Bliss & Glennon Inc. v. Eugene Lyle Ashley and Ashley General Agency, LLC

Opinion issued January 7, 2014

In The

Court of Appeals
For The

First District of Texas
————————————
NO. 01-12-01177-CV
———————————
BLISS & GLENNON INC., Appellant
V.
EUGENE LYLE ASHLEY AND ASHLEY GENERAL AGENCY, LLC,
Appellees

On Appeal from the 164th District Court
Harris County, Texas
Trial Court Case No. 2011-32520

OPINION

Appellant brings this interlocutory appeal from the trial court’s order

certifying a nationwide class. We reverse.
 BACKGROUND

A. The Parties

Plaintiff/appellant Bliss & Glennon, Inc. (B&G) is an insurance broker.

Essentially, it serves as the middle-man in the residual insurance market, i.e., it

brokers hard-to-place policies that cannot be purchased in the standard insurance

market. B&G’s customers are insurance agents that represent insureds, and B&G’s

suppliers are various insurance companies.

Defendant/appellee Lyle Ashley worked for B&G until June 2008. He then

founded defendant/appellee Ashley General Agency, LLC. Ashley is also a part

owner of the commercial building that housed B&G’s Conroe office until March

2011. B&G and Ashley have been involved in prior litigation involving

allegations by B&G that Ashley misappropriated trade secrets and violated various

agreements when he left B&G.

B. Bliss & Glennon’s claims

In the underlying suit, B&G sued Ashley and Ashley General seeking a

temporary restraining order and injunctive relief.

B&G’s petition alleged that when Ashley left B&G’s employment and

formed competing business Ashley General, he solicited B&G’s employees to join

him. On May 20, 2011, Ashley’s attorney contacted B&G’s attorney to notify

2
B&G that one of Ashley General’s employees, later identified as Justin Langston,1

had removed several of B&G’s CDs, hard drives, and other business information

from the dumpster that was onsite when B&G moved out of its Conroe office in

March 2001. B&G had moved out of the offices on March 18, Ashley noticed

items in the dumpster on March 19, and Langston went and retrieved the items

from the dumpster on March 20. Ashley’s counsel indicated to B&G that the CDs

and computer drives contained business information that B&G had claimed was

confidential in prior litigation between the parties, and sensitive third-party data,

including the social security numbers of various employees and other individuals.

Although B&G maintained that it did not discard confidential or sensitive

information in the trash, it requested the immediate return of any such items.

Ashley refused to return them. Shortly thereafter, B&G received a call from a

senior executive with one of its largest customers explaining that Ashley had called

him to report that B&G disclosed that customer’s confidential information, failed

to inform that customer, and had taken no protective steps to safeguard the

information. Ashley also told that customer that Ashley had a recent fraudulent

charge on his credit card that he believed was related to B&G’s data breach.

In response, B&G filed its petition in the underlying cause stating,

1
Langston was the IT department head for B&G’s Conroe office before he left to
work for Ashley General.
3
 B&G seeks a Temporary Restraining Order prohibiting the use or
disclosure to anyone other than B&G of all B&G information
Defendants found in B&G’s trash, or which Defendants have
represented was found in B&G’s trash, as well as the immediate
return of such information to B&G. B&G needs to know what
information Mr. Ashley has allegedly found for many reasons, not the
least of which is its duty to advise persons whose information has
been disclosed, if that is the case. B&G also seeks damages for Mr.
Ashley's use of B&G confidential information, his tortious
interference with B&G customer relationships, and defamation.

In addition to injunctive relief, B&G sought damages for conversion,

misappropriation of trade secrets and confidential information, unfair competition,

business disparagement, and defamation.

C. The Temporary Restraining Order

On May 31, 2011, the trial court granted a TRO ordering Ashley and Ashley

Agency to “[i]mmediately cease and desist from using, communicating, disclosing,

divulging or making available to any person or entity, directly or indirectly, the

contends of any information found in the trash.” Two weeks later, the court signed

an Agreed TRO containing the same provision, and B&G was finally provided a

copy of the items allegedly found in the dumpster. The trial court’s order, which it

entered without hearing evidence or making any “determination as to the substance

or validity of either parties’ claims,” but only to maintain the parties’ “interest in

the subject property” until trial, provided,

1. The property making the basis for the claims in this suit is to
remain in the care, custody, and control of the Counsel for
Defendants. Counsel is to ensure that said property is not

4
 accessed by either party for any reason. Counsel for
Defendants is to preserve said property in its current form and
disallow any access to said property until further order of this
Court.
2. Counsel for Defendants is to obtain affidavits, within thirty (30)
days, from any person who has had direct access to said
property that indicate no additional copies of the subject
property are in existence. Counsel is not required to obtain
such affidavits from anyone who has already testified to such
information.
3. Should Counsel for Defendants learn of anyone in possession of
copies of the subject property, they are to take possession of the
copies, immediately. In the event of such a discovery, Counsel
for Defendants is to notify Counsel for Plaintiffs and Court,
with the identity and contact information of the person in
possession of a copy.

D. Ashley’s and Ashley General’s Counterclaims

On May 30, 2012, Ashley and Ashley General filed counterclaims against

B&G, asserting, and seeking damages for, negligent protection of personal and

other sensitive information, invasion of privacy by public disclosure of private

information, business disparagement, and defamation. Ashley asserted that, after

the discovery of B&G’s information in the dumpster, he was “told of a fraud alert

on his personal credit card.” Ashley and Ashley General also sought sanctions and

attorneys’ fees, based on the contention that B&G’s claims were frivolous and

brought in bad faith for the purpose of harassment.

E. Ashley’s Class-Action Claims

On October 22, 2012, defendants/counter-plaintiffs Ashley and Ashley

General amended their counterclaim petition to add class-action claims. Their
5
petition asserted that Ashley had already appeared in the suit “as an individual and

in his capacity as representative of a class of similarly situated persons.” The

petition alleged that defendants’ claims satisfy the applicable standards for

certifying a class,

Ashley brings this class action pursuant to Rule 42 of the Texas Rules
of Civil Procedure because (1) the class is so numerous (in this case,
likely to exceed 7000 individuals) that joinder of all members is
impracticable, (2) there are questions of law or fact common to the
class, (3) the claims or defenses of the representative parties are
typical of the claims or defenses of the class, and (4) Ashley, as class
representative, will fairly and adequately protect the interests of the
class. Ashley, individually and as representative of the class, seeks
certification of the following class (the “Class”):

All individuals whose personal, sensitive information
was stored on electronic mediums, including hard drives,
that Defendants placed in the dumpster and cannot either
account for and/or did not have proper control, custody,
or possession for a period of time.

The class-action petition requested, on behalf of the class, all damages arising from

B&G’s actions, including “expenses for credit monitoring and identity theft

insurance, out-of-pocket expenses, anxiety, emotional distress, loss of privacy, and

other economic and non-economic harm—for which they are entitled to

compensation.” Defendants also sought attorneys’ fees, sanctions, and an

injunction “compelling B&G to issue notices to all members of the Class regarding

the breaches of duty regarding their personal information.”

6
F. The Class Certification

In addition to its petition, Ashley filed three documents in support of

certification: (1) a Motion for Class Certification with three exhibits (deposition

excerpt from B&G employee, B&G’s original petition, and an email from

American Express to Ashley), (2) a Brief in Support of Class Certification, and (3)

a proposed order and trial plan. B&G objected to Ashley’s motion for certification

as being untimely, and filed a response challenging Ashley’s standing and ability

to satisfy the requirements for class certification with two exhibits (deposition

excerpt from B&G employee and deposition excerpt from Ashley).

The materials allegedly found in the dumpster are not in the record, and the

record does not contain a very good description of the data involved. Ashley has

pleaded that the “information placed in the dumpster contains personal and

business information—including names, account numbers, tax numbers, e-mail

addresses, billing addresses, phone numbers, and social security numbers—

belonging to countless (Ashley believes the number of such individuals is over

7,000) persons and businesses.”

The parties’ trial-court briefing on class certification and the evidence

attached, however, reveal that the crux of the parties’ dispute revolves around a

hard drive Ashley alleges was found in the dumpster, and around the existence of

7
another potentially missing duplicate hard drive.2 B&G’s corporate representative,

Ms. Bowers, testified in her deposition that—at some point when Langford was

still employed by B&G—another company named “Willis” (also referred to

elsewhere as “H.R.H.”) erroneously sent a computer file to B&G containing a list

of social security numbers and other personal information. That email was

received by Langford. Bowers testified that although Langford knew that the

information was sent to him in error, he now claims that he backed up the

information onto two different hard drives. Langford claims that he retrieved one

of those hard drives from the dumpster two days after B&G moved out of its

office. Bowers testified that B&G does not know anything about a second hard

drive existing; nor does it possess such a hard drive.

According to Bowers, B&G conducted an immediate investigation when it

was contacted by Ashley about the materials allegedly found in the dumpster.

B&G disputes that any hard drive was thrown away (as its IT personal deny

discarding such items), and B&G had a data disposal company on hand with its

move that shredded paper and drilled holes in hard drives before taking them off-

2
The parties do not appear to dispute that the CDs found in the dumpster did not
contain confidential information, but instead contain software updates. There
were some paper copies of insurance policies in dumpster that would usually be
shredded instead of thrown away under B&G’s internal policies, but the parties
also appear to agree that these papers do not contain confidential personal or
business information. The class was thus defined in terms of individuals with
personal or sensitive information stored on “electronic mediums.”
8
site to discard. B&G’s thus believes that Ashley and/or Langford wrongfully

obtained the materials at issue from its office (rather than from a dumpster, as

claimed) and are skeptical of Langford’s claim that a duplicate hard drive exists

and is missing.

Over B&G’s objections, and following an unrecorded hearing, the trial court

certified the requested class with Ashley as the class representative, and ordered

B&G to give notice to class members at its own expense. B&G timely brought this

interlocutory appeal.

ISSUES ON APPEAL

B&G brings forth the following issues here:

1. Whether the Trial Court erred in failing to dismiss the Class Claims
for want of jurisdiction based on Lyle Ashley’s failure to carry his
burden to establish standing since: (1) Ashley and his counsel have
had custody and control of the confidential information at issue since
Ashley and his colleague allegedly removed it from a trash dumpster
two years ago; and (2) Ashley failed to establish the required causal
connection between his alleged injury of fraudulent charges on his
personal credit card and B&G’s alleged conduct, especially given the
lack of evidence that the credit card information was included in the
confidential information?

2. Whether the Trial Court erred in certifying a nationwide class action
asserting common law claims where Ashley failed to carry his burden
of proving the predominance and superiority aspects of Rule 42(b)(3),
as well as the requirements of commonality (Rule 42(a)(2)), typicality
(Rule 42(a)(3)), and adequacy (Rule 42(a)(4))?

9
 RULE 42 – CLASS ACTIONS
Class action suits are governed by Rule 42 of the Texas Rules of Civil

Procedure.

Rule 42. Class Actions

(a) Prerequisites to a Class Action. One or more members of
a class may sue or be sued as representative parties on behalf of all
only if (1) the class is so numerous that joinder of all members is
impracticable, (2) there are questions of law, or fact common to the
class, (3) the claims or defenses of the representative parties are
typical of the claims or defenses of the class, and (4) the
representative parties will fairly and adequately protect the interests of
the class.
(b) Class Actions Maintainable. An action may be maintained
as a class action if the prerequisites of subdivision (a) are satisfied,
and in addition:
(1) the prosecution of separate actions by or against individual
members of the class would create a risk of
(A) inconsistent or varying adjudications with respect to
individual members of the class which would establish
incompatible standards of conduct for the party opposing
the class, or
(B) adjudications with respect to individual members of
the class which would as a practical matter be dispositive
of the interests of the other members not parties to the
adjudications or substantially impair or impede their
ability to protect their interests; or
(2) the party opposing the class has acted or refused to act on
grounds generally applicable to the class, thereby making
appropriate final injunctive relief or corresponding declaratory
relief with respect to the class as a whole; or
(3) the questions of law or fact common to the members of the
class predominate over any questions affecting only individual
members, and a class action is superior to other available

10
 methods for the fair and efficient adjudication of the
controversy. The matters pertinent to these issues include:
(A) the interest of members of the class in individually
controlling the prosecution or defense of separate actions;
(B) the extent and nature of any litigation concerning the
controversy already commenced by or against members
of the class;
(C) the desirability or undesirability of concentrating the
litigation of the claims in the particular forum; and
(D) the difficulties likely to be encountered in the
management of a class action.
(c) Determining by Order Whether to Certify a Class
Action; Notice and Membership in Class.
(1)(A) When a person sues or is sued as a representative of a
class, the court must—at an early practicable time—determine
by order whether to certify the action as a class action.
(B) An order certifying a class action must define the
class and the class claims, issues, or defenses, and must
appoint class counsel under Rule 42 (g).
(C) An order under Rule 42(c)(1) may be altered or
amended before final judgment. The court may order the
naming of additional parties in order to insure the
adequacy of representation.
(D) An order granting or denying certification under Rule
42(b)(3) must state:
(i) the elements of each claim or defense asserted
in the pleadings;
(ii) any issues of law or fact common to the class
members;
(iii) any issues of law or fact affecting only
individual class members;
(iv) the issues that will be the object of most of the
efforts of the litigants and the court;
(v) other available methods of adjudication that
exist for the controversy;
11
 (vi) why the issues common to the members of the
class do or do not predominate over individual issues;
(vii) why a class action is or is not superior to
other available methods for the fair and efficient
adjudication of the controversy; and
(viii) if a class is certified, how the class claims
and any issues affecting only individual members, raised
by the claims or defenses asserted in the pleadings, will
be tried in a manageable, time efficient manner.
(2)(A) For any class certified under Rule 42(b)(1) or (2), the
court may direct appropriate notice to the class.
(B) For any class certified under Rule 42(b)(3), the court
must direct to class members the best notice practicable
under the circumstances, including individual notice to
all members who can be identified through reasonable
effort. The notice must concisely and clearly state in
plain, easily understood language:
(i) the nature of the action;
(ii) the definition of the class certified;
(iii) the class claims, issues, or defenses;
(iv) that a class member may enter an appearance
through counsel if the member so desires;
(v) that the court will exclude from the class any
member who requests exclusion, stating when and how
members may elect to be excluded; and
(vi) the binding effect of a class judgment on class
members under Rule 42 (c)(3).
....

TEX. R. CIV. P. 42.

“Courts must perform a rigorous analysis before ruling on class certification

to determine whether all prerequisites to certification have been met.” Sw. Ref. Co.

v. Bernal, 22 S.W.3d 425, 435 (Tex. 2000) (citation and internal quotation marks
12
omitted). In so doing, courts “may look beyond the pleadings.” Intratex Gas Co.

v. Beeson, 22 S.W.3d 398, 404 (Tex. 2000). “Because class determinations

generally involve considerations that are enmeshed in the factual and legal issues

comprising the plaintiff’s cause of action, the trial court must be able to make a

reasoned determination of the certification issues.” Exxon Mobil Corp. v. Gill,

299 S.W.3d 124, 126 (Tex. 2009) (quoting Beeson, 22 S.W.3d at 404). And while

“[d]eciding the merits of the suit in order to determine . . . its maintainability as a

class action is not appropriate,” Beeson, 22 S.W.3d at 404, “the substantive law . . .

must be taken into consideration in determining whether the purported class can

meet the certification prerequisites under Rule 42,” Union Pac. Res. Grp., Inc. v.

Hankins, 111 S.W.3d 69, 72–73 (Tex. 2003).

Our review of an interlocutory appeal from a class certification order is

limited to determining whether the trial court’s order constituted an abuse of

discretion. Ford Motor Co. v. Ocanas, 138 S.W.3d 447, 451 (Tex. App.—Corpus

Christi 2004, no pet.); see also Henry Schein, Inc. v. Stromboe, 102 S.W.3d 675,

690–91 (Tex. 2003). Typically, under this standard of review, the appellate court

must indulge every presumption favorable to the trial court’s ruling. See

Graebel/Houston Movers, Inc. v. Chastain, 26 S.W.3d 24, 29 (Tex. App.—

Houston [1st Dist.] 2000, pet dism’d w.o.j.). On certification issues, however, the

appellate court is not bound by this presumption and must independently determine

13
whether the requirements of rule 42 have been fully satisfied. See Ford Motor Co.,

138 S.W.3d at 451; see also Stonebridge Life Ins. Co. v. Pitts, 236 S.W.3d 201,

205 (Tex. 2007) (“Actual conformance with Rule 42 is indispensable, and

compliance with the rule must be demonstrated, not presumed.”); Bernal, 22

S.W.3d at 435 (actual compliance with rule 42 “must be demonstrated; it cannot be

presumed”).

Applying these standards, we conclude that the trial court accepted disputed

facts as agreed and thus failed to hold Ashley to his burden of affirmatively

establishing each prerequisite to class certification. Accordingly, while we reject

B&G’s argument that Ashley has failed to establish individual standing, we

nonetheless reverse the trial court’s class certification order.

I. Standing

Preliminarily B&G argues that Ashley has failed to demonstrate standing to

represent a class because, it asserts, Ashley lacks individual standing.3 It points to

3
We begin with an individual standing inquiry, because “before Rule 42’s
requirements are considered, a named plaintiff must first satisfy the threshold
requirement of individual standing at the time suit is filed, without regard to class
claims.” Sw. Bell Tel. Co. v. Mktg. on Hold Inc., 308 S.W.3d 909, 915 (Tex. 2010)
(holding, on interlocutory appeal of class certification order, that plaintiff had
standing, but nonetheless had not established that it could adequately represent the
class); see also Solotko v. LegalZoom.com, Inc., No. 03-10-00755-CV, 2013 WL
3724770, at *2 (Tex. App.—Austin July 11, 2013, pet. filed) (mem. op.) (noting
that named representative’s individual standing was “threshold matter” in
interlocutory appeal of order denying class certification); Magic Valley Elec. Co-
op. v. City of Edcouch, No. 13-05-202-CV, 2006 WL 733960, at *1 (Tex. App.—
Corpus Christi March 23, 2006, pet. dism’d) (mem. op) (examining proposed class
14
the supreme court’s holding that “a named plaintiff’s lack of individual standing at

the time suit is filed deprives the court of subject matter jurisdiction over the

plaintiff’s individual claims and claims on behalf of a class.” M.D. Anderson

Cancer Ctr. v. Novak, 52 S.W.3d 704, 711 (Tex. 2001). Citing recent Texas

Supreme Court precedent, B&G contends that “Ashley was required to prove three

essential elements for standing: injury, causation, and redressability”:

First, “a plaintiff must be personally aggrieved, his alleged injury
must be concrete and particularized, actual or imminent, not
hypothetical.” Daimler Chrysler Cor. v. Inman, 252 S.W.3d 299,
304–05 (Tex. 2008); accord Heckman [v. Williamson Cnty.], 369
S.W.3d [137,] 154 [(Tex. 2012)]. Second, “there must be a causal
connection between the injury and the conduct complained of – the
injury has to be fairly . . . trace[able] to the challenged action of the
defendant, and not . . . th[e] result [of] the independent action of some
third party not before the court.” Heckman, 369 S.W.3d at 154
(internal quotations and citations omitted). Third, “it must be ‘likely,’
as opposed to merely ‘speculative,’ that the injury will be ‘redressed
by a favorable decision.’” Id. at 154–55. If the named class
representative lacks standing, then the purported class action must be
dismissed for want of jurisdiction. M.D. Anderson, 52 S.W.3d at 711.
According to B&G, Ashley failed to satisfy these standing requirements for

four reasons: (1) Ashley and his counsel have had custody of the materials at issue

since they were allegedly removed from the dumpster, (2) Ashley has not

presented evidence that data fell into the hands of someone who intends to misuse

it, (3) Ashley has not presented evidence that his credit card information was

representative’s individual standing on interlocutory appeal from class
certification order because plaintiff’s individual standing is a “prerequisite to class
certification”).
15
contained in the property allegedly discarded by B&G, and (4) Ashley has not

shown that the fraudulent charges on his credit card were caused by B&G’s

actions.

Ashley responds that this case is different than the data-breach cases in

which the pleaded risk of harm is purely hypothetical. In this case, Ashley points

out, he has alleged that fraudulent activity occurred on his American Express

account because of B&G’s alleged breach, and that he has already incurred

mitigation expenses. Ashley contends that B&G is attempting to “substitute[e] a

sufficiency of the evidence argument for one challenging standing by asking this

Court to reweigh evidence of ‘causal connection’ similar to a merits-based appeal.”

Ashley asserts that this is inappropriate, as a “plaintiff does not lack standing

simply because he cannot prevail on the merits of his claim; he lacks standing

because his claim of injury is too slight for a court to afford redress.” Daimler

Chrysler Corp. v. Inman, 252 S.W.3d 299, 305 (Tex. 2008).

We agree with Ashley that he has alleged a particularized harm that satisfies

the requirement that he must “be personally aggrieved [and] his alleged injury

must be concrete and particularized, actual or imminent, not hypothetical.” Id. at

304–05. Ashley pleaded that B&G voluntarily discarded his private information,

his American Express account has since been compromised as a result, and that he

has suffered “expenses for credit monitoring and identity theft insurance, out-of-

16
pocket expenses, anxiety, emotional distress, loss of privacy, and other economic

and non-economic harm.”

For the reasons B&G articulates, it may ultimately be determined at the

summary-judgment or trial stage that Ashley cannot present sufficient evidence of

a data breach, causation, or damages.4 But for purposes of our standing inquiry

here, we are not conducting a sufficiency review; rather, we look to see whether

Ashley, as an individual plaintiff, has articulated a sufficient harm that is subject to

redress. Heckman, 369 S.W.3d at 155 (plaintiff “must plead facts demonstrating

that he, himself (rather than a third party or the public at large), suffered the injury”

(emphasis added)). Because Ashley pleads a specific, redressable harm, the cases

relied upon by B&G concluding that the persons seeking class certification had not

alleged a sufficient and particularized harm to demonstrate individual standing are

inopposite. See Novak, 52 S.W.3d at 706 (plaintiff complaining of allegedly

misleading letter soliciting donations did not have standing because he did not

contribute money so he was not harmed); DaimlerChrysler Corp., 252 S.W.3d at

307 (plaintiffs lacked standing because allegations of risk of harm from alleged

4
Similarly, we note that “whether the named plaintiff is a proper class
representative is not part of the standing inquiry,” Southwestern Bell Tel. Co., 308
S.W.3d at 919, and the corollary that determination that a particular plaintiff has
standing to bring an individual claim is not a determination that plaintiff is a
proper class representative.
17
manufacturing defect was so “extremely remote” that plaintiffs “cannot show more

than the merest possibility of injury to themselves”).

B&G also contends that “the fear of future fraudulent use of personal

information” is not a cognizable harm, and that “[f]ederal courts have rejected this

speculative alleged harm as being insufficient to confer standing because there is

no actual or imminent injury.” In support, it cites the following excerpt from a

Third Circuit case,

In this increasingly digitized world, a number of courts have had
occasion to decide whether the “risk of future harm” posed by data
security breaches confers standing on persons whose information may
have been accessed. Most courts have held that such plaintiffs lack
standing because the harm is too speculative. See Amburgy v. Express
Scripts, Inc., 671 F. Supp. 2d 1046, 1051–1053 (E.D. Mo. 2009); see
also Key v. DSW Inc., 454 F. Supp. 2d 684, 690 (S.D. Ohio 2006).
We agree with the holdings in those cases. Here, no evidence
suggests that the data has been—or will ever be—misused. The
present test is actuality, not hypothetical speculations concerning the
possibility of future injury. Appellants’ allegations of an increased
risk of identity theft resulting from a security breach are therefore
insufficient to secure standing. See Whitmore, 495 U.S. at 158, 110
S.Ct. 1717 (“[A]llegations of possible future injury do not satisfy the
requirements of Art. III.”).

Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir. 2011).

Reilly involved allegations that an unknown hacker infiltrated Ceridian’s

payroll system and “potentially gained access to personal and financial information

belonging to [plaintiffs] and approximately 27,000 employees at 1,900

companies.” Id. at 40. It was “not known whether the hacker read, copied, or

18
understood the data.” Id. Ceridian sent notice of the breach to potential victims.

Id. Plaintiffs then sued, seeking class status and alleging that “they: (1) have an

increased risk of identity theft, (2) incurred costs to monitor their credit activity,

and (3) suffered from emotional distress.” Id. Before a motion to certify the class

was heard, the court granted Ceridian’s motion to dismiss for failure to state a

claim. Affirming that dismissal, the Third Circuit emphasized that the plaintiffs’

“contentions rely on speculation that the hacker: (1) read, copied, and understood

their personal information; (2) intends to commit future criminal acts by misusing

the information; and (3) is able to use such information to the detriment of

[plaintiffs] by making unauthorized transactions in [plaintiffs’] names.” Id.; see

also Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1053 (E.D. Mo. 2009)

(“Assuming plaintiff’s allegation of security breach to be true, plaintiff alleges that

he would be injured ‘if’ his personal information was compromised, and ‘if’ such

information was obtained by an unauthorized third party, and ‘if’ his identity was

stolen as a result, and ‘if’ the use of his stolen identity caused him harm. These

multiple ‘if’s’ squarely place plaintiff’s claimed injury in the realm of the

hypothetical.”).

Although B&G accurately quotes Reilly, the question of what a plaintiff

must allege to establish standing in data-breach cases is far from settled under

federal law. See, e.g., Amburgy, 671 F. Supp. 2d at 1051 (“Subsequent to the

19
Seventh Circuit’s decision in Pisciotta [v. Old Nat’l Bancorp, 499 F.3d 629 (7th

Cir. 2007) (holding plaintiffs’ allegation of increased risk of identity theft

conferred standing)], district courts have consistently determined that claims of

increased risk of identity theft resulting from security breaches sufficiently allege

an injury-in-fact to confer Article III standing to those persons bringing such

claims.”); see also Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012)

(recognizing that the federal “courts of appeals have evidenced some disarray

about the applicability of this sort of ‘increased risk’ theory in data privacy cases”

as it relates to standing).

In any event, unlike the plaintiff in Reilly, Ashley has alleged that his data

was actually misused.5 Compare Reilly, 664 F.3d at 44 (“Appellants have alleged

no misuse, and therefore, no injury”). We thus conclude that—even if Reilly’s

analysis concluding that the hypothetical threat of a data breach and identity theft

is insufficient to convey standing were applicable—the facts here are

distinguishable.

5
The Reilly court distinguished its facts from Krottner v. Starbucks Corp., 628 F.3d
1139, 1142 (9th Cir. 2010), a case in which a laptop containing encrypted
employees’ information was stolen, and the plaintiff alleged that someone later
unsuccessfully tried to open a bank account in the employee’s name with his
social security number. Reilly, 664 F.3d at 44 (“[In] Krottner, the threatened
harms were significantly more ‘imminent’ and ‘certainly impending’ than the
alleged harm here.”).
20
 Because we have concluded that Ashley pleadings are sufficient to establish

his individual standing, we overrule B&G’s first issue and turn to the question of

whether Ashley’s proposed class claims satisfy Rule 42.

II. Class Certification

Ashley’s request for class certification was premised on its repeated

assertion that “B&G has judicially admitted its legal obligations to give notice to

Class members of their actual and potential harms relating to the loss of personal

information, including social security numbers.” It contends that the “B&G has

judicially admitted all aspects of class treatment,” and that “the identity of the

Class Members, the theory of liability, and the relief sought here are all eminently

suitable for class treatment.” Alternatively, he argues that the trial court correctly

determined that his pleadings establish each element of class certification.

B&G contends that Ashley has not demonstrated commonality among

claims, and that the trial court erred in determining that commonality was

judicially admitted by B&G. B&G argues that Ashley presented no evidence in

support of its conclusory claim of commonality, and notes recent precedent under

Federal Rule of Civil Procedure 23 rejecting the premise that commonality of

claims can be decided on pleadings rather than evidence. Stukenberg v. Perry, 675

F.3d 832, 841 (5th Cir. 2012) (holding that district court erred in finding

commonality, where court’s discussion “contained no reference to any of the three

21
causes of action advanced on behalf of the proposed class, nor did the district court

‘look beyond the pleadings to understand the claims, defenses, relevant facts, and

applicable substantive law in order to make a meaningful determination” about

commonality). Finally, B&G argues that the trial court erred in not examining

possible dissimilarities within the proposed class. Wal-Mart v. Dukes, 131 S. Ct.

2541, 2551 (2011).

Relatedly, B&G contends that Ashley failed to demonstrate that his

individual claims are typical of the purported class, or that he can adequately

represent the class. See TEX. R. CIV. P. 42(a). “Typicality and adequacy of

representation are closely related, for demanding typicality on the part of the

representative helps insure her adequacy of representation.” Supportkids, Inc. v.

Morris, 167 S.W.3d 422, 425 (Tex. App.—Houston [14th Dist.] 2005, pet. dism’d

w.o.j.) (citing Horton v. Goose Creek Indep. Sch. Dist., 690 F.2d 470, 486 n.27

(5th Cir. 1982)). Just as circumstances unique to a particular plaintiff can destroy

commonality, “[o]rdinarily, the presence of even an arguable defense peculiar to

the named plaintiff destroys the typicality of the class.” Id. at 425–26 (citing Spera

v. Fleming, Hovenkamp & Grayson, P.C., 4 S.W.3d 805, 812 (Tex. App.—

Houston [14th Dist.] 1999, no pet.)).

22
A. Judicial Admission

We begin by examining Ashley’s contention, accepted by the trial court, that

B&G judicially admitted the facts necessary to render class certification

appropriate. Ashley contends that the “commonality prerequisite is easily met

here,” as “B&G itself has already admitted the legal question, namely its legal

duties under statutory (e.g. Chapter 521 of the Texas Business and Commerce

Code) and common law.”6 Specifically, Ashley cites section 521.053 of the Texas

Business and Commerce Code, entitled “Notification Required Following Breach

of Security of Computerized Data,” as the source of B&G’s duty to give such

notice, which it claims B&G has “judicially admitted”:

(a) In this section, “breach of system security” means
unauthorized acquisition of computerized data that compromises the
security, confidentiality, or integrity of sensitive personal information
maintained by a person, including data that is encrypted if the person
accessing the data has the key required to decrypt the data . . . .
(b) A person who conducts business in this state and owns or
licenses computerized data that includes sensitive personal
information shall disclose any breach of system security, after
discovering or receiving notification of the breach, to any individual
whose sensitive personal information was, or is reasonably believed to
have been, acquired by an unauthorized person . . . .

TEX. BUS. & COM. CODE ANN. § 521.053 (West Supp. 2013). This section is part

of the Texas’ Identity Theft Enforcement and Protection Act.

6
Ashley likewise contends that B&G’s own “petition acknowledges the typicality
of the class members.”
23
 According to Ashley, “B&G’s sworn pleading, supported by two affidavits,

one by its very own general counsel, admits that regardless of how its information

found its way into the dumpster, B&G had a legal duty to notify all those who

were impacted by the loss of data.” Thus, it argues, the “trial court class

certification order must be affirmed because (1) of the uncontroverted proof of

harm to the class representative (Ashley); (2) no dispute exists about B&G’s legal

obligations; and (3) B&G did not follow through with those legal obligations.”

Ashley cites the following statements as B&G’s “admissions”:

B&G’s Original Petition & Application for TRO:

 “Although B&G believes that it did not discard any documents or
CDs containing confidential information as alleged by Mr. Ashley, it
determined it should assume that Mr. Ashley’s allegations were true
for the purpose of notifying any persons who might have been harmed
by the alleged disclosure of information.”
 “B&G sent Mr. Ashley a letter through his legal counsel requesting
the immediate return of ‘all Bliss & Glennon CDs and other
information that was found in the trash.’ B&G also requested ‘a list of
people to whom the information referenced above was disclosed so
that we can take action with respect to any information that has been
disclosed.”
 “Mr. Ashley has refused to return the alleged CDs and purported
confidential information to B&G so that B&G can ascertain the extent
of the supposed data release and next course of action to protect
further disclosure of such information.”
 “B&G also seeks the return of the information at issue, so that it can
comply with the duties mandated by Texas’ Identity Theft
Enforcement and Protection Act. The Act requires B&G to take
‘appropriate corrective action, to protect from unlawful use or

24
 disclosure any sensitive personal information collected or maintained
by the business in the regular course of business.’”
 “To date, Defendants have refused to permit B&G to comply with this
law while at the same time complaining to B&G’s customers that
B&G is doing nothing to comply. Unless the court enters the
requested Temporary Restraining Order, B&G will be unable to take
‘appropriate corrective action’ as required by the Identity Theft
Enforcement and Protection Act. In addition, B&G may be required
to provide notice to all those who many have been harmed by the
disclosure of the information at issue.”
Affidavit in Support of Application for TRO (Vice-President, General
Counsel, and Secretary of B&G’s Parent Company)
 “Although B&G believes it did not discard any documents or CDs
containing confidential information, we determined we should assume
that Mr. Ashley’s allegations were true for the purpose of notifying
any persons who might have been harmed by the alleged disclosure of
information. As a result we demanded return of the information
allegedly found by Mr. Ashley in B&G’s trash.”
Affidavit in Support of Application for TRO (B&G’s Regional Vice
President)
 “Although B&G believes it did not discard any documents or CDs
containing confidential information, it has determined it was ethically
required to assume that Mr. Ashley’s allegations were true for the
purpose of notifying any persons who might have been harmed by the
alleged disclosure of information.”
“A judicial admission is a formal waiver of proof that dispenses with the

production of evidence on an issue and bars the admitting party from disputing it.”

Sherman v. Merit Office Portfolio, Ltd., 106 S.W.3d 135, 140 (Tex. App.—Dallas

2003, pet. denied). As long as the statement stands unretracted, it must be taken as

true by the court and jury; it is binding on the declarant, and the declarant cannot

introduce evidence to contradict it. Lee v. Lee, 43 S.W.3d 636, 641 (Tex. App.—

25
Fort Worth 2001, no pet.). “Elements required for a judicial admission are: (1) a

statement made during the course of a judicial proceeding; (2) that is contrary to an

essential fact or defense asserted by the person making the admission; (3) that is

deliberate, clear, and unequivocal; (4) that, if given conclusive effect, would be

consistent with public policy; and (5) that is not destructive of the opposing party’s

theory of recovery.” Sherman, 106 S.W.3d at 140 (citing Lee, 43 S.W.3d at 641–

42; United States Fid. & Guar. Co. v. Carr, 242 S.W.2d 224, 229 (Tex. Civ.

App.—San Antonio 1951, writ ref’d)). It is the nature of an admission that by

intention it be an act of waiver, and not merely a statement of assertion or

concession, made for some independent purpose. United States Fid., 242 S.W.2d at

228.

“A judicial admission must be clear, deliberate, and unequivocal.” In re

Spooner, 333 S.W.3d 759, 764 (Tex. App.—Houston [1st Dist.] 2010, orig.

proceeding [mand. denied]) (citing Regency Advantage Ltd. P’ship v. Bingo Idea–

Watauga, Inc., 936 S.W.2d 275, 278 (Tex. 1996)). To determine whether a

statement is a judicial admission, it must be evaluated in context. Id.

Here, the petition and supporting affidavits containing what Ashley claims

are judicial admissions of B&G’s notification duties under Chapter 521 contain

additional statements making clear that B&G disputes Ashley’s entire version of

26
events and does not “disavow or otherwise abandon [its] general denial of

liability.” Id.

 “Although B&G denied that such information could have been found
as represented, B&G nonetheless requested the immediate return of
such information; however, Mr. Ashley, through his legal counsel,
refused to return the information.”
 “B&G makes a great effort to protect the integrity of all information
in its possession. In addition, when B&G vacated the property owned
by Mr. Ashley, it had a document disposal company waiting on-site to
properly destroy copies of confidential information, if necessary,
during the move.”
 “After conducting a thorough investigation regarding Mr. Ashley’s
dumpster diving story, B&G determined that such confidential
information could not have been disclosed as represented by Mr.
Ashley, especially since: (1) B&G operates a virtually paperless
workplace, (2) B&G’s policies prohibit confidential information from
being stored onto portable storage devices, including CDs, (3) B&G
did not burn confidential information onto CDs in the normal courts
eo fits operations, (4) the kind of information reported was not the
kind of information that would have been available or used by
employees in their normal business operations, and (5) B&G disabled
the CD drives of employee computers as soon as they were installed.”
Among other things, the Texas Identity Theft Enforcement and Protection

Act (1) defines “personal identifying information” and “sensitive personal

information,” (2) imposed duties on certain types of businesses to implement and

maintain reasonable procedures for protecting certain information and, (3) requires

that notice be given to individuals if certain types of data are acquired by

unauthorized persons. TEX. BUS. & COM. CODE Ann. § 521.002–.053 (West 2009

& West Supp. 2013). B&G’s petition was filed after Ashley announced that it had

27
found items containing sensitive and/or confidential information belonging to

B&G in the dumpster and steadfastly refused to identify for B&G what the

materials were or return them. Given this fact, and taking all of the above

statements in context, B&G’s petition reveals nothing more than its desire to take a

prudent approach to ascertaining what data had been compromised, if any, and

protect and notify those impacted if necessary. B&G was not in a position to know

what materials, if any, would be covered by Chapter 521, much less unequivocally

commit to a legal duty to give anyone notice under that statute. Accordingly, we

conclude that—taking B&G’s statements in context—B&G did not judicially

admit that it committed a data breach, or that it is required to give a particular form

of notice.

The trial court accepted Ashley’s characterization of B&G’s acquiescence,

relying heavily on B&G’s “admissions” in deeming class certification appropriate.

For example, the court’s order states,

 “B&G’s sworn Original Petition acknowledged its legal obligations to
give notice to the Class Members. See, e.g., Shepherd v. Ledford, 962
S.W.2d 28, 33 (Tex. 1998) (stating by stipulating to the existence of a
legal effect of acts the parties judicially admitted that conclusion).”
 “Any monetary relief . . . is incidental to the injunctive relief, which
B&G has acknowledged it is obligated to perform.”
 “All Class claims for relief rest on the same elements: (a) B&G was in
possession of the personal and other sensitive information belonging to
Ashley and the Class; and (b) B&G failed to protect that information
from disclosure and/or loss. Neither of the contentions is challenged by
B&G. Indeed, the lynchpin of this case is that B&G has judicially
28
 admitted both the fact of the disclosure and/or loss and its legal
obligations to the Class.”
 “[T]his Court has reviewed B&G’s opposition to the Motion for
Certification, which rested on a number of generalities, many of which
rely on the merits-based allegation that Ashley is responsible for the data
being found in the dumpster. Of course, B&G’s own sworn petition
claims that for the purpose of its legal obligation to provide notice to
hose individuals and business whose data was thrown away, it has
assumed that Ashley did not take the information wrongfully, so B&G’s
allegation is a non-starter. . . . . B&G’s erroneous challenge to the
typicality requirement under Rule 42 rests on the same faulty reasoning.”
 “[B]eyond not raising the issue of [choice-of-law] in any meaningful
way, B&G’s Original Petition presumed its obligation to give notice to
those impacted by the data breach, without regard to whether the
substantive law of multiple jurisdictions applied.”
 “No issues of law or fact would affect only individual Class Members
due to the fact all Class members are entitled to receive notice of the data
breach and B&G has acknowledged that fact.”
 “The issue that will be the object of most of the efforts of the litigants
and the Court will be determination of the measures required to protect
the Class Members from future harm from the data breach.”
 “This matter can be resolved in a unitary proceeding and in the following
manner: As noted earlier, B&G has acknowledged its obligation to give
notice to the Class members and an order is appropriate to compel B&G
to give notice of the data breach and the remedies afforded the Class
members. Accordingly, and pursuant to Texas Rule of Procedure
42(b)(2), this Court exercises its discretion and orders that within 60 days
of the date of this Order, that B&G issue, at its own expense, a Class
Notice, as approved by this Court.”
There are two primary flaws in the trial court’s reliance on what it

characterizes as B&G’s admissions. First, as explained above, B&G did not

judicially admit its duty to give notice under Chapter 521. Second, even if B&G

were required to give notice under Chapter 521 (an issue not before us), the court’s

29
order erroneously conflates section 521 notice with the class notice provided under

Rule 42 of the of the Texas Rules of Civil Procedure.

Chapter 521 imposes a notice obligation, under certain circumstances, on a

person or business responsible for disclosure of particular types of third-party

sensitive information to an unauthorized person. TEX. BUS. & COM. CODE ANN. §

521.053. In contrast, Rule 42 imposes an obligation on the party seeking class

treatment for its claims to provide individual notice and certain information about

the claims and class to each identifiable member of that class at the expense of the

party seeking class certification. Am. Express Travel Related Servs. Co., Inc. v.

Walton, 883 S.W.2d 703, 709 (Tex. App.—Dallas 1994, no pet.) (“[R]ule 42’s

plain language requires the party claiming the class to provide notice to class

members. TEX. R. CIV. P. 42(c)(2). We interpret this directive to include paying

the costs of notice.”).

The person responsible for notice under section 521.053 and rule 42 is

different, the contents and purpose of the notice under section 521.053 and rule 42

is different, the stage in the proceedings for giving notice under section 521.053

and rule 42 is different, and the appropriate person to bear the cost of notice under

section 521.053 and rule 42 is different. The trial court’s determination that an

obligation to give notice under section 521.053 equates to an obligation to give

Class Notice under rule 42 was thus erroneous.

30
B. Evidence of Commonality, Typicality and Adequacy of Representation

Having rejected the argument that Ashley was excused from meeting his

burden to satisfy the requisite prerequisites to class certification by B&G’s alleged

judicial admission, we examine the record and the trial court’s class certification

order to determine if the evidence demonstrates that class certification was

appropriate. See Riemer v. State, 392 S.W.3d 635, 639 (Tex. 2012) (court must

“apply a rigorous analysis to determine” if class certification requirements have

been satisfied). Because the evidence does not affirmatively demonstrate

commonality or typicality of claims, and because the unique relationship and

background between B&G and Ashley renders him inadequate to represent a class,

we conclude that the trial court erred in certifying a class and appointing Ashley as

class representative.

The parties’ briefing contains various and conflicting characterizations about

the data allegedly found in the dumpster, but there is no evidence about the actual

data in the record from which commonality could be assessed. Ashley’s motion

contains one sentence in support of commonality—i.e., “The vast majority of the

Class members are made up of employees of B&G and its predecessors, hence the

confidential and fiduciary relationship between the Class and B&G is beyond

dispute.” The court’s order likewise does not cite evidence, but refers only to

Ashley’s allegations regarding commonality, stating: “Ashley alleged facts that

31
give rise to common questions of both fact and law that are central to the Class

members’ claims. These include B&G’s failure to adequately protect their

information and the resulting harm.”

The trial court was required to look beyond Ashley’s pleaded facts in

assessing commonality. E.g., Wal-Mart Stores, 131 S. Ct. at 2551 (interpreting

federal Rule 23 governing class actions).7 It could not do so on this record, as

there is no evidence about the members of the proposed class, or about their

circumstances, their information compromised, or their possible injury. Moreover,

the trial court is required to assess potential dissimilarities within the class in

determining commonality. Id. B&G cites potential dissimilarities that both

demonstration a potential lack of commonality, and exemplify why, even if the

record were more developed, Ashley cannot establish typicality or adequacy of

representation.

B&G notes potential dissimilarities that include “(1) class members residing

in different states with different laws, (2) class members who have not suffered the

sort of consequential damages that Ashley seeks, such as out-of-pocket damages

and/or emotional distress; (3) class members who want to file claims against

Ashley and Langston for their actions; and (4) class members who, in contrast to

7
“Because Rule 42 is patterned after Federal Rule of Civil Procedure 23, federal
decisions and authorities interpreting current federal class action requirements are
instructive.” Riemer, 392 S.W.3d at 640.
32
Ashley’s allegations, have not experienced any actual fraudulent activity with their

accounts or identity.” B&G cites similar consideration in asserting that typicality

of claims is lacking, and that Ashley cannot adequately represent the class: “(1)

Ashley is subject to a unique defense; (2) Ashley has a bitter and litigious history

with B&G; and (3) Ashley has conflicts with the class members that go to the heart

of this litigation.”

Ashley is a former employee who has been accused of poaching employees

from B&G, including Langston (the former B&G employee who allegedly found

the data at issue in the dumpster). The parties have been in prior litigation over the

use and control of business data. Ashley now runs a business in direct competition

with B&G. B&G’s contends that, by his own admission, Ashley violated laws in

having Langston allegedly retrieve items from the trash dumpster, and that Ashley

is in fact the one responsible for the information falling into third parties’ hands.

B&G has pending claims against Ashley claiming that he wrongfully used B&G’s

confidential information to interfere with its relationships with customers.

Ashley’s claims cannot be typical, given that one of the issues to be resolved

by the factfinder is how the alleged missing data came to be in Ashley’s hands.

For the same reasons, he cannot be said to “fairly and adequately protect the

interests of the class” members (who would have claims against Ashley under

B&G’s theory of the case). Emp’rs Cas. Co. v. Tex. Ass’n of Sch. Bds. Workers’

33
Comp. Self-Ins. Fund, 886 S.W.2d 470, 475 (Tex. App—Austin 1994, writ dim’s

w.o.j.) (“[T]he interests of the class representatives must not be antagonistic to

those of the rest of the class. In this sense, this issue is often collapsed into the

typicality analysis.”); see also E&V Slack, Inc. v. Shell Oil Co., 969 S.W.2d 565,

568 (Tex. App.—Austin 1998, no pet.) (in suit against Shell Oil Co., named

representatives—who were former Shell dealers that currently own stations that

compete with Shell—could not adequately represent current Shell dealers).

CONCLUSION

The trial court certified a nationwide class action, relying in large part on

what it deemed a judicial admission by B&G of liability and duty to give class

notice. We reject the argument that B&G judicially admitted liability, and hold

that Ashley has not presented any evidence demonstrating commonality or

typicality, or that Ashley could fairly and adequately protect the interest of the

class. We sustain B&G’s second issue, reverse the trial court’s class certification

order, and remand for further proceedings.

Sherry Radack
Chief Justice

Panel consists of Chief Justice Radack and Justices Bland and Huddle.
34