Federal Court Dismisses Part of Wendy’s Data Breach Putative Class Action
A Florida federal court has dismissed part of a data breach complaint against Wendy’s, calling two of the claims “shotgun pleadings” and noting that the plaintiffs “misconstrue the basic legal principles of statutory law.” Torres v. Wendy’s Int’l, LLC, No. 16-0210 (M.D. Fla., order entered March 21, 2017). Additional details on the case appear in Issues 594 and 612 of this Update.
The plaintiffs originally filed suit in February 2016 after a data breach of Wendy’s credit card payment system, but the Florida court dismissed the suit for failure to plead an injury sufficient to prove standing. Ruling on the amended complaint, the court found that the plaintiffs could establish standing based on “particularized, concrete injuries,” including late fees, loss of credit card reward points and loss of cashback awards.
The court refused to dismiss a breach of implied contract count, reasoning that when a merchant invites a customer to pay with a credit card containing confidential information, an implied agreement that the merchant will safeguard the information may exist. In addition, the court sided with the plaintiffs on a negligence count, agreeing the facts pleaded supported a conclusion that the data breach was foreseeable.
The court rebuked plaintiffs for bundling claimed violations of state consumer protection laws in six separate states into a single count, failing to separate individual causes of action and claims for relief. “Although these laws share similarities, they are distinct causes of actions with unique requirements and defenses,” the court said. “By lumping all six causes of action into one count in the Amended Complaint, Wendy’s and this Court face the onerous task of sifting through the Amended Complaint to determine whether the facts alleged sufficiently state a claim for relief under the six different state consumer protection laws.”
For the same reason, the court also dismissed a count claiming violations of data breach statutes in five different states but addressed some of Wendy’s substantive arguments as to the allegations. Four of the five statutes do not create a private right of action, but the plaintiffs argued that statutes can “set forth a relevant duty of care for a common law tort claim.” The court disagreed, saying, “Plaintiffs misconstrue the basic legal principles of statutory law. A statute does not give rise to a civil cause of action unless the language of the statute explicitly so provides, or it can be determined by clear implication.” The court granted the plaintiffs leave to amend, but limited it to “statutes that do provide a private right of action.”
Issue 628
