Pena v. British Airways, PLC (UK) ( 2021 )

20-1426
Pena v. British Airways, PLC (UK)
UNITED STATES COURT OF APPEALS
FOR THE SECOND CIRCUIT
SUMMARY ORDER
RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A
SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY
FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT=S LOCAL RULE 32.1.1.
WHEN CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST
CITE EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION
“SUMMARY ORDER”). A PARTY CITING TO A SUMMARY ORDER MUST SERVE A COPY OF IT
ON ANY PARTY NOT REPRESENTED BY COUNSEL.
At a stated term of the United States Court of Appeals for the Second Circuit, held at the
Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the
3rd day of June, two thousand twenty-one.
Present:
DEBRA ANN LIVINGSTON,
Chief Judge,
MICHAEL H. PARK,
STEVEN J. MENASHI,
Circuit Judges.
_____________________________________
RALPH PENA, individually and on behalf of all
others similarly situated,
Plaintiff-Appellant,
v. 20-1426
BRITISH AIRWAYS, PLC (UK),
Defendant-Appellee.
_____________________________________
For Plaintiff-Appellant: JONATHAN E. TAYLOR, Gupta Wessler PLLC,
Washington, DC; Jason S. Rathod, Migliacchio Rathod,
LLP, Washington, DC; Gary S. Graifman, Kantrowitz
Goldhamer & Graifman, P.C., Chestnut Ridge, NY.
For Defendant-Appellee: KEARA M. GORDON, Colleen M. Gulliver & William J.
Diggs (on the brief), DLA Piper LLP (US), New York,
NY.
1
Appeal from a judgment of the United States District Court for the Eastern District of New
York (DeArcy Hall, J.).
UPON DUE CONSIDERATION, IT IS HEREBY ORDERED, ADJUDGED, AND
DECREED that the judgment of the district court is AFFIRMED.
Ralph Pena appeals from an April 7, 2020 judgment of the district court dismissing Pena’s
amended complaint in its entirety. Pena sued British Airways on behalf of a putative class
following a data breach that affected customers who booked travel on British Airways’ website or
mobile application between April 21 and September 5, 2018. Pena alleged, in part, that British
Airways breached a contractual obligation to abide by measures in its privacy policy to keep users’
data secure. The district court dismissed Pena’s complaint both for a lack of Article III standing,
holding that Pena’s alleged injuries were not “sufficiently concrete and particularized to confer
standing,” Pena v. British Airways, PLC (UK), No. 18-cv-6278, 2020 WL 3989055, at *2
(E.D.N.Y. Mar. 30, 2020), and because Pena’s breach of contract claim did not state a plausible
claim for relief. We assume the parties’ familiarity with the underlying facts, the procedural
history of the case, and the issues on appeal.
* * *
At the start, we disagree with the district court that Pena lacked Article III standing. 1 Pena
adequately alleged a concrete and particularized injury because his personal information was
“exposed as the result of a targeted attempt to obtain that [information],” McMorris v. Carlos
1
This Court requested additional briefing on whether we separately lacked subject-matter jurisdiction
under the Class Action Fairness Act (“CAFA”) because the aggregate amount in controversy is less than
$5,000,000. We are unable to dismiss for lack of subject-matter jurisdiction under CAFA because we
cannot say “to a legal certainty that [Pena’s] claim is really for less than the jurisdictional amount to justify
dismissal,” Washington Nat’l Ins. Co. v. OBEX Grp. LLC, 958 F.3d 126, 135 (2d Cir. 2020) (emphasis
omitted) (quoting A.F.A. Tours, Inc. v. Whitchurch, 937 F.2d 82, 87 (2d Cir. 1991)).
2
Lopez & Assocs., LLC, et al., 995 F.3d 295, 303 (2d Cir. 2021), his information was subsequently
“misused,” id., and he expended time and money to resolve the misuse with his credit card
companies. Pena alleged that after hackers stole information regarding two of his credit cards as
part of the British Airways data breach, his credit card information was misused, for
“approximately 20 unauthorized Uber rides” and for unauthorized purchases “totaling $1,000.”
Joint App’x 9, 10. Pena further alleged that after he incurred the fraudulent charges on his card,
he had to call his bank to deduce the nature of the charges, have the charges reversed, and cancel
his card. He stated that the call took “between 10-20 minutes” and that “[u]nder his cell phone
plan, he had to pay $0.20 a minute for the call” at international rates because he was abroad at the
time. Id. at 10. Pena has thus pled specific allegations sufficient to establish an “injury in fact.”
Cf. Whalen v. Michaels Stores, Inc., 689 F. App’x 89, 91 (2d Cir. 2017) (“Whalen pleaded no
specifics about any time or effort that she herself has spent monitoring her credit.”).
We agree, however, with the district court’s conclusion that Pena has failed to state a
plausible breach of contract claim under Federal Rule of Civil Procedure 12(b)(6), which we
review de novo. 2 See Dolan v. Connolly, 794 F.3d 290, 293 (2d Cir. 2015). Pena asserts that
British Airways undertook a contractual obligation to abide by the terms of its Privacy Policy,
because its “Website terms and conditions” stated that “[a]ny personal information You supply to
Us when You use this website will be used in accordance with Our Privacy Policy.” Joint App’x
170. To the extent Pena argues that the Privacy Policy was therefore incorporated into the Terms
and Conditions and that British Airways was contractually bound to its terms, the Privacy Policy’s
2
Upon determining that Pena lacked Article III standing, the district court should have dismissed the
complaint without further consideration of British Airways’ 12(b)(6) motion. See Rhulen Agency, Inc. v.
Alabama Ins. Guar. Ass’n, 896 F.2d 674, 678 (2d Cir. 1990). However, because the district court fully
considered the 12(b)(6) motion, we affirm on this alternate ground.
3
explicit statement that it was “not contractual and d[id] not form part of [Pena’s] contract with
[British Airways],” id. at 158, makes unambiguously clear that British Airways did not “assent[]
to” such incorporation. PaineWebber Inc. v. Bybyk, 81 F.3d 1193, 1201 (2d Cir. 1996) (quoting
Lamb v. Emhart Corp., 47 F.3d 551, 558 (2d Cir. 1995)). Because statements in British Airways’
Privacy Policy therefore cannot form the basis for a breach of contract claim, Pena’s claim was
properly dismissed.
We have considered Pena’s remaining arguments and find them to be without merit.
Accordingly, we AFFIRM the judgment of the district court.
FOR THE COURT:
Catherine O’Hagan Wolfe, Clerk of Court
4