1.1 million customers and non-customers who had purchased insurance products from  Nationwide or sought insurance quotations.    1.1  million  geographically  dispersed  people,  making  joinder  impracticable.  Disposition of this matter as a class action will provide substantial  benefits and efficiencies to the Parties and the Court.   13.  Nationwide collects PII from consumers and other sources in order to  provide quotes and sales to consumers for its insurance products and services. See  http://www. nationwide.com/notice-faq.jsp (last visited on Feb. 8, 2013). Plaintiff  purchased a Nationwide insurance policy. Nationwide has wrongfully retained and  failed to safeguard and protect Plaintiff’s and the other Class Members’ PII.    14.  On October 3, 2012, a portion of Nationwide’s computer network, which is  used by Nationwide and its insurance agents and Allied Insurance Company (“Allied”)  and its insurance agents, was intruded upon by an unauthorized person(s), resulting in  the theft and wrongful dissemination of Plaintiff’s and the other Class Members’ PII  (i.e., the Data Breach).  Nationwide reported that the Data Breach affected an estimated   15.  As a direct and/or proximate result of Defendant’s failure to properly  safeguard and protect the PII of its customers and non-customers, Plaintiff’s and the  other Class Members’ PII was stolen, wrongfully disseminated without authorization  and compromised.      16.  More than six weeks after the Data Breach occurred, Plaintiff received a  November 16, 2012 letter from Nationwide informing him of the Data Breach and the  fact that his PII had been wrongfully disseminated without authorization and  compromised. On information and belief, Nationwide sent the uniform letter to all other  Class Members.    17.  Nationwide’s letter encouraged Plaintiff to take certain steps to protect his  PII against misuse, advised him to be vigilant and suggested that he closely monitor his  bank statements, credit reports and other financial information for unusual activity.  Id.   Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 6 of 27  PAGEID #: 6 7  Nationwide offered Plaintiff only one year of free credit monitoring and identity theft  protection through Equifax, which provides under certain conditions up to $1 million  identity fraud expense coverage and access to his credit report.  Nationwide also  provided directions to Plaintiff and the other Class Members for placing a fraud alert.    18.  Nationwide also suggested and directed that Plaintiff and the other Class  members could place a security freeze on their credit reports, which Nationwide states is  “intended to prevent credit, loans and services from being approved in [an individual’s]  name without [that individual’s] consent; however, using a security freeze may delay  your ability to obtain credit.” See http://www.nationwide.com/notice-resources.jsp (last  visited Feb. 8, 2013). Nationwide, however, did not offer to pay this expense.  Further,  according to Nationwide, as stated on the referenced webpage, a credit bureau “may  charge a fee of up to $5.00 (and in some cases, up to $20.00) to place a freeze or lift or  remove a freeze.” Id.      19.  As a direct and/or proximate result of Defendant’s wrongful actions  and/or inaction and the resulting Data Breach, the criminal(s) and/or their customers  now have Plaintiff’s and the other Class Members’ compromised PII.  There is a robust  international market for the purloined PII.  Defendant’s wrongful actions and/or  inaction and the resulting Data Breach have also placed Plaintiff and the other Class  Members at an imminent, immediate and continuing increased risk of identity theft,  identity fraud1 and medical fraud.   1According to the United States Government Accounting Office (GAO), the terms “identity theft”  or “identity fraud” are broad terms encompassing various types of criminal activities.  Identity  theft occurs when PII is used to commit fraud or other crimes. These crimes include, inter alia,  credit card fraud, phone or utilities fraud, bank fraud and government fraud (theft of  government services).  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 7 of 27  PAGEID #: 7 8   20.  Identity theft occurs when someone uses an individual’s PII, such as the  person’s name, Social Security number, or credit card number, without the individual’s  permission,  to  commit  fraud  or  other  crimes.  See  http://www.consumer.ftc.gov/articles/pdf-0014-identity-theft.pdf (last visited Feb. 8,  2013).   21.  The Federal Trade Commission correctly sets forth that “Identity theft is a  serious crime. It can disrupt your finances, credit history, and reputation, and take time,  money, and patience to resolve.” Id.    22.  Identity theft crimes often involve more than just crimes of financial loss,  such as various types of government fraud (such as obtaining a driver’s license or official  identification card in the victim’s name but with their picture), using a victim’s name  and Social Security number to obtain government benefits and/or filing a fraudulent tax  return using a victim’s information.  Identity thieves also obtain jobs using stolen Social  Security numbers, rent houses and apartments and/or obtain medical services in a  victim’s name.  Identity thieves also have been known to give a victim’s PII to police  during an arrest, resulting in the issuance of an arrest warrant in the victim’s name and  an unwarranted criminal record.   23.  According to the FTC, “the range of privacy-related harms is more  expansive than economic or physical harm or unwarranted intrusions and that any  privacy framework should recognize additional harms that might arise from  unanticipated uses of data.”2  Furthermore, “there is significant evidence demonstrating  that technological advances and the ability to combine disparate pieces of data can lead  2Protecting  Consumer  Privacy  in  an  Era  of  Rapid  Change  39.  Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiff brings  this class action as a national class action on behalf of himself and the following Class of  similarly situated individuals:  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 14 of 27  PAGEID #: 14 15  All persons who sought an insurance quote from Nationwide  Mutual Insurance Company or Allied Insurance Company,  and whose names, and some combination of their Social  Security numbers, driver’s license numbers, dates of birth,  marital statuses, genders, occupations, and their employers’  names and addresses, were compromised by the October 3,  2012 data breach of the computer network used by  Nationwide  Mutual  Insurance  Company  and  Allied  Insurance Company agents. The Class specifically excludes  Defendant, any entity in which Defendant has a controlling  interest, Defendant’s officers, directors, agents and/or  employees, the Court and Court personnel.   40.  On information and belief, the putative Class is comprised of  approximately   41.  The rights of Plaintiff and each other Class Member were violated in a  virtually identical manner as a direct and/or proximate result of Defendant’s willful,  reckless and/or negligent actions and/or inaction and the resulting Data Breach.    42.  Questions of law and fact common to all Class Members exist and  predominate over any questions affecting only individual Class Members including,  inter alia:   a)  Whether Defendant violated FCRA by failing to properly  obtain, maintain, secure or protect Plaintiff’s and the other  Class Members’ PII;   b)  Whether Defendant willfully, recklessly and/or negligently  failed to maintain and/or execute reasonable procedures  designed to prevent unauthorized access to Plaintiff’s and  the other Class Members’ PII;   c)  Whether Defendant was negligent in failing to properly  safeguard and protect Plaintiff’s and the other Class  Members’ PII;   Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 15 of 27  PAGEID #: 15 16  d)  Whether Defendant owed a duty to Plaintiff and the other  Class Members to exercise reasonable care in safeguarding  and protecting their PII;  e)  Whether Defendant breached its duty to exercise reasonable  care in failing to safeguard and protect Plaintiff’s and the  other Class Members’ PII;   f)  Whether Defendant was negligent in failing to safeguard and  protect Plaintiff’s and the other Class Members’ PII;  g)  Whether, by publicly disclosing Plaintiff’s and the other  Class Members’ PII without authorization, Defendant  invaded their privacy; and  h)  Whether Plaintiff and the other Class Members sustained  damages as a result of Defendant’s failure to safeguard and  protect their PII.   43.  Plaintiff and his counsel will fairly and adequately represent the interests  of the other Class Members.  Plaintiff has no interests antagonistic to, or in conflict with,  the other Class Members’ interests.  Plaintiff’s lawyers are highly experienced in the  prosecution of consumer class action and data breach cases.     44.  Plaintiff’s claims are typical of the other Class Members’ claims in that  Plaintiff’s claims and the other Class Members’ claims all arise from Defendant’s failure  to properly safeguard and protect their PII.     45.  A class action is superior to all other available methods for fairly and  efficiently adjudicating Plaintiff’s and the other Class Members’ claims.  Plaintiff and the  other Class Members have been harmed as a result of Defendant’s wrongful actions  and/or inaction and the resulting Data Breach.  Litigating this case as a class action will  reduce the possibility of repetitious litigation relating to Defendant’s conduct.   46.  Class certification, therefore, is appropriate pursuant to FED. R. CIV. P.  23(b)(3) because the above common questions of law or fact predominate over any  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 16 of 27  PAGEID #: 16 17  questions affecting individual Class Members, and a class action is superior to other  available methods for the fair and efficient adjudication of this controversy.   47.  Class certification also is appropriate pursuant to FED. R. CIV. P. 23(b)(2)  because Defendant has acted or refused to act on grounds generally applicable to the  Class, so that final injunctive relief or corresponding declaratory relief is appropriate as  to the Class as a whole.   48.  The expense and burden of litigation would substantially impair the ability of  Class Members to pursue individual lawsuits in order to vindicate their rights.  Absent a  class action, Defendant will retain the benefits of its wrongdoing despite its serious  violations of the law.  49.  The preceding factual statements and allegations are incorporated herein  by reference.    50.  FCRA requires consumer reporting agencies to adopt and maintain  procedures for meeting the needs of commerce for consumer credit, personnel,  insurance and other information in a manner fair and equitable to consumers while  maintaining the confidentiality, accuracy, relevancy and proper utilization of such  information.  15 U.S.C. § 1681(b).   51.  FCRA defines a “consumer reporting agency” as:   Any person which, for monetary fees, dues, or on a cooperative  nonprofit basis, regularly engages in whole or in part in the practice  of assembling or evaluating consumer credit information or other  information on consumers for the purpose of furnishing consumer  reports to third parties, and which uses any means or facility of  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 17 of 27  PAGEID #: 17 18  interstate commerce for the purpose of preparing or furnishing  consumer reports.   15 U.S.C. § 1681a(f).     52.  FCRA defines a “consumer report” as:   [A]ny written, oral, or other communication of any information by a  consumer reporting agency bearing on a consumer’s credit  worthiness, credit standing, credit capacity, character, general  reputation, personal characteristics, or mode of living which is used  or expected to be used or collected in whole or in part for the  purpose of establishing the consumer’s eligibility for credit or  insurance to be used primarily for personal, family, or household  purposes; employment purposes, or any other purpose authorized  under [15 U.S.C. §] 1681(b).   15 U.S.C. § 1681a(d)(1).     53.  Defendant is a Consumer Reporting Agency as defined under FCRA  because on a cooperative nonprofit basis and/or for monetary fees, Defendant regularly  engages, in whole or in part, in the practice of assembling Plaintiff’s and the other Class  Members’ PII for the purpose of furnishing Consumer Reports to third parties in  connection with providing insurance quotes and/or uses interstate commerce for the  purpose of preparing and/or furnishing Consumer Reports in connection with providing  insurance quotes.    54.  Plaintiff’s and the other Class Members’ PII constitute Consumer Reports  because they bear on, inter alia, their credit worthiness, credit standing, credit capacity,  character, general reputation, personal characteristics, physical/medical conditions, and  mode of living, which is used or collected, in whole or in part, for the purpose of  establishing Plaintiff’s and the other Class Members’ eligibility for insurance to be used  primarily for personal, family, or household purposes.  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 18 of 27  PAGEID #: 18 19   55.  As a Consumer Reporting Agency, Defendant was (and continues to be)  required to adopt and maintain procedures designed to protect and limit the  dissemination of consumer credit, personnel, insurance and other information in a  manner fair and equitable to consumers while maintaining the confidentiality, accuracy,  relevancy, and proper utilization of such information.  Defendant, however, violated  FCRA by failing to adopt and maintain such protective procedures which, in turn,  directly and/or proximately resulted in the theft and wrongful dissemination of  Plaintiff’s and the other Class Members’ PII into the public domain.   56.  Defendant’s violation of FCRA, as set forth above, was willful or, at the  very least, reckless, constituting willfulness.    57.  As a direct and/or proximate result of Defendant’s willful and/or reckless  violations of FCRA, as described above, Plaintiff’s and the other Class Members’ PII was  stolen, made accessible to unauthorized third parties in the public domain and  compromised.       58.  As a further direct and/or proximate result of Defendant’s willful and/or  reckless violations of FCRA, as described above, Plaintiff and the other Class Members  were (and continue to be) injured and have suffered (and will continue to suffer) the  damages described in detail above.  Defendant’s wrongful actions and/or inaction  violated FCRA.    59.  Plaintiff and the other Class Members, therefore, are entitled to  compensation for their actual damages including, inter alia, expenses for adequate  credit monitoring and identity theft insurance, out-of-pocket expenses, such as costs for  placing a credit freeze or removing a credit freeze, loss of privacy, deprivation of the  value of their PII, and other economic and non-economic harm (as detailed above), or  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 19 of 27  PAGEID #: 19 20  statutory damages of not less than $100, and not more than $1,000, each, as well as  attorneys’ fees, litigation expenses and costs, pursuant to 15 U.S.C. § 1681n(a).   60.  The preceding factual statements and allegations are incorporated herein  by reference.    61.  Defendant owed a duty to Plaintiff and the other Class Members to  safeguard and protect their PII.  In the alternative, and as described above, Defendant  negligently violated FCRA by failing to adopt and maintain procedures designed to  protect and limit the dissemination of Plaintiff’s and the other Class Members’ PII for  the permissible purposes outlined by FCRA which, in turn, directly and/or proximately  resulted in the theft and wrongful dissemination of Plaintiff’s and the other Class  Members’ PII into the public domain.    62.  It was reasonably foreseeable that Defendant’s failure to maintain  procedures to safeguard and protect Plaintiff’s and the other Class Members’ PII would  result in an unauthorized third party gaining access to their PII for no permissible  purpose under FCRA.    63.  As a direct and/or proximate result of Defendant’s negligent violations of  FCRA, as described above, Plaintiff’s and the other Class Members’ PII was stolen, made  accessible to unauthorized third parties in the public domain and compromised.     64.  As a further direct and/or proximate result of Defendant’s willful and/or  reckless violations of FCRA, as described above, Plaintiff and the other Class Members  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 20 of 27  PAGEID #: 20 21  were (and continue to be) injured and have suffered (and will continue to suffer) the  damages described in detail above.  Defendant’s wrongful actions and/or inaction  violated FCRA.   65.  Plaintiff and the other Class Members, therefore, are entitled to  compensation for their actual damages, including, inter alia, expenses for adequate  credit monitoring and identity theft insurance, out-of-pocket expenses, such as costs for  placing a credit freeze or removing a credit freeze, loss of privacy, deprivation of the  value of their PII, and other economic and non-economic harm (as detailed above), as  well as attorneys’ fees, litigation expenses and costs, pursuant to 15 U.S.C. §1681o(a).  66.  The preceding factual statements and allegations are incorporated herein  by reference.    67.  Defendant owed a duty to Plaintiff and the other Class Members to  safeguard and protect their PII.    68.  Defendant breached its duty by failing to exercise reasonable care and  failing to safeguard and protect Plaintiff’s and the other Class Members’ PII.     69.  It was reasonably foreseeable that Defendant’s failure to exercise  reasonable care in safeguarding and protecting Plaintiff’s and the other Class Members’  PII would result in an unauthorized third party gaining access to such information for  no lawful purpose.    70.  Plaintiff and the other Class Members were (and continue to be) damaged  as a direct and/or proximate result of Defendant’s failure to secure and protect their PII  in the form of, inter alia, expenses for adequate credit monitoring and identity theft  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 21 of 27  PAGEID #: 21 22  insurance, out-of-pocket expenses, such as costs for placing a credit freeze or removing  a credit freeze, loss of privacy, deprivation of the value of their PII, and other economic  and non-economic harm (as detailed above), for which they are entitled to  compensation.   71.  Defendant’s wrongful actions and/or inaction and the resulting Data  Breach (as described above) constituted (and continue to constitute) negligence at  common law.  72.  The preceding factual statements and allegations are incorporated herein  by reference.   73.  Plaintiff’s and the other Class Members’ PII was (and continues to be)  sensitive and personal private information.   74.  By virtue of Defendant’s failure to safeguard and protect Plaintiff’s and the  other Class Members’ PII and the resulting Data Breach, Defendant wrongfully  disseminated Plaintiff’s and the other Class Members’ PII to unauthorized persons.     75.  Dissemination of Plaintiff’s and the other Class Members’ PII is not of a  legitimate public concern; publicity of their PII was, is and will continue to be offensive  to Plaintiff, the other Class Members and all reasonable people. The unlawful disclosure  of same violates public mores.    76.   Plaintiff and the other Class Members were (and continue to be) damaged  as a direct and/or proximate result of Defendant’s invasion of their privacy by publicly  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 22 of 27  PAGEID #: 22 23  disclosing their private facts (i.e., their PII) in the form of, inter alia, expenses for  adequate credit monitoring and identity theft insurance, out-of-pocket expenses, such as  costs for placing a credit freeze or removing a credit freeze, loss of privacy, deprivation  of the value of their PII, and other economic and non-economic harm (as detailed  above), for which they are entitled to compensation.  At the very least, Plaintiff and the  other Class Members are entitled to nominal damages.   77.  Defendant’s wrongful actions and/or inaction and the resulting Data  Breach (as described above) constituted (and continue to constitute) an invasion of  Plaintiff’s and the other Class Members’ privacy by publicly and wrongfully disclosing  their private facts (i.e., their PII) without their authorization or consent.   78.  The preceding factual statements and allegations are incorporated herein  by reference.   79.  Plaintiff and the other Class Members entrusted their PII to Defendant  and/or its affiliate, Allied, for the purpose of obtaining insurance quotes for insurance  products and services offered by Nationwide and/or Allied, or to others for similar  purposes. Plaintiff and the other Class Members were entitled to trust that their PII in  Nationwide’s or Allied’s possession would likewise be properly protected from unlawful  access whether or not they originally entrusted it to Nationwide.     80.  Plaintiff’s and the other Class Members’ PII is their personal property.   Defendant’s wrongful actions and/or inaction and the resulting Data Breach deprived  them of the value of their PII, for which there is a well-established national and  Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 23 of 27  PAGEID #: 23 24  international market, because the PII is now in the hands of unauthorized person(s) and  compromised.    81.  Further, Defendant wrongfully retained and failed to safeguard and  protect the PII of Plaintiff and the other Class Members.   82.  During the time of bailment, Defendant owed Plaintiff and the other Class  Members the duty to safeguard and protect their PII by maintaining reasonable and  effective data security practices, procedures and protocols to protect their PII.  As  alleged herein, Defendant breached its duty to Plaintiff and the other Class Members by  failing to safeguard and protect their PII which, in turn, directly and/or proximately  caused the Data Breach and the wrongful dissemination of their PII to unauthorized  persons.    83.  Defendant’s breach of this duty directly and/or proximately caused  Plaintiff and the other Class Members to suffer (and continue to suffer) the injuries and  damages alleged herein.    BAILMENT   Case: 2:13-cv-00118-MHW-MRA Doc #: 1 Filed: 02/08/13 Page: 5 of 27  PAGEID #: 5 6   INVASION OF PRIVACY BY PUBLIC DISCLOSURE OF PRIVATE FACTS   NEGLIGENT VIOLATION OF THE FAIR CREDIT REPORTING ACT   NEGLIGENCE   WILLFUL VIOLATION OF THE FAIR CREDIT REPORTING ACT  