Kowarsky v. American Family Life Insurance Company, No. 3:2022cv00377 - Document 45 (W.D. Wis. 2023)
Court Description: ORDER granting 33 Motion to Dismiss. Signed by District Judge William M. Conley on 8/31/2023. (jls)
Download PDF
<![CDATA[
Kowarsky v. American Family Life Insurance Company Doc. 45 IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WISCONSIN NATHAN KOWARSKY, Plaintiff, OPINION AND ORDER v. 22-cv-377 AMERICAN FAMILY LIFE INSURANCE COMPANY, Defendant. This proposed class action arises out of a data breach on defendant American Family Life Insurance Company’s online quote platform. Plaintiff Nathan Kowarsky provided his name, address and driver’s license number to American Family to receive an online quote, and hackers later used an automated bot process to obtain that same information. American Family sent a letter notifying plaintiff of this breach, as well as the risk that plaintiff’s information could be used to apply for unemployment benefits in plaintiff’s name. Fortunately, to date, plaintiff has not been victim to any fraudulent activity or identify theft as a result of the breach, but he still sued, claiming that American Family’s alleged failure to take reasonable measures to protect his personal information constitutes invasion of privacy, breach of confidence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, unfair business practices, unjust enrichment, and negligence under Wisconsin law. American Family now moves to dismiss the case for lack of standing and failure to state a claim. Because plaintiff failed to plead any concrete injury, the court will grant the motion and dismiss the case for lack of subject matter jurisdiction. Dockets.Justia.com OPINION Because standing is a requirement for the court to exercise subject matter jurisdiction under Article III of the Constitution, the court addresses it first. Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 278 (7th Cir. 2020). To have Article III standing to sue in federal court, a plaintiff must show (1) that he suffered an injury in fact, (2) which is fairly traceable to the challenged conduct of the defendant and (3) likely to be redressed by a favorable judicial decision. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). Moreover, plaintiff must demonstrate standing for each of his claims and for each form of relief that he seeks. TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208 (2021). Here, the plaintiff here seeks damages and injunctive relief. American Family argues that he cannot establish the first element— an injury in fact. An “injury in fact” means an injury that is “concrete and particularized and actual or imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (internal quotation marks omitted). “A material risk of future harm can satisfy the concrete-harm requirement in the context of a claim for injunctive relief … so long as the risk of harm is sufficiently imminent and substantial.” TransUnion, 141 S. Ct. at 2210; Ewing v. Med-1 Sols., LLC, 24 F.4th 1146, 1151 (7th Cir. 2022). However, “a risk of future harm, without more, is insufficiently concrete to permit standing to sue for damages in federal court.” Ewing, 24 F.4th at 1151. Plaintiff identifies four injuries that he says give him standing to sue for damages and injunctive relief: (1) the heightened threat of future identity theft; (2) anxiety; (3) time spent mitigating that threat; and (4) losing the benefit of his bargain with defendant. 2 However, as defendant notes, this court has already concluded that the first three of plaintiff’s alleged injuries are not sufficiently concrete to satisfy Article III standing, in Baysal v. Midvale Indem. Co., No. 21-CV-394-WMC, 2022 WL 1155295 (W.D. Wis. Apr. 19, 2022). The court’s Baysal decision has now been upheld by the Seventh Circuit in Baysal v. Midvale, No. 22-1812, 2023 WL 5368249 (7th Cir. Aug. 22, 2023). As here, the plaintiff in Baysal alleged that he was harmed by the disclosure of his driver’s license number. This court concluded that “the risk of harm posed by the disclosure of driver's license numbers is not imminent and too speculative to satisfy Article III standing.” 2022 WL1155295, at *2. Because the plaintiff in Baysal had failed to plead an objectively reasonable risk of harm, the court neither his anxiety nor “lost time” spent investigating and mitigating the breach were concrete injuries. Id. at *3–4. After a thorough exposition of U.S. Supreme Court and Seventh Circuit case law, Judge Easterbrook reached the same essential conclusion, explaining that the “main holding” of the Supreme Court in Clapper v. Amnesty International USA, 568 U.S. 398 (2013), is that “a possible route for a loss does not suffice for standing; the complaint must allege that what is possible actually happened or was ‘certainly impending.’” Id. at *5. In fairness, Judge Ripple includes his own discussion of the Seventh Circuit’s “ill-advised march to restructure standing doctrine,” id. at *10–9, but this only serves to underscore the controlling law on this lower court. If anything, plaintiff’s allegations of injury here are even less concrete than those in Baysal. In Baysal, the plaintiff at least attempted to identify instances of identity theft that were supposedly a result of the data breach, including a fraudulent unemployment compensation application, a fraudulently opened brokerage account in plaintiff’s name, 3 and an unauthorized purchase. However, both the Seventh Circuit and this court found these allegations were insufficient to infer that the alleged fraud had occurred because of plaintiff’s driver’s license number being shared. 2023 WL 5368249, at *4; 2022 WL 1155295, at *3 n.2. In contrast, plaintiff Kowarsky here does not even allege post-breach incidents involving his driver’s license number, nor facts explaining how his driver’s license number could be used to cause a “sufficiently substantial and imminent” injury. Instead, he merely alleges that identity fraud might occur. Although defendant discussed Baysal at length in the brief supporting its motion to dismiss, plaintiff failed to address the case at all in his response brief. Instead, he simply repeated the allegations from his compliant regarding his alleged injuries and cited several Seventh Circuit cases that this court discussed and distinguished in the Baysal decision, as did the Seventh Circuit on appeal. 2023 WL 5368249, at *2-4 (distinguishing Seventh Circuit cases in which plaintiffs alleged “concrete injury traceable to the disclosure”). In particular, this court explained in Baysal that the plaintiff could not rely on the Seventh Circuit’s decisions involving stolen credit card information in Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688, 693 (7th Cir. 2015), or Lewart v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016), to support standing for a claimant alleging only that his driver’s license number had been obtained by hackers. Baysal, 2022 WL 1155295, at *2 (“[U]nlike in Remijas, here, neither the data allegedly stolen could be reasonably inferred to create an impending risk of financial harm, nor do plaintiffs allege actual harm to one of the plaintiffs as in Lewart; thereby distinguishing risk of possible access to driver's license numbers from proven access to credit card numbers at stake in Remijas and Lewart.”) 4 Plaintiff does not attempt to distinguish Baysal or develop any new arguments about Remijas, Lewart, or any other controlling case law that this court did not consider and reject already in the Baysal decision. Nor does he argue that Baysal was incorrectly decided. Plaintiff does raise one alleged injury that was not raised in Baysal. Specifically, plaintiff alleges he was “denied the benefit of the bargain” that he made with defendant, which resulted in a concrete injury. (Plt.’s Br. (dkt. #38) 8 (“Plaintiff alleges that he did not receive what he understood himself to be receiving when he agreed to provide his information to Defendant and was, therefore, denied the benefit of the bargain.”).) However, this argument is too vague and undeveloped to support standing. For example, plaintiff does not say what “bargain” to which he is referring, whether he negotiated or paid anything to defendant, how he was denied the benefit of the bargain, or how this relates to the disclosure of his driver’s license number. Moreover, if plaintiff is arguing that he was denied the benefit of his bargain by the disclosure of his driver’s license number, the Seventh Circuit rejected a similar argument for the reasons above: the disclosure of his driver’s license, by itself, is not a traceable, concrete injury sufficient to establish standing. See Baysal, 2023 WL 5368249, at *5-6 (rejecting assertion that even assuming defendant violated the Driver’s Privacy Protection Act, 18 U.S.C. §§2721-25, relieves plaintiff of alleging a concrete injury from disclosure of his driver’s license number). Because plaintiff has failed to allege an injury-in-fact sufficient to establish Article III standing, this court must dismiss his claims for lack of subject matter jurisdiction. 5 ORDER IT IS ORDERED that: 1) Defendant American Family Life Insurance Company’s motion to dismiss (dkt. #33) is GRANTED, and plaintiff’s complaint is DISMISSED WITHOUT PREJUDICE for lack of subject matter jurisdiction. 2) The clerk of court is directed to enter judgment and close this case. Entered August 31, 2023. BY THE COURT: /s/ __________________________________ WILLIAM M. CONLEY District Judge 6
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
