Opinion
Case No. 15-cv-03590-EMC
12-21-2015
SUSAN HARVEY, Plaintiff, v. GOOGLE INC., Defendant.
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS
Docket No. 30
I. INTRODUCTION
Plaintiff Susan Harvey filed this lawsuit against Defendant Google, Inc., asserting that Google violated the Electronic Funds Transfer Act, 15 U.S.C. § 1693 et seq. ("EFTA") and California state laws by failing to protect her financial information from unknown third parties who used her Bank of America account for unauthorized purchases. First Amended Complaint ¶¶ 16-20, Docket No. 27 ("FAC"). Google moved to dismiss Plaintiff's First Amended Complaint on the grounds that 1) Plaintiff's EFTA claim is time-barred and that 2) the Court lacks supplemental jurisdiction over Plaintiff's state claims. Docket No. 30 at 1 ("MTD").
II. FACTUAL & PROCEDURAL BACKGROUND
Susan Harvey brings this action against Google, a Delaware corporation with its principal place of business in Mountain View. FAC ¶ 5. Google operates Google Play, a virtual marketplace where Android users can download and purchase games, applications, and other content. See FAC ¶ 8-9, MTD at 2. Plaintiff alleges that on March 20, 2013 she activated her Android Smartphone, signed in using a Google email address, and provided "debit/banking information for her EDD account with Bank of America" to the "Android operating system" in order to receive updates for her phone. FAC. ¶ 7. Plaintiff alleges that she "pressed the appropriate button" to purchase the game on her smartphone. FAC ¶ 8. Plaintiff denies that she provided her "debit/banking" information to Google Playstore. FAC ¶ 8; MTD at 2.
In August 2014, Plaintiff logged into her Google account and discovered numerous transactions on her bank account that did not belong to Plaintiff. Compl. ¶ 9. Plaintiff alleges that "transactions had been posted to her account from . . . April 15, 2013 through May of 2014." FAC ¶ 10. She alleges that upon clicking the appropriate tab on the Google website, she found approximately 1000 transactions, 650 of which were cleared. FAC ¶ 9. Her bank records showed the transactions were posted to her account between April 15, 2013 to May, 2014, with "thousands of dollars of her money being debited." FAC ¶ 10. Plaintiff contacted vendors listed on the transactions who informed her that the transactions are "Google transactions under which Google is receiving monies." FAC ¶ 12. After Plaintiff complained to Google, Google "contacted Plaintiff and advised her that all transactions would be reimbursed." FAC ¶ 14. Plaintiff alleges that unauthorized transactions were conducted through Google Playstore and "resulted in thousands of dollars being taken from her bank account." FAC ¶ 15. Plaintiff alleges that because "Google failed to implement and maintain reasonable security procedures and practices," hackers "obtain[ed] her Information and . . . post[ed] fraudulent transactions on Plaintiff's account." FAC ¶ 16. Based on these events, Harvey asserts the following causes of action: (1) violations of the Electronic Funds Transfer Act ("EFTA"), 15 U.S.C. § 1693 et seq.; (2) violation of UCL section 17200 et seq.; (3) negligence; (4) negligence per se; (5) invasion of privacy; and (6) violation of the California Data Breach Act, Cal. Civ. Code § 1798.80 et seq. Plaintiff filed her Complaint on April 15, 2015.
III. DISCUSSION
A. Legal Standard
Under Federal Rule of Civil Procedure 12(b)(6), a party may move to dismiss based on the failure to state a claim upon which relief may be granted. See Fed. R. Civ. P. 12(b)(6). A motion to dismiss based on Rule 12(b)(6) challenges the legal sufficiency of the claims alleged. See Parks Sch. of Bus. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). In considering such a motion, a court must take all allegations of material fact as true and construe them in the light most favorable to the nonmoving party, although "conclusory allegations of law and unwarranted inferences are insufficient to avoid a Rule 12(b)(6) dismissal." Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). While "a complaint need not contain detailed factual allegations . . . it must plead "enough facts to state a claim to relief that is plausible on its face." Id. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662 (2009); see also Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007). "The plausibility standard is not akin to a 'probability requirement' but it asks for more than sheer possibility that a defendant acted unlawfully." Iqbal, 556 U.S. at 678. B. Plaintiff's Claim under the EFTA is Time-Barred
EFTA, Section 1693(e) of the United States Code, provides:
(a) A preauthorized electronic fund transfer from a consumer's account may be authorized by the consumer only in writing, and a copy of such authorization shall be provided to the consumer when made. A consumer may stop payment of a preauthorized electronic fund transfer by notifying the financial institution orally or in writing at any time up to three business days preceding the scheduled date of such transfer. The financial institution may require written confirmation to be provided to it within fourteen days of an oral notification if, when the oral notification is made, the consumer is advised of such requirement and the address to which such confirmation should be sent.15 U.S.C. § 1693e.
(b) In the case of preauthorized transfers from a consumer's account to the same person which may vary in amount, the financial institution or designated payee shall, prior to each transfer, provide reasonable advance notice to the consumer, in accordance with regulations of the Bureau, of the amount to be transferred and the scheduled date of the transfer.
Section 1693m(g) of the United States Code provides that any action under EFTA "may be brought . . . within one year from the date of the occurrence of the violation." 15 U.S.C. § 1693m(g). Plaintiff alleges that in August 2014 she "cross-referenc[ed] her bank records and determin[ed] that [the] transactions had been posted on her account from approximately April 15, 2013 through May 2014." FAC ¶¶ 9, 10. Plaintiff argues that each transaction creates a new cause of action, thus transactions between April 15, 2014 and May 2014 should survive the statute of limitations. Docket No. 33 at 7 ("Opp'n").
Case law interpreting the statute of limitations of section 1693m(g) is sparse. The Sixth Circuit is the only circuit that addressed the statute of limitations in the context of a section 1693e claim for authorized transfers. In Wike v. Vertrue, Inc., 566 F.3d 590, 591 (6th Cir. 2009), plaintiff argued that the defendant violated the EFTA by setting up a monthly debit on the plaintiff's account based on oral, but not written, authorization. The transfers were arranged on February 14, 2005, the first recurring transfer occurred on March 22, 2005, and the consumer filed her complaint on March 14, 2006. Id. at 592. The district court dismissed the action as time-barred. Id. The Court of Appeal reversed explaining that section 1693e(a) of the EFTA speaks of preauthorized "transfers," not efforts to arrange them. 15 U.S.C. § 1693e(a). Id. at 593. According to the court, "[b]ecause there is no assurance at the time a payee attempts to initiate a transfer that anything will come of it, there is good reason to think Congress created a cause of action that accrues only when the reality of harm, not its mere possibility, takes place - which is when 'transfers' occur." Id. The court also stated:
[A]s a "standard rule," the statute of limitations begins to run "when the plaintiff has a complete and present cause of action" and thus "can file suit and obtain relief." Bay Area Laundry & Dry Cleaning Pension Trust Fund v. Ferbar Corp. of Cal., Inc., 522 U.S. 192, 201, 118 S.Ct. 542, 139 L.Ed.2d 553 (1997) (internal quotation marks omitted). Customarily, that is true when the defendant breaches a duty (here a duty imposed by statute) and the claimant is injured. Here, Vertrue violated a duty when it initiated the transfers, but Wike was not injured until the first transfer occurred. A consumer is injured only if, and only when, funds are withdrawn from her account.Id.
The court ultimately concluded that for purposes of the limitations period of the EFTA, a violation of the EFTA's preauthorized-transfer rule occurred when the first recurring transfer without the consumer's written consent took place. Id. at 593. Thus, because the consumer's bank made the first payment within one year of the filing of the lawsuit, her EFTA claim was timely. Id. at 596.
However, courts have held that the first recurring transfer not only triggers the one year limitations period as to that transfer, but it also triggers the limitations period for all ensuing transfers. See Camacho v. JPMorgan Chase Bank, No. 5:14-CV-04048-EJD, 2015 WL 5262022 (N.D. Cal. Sept. 9, 2015) and Pelletier v. Pac. WebWorks, Inc., No. CIV S-09-3503 KJM, 2012 WL 43281 (E.D. Cal. Jan. 9, 2012). There is no applicable "continuing violation" doctrine to save the claim from the time bar of EFTA if the first recurring transfer falls outside the limitations period, even if there are later transfers which do fall within the period.
In Camacho v. JPMorgan Chase Bank, No. 5:14-CV-04048-EJD, 2015 WL 5262022 (N.D. Cal. Sept. 9, 2015), the court explained:
Actions against financial institutions for failure to comply with the EFTA must be brought "within one year from the date of the occurrence of the violation." 15 U.S.C. § 1693m(g). In cases involving unauthorized transfers, courts interpret § 1693m(g) to require that EFTA claims be filed within one year of the date of the first recurring transfer. See, e.g., Wike v. Vertrue, Inc., 566 F.3d 590, 593 (6th Cir.2009); Pelletier v. Pac. Webworks, Inc., No. CIV S-09-3503 KJM KJN, 2012 U.S. Dist. LEXIS 2468, at *16, 2012 WL 43281 (E.D. Cal. Jan. 9, 2012); Repay v. Bank of America, N.A., No. 12 CV 10228, 2013 U.S. Dist. LEXIS 168679, at *8-16, 2013 WL 6224641 (N.D. Ill. Nov. 27, 2013) (rejecting plaintiff's request to apply "continuing violations" doctrine to EFTA claim and holding that § 1693m(g)'s statute of limitations begins to run on the date of the first reoccurring transfer).Id. at *4.
In Repay v. Bank of America, N.A., No. 12 CV 10228, 2013 U.S. Dist. LEXIS 168679, at *15, 2013 WL 6224641 (N.D. Ill. Nov. 27, 2013), the court explained that "the EFTA does not require that the payee obtain a separate written authorization for each transfer. Instead, the payee must obtain a single written authorization for the entire series of transfers." Thus, "rather than alleging a series of wrongful acts, Plaintiff has alleged a wrongful omission: failing to obtain written authorization for the series of transfers that were agreed upon and to provide a copy to the consumer." Id. Because the harm occurs once the series of transfers is initiated by the first transfer, "the continuing violation doctrine does not save an otherwise untimely suit when a single event gives rise to continuing injuries." Id. (quoting Clark v. City of Braidwood, 318 F.3d 764, 766 (7th Cir. 2003)).
Here, Plaintiff alleges that Google "debited Plaintiff's bank account on a recurring basis without providing a copy of a written authorization signed or similarly authenticated by Plaintiff for preauthorized electronic fund transfers." FAC ¶ 37. Harvey alleged in the complaint, however, that the first transaction had been posted on her account on April 15, 2013. FAC ¶ 10. Thus, her EFTA claim became time-barred on April 15, 2014, well before the complaint was filed. The fact that other later transfers occurred within the limitations period does not save the EFTA claim. C. Discovery Rule
Plaintiff relies on Diviacchi v. Affinion Grp., Inc., No. CIV.A. 14-10283-IT, 2015 WL 3631605 (D. Mass. Mar. 11, 2015) report and recommendation adopted, No. 14-CV-10283-IT, 2015 WL 3633522 (D. Mass. June 4, 2015) to argue that the repeated transfers from plaintiff's bank account are independently actionable. Opp'n at 7 n.13. In Diviacchi, the court concluded that "[e]ach transfer constitutes a new harm above and beyond the prior harm of a prior transfer and it amounts to an independent violation of section 1693e." 2015 WL 3631605, at *9. Thus, in Diviacchi, Plaintiff was able to bring a section 1693e claim "for the discrete acts of the purportedly unauthorized transfers." Id. Diviacchi represents the minority view and is not persuasive. Although the consumer is financially injured with each transfer, the basis of the wrongful conduct is the failure to obtain proper authorization in the first instance. The EFTA claim based on such conduct is fully consummated when the first unauthorized transfer is made. Under Wike, the consumer is able to bring suit as soon as that claim accrues; there is no need to rely on a continuing violations rule to protect the consumer's right to bring suit. --------
Plaintiff argues that the discovery rule applies to this action because she "first became aware of unauthorized withdrawals in August 2014." Opp'n at 8. Under the discovery rule, the limitations period does not begin to run until the plaintiff discovers (or reasonably should discover) that she has been injured. Lukovsky v. City and County of San Francisco, 535 F.3d 1044, 1048 (9th Cir. 2008). See also Unigard Sec. Ins. Co. v. Kansa Gen. Ins. Co., 1994 U.S. App. LEXIS 35914, *5 (Wash. Dec. 7, 1994) (stating that "[t]he discovery rule requires a plaintiff to use due diligence in discovering the basis for the cause of action. In other words, the discovery rule will postpone the running of a statute of limitations only until the time when a plaintiff, through the exercise of due diligence, should have discovered the basis for the cause of action.").
Plaintiff provided her "debit/banking information for her EDD account with Bank of America" to Google on March 20, 2013. FAC ¶ 7. She alleges she did not discover the unauthorized charges until August 2014 when she signed into her Google account. FAC ¶ 9. Plaintiff argues that "a close examination of the four (4) corners of the FAC do not suggest that Ms. Harvey knew or even had a reason to know of the unauthorized charges (at the heart of her EFTA claims) prior to August of 2014." Opp'n at 8. The Complaint, however, states that in August 2014, Plaintiff found "approximately one thousand (1000) listed transactions, six-hundred and fifty (650) of which were cleared." FAC ¶ 9 (emphasis added). During the hearing, Plaintiff's counsel conceded that these transactions would have appeared on Plaintiff's bank statements. This is confirmed by the complaint which states "said transactions had been posted to her account from approximately April 15, 2013 through May, 2014, with thousands of dollars of her money being debited." FAC ¶ 10. If Harvey had exercised due diligence, she should have discovered the injury either by looking at her Google account or even more simply, looking at her bank statements. It would not have taken much to discover that over the first 12 months of charges, there were hundreds of debits amounting to thousands of dollars on her bank statements. Because the discovery rule does not save her claim, the Court dismisses the EFTA claim. D. State Claims
Because the Court is dismissing the EFTA claim as time-barred, the only claims remaining are all based on state law (UCL, negligence, negligence per se, invasion of privacy, violation of the California Data Breach Act, Cal. Civ. Code § 1798.80 et seq.). The Court declines to exercise supplemental jurisdiction over the state law claims, especially as this case has not advanced beyond the pleadings. See 28 U.S.C. § 1367(c)(3) (providing that a district court "may decline to exercise supplemental jurisdiction over a claim . . . if . . . the district court has dismissed all claims over which it has original jurisdiction"); see also Sanford v. MemberWorks, Inc., 625 F.3d 550, 561 (9th Cir. 2010) (stating that, "'[i]n the usual case in which all federal-law claims are eliminated before trial, the balance of factors to be considered under the pendent jurisdiction doctrine - judicial economy, convenience, fairness, and comity - will point toward declining to exercise jurisdiction over the remaining state-law claims'").
Pursuant to 28 U.S.C. §1367 (d), Plaintiff's state law claims were tolled while they were pending in federal court and for a period of 30 days from the date of this order. 28 U.S.C. §1367 (d) (providing that "(d) The period of limitations for any claim asserted under subsection (a), and for any other claim in the same action that is voluntarily dismissed at the same time as or after the dismissal of the claim under subsection (a), shall be tolled while the claim is pending and for a period of 30 days after it is dismissed unless State law provides for a longer tolling period.")
IV. CONCLUSION
For the foregoing reasons, the Court grants Google's motion to dismiss. The federal claim is dismissed with prejudice. The Court declines to exercise supplemental jurisdiction over the state claims and therefore those claims are dismissed without prejudice. Plaintiff shall have 30 days to refile the case in state court. The Clerk of the Court is instructed to enter judgment in accordance with this opinion and close the file in this case.
This order disposes of Docket No. 30.
IT IS SO ORDERED. Dated: December 21, 2015
/s/_________
EDWARD M. CHEN
United States District Judge