First Circuit Upholds Dismissal of Claims Against Third-Party for Failure to Protect Personal Information

Class Action Privacy/Cyber Risk & Data Security

On February 28, the U.S. Court of Appeals for the First Circuit upheld the dismissal of a putative class action brought against a securities clearing company for alleged failures to protect certain personal information. Katz v. Pershing, LLC, No. 11-1983, 2012 WL 612793 (1st Cir. Feb. 28, 2012). In this case, the plaintiff was the customer of a brokerage firm that used defendant Pershing LLC’s online clearing system, but the customer had no direct relationship with the defendant. The plaintiff alleged that Pershing had contractual and statutory obligations to encrypt and protect the personal information of brokerage firm customers. Specifically, the plaintiff alleged various contract claims, including one that Pershing’s failures constituted a breach of its contract with the brokerage. She also claimed that Pershing violated Massachusetts consumer protection laws. The First Circuit upheld the district court’s dismissal, holding that the agreement between the brokerage and the defendant clearing firm did not confer any benefits on the plaintiff – the brokerage’s customer. The court stated that the separate contractual agreements between the plaintiff and her brokerage on the one hand, and between the brokerage and the defendant clearing firm on the other, could not be mixed and matched. The court also held, with regard to claims that Pershing violated the state data protection law, that plaintiff’s claims of potential harm from unprotected data were purely theoretical and “simply do[] not rise to the level of a reasonably impending threat.” As such plaintiff lacked standing to bring the statutory claims. Because the court found that the plaintiff lacked standing, it did not reach the issue of whether the Massachusetts data privacy law provides a private right of action.