Opinion
Case No: 8:17-cv-1239-T-30JSS
08-15-2017
GROW FINANCIAL FEDERAL CREDIT UNION, a Federally Chartered Credit Union, Plaintiff, v. GTE FEDERAL CREDIT UNION d/b/a GTE FINANCIAL, a Federally Chartered Credit Union, and ERICA PIERSON HOLLIDAY a/k/a Erica Pierson, an individual, Defendants.
ORDER
THIS CAUSE comes before the Court upon Defendants' Motions to Dismiss (Dkts. 15, 16) and Plaintiff's Response in Opposition (Dkt. 24). Upon review, the Court concludes that Defendants' motions should be granted in part and denied in part.
BACKGROUND
In this lawsuit, Plaintiff Grow Financial Federal Credit Union ("Grow Financial") is suing its competitor, Defendant GTE Federal Credit Union d/b/a GTE Financial, and Grow Financial's former employee Erica Pierson Holliday, who is now employed by GTE Financial. Grow Financial alleges that Holliday, while still employed by Grow Financial, sent Grow Financial's trade secrets and confidential/proprietary information to GTE Financial.
Grow Financial alleges the following claims against Holliday: the Federal Computer Fraud and Abuse Act ("CFAA") (Count I); the Florida Computer Abuse and Data Recovery Act ("CADRA") (Count II); and common law breach of duty of loyalty (Count VIII). Grow Financial alleges the following claims against both Defendants: misappropriation of trade secrets under the Federal Defendant Trade Secrets Act ("DTSA") (Count III) and the Florida Uniform Trade Secrets Act ("FUTSA") (Count IV); tortious interference with advantageous business relationships (Count V); conversion (Count VI); common law unfair competition (Count VII), and civil conspiracy (Count IX).
Holliday and GTE Financial now move to dismiss all of the claims for failure to state a claim under Rule 12(b)(6) of the Federal Rules of Civil Procedure. As explained below, the Court grants the motions to the extent that it dismisses the claims against Holliday under the CFAA and the CADRA. The Court also dismisses the claim of tortious interference with advantageous business relationships based on Grow Financial's withdrawal of this claim.
LEGAL STANDARD
Federal Rule of Civil Procedure 12(b)(6) allows a court to dismiss a complaint when it fails to state a claim upon which relief can be granted. When reviewing a motion to dismiss, a court must accept all factual allegations contained in the complaint as true. See Erickson v. Pardus, 551 U.S. 89, 94 (2007) (internal citation omitted). It must also construe those factual allegations in the light most favorable to the plaintiff. See Hunt v. Aimco Properties, L.P., 814 F.3d 1213, 1221 (11th Cir. 2016) (internal citation omitted).
To withstand a motion to dismiss, the complaint must include "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim has facial plausibility "when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Pleadings that offer only "labels and conclusions," or a "formulaic recitation of the elements of a cause of action," will not do. Twombly, 550 U.S. at 555.
DISCUSSION
I. CFAA
The CFAA provides a cause of action for the improper access to protected computers. See 18 U.S.C. §1030, et. seq. As it relates to this case, the statute provides that "[w]hoever - (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains" information from a protected computer is subject to liability. Id. at 1030(a)(2). Holliday argues that Grow Financial does not allege any facts demonstrating that she exceeded her authorized access. The Court agrees.
The term, "exceeds authorized access" is defined in the CFAA as "access to a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to obtain or alter." Id. at 1030(e)(6). Here, Grow Financial alleges that access to the subject information was necessary for Holliday to perform her job duties. Grow Financial contends that Holliday improperly used or disclosed the information that she accessed when she provided it to GTE Financial while she was still employed at Grow Financial. But, as this Court has previously held, an improper use of data is not tantamount to exceeding authorization under the CFAA. See Maintenx Mgmt., Inc. v. Lenkowski, No. 8:14-cv-2440-T-30MAP, 2015 WL 310543, *2-*3 (M.D. Fla. Jan. 25, 2015) ("The facts put forth by Maintenx support the notion that Lenkowski misused data he obtained from Maintenx's computers, not that he somehow exceeded his seemingly unfettered access.").
Although this Court's prior holding in Lenkowski is not addressed in the parties' briefs, Lenkowski is consistent with the majority view in this circuit that applies a narrow definition of "exceeds authorized access." See Enhanced Recovery Co., LLC v. Frady, No. 3:13-cv-1262-J-34JBT, 2015 WL 1470852, *5-*7 (Mar. 31, 2015) (listing cases). As the court explained in Enhanced Recovery, "[q]uite simply, without authorization means exactly that: the employee was not granted access by his employer. Similarly, exceeds authorized access simply means that, while an employee's initial access was permitted, the employee accessed information for which the employer had not provided permission." Id.
The Court sees no reason to depart from its reasoning in Lenkowski or from the majority view. Notably, if the Court were to apply the CFAA to an employee like Holliday, who allegedly divulged trade secrets that she was actually permitted to access, or who violated computer usage policies, the Court would be taking the CFAA beyond "its original purpose of targeting computer hackers." Enhanced Recovery 2015 WL 1470852 at *8 (citations omitted). Under this broad interpretation, the CFAA would be potentially violated each time an employee accessed an employer's "confidential" information for an improper purpose. The Court will not construe the statute in this broad manner.
Although the Court believes that amendment of the CFAA claim would most likely be futile, the Court will permit Grow Financial to amend this claim if it can allege facts that demonstrate that Holliday accessed information without Grow Financial's permission. The analysis focuses on Grow Financial's actions, rather than the subjective motivation of Holliday, because whether an employee exceeded her authorized access turns on what information the employer permitted that employee to access. See Allied Portables, LLC v. Youmans, No. 2:15-cv-294-FtM-38CM, 2015 WL 3720107, *5 (M.D. Fla. June 15, 2015) (discussing same).
II. CADRA
Like its federal counterpart, the purpose of the Florida Computer Abuse and Data Recovery Act is to safeguard computer systems against unauthorized access. See Fla. Stat. § 668.801. Under section 668.803(1), it is a violation for a person to "knowingly and with intent to cause harm or loss" "[o]btain[] information from a protected computer without authorization." "Without authorization" is defined as "access to a protected computer by a person who: (a) Is not an authorized user; (b) Has stolen a technological access barrier of an authorized user; or (c) Circumvents a technological access barrier on a protected computer without the express or implied permission of the owner, operator, or lessee of the computer or the express or implied permission of the owner of information stored in the protected computer." Fla. Stat. § 668.802(9)(a)-(c). The statute also defines the term "authorized user" as including an "employee . . . of the owner, operator, or lessee of the protected computer . . . if the . . . employee . . . is given express permission by the owner, operator, or lessee of the protected computer . . . to access the protected computer through a technological access barrier." Fla. Stat. § 668.802(1).
Applying these definitions, Grow Financial has failed to allege that Holliday accessed its computer system without authorization. The allegations do not state that Holliday was not an authorized user, had stolen a technological barrier of an authorized user, or otherwise circumvented a technological barrier of Grow Financial's computer system. Accordingly, the Court dismisses this claim. Much like the CFAA claim, the Court believes that amending this claim would be futile. However, the Court will permit Grow Financial to amend this claim if it can plead the necessary facts to establish that Holliday was without authorization when she accessed its computer system.
III. Federal and State Trade Secret Misappropriation
A. Subject Matter Jurisdiction over the Federal Defend Trade Secrets Act
The FDTSA vests federal courts with original jurisdiction to decide civil cases involving misappropriation of trade secrets as long as "the trade secret is related to a product or service used in, or intended for use in, interstate or foreign commerce." 18 U.S.C. § 1836(b)(1). Defendants argue the Court lacks subject matter jurisdiction over the FDTSA claim because the complaint does not allege a connection between the alleged trade secrets and interstate commerce. The Court disagrees.
The complaint alleges that Grow Financial is "a federally chartered credit union" that is "subject to the Gramm-Leach-Bliley Act of 1999 and the National Credit Union Administration's rules and regulations for privacy and confidentiality." (Dkt. 1 ¶10). Grow Financial "provides various financial products and services to its members, such as savings and checking accounts, mortgages, vehicle loans, credit cards, money management services, etc." and uses the trade secrets at issue "in connection with the provision of its products and services in interstate U.S. commerce." Id. at ¶¶7, 51. This is sufficient at this stage to establish a nexus between the trade secrets that were allegedly misappropriated and interstate commerce.
B. Whether the Trade Secret Claims Are Sufficiently Pled
"In a trade secret action, the plaintiff bears the burden of demonstrating both that the specific information it seeks to protect is secret and that it has taken reasonable steps to protect this secrecy." Am. Red Cross v. Palm Beach Blood Bank, Inc., 143 F.3d 1407, 1410 (11th Cir. 1998).
Holliday argues that Grow Financial has not pled sufficient facts to state a cause of action for trade secret misappropriation under federal and Florida law. Holliday's motion reads like a summary judgment motion and largely focuses on whether the information at issue constituted a trade secret, which is typically a question of fact. At this stage, there are numerous allegations about the secret nature of the information and the steps Grow Financial took to protect the information. For example, the complaint alleges Grow Financial's ownership of the trade secrets and then describes them in detail as Grow Financial's "list of members, its operating policies and procedures, . . . customized reports and documents - some created in-house, others commissioned through third parties . . ., lending strategy materials and internal procedures relating to the manner in which Grow Financial processes loan applications, financial analysis, and market research." (Dkt. 1 ¶¶ 8-9, 51, 63).
The complaint also alleges that Grow Financial took reasonable steps to protect the secrecy of its trade secrets and then goes into detail about its computer system's secure programming, testing, auditing, and on-going education of its employees about the sensitive nature of the trade secrets. The complaint alleges that employees are required to acknowledge annually, in writing, their duty to safeguard the information.
The complaint alleges that Holliday surreptitiously disclosed various proprietary Grow Financial documents to GTE Financial by first emailing them from her company email account to her personal account and then forwarding them from her personal account to GTE Financial. Moreover, Holliday emailed or printed out dozens of reports and other documents, many of which contained confidential and/or proprietary Grow Financial information and copied the trade secrets without Grow Financial's consent or authorization. The complaint includes a specific example of a proprietary "Dealer Scorecard" that Holliday provided to GTE Financial, which Holliday and GTE Financial then used and continue to use.
In sum, at this stage, Grow Financial has alleged sufficient facts to plausibly state a cause of action under the DTSA and the FUTSA. Accordingly, the Court will not dismiss Counts III and IV of the complaint.
IV. The Conversion and Unfair Competition Claims
A. Preemption
Both defendants argue that Grow Financial's conversion claim is preempted by the FUTSA and GTE Financial makes the same argument for the unfair competition claim. Defendants focus on the specific language of the FUTSA, which states that the Act displaces "conflicting tort . . . and other law of this state providing civil remedies for misappropriation of a trade secret." Fla. Stat. § 688.008(1). However, as Grow Financial points out, there has not yet been a determination in this litigation regarding whether the information and documents at issue constitute trade secrets under Florida law. Without this determination, Grow Financial is permitted to maintain the conversion and unfair competition claims in the alternative. See Vacation Club Svs., Inc. v. Rodriguez, No. 6:10-cv-247-Orl-31GJK, 2010 WL 1645129, at *2 (M.D. Fla. April 22, 2010) (denying defendant's motion to dismiss plaintiff's conversion claim as preempted by the FUTSA because plaintiff's alleged "confidential database of its timeshare members" had not yet been determined to be a trade secret and plaintiff was "free to plead in the alternative.").
For this same reason, Holliday's argument that the breach of loyalty claim is preempted by the FUTSA is denied. It is important to note that, even if the FUTSA claim ultimately prevails, the breach of loyalty claim may not be preempted if it relates to separate acts of dishonesty, i.e., acts other than the misappropriation of Grow Financial's trade secrets.
B. Whether the Conversion Claim Is Sufficiently Pled
Both Defendants argue that the conversion claim fails as a matter of law because Grow Financial still has copies of the information and documents at issue. The cases Defendants rely upon are not factually on point. Florida law recognizes a conversion claim, even if the rightful owner still has the information, for the wrongful taking of confidential business information. See Warshall v. Price, 629 So. 2d 903, 904-05 (Fla. 4th DCA 1993) (concluding that a doctor's use of the plaintiff's confidential patient list, which denied the plaintiff the benefit of his property, supported a claim for conversion, even though the plaintiff still had access to the list); see also Total Mktg. Tech., Inc. v. Angel Medflight Worldwide Air Ambulance Svs., LLC, No. 8:10-cv-2680-T-33TBM, 2012 WL 33150, at *3-*4 (M.D. Fla. Jan. 6, 2012) (concluding that the plaintiff alleged facts sufficient to establish the elements of conversion by alleging the wrongful taking of confidential business information). Accordingly, Defendants' motions are denied with respect to this claim.
V. Civil Conspiracy
"A civil conspiracy requires: (a) an agreement between two or more parties, (b) to do an unlawful act or to do a lawful act by unlawful means, (c) the doing of some overt act in pursuance of the conspiracy, and (d) damage to plaintiff as a result of the acts done under the conspiracy." Craig v. Kropp, No. 2:17-CV-180-FTM-99CM, 2017 WL 2506386, at *8 (M.D. Fla. June 9, 2017) (quoting Charles v. Fla. Foreclosure Placement Ctr., LLC, 988 So. 2d 1157, 1159-60 (Fla. 3d DCA 2008)). Holliday argues that this claim fails because Grow Financial does not allege sufficient facts in support of the alleged agreement between Holliday and GTE Financial to do an unlawful act. The Court disagrees.
The complaint alleges that GTE Financial, through its employee and officer James Esner, asked Holliday, while she was employed at Grow Financial, to search Grow Financial's computer system and send certain documents to GTE Financial, knowing that the documents were proprietary to Grow Financial. Holliday then provided this information to GTE Financial. This is sufficient at this stage. Accordingly, the Court will not dismiss this claim.
Holliday's remaining arguments are without merit. --------
It is therefore ORDERED AND ADJUDGED that:
1. Defendants' Motions to Dismiss (Dkts. 15, 16) are granted in part and denied in part as explained herein.
2. Counts I and II of the complaint are dismissed without prejudice to amend these claims within fourteen (14) days of this Order. Count V of the complaint is dismissed per Plaintiff's withdrawal of this claim.
3. If Plaintiff does not file an amended complaint by the deadline stated in paragraph 2 of this Order, Defendants shall file their answers within fourteen (14) days of the expiration of that deadline.
DONE and ORDERED in Tampa, Florida on August 15, 2017.
/s/ _________
JAMES S. MOODY, JR.
UNITED STATES DISTRICT JUDGE Copies furnished to:
Counsel/Parties of Record