## Facts

- AvMed, a Florida health-plan administrator, maintained unencrypted laptop computers containing members’ sensitive personal and health information.
- In December 2009, two laptops were stolen from AvMed’s corporate office in Gainesville, Florida; the devices held data on about 1.2 million current and former members.
- Plaintiffs Curry and Moore alleged their information was on the stolen laptops and that they later suffered identity theft (about 10 and 14 months after the thefts).
- They alleged unauthorized accounts were opened in their names, address information was changed, and fraudulent purchases were made using their identities.
- Plaintiffs alleged they exercised care in protecting their personal information and that the AvMed laptop theft was the likely source of the information used in the fraud.
- Plaintiffs filed suit asserting Florida-law claims including negligence, negligence per se, breach of contract, breach of implied contract, breach of the implied covenant of good faith and fair dealing, breach of fiduciary duty, and unjust enrichment; they sought to proceed on behalf of a putative class and an identity-theft subclass.
- The district court dismissed the second amended complaint under Rule 12(b)(6), concluding the complaint failed to allege a cognizable injury; plaintiffs appealed.

## Issues

1. Whether allegations of actual identity theft following a data breach constitute a cognizable injury sufficient for Article III standing and the injury element of Florida-law claims.
2. Whether plaintiffs plausibly alleged that AvMed’s failure to secure the laptops caused their identity theft under Twombly and Iqbal.
3. Whether the complaint stated plausible Florida-law claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of the implied covenant of good faith and fair dealing, breach of fiduciary duty, and unjust enrichment.

## Decision

- The Eleventh Circuit reversed in part, affirmed in part, and remanded.
- The court held that plaintiffs’ allegations of actual identity theft constituted a cognizable injury for standing and for the injury element of their Florida-law causes of action.
- The court held the complaint plausibly alleged causation for negligence, breach of contract, breach of implied contract, breach of fiduciary duty, and unjust enrichment.
- The court affirmed dismissal of the negligence per se claim and the implied covenant of good faith and fair dealing claim as inadequately pleaded under Florida law.
- The court allowed the negligence, breach of contract, breach of implied contract, breach of fiduciary duty, and unjust enrichment claims to proceed past the motion-to-dismiss stage.

## Legal Principles

- Article III standing requires a concrete, particularized injury fairly traceable to the defendant’s conduct and likely redressable by a favorable decision; actual identity theft is a concrete injury.
- Under Twombly and Iqbal, a complaint must plead facts permitting a reasonable inference of liability; causation may be plausibly inferred from the nature of stolen data, alleged protective practices, and the sequence of events linking a specific breach to identity theft.
- Contract and implied-contract theories may be plausibly pleaded where members allege they paid premiums and the defendant undertook (expressly or by implication) to safeguard sensitive information but failed to do so.
- Unjust enrichment may be plausibly pleaded where plaintiffs allege they conferred a monetary benefit that the defendant retained while allegedly failing to provide paid-for data security.
- Under Florida law, negligence per se requires a properly applicable statutory basis; a claim fails where the cited statute does not support per se liability on the pleaded facts.
- Under Florida law, breach of the implied covenant of good faith and fair dealing generally does not create an independent claim absent allegations tied to specific contractual terms and bad-faith frustration of the contract’s benefits.

## Conclusion

The Eleventh Circuit held that plaintiffs alleging actual identity theft after a specific data breach sufficiently alleged a cognizable injury and plausible causation to proceed on several Florida-law tort, contract, and unjust enrichment theories, while affirming dismissal of negligence per se and implied-covenant claims, and remanded for further proceedings.


Resnick v. AvMed, Inc., 693 F.3d 1317 (11th Cir. 2012)