## Facts

- JetBlue collected passenger personal information in Passenger Name Records (PNRs), including names, addresses, phone numbers, and itineraries, obtained through phone and online bookings.
- JetBlue maintained a privacy policy stating it would not share passenger information with third parties.
- After September 11, the Department of Defense contracted with Torch Concepts, Inc. to study base security, and Torch sought airline PNR data for analysis.
- The Transportation Security Administration requested that JetBlue provide its PNRs to Torch, and JetBlue transferred the PNRs.
- Passengers filed putative nationwide class actions alleging unlawful disclosure and use of their data, asserting federal claims under the Electronic Communications Privacy Act (ECPA) and multiple state statutory and common-law claims.
- The cases were consolidated in the Eastern District of New York; defendants moved to dismiss under Rule 12(b)(6).

## Issues

1. Whether JetBlue qualified as an “electronic communication service” provider under the ECPA based on its online reservation system.
2. Whether JetBlue qualified as a “remote computing service” provider under the ECPA by operating a website and servers that stored reservation information.
3. Whether state statutory privacy and consumer-protection claims were expressly preempted by the Airline Deregulation Act (ADA).
4. Whether plaintiffs stated non-preempted state common-law claims (breach of contract, trespass to chattels, unjust enrichment), including whether they alleged legally cognizable damages or injury.
5. Whether the court should retain supplemental jurisdiction over state-law claims after dismissal of the federal claims.

## Decision

- The court granted defendants’ motions to dismiss.
- The ECPA claims were dismissed because JetBlue’s reservation system did not make it an ECPA-covered “electronic communication service,” and the pleadings did not show JetBlue provided public computer processing or storage as a “remote computing service.”
- State statutory privacy and consumer-protection claims (including under New York General Business Law) were dismissed as expressly preempted by the ADA.
- Breach of contract, trespass to chattels, and unjust enrichment claims were not categorically preempted, but were dismissed for failure to state a claim, chiefly due to lack of cognizable damages or actual injury.
- The court retained supplemental jurisdiction to resolve and dismiss the state-law claims.

## Legal Principles

- ECPA liability under the relevant provisions requires the defendant to fit statutory provider categories; operating a website and internal reservation systems, without providing public computing or storage services, is insufficient.
- The ADA expressly preempts state laws “related to a price, route, or service” of an air carrier, including state statutory claims that would regulate airline representations and practices tied to passenger services.
- Under New York contract law, an alleged loss of privacy, without recognized contract damages, is not recoverable as breach-of-contract damages on these facts.
- Trespass to chattels requires actual injury or impairment to the plaintiff’s personal property; abstract privacy harm does not satisfy that element.
- Unjust enrichment requires a plausible allegation that the defendant was enriched at the plaintiff’s expense under inequitable circumstances; conclusory benefit allegations, without a corresponding cognizable loss or inequity, are insufficient.
- A federal court may retain supplemental jurisdiction after federal claims are dismissed, particularly where it can efficiently resolve remaining state claims, including on preemption and pleading grounds.

## Conclusion

The court dismissed consolidated passenger privacy claims arising from JetBlue’s transfer of PNR data to a government-requested contractor, holding that the ECPA did not apply to JetBlue’s reservation system, that the ADA preempted state statutory privacy and consumer claims targeting airline services, and that remaining state common-law theories failed for lack of cognizable damages or actual injury.


In re JetBlue Airways Corp. Privacy Litig., 379 F. Supp. 2d 299 (E.D.N.Y. 2005)