Court Opinion

ID: 7400268
Source: CourtListenerOpinion
Date Created: 2022-07-29 01:52:36.964923+00
Date Added: 2024-06-11T16:21:55.317597
License: Public Domain

McFadden, Presiding Judge, concurring in part and dissenting in part.
Athens Orthopedic Clinic filed a two-part motion to dismiss: it moved to dismiss the entire complaint under OCGA § 9-11-12 (b) (1) due to lack of subject-matter jurisdiction *648because of the plaintiffs' alleged lack of standing, and it moved to dismiss each claim for relief under OCGA § 9-11-12 (b) (6) due to the failure to state a claim. I would reverse the trial court's order granting the motion to dismiss because the plaintiffs have alleged facts sufficient to establish their standing. I would remand the case for further proceedings. So I dissent to Division 2 of the majority opinion. I concur in Division 1 because I agree with the majority that the plaintiffs failed to demonstrate that the trial court considered matters outside the complaint, given the trial court's explicit statement otherwise.
1. Standing is jurisdictional and should be addressed at the outset.
The majority does not address the issue of standing, instead implicitly pretermitting the issue and affirming the order of dismissal on the ground that the plaintiffs fail to state any claims. But standing "is jurisdictional and must be assessed before reaching the merits." Byrd v. United States , --- U.S. ----, ---- (IV), 138 S.Ct. 1518, 1530, 200 L.Ed.2d 805 (2018). "Jurisdiction of a court to afford the relief sought is a matter which should be decided preliminarily, at the outset. Jurisdiction either exists or does not exist without regard to the merit of the case." Whitlock v. Barrett , 158 Ga. App. 100, 103, 279 S.E.2d 244 (1981). See also Ruhrgas Ag v. Marathon Oil Co. , 526 U.S. 574, 577, 119 S.Ct. 1563, 143 L.Ed.2d 760 (1999) (federal courts may not pretermit the issue of jurisdiction even where the merits question is more readily resolved and the prevailing party on the merits would be the same as the prevailing party were jurisdiction denied).
Standing requires, among other things, that the plaintiffs have suffered an "injury in fact." Lujan v. Defenders of Wildlife , 504 U.S. 555, 560 (II), 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). And injury in fact is necessary for any cause of action the plaintiffs might claim, so an analysis of the standing issue is logically precedent to an analysis of the plaintiffs' particular causes of action. Accordingly I would address the issue of standing.1
2. The merits of the standing issue.
This case presents an issue of first impression for our court. Neither we, the Georgia Supreme Court, nor the Eleventh Circuit have decided whether a data breach, with little more, amounts to an injury in fact for purposes of standing. See Resnick v. AvMed , 693 F.3d 1317, 1323 (III) n. 1 (11th Cir. 2012) ("Some of our sister Circuits have found that even the threat of future identity theft is sufficient to confer standing in similar circumstances. As Plaintiffs have alleged only actual-not speculative-identity theft, we need not address the issue of whether speculative identity theft would be sufficient to confer standing.") (citations omitted). But the federal courts have uniformly applied a rule that a substantial risk of future harm is sufficient to show an injury in fact for purposes of standing. And applying that rule here, leads to the conclusion that the plaintiffs have standing.
"(I)n the absence of our own authority we frequently have looked to United States Supreme Court precedent concerning Article III [ (U. S. Const., Art. III, § 2) ] standing to resolve issues of standing to bring a claim in Georgia's courts." Center for a Sustainable Coast v. Turner , 324 Ga. App. 762, 764, 751 S.E.2d 555 (2013) (citation and punctuation omitted). Under that authority, the United States Supreme Court has held, "[a]n injury sufficient to satisfy Article III must be concrete and particularized and actual or imminent, not conjectural or hypothetical[, but a]n allegation of future injury may suffice if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur." Susan B. Anthony List v. Driehaus , --- U.S. ----, ---- (III) (A), 134 S.Ct. 2334, 2341, 189 L.Ed.2d 246 (2014) (citations and punctuation omitted; emphasis supplied). And *649the United States Circuit Courts of Appeal have, of course, uniformly applied that rule. See, e.g., Klayman v. President of the United States , 689 F. Appx. 921, 923 (11th Cir. 2017) ("An allegation of future injury may suffice if the threatened injury is substantially certain to occur."); Reddy v. Foster , 845 F.3d 493, 500 (II) (A) (1st Cir. 2017) ; Kenny v. Wilson , 885 F.3d 280, 287 (II) (4th Cir. 2018). See also Parker v. Leeuwenburg , 300 Ga. 789, 796 (2), 797 S.E.2d 908 (2017) (Peterson, J., dissenting) ("Evidence of future injury may suffice to constitute an injury in fact if the threatened injury is certainly impending, or there is a substantial risk that the harm will occur .") (citation and punctuation omitted; emphasis added). We should follow the rule uniformly adopted by the federal courts. Applying the rule here leads to the conclusion that the plaintiffs have standing.
The plaintiffs allege that due to the hackers2 obtaining their personal information, there is an "imminent threat that their personal information will be used to their detriment." They allege that the FBI had warned that health care systems were at risk of hacking because of "a higher financial payout for medical records in the black market," implying that such information is at risk of being offered for sale. They allege that their personally identifiable information, including insurance policy identification numbers, home addresses, dates of birth, ages, phone numbers, email addresses, and social security numbers, was offered for sale, and some of the information was posted to a public file-sharing storage website that facilitates the sharing of online data. The plaintiffs allege that they and other potential class members "face the imminent and substantial risk of future injury." One of the named plaintiffs already had fraudulent charges made using her credit card.
The plaintiffs' allegations of future injury show a substantial risk that harm will occur. The allegations thus suffice to establish standing. Compare Ree v. Zappos.com , 888 F.3d 1020 (9th Cir. 2018) (customers whose personal identifying information, including names, account numbers, passwords, email addresses, billing and shipping addresses, telephone numbers, and credit and debit card information, was allegedly stolen by hackers, but who did not allege that the information had been used to conduct financial transactions, had Article III standing to bring class action based on a substantial risk that the hackers would commit identity fraud or identity theft); Attias v. Carefirst , 865 F.3d 620, 629 (D.C. Cir. 2017), cert. denied, ("[n]o long sequence of uncertain contingencies involving multiple independent actors has to occur before the plaintiffs [who were victims of a data breach] will suffer any harm; a substantial risk of harm exists already, simply by virtue of the hack and the nature of the data that the plaintiffs allege was taken"); Galaria v. Nationwide Mut. Ins. Co. , 663 F. Appx. 384, 388 (6th Cir. 2016) (plaintiffs, whose personal information was stolen when defendant's network was hacked, adequately alleged Article III standing because they alleged that the theft of their personal data placed them at a continuing, increased risk of fraud and identity theft, that their injuries were fairly traceable to defendant's conduct, and a favorable verdict would provide redress); Remijas v. Neiman Marcus Group, LLC , 794 F.3d 688, 693 (7th Cir. 2015) ("Why else would hackers break into a store's database and steal consumers' private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers' identities.") with Katz v. Pershing, LLC , 672 F.3d 64, 80 (1st Cir. 2012) (plaintiff's increased risk of unauthorized access and identity theft theory insufficient to constitute "actual or impending injury" because plaintiff failed to "identify any incident in which her data has ever been accessed by an unauthorized person"); and Reilly v. Ceridian Corp ., 664 F.3d 38, 42 (3d Cir. 2011) (allegations of possible future injury insufficient to satisfy standing requirements).
Because I would find that the plaintiffs established standing by alleging an injury in fact, I would reverse the trial court. I would remand the case for the trial court to reconsider *650Athens Orthopedic Clinic's 12 (b) (6) motion in light of this finding.

The trial court did not specify whether he was granting the motion to dismiss under OCGA § 9-11-12 (b) (1) or (b) (6). Such a specification is important. For one thing, dismissals under OCGA § 9-11-12 (b) (1) are without prejudice, Pinnacle Benning, LLC v. Clark Realty Capital, LLC , 314 Ga. App. 609, 618 (2) (a), 724 S.E.2d 894 (2012), while dismissals under OCGA § 9-11-12 (b) (6) are on the merits and with prejudice. Jordan, Jones & Goulding v. Balfour Beatty Constr ., 246 Ga. App. 93, 93 (1), 539 S.E.2d 828 (2000). See also OCGA § 9-11-41 (b).

I would not indulge these thieves by using the comically grandiose name they have given themselves. They are common criminals, and we should not glamorize them.