. There are cases out there, and I recognize this, that say the mere exposure of a Social Security number is sufficient to establish harm. That paradigm seems to be coming up more often in the cases and in some dicta, but I don't believe that the law has settled on that as a bright-line test at this point. Nor should it. It seems almost counterintuitive to me that we would come to a place where the mere exposure of a Social Security number at this point would be considered sufficient injury in fact. I think we said in fact that that isn't enough, but we have something more. We have the exposure and the resulting use of the information to open up an account. It's different. In this case, we have neither without traceability. Let's assume that the plaintiff's allegations are correct. That's different than mere exposure. The use of this information without economic harm is insufficient. This is not a case where the use of a Social Security number resulted in any real cost to these defendants, and we know that that was not the point of the fraud. So in many cases, and in many cases where a Social Security number and its exposure is indicative of injury in fact, it's because it's used in a scheme where there's actual harm inflicted on the individuals who are bringing suit. That's not what happened here. What happened is that their Social Security numbers, their personal information, was used to defraud Amazon and not the plaintiffs themselves. And there's no allegation other than a bare assertion that they've been used in other ways without any specificity that their Social Security numbers have been used in any other scheme. It's this one scheme. The economic cost of it did not fall on them. It fell on Amazon. That makes this case different. Social Security numbers are now more widely disseminated due to the $1.5 billion affected by the Yahoo breach, the $147 million affected by the Equifax breach. It seems to me that at this point, Social Security numbers can no longer be a bright line rule, and it has to be something plus, which is an actual economic impact on the individuals who are seeking to be compensated for the exposure of that information. And you don't have that present in this case. I do think, though, that this case is primarily about traceability. It's about confirmation bias by a group of individuals on social media who reinforce one another in their beliefs. There is not in the complaint a pleading of massive credit card fraud against this group, but rather the allegation that they believe that their Social Security numbers or their information was exposed by the board. I'd like to address one other point, and that is the suggestion that there's some sort of moral hazard based in our argument that the defendant should not be before the court because they haven't admitted a data breach. And the plaintiffs say, well, if that argument holds up, then it is a disincentive for future organizations to admit to the fact that they had a breach. And I want to just share with the court the fact that there are many incentives in the law for organizations, institutions, commercial businesses who suffer a data breach to come forward and to admit to it. There are 48 data breach statutes in the country. They almost all require notice to individuals. Many require notice to the attorney generals. They have specific time periods in which notice must be given. Vermont, 14 days. Florida, 30 days. And there are substantial penalties if you fail to comply with the notice requirements either reasonably or within the time periods provided. And the multistate groups of attorney generals, the FTC, the Office of Civil Rights of Health and Human Services, are very active in providing a significant disincentive to the business community and to nonprofits like my client not to hold back if they are aware that they have a data breach and a duty to notify. So there is no danger being created in this case from a conclusion that where there's no clear nexus between the fraud and optometry, where my client has said that they have not had a data breach, and where the actual impact on these individuals and how they were caught up in the Amazon event isn't necessarily tied to anything having to do with NBO. One other correction I'd like to make, too, if I may. It's been stated that the district court erred when it said that there was not a rational reason for rejecting NBO's denial, but accepting the denial of other optometry organizations. And the plaintiffs have said that they pled in their complaint that these other organizations didn't collect the sensitive information. That's not precisely what the complaint pleads. Paragraph 16 of the Hutton complaint pleads that these three other organizations either did not collect the sensitive information or have denied it. So it's disjunctive and the or puts NBO in exactly the same category as these three other optometry-related organizations. So if you were to conclude that from the Facebook chatter and that there is a nexus to optometry, there is no reasonable inference to be drawn of why it is NBO versus other optometry organizations. That's not weighing one versus the other. That's not telling them to pick. That's saying if all things being equal, if there's nothing that distinguishes NBO from any other organization similarly situated, there isn't a rational basis to haul NBO into court and face them with a class action and everything that's involved in that. I thank the court for its time. Thank you, Ms. McCarran. Mr. Siegel. To start with that last point that she made, the argument being that you had two options. You picked one and left the other out. Of who to sue? Yes. the plausible allegation of the complaint are that these other organizations could not be the source of this information. Because they denied it? No, not just because they denied it at the time NBO was still investigating, but because if you look at the Mizrahi complaint, at age 60, paragraph 23 of the complaint, it is expressed that only the NBO collected social security numbers. That's it. Of these potential other groups. And it does spill into Houck and Woods and Judge Davis' comment in Woods, citing Your Honor, Judge Niemeyer, footnote 9 from Houck, that once the plaintiff meets this pleading standard, once it's plausible, it's NBO, that's it. The court does not engage in saying, well, what about this organization over here that may or may not have been a source of it? What about this organization over here that may or may not have been a source of it? It is a plausibility standard at the pleading stage for purposes of traceability. What is not in any of the facts before the court, as Your Honor, Judge Diaz pointed out, are any other reports of fraud through chase or that maiden names and social security numbers were assembled in some other entity that may have had a potential breach. That's not in the record. And so what we have are the plausible allegations of plaintiff that only NBO could have been the source of this information. But in her argument is, even from the face of the complaint, those discussions, I think, were to understand what her argument was. But her argument is that the social group on Facebook that exchanged this information was linked because of their profession and that had they been part of another social group, like meat and waters or some other things, they would have the traceability that would have been what organization was common to them. In other words, it was irrelevant to the board in this case because they all happen to be connected to the board and that's why they are on Facebook talking to each other. Right, but this is this confirmation bias that I confess I do not understand. You have a group of folks who do have the same or similar characteristics. They figure out, based on their interaction, that it is not lawyers or even other optometry groups. If you put the lawyers in the group, if you put all optometrists talking to each other about optometry and licensing and problems and they have a chat room themselves on Facebook, then that defines who is the source of the breach. In other words, she said that's just irrational because if you put a group of car salesmen who aren't of the same thing, then they would focus on the manufacturer because they had to register with the manufacturer. I don't know how to answer that, but that's the argument. Yeah, but we're talking about a relatively discreet, defined group of people, which are eye doctors, all of whom happen to apply, using this very sensitive personal information, including social security numbers, maiden names, prior addresses, etc., to take a board exam. Theoretically, they all had credit cards, too. They applied and so their data... She's arguing that it's all theoretical because the only defining characteristic is the fact that these people who got together got together because they were optometrists talking to each other. Right, and I think that is an unfair characterization of the complaint because what you have is a very defined, discreet group of people, all of whom provided the same information to one organization. And could it be... Is it possible, beyond the pleading stage, that it was some other entity? Sure, but that's not what's required here. And I think this is where we lop into the Howick Woods issue of is it plausible it's NBEO? And I think the answer to that is unquestionably that it is. One final note on economic harm. This concept that you need sort of monetary harm, I think, has been rebuked everywhere, including Spokio, the Supreme Court yesterday, declined to take it up in the Ninth Circuit again, affirming essentially the Ninth Circuit view that you do not need a monetary harm. And in Beck, finally, back-to-back, when Beck is talking about this Starbucks case, it concludes... May I sum up? I see him at the end of my time. It concludes that when it's talking about Starbucks, that plaintiff alleged that somebody opened up or attempted to open up a credit account using his Social Security number two weeks after the laptop was stolen. It's the same thing that was alleged here, and what the Court said in Beck is that's what gives rise to the certainly impending injury and risk of future theft, and that any mitigative efforts, freezing your credit, buying credit protection, are therefore appropriate recoverable damages. We ask the Court to reverse remand. Thank you. Thank you, Mr. Segal. We'll come down to the Great Council and proceed on to the last case. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/argument%3A34285. Public record. Not legal advice.