Opinion
19-12441
06-15-2021
In re StockX Customer Data Security Breach Litigation
ORDER REGARDING THE APPLICATION OF CALIFORNIA LAW AND NOT COMPELLING ARBITRATION
Victoria A. Roberts United States District Judge
I. INTRODUCTION
In early to mid-2019, Laura Esquer (“Esquer”) registered for a StockX account with her email address. Since March 2016 StockX requires all users to agree to StockX's Terms of Service and Privacy Policy (the “TOU”). Included in the TOU is a mandatory arbitration clause and a clause that requires the parties to apply Michigan law to all claims or disputes. Those clauses are at issue.
Esquer brings this putative class action against StockX. She seeks to represent herself and “other members of the general public of the State of California” who were allegedly harmed by StockX's failure to protect their confidential and personal information from a data breach. Esquer requests injunctive relief and declaratory judgment.
On March 18, 2021, the Court ordered the parties to brief whether Michigan or California state law applies to Esquer's claims, “because if Michigan - and not California - law applies, Esquer's claims are subject to arbitration.” [ECF No. 48].
For the reasons below, the Court finds that California law applies and the Court does not compel arbitration.
II. BACKGROUND
StockX is an e-commerce platform where users can purchase and sell luxury goods, fashion clothing, rare sneakers and accessories. StockX is a Michigan limited liability corporation with its principal place of business in Detroit.
The Court consolidated four actions against StockX where eight plaintiffs (the “Plaintiffs”) complained of a May 2019 data breach. The Court consolidated those cases under the case caption, In re StockX Customer Data Security Breach Litigation, No. 2:19-cv-12441-VAR-EAS. [ECF No. 17]. The Plaintiffs filed a Consolidated Class Action Complaint. [ECF No. 24].
On September 23, 2019, Esquer, a California resident, filed this putative class action in the United States District Court for the Northern District of California related to the May 2019 StockX data breach. See Laura Esquer v. StockX LLC, No. 5:19-CV-05933-LHK (N.D. Cal.). Esquer seeks relief under California's Consumer Records Act (“CRA”) and California's Unfair Competition Law (“UCL”). On June 30, 2020, the Northern District of California transferred venue to this Court. The Court consolidated Esquer's action under the In re StockX Customer Data Security Breach Litigation caption. [ECF No. 33]. After the Court consolidated Esquer's action, the Plaintiffs did not file an amended consolidated class action complaint to include Esquer or her claims.
StockX filed a motion to dismiss the Consolidated Class Action Complaint for improper venue and to compel arbitration. [ECF No. 30]. The motion did not include Esquer or her claims. In December 2020, the Court granted StockX's motion, finding that a valid arbitration agreement existed. [ECF No. 42]. The motion, however, did not resolve Esquer's claims.
Because the Court ordered the Plaintiffs to arbitration, the case was closed despite Esquer's complaint. In March 2021, the Court held a phone conference regarding the complaint. As a result of the phone conference, the Court ordered the clerk to reopen this case and ordered the parties to brief whether Michigan or California law applies to Esquer's claims. The matter is fully briefed.
Esquer created a StockX account during April 2019. StockX's TOU requires customers to:
[A]gree that, except to the extent inconsistent with the Federal Arbitration Act (“FAA”) or preempted by federal law, the laws of the State of Michigan, without regard to principles of conflict of laws, will govern these Terms and any claim or dispute that has arisen or may arise between you and StockX.
Put simply, the TOU states that customers must resolve disputes with StockX in arbitration under Michigan state law rather than through court proceedings. Esquer argues that the TOU is not enforceable because it would improperly preclude her from seeking relief on behalf of the California public.
Esquer argues California law applies, the choice of law provision is unenforceable, and that the Court should not compel arbitration of her claims. StockX argues that the Michigan choice of law provision in the TOU is enforceable under the Restatement Second of Conflict of Laws, Michigan law applies, and that Esquer must settle her claims through arbitration.
III. LEGAL STANDARD
Because there is a choice of law issue, this Court - as the transferee court - must apply the choice of law rules that the California court would have applied had the case not been transferred. See Rosen v. Chrysler Corp., 205 F.3d 918, 921 n.2 (6th Cir. 2000) (citing Ferens v. John Deere Co., 494 U.S. 516, 523 (1990)). Accordingly, the Court applies California choice of law rules.
Courts applying California's choice of law rules apply the tests set forth in Section 187(2) and Section 188 of the Second Restatement of Conflict of Laws.
Briefly stated, the proper approach under Restatement §187(2) is for this Court to first determine whether: (1) Michigan has a substantial relationship to the parties or their transaction, or (2) there is any other reasonable basis for the parties' choice of law. Nedlloyd Lines B.V. v. Superior Court, 842 P.2d 1148, 1152 (Cal. 1992). If neither test is satisfied, that is the end of the inquiry, and the Court need not enforce a choice of law provision.
However, if either test is met, the Court must next determine whether Michigan's law is contrary to a fundamental policy of California. If there is no conflict, the Court must enforce the parties' choice of Michigan law.
If there is a fundamental conflict, the Court must then determine whether California has a “materially greater interest than [Michigan] in the determination of the particular issue....” considering the five factors set forth in § 188. If California has a materially greater interest than Michigan, the Court must not enforce the Michigan choice of law provision.
IV. ANALYSIS
A. Michigan Has A Substantial Relationship to The Parties
Esquer does not disagree with StockX's contention that Michigan has a substantial relationship to the parties and transaction; it is domiciled here.
A “substantial relationship” exists between a party and the state in which it is domiciled, resides, or is incorporated. Nedlloyd Lines B.V., 834 P.2d 1148 (holding incorporation and domicile status create substantial relationship); Kipin Indus. v. Van Deilen Int'l, Inc., 182 F.3d 490, 494 (6th Cir. 1999); Restatement § 187 cmt. F. “If one of the parties resides in the chosen state, the parties have a reasonable basis for their choice.” Nedlloyd, 834 P.3d at 1153.
Because StockX is domiciled in Michigan the Court finds that Michigan has a substantial relationship to Esquer's claims.
B. Application of Michigan Law Is Contrary to Fundamental California Policy
Since Michigan has a substantial relationship to the parties, the next step in the inquiry is whether application of Michigan law is contrary to fundamental California policy.
This contract required Esquer to waive her right to bring claims against StockX in court and required arbitration under Michigan law. Esquer argues Michigan law is contrary to fundamental California policy, since it is contrary to California policy that ensures the rights of consumers to seek public injunctive relief under McGill v. Citibank, N.A., 393 P.3d 85 (2017). Pursuant to McGill, California courts recognize a plaintiff's right to pursue injunctive relief on behalf of the general public. See e.g., Mejia v. DACM Inc, 54 Cal.App. 5th 691, 701 (2020); Blair v. Rent-A-Ctr., Inc., 928 F.3d 819, 828 (9th Cir. 2019). Michigan has no such policy.
In McGill, the plaintiff, a credit card account holder, filed a class action against the issuing bank under the CRA and UCL. Id. at 87. The bank petitioned the court to compel arbitration. Id. at 88. McGill's prayer for relief asked the court to require the bank to immediately cease unfair competition and enjoin the bank - under the CRA and UCL - from continuing to conduct business via unlawful, fraudulent or unfair business acts and practices. Id. at 91. The court held that McGill sought public injunctive relief and noted “[c]ontracts that prevent all adjudication of public injunctive relief- in any forum-are impermissible under California law.” Id. at 91 and 94.
“Public injunctive relief” under the UCL and CRA is defined as “relief that has the primary purpose and effect of prohibiting unlawful acts that threaten future injury to the general public.” Id. at 90. A public purpose exists where private individuals seek injunctive relief that would “by and large benefit [ ] the general public.” See Magana v. DoorDash, Inc., 343 F.Supp. 3d 891, 900-01 (N.D. Cal. 2018). The benefit to the plaintiff, if any at all, must be incidental or result from plaintiff's status as a member of the general public. Id.
To determine whether Michigan law is contrary to the fundamental California policy established in McGill, the Court must first determine whether Esquer's complaint seeks public injunctive relief. See Magana, 343 F.Supp.3d 900 (N.D. Cal. 2018).
Esquer says her injunction request targets the general public. Her complaint “seeks to certify a class of all citizens of California whose Customer Data was stolen from StockX during the Data Breach.” She claims there is a real danger of future theft to existing and future StockX users' private information and that injunctive relief would ensure that the general public is not at risk of having personal information stolen if members sign up for a StockX account. Esquer alleges that StockX has not changed its practices since the 2019 data breach.
StockX maintains that McGill does not apply since Esquer's request targets only a narrow subset of individuals - those individuals whose data was stolen in 2019 - and not the general public. The Court disagrees. Esquer proposes twelve points, that if granted would work to ensure that StockX adequately and reasonably secures customer data of present and future customers. She requests an injunction that requires StockX to:
. hir[e] third-party security auditors and penetration testers in addition to internal security personnel to conduct testing, including simulated attacks, penetration tests, and audits on StockX's systems periodically, and ordering StockX to promptly rectify any flaws or issues detected by such parties;
. as required by Cal. Civ. Code Section 1798.81.5, “implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”;
. engag[e] third-party security auditors and internal personnel to run automated security monitoring;
. test, audit, and train its security personnel regarding any and all new and/or modified security measures or procedures;
. creat[e] further and separate protections for customer data including, but not limited to, the creation of firewalls and access controls so that if one area of StockX's data security measures are compromised, hackers cannot gain access to other areas of StockX's systems;
. utiliz[e] more complex and multilayered authentication;
. requir[e] consumers [to] use more complex and unique passwords;
. warn consumers of the substantial risks and effects of credential stuffing, instructing affected consumers to change their credentials on other e-commerce and web platforms they use;
. delet[e], in a reasonable and secure manner, Customer Data not necessary for StockX's provisions of products;
. conduct regular database scanning and security checks;
. conduct routine and periodic training and education to prepare internal security personnel regarding the processes to identify and contain a breach when it occurs and what appropriate actions are proper in response to a breach; and
. educat[e] its customers about the threats they face as a result of the loss of their financial and personal information to third parties, as well as the steps customers must take to protect themselves.
Esquer says that the California Court of Appeals' decision in Maldonado is instructive to a determination of the public nature of her lawsuit. Maldonado v. Fast Auto Loans, Inc., 60 Cal.App. 5th 710, 715 (2021). In Maldonado, customers brought a class action against an improperly licensed lender who targeted Californians, offering them high interest rate loans, often secured against their cars. Id. at 714.
Plaintiffs sought injunctive relief to prohibit defendant from continuing to charge unlawful interest rates and running false or misleading advertising. Id. at 715. The court reasoned that the plaintiffs' requested remedy encompassed all consumers and members of the public. Id. at 721. The Maldonado court held that the McGill rule applied because the complaint's prayer for relief specifically stated that “[p]ublic injunctive relief against defendant would prevent it from “future violations of the aforementioned unlawful and unfair practices.” Id. The court found that an injunction “will not directly benefit the Customers because they have already been harmed and are already aware of the misconduct…any benefit to the Customers is incidental to the ‘general public benefit of enjoining such a practice' (Citation omitted).” Id. (citing McGill, 394 P.3d 85).
StockX maintains that Esquer seeks a private injunction that would only benefit current StockX customers, and not members of the general public.
Accepting StockX's argument would require the Court to ignore Esquer's request to enjoin StockX from harming consumers by failing to adequately protect customer data. See Id. at 722. Esquer and other California StockX users whose data was compromised during the 2019 breach have nothing to personally gain from an injunction requiring StockX to employ safer data practices; their data has already been compromised. Id.
The Court agrees with StockX's assertion that there may be “millions of members of the general public who [will] never create a StockX account.” But that does not negate the fact that injunctive relief could benefit the general public. See Id. The Court does not deem the requested injunction private just because StockX could not possibly enter into an agreement with every California resident. Rejecting Esquer's suit for that reason would allow StockX to continue engaging in inadequate data protection practices in violation of the UCL and CRA and leave consumers unable to adjudicate their claims based on those practices on behalf of the public. Id. Even if Esquer stands to benefit from an injunction requiring reasonable security measures, it appears likely that the benefit to her would be incidental to the general public benefit. See McGill, 2 Cal.5th at 94 (citing Broughton v. Cigna Healthplans 21 Cal.4th 1066, 1080, fn. 5 (1999)). Esquer's requested relief has the purpose and effect of protecting the public from StockX's alleged ongoing harm.
Esquer pleads a fundamental policy of California law that requires application of California law to her claims.
C. California Has A Materially Greater Interest in Esquer's Claims Than Michigan
Because Esquer meets her burden to show that although Michigan has a substantial relationship to this transaction, its law is contrary to the fundamental policy of California, the Court answers the question: does California have a materially greater interest in having its law applied to Esquer's claims than does Michigan?
The Restatement lists five factors the Court should consider in determining which state has a materially greater interest: (1) the place of contracting; (2) the place of negotiation; (3) the place of performance; (4) the location of the subject matter of the contract; and (5) the residence, place of incorporation, and place of business of the parties. Restatement, supra, § 188(2); see also ABF Capital Corp. v. Berglass, 130 Cal.App.4th 825, 838 (2005) (noting Section 188 of the Restatement governs this analysis).
The first two factors are neutral - Esquer in California and StockX in Michigan negotiated the contract via the internet.
The third and fourth factors - the place of performance and location of the subject matter of the contract - are also neutral. Esquer agreed to the TOU in California and may have ordered items when she was located there, while StockX performed its obligations in Michigan. Most of the requirements of the TOU and any contract between StockX and its users are performed in Michigan - StockX hosts its platform from its office in Michigan; all transactions, including buying and selling, run through Michigan.
StockX cites to Volks to prove that the place of performance was Michigan. Volks USA, Inc. v. A2 Hosting, Inc., No. CV16-4277-CAS(Ex), 2016 WL 6808113 (C.D. Cal. Nov. 16, 2016). In Volks, the plaintiff claimed that the defendant improperly accessed and deleted data related to plaintiff's online store from a server allegedly located in California. Id. at *1. In determining whether Michigan or California law applied under the Restatement test, the court held that the principal place of performance and the subject matter of the contract were located in Michigan because the hosting service described by the terms of service related to plaintiff's use of defendant's servers in Michigan. Id. at *8.
Although StockX's TOU also relates to the use of its Michigan-hosted website, the TOU also discusses purchasing, selling, and the creation of an account, all of which may and did occur outside of Michigan - in this case, California.
The final factor is neutral because Esquer is a California resident and StockX is domiciled in Michigan.
Although under the five-part test the factors are neutral, Esquer says California has a materially greater interest in the application of its law because it has a strong interest in protecting California consumers. The Court agrees. The putative class consists only of California residents, and Esquer brings the claims pursuant to California law. Oestreicher v. Alienware Corp., 502 F.Supp.2d 1061, 1068-89 (N.D. Cal. 2007); See Klussman v. Cross Country Bank, 134 Cal.App.4th 1293, 1299 (2005) (where the plaintiffs reduced the class size from a nation-wide class to a class of only California residents, it increased California's interest in the litigation).
While not insignificant, Michigan's only interest is the enforcement of a contractual provision made by a corporate citizen. See Oestreicher, 322 Fed.Appx. at 491 (California had a materially greater interest than Florida in determining the enforceability of a class action waiver where the putative class consisted only of California residents, invoked only California consumer protection law, and Florida's only interest was to enforce the waiver drafted by a Florida corporation).
Further, the putative class member's inferior bargaining power against StockX tips the balance in favor of the application of California law. See Oestreicher, 502 F.Supp.2d at 1069.
The Court finds that California has a materially greater interest in protecting its citizens than Michigan has in adjudicating Esquer's claims against StockX. See Oestreicher v. Alienware Corp., 322 Fed.Appx. 489, 491 (9th Cir., Apr.02, 2009).
V. CONCLUSION
Because application of Michigan law would be contrary to fundamental California policy and California has a materially greater interest in Esquer's claims than Michigan, StockX's choice of law clause is unenforceable. The Court will not compel arbitration of Esquer's claims against StockX.
ORDERED.