EDWARD M. CHEN United States District Judge

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS FOR LACK OF PERSONAL JURISDICTION

Docket No. 7

Plaintiff Maria Asela Caces-Tiamson, proceeding pro se, has filed suit against Defendant Equifax. The suit is related to a data breach that occurred at Equifax and that the company announced in September 2017. Currently pending before the Court is Equifax's motion to dismiss for lack of personal jurisdiction and to dismiss for failure to state a claim for relief.

Having considered the parties' briefs and accompanying submissions, the Court finds this matter suitable for resolution without oral argument and thus VACATES the hearing on the motion. Equifax's motion to dismiss based on lack of personal jurisdiction is hereby GRANTED.

I. FACTUAL & PROCEDURAL BACKGROUND

Although Ms. Caces-Tiamson's complaint is not a model of clarity, it appears that her position is as follows.

In November 2019, Ms. Caces-Tiamson sent a letter to Equifax, stating that she was "a victim of the fraudulent data breach that occurred at your company and [that] was reported" in September 2017. See Compl., Ex. 1 (letter). In the same letter, Ms. Caces-Tiamson asked Equifax to provide "proofs of claim" on, inter alia, the following issues: (1) that, in September 2017, it did not announce the data breach; (2) that it did not know of the data breach for many months before announcing it; (3) that it did not intentionally try to cover up the data breach; (4) that it protected her personal data and did not allow it to be stolen; (5) that it is not liable to her for damages; etc. Ms. Caces-Tiamson asked Equifax to respond within ten days and then concluded her letter by stating:

A non-response and[/]or failure to provide Proof of Claim will constitute agreement by you, and that the undersigned can exercise the remedy provided by all applicable laws, federal, state and local. Your non-response will equate to commercial acquiescence to the terms outlined by the undersigned in a final Affidavit and Notice of Default.

Apparently, Equifax did not respond to Ms. Caces-Tiamson's letter. Accordingly, in January 2020, she filed the instant action in federal court. In the complaint, Ms. Caces-Tiamson states that she has exhausted her remedies with Equifax; that she gave Equifax an opportunity to provide "proofs of claim"; that Equifax was "sent a Notice of Fault and Opportunity to Cure [but] failed to respond"; and that, "[t]hrough [the] non-response and silence, [Equifax has] quietly agreed to all of the facts as outlined in the Notice of Default.[] Therefore the Plaintiff states a superior claim upon which relief can be granted." Compl. at 4, 6.

II. DISCUSSION

A. Legal Standard

A defendant may move to dismiss based on lack of personal jurisdiction pursuant to Federal Rule of Civil Procedure 12(b)(2).

In opposing a defendant's motion to dismiss for lack of personal jurisdiction, the plaintiff bears the burden of establishing that jurisdiction is proper. Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss. The plaintiff cannot "simply rest on the bare allegations of its complaint," but uncontroverted allegations in the complaint must be taken as true.

The test for personal jurisdiction of this Court is clear:

Where, as here, no federal statute authorizes personal jurisdiction, the district court applies the law of the state in which the court sits. California's long-arm statute, Cal. Civ. Proc. Code § 410.10, is coextensive with federal due process requirements, so the jurisdictional analyses under state law and federal due process are the same. For a court to exercise personal jurisdiction over a nonresident defendant consistent with due process, that defendant must have "certain minimum contacts" with the relevant forum "such that the maintenance of the suit does not offend 'traditional notions of fair play and substantial justice.'"

"There are two categories of personal jurisdiction: (1) general jurisdiction and (2) specific jurisdiction." Freestream, 905 F.3d at 602. The Court addresses first whether it has general jurisdiction over Equifax.

Where there is general jurisdiction over a defendant, the plaintiff can bring any claim against the defendant in the forum state. Thus, in order for general jurisdiction to obtain, the defendant's contacts with the forum state must be so continuous and systematic as to render the defendant essentially at home in the forum State. See Daimler AG v. Bauman, 571 U.S. 117, 122, 128 (2014); see also Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 807 (9th Cir. 2004) (asking whether the defendant has continuous and systematic contacts that approximate physical presence in the forum state). "With respect to a corporation, the place of incorporation and principal place of business are 'paradig[m] . . . bases for general jurisdiction.'" Daimler, 571 U.S. at 137. Although the Supreme Court has not held that "a corporation may be subject to general jurisdiction only in a forum where it is incorporated or has its principal place of business," the Court has also rejected the proposition that there is general jurisdiction over a corporation "in every State in which a corporation 'engages in a substantial, continuous, and systematic course of business.' That formulation . . . is unacceptably grasping." Id. (emphasis in original); see also id. at 139 (stating that the inquiry is "not whether a foreign corporation's in-forum contacts can be said to be in some sense 'continuous and systematic'" but rather "whether that corporation's 'affiliations with the State are so "continuous and systematic" as to render [it] essentially at home in the forum State'").

In the instant case, Ms. Caces-Tiamson has failed to make out a prima facie case of general jurisdiction. Equifax is a Georgia corporation; it also has its principal place of business there. See Morris Decl., Exs. 1-2 (business information for Equifax as provided by the Georgia Corporations Division). There is nothing to indicate that Equifax has affiliations with California that are so continuous and systematic as to render it essentially at home in California. In her opposition brief, Ms. Caces-Tiamson cites to a non -Equifax website (called "craft.co") indicating that Equifax has two offices in California: one in Escalon and the other in Concord. See Opp'n at 2 & Ex. 2 (information on Equifax locations as provided by www.craft.co/equifax/locations). But even accepting that evidence as true, that does not establish that Equifax's affiliations with California are so continuous and systematic as to render it essentially at home in the state. Indeed, Equifax has submitted evidence as part of its reply brief, reflecting that (1) it "has never maintained a site located in Escalon" and that (2) it previously "maintained an operations site in Concord . . . to handle unemployment compensation claims concerning customers of [Equifax Workforce Solutions's] Unemployment Cost Management product. This location served no function related to the network which was impacted in the data security incident announced publicly by Equifax Inc. in September 2017" and the site "closed in Q2 2018." Bekaert Decl. ¶¶ 5-7."). That does not come close to satisfying the Daimler test. C. Specific Jurisdiction

The Ninth Circuit has a three-part test to determine whether there is specific jurisdiction over a claim.

(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;

(2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and

(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e., it must be reasonable.

In the instant case, the critical issue is (1) above. As to whether the purposeful availment/purposeful direction requirement has been met, the Court must first ask what exactly is the nature of the claim that Ms. Caces-Tiamson is bringing.

If Ms. Caces-Tiamson were bringing some kind of tort claim against Equifax for not preventing the data breach, then the Court would apply a purposeful direction analysis. See In re Boon Glob., Ltd., 923 F.3d 643, 651 (9th Cir. 2019) ("'The exact form of our jurisdictional inquiry depends on the nature of the claim at issue.' For claims sounding in contract, a purposeful availment test is used; for claims sounding in tort a purposeful direction test is used."). Under that analysis, Ms. Caces-Tiamson cannot establish even a prima facie case of specific jurisdiction because, as Equifax argues, "any and all actions which Equifax did or allegedly did not take with respect to its data security systems" would presumably have occurred in Georgia, where Equifax has its principal place of business. Mot. at 2. The fact that Ms. Caces-Tiamson suffered injury in California (i.e., where she resides) as a result of Equifax's actions or omissions is not enough to support specific jurisdiction. See In re Packaged Seafood Prods. Antitrust Litig., 338 F. Supp. 3d 1118, 1161 (S.D. Cal. 2018) ("As the Supreme Court made clear in Walden v. Fiore [571 U.S. 277 (2014)], something more is required than 'imposition of an injury . . . to be suffered by the plaintiff while she is residing in the forum state.'").

A plaintiff's "residency in the forum state is not the sine qua non of specific jurisdiction." Neither is where the Plaintiff experienced her injury. Rather, the Supreme Court has instructed [in Walden] that "t]he proper question is not where the plaintiff experienced a particular injury or effect but whether the defendant's conduct connects him to the forum in a meaningful way."

Nor can specific jurisdiction be based on the mere fact that Equifax provides services to customers nationwide, including but not limited to California. See Asahi Metal Indus. Co., Ltd. v. Sup. Ct. of California, Solano County, 480 U.S. 102, 112 (1987) (stating that "[t]he 'substantial connection' between the defendant and the forum State necessary for a finding of minimum contacts must come about by an action of the defendant purposefully directed toward the forum State" and that "[t]he placement of a product into the stream of commerce, without more, is not an act the defendant purposefully directed toward the forum state") (emphasis in original).

In her opposition brief, Ms. Caces-Tiamson's tries to link the data breach to California because Equifax purportedly has two California offices and "[t]he computer systems in these locations are networked . . . to the computer at Equifax's Headquarters in Georgia, sharing data." Opp'n at 3. Ms. Caces-Tiamson, however, has not shown that data breach or the failure to prevent the data breach is tied to the California offices specifically. See pages 4-5, supra (discussing evidence provided by Equifax as part of its reply brief regarding the alleged Escalon office and the Concord office).

The only wrinkle here is that Ms. Caces-Tiamson has framed her complaint in an odd way. Based on the allegations in her complaint, she does not purport to be bringing a direct tort claim based on Equifax's failure to prevent the data breach. Rather, she asserts in the complaint that (1) she gave Equifax an opportunity to provide proof that it was not at fault, (2) Equifax failed to respond, and (3) thus Equifax should be deemed to have admitted to liability (i.e., is in some kind of default). Even as framed, Equifax's liability turns on its responsibility for the breach. Hence, the problematic nature of personal jurisdiction still obtains. In any event, there is nothing to indicate that Equifax's failure to respond to Ms. Caces-Tiamson's notice occurred in California, rather than Georgia. Again, specific jurisdiction must be based on "contacts that the 'defendant himself' creates with the forum state." Walden, 571 U.S. at 284 (emphasis in original). The "'minimum contacts' analysis looks to the defendant's contacts with the forum State itself, not the defendant's contacts with persons who reside there." Id. at 285.

Finally, even if the Court were to apply a purposeful availment analysis, "[t]he purposeful availment standard requires more than foreseeability of causing injury in another state." Terracom v. Valley Nat. Bank, 49 F.3d 555, 560 (9th Cir. 1995) (adding that "'the foreseeability that is critical to due process analysis . . . is that the defendant's conduct and connection with the forum State are such that he should reasonably anticipate being haled into court there'"). Ms. Caces-Tiamson has not made a sufficient showing of specific jurisdiction.

III. CONCLUSION

For the foregoing reasons, the Court grants Equifax's motion to dismiss based on lack of personal jurisdiction. Because the Court is granting the motion to dismiss based on lack of personal jurisdiction, it need not address Equifax's secondary argument in support of dismissal, i.e., failure to state a claim for relief.

The Clerk of the Court is directed to close the file in this case.

This order disposes of Docket No. 7.

IT IS SO ORDERED. Dated: March 20, 2020

/s/_________

EDWARD M. CHEN

United States District Judge