Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-almd-1_16-cv-00272/USCOURTS-almd-1_16-cv-00272-0/pdf.json

Nature of Suit Code: 360
Nature of Suit: Other Personal Injury
Cause of Action: 28:1332 Diversity-Personal Injury

---

IN THE UNITED STATES DISTRICT COURT

FOR THE MIDDLE DISTRICT OF ALABAMA

SOUTHERN DIVISION

MELISSA BOHANNAN, et al.,

Plaintiffs,

v.

INNOVAK INTERNATIONAL, 

INC.,

Defendant.

)

)

)

)

)

)

)

)

)

)

CASE NO. 1:16-CV-272-WKW

[WO]

MEMORANDUM OPINION AND ORDER

Before the court is Defendant’s motion to dismiss (Doc. # 8), which is 

construed as also containing a motion for a more definite statement (see Doc. # 8, at 

10). The motions have been fully briefed (Docs. # 14 and 15). Upon careful 

consideration, both motions will be denied.

I. JURISDICTION AND VENUE

Subject-matter jurisdiction is exercised pursuant to the Class Action Fairness 

Act, 28 U.S.C. § 1332(d). Plaintiffs allege that they are all citizens of Alabama, that 

Defendant is a citizen of South Carolina, that they bring this action on behalf of a 

class that exceeds 100 individuals, and that the amount in controversy exceeds 

$5,000,000. The parties do not contest personal jurisdiction or venue.

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 1 of 12
2

II. STANDARD OF REVIEW

A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil 

Procedure tests the sufficiency of the complaint against the legal standard articulated 

by Rule 8 of the Federal Rules of Civil Procedure. Rule 8 provides that the complaint 

must include “a short and plain statement of the claim showing that the pleader is 

entitled to relief.” Fed. R. Civ. P. 8(a)(2). When evaluating a motion to dismiss 

pursuant to Rule 12(b)(6), the court must take the facts alleged in the complaint as 

true and construe them in the light most favorable to the plaintiff. Resnick v. AvMed, 

Inc., 693 F.3d 1317, 1321–22 (11th Cir. 2012).

To survive a Rule 12(b)(6) motion, the complaint “must contain sufficient 

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its 

face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. 

Twombly, 550 U.S. 544, 570 (2007)). The complaint is facially plausible when “the 

plaintiff pleads factual content that allows the court to draw the reasonable inference 

that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678.

A party may move for a more definite statement under Rule 12(e) of the 

Federal Rules of Civil Procedure when a pleading is “so vague or ambiguous that 

the party cannot reasonably prepare a response.”

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 2 of 12
3

III. BACKGROUND

Plaintiffs brought this class action after learning that unknown individuals 

misappropriated their personal private information. The facts and procedural history 

will be briefly discussed.

Defendant Innovak International, Inc. (“Innovak”) is an information 

technology company serving employers like schools, school systems, and other state 

agencies. Innovak’s software allows its end users to access tax and payroll 

information remotely through its internet portal. The internet portal stores an array 

of employee personal private information (“PPI”), including social security 

numbers, addresses, telephone numbers, and dates of birth.

Plaintiffs, who are end users of Innovak’s ledger software system,1allege that 

Innovak suffered a security breach when hackers infiltrated the internet portal. They 

contend that Innovak was aware of its software’s vulnerabilities as early as 2014, yet 

failed to take protective measures to ensure data security. They further contend that, 

in April of 2016, Innovak admitted to news media outlets that it suffered a data 

breach, but took no steps to directly inform its end users of the breach. Instead, 

 

1 Ten plaintiffs brought this action on behalf of themselves and a class of similarly situated 

individuals. The named plaintiffs, referred to collectively as “Plaintiffs,” include Melissa 

Bohannan, Cherissa Hall, Jolie Hall, Summer Lisenby, Maryellen Prophet, Jennifer Matheny, 

Tiffany McCoy, Ashley McGhee, Sherrie Salem, and Crystal Shelley.

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 3 of 12
4

Plaintiffs learned about the breach when they received letters from the Internal 

Revenue Service indicating that their PPI had been compromised.

In their class action complaint, Plaintiffs assert claims for (1) negligence, (2) 

breach of implied contract, (3) gross negligence, recklessness and/or wantonness, 

(4) unjust enrichment, and (5) fraudulent suppression. Plaintiffs allege that they 

have suffered psychic injuries as a result of learning that their PPI had been 

compromised. Some Plaintiffs further allege that nefarious individuals used their 

misappropriated PPI to file false tax returns in their names. They also have incurred 

the costs of mitigating additional harm associated with the breach. They seek 

compensatory damages, punitive damages, restitution, attorneys’ fees, and costs.

The complaint includes specific class action allegations. Plaintiffs define the 

putative nationwide class as “all persons whose PPI was compromised as a direct 

and proximate result of the Innovak data breach.” (Doc. # 1, at 8.) They 

alternatively propose various statewide classes consisting of, for example, “[a]ll 

persons in Alabama whose PPI was compromised as a direct result of the Innovak 

data breach.” (Doc. # 1, at 8.) With respect to the class action prerequisites set forth 

in Rule 23(a) of the Federal Rules of Civil Procedure, Plaintiffs contend that the 

class is so numerous that joinder is impracticable, that there are questions of law and 

fact common to putative class members, that Plaintiffs’ claims are typical of the 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 4 of 12
5

claims of the class members, and that Plaintiffs will adequately protect the interests 

of the putative class members. They further allege that the questions of law and fact 

common to the class members predominate over individual questions, and that class 

treatment is superior to individual adjudication. See Fed. R. Civ. P. 23(b)(3).

Innovak responded to Plaintiffs’ complaint with a motion to dismiss for failure 

to state a claim upon which relief can be granted. (Doc. # 8.) Pursuant to the briefing 

order (Doc. # 12), Defendants filed a brief in support of their motion (Doc. # 14), 

and Plaintiffs filed a response (Doc. # 15). Defendants did not file a reply brief, and 

the matter is considered submitted on the briefing.

IV. DISCUSSION

In the motion now before the court, Innovak advances three arguments. First, 

it contends that Plaintiffs’ class complaint should be dismissed for failure to satisfy 

Rule 23 of the Federal Rules of Civil Procedure. Second, it arguesthat the complaint 

should be dismissed for failure to state a claim upon which relief can be granted. 

Third, it maintains that the complaint is so vague or ambiguous that it cannot 

reasonably prepare a response. These arguments will be addressed in turn.

A. The Complaint Will Not Be Dismissed for Failure to Satisfy Rule 23.

Innovak first argues that the class complaint should be dismissed because the 

class is not ascertainable, and thus fails to satisfy the requirements of Rule 23. The 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 5 of 12
6

principles governing class certification will first be generally addressed. These 

principles will then be applied to Plaintiffs’ proposed class.

Pursuant to Rule 23(a), plaintiffs may sue on behalf of a class only where: 

“(1) the class is so numerous that joinder of all members is impracticable; (2) there 

are questions of law and fact common to the class; (3) the claims or defenses of the 

representative parties are typical of the claims or defenses of the class; and (4) the 

representative parties will fairly and adequately protect the interests of the class.” 

Rule 23(b) further requires that the class fit within one of three enumerated 

categories. In addition to these explicit requirements, Rule 23 has been construed to 

include an implicit requirement that the purported class be ascertainable by reference 

to objective criteria. Bussey v. Macon Cty. Greyhound Park, 562 F. App’x 782, 787

(11th Cir. 2014). The objective criteria should allow class members to be identified

in a manner that is administratively feasible, which means that identifying class 

members requires little, if any, individual inquiry. Id.

Where the proposed class definition requires the court to determine the merits 

of an individual class member’s claims as a predicate to determining her membership 

in the class, the class is not ascertainable. See Likes v. DHL Express, 288 F.R.D. 

524, 531–32 (N.D. Ala. 2012). These “fail-safe” classes, which are framed in terms 

of legal conclusions, are not administratively feasible. They inevitably require miniCase 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 6 of 12
7

trials to determine which individuals belong to the class. William H. Rubenstein, 

Newberg on Class Actions § 3:6 (5th ed.).

Innovak contends that Plaintiffs’ proposed class constitutes a fail-safe class 

and is otherwise unascertainable under the controlling legal principles. Innovak 

acknowledges that class allegations generally are not dismissed at the pleading stage 

for failure to comply with Rule 23, but nonetheless maintains that it is appropriate 

to dismiss Plaintiffs’ class complaint under Rule 12(b)(6). (Doc. # 14, at 5 (citing 

Schilling v. Kenton Cty., Civil Action No. 10-143-DLB, 2011 WL 293759 (E.D. Ky. 

Jan. 27, 2011).) Despite the early nature of this motion, nothing in Rule 23 precludes 

the consideration of class certification issues in the context of a motion to dismiss. 

It merely provides that issues of class certification should be decided “at an early 

practicable time.” Fed. R. Civ. P. 23(c)(1)(A).

The relevant inquiry here is whether the allegations are sufficient to plausibly 

support the existence of an ascertainable class. See Iqbal, 556 U.S. at 678. Or, to 

borrow phrasing from the case on which Innovak chiefly relies for this motion, the 

moving party bears the burden of demonstrating that it will be “impossible to certify 

the class as alleged.” Schilling, 2011 WL 293759, at * 4 (citing Bryant v. Food Lion, 

Inc., 774 F. Supp. 1484, 1495 (D.S.C. 1991)). The issue of whether Plaintiffs 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 7 of 12
8

proposed a fail-safe class will be addressed first. It will then be determined whether 

the proposed class is otherwise ascertainable.

Based on the allegations in the complaint, it cannot be said that Plaintiffs have 

proposed an unascertainable fail-safe class. As noted above, a proposed class is 

deficient as fail-safe where it is defined in such a way that determining its 

membership requires a determination of the merits of the potential class members’ 

claims. See Likes, 288 F.R.D. at 531–32. Innovak argues that Plaintiffs’ proposed 

class definitions require findings “that [Innovak’s] conduct was ‘wrongful,’ 

‘unlawful,’ ‘negligent,’ ‘wanton,’ [or] ‘reckless.’” (Doc. # 14, at 6.) Innovak also 

contends that the class definitions require the finding “that [Innovak] ‘knew of the 

risks,’ acted with a ‘conscious disregard,’ and ‘refused to take adequate and 

reasonable precautions . . . to adequately protect [PPI].’” (Doc. # 14, at 6–7.)

None of the words or phrases Innovak quoted in this portion of its brief 

actually appears in the proposed class definitions. The proposed class definitions 

themselves do not mention that Innovak was negligent, reckless, or wanton in its

behavior. Nor do the proposed class definitions make reference to Innovak’s 

conscious disregard for a known risk. The proposed classes merely include those 

persons, either on a nationwide or statewide scale, “whose PPI was compromised as 

a direct and proximate result of the Innovak data breach.” (Doc. # 1, at 8.) Innovak 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 8 of 12
9

grafted this litany of legal conclusions onto the proposed class definitions without 

further explanation. They otherwise are only found in the portion of the complaint 

in which Plaintiffs lay out their causes of action.

The only aspect of the proposed class definitions that could arguably call for

a legal conclusion is the requirement that class members’ PPI be compromised as a 

“direct and proximate result” of the Innovak data breach. Whether some event 

proximately caused the harm of which a plaintiff complains is a question that 

requires a legal conclusion. But the definitions offered in Plaintiffs’ complaint do 

not venture so far as to inquire whether, as a matter of law, the Innovak data breach 

proximately caused the ultimate harm the putative class member suffered. Instead, 

they ask whether the Innovak data breach caused the putative class member’s PPI to 

be compromised, which is a question that can be answered without engaging in a 

final adjudication of the merits of the putative class member’s claim for liability 

against Innovak. The definitions merely require the finding that the putative class 

member’s data was rendered insecure as a result of the data breach. And Plaintiffs 

allege that Innovak’s own records will confirm which end users were affected by the 

breach.

The class, as alleged, is otherwise sufficiently ascertainable to survive Rule 

12(b)(6) scrutiny. Plaintiffs contend that Innovak maintains PPI in a centralized 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 9 of 12
10

location, that its records will indicate which PPI was compromised as a result of the 

breach, that there is a finite number of end users whose data could have been 

compromised, and that all end users were affected by the breach. Taking these 

allegations as true, the complaint is sufficient to indicate that class members can be 

ascertained by administratively feasible objective criteria. See Karhu v. Vital 

Pharm., Inc., 621 F. App’x 945, 948 (11th Cir. 2015) (holding that the class is 

ascertainable where the proponent of class certification can establish that the class 

members can be identified by reference to records that are in the defendant’s control 

and are useful for identification purposes). The discovery process will ultimately 

reveal whether Innovak’s records provide a feasible means of identifying all end 

users whose PPI was compromised. And the parties can move for a final decision 

on the issue of class certification after this period for investigation.

For purposes of the instant motion to dismiss, however, it cannot be said that 

the alleged class is impossible to certify. Accordingly, to the extent Innovak seeks 

to dismiss the complaint for failure to comply with Rule 23, its motion is due to be 

denied.

B. The Complaint Will Not Be Dismissed for Failure to State a Claim.

Innovak also argues generally that the complaint should be dismissed for 

failure to state a claim. See Fed. R. Civ. P. 12(b)(6). Innovak’s only argument on 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 10 of 12
11

this point is that Plaintiffs’ complaint does not specify what measures or steps 

Innovak should have taken to prevent the data security breach. (Doc. # 14, at 12.) 

The complaint contains sufficient factual matter, however, to support a plausible 

claim for relief. See Iqbal, 556 U.S. at 678.

Plaintiffs allege that Innovak was aware of the vulnerabilities in its data 

storage system and that it failed to take reasonable steps to prevent a breach. They

further allege that Innovak chose not to “lockdown its internet portal” or notify its 

end users that their PPI had been compromised. (Doc. # 1, at 11.) In its motion, 

Innovak offers no authority supporting the proposition that Plaintiffs must 

specifically allege which protective action Innovak should have taken to prevent the 

breach. Taken together, the allegations in the complaint constitute a plain statement 

showing that Plaintiffs are entitled to relief. See Fed. R. Civ. P. 8(a)(2). Applying 

the Rule 12(b)(6) standard, the factual allegations support the plausible inference 

that Innovak is liable for the claims asserted. See Iqbal, 556 U.S. at 678. 

Accordingly, to the extent Innovak seeks to dismiss the complaint pursuant to Rule 

12(b)(6), its motion is due to be denied.

C. Plaintiffs Will Not Be Ordered to Provide A More Definite Statement.

Innovak finally argues that Plaintiffs should be ordered to provide a more 

definite statement pursuant to Rule 12. It cannot be said, however, that the 

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 11 of 12
12

allegations are so vague or ambiguous that Innovak cannot prepare a response. See

Fed. R. Civ. P. 12(e). The factual allegations are neither vague nor ambiguous. 

Plaintiffs specifically identify the grounds for their relief such that Innovak is in a 

position to prepare its answer. Innovak’s motion for a more definite statement is 

thus due to be denied.

V. CONCLUSION

Accordingly, it is ORDERED that Defendant’s motion to dismiss (Doc. # 8) 

is DENIED. It is further ORDERED that Defendant’s motion for a more definite 

statement (Doc. # 8) is DENIED.

DONE this 4th day of August, 2016. 

 /s/ W. Keith Watkins 

CHIEF UNITED STATES DISTRICT JUDGE

Case 1:16-cv-00272-WKW-WC Document 16 Filed 08/04/16 Page 12 of 12