Opinion
No. C 06-03762 CRB.
September 12, 2006
ORDER
Now pending before the Court is Defendant's motion to dismiss Plaintiffs' claims. For the reasons set forth below, Defendant's motion is GRANTED with prejudice as to Plaintiffs' fifth cause of action. Defendant's motion is GRANTED without prejudice as to Plaintiffs' other causes of action.
BACKGROUND
On April 1, 2006, an unknown person allegedly stole a briefcase belonging to an employee of Union Bank of California ("UBOC"). This briefcase allegedly contained personal and financial information belonging to persons with checking, savings, and/or other depository accounts with UBOC. According to Plaintiffs, this information included "names, addresses, telephone numbers, account numbers, types of accounts, account opening dates, account balances, social security numbers and, occasionally, interest rates." Complaint ¶ 11. On April 25, 2006, pursuant to California law, UBOC notified its customers about the theft.
California Civil Code section 1798.82 requires businesses that keep secured records containing confidential information to "disclose any breach of the security of the system . . . to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person." CAL. CIV. CODE § 1798.82.
Plaintiffs Crystal and Roy Garcia purport to represent themselves and other similarly situated UBOC customers ("Plaintiffs") who maintain accounts with UBOC and who have had their confidential financial information compromised as a result of the theft of the briefcase. Complaint ¶ 14. Plaintiffs brought this suit alleging that UBOC recklessly and negligently maintained custody of Plaintiffs' data and thereby allowed it to be stolen. They further allege that they relied on UBOC's misleading representation that their information "would remain secure." Id. ¶ 27. Specifically, Plaintiffs set forth eight claims: (1) negligence; (2) fraud; (3) negligent misrepresentation; (4) invasion of privacy; (5) negligent noncompliance with the Fair Credit Reporting Act (FCRA); (6) violation of the California Credit Reporting Agencies Act (CCRA); (7) violation of the California Investigative Consumer Reporting Agencies Act (CICRAA); and (8) violation of California's Unfair Competition Law under Business and Professions Code section 17200.
Defendant now moves to dismiss under Rule 12(b)(6), alleging that Plaintiffs have failed to state a claim upon which relief may be granted.
Plaintiffs have identified UnionBanCal as the defendant in this suit. Their factual allegations, however, pertain almost exclusively to UBOC. While the Complaint treats these two corporate entities as one and the same, the parties now agree that UnionBanCal and UBOC are separate corporate entities — UnionBanCal is not a bank but a holding company, and UBOC is one of its subsidiaries. UnionBanCal thus argues, correctly, that it is not the proper defendant in this suit, and Plaintiffs have indicated their intention to amend the complaint accordingly. This order proceeds to the merits of Plaintiffs' claims as if they had properly named UBOC as the defendant. Defense counsel has asserted that he has authority to represent both UnionBanCal and UBOC in this matter, and both corporations were represented at the hearing on the motion to dismiss.
DISCUSSION
Plaintiffs allege, inter alia, that UBOC has violated the FCRA, 15 U.S.C. § 1681 et. seq. Specifically, Plaintiffs aver that the data contained in the stolen briefcase constitute "consumer reports" as defined by that statute, and that UBOC violated the FCRA by disclosing these consumer reports to unauthorized third persons. Complaint ¶¶ 70, 71; see also 15 U.S.C. §§ 1681b, 1681o.
Even taking the Plaintiffs' factual allegations as true, however, their Complaint cannot support a claim under the FCRA. On the facts presented in the Complaint, UBOC was not acting as a "consumer reporting agency" with respect to the information contained in the stolen briefcase. Furthermore, the contents of the briefcase, as described in the Complaint, do not constitute "consumer reports." Therefore, UBOC cannot incur liability under that statute. See Rush v. Macy's N.Y., Inc., 775 F.2d 1554, 1557 (7th Cir. 1985) (holding that only a consumer reporting agency can be liable for claims under the FCRA).
Under the FCRA, a "consumer reporting agency" is defined as an entity that provides "consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties." 15 U.S.C. § 1681a(f) (emphasis added). Here, the Complaint does not allege that UBOC produced the information contained in the stolen briefcase for the purpose of providing it to any third party. Nor could the Complaint plausibly make such an allegation, in light of the fact that the briefcase was allegedly stolen. Thus, at least insofar as the stolen briefcase is concerned, the Complaint fails to establish that UBOC was acting as a "consumer reporting agency." Accord Moore v. Beneficial Nat'l Bank USA, 876 F. Supp. 1247, 1259-61 (M.D. Ala. 1995) (holding that a bank did not act as "consumer reporting agencies" when handling information relating to its customers' accounts).
Plaintiffs allege in their Complaint that UBOC is generally in the business of generating consumer reports. Complaint ¶ 19. Plaintiff further alleges that UBOC "maintains computer databases of consumer identity and credit information for use in generating credit/background reports and in verifying information supplied by individuals as part of business transactions, such as credit, insurance, employment, or housing applications." Id. ¶ 20. Plaintiff also alleges that UBOC "communicates information relating to consumers' creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, and/or mode of living," and that this information "is used or expected to be used . . . to serve as a factor in establishing consumers' eligibility for personal, family or household credit, insurance, housing or employment."Id. at 21. These allegations, taken as true, may establish that UBOC sometimes functions as a "consumer reporting agency." But this alone does not establish UBOC's liability under the FCRA in this case; in order to fall under the ambit of the FCRA, it must have been acting as a consumer reporting agency at the time it generated the information in the stolen briefcase. See Smith v. First National Bank of Atlanta, 837 F.2d 1575, 1578 (11th Cir. 1988) (holding that a bank is not acting as a "consumer reporting agency" if it has not furnished a "consumer report.").
The FCRA sets forth a broad definition of "consumer reports," but it expressly excludes from that definition any reports "containing information solely as to transactions or experiences between the consumer and the person making the report." 15 U.S.C. § 1681a(d)(2)(A)(i). Because the data contained in the stolen briefcase as described by Plaintiffs fit squarely within this exception described by section 1681a(d)(2)(A)(i), the Complaint fails to establish UBOC's liability under the FCRA. See Smith v. First National Bank of Atlanta, 837 F.2d 1575, 1578 (11th Cir. 1988) ("[W]here [a bank] has reported information based solely on its own experience with one of its customers, the bank is not acting as a 'consumer reporting agency,' within the meaning of the [FCRA] because . . . it has not furnished a 'consumer report.'").
Plaintiffs' conclusory assertions that the briefcase contained "consumer reports" are insufficient. Clegg v. Cult Awareness Network, 18 F.3d 752, 754-55 (9th Cir. 1994) (noting that a district court "is not required to accept legal conclusions cast in the form of factual allegations if those conclusions cannot reasonably be drawn from the facts alleged"); Western Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981) ("We do not, however, necessarily assume the truth of legal conclusions merely because they are cast in the form of factual allegations."). Here, the Plaintiffs have alleged only that the stolen briefcase contained "names, addresses, telephone numbers, account numbers, types of accounts, account opening dates, account balances, social security numbers and, occasionally, interest rates." Complaint ¶ 11. This is information relating "solely as to transactions or experiences between [Plaintiffs] and [UBOC]." 15 U.S.C. § 1681a(d)(2)(A)(i).
Plaintiffs argue that the contents of the briefcase nonetheless constitute "consumer reports" because some of the information — such as telephone numbers, social security numbers, and addresses — does not "solely" describe transactions between the Plaintiffs and UBOC. In other words, because such personal information might also relate to other transactions affecting the Plaintiffs' credit, such information should qualify the contents of the stolen briefcase as "consumer reports." The problem with Plaintiffs' argument is that such personal information still constitutes information relating to "transactions or experiences between the consumer and the person making the report." Id. § 1681a(d)(2)(A)(i). Simply put, information relating to "transactions or experiences between the consumer and the person making the report" necessarily includes information about the consumer. To hold otherwise — i.e., to accept Plaintiffs' argument that the presence of personal information about UBOC's customers renders the contents of the briefcase beyond the scope of Section 1681a(d)(2)(A)(i) — would render that provision of the FCRA nearly meaningless.
Even construing the allegations in the Complaint in the light most favorable to Plaintiffs, see Cahill v. Liberty Mut. Ins. Co., 80 F.3d 336, 337 (9th Cir. 1996), and assuming that all general allegations embrace whatever specific facts might be necessary to support them, see Peloza v. Capistrano Unified Sch. Dist., 37 F.3d 517, 521 (9th Cir. 1994), Plaintiffs fail to sufficiently allege that the data contained in the stolen briefcase could constitute "consumer reports" within the meaning of the FCRA. Therefore, Plaintiffs claim under the FCRA is DISMISSED with prejudice.
Plaintiffs also assert claims under roughly analogous California statutes, including the CCRAA and the ICRAA. While the Court notes that the legal analysis under these statutes is substantially similar to the analysis required by the FCRA, see Gomon v. TRW, Inc., 28 Cal. App. 4th 1161, 1168 (4th Dist. 1994), the Court makes no determination here regarding the sufficiency of these state-law claims.
With the dismissal of Plaintiffs' claim under the FCRA, a jurisdictional problem arises. Plaintiffs allege subject matter jurisdiction only under 28 U.S.C. § 1331 on the basis of their FCRA claim, and diversity jurisdiction under 28 U.S.C. § 1332. Complaint ¶ 4. Without the FCRA claim, there can be no subject matter jurisdiction under section 1331. Moreover, Plaintiffs have not pled facts to support diversity jurisdiction under section 1332 because they do not identify the parties as diverse. See Complaint ¶¶ 10-11 (identifying UnionBanCal as a "commercial financial institution" with "its headquarters in San Francisco, California"). Because there is no basis for federal jurisdiction, the remainder of Plaintiffs' claims are DISMISSED without prejudice. As to their other claims, Plaintiffs are free to amend their Complaint if they so choose, but the basis for federal jurisdiction must appear on the face of the Complaint.See Fed R. Civ. P. 8(a) ("A pleading which sets forth a claim for relief . . . shall contain . . . a short and plain statement of the grounds upon which the court's jurisdiction depends.").Cf. Warth v. Seldin, 422 U.S. 490, 518 (1975) ("It is the responsibility of the complainant clearly to allege facts demonstrating that he is a proper party to invoke judicial resolution of the dispute and the exercise of the court's remedial powers.").
IT IS SO ORDERED.