Opinion
No. C05-02392 MJJ
02-10-2006
MARK WITRIOL, Plaintiff, v. LEXISNEXIS GROUP, a corporation; REED ELSEVIER, INC., a corporation; and SEISINT INC., a corporation, Defendants.
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS' MOTION TO DISMISS
Pending before the Court is Defendants LexisNexis Group, Reed Elsevier, Inc., and Seisint, Inc.'s Motion to Dismiss Amended Complaint (Doc. #23). Plaintiff Mark Witriol has filed an Opposition (Doc. #29), and Defendants have filed a Reply (Doc. #32). For the following reasons, the Court grants Defendants' Motion in part, and denies it in part. I. Background
Plaintiff filed this class action against Defendants on June 13, 2005, alleging that Defendants disclosed consumer reports and personal information about Plaintiff and the proposed Class Members, without their consent or authorization, to third parties who lacked any permissible purpose for receiving and using such information. As a result, Plaintiff alleges that "Defendants have thereby violated federal and state statutes . . . and have further violated the privacy rights of . . . Plaintiff and the Class Members, who hold reasonable expectations that their credit information shall be maintained in a secure and confidential manner." In his Amended Complaint, Plaintiff asserts the following claims: (1) negligence (count one); (2) willful violation of the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. §§ 1681b, 1681n (count two); (3) negligent noncompliance with the FCRA, 15 U.S.C. § 1681b, 1681o (count three); (4) violation of the California Credit Reporting Agencies Act ("CCRAA"), California Civil Code §§ 1785.11, 1785.14, 1785.19, and 1785.22 (count four); (5) violation of the California Investigative Consumer Reporting Agencies Act ("CICRA"), California Civil Code §§ 1786.12, 1786.20 (count five); (6) violation of the Information Practices Act, California Civil Code § 1798.53 (count six); and (7) violation of California Business and Professions Code §§ 17200 et seq. (count seven).
Defendants now move to dismiss Plaintiff's Amended Complaint in its entirety pursuant to Federal Rule of Civil Procedure 12(b)(6). II. Legal Standard - Motion to Dismiss
A motion to dismiss pursuant to Rule 12(b)(6) tests the legal sufficiency of a claim. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). Because the focus of a 12(b)(6) motion is on the legal sufficiency, rather than the substantive merits of a claim, the Court ordinarily limits its review to the face of the complaint. See Van Buskirk v. Cable News Network, Inc., 284 F.3d 977, 980 (9th Cir. 2002). Generally, dismissal is proper only when the plaintiff has failed to assert a cognizable legal theory or failed to allege sufficient facts under a cognizable legal theory. See SmileCare Dental Group v. Delta Dental Plan of Cal., Inc., 88 F.3d 780, 782 (9th Cir. 1996); Balisteri v. Pacifica Police Dep't, 901 F.2d 696, 699 (9th Cir. 1988); Robertson v. Dean Witter Reynolds, Inc., 749 F.2d 530, 534 (9th Cir. 1984). Further, dismissal is appropriate only if it appears beyond a doubt that the plaintiff can prove no set of facts in support of a claim. See Abramson v. Brownstein, 897 F.2d 389, 391 (9th Cir. 1990). In considering a 12(b)(6) motion, the Court accepts the plaintiff's material allegations in the complaint as true and construes them in the light most favorable to the plaintiff. See Shwarz v. United States, 234 F.3d 428, 435 (9th Cir. 2000). III. Discussion
1. Claims Under the Consumer Reporting Statutes
Counts two through five of Plaintiff's Amended Complaint assert claims for willful and negligent violation of the federal FCRA, violation of the CCRAA, and violation of the CICRAA. Defendants argue that under these statutes a credit reporting agency is only liable for impermissibly "furnishing" a consumer report for purposes not expressly provided in the statutes. Defendants advance that, "[w]here information is obtained from a consumer reporting agency under false pretenses and without the agency's actual knowledge of impropriety, there is no agency liability under the FCRA." (Mot. at 10.) Because Defendants contend that they did not furnish any credit reports, in that, they were the victims of a criminal trespass when one or more individuals impersonated legitimate subscribers and obtained consumer reports from Defendants, they assert that they cannot be held liable under the statutes. Instead, Defendants assert that, "[t]he only person against whom [P]laintiff could state a civil claim is the person or persons who used fake credentials to view [P]laintiff's consumer report." (Mot. at 10 (citing 15 U.S.C. 1681n(a).)
In response, Plaintiff argues that Defendants' argument is improper in the 12(b)(6) context because it relies on extrinsic facts not found in the Amended Complaint. Specifically, Plaintiff contends that the Amended Complaint contains no allegations about third parties fraudulently obtaining credit reports from Defendants. As a result, Plaintiff submits that these allegation cannot serve as a basis to dismiss the Amended Complaint. The Court agrees with Plaintiff. Furthermore, taking the allegations in the Amended Complaint as true, and construing them in Plaintiff's favor, Plaintiff has expressly alleged that "Defendants furnished consumer reports and other personal information regarding [] Plaintiff [] to unauthorized third parties[.]" (Am. Compl. ¶ 38.) In fact, in their Motion, Defendants concede that "Plaintiff claims that LexisNexis violated the FCRA, CCRAA, and ICRAA by furnishing 'consumer reports,' 'consumer credit reports,' or 'investigative consumer reports' to unauthorized third parties who lacked a permissible purpose for obtaining such reports." (Mot. at 7 (emphasis added).) At the pleading stage, this allegation is sufficient to sustain Plaintiff's claims.
Apart from their Motion, Defendants have filed a Request for Judicial Notice pursuant to Federal Rule of Evidence 201, wherein Defendants ask the Court to take judicial notice of two press releases that Defendants issued concerning theft of information from its computer database, and a letter from LexisNexis to persons potentially affected by the alleged theft. (Doc. #24.) Generally, Rule 201 of the Federal Rules of Evidence allows a court to take judicial notice of a fact that is "not subject to reasonable dispute in that it is either (1) generally known within the territorial jurisdiction of the trial court or (2) capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned." Even when judicial notice is not appropriate under Rule 201, a court may nevertheless consider documents "whose contends are alleged in a complaint and whose authenticity no party questions, but which are not physically attached to the [plaintiff's] pleadings." Branch v. Tunnel, 14 F.3d 449, 454 (9th Cir. 1994).
Here, Defendants contend that judicial notice is appropriate because: (1) the press releases and the letter form the basis for Plaintiff's claims; (2) the Amended Complaint refers to the subject matter of the press releases and the letter; and (3) the authenticity of the press releases and letter cannot be questioned. Plaintiff, however, argues that "[t]he facts contained in these documents are not judicially noticeable, as they are not referred to in the Complaint and they do not constitute matters of public record." Additionally, Plaintiff argues that "the content of the documents and the accuracy of the proffered 'facts' are highly disputed in this case." The Court agrees with Plaintiff. Neither the press releases nor the letter from LexisNexis are specifically referenced in the Amended Complaint. Further, the subject matter of all three documents - namely, that third parties fraudulently accessed information from Defendants' database - is directly contradicted by the allegations in the Amended Complaint that Defendants' intentionally disclosed such information to third parties. Accordingly, the Court declines to take judicial notice of these documents.
In sum, Plaintiff has adequately pled that Defendants violated the consumer reporting statutes by furnishing consumer reports to unauthorized recipients for impermissible purposes. The Court therefore DENIES Defendants' Motion to Dismiss with respect to counts two through five.
2. Claim Under the Information Practices Act
Next, Defendants move to dismiss count six, wherein Plaintiff asserts a claim for violation of the Information Practices Act, California Code § 1798.53. According to Defendants, § 1798.53 does not apply to non-governmental entities like Defendants. Plaintiff, however, argues that § 1798.53 creates civil liability for "any person . . . who intentionally discloses information, not otherwise public[.]" Citing California Civil Code § 1798.3(f), Plaintiff argues that "person" is defined as: "any natural person, corporation, partnership, limited liability company, firm, or association." Thus, Plaintiff contends that Defendants qualify as a "person" and therefore can be held liable for violation of the IPA.
In support of its argument that only government agencies are subject to the IPA, Defendants cite Jennifer M. v. Redwood Women's Health Center, 105 Cal. Rptr. 2d 544 (Cal. Ct. App. 2001). Because they are not government agencies, Defendants argue that Plaintiff's claim under the IPA fails as a matter of law. The Court, however, disagrees with Defendants.
In Jennifer M. the plaintiff sued a private health care center for violations of several sections of the IPA, alleging that the center had disclosed confidential medical information about her to third parties. Id. at 547. The trial court granted the center's motion for summary judgment, finding that the IPA applied only to government agencies and not to private medical facilities. On appeal, the court framed the issue as whether the IPA applied to a private hospital, such the center, on the basis of its contractual relationship with the California Department of Health Services to provide medical services. Id. at 548. The court affirmed summary judgment for the center, holding that the "IPA was not intended to cover private entities such as [the center] and is inapplicable under the circumstances of this case." Id. Seizing on this language, Defendants argue that Plaintiff's IPA claim against them fails.
However, a closer read of the Jennifer M. decision reveals otherwise. Specifically, in analyzing the plaintiff's claim, the court noted that "Jennifer's complaint cites and relies on 10 separate provisions of the [IPA]. (§§ 1798.1, 1798.3, 1798.19, 1798.24, 1798.45, 1798.46, 1798.47, 1798.48, 1798.53, 1798.63.)." The court then reviewed each of these provisions, noting that "[t]he key remedial provisions of the [IPA] are sections 1798.53 and 1798.45." Id. Particularly, it recognized that "Section 1798.53 sets out a civil action for damages for the intentional disclosure of confidential personal information 'maintained by a state agency or from 'records' within a 'system of records' . . . maintained by a federal government agency . . . ." Id. at 549. The court noted that § 1798.45, on the other hand, "provides for a direct civil action against 'an agency' whenever it '[f]ails to comply with any provision of the [IPA] 'in such a way as to have an adverse effect of an individual.'" Id. After reviewing the provisions, the court reasoned:
On its face, the [IPA] is aimed at barring or limiting the dissemination of confidential personal information-and preventing the misuse of such information-by government agencies. [] Anti-Defamation League of B'nai B'rith v. Superior Court, 67 Cal. App. 4th 1072, 1079, (1998). Clearly, as a privately owned medical clinic, Redwood is not itself a government agency or entity as defined by section 1798.3, subdivision
(b). Thus, the provisions of the [IPA] cited by [the plaintiff], all of which deal with information maintained by "agencies," are inapplicable to this action.Id. at 550. However, the court went on to analyze § 1798.53 independently, and concluded that this provision, standing alone, did not help the plaintiff's case. Id. at 551. Specifically, the court found that the center was not an agency, and "[t]here is no evidence the information at issue was 'maintained by' either a state or federal government agency, or was 'obtained' by [the center] from any such agency-maintained source of information." Id. Accordingly, the court held that the plaintiff's claim pursuant to § 1798.53 failed. Id. Based on this discussion, it appears that if the plaintiff could have shown that the information was obtained from or maintained by a government agency, the claim would have been viable, despite the fact that the center was not itself a government agency. Thus, the proposition that only government agencies are subject to the IPA is undermined by the court's analysis of the plaintiff's claim pursuant to § 1798.53.
Further, other California decisions have allowed claims pursuant to § 1798.53 against nongovernment entities. In fact, in Anti-Defamation League of B'Nai B'rith, the decision cited in Jennifer M. as establishing that the IPA only applies to government agencies, the plaintiffs brought an action for invasion of privacy in violation of § 1798.53 against a civil rights organization. 67 Cal. App. 4th at 1078. Further, in that matter, the court held that, in certain circumstances journalists are immune from liability under § 1798.53 based on First Amendment protections. Id. at 1077. If § 1798.53 only applied to government agencies this discussion would be unnecessary. Likewise, in Fahizah Alim v. Superior Court of Sacramento County, 185 Cal. App. 3d 144 (1986), the plaintiff sued a reporter, an editor, and a publisher, for invasion of privacy pursuant to § 1798.53, claiming that a newspaper article that the defendants published disclosed personal or confidential information about the plaintiff in a false and inaccurate manner. Id. at 147. The trial court denied summary judgment on the § 1798.53 claim, rejecting the defendants argument that their publication was protected under the First Amendment. Defendants thereafter appealed. On appeal, the court addressed whether the constitutional protections afforded the press under the First Amendment apply to claims under § 1798.53. Id. at 149. Again, if the defendants were not subject to liability under the statute because they were not a government agency, this discussion would have been moot.
As the foregoing decisions illustrate, California courts have permitted claims pursuant to § 1798.53 against non-governmental agencies. Moreover, as Plaintiff points out, this is consistent with the plain language of § 1798.53, which authorization a civil cause of action against "any person . . . who intentionally discloses information, not otherwise public." Had Plaintiff proceeded under one of the IPA's other sections which expressly apply to government agencies, Defendants would be correct. However, Plaintiff has asserted a claim under § 1798.53, which contains no such limitation. Accordingly, the Court finds that Plaintiff may assert a claim under § 1798.53 against Defendants.
Further, § 1798.53 expressly exempts an "employee of the state or of a local government agency acting solely in his or her official capacity," from its reach. If the statute only applied to government agencies, such an express exclusion would be unnecessary. This language further supports the conclusion that Plaintiff may maintain his claim under § 1798.53 against Defendants.
Nevertheless, Defendants contend that "even if section 1798.53 applied to non-governmental entities . . . [Plaintiff's] claim would still fail because his allegations do not satisfy the elements of the statute." Specifically, Defendants argue that Plaintiff has failed to allege: (1) that information about him was intentionally disclosed; and (2) that information disclosed about him was nonpublic information that [D]efendants obtained from a government agency.
In response, Plaintiff argues that he has adequately alleged the necessary elements to sustain a claim under § 1798.53, and points to ¶ 30 of his Amended Complaint in support. These paragraph provides:
Defendants knowingly and intentionally disclosed the Representative Plaintiff's and the Class Members' consumer reports to unauthorized third parties, which persons and/or entities did not have permissible purposes for receiving and/or using such information . . . Defendant's [sic] knowing and intentional disclosure of private consumer information was done in a systematic manner to generate revenue and profits for Defendants, at the expense of Representative Plaintiff and the Plaintiff Classes, in conscious disregard of their rights.Reviewing this paragraph, Plaintiff has sufficiently alleged that Defendants' disclosure of the information was intentional. However, Plaintiff has failed to identify any language in his Amended Complaint, and the Court has found none, alleging that Defendants knew or should reasonably have known that the information was obtained from personal information maintained by a state or federal agency. The Court therefore GRANTS Defendants' Motion to Dismiss count 6 of the Amended Complaint. Concomitantly, the Court grants Plaintiff leave to amend to cure this deficiency.
3. Count Seven - Violation of California Business and Professions Code § 17200
In count seven, Plaintiff asserts a claim against Defendants for violation of California Business and Professions Code § 17200. Specifically, he alleges that:
62. Defendants' unauthorized disclosure of the Representative Plaintiff's and the Class Members' private information, their systematic violation of the FCRA, CCRAA, ICRAA and IPA, as alleged herein, their unlawful invasion of Representative Plaintiff's and the California Class Members' privacy rights and the other wrongful conduct alleged in this Complaint, reveal a pattern and practice of unfair, unlawful and fraudulent business practices in violation of California Business & Professions Code § 17200 et seq.(Am. Compl. at ¶¶ 62-63.)
63. Defendants' knowing failure to safeguard the Representative Plaintiff's and the Class Members' personal and confidential information, and to adopt policies in accordance with and/or to adhere to the fair credit reporting laws, all of which are binding upon and burdensome to Defendant's [sic] competitors, engenders an unfair competitive advantage for Defendant [sic], thereby constituting an unfair business practice, as set forth in California Business & Professions Code §§ 17200-17208.
Defendants first argue that "[b]ecause all of Plaintiff's other statutory claims fail as a matter of law, he has failed to plead any 'unlawful' act required for a section 17200 claim." (Mot. at 13.) However, as previously discussed, Plaintiff has plead viable claims under California's consumer reporting statutes. Accordingly, the Court rejects Defendants' argument as a basis to dismiss count seven.
Next, Defendants charge that Plaintiff lacks standing to bring a claim under § 17200. According to Defendants, standing to bring a § 17200 claim is limited to any person "who has suffered injury in fact and has lost money or property." (Citing Cal. Bus. & Prof. Code § 17204.) Because they claim that Plaintiff has neither alleged that he suffered an injury in fact, nor alleged that he has lost money or property as a result of Defendants' actions, Defendants urge the Court to dismiss count seven.
In opposition, Plaintiff maintains that he has sufficiently alleged facts demonstrating that he has standing to pursue his claim under § 17200. In support, he cites to paragraphs 27, 36, 37, 47, 52, 56, 60, 64 and 65, which he claims "refer to the injuries and damages incurred by Plaintiff and the Plaintiff Classes." The Court has reviewed these paragraphs. With the exception of ¶ 36, the Court agrees with Defendants that the paragraphs Plaintiff proffers do not allege any "lost money or property." As to ¶ 36, however, Plaintiff has expressly alleged that, he and the Class Members have incurred "costs associated with monitoring and repairing credit impaired by the unauthorized release of private information." Thus, Plaintiff has sufficiently alleged that he has suffered actual injury and sustained monetary loss as a result of Defendants' actions. The Court therefore DENIES Defendants' Motion with respect to count seven.
4. Count One - Negligence
In count one of the Amended Complaint, Plaintiff asserts a negligence claim against Defendants. Defendants move to dismiss this claim on the grounds that it is preempted, and because Plaintiff has failed to plead the basic elements of a negligence claim.
a) Preemption
Under Article VI of the Constitution, the laws of the United States "shall be the supreme Law of the land; . . . any Thing in the Constitution or Laws of any state to the Contrary notwithstanding." U.S. Const. Art. VI, cl. 2. Accordingly, any state law that conflicts with federal law has no effect. See Cipollone v. Liggett Group, Inc., 505 U.S. 504, 516 (1992).
Federal law may preempt state law under the Supreme Clause in three circumstances. English v. Gen. Elec. Co., 496 U.S. 72, 78 (1990). First, Congress may state its intent that federal law preempt state law through an express statutory provision. Id. Second, "in the absence of explicit statutory language, state law is preempted where it regulates conduct in a field that Congress intended the Federal Government to occupy exclusively." Id., at 79. As the Supreme Court explained:
Such an intent may be inferred from a "scheme of federal regulation . . . so pervasive as to make reasonable the inference that Congress left no room for the States to supplement it," or where an Act of Congress "touch[es] a field in which the federal interest is so dominant that the federal system will be assumed to preclude enforcement of state laws on the same subject.Id. (quoting Rice v. Santa Fe Elevator Corp., 331 U.S. 218, 230 (1947)). Third, when state law actually conflicts with federal law, it is preempted. Id. "Thus, the Court has found preemption when it is impossible for a private party to comply with both state and federal requirements, or where state law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress." Id. (internal citation and quotation omitted). When engaging in a preemption analysis, the Court remains mindful that "[t]he purpose of Congress is the ultimate touchstone of pre-emption analysis." Cipollone, 505 U.S. at 516.
Here, Defendants contend that the Gramm-Leach-Billey Act, 15 U.S.C. § 6801, et seq., preempts Plaintiff's state-law negligence claim. Specifically, proceeding under an implied preemption theory, Defendants argue that the GLBA's regulatory scheme establishes comprehensive standards to protect the security and confidentiality of consumer information that financial institutions maintain. Toward this end, and pursuant to Section 501 of the GLBA, Defendants point out that the Federal Trade Commission has promulgated Standards for Safeguarding Consumer Information, which regulated entities are required to "develop, implement, and maintain." 16 C.F.R. § 314.3. According to Defendants, "[a]llowing individual negligence actions against LexisNexis would not only create the patchwork of state regulation that the Safeguards Rule was designed to avoid, but it would also undermine Congress's manifest intent to preempt enforcement of security requirements by courts and individual litigants." (Mot. at 16.) Citing Briggs v. Emporia State Bank & Trust Co., No. 05-2125-JWL, 2005 WL 2035038, at *3 (D. Kan. Aug. 23, 2005), Defendants also assert that "Congress intended for the [FTC's] regulatory scheme to be the exclusive method for enforcing the statute." Defendants thus argue that "permitting individual actions under state law in state court to regulate the very conduct that the Safeguards Rule was intended to comprehensively govern and that the FTC was intended to exclusively regulate would subvert the core of Congress's regulatory scheme." (Mot. at 16.)
The Court, however, is unpersuaded by Defendants' argument. As Defendants correctly note, under the GLBA, the FTC has sole jurisdiction to enforce the statute. That being said, Defendants have provided no authority, and the Court has found none, supporting their contention that because the GLBA does not provide a private cause of action to enforce its provisions, it therefore preempts all other state causes of action based on disclosure of consumer information - even claims completely unrelated to the GLBA. To be sure, Plaintiff is not alleging any claim under the GLBA. If that were the case, Plaintiff's claims would be subject to dismissal because the GLBA contains no provision supporting such a claim. In fact, Plaintiff does not reference the GLBA at any point in his Amended Complaint. Because the GLBA and the standards it imposes form no part of Plaintiff's claim, and because Defendants have failed to proffer any authority indicating that Congress intended the GLBA to preempt state law claims unrelated to the Act, the Court rejects Defendants' argument that the GLBA preempts Plaintiff's negligence claim.
Defendants' reliance on Briggs is misplaced. There, while the district court held that the plaintiffs could not assert a claim under the GLBA because no private cause of action existed under the Act, and could not assert a claim pursuant the FTC's regulatory sections enacted pursuant to the GLBA, the court did not hold that the plaintiffs were precluded from asserting non-GLBA state-law claims against the defendant bank. Because the court dismissed all of the plaintiffs' federal claims, it declined to address supplemental jurisdiction over the remaining state-law claims. However, the court expressly noted that the dismissal was "without prejudice to plaintiff's reasserting these various state law claims if the plaintiffs elect to reassert their federal Consumer Credit Protection Act or Fair Credit Reporting Act claim." See 2005 WL 2035038 at *4. Accordingly, the Briggs court never addressed the preemption issue Defendants raise in this matter.
Second, Defendants argue that, even if the negligence claim is not preempted, Plaintiff has failed to adequately allege the duty and damage elements of a negligence claim. With respect to the duty element, in ¶ 33 of the Amended Complaint, Plaintiff alleges:
As custodians of the Representative Plaintiff's and the Class Members' personal and confidential information, which Defendants sell and/or disclose to their customers, for profit, in the regular course of their business, Defendants owe a duty of care to the Representative Plaintiff and the Class Members to prevent access to such information by unauthorized third parties.Thus, Plaintiff has sufficiently alleged that Defendants owed him a duty of care.
Defendants also argue that Plaintiff's allegations that he suffered economic and emotional injuries based on Defendants' conduct, are insufficient to sustain a negligence claim. Defendants assert that "[a]bsent a showing of injury to person or property . . . neither of those forms of damages is cognizable in tort." Construing Plaintiff's damages allegations in the light most favorable to Plaintiff, however, the Court finds that Plaintiff had adequately alleged that he suffered actual damages as a result of Defendants' conduct. Consequently, the Court DENIES Defendants' Motion with respect to count one. / / / / / / / / / / / / IV. Conclusion
Nothing in this Order shall be construed as precluding Defendants from arguing that they are entitled to judgment on Plaintiff's negligence claim because Plaintiff failed to provide sufficient evidence that he (and the relevant Class Members) sustained legally cognizable damages recoverable under a general negligence theory.
For the foregoing reasons, the Court GRANTS IN PART AND DENIES IN PART Defendants' Motion to Dismiss as follows: The Court GRANTS Defendants' Motion with respect to count six, with leave to amend. The Court DENIES Defendants' Motion as to all other counts. Plaintiff shall file any Second Amended Complaint within 10 days of the filing date of this Order.
IT IS SO ORDERED.
Dated: February 10, 2006.
/s/_________
MARTIN J. JENKINS
UNITED STATES DISTRICT JUDGE