United States District Court, M.D. Alabama, Southern Division
MEMORANDUM OPINION and ORDER
TERRY F. MOORER, Magistrate Judge.
In the Complaint, D & J Optical ("Plaintiff" or "D&J Optical") asserts that Dr. Tammy Wallace ("Dr. Wallace"), a former independent contractor hired by Plaintiff; Debbie Hughes ("Hughes"), a former employee; and Enterprise Optical, LLC, d/b/a/Eyes of Ozark Optical ("Enterprise Optical"), its competitor, misappropriated information maintained in Plaintiff's computer system. Specifically, D&J Optical asserts that the defendants violated:
(1) The Computer Fraud and Abuse Act, 18 U.S.C. § 1030;
(2) The Digital Millenium Copyright Act, 17 U.S.C. § 1201;
(3) The Alabama Trade Secrets Act, § 8-27-1, Ala. Code 1975; and
(4) The Alabama Digital Crime Act, § 13A-8-112.
The plaintiff also asserts state law claims of trespass, conversion, intentional interference with business relations, and civil conspiracy against all of the defendants; breach of contract against Dr. Wallace; breach of duty of loyalty and fraudulent suppression against both Hughes and Dr. Wallace; and tortious interference with contract against Enterprise Optical.
The court has jurisdiction of the plaintiff's claims pursuant to its federal question jurisdiction, 28 U.S.C. § 1331, and supplemental jurisdiction, 28 U.S.C. § 1367. Pursuant to 28 U.S.C. § 636(c)(1) and M.D. Ala. LR 73.1, the parties have consented to a United States Magistrate Judge conducting all proceedings in this case and ordering the entry of final judgment.
Now pending before the court is the Motion to Dismiss filed by Enterprise Optical. Doc. 17. Upon consideration of the Motion and Plaintiff's Response, the court concludes that the Motion to Dismiss is due to be GRANTED with respect to the Digital Millenium Copyright Act claim and DENIED on the remaining claims.
II. STANDARD OF REVIEW
A Rule 12(b)(6) Motion tests the legal sufficiency of the complaint. Although it must accept well-pled facts as true, the court is not required to accept a plaintiff's legal conclusions. Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 1949 (2009) ("[T]he tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions"). In evaluating the sufficiency of a plaintiff's pleadings, the court must indulge reasonable inferences in plaintiff's favor, "but we are not required to draw plaintiff's inference." Aldana v. Del Monte Fresh Produce, N.A., Inc., 416 F.3d 1242, 1248 (11th Cir. 2005). Similarly, "unwarranted deductions of fact" in a complaint are not admitted as true for the purpose of testing the sufficiency of plaintiff's allegations. Id .; see also Iqbal, 556 U.S. at 680, 129 S.Ct. at 1951 (stating conclusory allegations are "not entitled to be assumed true").
A complaint may be dismissed if the facts as pled do not state a claim for relief that is plausible on its face. See Iqbal, 556 U.S. at 679, 129 S.Ct. at 1950 (explaining "only a complaint that states a plausible claim for relief survives a motion to dismiss"); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 561-62, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (retiring the prior "unless it appears beyond doubt that the plaintiff can prove no set of facts" standard). In Twombly, the Supreme Court emphasized that a complaint "requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555. Factual allegations in a complaint need not be detailed but "must be enough to raise a right to relief above the speculative level on the assumption that all the allegations in the complaint are true (even if doubtful in fact)." Id. at 555 (internal citations and emphasis omitted).
In Iqbal, the Supreme Court reiterated that although FED. R. CIV. P. 8 does not require detailed factual allegations; it does demand "more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Iqbal, 556 U.S. at 678, 129 S.Ct. at 1949. A complaint must state a plausible claim for relief, and "[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. The mere possibility the defendant acted unlawfully is insufficient to survive a motion to dismiss. Id. The well-pled allegations must nudge the claim "across the line from conceivable to plausible." Twombly, 550 U.S. at 570.
D&J Optical operates optical centers in Ozark, Alabama and Opp, Alabama. Doc. 1, Pl's Comp., p. 3. It maintains a secure server for storage of its confidential and trade secret information related to the practice. Id., p. 6. D&J manages digital patient records related to insurance billing through Panacea software, which stores basic demographic and contact information for each patient, as well as brief descriptions of the diagnosis, treatment history, follow-up schedule, and billing information for each patient. Id., pp. 6-7.
Hughes, a former employee, began working at D&J Optical in March 2007. Id., p. 6. Although she had no administrator privileges to access the server, she was assigned a user name and password allowing her to access patient records in order to fulfill her duties in filing insurance claims. Id., p. 8.
In 2009, Dr. Wallace began working part time as an optometrist for D&J Optical. Id., p. 3. In 2012, she entered into an Independent Contract Agreement with D&J Optical to work as a full-time optometrist. The plaintiff alleges that, as part of the agreement, Dr. Wallace agreed that she would not disclose, directly or indirectly, D&J Optical's "client names, addresses, personal information, files and records, as well as other processes, procedures, compilations of information, records, and specifications that are owned by the corporation and that are regularly used in the operation of the corporation's business." Id., p.4. Neither Hughes nor Dr. Wallace were given credentials or passwords granting them access to the server or allowing them to make any modifications to D&J's computer system. Id., p. 7.
On August 29, 2013, Dr. Wallace gave notice that she planned to leave the D&J Optical practice effective November 27, 2013. Id., p. 5. At some point around this time, Enterprise Optical began to open an optical center in Ozark, Alabama. On September 14, 2013, Hughes requested vacation leave from D&J Optical. Plaintiff alleges that, while on vacation, Hughes received training at Enterprise Optical, downloaded patient contact information to her secured workstation, and subsequently attempted to erase her actions from her computer. Id., p.6.
On October 1, 2013, Hughes gave notice of her intent to leave D&J Optical. On October 28, 2013, Hughes began working at Enterprise Optical. On December 3, 2013, Dr. Wallace also began working at Enterprise Optical. On this same day, D&J Optical began receiving faxed requests from Enterprise Optical for patient records. Id., p. 5. For the next two weeks, more than fifty requests for patient records were faxed from Enterprise Optical to D&J Optical. Id., pp. 5-6.
At some point in 2014, Kyle Jones ("Jones"), the Controller of D&J Optical, discovered that data was transferred without authorization from the D&J Optical server to "Starfield Technologies File Backup." Id. Tom Rivers ("Rivers"), an IT consultant and co-designer of the Panacea software, conducted research and confirmed that Starfield Technologies is not a service used or authorized by D&J Optical. Id., p. 8. In addition, he discovered that the Cisco Mobility Client software was installed on D&J Optical's workstations without authorization and that a wireless transmitter was plugged into a USB port of a workstation, which allowed remote access to the server through a wireless access point or virtual private network. Seven user names were established without authorization. Id., p. 9.
Jones also discovered a wire from the company's internet access point extending into the attic of the building. The wire connected to a booster which allowed access to a workstation from the internet. Rivers determined that the D&J Optical server was remotely accessed from an IP address assigned to the D&J Optical network in Ozark to a computer named "WALLACEFAMILY" between October 31, 2013, and December 2, 2013. D&J Optical workstations were also remotely accessed by computer addresses traceable to Enterprise Optical both before and after the individual defendants terminated their employment with D&J Optical. Id.
D&J Optical alleges that, as a result of the unauthorized remote access to its computer system, it was forced to employ experts to undertake a forensic analysis, send letters regarding the unauthorized access as a breach of protected health information to its patients, post notices in the local newspapers, and submit a breach of ...