Opinion
No. C 18-05982 WHA C/w:No. C 19-00117 WHA
08-09-2019
STEPHEN ADKINS, an individual and Michigan resident, on behalf of himself and all others similarly situated, Plaintiff, v. FACEBOOK, INC., Defendant.
ORDER ON MOTION FOR LEAVE TO FILE AN AMENDED CONSOLIDATED COMPLAINT AND VACATING HEARING
INTRODUCTION
In this data-breach putative class action, plaintiff Stephen Adkins moves for leave to amend the consolidated complaint. The motion for leave to amend is GRANTED IN PART AND DENIED IN PART.
STATEMENT
A prior order dated June 21 detailed the background to this action (Dkt. No. 153). In brief, in September 2018, Facebook discovered it had been hacked. According to Facebook, the hackers stole information from approximately 29 million Facebook users worldwide, including 3.9 million users in the United States (Dkt. No. 153 at 6). Eleven putative class action lawsuits followed. In January 2019, an order consolidated the eleven lawsuits (Dkt. No. 67). In February 2019, five named plaintiffs filed a consolidated complaint (Dkt. No. 76). Subsequently, all but one of the remaining named plaintiffs from the eleven putative class actions voluntarily withdrew without prejudice (Dkt. Nos. 87-94).
In March 2019, Facebook moved to dismiss the consolidated complaint, attacking plaintiffs' Article III standing as well as the sufficiency of plaintiffs' claims (Dkt. No. 96). A hearing on the motion to dismiss was held in May 2019. At the hearing, depositions of the named plaintiffs were ordered. Supplemental briefing on the depositions followed (Dkt. Nos. 122, 135). Abruptly, three of the five named plaintiffs voluntarily withdrew without prejudice (Dkt. Nos. 140-142).
In June 2019, an order granted Facebook's motion in part, dismissing one plaintiff entirely for lack of standing and dismissing seven of ten alleged claims (Dkt. No. 153). The order further consolidated two of the three surviving claims (negligence and negligence per se) into two separate theories of a single claim. The dismissed plaintiff, William Bass, did not seek leave to amend his claims.
Now, the sole remaining named plaintiff, Stephen Adkins, seeks to amend six of the seven dismissed claims as well as one of his surviving claims (Dkt. No. 160). Facebook opposes. The primary issues remain twofold. First, whether or not the limitation-of-liability clause in Facebook's terms of service should be enforced. Second, whether or not an economic injury sufficient to bring a claim under Section 17200 exists. In addition, plaintiff Adkins requests leave to amend his surviving claim of negligence to add newly alleged facts, a new theory of harm, and punitive damages. Facebook also opposes this amendment. This order follows full briefing (Dkt. Nos. 173, 180). Pursuant to Civil Local Rule 7-1(b), this order finds plaintiff's motion for leave to file an amended complaint suitable for submission without oral argument and hereby VACATES the hearing scheduled for August 22.
ANALYSIS
Rule 15(a)(2) permits a party to amend its pleadings with leave of court, advising that "[t]he court should freely give leave when justice so requires." Futility alone can justify denying leave to amend. Nunes v. Ashcroft, 375 F.3d 805, 808 (9th Cir. 2004). For purposes of assessing futility on this motion, the legal standard is the same as it would be on a motion to dismiss under Rule 12(b)(6). Miller v. Rykoff-Sexton, Inc., 845 F.2d 209, 214 (9th Cir. 1988), overruled on other grounds by Ashcroft v. Iqbal, 556 U.S. 662 (2009).
This order denies leave to amend in part and grants leave to amend in part. First, this order again refuses to invalidate the limitation-of-liability clause agreed to by the parties. There was no procedural unconscionability. Accordingly, leave to amend the four claims for breach of contract (claims 1-4) and the claim for breach of confidence (claim 7) will be denied. Second, plaintiff still has not alleged standing under Section 17200. The value of plaintiff's personal information has not diminished to plaintiff since the data breach. Leave to amend the claim under Section 17200 (Claim 6) will also be denied. Third, because the negligence claim has already been deemed plausible, the amendments to the negligence claim, including the newly alleged theory of credit-monitoring harm and newly sought remedy of punitive damages, will be permitted. These points are now developed in detail.
1. LIMITATION-OF-LIABILITY (CLAIMS 1-4, 7).
In using the Facebook social media service, Facebook users agree that Facebook's "liability shall be limited to the fullest extent permitted by applicable law." In turn, under California law, "[w]ith respect to claims for breach of contract, limitation of liability clauses are enforceable unless they are unconscionable, that is, the improper result of unequal bargaining power or contrary to public policy." Food Safety Net Servs. v. Eco Safe Sys. USA, Inc., 209 Cal. App. 4th 1118, 1126 (2012). "Procedural unconscionability requires oppression or surprise." Pinnacle Museum Tower Assn. v. Pinnacle Market Development (US), LLC, 55 Cal. 4th 223, 247 (2012). California Civil Code Section 1668 further invalidates limitations on liability per public policy for three categories of claims: fraud, willful injury, and violations of a statute.
The prior order dated June 21 refused to invalidate the limitation clause. Specifically, the order found that Facebook had imposed the clause through a fair procedure. The clause contained clear enough language and was not buried in the fine print of the terms of service. Moreover, plaintiff could have simply not enrolled in Facebook's social media service. Facebook is not a necessity of life and anyone who does not like the terms of service can go elsewhere. Accordingly, because the clause was not procedurally unconscionable, the limitation-of-liability clause precluded plaintiff's four breach of contract claims and the claim for tortious breach of confidence. The order dismissed those claims.
Plaintiff now returns to argue that the clause was procedurally unfair because both oppression and surprise apply to this liability clause. Neither do. The prior order's conclusion on the liability clause remains.
Plaintiff argues that the clause was oppressive because it is adhesive. "Although adhesion contracts often are procedurally oppressive, this is not always the case. Oppression refers not only to an absence of power to negotiate the terms of a contract, but also to the absence of reasonable market alternatives." Morris v. Redwood Empire Bancorp, 128 Cal. App. 4th 1305, 1320 (2005) (internal citation omitted). To this end, "when the challenged term is in a contract concerning a nonessential recreational activity, the consumer always has the option of simply forgoing the activity." Belton v. Comcast Cable Holdings, LLC, 151 Cal. App. 4th 1224, 1245 (2007). Facebook's social media service, to repeat, is not one of life's necessities. Plaintiff does not even attempt to argue otherwise. This remains fatal to finding oppression here.
As procedural unconscionability can be satisfied by either oppression or unfair surprise, this order now turns to unfair surprise. Plaintiff first argues that there was unfair surprise because "the liability disclaimers directly contradict Facebook's promises" (Dkt. No. 160 at 7). "Unfair surprise results from misleading bargaining conduct or other circumstances indicating that party's consent was not an informed choice." Dotson v. Amgen, Inc., 181 Cal. App. 4th 975, 980 (2010) (citation omitted). Plaintiff provides only one example of a promise the liability clause purportedly contradicts, that is that Facebook declared in its "privacy principles" that "[w]e are accountable." This phrase, however, clearly related to Facebook's internal data practices — not legal liability. Specifically, directly underneath the phrase "[w]e are accountable," in large and clear enough letters, Facebook explained in full: "[i]n addition to comprehensive privacy reviews, we put products through rigorous data security testing. We also meet with regulators, legislators and privacy experts around the world to get input on our data practices and policies." This attempt at security is what "[w]e are accountable" communicated — not that Facebook will always assume full-throated legal liability.
Plaintiff next complains that he never saw the liability clause and so he "was not aware that Facebook could not be held liable for a data breach or similar attack" (Dkt. Nos. 159 ¶ 210; 160 at 7). The short answer is that he should have taken the time to do so and the fault lies with him, not Facebook, for the failure. "[O]ne who assents to a contract is bound by its provisions and cannot complain of unfamiliarity with the language of the instrument." Madden v. Kaiser Found. Hosps., 17 Cal. 3d 699, 710 (1976); see also Circuit City Stores, Inc. v. Ahmed, 283 F.3d 1198, 1200 (2002). As a Facebook user since March 2009, plaintiff had ample opportunity to read the terms of service.
Finally, plaintiff argues that the wording of the liability clause itself provided sufficient ambiguity to unfairly surprise users. More specifically, plaintiff argues that the phrase "applicable law" was not clear in two respects. First, whether "applicable law" meant the law at the time the agreement was consummated or at some later time. Second, that the clause "require[d] the reader to divine that the 'applicable law' means California Code of Civil Procedure § 1668 — and then underst[ood] that that provision allows a company to disclaim" (Dkt. No. 180 at 4). In addition, according to plaintiff, reading Section 1668 into the clause would render "the much more conspicuous warranty disclaimer . . . entirely superfluous because it would be subsumed in this broader, although hidden, disclaimer" (ibid.).
It was clear enough to the reader that limiting liability to "the fullest extent" precluded the broadest possible set of claims. Greater specificity in the language was not required to clearly communicate the breadth of the waiver. The clause was not buried in the fine print. The paragraph began by noting this broad limitation-of-liability and the reason why it remained in place. In addition, emphasizing some words did not nullify the words that followed. Facebook's 'belt and suspenders' approach to limiting warranty liability was not unfairness. The motion for leave to amend the four breach of contract claims and the claim for breach of confidence is DENIED.
2. SECTION 17200 (CLAIM 6).
In order to establish standing for Section 17200, plaintiff must show that he personally lost money or property "as a result of the unfair competition." Cal. Bus. & Prof. Code § 17204; Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322 (2011). Plaintiff had previously argued that his economic injury stemmed from the lost value of his personal information. No binding decision exists which addresses whether this suffices to establish standing under Section 17200. In an unpublished decision, however, our court of appeals summarily rejected this theory holding that plaintiffs had "failed to allege that they lost money or property as a result of the unfair competition." In re Facebook Privacy Litigation, 572 F. App'x 494, 494 (9th Cir. 2014) (citations and quotations omitted).
The June 21 order also found plaintiff's argument lacking. In brief, it noted it was "not enough to merely say the information was taken and therefore it ha[d] lost value" (Dkt. No. 153 at 18). For example, plaintiff Adkins never isolated any impairment of the ability to participate in any market due to the data breach. This deficiency remains.
Plaintiff notes that other platforms rely on personal information to generate advertising revenue. At best, however, the data breach thereby rendered the information less valuable to those sites. Plaintiff today remains no more inhibited than before the data breach to use any of these data-preying platforms. As such, this cannot give plaintiff standing under Section 17200. His personal information has maintained the same value to him. Accordingly, the motion for leave to amend the claim for violating Section 17200 is DENIED.
3. CREDIT MONITORING AND PUNITIVE DAMAGES TO NEGLIGENCE CLAIM (CLAIM 5).
The proposed amended complaint adds new alleged facts to bolster its claim for negligence. It adds a new theory of harm in the cost of credit monitoring. It also adds punitive damages. Because the claim for negligence has already been found to be plausibly alleged, these newly alleged facts, theories, and subsequent remedies will be permitted. Rule 56 will tease out whether they are unfounded. Accordingly, plaintiff's motion for leave to amend the negligence claim is GRANTED.
Facebook requests judicial notice of five exhibits (Dkt. No. 175). In light of the above analysis, Facebook's request for judicial notice is DENIED AS MOOT. --------
CONCLUSION
For the foregoing reasons, plaintiff's motion for leave to file an amended complaint is GRANTED IN PART AND DENIED IN PART. All unopposed amendments and all amendments related to the negligence claim (claim 5) are permitted to proceed. All amendments related to the claims for breach of contract (claims 1-4), violation of Section 17200 (claim 6), and the claim for breach of confidence (claim 7) are not permitted. Those claims are DISMISSED without leave to amend.
Plaintiff must file an amended consolidated complaint consistent with this order within SEVEN CALENDAR DAYS. The answer is due within FOURTEEN CALENDAR DAYS thereafter. Rule 12 practice will now cease and yield to discovery. The deadline to move for class certification remains AUGUST 29 AT NOON. The hearing scheduled for August 22 is VACATED.
IT IS SO ORDERED. Dated: August 9, 2019.
/s/_________
WILMAM ALSUP
UNITED STATES DISTRICT JUDGE