Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 1 of 22
`
`UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF COLUMBIA
`
`
`Chantal ATTIAS, et al.,
`
`
`
`
`
`
`
`
`
`
`
`
`
`Case No. 15-cv-00882 (CRC)
`
`
`
`
`
`
`
`Plaintiffs,
`
`
`
`
`CAREFIRST, INC., et al.,
`
`v.
`
`
`
`
`
`Defendants.
`
`
`
`
`
`MEMORANDUM OPINION
`
`Plaintiffs brought this putative class action against D.C.-area health insurer CareFirst and
`
`various of its affiliates after CareFirst suffered a data breach in 2014. The breach compromised
`
`the names, birthdates, email addresses, and subscriber identification numbers of over one million
`
`of CareFirst’s insureds. The named plaintiffs are seven of those insureds, and they lodge a host
`
`of contract, tort, and state-specific statutory claims against the company stemming from the
`
`breach.
`
`CareFirst has now twice moved to dismiss the complaint. On the first occasion, the Court
`
`granted the motion on standing grounds and dismissed the complaint in its entirety. That
`
`decision was reversed by the D.C. Circuit, which concluded that plaintiffs’ heightened risk of
`
`future identity theft satisfied the injury-in-fact requirement of Article III standing. On remand,
`
`CareFirst renewed its motion to dismiss the complaint for failure to state a claim, which the
`
`Court granted in substantial part. All told, the Court dismissed all the claims in the complaint
`
`save two claims advanced by the two named plaintiffs who alleged actual misuse of their
`
`exposed data. The Court then issued a final order as to the dismissed claims under Federal Rule
`
`of Civil Procedure 54(b), thereby permitting plaintiffs to appeal. However, the D.C. Circuit
`
`
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 2 of 22
`
`concluded that the requirements of Rule 54(b) had not been met and thus dismissed the appeal
`
`for lack of jurisdiction.
`
`Following remand, plaintiffs filed the present motion for reconsideration of the Court’s
`
`dismissal of their claims under Rule 12(b)(6). Reconsideration is warranted, plaintiffs argue, to
`
`clarify that D.C. law does not require actual damages to sustain a breach of contract claim; to
`
`address intervening D.C. Circuit precedent that, in plaintiffs’ view, widens the scope of “actual
`
`damages” stemming from the data breach; and to correct the Court’s prior analysis of the
`
`relationship between plaintiffs’ claims under the District of Columbia Consumer Protection
`
`Procedures Act and their breach of contract claims. For the following reasons, the Court will
`
`grant the motion in part and deny it in part.
`
`I. Background
`
`A. Factual Background
`
`The Court presumes familiarity with its two prior opinions, Attias v. CareFirst, Inc., 199
`
`F. Supp. 3d 193 (D.D.C. 2016) (“Attias I”), and Attias v. CareFirst, Inc., 365 F. Supp. 3d 1
`
`(D.D.C. 2019) (“Attias II”), which fully recount the background facts. The Court will only
`
`briefly summarize them here.
`
`CareFirst, Inc. and certain of its affiliates (collectively, “CareFirst”) operate a group of
`
`health insurance companies that provide coverage to over one million people in the District of
`
`Columbia, Maryland, and Virginia. See Second Am. Class Action Compl., ¶ 23 (“SAC”) ECF
`
`No. 9. To receive CareFirst insurance, customers provide the company with personal
`
`information including their names, addresses, and social security numbers. Id. ¶¶ 26–27. In
`
`June 2014, this information (with the exception, according to CareFirst, of the insureds’ social
`
`security numbers) was compromised when the company suffered a data breach. Id. ¶ 33.
`
`2
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 3 of 22
`
`CareFirst discovered the breach in April 2015 and notified the public the following month. Id.
`
`¶ 15, 35–36. Shortly thereafter, plaintiffs filed this putative class action.
`
`B. Procedural Background
`
`1. The complaint
`
`The operative complaint names seven plaintiffs: Chantal Attias and Andreas Kotzur of
`
`the District of Columbia, Richard and Latanya Bailey of Virginia, and Curt and Connie Tringler
`
`and Lisa Huber of Maryland. Id. ¶¶ 1–4. They each allege that CareFirst’s carelessness in
`
`handling their personal information violated D.C. tort and contract laws, as well as the consumer
`
`protection statutes of each plaintiff’s home state. All told, the complaint contains eleven claims:
`
`breach of contract (Count I), negligence (Count II), violation of the District of Columbia
`
`Consumer Protection Procedures Act (“CPPA”) (Count III), violation of the District of Columbia
`
`Data Breach Notification Act (Count IV), violation of the Maryland Consumer Protection Act
`
`(“MCPA”) (Count V), violation of the Virginia Consumer Protection Act (“VCPA”) (Count VI),
`
`fraud (Count VII), negligence per se (Count VIII), unjust enrichment (Count IX), breach of the
`
`duty of confidentiality (Count X), and constructive fraud (Count XI).
`
`By way of damages, plaintiffs allege that the data breach heightened their risk of future
`
`identity theft, resulting in “economic and non-economic loss in the form of mental and emotional
`
`pain and suffering,” id. ¶ 38, as well as “years of constant surveillance of their financial and
`
`personal records, monitoring, and loss of rights,” id. ¶ 56. Two plaintiffs, the Baileys of
`
`Virginia, also allege that “they were not given the benefit of the services for which they
`
`bargained[.]” Id. ¶ 114. Two more plaintiffs, the Tringlers of Maryland, allege that they
`
`suffered “tax-refund fraud” because, at least at the time of the complaint, they had not received
`
`an expected federal tax refund. Id. ¶ 57.
`
`3
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 4 of 22
`
`2. Dismissal for lack of jurisdiction
`
`In September 2015, CareFirst moved to dismiss the complaint for lack of subject matter
`
`jurisdiction under Rule 12(b)(1) and for failure to state a claim under Rule 12(b)(6). See Mot. to
`
`Dismiss, ECF No. 13. The Court granted the Rule 12(b)(1) motion, finding that it lacked subject
`
`matter jurisdiction because plaintiffs failed to satisfy the injury-in-fact requirement of Article III
`
`standing. See Attias I, 199 F. Supp. 3d at 203. Five of the seven plaintiffs (all but the Tringlers)
`
`failed to allege any actual misuse of their information. In accord with several other district court
`
`decisions nationwide—including one dismissing a Maryland federal class action brought by
`
`another group of CareFirst customers affected by the same breach—the Court concluded that
`
`“merely having one’s personal information stolen in a data breach is insufficient to establish
`
`standing to sue the entity from wh[ich] the information was taken.” Id. at 197. As to the
`
`Tringlers, the Court found that they failed to plausibly allege either (i) that their social security
`
`numbers were stolen as part of the breach, or (ii) that tax refund fraud could occur without the
`
`perpetrators having access to such numbers. Id. at 201. The Court therefore concluded that the
`
`Tringlers’ injury was not “fairly traceable” to the breach and that they, too, lacked standing. Id.
`
`(citing Clapper v. Amnesty Int’l, 568 U.S. 398, 409 (2013)).
`
`The D.C. Circuit reversed. See Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir. 2017).
`
`The court reasoned that the complaint contained specific allegations that CareFirst “collected and
`
`stored” personal information that could be combined to commit identity theft and fraud—even if
`
`the compromised information did not include plaintiffs’ social security numbers. Id. at 628. The
`
`resulting “risk of future injury” was alone “substantial enough to create Article III standing.” Id.
`
`4
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 5 of 22
`
`3. Dismissal for failure to state a claim
`
`On remand, CareFirst filed a renewed Rule 12(b)(6) motion to dismiss for failure to state
`
`a claim. See Mot. to Dismiss, ECF No. 44. The Court granted the motion in substantial part,
`
`permitting only two claims brought by the Tringlers to proceed. See Attias II, 365 F. Supp. 3d 1
`
`(D.D.C. 2019). As that opinion is the basis of the present motion for reconsideration, the Court
`
`will describe it in some detail.
`
`In resolving CareFirst’s renewed motion, the Court began by addressing the company’s
`
`argument that plaintiffs failed to plead actual damages as required by nine of the eleven claims—
`
`specifically, those for (1) breach of contract, (2) negligence, (3) negligence per se, (4) fraud, (5)
`
`constructive fraud, (6) breach of duty of confidentiality, (7) violation of the MCPA, (8) violation
`
`of the VCPA, and (9) violation of the D.C. Data Breach Notification Act. The Court addressed
`
`each claim under the relevant governing law (for the most part, D.C. common law) and
`
`concluded that each required an allegation of actual damages.
`
`Turning to the operative complaint, the Court observed four potential theories of
`
`damages: (1) actual misuse of personal information, (2) benefit of the bargain struck in the
`
`underlying insurance contracts, (3) mitigation costs, and (4) emotional distress. Starting from the
`
`top, the Court concluded that “actual misuse” of exposed information clearly qualified as “actual
`
`damages.” Attias II, 365 F. Supp. 3d at 11–12. It stressed, however, that under the D.C. Court
`
`of Appeals’ decision in Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C.
`
`2009), actual misuse of personal data under D.C law requires more than a mere threat of future
`
`misuse. Rather, to sufficiently plead actual damages under that theory, D.C. common law
`
`requires the plaintiff to allege an instance of present (or actual) misuse of her personal data. See
`
`id. Only the Tringlers, who alleged that they suffered tax refund fraud as a result of the breach,
`
`5
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 6 of 22
`
`plausibly alleged such misuse. See SAC ¶ 57. The Court thus concluded that the first theory of
`
`damages had been inadequately alleged by the other plaintiffs. Attias II, 365 F. Supp. 3d at 12.
`
`Plaintiffs’ alternative theories of damages were less convincing. As to the second
`
`theory—benefit of the bargain—plaintiffs “broadly allege[d] that some indeterminate amount of
`
`their health insurance premiums went towards providing data security” that they did not receive.
`
`Id. at 13. Observing that the D.C. Court of Appeals had not spoken on the issue, the Court ruled
`
`in accord with fellow courts in this District that found the theory too amorphous to plausibly
`
`allege injury-in-fact. Id. (citing In re Sci. Applications Int’l Corp. Backup Tape Data Theft
`
`Litig., 45 F. Supp. 3d 14 (D.D.C. 2014) and Austin-Spearman v. AARP & AARP Servs. Inc.,
`
`119 F. Supp. 3d 1, 13–14 (D.D.C. 2015)). As to the third theory—mitigation damages—the
`
`Court looked again to Randolph, where the D.C. Court of Appeals squarely held that costs
`
`associated with “credit monitoring or other security measures to guard against possible misuse of
`
`[plaintiffs’] data” was “not the result of any present injury, but rather the result of the
`
`anticipation of future injury that has not materialized.” 973 A.2d at 708 (cleaned up). See Attias
`
`II, 365 F. Supp. 3d at 14.
`
`The Court then turned to plaintiffs’ fourth and final theory: emotional distress. By this
`
`stage in the analysis, the Court had rejected the economic theories of damages (as explained
`
`above) for all but the Tringlers. Save for the Tringlers, then, plaintiffs were left with claims for
`
`purely emotional distress. Id. at 16–17. This outcome was fatal for plaintiffs’ fraud and MCPA
`
`claims, which permit recovery of emotional distress only where there is an accompanying
`
`allegation of pecuniary (for the fraud claims) or physical (for the MCPA claims) injury. See id.
`
`As to the negligence claims, D.C. law requires plaintiffs pleading purely emotional distress to
`
`satisfy either the “zone of physical danger rule,” Williams v. Baker, 572 A.2d 1062 (D.C. 1990)
`
`6
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 7 of 22
`
`(en banc), or the “special relationship and undertaking rule,” Hedgepeth v. Whitman Walker
`
`Clinic, 22 A.3d 789, 795 (D.C. 2011). Plaintiffs, who pleaded emotional distress as ancillary
`
`damages, satisfied neither. See Attias II, 365 F. Supp. 3d at 17. The Court thus concluded that
`
`the alleged emotional distress did not sustain plaintiffs’ burden to plead actual damages.1 Id.
`
`Accordingly, the Court dismissed the claims for breach of contract, negligence,
`
`negligence per se, fraud, constructive fraud, violation of the D.C. Data Breach Notification Act,
`
`violation of the MCPA, violation of the VCPA, and breach of the duty of confidentiality, for all
`
`but the Tringlers. Id. In sum, the Court’s analysis of damages left the Tringlers with all their
`
`claims and the D.C. plaintiffs with only their D.C. CPPA claims.2 Id.
`
`The Court then addressed CareFirst’s alternative argument that plaintiffs’ tort claims
`
`should be dismissed as duplicative of their contract claims. This argument was premised on the
`
`“independent duty rule,” which requires tort claimants to allege that defendants owed them a
`
`common-law duty of care independent of any contractual relationship. See id. at 18. The Court
`
`determined that plaintiffs ran afoul of this rule because they alleged “no facts separable from the
`
`terms of the contract upon which the tort may independently rest.” Id. (cleaned up). The Court
`
`thus dismissed the tort claims advanced by all plaintiffs (including the Tringlers) based on the
`
`independent duty rule. Id. at 25. It then dismissed the D.C. plaintiffs’ claims under the D.C.
`
`
`
`1 Plaintiffs did not seek emotional distress damages for their VCPA, D.C. Data Breach
`Notification Act, breach of duty of confidentiality, or breach of contract claims.
`
` The Court also granted CareFirst’s motion to dismiss plaintiffs’ unjust enrichment
`claims as precluded by the existence of a valid, enforceable contract. See Attias II, 365 F. Supp.
`at 25. Plaintiffs have not requested reconsideration of that decision, and the Court finds no
`reason to disturb it here.
`
` 2
`
`7
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 8 of 22
`
`CPPA for largely the same reason. Id. at 25–26 (dismissing plaintiffs’ D.C. CPPA claims as
`
`“entirely duplicative of their breach of contract claim”).
`
`All said and done, the Court dismissed all but the Tringlers’ claims for breach of contract
`
`and violations of the MCPA. The Court then sought the parties’ views as to whether it should
`
`enter an order under Federal Rule of Civil Rule 54(b)—which permits certain orders that resolve
`
`some, but not all, claims for relief to be certified as “final”—or, alternatively, under 28 U.S.C.
`
`§ 1292(b). See Feb. 14, 2019, Min. Order. The parties “conferred and agree[d] that the Court
`
`should enter an order under Federal Rule of Civil Procedure 54(b) directing a final appealable
`
`judgment.” Response at 1, ECF No. 59; see also Response at 1, ECF No. 58. Finding no just
`
`reason to delay entry of final judgment on the dismissed claims, the Court entered the requested
`
`order on February 26, 2019. See Order, ECF No. 60. Plaintiffs appealed.
`
`4. Subsequent proceedings
`
`On appeal, the D.C. Circuit considered sua sponte whether the Court properly issued a
`
`final appealable order under Rule 54(b). See Dec. 6, 2019 Per Curiam Order, Attias v. CareFirst,
`
`969 F.3d 412 (2020) (No. 19-7020). The presiding panel requested supplemental briefing on the
`
`issue; both sides responded that Rule 54(b) was satisfied and that the appeal was thus properly
`
`before the Circuit. The panel disagreed. For an otherwise interlocutory order to be certified as a
`
`final judgment under Rule 54(b), it explained, “the order must resolve a distinct claim for relief.”
`
`Attias, 969 F.3d at 417 (cleaned up). The panel reasoned that the Court’s Rule 54(b)
`
`certification failed to satisfy that requirement because the dismissed claims “appear[ed] highly
`
`intertwined” with the Tringlers’ two remaining claims. Id. at 418 (cleaned up). And “if a
`
`disposition is not ‘final’ under Rule 54(b),” the panel continued, “then it likewise cannot qualify
`
`8
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 9 of 22
`
`as a ‘final decision’ under [28 U.S.C. §] 1291.” Id. at 417. The Circuit thus dismissed the
`
`appeal for lack of jurisdiction. Id. at 418.
`
`So, the case is once again before this Court. Plaintiffs, for their part, request
`
`reconsideration of the Court’s decision to dismiss the bulk of their complaint for failure to plead
`
`actual damages and failure to distinguish their contract claims from their D.C. CPPA claims.
`
`CareFirst opposes reconsideration, and requests that the case be permitted to proceed to
`
`discovery to resolve the narrow question of whether the Tringlers have by now received their tax
`
`refund. The Court held a hearing on plaintiffs’ reconsideration motion on October 21, 2020.
`
`II. Legal Standard
`
`The Court begins with a procedural point. Although plaintiffs filed their motion to
`
`reconsider “pursuant to Federal Rules of Civil Procedure 59(e) and 60,” Pls. Memo. at 1, ECF
`
`No. 65, neither rule permits reconsideration in these circumstances.
`
`For starters, motions for reconsideration under Rule 59(e) “must be filed no later than 28
`
`days after the entry of the judgment.” Plaintiffs missed that deadline by nearly two years.
`
`Typically, courts elect to consider motions filed after the Rule 59(e) deadline under Rule 60(b),
`
`which permits reconsideration of a court’s “final judgment” in certain circumstances. Fed. R.
`
`Civ. P. 60(b); see, e.g., Owen-Williams v. BB & T Inv. Servs., Inc., 797 F. Supp. 2d 118, 121–22
`
`(D.D.C. 2011). Save for the more permissive deadline, however, “in most cases, the bar stands
`
`even higher for a party to prevail on a Rule 60(b) motion[.]” Uberoi v. EEOC, 271 F. Supp. 2d
`
`1, 2 (D.D.C. 2002). That’s because Rule 60(b) motions are granted in very limited
`
`circumstances, requiring a showing of “fraud, mistake, extraordinary circumstances, or other
`
`enumerated situations.” Id. at 3.
`
`9
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 10 of 22
`
`Though plaintiffs neglect to specify which portion of Rule 60(b) they believe permits
`
`reconsideration, only the “catchall provision,” Rule 60(b)(6), is arguably applicable. Resort to
`
`Rule 60(b)(6) is “appropriate only in extraordinary circumstances,” however. Kramer v. Gates,
`
`481 F.3d 788, 790 (D.C. Cir. 2007) (cleaned up). Here, plaintiffs’ motion is based partly on
`
`previously available authority that plaintiffs seemingly overlooked and partly on intervening case
`
`law. Typically, neither scenario is considered extraordinary circumstances warranting
`
`reconsideration under Rule 60(b)(6). See Walsh v. Hagee, 10 F. Supp. 3d 15, 19 (D.D.C. 2013)
`
`(extraordinary circumstances not presented by “theories or arguments that could have been raised
`
`previously”) (cleaned up); Kramer v. Gates, 481 F.3d 788, 791–92 (D.C. Cir. 2007)
`
`(extraordinary circumstances not presented by “an intervening change in case law”) (cleaned up).
`
`Regardless, reconsideration under Rule 60(b)(6) is barred by a more glaring obstacle—
`
`the rule explicitly applies to only final orders. See Fed. R. Civ. P. 60(b) (providing that “the
`
`court may relieve a party or its legal representative from a final judgment, order, or proceeding”)
`
`(emphasis added). And plaintiffs seek reconsideration of an order that the D.C. Circuit has
`
`declared to be non-final and interlocutory. See Attias, 969 F.3d at 417–18.
`
`All is not lost for plaintiffs, however. Because they seek reconsideration of an
`
`interlocutory order, the Court may consider it within its discretion under Rule 54(b). See, e.g.,
`
`Pinson v. DOJ, 321 F.R.D. 1, 3–4 (D.D.C. 2017) (reconsidering motion filed under Rules 59(e)
`
`and 60 under Rule 54(b)). Rule 54(b) provides:
`
`When an action presents more than one claim for relief . . . the court may direct
`entry of a final judgment as to one or more, but fewer than all, claims . . . .
`Otherwise, any order or other decision . . . does not end the action as to any of the
`claims or parties and may be revised at any time before the entry of a judgment
`adjudicating all the claims and all the parties’ rights and liabilities.
`
`
`
`10
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 11 of 22
`
`Fed. R. Civ. P. 54(b) (emphasis added). The distinction between the various rules is a
`
`meaningful one, as the standard for review of interlocutory decisions is more permissive than
`
`that applied to motions for reconsideration under Federal Rules of Civil Procedure 59(e) or
`
`60(b). See, e.g., Williams v. Savage, 569 F. Supp. 2d 99, 108 (D.D.C. 2008). As the D.C.
`
`Circuit has explained, “Rule 54(b)’s approach to the interlocutory presentation of new arguments
`
`as the case evolves can be more flexible” than under Rule 59(e), “reflecting the inherent power
`
`of the rendering district court to afford such relief from interlocutory judgments as justice
`
`requires.” Cobell v. Jewell, 802 F.3d 12, 25 (D.C. Cir. 2015) (cleaned up).
`
`The “as justice requires” standard “leave[s] a great deal of room for the court’s
`
`discretion” and, at times, “amounts to determining whether relief upon reconsideration is
`
`necessary under the relevant circumstances.” Lewis v. Dist. of Columbia, 736 F. Supp. 2d 98,
`
`102 (D.D.C. 2010) (cleaned up). That being said, the court’s discretion under Rule 54(b) is not
`
`boundless, but rather is “limited by the law of the case doctrine and subject to the caveat that
`
`where litigants have once battled for the court’s decision, they should neither be required, nor
`
`without good reason permitted, to battle for it again.” Id. (cleaned up).
`
`III. Analysis
`
`Plaintiffs seek reconsideration of the Court’s prior opinion for three reasons. First,
`
`plaintiffs contend that, contrary to the Court’s initial conclusion, actual damages are not required
`
`to state a claim for breach of contract under D.C. common law. Second, plaintiffs argue that
`
`intervening D.C. Circuit caselaw treats data-breach mitigation expenses as “actual damages” and
`
`thereby eliminates the Court’s basis for dismissing nine of their eleven claims. And third,
`
`plaintiffs maintain that the Court clearly erred in concluding that CareFirst’s alleged breach of
`
`contract is not actionable under the D.C. CPPA. The Court will address each contention in turn.
`
`11
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 12 of 22
`
`A. Whether Plaintiffs’ Contract Claims Require an Allegation of Actual Damages.
`
`The Court begins with plaintiffs’ request for reconsideration of their contract claims. As
`
`explained, the Court previously dismissed all but the Tringlers’ contract claims on the grounds
`
`that none of the other plaintiffs pleaded actual damages. See Attias II, 969 F. Supp. 3d at 9–10,
`
`17. For the premise that plaintiffs must allege actual damages to support a breach of contract
`
`claim under D.C. law, the Court pointed to Cahn v. Antioch Univ., 482 A.2d 120, 130 (D.C.
`
`1984), where the D.C. Court of Appeals observed that a “[i]t is clear in contract law that a
`
`plaintiff is not required to prove the amount of his damages precisely; however, the fact of
`
`damage and a reasonable estimate must be established.” (cleaned up).
`
`In hindsight, the Courts’ reliance on Cahn may have been misplaced. As a fellow judge
`
`on this Court recently observed, “there is a conflict within the caselaw” as to whether “proof of
`
`actual damages is an element of a [D.C.] contract claim.” Moini v. LeBlanc, 456 F. Supp. 3d 34,
`
`51 (D.D.C. 2020). On the one hand, the D.C. Court of Appeals has clearly indicated that
`
`damages are required for a prima facie contract claim. See Cahn, 482 A.2d at 130; see also
`
`Osbourne v. Capital City Mortg. Corp., 727 A.2d 322, 324–25 (D.C. 1999) (observing that a
`
`“prima facie case for breach of contract . . . required some proof of damages”). On the other
`
`hand, the D.C. Court of Appeals has since stated, in Wright v. Allen, that “the absence of
`
`specific monetary injury does not prevent the accrual of a cause of action for breach of
`
`contract[.]” 60 A.3d 749, 753 (D.C. 2013) (cleaned up). Wright explained that “[e]ven where
`
`monetary damages cannot be proved” the prevailing party may be entitled to nominal damages,
`
`specific performance, or declaratory relief. Id. at 206 & n.3; see also Francis v. Rehman, 110
`
`A.3d 615, 620 (D.C. 2015) (“to state a claim for breach of contract so as to survive a Rule
`
`12(b)(6) motion to dismiss, it is enough for the plaintiff to describe the terms of the alleged
`
`contract and the nature of the defendant’s breach”).
`
`12
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 13 of 22
`
`The D.C. Court of Appeals appears not to have addressed this apparent conflict, and this
`
`Court is not poised to resolve it on the present motion. The Court notes, however, that Wright
`
`and Francis both post-date Cahn and Osbourne, and in order “[t]o properly discern the content of
`
`state law,” it is this Court’s duty to “defer to the most recent decisions of the state’s highest
`
`court.” Easaw v. Newport, 253 F. Supp. 3d 22, 34 (D.D.C. 2017) (emphasis added) (cleaned up).
`
`The more recent cases thus favor permitting plaintiffs’ contract claims to proceed. The Court
`
`will, therefore, grant plaintiffs’ motion to reconsider this issue and reinstate their contract claims
`
`(Count I).3
`
`B. Whether Plaintiffs Alleged Actual Damages in Light of Intervening Precedent.
`
`Plaintiffs next request reconsideration of whether they did, in fact, plead actual damages
`
`in light the D.C. Circuit’s intervening decision in In re: U.S. Office of Pers. Mgmt. Data Sec.
`
`Breach Lit., 928 F.3d 42 (D.C. Cir. 2019) (“OPM”). To address this argument, the Court will
`
`first briefly recount the Circuit’s ruling in OPM before turning to whether it warrants
`
`reconsideration of the Court’s dismissals.
`
`1. The OPM decision
`
`In OPM, plaintiffs filed suit against the Office of Personnel Management (“OPM”)
`
`following a series of cyberattacks that exposed multiple OPM databases, including ones
`
`containing information drawn from federal employment background investigations. Id. at 50.
`
`The attacks allegedly compromised plaintiffs’ social security numbers, home addresses, and
`
`fingerprints. Id. at 50. The claims included violations of the Privacy Act of 1974, 5 U.S.C.
`
`§ 552a, a federal statute governing the handling of confidential records by Executive Branch
`
`
`
`3 The Court reaches this conclusion despite the fact that plaintiffs failed to cite either
`Wright or Francis in their briefing on the motion to dismiss.
`
`13
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 14 of 22
`
`agencies. The Privacy Act permits recovery for certain violations of its terms where, among
`
`other things, plaintiffs have suffered “actual damages” due to an agency’s willful violation. Id.
`
`at 64 (cleaned up).
`
`OPM sought dismissal of plaintiffs’ Privacy Act claims on the grounds that they failed to
`
`plead the requisite damages. The district court granted the motion for all but two plaintiffs who
`
`allegedly had incurred out-of-pocket expenses as a result of actual identity theft. In re OPM
`
`Security Breach Lit., 266 F. Supp. 3d 1, 40 (D.D.C. 2017) aff’d in part, rev’d in part and
`
`remanded, 928 F.3d 42 (D.C. Cir. 2019). In the district court’s view, “actual damages” excluded
`
`allegations of identity theft, lost time, or emotional distress unaccompanied by any attendant out-
`
`of-pocket expenses. Id. at 39–40. The court further concluded that the cost of credit monitoring
`
`services did not suffice “because expenditures undertaken voluntarily to prevent possible future
`
`harm [did] not constitute actual damages attributable to OPM.” Id. at 40.
`
`The D.C. Circuit reversed in relevant part. Specifically, the court found that even those
`
`plaintiffs who had not incurred any pecuniary losses because of a past instance of identity theft
`
`had adequately alleged actual damages within the meaning of Privacy Act. OPM, 928 F.3d at
`
`64–66. Such plaintiffs included those who “purchased credit protection and/or credit repair
`
`services after learning of the breach.” Id. at 65. The court construed these types of prophylactic
`
`expenses, despite (in some cases) having accrued wholly apart from any alleged misuse of
`
`plaintiffs’ personal data, as the “paradigmatic example of ‘actual damages’ resulting from the
`
`violation of privacy protections.” Id. at 65.
`
`2. Application of OPM to plaintiffs’ claims
`
`Plaintiffs argue that OPM requires broad reconsideration of the nine claims previously
`
`dismissed for failure to plead actual damages. Plaintiffs home in on the Court’s rejection of their
`
`14
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 15 of 22
`
`mitigation theory of damages, which in their view closely resembles the theory of damages
`
`alleged in OPM.4 They argue that OPM’s acceptance of out-of-pocket expenses resulting from
`
`“credit protection and/or credit repair services” as “actual damages” under the Privacy Act,
`
`OPM, 928 F.3d at 65, undermines this Court’s prior finding that mitigation costs “cannot be
`
`recovered as consequential damages because there is not an actual injury, only an anticipated
`
`one,” Attias II, 365 F. Supp. 3d at 15.
`
`The Court begins with a preliminary point: plaintiffs are mistaken that OPM is
`
`“controlling on the issue of damages[.]” Pls. Memo. at 4; see also Reply Mot. at 4, ECF No. 71
`
`(claiming that “OPM is controlling authority”). As this Court sits in diversity, plaintiffs’ claims
`
`are governed by the substantive laws of D.C., Virginia, and Maryland. By contrast, OPM
`
`construed actual damages in the context of a federal statute that is not at issue in this litigation.
`
`And as the Court previously stated, the state law context is “all the more salient in a data breach
`
`case” because “federal courts across the country have applied the relevant state law to claims
`
`arising out of data breaches to very different effect.” Attias II, 365 F. Supp. 3d at 8. This
`
`context is especially important when considering the meaning of “actual damages,” which is a
`
`term of art that retains a “chameleon like quality” and resists any “all-purpose definition.”
`
`Federal Aviation Admin. v. Cooper, 566 U.S. 284, 294 (2012).
`
`
`
`4 Plaintiffs also assert that “applying the law of OPM supports that [p]laintiffs have pled
`damages in this case including both economic and non-economic damage.” Pls. Memo. at 3–4.
`Plaintiffs are incorrect. In fact, OPM reiterated that “[a]ctual damages’ within the meaning of
`the Privacy Act are limited to proven pecuniary or economic harm.” OPM, 928 F.3d at 64
`(emphasis added).
`
`15
`
`
`
`

`

`Case 1:15-cv-00882-CRC Document 76 Filed 01/29/21 Page 16 of 22
`
`Against this backdrop, the Court turns to plaintiffs’ contention that reconsideration of
`
`“actual damages” is warranted in light of OPM. The Court will begin with the claims governed
`
`by D.C. law before turning to those governed by Virginia and Maryland law.
`
`a. D.C. claims
`
`Seven claims previously dismissed for failure to plead actual damages are governed by
`
`D.C. law—namely, plaintiffs’ claims for breach of contract (Count I), negligence (Count II),
`
`negligence per se (Count VIII), fraud (Count VII), constructive fraud (Count XI), breach of duty
`
`of confidentiality (Count X), and violation of the D.C. Data Breach Notification statute (Count
`
`IV).5
`
`As previously explained, plaintiffs argue that the mitigation costs found to be “actual
`
`damages” in OPM “share[] many similarities” to those rejected by this Court’s prior ruling. Pls.
`
`Memo. at 6. That may be so.6 Regardless, the D.C. Court of Appeals has squarely held that
`
`“actual damages” exclude a data-breach plaintiff’s mitigation costs absent any actual misuse of
`
`the plaintiff’s data. See Randolph, 973 A.2d at 708. Like plaintiffs here, the plaintiffs in
`
`
`
`5 The parties agree (albeit for different reasons) that the Security Breach Protection
`Amendmen