Summary
applying Nevada law in data breach action and dismissing the unjust enrichment claims
Summary of this case from In re Brinker Data Incident Litig.Opinion
3:12-cv-00325-RCJ-VPC MDL No. 2357
2013-09-09
In re ZAPPOS.COM, INC., CUSTOMER DATA SECURITY BREACH LITIGATION.
ORDER
This multidistrict litigation case arises out of the alleged security breach of Zappos.com's customer data. Pending before the Court is Defendant Amazon.com's, Inc., d.b.a. Zappos.com ("Zappos") Motion to Dismiss (ECF No. 62). For the reasons given herein, the Court grants the Motion in part and denies it in part, dismissing most of the common law claims, but not dismissing most of the statutory claims.
I. FACTS AND PROCEDURAL HISTORY
On June 14, 2012, the U.S. Judicial Panel on Multidistrict Litigation ("JPML") granted Defendant's motion to create the present case pursuant to 28 U.S.C. § 1407, transferring six extra-district actions to this District, consolidating them with three actions from this District, and assigning the MDL Case to this Court. (See Transfer Order, June 14, 2012, ECF No. 1). Those nine cases were: Richards v. Amazon.com, Inc., No. 6:12-cv-212 (M.D. Fla.); St. Lawrence v. Zappos.com, Inc., No. 0:12-cv-60133 (S.D. Fla.); Stevens v. Amazon.com, Inc., No. 3:12-cv-32 (W.D. Ky.); Penson v. Amazon.com, Inc., No. 3:12-cv-36 (W.D. Ky.); Elliott v. Amazon.com, Inc., No. 3:12-cv-37 (W.D. Ky.); Habashy v. Amazon.com, Inc., No. 1:12-cv-10145 (D. Mass.); Priera v. Zappos.com, Inc., No. 2:12-cv-182 (D. Nev.); Simon v. Amazon.com, Inc., No. 2:12-cv-232 (D. Nev.); and Ree v. Amazon.com, Inc., d.b.a. Zappos.com, No. 3:12-cv-72 (D. Nev.). (See id.). Zappos moved to compel arbitration and stay the case. While that motion was pending, the JPML transferred in one more action: Nobles v. Zappos.com, Inc., No. 12-cv-3131 (N.D. Cal.). (See Conditional Transfer Order (CTO-1), July 16, 2012, ECF No. 5). The Court denied the motion to compel arbitration because the arbitration contract was "browsewrap" not requiring any objective manifestation of assent (as opposed to a "clickwrap" agreement, which requires an affirmative act by the website visitor assenting to terms before proceeding), and there was no evidence that Plaintiffs had knowledge of the offer such that assent could be implied merely by use of the website. (See Order 7-10, Sept. 27, 2012, ECF No. 21). The Court also noted that even if there had been sufficient evidence of express or implied acceptance, the contract would have failed for lack of consideration, because Zappos's ability under the contract unilaterally to revise its terms made Zappos's promise to perform thereunder illusory. (See id. 10-12).
Plaintiffs in the three Kentucky cases filed a Consolidated Amended Class Action Complaint ("CACAC"), which plaintiffs from a case not part of the present MDL Case also purported to join. (See CACAC, Nov. 12, 2012, ECF No. 58). The following day, Plaintiffs in the other seven cases from Nevada, California, Florida, and Massachusetts filed an Amended Consolidated Complaint ("ACC"). (See ACC, Nov. 13, 2012, ECF No. 59). The CACAC and the ACC appear to account for all actions pending in this case. The CACAC lists twelve causes of action: (1)-(2) willful and negligent violations of the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681(b); (3) public disclosure of private facts; (4) negligence; (5) breach of contract; (6) violation of various state deceptive trade practices or consumer protection acts; (7) violation of the California unfair competition law; (8) violation of California consumer records security law; (9) violation of the California consumer legal remedies act; (10) violation of the Texas deceptive trade practices-consumer protection act; (11) unjust enrichment; and (12) declaratory relief. The ACC lists ten causes of action: (1) negligence; (2) public disclosure of private facts; (3)-(4) breach of contract; (5) unfair competition under California law; (6) misleading advertising under California law; (7) improper disclosure and notification of security breach under California and Washington law; (8) violation of various state deceptive trade practices or consumer protection acts; (9) violation of the California Consumer Legal Remedies Act; and (10) violation of the Nevada Deceptive Trade Practices Act. Defendant has moved to dismiss both the CACAC and the ACC for lack of standing and failure to state a claim.
That case is Relethford v. Amazon.com, Inc., No. 2:12-cv-864 (D. Nev.). Plaintiffs in Relethford originally sued in the Southern District of California. (See Compl., Mar. 2, 2012, ECF No. 1 in Case No. 2:12-cv-864). A court of that district transferred the case to this District pursuant to 28 U.S.C. § 1404(a). (See Order, May 18, 2012, ECF No. 9-1 in Case No.2:12-cv-864). The case was assigned to Judge Dawson, who granted the parties' joint motion to reassign the case to this Court. Although the case has been pending in this Court for almost a year, (see Order, Oct. 15, 2012, ECF No. 16 in Case No.2:12-cv-864), it has not been consolidated into the present case, there is no indication of any motion to transfer pending before the JPML, and this Court probably has no jurisdiction to circumvent the JPML's control over transfer via a local consolidation order. Cf. In re Showa Denko K.K. L-Tryptophan Prods. Liab. Litig.-II, 953 F.2d 162, 165-66 (4th Cir. 1992). In any case, there has not even been any motion to consolidate, join, intervene, etc. apart from the transfer to this Court of the separate case by another Court of this District and the sudden appearance of the Relethford plaintiffs' names in the caption of the CACAC in the present case. The Relethford plaintiffs are therefore not properly joined in the CACAC. Appropriately, the Clerk has not added those plaintiffs to the docket in this case.
II. LEGAL STANDARDS
Federal Rule of Civil Procedure 8(a)(2) requires only "a short and plain statement of the claim showing that the pleader is entitled to relief" in order to "give the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Conley v. Gibson, 355 U.S. 41, 47 (1957). Federal Rule of Civil Procedure 12(b)(6) mandates that a court dismiss a cause of action that fails to state a claim upon which relief can be granted. A motion to dismiss under Rule 12(b)(6) tests the complaint's sufficiency. See N. Star Int'l v. Ariz. Corp. Comm'n, 720 F.2d 578, 581 (9th Cir. 1983). When considering a motion to dismiss under Rule 12(b)(6) for failure to state a claim, dismissal is appropriate only when the complaint does not give the defendant fair notice of a legally cognizable claim and the grounds on which it rests. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). In considering whether the complaint is sufficient to state a claim, the court will take all material allegations as true and construe them in the light most favorable to the plaintiff. See NL Indus., Inc. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). The court, however, is not required to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences. See Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). A formulaic recitation of a cause of action with conclusory allegations is not sufficient; a plaintiff must plead facts showing that a violation is plausible, not just possible. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 555).
"Generally, a district court may not consider any material beyond the pleadings in ruling on a Rule 12(b)(6) motion. However, material which is properly submitted as part of the complaint may be considered on a motion to dismiss." Hal Roach Studios, Inc. v. Richard Feiner & Co., 896 F.2d 1542, 1555 n.19 (9th Cir. 1990) (citation omitted). Similarly, "documents whose contents are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the pleading, may be considered in ruling on a Rule 12(b)(6) motion to dismiss" without converting the motion to dismiss into a motion for summary judgment. Branch v. Tunnell, 14 F.3d 449, 454 (9th Cir. 1994). Moreover, under Federal Rule of Evidence 201, a court may take judicial notice of "matters of public record." Mack v. S. Bay Beer Distribs., Inc., 798 F.2d 1279, 1282 (9th Cir. 1986). Otherwise, if the district court considers materials outside of the pleadings, the motion to dismiss is converted into a motion for summary judgment. See Arpin v. Santa Clara Valley Transp. Agency, 261 F.3d 912, 925 (9th Cir. 2001).
III. ANALYSIS
A. Standing
As a general matter, the Court finds that Plaintiffs have standing. Plaintiffs have sufficiently alleged that they have had to pay money to monitor their credit scores and secure their financial information due to the increased risk of criminal fraud against them occasioned by Defendant's negligent loss of their personal information. Where actual harm is required under a given cause of action, Plaintiffs will have to show that the Rule 23(a) requirements have been satisfied with respect to such damages, i.e., that there is a sufficiently numerous class that has, like named Plaintiffs, experienced these kinds of expenses, but standing is otherwise sufficiently alleged. Of course, no Plaintiff may assert speculative harm, and the class may not include members with only speculative harm. Claims that a Plaintiff has been harmed, for example, by the use of his personal information by the receipt of advertising emails from third parties, will not support standing. Except where a statute provides that the breach of data is cognizable harm in-and-of-itself, Plaintiffs must allege actual harm, i.e., having spent money on fraud prevention measures such as credit monitoring or other fraud prevention services, or actual fraud or identity theft.
However, some claims do fail for lack of standing, at least in part. For example, the CACAC Plaintiffs, being from Texas, Florida, and Alabama, variously, have no standing to assert violations of California statutes. As noted, supra, the putative California Plaintiff in the CACAC is not properly joined therein.
B. The Merits
1. Public Disclosure of Private Facts and The FCRA
The Court dismisses the claims for public disclosure of private facts and violation of the FCRA, without leave to amend. Zappos is not alleged, even in the alternative, to have intentionally disclosed Plaintiff's personal information, and the personal information is also not properly alleged to have constituted "private facts" as that term is used in the context of the relevant tort. See Busse v. Motorola, Inc., 351 Ill. App. 3d 67, 72-73 (App. Ct. 2004) (distinguishing "personal information" such as a social security number that is not objectionable or embarrassing in and of itself, from "private facts" such as information about a person's private behavior); Restatement (Second) of Torts § 652D (1977). Zappos is also not alleged to be a "consumer reporting agency" subject to suit under the FCRA as defined by the statute, see 15 U.S.C. § 1681a(f).
2. Breach of Contract
The Court also dismisses the contractual claims. Plaintiffs allege that Zappos breached a contract to safeguard their data. But there is no allegation of any express or implied contract. The only allegations alleged to give rise to any contract are that customers agreed to pay money for goods and that statements on Zappos's website indicated that its servers were protected by a secure firewall and that customers' data was safe. The first type of contract for the sale of goods is not alleged to have been breached, and the unilateral statements of fact alleged as to the safety of customers' data do not create any contractual obligations, although if negligently or intentionally false, such statements can be the basis of misrepresentation claims in tort. The Court dismisses the contractual claims.
3. Negligence
The Court will treat the negligence claims as negligent misrepresentation claims. Plaintiffs have sufficiently alleged that Zappos negligently failed to protect Plaintiffs' private data from electronic theft with sufficient electronic safeguards. Plaintiffs need not rely on any special duty of care. In the context of a simple negligence claim, Zappos owed Plaintiffs the duty of care owed by all persons to all other persons as a general matter: the duty to act as a reasonable and prudent person under the same or similar circumstances. Negligence is a question of fact in this case. Although a tort by a third person is an intervening cause, it is not a superseding cause if the defendant's negligence made the third person's tort foreseeably more likely. See Dan B. Dobbs, The Law of Torts § 190 (2000). However, the Court is compelled to agree with Defendant that the economic loss doctrine bars recovery in negligence in this case. The economic loss doctrine in Nevada generally provides "that unless there is personal injury or property damage, a plaintiff may not recover in negligence for economic losses." Terracon Consultants W., Inc. v. Mandalay Resport Grp., 206 P.3d 81, 87 (Nev. 2009). This broad statement is enough to prevent the negligence claims in the present case, unless some exception applies, because Plaintiffs allege only economic losses, not personal injury or property damage.
The Nevada Supreme Court does recognize some exceptions, such as for negligent misrepresentation claims. See id. at 88. The Court will therefore treat the present claim not as a simple negligence claim, but as a negligent misrepresentation claim. The Nevada Supreme Court has barred negligent misrepresentation claims under the economic loss doctrine "in the context of commercial construction design professionals, [because] contract law is better suited for resolving such claims." Halcrow, Inc. v. Eighth Judicial Dist. Court, 302 P.3d 1148, 1153 (Nev. 2013) (internal quotation marks omitted). In other words, the Court reiterated the aspect of the doctrine that prevents a plaintiff from blurring the line between contract and tort by complaining that a defendant fully performed a contract but "negligently performed" it in some way by failing to live up to the plaintiff's desired standards that were not incorporated into the contract itself, even if the defendant made some representation within the scope of the contract that he did not live up to but which was not integrated into the terms of the contract. If a plaintiff desires a particular standard of performance, he must put those terms into the contract. Once a contract exists, the terms of the contract control the parties' duties to one another thereunder. The general duty of care to act as a reasonable and prudent person under the same or similar circumstances that is owed by all persons to all other persons under the doctrine of negligence is not applicable to a specific contractual relationship. Here, however, there is no "highly interconnected network of contracts delineat[ing] each party's risks and liabilities in case of negligence, which in turn 'exert significant financial pressures to avoid such negligence.'" Id. (quoting Terracon Consultants W., Inc., 206 P.3d at 88). The Court indicated that the economic loss doctrine should not bar claims for negligent misrepresentation in cases like the present one:
Plaintiffs may if they wish amend to better plead a negligent misrepresentation claim.
Liability is proper in cases where there is significant risk that "the law would not exert significant financial pressures to avoid such negligence." These types of cases encompass economic losses sustained, for example, as a result of defamation, intentionally caused harm, negligent misstatements about financial matters, and loss of consortium.Id. (quoting Terracon Consultants W., Inc., 206 P.3d at 88) (citation omitted; emphasis added). The claim that Zappos negligently misstated the safety of Plaintiff's financial information is therefore not barred by the economic loss doctrine.
4. Unjust Enrichment
In Nevada, the elements of an unjust enrichment claim or "quasi contract" are: (1) a benefit conferred on the defendant by the plaintiff; (2) appreciation of the benefit by the defendant; and (3) acceptance and retention of the benefit by the defendant (4) in circumstances where it would be inequitable to retain the benefit without payment. See Leasepartners Corp., Inc. v. Robert L. Brooks Trust, 942 P.2d 182, 187 (Nev. 1997) (quoting Unionamerica v. McDonald, 626 P.2d 1272, 1273 (Nev. 1981) (quoting Dass v. Epplen, 424 P.2d 779, 780 (Colo. 1967))). An indirect benefit will support an unjust enrichment claim. Topaz Mut. Co., Inc. v. Marsh, 839 P.2d 606, 613 (Nev. 1992) (recognizing an actionable unjust enrichment claim where there was an indirect benefit conferred upon the defendant). Unjust enrichment is an equitable substitute for a contract, and an action for unjust enrichment therefore cannot lie where there is an express written agreement governing the relationship at issue. Lipshie v. Tracy Inv. Co., 566 P.2d 819, 824 (Nev. 1977).
Here, Plaintiffs do not allege having bestowed any gratuitous benefit upon Defendant, and the Court will therefore dismiss the unjust enrichment claims. The claim known as "unjust enrichment" in most states—but which is more accurately called "restitution" in California—means more than that the defendant has profited unscrupulously while the plaintiff has been harmed. The claim only lies against a defendant who has willingly received the plaintiff's labor or goods without giving anything of equal value in return under circumstances where it would be inequitable not to require payment or "restitution" therefor. An unjust enrichment claim requires that the plaintiff has in some way conferred a benefit onto the defendant. See Restatement (First) of Restitution § 1 cmt. b (1937) ("A person confers a benefit upon another if he gives to the other possession of or some other interest in money, land, chattels, or choses in action, performs services beneficial to or at the request of the other, satisfies a debt or a duty of the other, or in any way adds to the other's security or advantage."). Plaintiffs do not allege such facts here. Although Plaintiffs allege having bestowed the benefit of their purchase of goods, it appears undisputed that Defendant provided Plaintiffs a benefit in return (providing the goods) such that there is no unrecompensed benefit conferred. Plaintiffs allege having bestowed no benefit upon Defendant outside of the contracts they formed to purchase goods, which contracts are not at issue.
5. Declaratory Relief
The Court dismisses this claim, as it is on its face duplicative of the causes of action elsewhere directly asserted. (See CACAC ¶ 167 ("[Plaintiffs] seek a declaratory judgment that Zappos violated FCRA and/or the statutes and/or common law of the various states set forth above.")).
6. Statutory Claims
a. Alabama Statutes
CACAC Plaintiffs bring claims under "AL Code § 8-19-1, et seq." Section 8-19-1 of the Alabama Code is simply the title of the Alabama "Deceptive Trade Practices Act." See Ala. Code § 8-19-1. CACAC Plaintiffs must make a more definite statement as to violations of this statute. Normally, the Court would give leave to amend. However, as Defendants note, private class actions are not permitted for violations of this statute. See id. § 8-19-10(f).
b. California Statutes
As noted, supra, CACAC Plaintiffs have no standing to assert violations of the California statutes, as no California resident is properly joined in the CACAC. ACC Plaintiffs have brought claims under several California statutes.
i. California Business and Professional Code Section 17200 et seq.
Under this "Unfair Competition" statute, "unfair competition shall mean and include any unlawful, unfair or fraudulent business act or practice and unfair, deceptive, untrue or misleading advertising and any act prohibited by Chapter 1 (commencing with Section 17500) of Part 3 of Division 7 of the Business and Professions Code." Cal. Bus. & Prof. Code § 17200. Section 17500 prohibits false and misleading statements in a way similar to the common law misrepresentation torts. See id. § 17500. Plaintiffs have sufficiently alleged a violation of this statute.
ii. California Business and Professional Code Section 17500 et seq.
Although this claim under the "Misleading Advertising" statute may be duplicative of the claim under the Unfair Competition statute, which incorporates the Misleading Advertising statute, the Court will not dismiss it, as it is sufficiently pled. Issues of puffery, reasonableness of reliance, causation, etc. are for the fact-finder. The Court will not permit duplicative damages at trial for the same harm, of course.
iii. California Civil Code Section 1798.80 et seq.
Section 1798.80 is a definitional statute with no substantive standards. Section 1798.82 provides a civil action for violations of the substantive standards of the data breach reporting requirements thereunder. See Cal. Civ. Code § 1798.82. Plaintiffs allege that Zappos failed to notify customers of the breach who had cancelled their accounts and opted not to receive future emails. The Court will not dismiss this claim.
c. Florida Statutes
CACAC Plaintiffs bring a claim under "FLA. STAT. § 501.201, et seq." Section 501.201 of the Florida Statutes is simply the title of the "Florida Deceptive and Unfair Trade Practices Act." See Fla. Stat. § 501.201. CACAC Plaintiffs must make a more definite statement as to violations of this statute. The Court dismisses this claim, with leave to amend.
d. Massachusetts Statutes
ACC Plaintiffs bring a claim under Section 2 of Chapter 93A of the Massachusetts General Laws et seq. Section 2 prohibits "[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce . . . ." Mass. Gen. Laws ch. 93A, § 2(a). Section 9 provides for a civil remedy by "any person" injured by a violation of the statute. See id. § 9(1). However, as Defendant notes, Massachusetts has a separate chapter governing security breaches such as alleged in the present case, see Mass. Gen. Laws ch. 93H, and section 6 of that chapter permits only the Massachusetts Attorney General to bring a civil action for such violations, pursuant to section 4 of chapter 93A, see id. § 6. The Court therefore dismisses this claim, without leave to amend.
e. Nevada Statutes
Both CACAC and ACC Plaintiffs bring claims under the Nevada Deceptive Trade Practices Act. See Nevada Revised Statutes § 598.0903 et seq. Sections 598.0915 through 598.0925 list various kinds of deceptive trade practices cognizable under the statute. Neither group of Plaintiffs identifies which kinds of violations are alleged. The Court dismisses these claims, with leave to amend.
f. New York Statutes
ACC Plaintiffs bring a claim under the New York Deceptive Trade Practices Act. See N.Y. Gen. Bus. Law § 349. Section 349 prohibits "[d]eceptive acts or practices in the conduct of any business, trade or commerce or in the furnishing of any service in this state . . . .," see id. § 349(a), and provides for a civil action "any person who has been injured by reason of any violation of this section . . . .," see id. § 349(h). The Court will not dismiss this claim.
g. Texas Statutes
CACAC Plaintiffs bring claims for violations of two Texas statutes. Under the sixth cause of action, they allege violations of "TEX. BUS. & COM. CODE § 17.41, et seq.," and under the tenth cause of action, they allege violations of "TEX. BUS & COM. CODE § 17.50(a)(3)."
i. Section 17.41 et seq.
Section 17.41 of the Texas Business and Commercial Code is simply the title of the Texas "Deceptive Trade Practices-Consumer Protection Act." See Tex. Bus. & Com. Code § 17.41. CACAC. CACAC Plaintiffs must make a more definite statement as to violations of this statute. The Court dismisses these claims. The Court will not give leave to amend, because any such amended claims would be duplicative with the claims under section 17.50 that are separately pled under the tenth cause of action, infra.
Under the tenth cause of action, the CACAC Plaintiffs allege that by failing to safeguard, protect, and encrypt the Texas Plaintiff's and Texas sub-class members' data and failing to timely notify them of the data breach, Defendant violated section 17.50(a)(3), which provides for economic and emotional damages for "any unconscionable action or course of action." Plaintiffs have sufficiently alleged false, misleading, or deceptive practices via the statements on Zappos's website that Plaintiffs' personal data was secure. The Court will not dismiss this claim.
h. Virginia Statutes
ACC Plaintiffs bring claims under the Virginia Consumer Protection Act. See Va. Code § 59.1-196 et seq. That section of the Virginia Code simply provides the title for the act. ACC Plaintiffs must make a more definite statement as to violations of this statute. The Court dismisses this claim, with leave to amend.
i. Washington Statutes
ACC Plaintiffs bring claims under Washington Statutes sections 19.255.020 et seq. and 19.86 et seq.
i. Washington Statutes Section 19.255.020 et seq.
Section 19.225.010 provides for civil liability for failure to notify customers of data security breaches. Plaintiffs have sufficiently alleged a violation of this statute.
ii. Washington Statutes Section 19.86 et seq.
The relevant sections are 19.86.010 through 19.86.920. Section 19.86.020 prohibits "[u]nfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce," and section 19.86.090 provides for a civil right of action. See Wash Stat. §§ 19.86.020, 19.86.090. The Court will not dismiss this claim.
CONCLUSION
IT IS HEREBY ORDERED that the Motion to Dismiss (ECF No. 62) is GRANTED IN PART and DENIED IN PART, as delineated herein.
IT IS FURTHER ORDERED that the Motions for Leave (ECF Nos. 80, 87, 97, 99) are GRANTED.
IT IS SO ORDERED.
___________
ROBERT C. JONES
United States District Judge