United States Court of Appeals
                      For the First Circuit

No. 11-1983

                           BRENDA KATZ,

                      Plaintiff, Appellant,

                                v.

                          PERSHING, LLC,

                       Defendant, Appellee.


          APPEAL FROM THE UNITED STATES DISTRICT COURT

                FOR THE DISTRICT OF MASSACHUSETTS

         [Hon. Richard G. Stearns, U.S. District Judge]


                              Before

                      Selya, Circuit Judge,
                   Souter,* Associate Justice,
                    and Lipez, Circuit Judge.


     Stephen J. Calvacca, with whom Susan L. Moran and Law Offices
of Calvacca Moran were on brief, for appellant.
     Stephen L. Ratner, with whom Margaret A. Dale, Jason D.
Gerstein, Scott Harshbarger, and Proskauer Rose LLP were on brief,
for appellee.


                        February 28, 2012




     *
      Hon. David H. Souter, Associate Justice (Ret.) of the Supreme
Court of the United States, sitting by designation.
           SELYA, Circuit Judge.   Plaintiff-appellant Brenda Katz

insists that defendant-appellee Pershing, LLC failed to protect

sensitive nonpublic personal information as it was obligated to do

under both contract and consumer protection laws.     To vindicate

this concern, she sued the defendant on her behalf and on behalf of

others similarly situated.     The district court dismissed her

putative class action.   Her appeal of that order requires us to

examine both abecedarian principles of Article III standing and

assorted provisions of state substantive law.

           As a general matter, class action litigation has kept

pace with rapid technological advances.    But there are limits —

constitutional, prudential, and doctrinal — to how far a class

action plaintiff may extend the zone of liability.   In this case,

the plaintiff's reach exceeds her grasp. We conclude that, despite

the dire forebodings expressed in her complaint, she not only has

failed to state any contractual claim for relief but also lacks

constitutional standing to assert a violation of any arguably

applicable consumer protection law.    Consequently, we affirm the

district court's order of dismissal.

I.   BACKGROUND

           Because this case was decided below on a motion to

dismiss, we rehearse the facts as revealed by the complaint and the

documents annexed thereto.   See SEC v. Tambone, 

, 438

(1st Cir. 2010) (en banc).


                                -2-
            The defendant is a Delaware limited liability company.

Its single member is a Delaware corporation that maintains its

principal place of business in New York.                    The defendant sells

brokerage    execution,       clearance,       and   investment      products    and

services to other financial organizations.                    Its customers are

typically registered broker-dealers and investment advisers that

trade securities on behalf of their clients.

            One of the services that the defendant offers is called

NetExchange   Pro.      This    is   an    electronic platform         that    gives

subscribing       financial    organizations         (introducing      firms)     an

interface for obtaining research and managing brokerage accounts

via the Internet.      When an introducing firm uses NetExchange Pro,

end-users (employees of the introducing firm, such as investment

consultants) can use the service to access remotely a wealth of

information about market dynamics and customer accounts.

            The introducing firm may make its clients' nonpublic

personal    information,       including       social     security   numbers    and

taxpayer identification numbers, accessible to certain authorized

end-users in NetExchange Pro.             Some of the defendant's employees

also have access to this information.

            The    plaintiff    is   a    citizen    of    Massachusetts.        She

maintains a brokerage account at National Planning Corporation

(NPC), one of the introducing firms that uses the NetExchange Pro

service. NPC and the defendant are parties to a clearing agreement


                                         -3-
(the Agreement), which governs their rights and responsibilities

with respect to the service and the associated data.           Because NPC

has   made    its   customers'   account   information      accessible    in

NetExchange    Pro,   the   plaintiff,   like   all   NPC   customers,   has

received a disclosure statement from the defendant alerting her to

the provisions of the Agreement.

             As evinced in her complaint, the plaintiff's concern is

that her nonpublic personal information has been left vulnerable to

prying eyes because it is inadequately protected by the defendant's

service.     She asserts, among other things, that authorized end-

users can access and store her data at home and elsewhere, twenty-

four hours a day and seven days a week, in unencrypted form; that

the data, once saved by an authorized user, can potentially be

accessed by hackers or other third parties; that the defendant

fails adequately to monitor unauthorized access to her information;

and that it employs inadequate methods for end-user authentication.

             With these concerns velivolant, the plaintiff filed a

putative class action against the defendant in the United States

District Court for the District of Massachusetts. Citing the Class

Action Fairness Act of 2005 (CAFA), 28 U.S.C. §§ 1332(d), 1453,

1711-1715, she invoked the district court's original jurisdiction

by alleging diversity of citizenship between the defendant and at

least one member of the putative class (herself) and the existence

of an aggregate amount in controversy in excess of $5,000,000, see


                                   -4-


   The complaint alleged breach of contract,

breach of implied contract, negligent breach of contractual duties,

violations of Massachusetts consumer protection laws, and other

infractions not relevant here.

            The defendant moved to dismiss the action on grounds that

the plaintiff lacked Article III standing, see Fed. R. Civ. P.

12(b)(1), and that she failed to state a claim upon which relief

could be granted, see Fed. R. Civ. P. 12(b)(6).   After some backing

and filling, the details of which need not concern us, the district

court granted the motion to dismiss.      See Katz v. Pershing, LLC,

(D. Mass. 2011).    The court disposed of all the

plaintiff's claims for want of either constitutional or statutory

standing.    See 

  This timely appeal ensued.

II.   ANALYSIS

            "The existence vel non of standing is a legal question

and, therefore, engenders de novo review."     Me. People's Alliance

& Natural Res. Def. Council v. Mallinckrodt, Inc., 

,

283 (1st Cir. 2006).    In considering the pre-discovery grant of a

motion to dismiss for lack of standing, "we accept as true all

well-pleaded factual averments in the plaintiff's . . . complaint

and indulge all reasonable inferences therefrom in his favor."


      1
       CAFA's minimal diversity requirements apply to putative
class actions. See Aguayo v. U.S. Bank, 

, 917 (9th
Cir. 2011); Spivey v. Adaptive Mktg. LLC, 

, 821-22 &
n.1 (7th Cir. 2010). We have jurisdiction to review the dismissal
of her action pursuant to 28 U.S.C. § 1291.

                                  -5-
Deniz v. Mun'y of Guaynabo, 

, 144 (1st Cir. 2002).                           A

similar standard of review obtains for motions to dismiss under

Rule 12(b)(6).       See Nisselson v. Lernout, 

, 150 (1st

Cir. 2006).    With respect to either type of decision, "[w]e are not

wedded to the lower court's rationale, but may affirm the order of

dismissal on any ground made manifest by the record." Román-Cancel

v. United States, 

, 41 (1st Cir. 2010); see Ruiz v.

Bally Total Fitness Holding Corp., 

, 5 (1st Cir. 2007).

            Because no class was certified below, we evaluate only

whether the plaintiff herself has constitutional and statutory

standing to pursue the action.               See Nat'l Org. for Women, Inc. v.

Scheidler,    

,   255    &    n.3   (1994).         We   begin   this

evaluation with a discussion of the requirements of Article III

standing.      With    this       foundation        in   place,     we    appraise     the

plaintiff's claims in two groups: those alleging abridgment of her

common-law rights and those alleging violations of the rights

conferred by certain state consumer protection laws, see Mass. Gen.

Laws ch. 93A (Chapter 93A); 

(Chapter 93H).

              A.    Principles of Constitutional Standing.

            The Constitution limits the judicial power of the federal

courts to actual cases and controversies.                     U.S. Const. art. III,

§ 2, cl. 1.        A case or controversy exists only when the party

soliciting federal court jurisdiction (normally, the plaintiff)

demonstrates       "such    a    personal      stake     in   the    outcome     of    the


                                             -6-
controversy as to assure that concrete adverseness which sharpens

the   presentation    of    issues    upon      which     the      court    so    largely

depends."      Baker v. Carr, 

, 204 (1962).                    The standing

inquiry is claim-specific: a plaintiff must have standing to bring

each and every claim that she asserts.                Pagán v. Calderón, 

, 26 (1st Cir. 2006).

            To satisfy the personal stake requirement, a plaintiff

must establish each part of a familiar triad: injury, causation,

and redressability.        See Lujan v. Defenders of Wildlife, 

, 560-61 (1992).        "[E]ach element must be supported in the same

way as any other matter on which the plaintiff bears the burden of

proof, i.e., with the manner and degree of evidence required at the

successive stages of the litigation."                 

see Bennett v.

Spear, 

, 167-68 (1997).

            The first element of Article III standing is injury in

fact.      This element is defined as "an invasion of a legally

protected interest which is (a) concrete and particularized; and

(b)   actual    or   imminent,      not    conjectural        or     hypothetical."

Defenders of 

(footnote, citations, and

internal     quotation      marks     omitted).              These       are      distinct

characteristics.      Particularity demands that a plaintiff must have

personally     suffered    some   harm.         See    

    n.1.      The

requirement of an actual or imminent injury ensures that the harm




                                          -7-
has either happened or is sufficiently threatening; it is not

enough that the harm might occur at some future time.             

            The second element is causation.        This element requires

the plaintiff to show a sufficiently direct causal connection

between the challenged action and the identified harm.             See 

.   Such a connection "cannot be overly attenuated."            Donahue v.

City of Boston, 

, 115 (1st Cir. 2002).                Because the

opposing party must be the source of the harm, causation is absent

if the injury stems from the independent action of a third party.

See Simon v. E. Ky. Welfare Rights Org., 

, 41-42 (1976).

            The final element is redressability.       The plaintiff must

show that a favorable resolution of her claim would likely redress

the professed injury.        Redressability is a matter of degree.         To

satisfy this requirement, the plaintiff "need not definitively

demonstrate that a victory would completely remedy the harm."

Antilles Cement Corp. v. Fortuño, ___ F.3d ___, ___ (1st Cir. 2012)

[Nos. 09-1314, 09-1583, slip op. at 8].

            Along with the trio of constitutional elements prescribed

by Article III, standing also has prudential dimensions.                These

components "ordinarily require a plaintiff to show that his claim

is premised on his own legal rights (as opposed to those of a third

party), that his claim is not merely a generalized grievance, and

that it falls within the zone of interests protected by the law

invoked."     

.   Although   the    prudential


                                     -8-
requirements may be relaxed in some contexts, "the constitutional

requirements apply with equal force in every case." Nat'l Org. for

Marriage v. McKee, 

, 46 (1st Cir. 2011), petition for

cert. filed, 

(U.S. Nov. 2, 2011) (No. 11-599).

           It is against this backdrop that we next consider whether

the plaintiff has standing as to each of her claims.

                         B.   Common-Law Claims.

           The invasion of a common-law right (including a right

conferred by contract) can constitute an injury sufficient to

create standing.    See Ala. Power Co. v. Ickes, 

, 479

(1938).   The plaintiff alleges that she has rights deriving from

the   Agreement,   the   disclosure   statement,   and   various   online

advertisements. These allegations are arrayed in support of claims

for breach of an express contract, breach of an implied contract,

and negligent breach of contractual duties.

           The district court determined that the plaintiff lacked

standing to bring these contract-based claims because she had no

contract with the defendant.       

.

There is some question as to whether the existence of a contractual

relationship between the plaintiff and the defendant is a part of

an inquiry into standing (as opposed to a part of an inquiry into

the merits of a claim).       From an analytical standpoint, we think

the better view is that when a plaintiff generally alleges the

existence of a contract, express or implied, and a concomitant


                                   -9-
breach of that contract, her pleading adequately shows an injury to

her rights.     Even so, the present plaintiff has failed to state an

actionable claim.       We explain briefly.

            This action is brought under our diversity jurisdiction.

See 28 U.S.C. § 1332(d).       It is thus clear that state substantive

law must prescribe the rules of decision.          See Avery v. Hughes, 

, 693-94 (1st Cir. 2011).          Here, however, the laws of two

different states are implicated.          The Agreement provides that New

York law governs its construction and interpretation.            Therefore,

the plaintiff's claim for breach of contract is governed by that

law.     Nevertheless, the parties concede, at least tacitly, that

Massachusetts     law    controls   the    other   claims   raised    by   the

plaintiff.      We are free to honor the reasonable understanding of

the parties as to choice of law, see Artuso v. Vertex Pharm., Inc.,

, 5 (1st Cir. 2011), and we do so here.

            To survive a motion to dismiss for failure to state a

claim,    the   "complaint   must   contain   sufficient    factual   matter

. . . to 'state a claim to relief that is plausible on its face.'"

Ashcroft v. Iqbal, 

, 1949 (2009) (quoting Bell Atl.

Corp. v. Twombly, 

, 570 (2007)).                This means that

"[t]he complaint must include 'factual content that allows the

court to draw the reasonable inference that the defendant is liable

for the misconduct alleged.'"        Haley v. City of Boston, 

, 46 (1st Cir. 2011) (quoting 

).                "If


                                    -10-
the factual allegations in the complaint are too meager, vague, or

conclusory to remove the possibility of relief from the realm of

mere conjecture, the complaint is open to dismissal." 

.      We review the plaintiff's complaint, including the

documents annexed thereto, to see if it satisfies these standards.

             To make out a breach of contract claim under New York

law, the plaintiff must plead the existence of a promise that she

is entitled to enforce.          See Truty v. Fed. Bakers Supply Corp., 

, 899 (N.Y. App. Div. 1995).           Inasmuch as she is not a

party to the Agreement, the plaintiff's first contention is that

she may sue as a third-party beneficiary.                In this wise, she

asserts that the defendant has breached the Agreement's data

confidentiality provision, which requires the defendant to protect

NPC's proprietary information "to the same extent and in at least

the   same    manner   as    [it]    protects   its   own     confidential   or

proprietary information."           She insists that she is an intended

beneficiary of this confidentiality provision and, therefore, can

sue the defendant to enforce it.

             This contention is easily dispatched.              The Agreement

contains an explicit statement that it "is not intended to confer

any benefits on third-parties including, but not limited to,

customers of [NPC]."        New York law on this point is transparently

clear: "[w]here a provision exists in an agreement expressly

negating     an   intent    to    permit   enforcement   by    third   parties,


                                       -11-
. . . that provision is decisive."    Nepco Forged Prods., Inc. v.

Consol. Edison Co. of N.Y., 

, 681 (N.Y. App. Div.

1984); see India.com, Inc. v. Dalal, 

, 321-22 (2d Cir.

2005) (collecting cases).

          The plaintiff clamors that there are exceptions to this

bright-line rule. The precedents that she offers, however, contain

only general principles for determining whether a party is, in

fact, a third-party beneficiary.   See, e.g., Flickinger v. Harold

C. Brown & Co., 

, 600 (2d Cir. 1991); Banco Espirito

Santo de Investimento, S.A. v. Citibank, N.A., No. 03 Civ. 1537,

, at *8-10 (S.D.N.Y. Dec. 22, 2003); Artwear, Inc.

v. Hughes, 

, 692 (N.Y. App. Div. 1994).          The

plaintiff has not pointed to any New York case in which an explicit

disclaimer of third-party beneficiary claims has been overlooked

for any reason, and our research has revealed none.     This makes

perfect sense in view of New York's immutable requirement that the

contracting parties must intend to benefit the third party: "absent

such intent, the third party is merely an incidental beneficiary

with no right to enforce the particular contract[]."   Port Chester

Elec. Constr. Corp. v. Atlas, 

, 986 (N.Y. 1976).

          Where, as here, that intent is unambiguously disclaimed,

a suitor cannot attain third-party beneficiary status. See Piccoli

A/S v. Calvin Klein Jeanswear Co., 

, 164

(S.D.N.Y. 1998).   Whatever exceptions the plaintiff thinks there


                               -12-
could be or should be in these circumstances, we — as federal

judges sitting in diversity jurisdiction — "cannot be expected to

create new doctrines expanding state law." Gill v. Gulfstream Park

Racing Ass'n, 

, 402 (1st Cir. 2005); see Kassel v.

Gannett Co., 

, 949-50 (1st Cir. 1989).                After all,

federal diversity courts are charged with ascertaining state law,

not with reshaping it.

            Relatedly, the plaintiff advocates a "public policy"

exception that would block the enforcement of this disclaimer. She

asseverates that by disavowing third-party beneficiaries in the

Agreement, the defendant is attempting to contract away its duty to

obey state and federal data security laws.             This asseveration

stands logic on its ear.      The defendant has not contracted away its

legal duties but, rather, has undertaken specific confidentiality

obligations to NPC.     The Agreement merely limits enforcement of

those obligations to the contracting party (NPC).

            The plaintiff has a fallback position.         Rule 4311 of the

New York Stock Exchange requires clearing firms like the defendant

to notify customers of introducing firms like NPC "of the existence

of the carrying agreement and the responsibilities allocated to

each   respective   party."      In    compliance   with   this   rule,   the

defendant sent a disclosure statement to all of NPC's customers

(including the plaintiff), notifying them of the Agreement and its

contents.    The plaintiff alleges that this disclosure statement


                                      -13-
supersedes the Agreement's disclaimer of third-party beneficiaries

and reinstates her as an intended beneficiary of the Agreement.

          We fail to see how the disclosure statement modifies the

express disclaimer of third-party beneficiary claims.          After all,

the Agreement expressly forbids subsequent modifications unless

those modifications are "in writing signed by the parties."           Such

clauses are routinely enforced under New York law.         See N.Y. Gen.

Oblig. Law § 15-301(1).       It follows inexorably that the express

disclaimer of third-party beneficiary claims could not have been

negated   by    the   unsigned   disclosure    statement   unilaterally

formulated by one of the contracting parties.

          The    plaintiff    extracts    another   argument   from   the

disclosure statement.        She says that the disclosure statement

creates an implied contract between her and the defendant, thereby

obligating the defendant to meet certain data confidentiality

requirements.    This argument lacks force.

          The plaintiff couches her implied contract argument in

terms of Massachusetts law.      Under that law, "[a] contract implied

in fact requires the same elements as an express contract and

differs only in the method of expressing mutual assent." Mass. Eye

& Ear Infirm. v. QLT Phototherapeutics, Inc., 

, 230

(1st Cir. 2005) (internal quotation marks omitted).        One of these

elements is consideration. See T.F. v. B.L., 

, 1249

& n.4 (Mass. 2004).    This element "is satisfied if there is either


                                   -14-
a benefit to the promisor or a detriment to the promisee."                    Marine

Contractors Co. v. Hurley, 

, 919 (Mass. 1974); see 3

Richard A. Lord, Williston on Contracts § 7:4 (4th ed. 2008).

            In     the    case   at   hand,   there      is    no     allegation    of

consideration sufficient to support an implied contract claim. The

plaintiff    has    not    adequately    alleged      that      she    provided    any

bargained-for benefit or suffered any bargained-for detriment in

exchange for the defendant's supposed promises. All the items that

she suggests as consideration — her payment of fees and supplying

of   information     —    were   furnished    to   NPC    in    exchange    for    its

brokerage services. NPC, not the plaintiff, provided consideration

to the defendant.

            The     plaintiff's       conclusory         allegation       that     the

consideration flowed "indirectly" from her to the defendant does

not withstand the test of plausibility.               See 

; 

.          In fact, the documents depict two

separate    sets     of    contractual    obligations          and    benefits,    one

connecting the plaintiff to NPC and the other connecting NPC to the

defendant.    These sets cannot be mixed and matched.                   Accordingly,

we cannot credit the plaintiff's ipse dixit that she has adequately

pleaded the consideration needed for an implied contract.

            This brings us to negligent breach of contractual duties.

That claim, too, is cast in terms of Massachusetts law.                             In

Massachusetts, such a cause of action is available when a party to


                                       -15-
a contract carelessly fails to perform as required and, as a

result, foreseeably exposes third parties to injury.               See Anderson

v. Fox Hill Vill. Homeowners Corp., 

, 823 (Mass.

1997).

            The plaintiff's claim founders.                To succeed, she must

still plead the familiar elements of negligence, including duty,

breach, causation, and harm.             See Banaghan v. Dewey, 

, 812-13 (Mass. 1959).          Here, she has merely given lip service

to the elements of causation and harm.                It would serve no useful

purpose at this point to cite book and verse concerning the

deficiencies of these allegations.               It suffices to say that the

same reasoning that shows the absence of plausible allegations of

causation    and    harm    with   respect      to   the   plaintiff's   consumer

protection claims, see infra Part II(C), applies with equal force

to   the   negligent      breach   of    contract     claim.    These    types   of

implausible allegations are insufficient to state a claim upon

which relief can be granted.               See 

;

.

                     C.    Consumer Protection Claims.

            We     transition      now    to    the    claims    brought    under

Massachusetts consumer protection laws.               See Chapter 93A; Chapter

93H.     When a plaintiff alleges injury to rights conferred by a

statute, two separate standing-related inquiries pertain: whether

the plaintiff has Article III standing (constitutional standing)


                                         -16-
and whether the statute gives that plaintiff authority to sue

(statutory standing).    See Steel Co. v. Citizens for a Better

Env't, 

, 89, 92 (1998).    Article III standing presents

a question of justiciability; if it is lacking, a federal court has

no subject matter jurisdiction over the claim.        See 

statutory standing goes to the merits of the claim.   See

Bond v. United States, 

, 2362-63 (2011); CGM, LLC v.

BellSouth Telecomms., Inc., 

, 51-52 (4th Cir. 2011).

          Legislatures may affect both types of standing when they

enact new statutes.   Specifically, they can raise to the status of

legally cognizable injuries certain harms that might otherwise have

been insufficient at common law, and they may confer the authority

to sue for those harms on private persons or public entities.

Defenders of 

; see Thompson v. N. Am.

Stainless, LP, 

, 869 (2011).

          In order to maintain a suit, a plaintiff must both suffer

a cognizable injury and locate herself within the designated group

who can sue for redress.      The Supreme Court has decreed that

federal courts normally must decide whether a particular plaintiff

has constitutional standing before considering that plaintiff's

statutory standing.   See Steel 

& n.2; see

also 

("When a court is confronted with

motions to dismiss under both Rules 12(b)(1) and 12(b)(6), it




                               -17-
ordinarily     ought    to   decide   the    former   before   broaching    the

latter.").

             Given this directive, we preface our analysis of each

statutory claim with an assessment of whether the plaintiff has

demonstrated Article III standing.           See TrafficSchool.com, Inc. v.

Edriver Inc., 

, 825 (9th Cir. 2011).                 Only if the

plaintiff has cleared this hurdle will we proceed to examine

whether she has adequately alleged her membership in the class of

persons who can bring suit under Massachusetts consumer protection

laws.

             The plaintiff posits that she has constitutional standing

because (i) the defendant's services are of a lesser value than

promised, thus depriving her of the "benefit of the bargain," see

Rice    v.   Price,    

,   894   (Mass.   1960);   (ii)   the

defendant's statements have induced her to pay higher fees for

NPC's services than she otherwise would have paid; (iii) the

defendant's failure to provide notice of security breaches as

required by law has injured her; (iv) the defendant's inability to

furnish legally required privacy protections has necessitated her

purchase of identity theft insurance; and (v) that inability has




                                      -18-
exposed her to a substantial risk of future data insecurity.2    We

group these contentions into two subsets and consider them below.

            1.   False    Promises   and   Misrepresentations.   The

plaintiff's first theories of standing derive from state statutory

protections against false advertising and misrepresentation.     She

says that the defendant's inaccurate boast that it adequately

protects customer data — a claim made both in its advertising and

in the Agreement — entitles her to bring suit under Chapter 93A.

The plaintiff has offered two explanations for why she may pursue

these claims: the fact that she has overpaid for a product that

allegedly does not perform as promised and the fact that the false

advertisements induced her to pay too much for NPC's brokerage

services.

            Under the first theory, she styles her loss as the

benefit of the bargain.   By this, she means that she is paying more

to NPC than the (less secure) service provided by the defendant is


     2
       In two sentences of the complaint and a single paragraph of
her sixty-page brief, the plaintiff cursorily states that the
defendant's failure to employ reasonable security measures while
representing that its security measures are excellent is a
violation of the Federal Trade Commission Act (FTC Act), see 15
U.S.C. § 45 (prohibiting unfair trade practices), and other federal
consumer protection statutes.    It is common ground that unfair
trade practices which violate the FTC Act can form the basis for a
private action under Chapter 93A. See In re TJX Cos. Retail Sec.
Breach Litig., 

, 496-97 (1st Cir. 2009). Standing is
still required, however, and the plaintiff here alleges in support
of her undeveloped FTC Act claim only the same theories of injury
relied on in support of her other claims. Because we find those
theories of injury constitutionally insufficient, we have no need
to analyze the FTC Act claim separately.

                                 -19-
actually worth.     It is a bedrock proposition that "a relatively

small economic loss — even an 'identifiable trifle' — is enough to

confer standing."     Adams v. Watson, 

, 924 (1st Cir.

1993).    But whether or not the plaintiff can cross that low

threshold — a matter on which we take no view — her claim stumbles

over the altogether different requirement of causation.

          When the injury alleged is the result of actions by some

third party, not the defendant, the plaintiff cannot satisfy the

causation element of the standing inquiry.     See Ariz. Christian

Sch. Tuition Org. v. Winn, 

, 1447-48 (2011); Raines

v. Byrd, 

, 830 n.11 (1997); Allen v. Wright, 

, 757-58 (1984).    This is such a case.

          Any loss that the plaintiff suffered derives from the

fees that she pays to NPC.     If she is being overcharged at all,

that overcharging is at the instance of NPC, not the defendant.

Simply put, her injury is not fairly traceable to the defendant's

action.

          The plaintiff's remonstrances about the benefit of the

bargain do not change this calculus.    She has no bargain with the

defendant and, therefore, no entitlement to any benefit from the

defendant.

          The plaintiff advances a related argument.      She avers

that the defendant's misleading advertisements caused her injury

because they likely affected her decision to pay NPC's artificially


                                -20-
inflated fees.      This argument lands wide of the mark.                   Although

buyers who do not actually rely on false advertisements sometimes

may seek protection under Massachusetts law, see, e.g., Aspinall v.

Philip Morris Cos., 

, 486 (Mass. 2004), the fact that

a litigant need not prove reliance on a representation does not

vitiate the altogether different requirement of causation.

            To satisfy Article III, the injury alleged - here,

overpayment    to   NPC    -    must    be   ascribable     to    the    defendant's

misrepresentations.        In actions brought under Chapter 93A, this

does not foreclose the possibility that overpayments to a third

party might in some circumstances constitute a cognizable injury

caused by the party that has made the misrepresentations.                         See,

e.g., In re Pharm. Indus. Average Wholesale Price Litig., 

, 161, 190 (1st Cir. 2009) (finding Article III injury to be

overpayments in the form of elevated reimbursement, insurance, and

coinsurance costs imputable to the drug company's publication of

false average wholesale prices).               The plaintiff tries to style

herself in this position: she claims that she chose NPC and

overpaid    for     its        services      because   of        the     defendant's

misrepresentations.

            These allegations fall short.              In order to support a

finding of causation in these circumstances, a plaintiff must

plausibly     allege   a       direct     causal   relationship         between   her

overpayment and the defendant's purportedly misleading statements.


                                        -21-
See 

(finding Article III standing when defendant's

misrepresentations    "directly   resulted    in   an    increase   to   the

payments the plaintiffs were required to make").          Even when third

parties are not involved (as in the prototypical Chapter 93A case),

the causation requirement is usually satisfied when a consumer

purchases a falsely advertised product because the defendant's

misrepresentations would have artificially inflated the price paid

by the consumer.   Cf. Rule v. Fort Dodge Animal Health, Inc., 

, 251-53 (1st Cir. 2010) (considering such a claim on the

merits).     The   plaintiff   has   not     satisfied    this   essential

prerequisite here.

           The plaintiff attempts to show causation by alleging that

the fees she pays to NPC are higher than they otherwise would be

because NPC "passed on" the inflated charges for the defendant's

service to her.      But the documents depict two separate sets of

contractual obligations with separate fees and services: one set

between NPC and the defendant and the other set between the

plaintiff and NPC.     Thus, the plaintiff's allegation is nothing

more than a bare hypothesis that NPC possibly might push this

aspect of its operational costs onto her.       This is not a plausible

allegation that the false advertisements caused her to pay the

supposedly inflated prices for NPC's services.           See Iqbal, 129 S.

Ct. at 1949; 

.               As a result, the




                                  -22-
plaintiff has not satisfied the causation requirement for Article

III standing.

            2.    Data Insecurity.         The plaintiff's remaining claims

assert injuries to rights purportedly created by Chapter 93H and

other kindred privacy regulations. See, e.g., 940 Mass. Code Regs.

§ 3.16(3) (explaining that violation of "existing statutes, rules,

regulations or laws, meant for the protection of the public's

health, safety, or welfare" is an unfair trade practice).                     She

maintains that she may bring an action for violation of Chapter 93H

because she has not been notified of extant but unidentified

security breaches and, in all events, the defendant has failed to

conform to various encryption protocols.             These shortcomings, she

laments, have required her to purchase identity theft insurance and

have    exposed   her    nonpublic   personal      information      to   possible

misappropriation.

            The district court held that a cause of action for a

violation of Chapter 93H can be brought only by the Attorney

General.    See 

(citing Chapter 93H,

§ 6).    We do not decide that question today but, rather, adhere to

"the    general   rule   []   that   a    court   should    first   confirm   the

existence of rudiments such as jurisdiction and standing before

tackling the merits of a controverted case."               Berner v. Delahanty,

, 23 (1st Cir. 1997).           Assuming, without deciding, that

a private person may pursue a cause of action under Chapter 93H —


                                         -23-
a matter best left to the Massachusetts courts — the plaintiff

nonetheless cannot satisfy Article III's injury requirement.

          Chapter 93H has two principal components.             The first

component enables various branches of the state government to adopt

privacy rules and regulations to:

          insure the security and confidentiality of
          customer information in a manner fully
          consistent with industry standards; protect
          against anticipated threats or hazards to the
          security or integrity of such information; and
          protect against unauthorized access to or use
          of such information that may result in
          substantial harm or inconvenience to any
          consumer.

Chapter 93H, § 2(a).   The executive branch of the state government

has responded by promulgating "Standards for the Protection of

Personal Information of Residents of the Commonwealth."         201 Mass.

Code Regs. §§ 17.00-17.05.     These standards impose duties and

requirements on persons and entities that own, license, or maintain

personal information about Massachusetts residents.      

17.04.

          The second component of Chapter 93H establishes privacy

notification   requirements.       Chapter   93H,   §§   3-4.       These

requirements are triggered by any "breach of security," as defined

by the statute, or any unauthorized access or use of personal

information.   

3-4.    When such unauthorized access or

use occurs, persons and entities that own, license, or maintain

Massachusetts residents' personal information must provide notice


                                -24-
to government officials and affected parties pursuant to various

disclosure guidelines.     

          In determining how to evaluate the plaintiff's standing

to challenge alleged failures to abide by these strictures, a

comparison to the environmental standing cases is instructive.

Those decisions teach that an allegation that someone has failed to

meet some legal requirement, without more, is insufficient to

confer Article III standing. See, e.g., Defenders of 

, 572-73.     Inasmuch as standing necessitates that a

plaintiff "allege[] such a personal stake in the outcome of the

controversy   as   to   warrant   his    invocation    of   federal-court

jurisdiction," Horne v. Flores, 

, 2592 (2009)

(internal quotation marks omitted), an injury in fact must also be

alleged. We assess the plaintiff's allegations through this prism.

          Our starting point is the plaintiff's claim that she has

been injured because the defendant has failed to provide notice of

a security breach as required by Chapter 93H.               The complaint

fleshes out this claim by alleging only that a "massive number of

breaches of security [] have invariably occurred" and that, as a

result, some level of unauthorized access must have transpired,

thereby exposing    some   unspecified people's       nonpublic personal

information to further unauthorized disclosure.        She suggests that

these breaches should have been reported pursuant to Chapter 93H

and that the defendant's failure to do so entitles her to sue.


                                  -25-
            This claim is unavailing. Critically, the complaint does

not contain an allegation that the plaintiff's nonpublic personal

information has actually been accessed by any unauthorized user.

To achieve standing, plaintiffs "must allege and show that they

personally have been injured, not that injury has been suffered by

other, unidentified members of the class to which they belong and

which they purport to represent."              Warth v. Seldin, 

,

502 (1975).    Without any reference to an identified breach of the

plaintiff's data security, the complaint does not show an injury

sufficient to give rise to Article III standing.

            The plaintiff's next attempt to demonstrate injury in

fact focuses on her purchase of identity theft insurance and credit

monitoring services.         In evaluating this plaint, the reasoning in

the environmental standing cases is once again instructive.                        In

Mallinckrodt, we examined the plaintiffs' assertions that they had

refrained     from   visiting     a     river     due    to     fear   of   mercury

contamination.         In    assaying     whether       those    statements   were

sufficient to create an injury in fact, we observed that "an

individual's decision to deny herself aesthetic or recreational

pleasures based on concern about pollution will constitute a

cognizable    injury    only    when    the    concern    is    premised    upon    a

realistic threat."          

.             The Supreme

Court has assumed a similar stance in both environmental and

nonenvironmental cases.         See, e.g., Friends of the Earth, Inc. v.


                                        -26-
Laidlaw Envtl. Servs. (TOC), Inc., 

, 184-85 (2000);

City of Los Angeles v. Lyons, 

, 107 n.8 (1983).

            We think that an analogous requirement is in order here.

When an individual alleges that her injury is having to take or

forebear from some action, that choice must be premised on a

reasonably     impending     threat.      Such     a     requirement     is    fully

consistent with the well-settled principle that the harm or injury

must be actual or imminent, not speculative.                    See Defenders of

& n.2.

            In this case, the plaintiff purchased identity theft

insurance    and    credit   monitoring       services    to    guard    against   a

possibility,       remote    at   best,   that     her     nonpublic      personal

information might someday be pilfered.            Such a purely theoretical

possibility simply does not rise to the level of a reasonably

impending threat.

            To recapitulate, the plaintiff has not alleged that her

nonpublic personal information actually has been accessed by any

unauthorized person.         Her cause of action rests entirely on the

hypothesis that at some point an unauthorized, as-yet unidentified,

third party might access her data and then attempt to purloin her

identity.     The conjectural nature of this hypothesis renders the

plaintiff's    case    readily    distinguishable        from    cases    in   which

confidential data actually has been accessed through a security

breach and persons involved in that breach have acted on the ill-


                                       -27-
gotten information. Cf. Anderson v. Hannaford Bros., 

,

164-65   (1st   Cir.   2011)   (holding   purchase   of   identity   theft

insurance in such circumstances reasonable in negligence context).

Given the multiple strands of speculation and surmise from which

the plaintiff's hypothesis is woven, finding standing in this case

would stretch the injury requirement past its breaking point.

           We reach at long last the plaintiff's final theory of

injury: her assertion that the defendant's failure to adhere to

privacy regulations increases her risk of harms associated with the

loss of her data.       The courts of appeals have evidenced some

disarray about the applicability of this sort of "increased risk"

theory in data privacy cases. See, e.g., Reilly v. Ceridian Corp.,

, 43-46 (3d Cir. 2011) (finding no injury in fact when

unauthorized person accessed but did not yet misuse plaintiffs'

data); Krottner v. Starbucks Corp., 

, 1143 (9th Cir.

2010) (finding injury in fact when plaintiffs pled increased risk

of harm following theft of a laptop that contained their personal

data); Pisciotta v. Old Nat'l Bancorp, 

, 634 (7th Cir.

2007) (finding injury in fact when plaintiffs claimed an increased

risk of data theft after their information had been accessed by a

malicious and sophisticated hacker).         Be that as it may, these

cases have a common denominator.     In each of them, the plaintiffs'

data actually had been accessed by one or more unauthorized third




                                   -28-
parties.   See 

; 

-

41; 

.

           The allegations in this case do not mirror that common

denominator.   Here, the plaintiff alleges only that there is an

increased risk that someone might access her data and that this

unauthorized access (if it occurs) will increase the risk of

identity theft and other inauspicious consequences. Thus, the risk

of harm that she envisions is unanchored to any actual incident of

data breach. This omission is fatal: because she does not identify

any incident in which her data has ever been accessed by an

unauthorized person, she cannot satisfy Article III's requirement

of actual or impending injury.    See 

(noting that if the laptop containing customer data "had [not] been

stolen, and Plaintiffs had sued based on the risk that it would be

stolen at some point in the future," court would be unlikely to

find Article III injury).

           Standing is not an "ingenious academic exercise in the

conceivable.   A plaintiff must allege that he has been or will in

fact be perceptibly harmed . . . , not that he can imagine

circumstances in which he could be affected."     United States v.

Students Challenging Regulatory Agency Procedures (SCRAP), 

, 688-89 (1973).   So it is here.   Insofar as we can tell from

the complaint, no interest or right of the plaintiff has been

harmed by any violation of applicable privacy laws. In the absence


                               -29-
of such a showing, we lack jurisdiction to review her statutory

claims.

III.   CONCLUSION

            The innovations and problems of the electronic age have

created new challenges for the courts. But venerable principles of

our jurisprudence can guide us on this frontier.       This case is

illustrative: the plaintiff has asserted a litany of novel harms

under freshly inked laws, but the irreducible minimum requirements

of pleading and Article III doom her case.

            We need go no further. For the reasons elucidated above,

we affirm the judgment of the district court.



Affirmed.




                                -30-