PENA v. BRITISH AIRWAYS PLC UK (2021)

SUMMARY ORDER

Ralph Pena appeals from an April 7, 2020 judgment of the district court dismissing Pena's amended complaint in its entirety. Pena sued British Airways on behalf of a putative class following a data breach that affected customers who booked travel on British Airways’ website or mobile application between April 21 and September 5, 2018. Pena alleged, in part, that British Airways breached a contractual obligation to abide by measures in its privacy policy to keep users’ data secure. The district court dismissed Pena's complaint both for a lack of Article III standing, holding that Pena's alleged injuries were not “sufficiently concrete and particularized to confer standing,” Pena v. British Airways, PLC (UK), No. 18-cv-6278, 2020 WL 3989055, at *2 (E.D.N.Y. Mar. 30, 2020), and because Pena's breach of contract claim did not state a plausible claim for relief. We assume the parties’ familiarity with the underlying facts, the procedural history of the case, and the issues on appeal.

* * *

At the start, we disagree with the district court that Pena lacked Article III standing.¹ Pena adequately alleged a concrete and particularized injury because his personal information was “exposed as the result of a targeted attempt to obtain that [information],” McMorris v. Carlos Lopez & Assocs., LLC, et al., 995 F.3d 295, 303 (2d Cir. 2021), his information was subsequently “misused,” id., and he expended time and money to resolve the misuse with his credit card companies. Pena alleged that after hackers stole information regarding two of his credit cards as part of the British Airways data breach, his credit card information was misused, for “approximately 20 unauthorized Uber rides” and for unauthorized purchases “totaling $1,000.” Joint App'x 9, 10. Pena further alleged that after he incurred the fraudulent charges on his card, he had to call his bank to deduce the nature of the charges, have the charges reversed, and cancel his card. He stated that the call took “between 10-20 minutes” and that “[u]nder his cell phone plan, he had to pay $0.20 a minute for the call” at international rates because he was abroad at the time. Id. at 10. Pena has thus pled specific allegations sufficient to establish an “injury in fact.” Cf. Whalen v. Michaels Stores, Inc., 689 F. App'x 89, 91 (2d Cir. 2017) (“Whalen pleaded no specifics about any time or effort that she herself has spent monitoring her credit.”).

We agree, however, with the district court's conclusion that Pena has failed to state a plausible breach of contract claim under Federal Rule of Civil Procedure 12(b)(6), which we review de novo.² See Dolan v. Connolly, 794 F.3d 290, 293 (2d Cir. 2015). Pena asserts that British Airways undertook a contractual obligation to abide by the terms of its Privacy Policy, because its “Website terms and conditions” stated that “[a]ny personal information You supply to Us when You use this website will be used in accordance with Our Privacy Policy.” Joint App'x 170. To the extent Pena argues that the Privacy Policy was therefore incorporated into the Terms and Conditions and that British Airways was contractually bound to its terms, the Privacy Policy's explicit statement that it was “not contractual and d[id] not form part of [Pena's] contract with [British Airways],” id. at 158, makes unambiguously clear that British Airways did not “assent[ ] to” such incorporation. PaineWebber Inc. v. Bybyk, 81 F.3d 1193, 1201 (2d Cir. 1996) (quoting Lamb v. Emhart Corp., 47 F.3d 551, 558 (2d Cir. 1995)). Because statements in British Airways’ Privacy Policy therefore cannot form the basis for a breach of contract claim, Pena's claim was properly dismissed.

We have considered Pena's remaining arguments and find them to be without merit. Accordingly, we AFFIRM the judgment of the district court.

FOOTNOTES

1.   This Court requested additional briefing on whether we separately lacked subject-matter jurisdiction under the Class Action Fairness Act (“CAFA”) because the aggregate amount in controversy is less than $5,000,000. We are unable to dismiss for lack of subject-matter jurisdiction under CAFA because we cannot say “to a legal certainty that [Pena's] claim is really for less than the jurisdictional amount to justify dismissal,” Washington Nat'l Ins. Co. v. OBEX Grp. LLC, 958 F.3d 126, 135 (2d Cir. 2020) (emphasis omitted) (quoting A.F.A. Tours, Inc. v. Whitchurch, 937 F.2d 82, 87 (2d Cir. 1991)).

2.   Upon determining that Pena lacked Article III standing, the district court should have dismissed the complaint without further consideration of British Airways’ 12(b)(6) motion. See Rhulen Agency, Inc. v. Alabama Ins. Guar. Ass'n, 896 F.2d 674, 678 (2d Cir. 1990). However, because the district court fully considered the 12(b)(6) motion, we affirm on this alternate ground.