MEMORANDUM AND ORDER ON DEFENDANT'S MOTION TO DISMISS

STEARNS, District Judge.

BACKGROUND

Plaintiff Brenda Katz owns an account at National Planning Corporation (NPC), an "introducing firm" for which defendant Pershing, LLC (Pershing), provides brokerage clearing services executed on a proprietary software platform called NetExchange Pro. The platform allows brokerage firms and customers (currently over 5,000,000 in number) to access account information, stock quotes, and research tools over the Internet.1 Katz alleges that up to 100,000 users (including key Pershing employees) have 24-hour electronic access to customers' non-public personal information (NPPI), including Social Security numbers, taxpayer identification numbers, and bank account numbers, without robust information technology security in place. Pl.'s Opp'n at 2. As a result, Katz alleges that customers' NPPI is susceptible of being downloaded or improperly stored without encryption, making it vulnerable to unauthorized access by third parties, including spyware. Katz claims that NPC paid fees to Pershing to protect customer data—fees that she believes were passed on to her and other putative class members.

On December 23, 2010, Katz filed this Complaint alleging violations of the Massachusetts Unfair and Deceptive Trade Practices Act, Mass. Gen. Laws ch. 93A; violations of other (unspecified) states' unfair trade practices statutes; breach of contract; breach of implied contract; negligent breach of contractual duties; unjust enrichment, and other prayers for equitable relief. Katz seeks certification of a class consisting of

Compl. ¶ 49.2

On March 11, 2011, Pershing filed a motion to dismiss the Complaint pursuant to Fed.R.Civ.P. 12(b)(1) and 12(b)(6). The court granted the motion on Rule 12(b)(1) grounds before Katz filed an opposition.3 Katz filed a motion to reconsider on March 30, 2011. The motion was granted in part, and a hearing was held on June 3, 2011, on Pershing's reinstated motion to dismiss.

DISCUSSION

Subject Matter Jurisdiction

"When faced with motions to dismiss under both 12(b)(1) and 12(b)(6), a district court, absent good reason to do otherwise, should ordinarily decide the 12(b)(1) motion first. . . . It is not simply formalistic to decide the jurisdictional issue when the case would be dismissed in any event for failure to state a claim. Different consequences flow from dismissals under 12(b)(1) and 12(b)(6): for example, dismissal under the former, not being on the merits, is without res judicata effect." Ne. Erectors Ass'n of the BTEA v. Sec'y of Labor, Occupational Safety & Health Admin., 62 F.3d 37, 39 (1st Cir. 1995). A court is permitted to look beyond the pleadings to determine jurisdiction on a 12(b)(1) motion, hence the formality of converting the motion to one for summary judgment need not be observed. See Gonzalez v. United States, 284 F.3d 281, 288 (1st Cir.2002); Dynamic Image Techs., Inc. v. United States, 221 F.3d 34, 37-38 (1st Cir.2000).

"Unlike a dismissal for lack of constitutional standing, which should be granted under Rule 12(b)(1), a dismissal for lack of prudential or statutory standing is properly granted under Rule 12(b)(6)." Harold H. Huggins Realty, Inc. v. FNC, Inc., 634 F.3d 787, 795 n. 2 (5th Cir.2011). See also Maio v. Aetna, Inc., 221 F.3d 472, 482 n. 7 (3d Cir.2000) ("Generally speaking, motions to dismiss on the grounds of a failure to allege an `injury in fact' implicate constitutional standing principles and thus are predicated on Rule 12(b)(1) rather than Rule 12(b)(6).").

To survive a motion to dismiss under Fed.R.Civ.P. 12(b)(6), a complaint must allege "a plausible entitlement to relief." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 559, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). "While a complaint attacked by a Rule 12(b)(6) motion does not need detailed factual allegations, a plaintiff's obligation to provide the `grounds' of his `entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of a cause of action's elements will not do." Id. at 555, 127 S.Ct. 1955 (internal citations omitted). See also Berner v. Delahanty, 129 F.3d 20, 25 (1st Cir.1997) (dismissal for failure to state a claim is appropriate if the pleadings fail to set forth "factual allegations, either direct or inferential, respecting each material element necessary to sustain recovery under some actionable legal theory") (internal quotation marks omitted). "If the factual allegations in the complaint are too meager, vague, or conclusory to remove the possibility of relief from the realm of mere conjecture, the complaint is open to dismissal." Tasker v. DHL Ret. Sav. Plan, 621 F.3d 34, 39 (1st Cir.2010) (internal citation and quotation marks omitted).

Pershing's Rule 12(b)(1) motion challenges Katz's standing to prosecute the Complaint, arguing that she "does not and cannot allege that any of her protected data has been lost, stolen, disclosed, or accessed by an unauthorized person; nor does she allege any facts concerning the [supposed fees] indirectly paid to Pershing." Def.'s Mem. at 6. There are "three fundamental requisites of standing that every litigant invoking the jurisdiction of the federal courts must possess: (1) injury-in-fact—an invasion of a legally-protected interest that is both concrete and particularized, and actual or imminent; (2) causation; and (3) redressability." Benjamin v. Aroostook Med. Ctr., Inc., 57 F.3d 101, 104 (1st Cir.1995); see also Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). "Future injury must be imminent to qualify as injury-in-fact" to ensure that the "alleged injury is not too speculative." Sea Shore Corp. v. Sullivan, 158 F.3d 51, 56 (1st Cir.1998).

In her Complaint, Katz does not allege that any of her NPPI has been misappropriated, nor does she allege any facts regarding the "fees" that she and other class nominees allegedly paid (indirectly) to Pershing. Instead, she complains of "Pershing's reckless, improper and/or unlawful failure to safeguard the [NPPI]," Compl. ¶ 2, and Pershing's "ongoing violation of the Massachusetts Privacy Standards and [Chapter] 93A." Pl.'s Opp'n. at 6.

As Pershing points out, at least four federal courts have reviewed and dismissed data loss claims on Article III standing grounds.4 See Randolph v. ING Life Ins. & Annuity Co., 486 F.Supp.2d 1, 8 (D.D.C.2007) (increased risk of identity theft claims stemming from laptop burglary amounted to "mere speculation that at some unspecified point in the indefinite future [plaintiffs] will be the victims of identity theft"); Key v. DSW, Inc., 454 F.Supp.2d 684, 690 (S.D.Ohio 2006) (absent evidence of a third party intent to make unauthorized use of plaintiff's financial data or identity, plaintiff fails to allege an actual or imminent injury-in-fact); Bell v. Acxiom Corp., 2006 WL 2850042, at *2 (E.D.Ark. Oct. 3, 2006) (increased risk of identity theft insufficient to show that plaintiff suffered "concrete damages"); Giordano v. Wachovia Sec., LLC, 2006 WL 2177036, at *4 (D.N.J. July 31, 2006) ("Plaintiff's claims [of increased risk of identity theft], at best, are speculative and hypothetical future injuries."). Even where courts have found that actual NPPI loss has occurred, a plaintiff's standing is not assured. See, e.g., Hammond v. Bank of New York Mellon Corp., 2010 WL 2643307, at *8 (S.D.N.Y. June 25, 2010) (finding no Article III standing despite a confirmed loss of NPPI data because the potential for future injury was "speculative" and "hypothetical").

For her part, Katz attempts to distinguish her claims from the unsuccessful "increased risk" cases by arguing that she has standing under both her Chapter 93A and breach of contract claims because of Pershing's "misrepresentations and willful non-disclosure of material facts concerning the security features of [NetExchange Pro]." Pl.'s Opp'n at 5. Katz insists that she and the putative class have suffered "actual pecuniary damages as a result of being deprived of the benefit of the bargain in that the services delivered were of distinctively lesser value than the services as advertised and promised." Pl.'s Opp'n at 1.

Chapter 93A prohibits "[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce." Mass. Gen. Laws ch. 93A, § 2(a). Violation of a State statute or regulation may constitute an unfair practice under Chapter 93A. Under the Code of Massachusetts Regulations, an act or practice is a violation of Chapter 93A, § 2, if: "[i]t fails to comply with existing statutes, rules, regulations or laws, meant for the protection of the public's health, safety, or welfare. . . ." 940 CMR § 3.16(3). See also Reddish v. Bowen, 66 Mass.App.Ct. 621, 627-629, 849 N.E.2d 901 (2006) (the improper construction of a swimming pool implicated Mass. Gen. Laws ch. 142A, § 17, under which a violation of a local or State "building law" is treated as a Chapter 93A unfair and deceptive act). Katz specifically points to Mass. Gen. Laws ch. 93H, enacted in 2007 in the wake of a highly-publicized loss of security data at TJX Companies. Chapter 93H imposes an obligation on businesses that store the personal and financial information of Massachusetts customers to provide notice if the business knows or has reason to know of a breach of security. Chapter 93H defines a "breach of security" as:

Id. § 1(a) (emphasis added). Katz argues that Pershing's alleged failure to comply with the minimum standards of Chapter 93H creates "a substantial risk of identity theft or fraud against a resident of the commonwealth." Id. There is a definitional weakness in Katz's argument. Where, as here, no facts have been pled alleging any instances of actual data loss or access by a person without permission to do so, there has been no "unauthorized acquisition or unauthorized use" of NPPI; therefore, no breach of security has yet occurred within the meaning of the statute.

More fundamentally, the power to enforce Chapter 93H is limited to the State Attorney General—the statute does not incorporate or otherwise authorize a private right of action. The enforcement section of Chapter 93H provides that the "attorney general may bring an action pursuant to . . . chapter 93A against a person or otherwise to remedy violations of this chapter. . . ." Mass. Gen. Laws ch. 93H, § 6. Because Katz cannot maintain an action under Chapter 93A based on an alleged violation of Chapter 93H, she cannot look to the state consumer protection statute to establish standing.5 See Owen Weaver, A Missed Opportunity to Bolster Consumer Protection in Massachusetts: How Massachusetts Residents Are Still Without a Private Right of Action After the TJX Security Breach, 43 New Eng. L.Rev. 677, 704-706 (2009).6

Breach of Contract

Katz's second theory of standing is based on her claim of status as a third-party beneficiary of the contract between NPC and Pershing. "`[W]hen one person, for a valuable consideration, engages with another, by simple contract, to do some act for the benefit of a third, the latter, who would enjoy the benefit of the act, may maintain an action for the breach of such engagement.'" Rae v. Air-Speed, Inc., 386 Mass. 187, 195, 435 N.E.2d 628 (1982), quoting Brewer v. Dyer, 61 Mass. 337, 7 Cush. 337, 340 (1851). To recover as a third party beneficiary, a plaintiff must show that she was the intended beneficiary of the contract, not merely an incidental one. Spinner v. Nutt, 417 Mass. 549, 555, 631 N.E.2d 542 (1994); Macksey v. Egan, 36 Mass.App.Ct. 463, 469, 633 N.E.2d 408 (1994). "Because third-party beneficiary status constitutes an exception to the general rule that a contract does not grant enforceable rights to nonsignatories,. . . a person aspiring to such status must show with special clarity that the contracting parties intended to confer a benefit on him." McCarthy v. Azure, 22 F.3d 351, 362 (1st Cir.1994). See also Anderson v. Fox Hill Vill. Homeowners Corp., 424 Mass. 365, 367, 676 N.E.2d 821 (1997) (lessee assumed no contractual responsibilities expressly benefitting employees on the premises); Lakew v. Massachusetts Bay Transp. Auth., 65 Mass.App.Ct. 794, 799-800, 844 N.E.2d 263 (2006) (tenant employee not the intended beneficiary of an agreement with the landlord to provide security services). Where the parties have expressly excluded third-party beneficiaries, that intent is controlling. See Cumis Ins. Soc'y, Inc. v. BJ's Wholesale Club, Inc., 455 Mass. 458, 464, 918 N.E.2d 36 (2009).

In this last regard, Pershing notes that its Clearing Agreement with NPC clearly states that the agreement is "not intended to confer any benefits on third-parties including, but not limited to, customers of [NPC]." Compl.-Ex. 2 (Clearing Agreement), at § 29.9. Katz concedes that exclusionary clauses like this one are generally dispositive of the parties' intent with respect to a third party's contractual rights; however, she argues that the clause is repugnant to public policy because a "clearing broker cannot contract away duties owed to an investor which the law requires him to perform." Hossain v. Rauscher Pierce Refsnes, Inc., 46 F.Supp.2d 1164, 1168 (D.Kan.1999).

While the general proposition is unexceptionable, Katz does not specify any contracted-away duty that Pershing was legally bound to perform. Instead, she argues that the exclusionary clause is superseded by the representations made by Pershing in its Disclosure Statement that it "recognizes the importance of protecting the confidentiality of [NPPI] that it collects from its customers" and that keeping NPPI secure is a "top priority." Compl.-Ex. 1 (Disclosure Statement). Regardless of what may have been said by Pershing in the Statement, it is irrelevant to the contractual understanding between Pershing and NPC because of the Clearing Agreement's unambiguous integration clause.7 See Artuso v. Vertex Pharm., Inc., 637 F.3d 1, 6 (1st Cir.2011) ("Unless the court determines that an ambiguity exists, the terms of an [] agreement must be deduced, construed, and enforced as written. This is particularly true where, as here, the contract contains an integration clause.") (internal citations and quotation marks omitted).

Breach of Implied Contract

An implied-in-fact contract comes into being when, not withstanding the absence of a written or verbal agreement, the conduct or relations of the parties imply the existence of a contract. Popponesset Beach Ass'n v. Marchillo, 39 Mass.App.Ct. 586, 592, 658 N.E.2d 983 (1996). "Otherwise expressed, if a person knowingly receives services and other benefits, and there is no evidence that those services and benefits were being furnished gratuitously, the law implies a promise to pay the value of those services and benefits." Id. To allege an implied-in-fact contract, a plaintiff must plead the elements of an express contract, including consideration, mutual assent, and damages. See Mass. Eye & Ear Infirmary v. QLT Phototherapeutics, Inc., 412 F.3d 215, 230 (1st Cir.2005), aff'd, 552 F.3d 47 (1st Cir.2009). A promise to perform a pre-existing duty is not valid consideration. See Gravallese v. Massachusetts Parole Bd., 1995 WL 808813, at *2 (Mass.Super. Apr. 19, 1995); 2 Corbin on Contracts § 7.1, at 342 (revised ed. 1995).

Pershing's argument is brief and persuasive. Because Pershing obtained Katz's NPPI as part of its business relationship with NPC, and Katz alleges that the contract between Pershing and NPC required Pershing to safeguard the NPPI, any alleged promise to Katz to do the same would not amount to valid consideration. Why? Because Pershing was already bound to NPC to do the same.8

Unjust Enrichment

In the alternative, Katz seeks restitution under the equitable doctrine of unjust enrichment. To prove unjust enrichment, a plaintiff must show: "(1) a benefit conferred upon the defendant by the plaintiff; (2) an appreciation or knowledge of the benefit by the defendant; and (3) the acceptance or retention of the benefit by the defendant under circumstances which make such acceptance or retention inequitable." Stevens v. Thacker, 550 F.Supp.2d 161, 165 (D.Mass.2008). See also LaSalle Nat'l Bank v. Perelman, 82 F.Supp.2d 279, 294-295 (D.Del.2000). Although Katz lacks a remedy at law (a prerequisite of unjust enrichment), her claim fails for the simple reason that she has not alleged that she has conferred a specific benefit on Pershing or that Pershing ever requested (or was aware) of any such benefit, direct or indirect.

ORDER

Because the court lacks subject matter jurisdiction under Fed.R.Civ.P. 12(b)(1) given the lack of any plausible injury-in-fact, Pershing's Motion to Dismiss is ALLOWED in its entirety. Because Katz lacks statutory standing under Chapter 93A to prosecute a violation of Chapter 93H, that count is also DISMISSED pursuant to Fed.R.Civ.P. 12(b)(6). The Clerk will now close the case.

SO ORDERED.