Opinion
Case No. 5:14-cv-05531-EJD
01-20-2017
MARK FOSTER, et al., individually and on behalf of all others similarly situated, Plaintiffs, v. ESSEX PROPERTY, INC., Defendant.
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS
Re: Dkt. No. 28
Plaintiffs Mark and Akiko Foster ("Plaintiffs") bring this putative class action against Defendant Essex Property Trust, Inc. ("Essex") asserting various state law claims arising out of a data breach. Federal jurisdiction arises pursuant to 28 U.S.C. § 1332(d). Presently before the court is Essex's Motion to Dismiss Plaintiffs' First Amended Complaint ("FAC"). Dkt. No. 28. Having carefully considered the parties' briefing, the Motion to Dismiss will be granted for the reasons explained below.
I. FACTUAL AND PROCEDURAL BACKGROUND
Essex is a real estate trust that develops, redevelops, and manages multifamily communities in Northern California, Southern California, and the Seattle Metro areas. FAC, Dkt. No. 27, at ¶ 16. Plaintiffs are a married couple that previously leased an apartment from Defendant. Id. at ¶ 8. Plaintiffs allege that during the application process "required by Essex prior to leasing a property from it," they provided Essex with "sensitive personal and financial information," or "PII," which category of information includes "customer names, mailing addresses, email addresses, and birth dates, as well as credit and debit card numbers, employment information, including salaries, social security numbers and other personal information." Id. at ¶¶ 1, 3, 9. Plaintiffs also provided Essex with authorization to perform a credit check on each of their credit histories. Id. at ¶ 9. They allege that Essex then kept their PII on its computer systems, servers and databases "in perpetuity, regardless of whether a consumer terminated his or her relationship with Essex." Id. at ¶ 4.
Although the dates are not revealed, the FAC suggests that Essex sustained one or more security breaches to its computer network after it received Plaintiffs' PII. Id. at ¶ 2. Plaintiffs contend that as a result of the breach, their PII was revealed to "cyber criminals." Id. at ¶¶ 2, 5. They believe these individuals then "made unauthorized charges on their credit cards and exposed them to a greater risk of identity theft and fraud." Id. at ¶ 10. The FAC contains an itemized list of the unauthorized charges made to Mark Foster's credit card, which Plaintiffs allege were the result of Essex's failure to employ "reasonable, industry-standard, or appropriate security measures" to protect sensitive information. Id. at ¶¶ 10, 19.
Essex moved to dismiss Plaintiffs' original complaint, which motion the court granted for failure to prove standing. Plaintiffs then filed the FAC and assert the following claims: (1) violation of the Unfair Competition Law, California Business and Professions Code § 17200 et seq.; (2) violation of the Consumer Legal Remedies Act, California Civil Code § 1750 et seq.; (3) violation of California Civil Code § 1798.80 et seq; and (4) negligence.
II. LEGAL STANDARD
Although Essex brings this motion under two sections of Federal Rule of Civil Procedure 12, only one requires discussion.
A motion brought under Rule 12(b)(1) challenges subject matter jurisdiction, and may be either facial or factual. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). A "factual" attack, like the one presented here, "contests the truth of the plaintiff's factual allegations, usually by introducing evidence outside the pleadings." Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). "If the moving party converts 'the motion to dismiss into a factual motion by presenting affidavits or other evidence properly brought before the court, the party opposing the motion must furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.'" Wolfe, 392 F.3d at 362. The court may review this evidence without converting the motion into a motion for summary judgment." Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Because it is presumed "that federal courts lack jurisdiction unless the contrary appears affirmatively from the record, the party asserting federal jurisdiction when it is challenged has the burden of establishing it." DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 342 n.3 (2006) (quoting Renne v. Geary, 501 U.S. 312, 316 (1991) (internal quotation marks and citation omitted)).
Standing can be properly challenged through a Rule 12(b)(1) motion. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). Since standing is "an indispensable part of the plaintiff's case, each element must be supported in the same way as any other matter on which the plaintiff bears the burden of proof." Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992).
III. DISCUSSION
Essex again argues that Plaintiffs failed to establish standing to assert their claims. The court agrees.
A. General Principles of Standing
The constitutional standing doctrine "functions to ensure, among other things, that the scarce resources of the federal courts are devoted to those disputes in which the parties have a concrete stake." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs., Inc., 528 U.S. 167, 191 (2000). It "is a doctrine rooted in the traditional understanding of a case or controversy" and "limits the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong." Spokeo v. Robins, 136 S. Ct. 1540, 1547 (2016). Standing to sue is also a jurisdictional requirement that cannot be waived. City of Los Angeles v. Cty. of Kern, 581 F.3d 841, 845 (9th Cir. 2009).
Generally, the inquiry critical to determining the existence of standing under Article III of the Constitution is "'whether the litigant is entitled to have the court decide the merits of the dispute or of particular issues.'" Allen v. Wright, 468 U.S. 737, 750-51 (1984) (quoting Warth v. Seldin, 422 U.S. 490, 498 (1975)). Three basic elements must be satisfied: (1) an "injury in fact," which is neither conjectural or hypothetical, (2) causation, such that a causal connection between the alleged injury and offensive conduct is established, and (3) redressability, or a likelihood that the injury will be redressed by a favorable decision. Lujan, 504 U.S. at 560-61. If the plaintiff fails to establish these elements, "an Article III federal court therefore lacks subject matter jurisdiction over the suit [and i]n that event, the suit should be dismissed under Rule 12(b)(1)." Cetacean Cmty. v. Bush, 386 F.3d 1169, 1174 (9th Cir. 2004).
"In a class action, standing is satisfied if at least one named plaintiff meets the requirements." Bates v. United Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). "The plaintiff class bears the burden of showing that the Article III standing requirements are met." Id.
B. Application to the FAC
The court now examines the FAC and the parties' arguments with the above authority in mind.
Through a factual challenge to standing, Essex first argues that Plaintiffs were not injured as a result of the security breaches to Essex's computer network because their credit card and other personal information was not stored on the system. Essex submitted two declarations in support of that argument. In the first, the former Senior Manager of IT for Essex, Kevin Moller, states that Essex's internal computer system was the only one subject to the security breach announced in September, 2014. Decl. of Kevin Moller, Dkt. No. 28, at ¶ 3. He also states that "[n]o credit card information for any residents at Essex properties was stored on Essex's internally-hosted system in the regular course of business," and that Plaintiffs' resident information was never transferred to or stored on Essex's internally-hosted system. Id. at ¶ 5. Based on these two facts, Moller concludes that "it is not possible that the cyber-attack on the Essex internal network led to or facilitated any alleged unauthorized charges on [Plaintiffs'] credit cards." Id. at ¶ 7. In addition, Moller concludes that the security breach of Essex's internal system "could not have resulted in the disclosure of personal information about [Plaintiffs] because there is no personal information about [Plaintiffs] that is or was stored on the system that was the subject" of the breach. Id. at ¶ 11.
In the second declaration, Essex's Customer Care and Collections Manager, Lisa Demeter, reviewed Plaintiffs' rental file and determined that Plaintiffs did not provide their credit or debit card information with their rental applications, and that Plaintiffs paid the application fee and holding deposit with a check. Decl. of Lisa Demeter, Dkt. No. 29, at ¶ 4. Demeter also determined that Plaintiffs never paid rent using a credit and debit card, and any information obtained from a credit check or suitability screening of Plaintiffs was printed out and placed in a paper file and "never stored or retained on Essex's computer system." Id. at ¶¶ 10, 14.
These declarations undermine the allegations critical to Plaintiffs' Article III standing. Specifically, the descriptions of what information was collected from Plaintiffs, and what does and does not exist on Essex's internal computer system, contradict the factual claims that Essex induced Plaintiffs to provide it with credit card information and kept Plaintiffs' PII on the network that was ultimately breached. Since Moller and Demeter state that Plaintiffs' credit card information was never collected and that their PII was never stored on the internal computer system in any event, the allegation that cyber criminals obtained Plaintiff's PII through a breach of Essex's internal system is factually impossible. Essex, therefore, has presented enough evidence to contest the truth of the FAC's standing allegations. See Safe Air for Everyone, 373 F.3d at 1039 ("The court need not presume the truthfulness of the plaintiff's allegations.")
In the face of Essex's showing, Plaintiffs must now "present affidavits or any other evidence necessary to satisfy [their] burden of establishing" standing. St. Clair v. City of Chico, 880 F.2d 199, 201 (9th Cir. 1989). And under these particular procedural circumstances, they must make a prima facie showing to confirm this court's subject matter jurisdiction. See Societe de Conditionnement en Aluminum v. Hunter Eng'g Co., 655 F.2d 938, 942 (9th Cir. 1985).
Plaintiffs have not done so. Notably, no such evidence accompanies their opposition, and Plaintiffs did not request leave to conduct discovery to counter the declarations submitted by Essex. Instead, Plaintiffs rely on material added to the FAC, including more detailed allegations concerning the unauthorized charges applied to Mark Foster's credit card and his declaration supporting those allegations. According to Mark Foster, Plaintiffs provided their PII to Essex during the lease application process and authorized Essex to perform a credit check on each of their credit histories.
But though this evidence better describes the particular injury at issue, it fails to establish the second element of Article III standing: that there exists a causal connection between the unauthorized charges on Mark Foster's credit card and the security breach of Essex's internal computer system. See Lujan, 504 U.S. at 560 (holding that "the injury has to be 'fairly . . . trace[able] to the challenged action of the defendant, and not . . . the result [of] the independent action of some third party not before the court.'"). Mark Foster's declaration neither explains how Plaintiffs' PII - and in particular their credit card information - ended up stored on Essex's internal computer system, nor explains how the breach of Essex's system led to the unauthorized charges on Mark Foster's Chase United Mileage Plus credit card. Again, Essex has produced evidence showing that no connection between the breach and the charges can be made as a matter of fact. Since Plaintiffs did not respond with evidence showing otherwise, they have not satisfied their burden to make a prima facie showing of standing. This is fatal to all of their causes of action, even those brought under California statutes, because statutory standing only satisfies Article III's injury-in-fact element, not its causation element. See Cantrell v. City of Long Beach, 241 F.3d 674, 684 (9th Cir. 2001).
Plaintiffs' argument to the contrary is unpersuasive. They contend the FAC's allegations are sufficient to establish standing "because this is the motion to dismiss phase and there has been no discovery in this proceeding." In doing so, however, they misapprehend both this motion and their corresponding burden in response to it. As already indicated, the court is "not restricted to the face of the pleadings" when deciding a Rule 12(b)(1) factual challenge, "but may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction." McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988). Nor must the court accept Plaintiffs' allegations as true, as it would for motions under Rule 12(b)(6). Americopters, LLC v. FAA, 441 F.3d 726, 732 n.4 (9th Cir. 2006) ("[U]nlike a Rule 12(b)(6) motion, in a Rule 12(b)(1) motion, the district court is not confined by the facts contained in the four corners of the complaint - it may consider facts and need not assume the truthfulness of the complaint."). Instead, Plaintiffs were required to affirmatively produce counter-affidavits or other evidence controverting Essex's declarations disputing their standing allegations. St. Clair, 880 F.2d at 201. If Plaintiffs needed to conduct discovery to accomplish this task, they certainly could have sought permission to do so. They did not, and the evidence they have produced is unresponsive to Essex's challenge.
Plaintiffs' legal citations are of no assistance to their position. The district court's decision in In re Sony Gaming Networks And Customer Data Security Breach Litigation, 903 F. Supp. 2d 942 (S.D. Cal. 2012), does not stand for the proposition that mere allegations are sufficient to overcome a factual attack under Rule 12(b)(1) since it appears that, in contrast to Essex, the defendant in Sony did not produce evidence negating the causal connection between the data breach and the plaintiffs' alleged injuries. Similarly, the defendant in Corona v. Sony Pictures Entertainment, Inc., 14-CV-09600 RGK (Ex), 2015 U.S. Dist. LEXIS 85865, 2015 WL 3916744 (C.D. Cal. June 15, 2015), did not make a factual attack on the plaintiffs' standing allegations. These distinctions between those cases and this one make a difference because without evidence outside the complaint, a district court is properly limited to the plaintiff's standing allegations when considering a 12(b)(1) motion. See Safe Air for Everyone, 373 F.3d at 1039 ("In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction.").
Similarly, the oft-cited case of Krottner v. Starbucks, 628 F.3d 1139 (9th Cir. 2010), does not apply to the issue addressed here. While that case is helpful in framing whether a plaintiff has experienced an injury-in-fact, it does not discuss Article III's causation requirement. As the opinion clarifies, that element was undisputed before the district court. Krottner, 628 F.3d at 1141.
Furthermore, the court has considered whether the standing "issue and substantive issues are so intertwined that the question of jurisdiction is dependent on the resolution of factual issues going to the merits," such that the jurisdictional determination should await a determination of the relevant facts on either a motion going to the merits or at trial." Augustine v. United States, 704 F.2d 1074, 1077 (9th Cir. 1983). The court observes, however, that the material facts concerning Article III's causation element are undisputed since Plaintiffs did not produce evidence to support that issue. Consequently, any factual overlap between Plaintiffs' standing and the merits is not an impediment to granting Essex's Rule 12(b)(1) motion. Id. (holding that on a Rule 12(b)(1) motion, "the moving party should prevail only if the material jurisdictional facts are not in dispute and the moving party is entitled to prevail as a matter of law).
In sum, the court concludes that Plaintiffs have not established "the requisite of a case or controversy with the defendant[]," and as such may not seek relief on behalf of themselves or any other member of the class. O'Shea v. Littleton, 414 U.S. 488, 494 (1974); accord Lierboe v. State Farm Mut. Auto. Ins. Co., 350 F.3d 1018, 1022 (9th Cir.2003). Their causes of action against Essex must therefore be dismissed.
C. Leave to Amend
The court must now determine whether Plaintiffs should again be granted leave to amend. "Dismissal without leave to amend is improper unless it is clear, upon de novo review, that the complaint could not be saved by any amendment." Krainski v. Nevada ex rel. Bd. of Regents of Nevada Sys. of Higher Educ., 616 F.3d 963, 972 (9th Cir. 2010) (internal citation and quotation marks omitted). However, "[a] district court may deny leave to amend when amendment would be futile" (Hartmann v. Cal. Dep't of Corr. & Rehab., 707 F.3d 1114, 1129-30 (9th Cir. 2013)), or for "failure to cure deficiencies by amendments previously allowed." Leadsinger, Inc. v. BMG Music Publ'g, 512 F.3d 522, 532 (9th Cir. 2008).
Here, the court previously dismissed the causes of action against Essex for lack of standing after Plaintiffs failed to refute the same evidence resubmitted with this motion. There is nothing in Plaintiffs' papers which suggests that permitting yet another amended complaint will cure the factual defect in their standing to bring this action. Accordingly, the court finds that leave to amend would futile and will deny such relief on that basis.
IV. ORDER
Based on the foregoing, Essex's Motion to Dismiss under Rule 12(b)(1) (Dkt. No. 28) is GRANTED for lack of standing. All causes of action are DISMISSED WITHOUT LEAVE TO AMEND in this action, but WITHOUT PREJUDICE. See Fleck & Assocs. v. City of Phoenix, 471 F.3d 1100, 1106 (9th Cir. 2006).
The Clerk shall close this file.
IT IS SO ORDERED. Dated: January 20, 2017
/s/_________
EDWARD J. DAVILA
United States District Judge