Opinion ID: 1363007
Heading Depth: 2
Heading Rank: 2

Heading: Availability of Credit Monitoring Damages Under Indiana Law

Text: With the issue of jurisdiction resolved, we now turn to the merits of the plaintiffs' claim for damages. This case, invoking CAFA's special rules for diversity jurisdiction, alleges causes of action under Indiana law. Our duty, therefore, as in every diversity case, is to apply state substantive law, as we believe the highest court of the state would apply it. State Farm Mut. Auto. Ins. Co. v. Pate, 275 F.3d 666, 669 (7th Cir.2001). The principal claims in this case are based on a negligence theory. The elements of a negligence claim under Indiana law are: (1) a duty owed to plaintiff by defendant, (2) breach of duty by allowing conduct to fall below the applicable standard of care, and (3) a compensable injury proximately caused by defendant's breach of duty. Bader v. Johnson, 732 N.E.2d 1212, 1216-17 (Ind.2000) (emphasis added). The plaintiffs' complaint also alleges that ONB has breached an implied contract. Compensable damages are an element of a breach of contract cause of action as well. See McCalment v. Eli Lilly & Co., 860 N.E.2d 884, 894 (Ind. Ct.App.2007). As this case comes to us, both the negligence and the contractual issues can be resolved, and the judgment of the district court affirmed, if the district court was correct in its determination that Indiana law would not permit recovery for credit monitoring costs incurred by the plaintiffs. We review de novo the district court's determination of the content of state law. Hinc v. Lime-O-Sol Co., 382 F.3d 716, 720 (7th Cir.2004); see also Salve Regina Coll. v. Russell, 499 U.S. 225, 231-32, 111 S.Ct. 1217, 113 L.Ed.2d 190 (1991) (rejecting a rule of deference to district court determinations of state law). We must determine whether Indiana would consider that the harm caused by identity information exposure, coupled with the attendant costs to guard against identity theft, constitutes an existing compensable injury and consequent damages required to state a claim for negligence or for breach of contract. Neither the parties' efforts nor our own have identified any Indiana precedent addressing this issue. Nor have we located the decision of any court (other than the district court in this case) that examines Indiana law in this context. We are charged with predicting, nevertheless, how we think the Supreme Court of Indiana would decide this issue. See Dumas v. Infinity Broad. Corp., 416 F.3d 671, 680 n. 11 (7th Cir.2005). When faced with a novel question of state law, federal courts sitting in diversity have a range of tools at their disposal. First, when the intermediate appellate courts of the state have spoken to the issue, we shall give great weight to their determination about the content of state law, absent some indication that the highest court of the state is likely to deviate from those rulings. See Woidtke v. St. Clair County, Illinois, 335 F.3d 558, 562 (7th Cir.2003). We also shall consult a variety of other sources, including other relevant state precedents, analogous decisions, considered dicta, scholarly works, and any other reliable data tending convincingly to show how the highest court in the state would decide the issue at hand. McKenna v. Ortho Pharm. Corp., 622 F.2d 657, 663 (3d Cir.1980); see generally Dolores K. Sloviter, A Federal Judge Looks at Diversity Jurisdiction, 78 Va. L.Rev. 1671 (1992) (discussing the challenges facing federal courts in applying uncharted areas of state law). In the absence of any authority from the relevant state courts, we also shall examine the reasoning of courts in other jurisdictions addressing the same issue and applying their own law for whatever guidance about the probable direction of state law they may provide. See Allstate Ins. Co. v. Tozer, 392 F.3d 950, 952 (7th Cir.2004). In the end, however, the plaintiffs must come forward with some authority to support their view that they have a right to the relief they seek because, as we have stated, we have limited discretion . . . with respect to untested legal theories brought under the rubric of state law. A.W. Huss Co. v. Cont'l Cas. Co., 735 F.2d 246, 253 (7th Cir.1984). Without state authority to guide us, [w]hen given a choice between an interpretation of [state] law which reasonably restricts liability, and one which greatly expands liability, we should choose the narrower and more reasonable path (at least until the [state] Supreme Court tells us differently).. Todd v. Societe Bic, S.A., 21 F.3d 1402, 1412 (7th Cir.1994) (en banc); see also Insolia v. Philip Morris Inc., 216 F.3d 596, 607 (7th Cir.2000) (Federal courts are loathe to fiddle around with state law. Though district courts may try to determine how the state courts would rule on an unclear area of state law, district courts are encouraged to dismiss actions based on novel state law claims.); Home Valu, Inc. v. Pep Boys, 213 F.3d 960, 965 (7th Cir.2000) (adopting an interpretation of state law which, between two possible options, take[s] the approach that is restrictive of liability). [5] With these principles in mind, we turn to our consideration of whether Indiana would recognize a cause of action for a data exposure injury. Specifically, we shall examine whether Indiana would compensate victims who undertake credit monitoring to guard against identity theft that might follow.
We begin our inquiry with the Indiana authority most closely addressed to the issue before us. On March 21, 2006, the Indiana legislature enacted a statute that applies to certain database security breaches. Specifically, the statute creates certain duties when a database in which personal data, electronically stored by private entities or state agencies, potentially has been accessed by unauthorized third parties. I.C. § 24-4.9 et seq. [6] The statute took effect on July 1, 2006, see Ind. Pub.L. 125-2006, § 6 (Mar. 21, 2006), after the particular incident involved in this case; neither party contends that the statute is directly applicable to the present dispute. [7] We nevertheless find this enactment by the Indiana legislature instructive in our evaluation of the probable approach of the Supreme Court of Indiana to the allegations in the present case. The provisions of the statute applicable to private entities storing personal information require only that a database owner disclose a security breach to potentially affected consumers; they do not require the database owner to take any other affirmative act in the wake of a breach. If the database owner fails to comply with the only affirmative duty imposed by the statutethe duty to disclosethe statute provides for enforcement only by the Attorney General of Indiana. It creates no private right of action against the database owner by an affected customer. It imposes no duty to compensate affected individuals for inconvenience or potential harm to credit that may follow. [8] The plaintiffs maintain that the statute is evidence that the Indiana legislature believes that an individual has suffered a compensable injury at the moment his personal information is exposed because of a security breach. We cannot accept this view. Had the Indiana legislature intended that a cause of action should be available against a database owner for failing to protect adequately personal information, we believe that it would have made some more definite statement of that intent. Moreover, given the novelty of the legal questions posed by information exposure and theft, it is unlikely that the legislature intended to sanction the development of common law tort remedies that would apply to the same factual circumstances addressed by the statute. The narrowness of the defined duties imposed, combined with state-enforced penalties as the exclusive remedy, strongly suggest that Indiana law would not recognize the costs of credit monitoring that the plaintiffs seek to recover in this case as compensable damages.
The plaintiffs further submit that cases decided by the Indiana courts in analogous areas of the law instruct that they suffered an immediate injury when their information was accessed by unauthorized third parties. Specifically, the plaintiffs claim that Indiana law acknowledges special duties on the part of banks to prevent the disclosure of the personal information of their customers; they further claim that Indiana courts have recognized explicitly the significant harm that may result from a failure to prevent such a loss. See Indiana Nat'l Bank v. Chapman, 482 N.E.2d 474 (Ind.Ct.App.1985); American Fletcher Nat'l Bank & Trust Co. v. Flick, 146 Ind.App. 122, 252 N.E.2d 839 (1969). In Indiana National Bank v. Chapman, 482 N.E.2d 474 (Ind.Ct.App.1985), the Court of Appeals of Indiana considered a claim that, in the course of an investigation into possible financial motives for an arson, the bank, intentionally and without authorization, had disclosed to law enforcement that an account of one of its customers had been marked for repossession. The court held that the bank had contracted impliedly with its customers not to reveal financial information to law enforcement, absent a public duty. Id. at 482. In American Fletcher National Bank & Trust Co. v. Flick, 146 Ind.App. 122, 252 N.E.2d 839 (1969), the Court of Appeals considered liability based on a bank's erroneous dishonor of a customer's check when a third-party attempted to cash it. The appellate court concluded that the plaintiff, whose creditors had been told that the plaintiff's business account had insufficient funds to cover the checks the plaintiff had written, had suffered a presumptive present harm to his business reputation and credit. Id. at 846. Whatever these cases say about the relationship of banks and customers in Indiana, they are of marginal assistance to us in determining whether the present plaintiffs are entitled to the remedy they seek as a matter of Indiana law. The reputational injuries suffered by the plaintiffs in American Fletcher and Indiana National Bank were direct and immediate; the plaintiffs sought to be compensated for that harm, rather than to be reimbursed for their efforts to guard against some future, anticipated harm. We therefore do not believe that the factual circumstances of the cases relied on by the plaintiffs are sufficiently analogous to the circumstances that we confront in the present case to instruct us on the probable course that the Supreme Court of Indiana would take if faced with the present question. [9] Although not raised by the parties, we separately note that in the somewhat analogous context of toxic tort liability, [10] the Supreme Court of Indiana has suggested that compensable damage requires more than an exposure to a future potential harm. Specifically, in AlliedSignal, Inc. v. Ott, 785 N.E.2d 1068 (Ind.2003), the Supreme Court of Indiana held that no cause of action accrues, despite incremental physical changes following asbestos exposure, until a plaintiff reasonably could have been diagnosed with an actual exposure-related illness or disease. Id. at 1075. In its decision that no compensable injury occurs at the time of exposure, the court relied on precedent from both state and federal courts in general agreement with the principle that exposure alone does not give rise to a legally cognizable injury. Id. at 1075 n. 8. Although some courts have allowed medical monitoring damages to be recovered or have created a special cause of action for medical monitoring under similar circumstances, see Badillo v. American Brands, Inc., 117 Nev. 34, 16 P.3d 435, 438-39 & nn. 1-2 (2001) (citing cases interpreting the law of seventeen states to allow medical monitoring in some form), no authority from Indiana is among them. Indeed, its recent holding in AlliedSignal indicates a contrary approach. To the extent the decision of the Supreme Court of Indiana in that matter provides us with guidance on the likely approach that court would adopt with respect to the information exposure injury in this case, we think it supports the view that no cause of action for credit monitoring is available. [11]
Finally, without Indiana guidance directly on point, we next examine the reasoning of other courts applying the law of other jurisdictions to the question posed by this case. Allstate Ins. Co., 392 F.3d at 952. In this respect, several district courts, applying the laws of other jurisdictions, have rejected similar claims on their merits. In addition to those cases in which the district court held that the plaintiff lacked standing, [12] a series of cases has rejected information security claims on their merits. Most have concluded that the plaintiffs have not been injured in a manner the governing substantive law will recognize. See, e.g., Kahle v. Litton Loan Servicing, LP, 486 F.Supp.2d 705, 712-13 (S.D.Ohio 2007) (entering summary judgment for the defendant because the plaintiff had failed to demonstrate an injury); Guin v. Brazos Higher Educ. Serv. Corp., Inc., 2006 WL 288483 (D.Minn. Feb.7, 2006) (unpublished) (same); Stollenwerk v. Tri-West Healthcare Alliance, 2005 WL 2465906, at  (D.Ariz. Sept.6, 2005) (unpublished) (granting summary judgment for defendants because the plaintiffs had failed to provide evidence of injury); see also Hendricks v. DSW Shoe Warehouse, 444 F.Supp.2d 775, 783 (W.D.Mich.2006) (dismissing an action where [t]here is no existing Michigan statutory or case law authority to support plaintiff's position that the purchase of credit monitoring constitutes either actual damages or a cognizable loss). Although some of these cases involve different types of information losses, all of the cases rely on the same basic premise: Without more than allegations of increased risk of future identity theft, the plaintiffs have not suffered a harm that the law is prepared to remedy. Plaintiffs have not come forward with a single case or statute, from any jurisdiction, authorizing the kind of action they now ask this federal court, sitting in diversity, to recognize as a valid theory of recovery under Indiana law. We decline to adopt a substantive innovation in state law, Combs v. Int'l Ins. Co., 354 F.3d 568, 578 (6th Cir.2004), or to invent what would be a truly novel tort claim on behalf of the state, Insolia, 216 F.3d at 607, absent some authority to suggest that the approval of the Supreme Court of Indiana is forthcoming. See Todd, 21 F.3d at 1412 (noting that federal courts should be wary of broadening untested theories of liability under state law); see also Insolia, 216 F.3d at 607 (noting that we would neither recognize independently nor certify a question to the state regarding every creative but unlikely state cause of action that litigants devise from a blank slate); Birchler v. Gehl Co., 88 F.3d 518, 521 (7th Cir.1996) (favoring narrow interpretation of undecided issues of liability under state law); Ry. Express Agency, Inc. v. Super Scale Models, Ltd., 934 F.2d 135, 138 (7th Cir.1991) (noting that recent opinions of this court have strongly encouraged district courts to dismiss actions based on novel state law claims). In sum, all of the interpretive tools of which we routinely make use in our attempt to determine the content of state law point us to the conclusion that the Supreme Court of Indiana would not allow the plaintiffs' claim to proceed.