Erhart v. BofI Holding, Inc.

Full title: Charles Matthew ERHART, Plaintiff, v. BOFI HOLDING, INC., Defendant.

Court: United States District Court, S.D. California.

Date published: Mar 31, 2020

612 F. Supp. 3d 1062 (S.D. Cal. 2020)

Opinion

Case No. 15-cv-02287-BAS-NLS, 15-cv-02353-BAS-NLS

2020-03-31

Charles Matthew ERHART, Plaintiff, v. BOFI HOLDING, INC., Defendant.

Carol Gillam, Sara Heum, The Gillam Law Firm, Los Angeles, CA, for Plaintiff. Heather Lynn Plocky, Martin David Katz, Polly Towill, Andre J. Cronthall, Sheppard Mullin Richter & Hampton, LLP, Los Angeles, CA, for Defendant.

Cynthia Bashant, United States District Judge

Carol Gillam, Sara Heum, The Gillam Law Firm, Los Angeles, CA, for Plaintiff.

Heather Lynn Plocky, Martin David Katz, Polly Towill, Andre J. Cronthall, Sheppard Mullin Richter & Hampton, LLP, Los Angeles, CA, for Defendant.

ORDER:

(1) GRANTING IN PART AND DENYING IN PART BOFI FEDERAL BANK'S MOTION FOR SUMMARY JUDGMENT (ECF No. 127); AND

(2) GRANTING IN PART AND DENYING IN PART CHARLES ERHART'S MOTION FOR SUMMARY JUDGMENT (ECF No. 137)

Cynthia Bashant, United States District Judge

INTRODUCTION

Charles Erhart was an internal auditor for BofI Federal Bank. After Erhart discovered conduct he believed to be wrongful, he reported it to BofI's principal regulator. BofI responded by allegedly defaming and terminating him. Erhart then filed this lawsuit for whistleblower retaliation under state and federal law. The next morning, The New York Times published an article summarizing the lawsuit's allegations—causing BofI's stock price to plummet. The Bank quickly commenced a countersuit against Erhart claiming he committed fraud, breached his duty of loyalty, and violated state and federal anti-hacking statutes. The Court consolidated BofI's countersuit with Erhart's whistleblower-retaliation action.

Now before the Court are the parties' cross-motions for summary judgment. BofI asks the Court to summarily adjudicate parts of Erhart's whistleblower retaliation claims. (ECF No. 127.) Erhart, in turn, seeks summary judgment on almost all the Bank's claims. (ECF No. 137.) The Court held oral argument on the motions. (ECF No. 175.) For the following reasons, the Court GRANTS IN PART and DENIES IN PART each party's motion.

BACKGROUND

Charles Erhart graduated from The University of Kansas in 2009 with a degree in finance. (Erhart Prelim. Inj. Decl. ¶ 2, ECF No. 158-4.) After briefly working as a financial support analyst, Erhart served as an examiner for the Financial Industry Regulatory Authority for nearly four years. (Id. ¶ 3.) Then, in September 2013, he started working for BofI at its headquarters in San Diego, California. (Erhart Summ. J. Opp'n Decl. ¶ 2, ECF No. 158-2; Joint Statement of Undisputed Facts ("JSUF") ¶ 6, ECF No. 167.)

BofI Federal Bank is a federally chartered savings and loan association. (JSUF ¶ 1.) Its holding company, BofI Holding, Inc., is publicly traded under the Securities Exchange Act of 1934.¹ BofI provides financing for residential properties and small-to-medium size businesses. (Id. ¶ 2.) The Bank also purchases "specialty finance receivables," such as payment streams from structured court settlements and lottery winnings. (Id. ¶¶ 2, 44; see also Erhart Prelim. Inj. Decl. ¶ 12.) The Bank hired Erhart to work as an internal auditor in its Internal Audit Department. (JSUF ¶ 6.)

1 BofI Holding's common stock originally traded on The NASDAQ Global Select Market under Section 12(b) of the Exchange Act. See Axos Financial, Inc., Registration of Securities (Form 8-A) (Sept. 13, 2018). Since this lawsuit was filed, BofI Holding and BofI Federal Bank have rebranded as Axos Financial, Inc. and Axos Bank. (Tolla Decl. ¶ 2, ECF No. 127-2.) The holding company's shares now trade on The New York Stock Exchange. Axos Financial, Inc., Registration of Securities (Form 8-A) (Sept. 13, 2018).
To maintain continuity, the Court refers to these entities by their prior names. And unless the distinction is relevant, the Court uses "BofI" and "the Bank" to refer to either BofI Holding or BofI Federal Bank.

I. The Internal Audit Department

BofI's Internal Audit Department tests, monitors, and reports on the Bank's internal controls. (JSUF ¶¶ 9, 11.) The Office of the Comptroller of the Currency ("OCC") is BofI's primary regulator. (Id. ¶ 4.) The OCC defines internal controls in the banking context as "the systems, policies, procedures, and processes" implemented to "safeguard bank assets, limit or control risks, and achieve a bank's objectives." OCC, Comptroller's Handbook: Internal Control 1 (2001). An audit of BofI's internal controls starts with an internal auditor obtaining "input and supporting documentation from the relevant business unit" and preparing "preliminary conclusions in the form of a draft audit report." (JSUF ¶ 14.) Then, during the "exit meeting" for the audit, "key individuals from Internal Audit and the business unit discuss potential issues raised in the draft report." (Id. ¶ 15.) Once the audit report is finalized, the Vice President ("VP") of Internal Audit distributes the final report to both the business unit and the Audit Committee of the Board of Directors—which oversees the Internal Audit Department. (Id. ¶¶ 12, 18.)

When Erhart joined BofI, Jonathan Ball served as the VP of Internal Audit and managed the Internal Audit Department. (JSUF ¶ 9.) Hence, Erhart reported directly to VP Ball. (Id. ) One level above VP Ball on the corporate hierarchy was John Tolla, Senior Vice President ("SVP") of Audit and Compliance. (Erhart Prelim. Inj. Decl. ¶ 10.)

As an internal auditor, Erhart's job responsibilities included completing assigned audits. (JSUF ¶ 7.) He necessarily had to make inquiries and judgments based on the information available to him. (Id. ¶ 8.) Erhart had not previously done internal audit work. (Erhart Summ. J. Opp'n Decl. ¶ 2.) He thus "received on-the-job training, primarily from Mr. Ball, but also online at ‘Reg U’ and at various Banker Compliance Group seminars." (Id. ) In addition, Erhart "was trained to do Sarbanes–Oxley Act (‘SOX’) testing," and he "knew that the Bank was required to certify its SOX compliance with the CEO and CFO signing off on such a certification on its financials, such as" Form 10-K filed with the SEC. (Id. ¶ 3.)

Erhart worked in BofI's Internal Audit Department for approximately eighteen months. (See Erhart Prelim. Inj. Decl. ¶¶ 9, 53, 72.) The parties tell two diverging stories of his tenure at the Bank.

II. Erhart's Believed Wrongdoing

Erhart's narrative portrays himself as an internal auditor in a turbulent corporate environment. (See Erhart Prelim. Inj. Decl. ¶¶ 9–75.) Time and time again, Erhart claims he repeatedly battled against pressure from senior management as he discovered conduct he believed to be wrongful. (Id. )

For instance, Erhart states he unearthed wrongdoing while conducting the "Structured Settlements and Lottery Audit." (Erhart Prelim. Inj. Decl. ¶¶ 10–16.) As mentioned, one of BofI's revenue sources involves purchasing structured settlements and payment streams to lottery winners. (Id. ¶ 12.) The Bank solicits prospects for this business unit through phone calls and a website. (Id. ) While conducting an audit of this business unit in December 2013, Erhart states he discovered BofI's callers "were not notifying people they called that the calls were being recorded," which Erhart believed violated " California Penal Code § 632." (Id. ¶ 13.)

When senior management became aware of his finding, Erhart claims management instructed him and his supervisor VP Ball to remove the finding from the written audit report. (Erhart Prelim. Inj. Decl. ¶¶ 14–16.) And when he and Ball refused to do so, Erhart further claims that senior management told him to mark the entire report "Attorney Client Privileged" out of a concern that "the finding could be discoverable in class action litigation against the Bank, which would be expensive to defend." (Id. ¶ 16.) Erhart "acceded to this order," but still refused "to remove the finding from the audit." (Id. )

Erhart states he believed this conduct was wrongful because it is "improper to remove findings from audits before they [are] turned over to regulators like the OCC." (Erhart Summ. J. Opp'n Decl. ¶ 6.) He also states he believed the instructions "to remove the finding constituted a violation of SOX, including rules that require adequate internal controls and accurate books and records, as well as constituting fraud on shareholders and regulators." (Id. )

Several other examples of Erhart's believed wrongdoing involve the Bank's interactions with the OCC, including during an onsite regulatory examination. (See Erhart Prelim. Inj. Decl. ¶¶ 32–33, 37–43, 49, 52.) Erhart claims the Bank falsely responded to information requests, withheld information that the OCC had requested, and sought to defraud the regulator. (Id. ¶¶ 32, 33, 39; Erhart Summ J. Opp'n Decl. ¶¶ 13, 15, 17–18.) He also claims the Bank discouraged internal audit staff from communicating in writing during the examination because BofI "did not want a paper trail regarding [its] improprieties." (Erhart Summ J. Opp'n Decl. ¶ 17.)

Erhart describes various other conduct he discovered at BofI that he believed was wrongful. (See generally Erhart Prelim. Inj. Decl. ¶¶ 9–75; Erhart Summ. J. Opp'n Decl. ¶¶ 5–16.) Ultimately, Erhart claims he reported this conduct to the Government, and he contends BofI retaliated against him for raising these concerns—including by harassing, defaming, and firing him. (Erhart Summ. J. Opp'n Decl. ¶¶ 20–21.) As one example, Erhart claims BofI's CEO falsely declared that Erhart's "whistleblower activities were ‘malicious’ " and that any information Erhart provided to the government could not be credible because of his "psychiatric medical leave." (Erhart Prelim. Inj. Decl. ¶¶ 73–74.) The CEO also purportedly claimed "that he was going to ‘bury the whistleblower.’ " (Id. ¶ 74.)

III. The Bank's Counter-Narrative

In contrast, the Bank portrays Erhart as an internal auditor gone rogue—a loose cannon who recklessly handled confidential information and conducted unauthorized investigations. As one example, the Bank claims that Erhart, without authorization, requested that Bank staff run due diligence reports to dig up dirt on other employees, including a bank executive's son. (Tolla Rule 30(b)(6) Dep. 50:13–51:4, ECF No. 155-11; Ball Dep. 329:8–14, ECF No. 155-6.) Erhart's manager, VP Ball, testified that Erhart did not have authority to have these reports run and he did not request permission to do so. (See Ball Dep. 329:8–10, 15–17, ECF No. 155-6.)

As another example, BofI highlights that Erhart obtained its CEO's personal tax returns allegedly as part of a review of employee deposit accounts at the Bank. (Erhart Dep. 639:7–640:14, ECF No. 155-3.) VP Ball did not instruct Erhart to obtain these tax returns, was not aware that Erhart did, and testified it was improper for Erhart to pull the personal returns "at that part of the investigation." (Ball Dep. 318:7–18, ECF No. 155-6.)

The Bank also claims Erhart improperly inserted himself into a payroll audit. The Bank argues it is disputed "if, when, and how Erhart may have been assigned to conduct this audit." (BofI's Opp'n 12:10–11, ECF No. 155.) VP Ball does not recall if Erhart was assigned to this audit and believes Erhart was "corrupting the audit." (Ball Dep. 178:19–183:3, ECF No. 155-6.) The Bank further claims that after he purportedly requested employee bonus information for the payroll audit, Erhart distributed a list of BofI employee stock options and awards to at least one other auditor who was not working on the audit. (Tolla Rule 30(b)(6) Dep. 55:25–57:3, ECF No. 155-11.) A recipient of this list testified that Erhart sent the information because he "wanted us to be aware of all the bonuses that had been granted to all of the employees at BofI Federal Bank." (Grenet Dep. 113:7–13, ECF No. 155-9.) Beyond improperly accessing supposed confidential information, the Bank claims Erhart wrongly took this information from BofI. Erhart admittedly kept documents containing information "in a bag that was buried in [his] closet under a bunch of items." (Erhart Dep. 192:8–13, ECF No. 155-2.) He claims he had permission to take documents home, but this fact is disputed. (Ball Dep. 93:5–15, ECF No. 155-5.) The Bank claims this conduct would be against BofI policy, as everything was supposed to be "kept in the bank or stored in there on the bank's electronic system." (Id. 93:8–10, 261:3–17.) Erhart also put confidential information on a USB drive purportedly without permission and later returned during this lawsuit two USB drives containing confidential information. (Id. 93:11–15, Erhart Dep. 931:14–932:8, ECF No. 155-4.)

IV. Procedural History

In April 2015, Erhart filed a Whistleblower Complaint with the Department of Labor ("DOL")'s Occupational Safety and Health Administration ("OSHA") that alleges he was retaliated against for reporting wrongdoing he discovered at the Bank. (OSHA Whistleblower Compl., ECF No. 158-16.) Then, approximately six months later, Erhart commenced this action, raising federal whistleblower retaliation claims and an assortment of state law causes of action against the Bank. (Erhart's Compl., ECF No. 1.)

Nearly a week after Erhart filed his Complaint, BofI filed a countersuit against Erhart, bringing claims under the Computer Fraud and Abuse Act and various state laws. (BofI's Compl., No. 15-cv-2353-BAS-NLS, ECF No. 1.) The Court consolidated BofI's countersuit with Erhart's whistleblower retaliation action. (ECF No. 22.) Since then, the Court has resolved a medley of motions, and the parties have completed discovery. Now before the Court are the parties' cross-motions for summary judgment.

LEGAL STANDARD

"A party may move for summary judgment, identifying each claim or defense—or the part of each claim or defense—on which summary judgment is sought." Fed. R. Civ. P. 56(a). Summary judgment is appropriate under Rule 56(c) where the moving party demonstrates the absence of a genuine issue of material fact and entitlement to judgment as a matter of law. See Fed. R. Civ. P. 56(c) ; Celotex Corp. v. Catrett , 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). A fact is material when, under the governing substantive law, it could affect the outcome of the case. Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). A dispute about a material fact is genuine if "the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Id. at 248, 106 S.Ct. 2505.

A party seeking summary judgment always bears the initial burden of establishing the absence of a genuine issue of material fact. Celotex , 477 U.S. at 323, 106 S.Ct. 2548. The moving party can satisfy this burden in two ways: (1) by presenting evidence that negates an essential element of the nonmoving party's case; or (2) by demonstrating that the nonmoving party failed to make a showing sufficient to establish an element essential to that party's case on which that party will bear the burden of proof at trial. Id. at 322–23, 106 S.Ct. 2548. "Disputes over irrelevant or unnecessary facts will not preclude a grant of summary judgment." T.W. Elec. Serv., Inc. v. Pac. Elec. Contractors Ass'n , 809 F.2d 626, 630 (9th Cir. 1987).

If the moving party meets this initial burden, the nonmoving party cannot defeat summary judgment merely by demonstrating "that there is some metaphysical doubt as to the material facts." Matsushita Electric Indus. Co., Ltd. v. Zenith Radio Corp. , 475 U.S. 574, 586, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986) ; see also Triton Energy Corp. v. Square D Co. , 68 F.3d 1216, 1221 (9th Cir. 1995) ("The mere existence of a scintilla of evidence in support of the non-moving party's position is not sufficient." (citing Anderson , 477 U.S. at 252, 106 S.Ct. 2505 )). Rather, the nonmoving party must "go beyond the pleadings and by ‘the depositions, answers to interrogatories, and admissions on file,’ designate ‘specific facts showing that there is a genuine issue for trial.’ " Celotex , 477 U.S. at 324, 106 S.Ct. 2548 (quoting former Fed. R. Civ. P. 56(e) ).

When making this determination, the court must view all inferences drawn from the underlying facts in the light most favorable to the nonmoving party. See Matsushita , 475 U.S. at 587, 106 S.Ct. 1348. "Credibility determinations, the weighing of evidence, and the drawing of legitimate inferences from the facts are jury functions, not those of a judge, [when] he [or she] is ruling on a motion for summary judgment." Anderson , 477 U.S. at 255, 106 S.Ct. 2505.

THE BANK'S MOTION

BofI moves for partial summary judgment on Erhart's federal whistleblower retaliation claims and his related state law retaliation and wrongful discharge causes of action. (BofI's Mot., ECF No. 127-1.) The Court will address each claim in turn.

I. Sarbanes–Oxley § 806, 18 U.S.C. § 1514A

Erhart's first claim alleges BofI retaliated against him in violation of Sarbanes–Oxley § 806, 18 U.S.C. § 1514A. (Erhart's Second Am. Compl. ("SAC") ¶¶ 76–87, ECF No. 124.) Congress enacted the Sarbanes–Oxley Act of 2002, Pub. L. No. 107-204, 116 Stat. 745, to "safeguard investors in public companies and restore trust in the financial markets following the collapse of Enron Corporation." Lawson v. FMR LLC , 571 U.S. 429, 432, 134 S.Ct. 1158, 188 L.Ed.2d 158 (2014) (citing S. Rep. No. 107-146, at 2–11 (2002)). In seeking to prevent corporate fraud, Congress was particularly concerned with the "abundant evidence that Enron had succeeded in perpetuating its massive shareholder fraud in large part due to a ‘corporate code of silence.’ " Id. at 435, 134 S.Ct. 1158 (citing S. Rep. No. 107-146, at 2, 4–5 (2002)). This code of silence discouraged employees from reporting fraudulent behavior, and employees who attempted to report misconduct faced retaliation. Id. (citing S. Rep. No. 107-146, at 2, 5, 10 (2002)).

To address this issue, Section 806 of Sarbanes–Oxley created a new whistleblower protection provision, 18 U.S.C. § 1514A. Lawson , 571 U.S. at 435, 134 S.Ct. 1158. This provision, as amended, provides:

No [publicly-traded] company ... may discharge ... or in any other manner discriminate against an employee in the terms and conditions of employment because of any lawful act done by the employee—

(1) to provide information ... regarding any conduct which the employee reasonably believes constitutes a violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities or commodities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders, when the information or assistance is provided to

or the investigation is conducted by

(A) a Federal regulatory or law enforcement agency;

(B) any Member of Congress or any committee of Congress; or

(C) a person with supervisory authority over the employee ....

18 U.S.C. § 1514A(a). Notably, Sarbanes–Oxley does not provide whistleblower protection for any reported company misconduct. See id. The conduct must constitute a believed violation specifically enumerated in the statute. Id.

As mentioned, Erhart claims BofI violated § 1514A by retaliating against him for reporting conduct he believed to be wrongful to the Government. (Erhart's SAC ¶¶ 76–87.) He describes a little over a dozen instances of believed misconduct involving the Bank. (See Erhart Prelim. Inj. Decl. ¶¶ 10–46, Erhart Summ. J. Opp'n Decl. ¶¶ 4–20.) In construing the evidence in the light most favorable to Erhart, the Court categorizes the believed misconduct as follows:

1st Category:	Corrupted Structured Settlements & Lottery Audit
2nd Category:	Altered Financial Statements
3rd Category:	Untimely 401(k) Payments
4th Category:	Improper Strategic Plan Approval
5th Category:	High Deposit Concentration Risk
6th Category:	Misleading Response to SEC Subpoena
7th Category:	Undisclosed Customer Accounts
8th Category:	Undisclosed Subpoenas
9th Category:	Unauthorized Risky Loans
10th Category:	Miscalculated Allowance for Loan & Lease Losses ("ALL")
11th Category:	Incomplete Flood Disaster Protection Act ("FDPA") Audit
12th Category:	Sanitized Global Cash Card Review
13th Category:	Improprieties in CEO's Account
14th Category:	Improprieties in CEO's Brother's Account

The Court underscores, however, that in labeling Erhart's beliefs, the Court is not drawing any conclusions about the legality of the Bank's conduct. See Van Asdale v. Int'l Game Tech. , 577 F.3d 989, 1001 (9th Cir. 2009). The Bank raises several challenges to Erhart's Sarbanes–Oxley claim.

A. Exhaustion of Administrative Remedies

The Court first addresses BofI's request for partial summary judgment on Erhart's Sarbanes–Oxley claim based on § 1514A's exhaustion requirement. (BofI's Mot. 48:14–50:19.) "Because exhaustion requirements are designed to deal with parties who do not want to exhaust, administrative law creates an incentive for these parties to do what they would otherwise prefer not to do, namely, to give the agency a fair and full opportunity to adjudicate their claims." Woodford v. Ngo , 548 U.S. 81, 90, 126 S.Ct. 2378, 165 L.Ed.2d 368 (2006). The "law does this by requiring proper exhaustion of administrative remedies, which ‘means using all steps that the agency holds out, and doing so properly (so that the agency addresses the issues on the merits).’ " Id. (quoting Pozo v. McCaughtry , 286 F.3d 1022, 1024 (7th Cir. 2002) ).

To pursue a Sarbanes–Oxley whistleblower retaliation claim, a plaintiff must first initiate an administrative action by filing a complaint with the Secretary of Labor. 18 U.S.C. § 1514A(b)(1)(A). The Secretary of Labor has delegated the responsibility for investigating and initially adjudicating the complaint to OSHA. Lawson , 571 U.S. at 436, 134 S.Ct. 1158 (citing 78 Fed. Reg. 3918 (2013) ).

The claimant may appeal OSHA's determination to an administrative law judge and ultimately the DOL's Administrative Review Board ("ARB"). Lawson , 571 U.S. at 436–37, 134 S.Ct. 1158 (citing 29 CFR §§ 1980.104 to 1980.110). "[T]he ARB's determination on a § 1514A claim constitutes the agency's final decision and is reviewable in federal court under the standards stated in the Administrative Procedure Act, 5 U.S.C. § 706." Id. at 437, 134 S.Ct. 1158. "If, however, the ARB does not issue a final decision within 180 days of the filing of the complaint, and the delay is not due to bad faith on the claimant's part, the claimant may proceed to federal district court for de novo review." Id. (citing 18 U.S.C. § 1514A(b) ).

Erhart filed a Whistleblower Complaint with OSHA on April 14, 2015. (OSHA Whistleblower Compl., ECF No. 158-16.) He then filed this action on October 13, 2015. (ECF No. 1.) Hence, there is no dispute that Erhart first commenced the administrative process and then appropriately waited at least 180 days to file his district court complaint. See 18 U.S.C. § 1514A(b)(1)(B).

1. Partial Exhaustion

Although Erhart filed an administrative complaint, BofI argues that Erhart's district court complaint is still improper on partial exhaustion grounds. The Bank claims his complaint impermissibly exceeds the scope of the administrative filing by identifying "six new categories" of conduct Erhart believed was wrongful. (BofI's Mot. 50:2–19.) Consequently, BofI argues these categories are unexhausted and this Court "lacks statutory jurisdiction" over part of Erhart's claim. (Id. ) BofI has previously raised this partial exhaustion argument.²

2 BofI moved to strike various allegations from Erhart's initial Complaint based on exhaustion of administrative remedies. (ECF No. 3.) Because the Court dismissed Erhart's Complaint, the Court denied the request. (ECF No. 22.)
BofI renewed its motion to strike when the Bank attacked Erhart's First Amended Complaint. (ECF No. 35.) The Court again denied BofI's request, reasoning that even if Erhart failed to fully exhaust his administrative remedies, the allegations at issue were properly included in his pleading to support his claims that were not subject to an exhaustion requirement—like his California state law whistleblower retaliation claim. (ECF No. 44.)
BofI later again raised the exhaustion issue when moving for judgment on the pleadings. (ECF No. 78-1.) In response, Erhart requested permission to submit additional evidence regarding his OSHA filing. (ECF No. 84.) Because resolving this issue likely required considering Erhart's additional evidence, the Court said it preferred to make a decision without the constraints of a pleadings motion. (ECF No. 123.) The Court thus stated BofI could renew this argument in its forthcoming summary judgment motion. (Id. )

The Court is unaware of any binding authority addressing a partial exhaustion issue in the Sarbanes–Oxley context.³ The Court initially notes that the DOL's regulations for retaliation complaints under § 1514A provide that "[n]o particular form of complaint is required." 29 C.F.R. § 1980.103(b). Indeed, a complaint may even be made orally, in which case the complaint "will be reduced to writing by OSHA." Id. This "absence of formal pleading requirements" means "complaints in OSHA administrative proceedings are not expected to meet the standards of pleading that apply to claims filed in federal court under Rule 12(b)(6)." Wadler v. Bio-Rad Labs., Inc. , 141 F. Supp. 3d 1005, 1020 (N.D. Cal. 2015) ; accord Sharkey v. J.P. Morgan Chase & Co. , 805 F. Supp. 2d 45, 53 (S.D.N.Y. 2011). That said, "an exhaustion requirement would be meaningless if the complainant were free to litigate claims bearing little or no connection to the preceding administrative complaint." Jones v. Southpeak Interactive Corp. of Del. , 777 F.3d 658, 669 (4th Cir. 2015).

3 In an unpublished decision, Curtis v. Century Surety Co. , 320 F. App'x 546, 548 (9th Cir. 2009), the Ninth Circuit concluded the district court did not err in granting summary judgment based on the exhaustion requirement where the plaintiff failed to file an administrative complaint altogether. See also Order, Curtis v. Century Sur. Co. , No. 05-1538-PHX-ROS, (D. Ariz. Aug. 24, 2006), ECF No. 39.

Accordingly, several approaches have been used when a defendant argues the lawsuit exceeds the scope of the OSHA complaint. One district court examined whether the administrative complaint provided the opposing party "fair notice" of the charges against it.⁴ Another district court reasoned the "appropriate inquiry" is "not whether every fact forming the basis for the belief that gave rise to a plaintiff's protected activity was previously administratively pled, but whether each separate and distinct claim was pled before the agency." Wong v. CKX, Inc. , 890 F. Supp. 2d 411, 418 (S.D.N.Y. 2012) (quoting Sharkey , 805 F. Supp. 2d at 53 ).

4 Relying on an administrative decision, the court reasoned an administrative complaint "is sufficient so long as the whistleblower complainants give an opposing party ‘fair notice’ of the charges against it." Wadler , 141 F. Supp. 3d at 1020. This standard requires only that an administrative complaint "provide (1) some facts about the protected activity, showing some ‘relatedness’ to the laws and regulations of one of the statutes in [the agency's] jurisdiction, (2) some facts about the adverse action, (3) a general assertion of causation and (4) a description of the relief that is sought." In re Evans v. EPA , 2012 WL 3164358, at *6 (DOL Adm. Rev. Bd., July 31, 2012).

As another approach, the Fourth and Fifth Circuits looked to their jurisprudence under Title VII of the Civil Rights Act to inform the Sarbanes–Oxley exhaustion inquiry. Analogous to Sarbanes–Oxley's regime, Title VII requires a plaintiff to file a discrimination charge with the Equal Employment and Opportunity Commission ("EEOC"). See 42 U.S.C. § 2000e–16(c). Thus, the Fourth Circuit relied on its Title VII standard, which provides "the litigation may encompass claims ‘reasonably related to the original [administrative] complaint, and those developed by reasonable investigation of the original complaint.’ " Jones , 777 F.3d at 669 (quoting Evans v. Techs. Applications & Serv. Co. , 80 F.3d 954, 963 (4th Cir. 1996) ). The Fifth Circuit also applied its Title VII standard to Sarbanes–Oxley and similarly noted: "The scope of a judicial complaint is limited to the sweep of the OSHA investigation that can reasonably be expected to ensue from the administrative complaint." Wallace v. Tesoro Corp. , 796 F.3d 468, 476 (5th Cir. 2015).

The Court finds this latter approach persuasive and will similarly look to the Ninth Circuit's Title VII cases for guidance. The "scope of a Title VII claimant's court action depends upon the scope of both the EEOC charge and the EEOC investigation." Sommatino v. United States , 255 F.3d 704, 708 (9th Cir. 2001). The district court may entertain "any charges of discrimination that are ‘like or reasonably related’ to the allegations in the EEOC charge, or that fall within the ‘EEOC investigation which can reasonably be expected to grow out the charge of discrimination.’ " Id. (quoting Deppe v. United Airlines , 217 F.3d 1262, 1267 (9th Cir. 2000) ). Adapting this standard here, the permissible scope of Erhart's lawsuit covers "any charges of [retaliation] that are ‘like or reasonably related’ to the allegations in the [OSHA Complaint], or that fall within the ‘[OSHA] investigation which can reasonably be expected to grow out of the charge of [retaliation]." See id.

2. Scope of Erhart's OSHA Filing

Erhart's form OSHA Complaint alleges BofI began retaliating against him on January 14, 2015. (OSHA Whistleblower Compl. ¶ 22.) When asked to describe why he believes BofI was retaliating against him, Erhart's administrative complaint alleges:

I believe the Bank has been committing securities fraud, wire fraud, mail fraud, fraud on its shareholders, violations of SEC rules and regulations, and other violations of the Dodd-Frank Wall Street Reform and Consumer Protection Act, and the Sarbanes–Oxley Act (I have extensive information regarding these).

Management found my internal audit memo to my boss in his email, and then unlocked my file cabinets, finding my documentation of potential tax evasion by CEO Garrabrants, then called me "malicious" in staff meetings[.]

Because I reported to the SEC that the Bank had withheld material information from them, and also did so to the Office

of the Controller of Currency that was investigating the Bank; and because I told Bank management that I had done so; to intimidate me from looking into unlawful activities at the Bank, and from reporting those to authorities; because I refused to engage in certain unlawful activities; to retaliate against me for what it believed I had done; and to send a message to other employees about what will happen if they do what I have done, or allegedly have done.

(Id. ¶ 25.)

BofI argues the OSHA Complaint fails to exhaust "six new categories" of believed misconduct that now appear in Erhart's Second Amended Complaint. (BofI's Mot. 50:2–6.) The challenged allegations correspond with the following categories the Court has identified:

1st Category:	Corrupted Structured Settlements & Lottery Audit(See Erhart's SAC ¶¶ 11–16)
2nd Category:	Altered Financial Statements(See id. ¶ 17)
3rd Category:	Untimely 401(k) Payments(See id. ¶ 18)
4th Category:	Improper Strategic Plan Approval(See id. ¶¶ 19–21)
9th Category:	Unauthorized Risky Loans(See id. ¶ 34)
10th Category:	Miscalculated ALL(See id. ¶ 36)

(See BofI's Mot. 50:2–6.)

In response, Erhart highlights that he submitted his Whistleblower Complaint to OSHA with a cover letter that also enclosed a thumb drive of documents related to his allegations. (Gillam Decl. ¶ 3, Ex. P.) Erhart's counsel—who helped Erhart prepare his administrative complaint—declares that this thumb drive contained "the same documents Mr. Erhart had submitted to the OCC in early March 2015." (Gillam Decl. ¶ 2.)

One of these accompanying documents is titled "Notes for Whistleblower Discussion with OCC on March 9, 2015 at 1:30 PM Pacific Time." (OCC Whistleblower Notes, ECF No. 174-10.) This fifteen-page, typewritten document includes Erhart's "Recent Timeline of Events" and "Summary of Key Issues." (Id. ) The key issues summary includes sub-headers and factual allegations that correspond with five out of six of the categories challenged on exhaustion grounds:

• "Recording Phone Calls in violation of California Penal Code 632" (1st Category);

• "Untimely contributions made for employee 401k elective deferrals" (3rd Category);

• "Business Plan Audit - Board Approval of Fiscal 2015 Strategic Plan Inaccuracies" (4th Category);

• "Expanded Scope Loan Originations Audit Reveals Major [Know Your Customer] Concerns" and "[Bank Secrecy Act personnel] identifying issues with Loans, primarily regarding Politically Exposed Persons" (9th Category); and

• "The Bank had not and may still not be calculating ALL correctly" (10th Category).

(Id. ) Erhart effectively concedes that the documents he submitted did not mention "the altered financials allegation factual predicate"—the 2nd Category and remaining item challenged on exhaustion grounds. (See Erhart's Opp'n 44:25–45:2, ECF No. 158.)

Given the standard the Court adopted above, Erhart adequately rebuts BofI's motion for five out of the six challenged categories. Erhart's OSHA Complaint is admittedly imprecise; it claims he has "extensive information regarding" the believed violations of law. (OSHA Compl. ¶ 25.) Considering the breadth of his allegations, Erhart ideally would have included his "summary of key issues" in his OSHA Complaint or expressly incorporated the summary by reference. But his OSHA Complaint is "not expected to meet the standards of pleading that apply to claims filed in federal court under Rule 12(b)(6)." See Wadler , 141 F. Supp. 3d at 1020 ; accord Sharkey , 805 F. Supp. 2d at 53. And "[n]o particular form of complaint is required." 29 C.F.R. § 1980.103(b). Moreover, a reasonable investigation of the OSHA Complaint would encompass at least skimming the items Erhart submitted with his pleading. A cursory review would discover Erhart's factual timeline and "summary of key issues," which are in a document invitingly titled "Notes for Whistleblower Discussion with OCC." (OCC Whistleblower Notes.) BofI argues "no authority supports the proposition that merely submitting a thumb drive of raw documents and data to OSHA satisfies the exhaustion requirement's pleading requirement such that a court has jurisdiction over every conceivable claim that might be premised on the contents of any and all documents on the drive." (BofI's Reply 20:11–14, ECF No. 164.) The Court agrees. The agency cannot be expected to interpret a heap of e-mails and spreadsheets to determine what Erhart believed was wrong. That said, Erhart's factual timeline and summary of "key issues" is not "raw data," and it sufficiently aligns with almost all of his challenged district court allegations.

Moreover, the record does not establish Erhart "was trying to circumvent the Sarbanes–Oxley Act exhaustion requirement." See Jones , 777 F.3d at 669. He could have more skillfully completed his administrative pleading, but Sarbanes–Oxley's "exhaustion requirement should not become a tripwire for hapless plaintiffs." Id. Hence, BofI is not entitled to summary judgment for those categories of believed misconduct that Erhart included with his administrative filing.

That said, the Court draws the line at Erhart's allegations underlying the 2nd Category regarding potentially altered financial statements. (See Erhart's SAC ¶ 17.) Erhart's OSHA Complaint did not mention this conduct, and his submission did not contain "documents related to ... the altered financials allegation factual predicate." (Erhart's Opp'n 44:25–27.) Nor do his whistleblower discussion notes mention the challenged allegation. (See OCC Whistleblower Notes.) Erhart has failed to demonstrate that this conduct falls within the scope of his OSHA Complaint or a reasonable investigation flowing from the complaint. Hence, summary adjudication on exhaustion grounds for this item is warranted.

In sum, the Court denies the Bank's request to summarily adjudicate five of the conduct categories for Erhart's Sarbanes–Oxley claim on exhaustion grounds. The Court grants partial summary judgment in BofI's favor on Erhart's Sarbanes–Oxley claim with respect to his allegations regarding alteration of financial statements because he did not exhaust this issue.

B. Protected Activity

Beyond its exhaustion challenge, BofI seeks a determination that twelve categories of conduct identified by Erhart do not constitute protected activity as a matter of law under Sarbanes–Oxley. (BofI's Mot. 8:22–38:6.) This sweeping challenge involves a labyrinth of securities laws, accounting-related regulations, and banking compliance provisions. To establish a framework, the Court first reviews the reasonable belief standard for claims under § 1514A. Next, the Court explores how Erhart's claim would function before a jury. Third, the Court provides an overview of several rules that Erhart relies upon to explain why he believed the Bank's conduct was wrongful. Finally, the Court turns to assessing BofI's discrete challenges.

1. Reasonable Belief Standard

Whistleblower retaliation claims under Sarbanes–Oxley "are governed by a burden-shifting procedure under which the plaintiff is first required to establish a prima facie case of retaliatory discrimination." Tides v. Boeing Co. , 644 F.3d 809, 813–14 (9th Cir. 2011). To make a prima-facie showing, the plaintiff must show that (1) the plaintiff engaged in protected activity; (2) the plaintiff's employer knew, actually or constructively, of the protected activity; (3) the plaintiff suffered an unfavorable personnel action; and (4) the circumstances raise an inference that the protected activity was a contributing factor to the unfavorable action. Id. at 814 (citing Van Asdale , 577 F.3d at 996 ); see also 29 C.F.R. § 1980.104(e)(2)(i)–(iv). If the plaintiff makes this showing, then "the employer assumes the burden of demonstrating by clear and convincing evidence that it would have taken the same adverse employment action in the absence of the plaintiff's protected activity." Van Asdale , 577 F.3d at 996.

Erhart, then, must first demonstrate that he engaged in protected activity under Sarbanes–Oxley. The anti-retaliation statute protects an employee who "provide[s] information ... regarding any conduct which the employee reasonably believes constitutes a violation of section 1341 [mail fraud], 1343 [wire fraud], 1344 [bank fraud], or 1348 [securities or commodities fraud], any rule or regulation of the Securities and Exchange Commission, or any provision of Federal law relating to fraud against shareholders ...." 18 U.S.C. § 1514A(a)(1). The second to last segment, "any rule or regulation of the [SEC]," refers only to "administrative rules or regulations"—not statutes. See Wadler v. Bio-Rad Labs., Inc. , 916 F.3d 1176, 1186–87 (9th Cir. 2019).

To establish protected activity, an employee does "not have to prove that he reported an actual violation." See Wadler , 916 F.3d at 1186–87 (citing Van Asdale , 577 F.3d at 1001 ; Sylvester v. Parexel Int'l LLC , No. 07-123, 2011 WL 2517148, at *14 (Dep't of Labor May 25, 2011) ). Rather, the employee has "to prove only that he ‘reasonably believed that there might have been’ a violation." See id. at 1187 (quoting Van Asdale , 577 F.3d at 1001 ). The statute also protects an employee who has a reasonable but mistaken belief that there might have been a violation of one of the laws listed in § 1514A. Van Asdale , 577 F.3d at 1001. The Ninth Circuit has described this "reasonable belief" standard "as a ‘minimal threshold requirement.’ " Wadler , 916 F.3d at 1187 (quoting Van Asdale , 577 F.3d at 1001 ).

The "reasonable belief" standard includes both a subjective component and an objective component. E.g. , Wadler , 916 F.3d at 1187–88, Van Asdale , 577 F.3d at 1000. For the subjective component, the employee must demonstrate he believed the conduct reported violated one of the categories in § 1514A. Van Asdale , 577 F.3d at 1000. "The objective reasonableness component ... ‘is evaluated based on the knowledge available to a reasonable person in the same factual circumstances with the same training and experience as the aggrieved employee.’ " Wadler , 916 F.3d at 1188 (quoting Sylvester , 2011 WL 2517148, at *12 ). This evaluation "requires an examination of the reasonableness of a complainant's beliefs, but not whether the complainant actually communicated the reasonableness of those beliefs to management or the authorities." Id. (quoting Sylvester , 2011 WL 2517148, at *13 ).

This reasonable person standard recognizes that "[m]any employees are unlikely to be trained to recognize legally actionable conduct by their employers." Nielsen v. AECOM Tech. Corp. , 762 F.3d 214, 221 (2d Cir. 2014). Accordingly, "the inquiry into whether an employee had a reasonable belief is necessarily fact-dependent, varying with the circumstances of the case." Rhinehimer v. U.S. Bancorp Invs., Inc. , 787 F.3d 797, 811 (6th Cir. 2015) ; accord Wadler , 916 F.3d at 1188.

2. Wadler v. Bio-Rad Labs., Inc.

Exploring how Erhart's Sarbanes–Oxley claim would function at trial further informs the Court's summary judgment inquiry. The Ninth Circuit's decision in Wadler v. Bio-Rad Labs., Inc. , 916 F.3d 1176 (9th Cir. 2019), is helpful. There, the district court held a trial on a Sarbanes–Oxley retaliation claim. Id. at 1184. The segment of laws enumerated in § 1514A at issue was "any rule or regulation of the" SEC. Id. Hence, after instructing the jury on the elements of the retaliation claim and the reasonable belief requirement, the court further instructed the jury as to the relevant rules or regulations of the SEC. Id. ⁵ Relying on the Foreign Corrupt Practices Act ("FCPA"), the court explained that it was illegal to, among other things, bribe a foreign official and fail to keep accurate and reasonably detailed books and records. Id.

5 See also Am. Jury Instructions, No. 15-cv-02356-JCS, Wadler v. Bio-rad Labs. Inc. , (N.D. Cal. Feb. 3, 2017), ECF No. 217.

On appeal from a verdict in the plaintiff's favor, the Ninth Circuit held the district court made an instructional error regarding the Sarbanes–Oxley claim. 916 F.3d at 1186–87. The Ninth Circuit highlighted that in § 1514A, "Congress uses the phrase ‘any rule or regulation of the [SEC]’ in the same list in which it uses ‘any provision of Federal law relating to fraud against shareholders,’ " indicating "there is a difference between the meaning of ‘rule or regulation’ and ‘law.’ " Id. at 1186 (alteration in original). The plain interpretation is that " ‘law’ encompasses statutes, like the FCPA, whereas ‘rule or regulation’ does not." Id. Thus, the district court erred in instructing the jury that statutory provisions of the FCPA are "rules or regulations of the SEC" under § 1514A.⁶ Id. at 1187.

6 However, the Ninth Circuit remanded for the district court to determine if there should be a new trial because the SEC has a regulation based on the FCPA that forbids falsifying records. 916 F.3d at 1188–89. The Ninth Circuit also told the district court to consider whether the FCPA's provisions could fall under the last segment of laws in § 1514A, "any other federal law relating to fraud against shareholders." See id. at 1189. The case settled upon remand. Order Dismissing Case, No. 15-cv-02356-JCS, Wadler v. Bio-rad Labs. Inc. , (N.D. Cal. Sept. 25, 2019), ECF No. 268.

Notwithstanding the district court's instructional error, Wadler confirms that Erhart's beliefs must be tied to at least one segment of laws in § 1514A to support his Sarbanes–Oxley claim. The Court will have to tell the jury what the underlying law prohibits. Erhart therefore cannot broadly argue that he objectively believed there were violations of "any rule or regulation of the [SEC]" or "any provision of Federal law relating to fraud against shareholders." See 18 U.S.C. § 1514A. This Court should not be expected to—and realistically cannot—"go fishing through securities law and regulation for provisions [Erhart] may have believed were violated." See Lamb v. Rockwell Automation, Inc. , 249 F. Supp. 3d 904, 915 n.4 (E.D. Wis. 2017) ; accord Day v. Staples, Inc. , 555 F.3d 42, 57 n.14 (1st Cir. 2009) (refusing to consider § 1514A argument based on "unspecified ... SEC regulations"). The Court has previously warned Erhart that for his Sarbanes–Oxley claim to be viable, his beliefs must be tethered to the segments of laws listed in § 1514A. (ECF No. 22.) Hence, although Erhart did not have to cite a code section or rule when engaging in protected activity, he now—with the aid of counsel—must demonstrate to the Court that the jury could conclude he reasonably believed the conduct he reported violated a law that is covered by § 1514A. If he cannot meet this burden, summary judgment in BofI's favor is appropriate.

3. Erhart's § 1514A Rules

To that end, Erhart proposes several rules that he argues fall under § 1514A's scope and fit BofI's alleged misconduct. Because Erhart frequently relies upon these rules to argue his beliefs of wrongdoing were objectively reasonable, the Court considers them before turning to the Bank's arguments.

i. Books-and-Records Rule

The first rule Erhart relies upon is rooted in the FCPA. Congress enacted the FCPA "to stop bribery of foreign officials and political parties by domestic corporations." Clayco Petrol. Corp. v. Occidental Petrol. Corp. , 712 F.2d 404, 408 (9th Cir. 1983). The FCPA amended the Securities Exchange Act by adding (1) anti-bribery provisions and (2) auditing and accounting provisions. Pub. L. No. 95-213, §§ 102–04, 91 Stat. 1494, 1494–98 (1977). One of the accounting provisions, Exchange Act § 13(b), provides:

(2) Every issuer which has a class of securities registered pursuant to [ 15 U.S.C. § 78l ] and every issuer which is required to file reports pursuant to [ 15 U.S.C. § 78o (d) ] shall–

(A) make and keep books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer[.]

....

(5) No person shall knowingly ... falsify any book, record, or account described in paragraph (2).

15 U.S.C. § 78m(b)(2)(A), (b)(5). Further, willfully falsifying books and records is a crime. See id. § 78ff(a).

The books-and-records provision in Exchange Act § 13(b) also has a corresponding SEC rule, which Erhart frequently relies upon in his opposition. (See Erhart's Opp'n 38:28–39:1 (citing 17 C.F.R. § 240.13b2–1 ).)⁷ Titled "Falsification of accounting records," this rule provides: "No person shall directly or indirectly, falsify or cause to be falsified, any book, record or account subject to section 13(b)(2)(A) of the Securities Exchange Act." 17 C.F.R. § 240.13b2–1. The Court will refer to this item as the "Books-and-Records Rule."

7 (See also id. 4:15–16; 4:25–27, 8:18–20; 10:26–28; 14:4–5; 37:26–27; 38:7–9; 39:8–13; Erhart Summ. J. Decl. ¶¶ 6, 10.)

For example, in United States v. Reyes , 577 F.3d 1069, 1072 (9th Cir. 2009), Stephanie Jensen, a corporate executive, committed a books-and-records violation by falsifying corporate minutes as part of "a scheme to reward employees with grants of backdated stock options." "The options were backdated to a time when the company's stock price was low, but the options were not recorded on the company's books as an expense of the corporation, so the books showed the corporation to be more profitable than it was." Id. at 1072–73.

After being convicted, Jensen moved for a new trial, arguing Exchange Act § 13(b)(2)(A) was unconstitutionally vague when applied to her case. United States v. Jensen , 532 F. Supp. 2d 1187, 1195 (N.D. Cal. 2008). The district court rejected this argument, reasoning the statutory books-and-records provision "is laudably clear: it prohibits a person from falsifying a particular type of corporate book or record." Id. at 1196. Thus, when applied to Jensen's case, "a person of ordinary intelligence would be able to determine that helping to create false committee meeting minutes that have the effect of understating corporate expenses constitutes the falsification of a record that ‘reflect[s] the transactions and dispositions of the assets of the issuer.’ " Id. at 1196–97 (emphasis added) (quoting 15 U.S.C. § 78m(b)(2)(A) ).

As another illustration, in Wadler , discussed above, the Ninth Circuit held there was "sufficient evidence to support the objective reasonableness of" the plaintiff general counsel's belief that his employer "had falsified books and records."⁸ 916 F.3d at 1188. The plaintiff's belief was based in part on an audit of sales documentation that revealed the employer owed $30 million in royalty obligations due to "missing documentation of end-user prices for products." Id. at 1182. There was also evidence of employees entering into unauthorized contracts with distributors that provided improper incentives with a financial impact of up to $1 million. Id. The Ninth Circuit rationalized that a reasonable jury "could find that a general counsel in [the plaintiff]'s position reasonably believed that" his employer "was falsifying books and records as part of its alleged FCPA violations." Id. at 1188.

8 As the Court discussed, the Ninth Circuit determined the district court improperly instructed the jury that the FCPA's books-and-records provision—Exchange Act § 13(b)—was a "rule or regulation of the" SEC under 18 U.S.C. § 1514A. Wadler , 916 F.3d at 1186–87. But the Ninth Circuit noted the Books-and-Records Rule based on the statutory provision is such "an SEC regulation within the scope of" § 1514A. Id. at 1185.

In sum, the Books-and-Records Rule prohibits the falsification of a corporate record that is necessary to accurately and fairly reflect the transactions and dispositions of the assets of the company in reasonable detail. And this rule falls under § 1514A because it is a "rule or regulation of the [SEC]." See 18 U.S.C. § 1514A ; see also Wadler , 916 F.3d at 1185.

ii. Internal Controls Rule

The Court will refer to the next rule Erhart relies upon as the "Internal Controls Rule." (See Erhart's Opp'n 39:1–2 (citing Exchange Act § 13(b)(2) and SEC Rule 13a–15).)⁹ The rule he references requires certain issuers of securities to maintain "internal control over financial reporting." 17 C.F.R. § 240.13a–15(a).¹⁰ Under the regulation:

9 (See also Erhart's Opp'n 4:1, 15; 4:26–27; 7:15; 8:19; 12:8; 14:5; 16:19; 34:13–14; 35:7–8; 37:25; 38:6–7; 41:19–20; Erhart Summ. J. Decl. ¶¶ 6, 10, 11, 14, 16.)

10 The Court recognizes that this regulation also requires certain securities issuers to maintain "disclosure controls and procedures." 17 C.F.R. § 240.13a–15(a). "[I]nternal control over financial reporting" and "disclosure controls and procedures" are different concepts with separate definitions in the regulation. Id. § 240.13a–15(a), (e), (f). Erhart does not mention "disclosure controls and procedures" anywhere in his opposition or evidentiary submissions. Consequently, the Court does not consider this concept throughout this order.

The term internal control over financial reporting is defined as a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

(1) Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions

and dispositions of the assets of the issuer;

(2) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and

(3) Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements.

Id. § 240.13a–15(f).

In adopting this rule, the SEC elaborated on the scope of a company's required internal control system. In Re Mgmt.'s Report on Internal Control over Fin. Reporting & Certification of Disclosure in Exch. Act Periodic Reports , Release No. 8238, 80 S.E.C. Docket 1014, 2003 WL 21294970 (June 5, 2003). The SEC noted:

A few of the commenters urged us to adopt a considerably broader definition of internal control that would focus not only on internal control over financial reporting, but also on internal control objectives associated with enterprise risk management and corporate governance. While we agree that these are important objectives, the definition that we are adopting retains a focus on financial reporting[.]

Id. at *7. Hence, the SEC's internal control definition does not broadly require "compliance with applicable laws and regulations," but the definition does require "compliance with the applicable laws and regulations directly related to the preparation of financial statements, such as the Commission's financial reporting requirements." Id. at *8. This commentary confirms what is already plain from the rule's text: the rule concerns ensuring "the reliability of financial reporting and the preparation of financial statements." 17 C.F.R. § 240.13a–15(f) ; see also 15 U.S.C. § 78m(b)(2)(B) (requiring issuers to "devise and maintain a system of internal accounting controls"). Consequently, the Internal Controls Rule is much more limited in scope than the OCC's banking definition of "internal controls" that the Court mentioned above. Compare 17 C.F.R. § 240.13a–15(f), with OCC, Comptroller's Handbook: Internal Control 1 (2001).

The plaintiff's Sarbanes–Oxley claim in Thomas v. Tyco International Management Co. , 416 F. Supp. 3d 1340 (S.D. Fla. 2019), illustrates a potential violation of this rule. The plaintiff was the manager for financial reporting for the defendant's North America businesses. Id. at 1346. She reported concerns "about a proper segregation of duties in the financial reporting team" and weaknesses in a monthly financial "tie-out" process that could "translate[ ] into material weaknesses in the corporation's financial statements." Id. at 1348–49. Although the plaintiff's whistleblower retaliation claim ultimately did not survive summary judgment on other grounds, the district court concluded "that a genuine issue of material fact exist[ed] as to whether [the plaintiff] reasonably believed that she was engaging in protected conduct each time she raised issues regarding [the defendant's] lack of internal controls regarding financial management." Id. at 1361.¹¹ In sum, the Internal Controls Rule requires a regulated company to maintain a system that provides reasonable assurance regarding the reliability of financial reporting and the preparation of external financial statements. The system must include policies and procedures regarding certain items, including providing reasonable assurance that expenditures are made only in accordance with management's authorization. The rule does not, however, broadly require compliance with all laws or corporate risk management objectives. And like the Books-and-Records Rule, the Internal Controls Rule falls under § 1514A because it is a "rule or regulation of the [SEC]." See 18 U.S.C. § 1514A.

11 The Court notes the underlying theory of liability in Tyco for a violation of internal controls was slightly different than that presented in this case. See id. at 1348 n.10. The Tyco plaintiff believed the defendant was violating Sarbanes Oxley § 404, 15 U.S.C. § 7262, which provides the SEC must adopt rules that require a covered company's annual report to "(1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contain an assessment ... of the effectiveness of the internal control structure and procedures of the issuer for financial reporting." 15 U.S.C. § 7262. For purposes of illustration, however, Tyco is comparable because 15 U.S.C. § 7262 and the Internal Controls Rule concern the same set of required internal controls over financial reporting.

iii. Shareholder Fraud

Third, Erhart frequently raises the specter of potential shareholder fraud. (Erhart's Opp'n 1:19–20.)¹² The Ninth Circuit considered a shareholder fraud theory in the context of § 1514A in Van Asdale v. International Game Technology , 577 F.3d 989 (9th Cir. 2009). There, two plaintiffs worked as in-house counsel for "a publicly-traded, Nevada-based company specializing in computerized gaming machines and similar products." Id. at 991. The gaming company began merger negotiations with another gaming entity, and the gist of the plaintiffs' lawsuit was that they "were terminated for reporting possible shareholder fraud in connection with that merger." Id. at 992. In short, the merger partner had a valuable patent on the use of a wheel with a slot machine. Id. But there was concern before the merger that this patent might be subject to invalidation by a competitor's prior art. Id. After the merger, it was revealed that the merger partner may have known of problematic prior art; meaning, "the benefits of the merger may have been overvalued." Id. at 993. After the plaintiffs expressed this concern to the newly-merged company's management—which included officers from the merger partner—the plaintiffs claimed they were retaliated against. See id. at 993–94.

12 (See also id. 7:10–13; 8:20; 11:13–15; 14:3–4; 20:1–2; 26:3–4; 34:25–26; 38:17–21, 27–28; Erhart Summ. J. Decl. ¶¶ 6, 11, 13.)

On appeal, the Ninth Circuit determined the plaintiffs met their burden at the summary judgment phase to show they reasonably believed there might have been shareholder fraud. Van Asdale , 577 F.3d at 1001. The Ninth Circuit noted a securities fraud claim's elements "include a material misrepresentation or omission, scienter, a connection with the purchase or sale of a security, reliance, economic loss, and loss causation." Id. (citing Dura Pharms., Inc. v. Broudo , 544 U.S. 336, 341–42, 125 S.Ct. 1627, 161 L.Ed.2d 577 (2005) ). And to show securities fraud under SEC Rule 10b–5, "a plaintiff must demonstrate ‘(1) a material misrepresentation or omission of fact, (2) scienter, (3) a connection with the purchase or sale of a security, (4) transaction and loss causation, and (5) economic loss.’ " Id. (quoting In re Daou Sys., Inc. , 411 F.3d 1006, 1014 (9th Cir. 2005) ).

Turning to the plaintiffs' theory of fraud, the Ninth Circuit concluded it was close enough to a securities fraud claim. Van Asdale , 577 F.3d at 1001. The relevant intellectual property was an important part of the merger that provided a substantial portion of the merged company's income, and there was evidence the merger would not have occurred had the plaintiffs' employer been aware of the problematic prior art. Id. Further, given that (1) the prior art was potentially important, (2) several former officials from the merger target now occupied top management positions at the merged company, and (3) these officials allegedly had financial motives favoring nondisclosure, the Ninth Circuit held it was objectively reasonable for the plaintiffs to suspect that the non-disclosure might have been deliberate. Id.

Accordingly, a conceivable shareholder fraud theory requires at least (1) a material misrepresentation or omission of fact and (2) an indication of an intent to defraud. See Van Asdale , 577 F.3d at 1001 ; see also In re ChinaCast Educ. Corp. Sec. Litig. , 809 F.3d 471, 472, 474 (9th Cir. 2015) (noting "scienter or intent to defraud" is "a bedrock requirement of Rule 10b–5"). Further, this item, of course, falls under § 1514A's grasp. See 18 U.S.C. § 1514A ; Van Asdale , 577 F.3d at 1000–02.

iv. Fraud on Regulators

The last recurring theory Erhart raises is that the Bank was "defrauding" its regulators, particularly the OCC—a bank regulator. (Erhart's Opp'n 1:17–18; 4:27–28; 14:5–6; 34:8–10, 19–21; 36:1.) Yet Erhart does not identify an SEC rule that this purported conduct violated. Nor does he offer a meaningful explanation for why this conduct would fall under either the mail fraud, wire fraud, bank fraud, or securities fraud statutes "or any provision of Federal law relating to fraud against shareholders ...." See 18 U.S.C. § 1514A. The Court separately considers below whether this concept may fit Erhart's broader, California state law whistleblower retaliation claim. As to Sarbanes–Oxley, however, Erhart does not demonstrate this theory falls within the grasp of § 1514A. Consequently, the Court does not apply this theory to Erhart's § 1514A claim below.

4. Challenged Categories

BofI challenges the following categories of believed misconduct, arguing Erhart fails to demonstrate a factfinder could conclude he engaged in protected activity under § 1514A :

2nd Category:	Altered Financial Statements
3rd Category:	Untimely 401(k) Payments
4th Category:	Improper Strategic Plan Approval
6th Category:	Misleading Response to SEC Subpoena
7th Category:	Undisclosed Customer Accounts
8th Category:	Undisclosed Subpoenas
9th Category:	Unauthorized Risky Loans
10th Category:	Miscalculated ALL
11th Category:	Incomplete FDPA Audit
12th Category:	Sanitized Global Cash Card Review
13th Category:	Improprieties in CEO's Account
14th Category:	Improprieties in CEO's Brother's Account

(See BofI's Mot. 8:22–38:6.) The Court will not address the 2nd Category because the Court found it is unexhausted. For the remaining categories, the Court potentially considers two issues in light of the standards set forth above: first, whether Erhart demonstrates the conduct fits into one of the segments of laws included in § 1514A, including the Books-and-Records Rule, the Internal Controls Rule, or shareholder fraud; and second, whether Erhart produces sufficient evidence that a trier of fact could conclude his belief of a violation was objectively reasonable.

i. 3rd Category: Untimely 401(k) Payments

Contributions to qualifying employer-sponsored plans receive special tax treatment under 26 U.S.C. § 401(k). Under the DOL's regulations, an employer must deposit its employees' contributions to 401(k) accounts as soon as the contributions "can reasonably be segregated from the employer's general assets." 29 C.F.R. § 2510.3–102. Regardless, the contributions must be deposited no later than the following month's fifteenth business day. See id.

In the middle of 2014, Erhart and another Internal Audit employee performed a payroll audit. (Erhart Prelim. Inj. Decl. ¶ 18.) They discovered "that the Bank had not been making timely deposits to employees' 401(k) accounts for employee elective deferrals." (Id. ) Erhart later identified nine pay periods where—based on his payroll records—he believed contributions had been deposited late. (BofI's Mot. Ex. WW, ECF No. 127-55.)

Ultimately, the Bank self-reported under the DOL's Voluntary Fiduciary Correction Program that it had made delinquent participant contributions "on 5 occasions during the plan year 2014." (BofI's Mot. Ex. AAA, at 2, ECF No. 127-59.) BofI reported that $83,549 in contributions were paid late and that it had "restored funds for lost earnings in the amount of $64.73 on 12/02/2015." (Id. ; accord JSUF ¶ 22.)

BofI challenges this category on the first issue: whether Erhart demonstrates the conduct fits into one of the segments of laws listed in § 1514A. BofI argues: "Erhart no doubt could reasonably believe BofI failed to comply with specific DOL regulations governing the timeliness of employee elective deferral contributions. But that conduct did not relate to any SEC (as opposed to DOL) rule or regulation. Nor does it relate to ... any SOX-enumerated violation." (BofI's Mot. 12:2–11.) The Court agrees. The Internal Controls Rule does not broadly encompass all laws and regulations, and Erhart does not show the Bank could have violated this rule. Nor does Erhart demonstrate BofI was possibly violating the Books-and-Records Rule or committing shareholder fraud. Thus, while it is possible that this conduct may support one of Erhart's other whistleblower retaliation claims, this conduct does not support a claim under § 1514A. Cf. Villanueva v. U.S. Dep't of Labor , 743 F.3d 103, 110 (5th Cir. 2014) (holding employee's belief that employer was violating Colombian tax laws was insufficient under § 1514A ). The Court thus grants BofI's request for partial summary judgment on this category of believed misconduct.

ii. 4th Category: Improper Strategic Plan Approval

Erhart was assigned to conduct the "Fiscal Year 2014/2015 Business Plan Audit." (Erhart Prelim. Inj. Decl. ¶ 19; accord JSUF ¶ 61.) This audit's objectives "included determining whether or not BofI's Board of Directors had approved the current business plan." (JSUF ¶ 62.) The relevant document is titled "Fiscal 2015 Strategic Plan." (Erhart's Opp'n Ex. 229, ECF No. 174-11.) The Court sealed the Strategic Plan because it contains proprietary information, and the specific information is unnecessary to understand the parties' dispute and the Court's rulings. (ECF No. 178.) To generally describe the document, it contains BofI's internal strategies and forward-looking projections for the then-coming fiscal year. (Erhart's Opp'n Ex. 229.) These projections include internal metrics and assumptions about business divisions, profitability, employee utilization, fees, and other matters. (Id. )

Erhart states he learned "that the Strategic Plan had not been approved at any of the following Board of Directors meetings: May 1, 2014; July 2014; [or] September 2014." (Erhart Prelim. Inj. Decl. ¶ 19.) As of early 2015, Erhart believed the plan still had not been approved. (Erhart Dep. 1243:19–21, ECF No. 158-8.) Then, in February 2015, Erhart claims a unanimous written consent approving the plan appeared "miraculously" and showed approval "back in July." (Id. 1243:22–25; see also BofI's Mot. Ex. BB, ECF No. 127-34.) Upon reviewing the document, Erhart believed the Bank's board members' signatures were "copy and paste" and that the Bank "was backdating these signatures and the approval didn't actually occur on – in July 2014." (Erhart Dep. 1244:2–7; see also BofI's Mot. Ex. BB.) Based on this conduct, Erhart states he believed "the Bank was not properly maintaining its records and did not have adequate internal controls as required under SEC rules." (Erhart Summ. J. Opp'n Decl. ¶ 10.) He also testified that he believed the OCC's Asset Management and Director's Book publications required approval of the Bank's strategic and business plans. (Erhart Dep. 1228:1–1229:16, ECF No. 158-8.)

BofI moves for partial summary judgment, arguing no reasonable person in Erhart's position would believe any false or deceptive conduct had occurred. (BofI's Mot. 22:4–23:25.) BofI argues that Erhart knew the strategic planning process was a matter of BofI's corporate governance policy, and BofI's purported "failure to comply with its own voluntary internal governance policies does not itself violate any law, much less federal wire, mail or bank fraud statutes or an SEC rule or regulation, and Erhart could not have reasonably believed otherwise." (Id. 22:21–23:2.)

The Bank's challenge is persuasive. Initially, given the scope of § 1514A, the Court rejects Erhart's reliance on handbooks or similar advisory publications from the OCC. Without more explanation, it is not reasonable for an internal auditor in Erhart's position to believe guidance from the OCC constitutes "any rule or regulation of the [SEC]" or "any provision of Federal law relating to fraud against shareholders." See 18 U.S.C. § 1514A.

As for Erhart's recurring theories of liability, he does not demonstrate a factfinder could conclude it was reasonable to believe this conduct amounted to a violation of the Books-and-Records Rule. Erhart's conclusory argument that "certainly [his] allegations with respect to ... Strategic Plan approval or lack thereof ... would fit within" the Books-and-Records Rule is inadequate. (See Erhart's Opp'n 39:8–13.) He does not explain why the allegedly falsified document—minutes approving the Strategic Plan—could be believed to be the type of corporate record covered by the rule. These minutes do not document "the transactions and dispositions of the assets of the" Bank. See 15 U.S.C. § 78m(b)(2)(A) ; cf. Jensen , 532 F. Supp. 2d at 1196 (reasoning a books-and-records violation occurred where falsified meeting minutes concerning stock options had "the effect of understating corporate expenses"); see also Wadler , 916 F.3d at 1182 (reasoning evidence supported objective belief of books-and-records violation where missing documentation meant employer owed $30 million in royalty obligations). And the Court will not make that jump without Erhart's help. Moreover, even if the underlying Strategic Plan itself is such a corporate record, which it does not appear to be, Erhart does not claim he believed this document was falsified. (See Erhart Summ. J. Opp'n Decl. ¶¶ 7–10.)

As for the Internal Controls Rule, Erhart again unhelpfully argues in a conclusory fashion that the improper Strategic Plan approval would "clearly fit within this category." (Erhart's Opp'n 39:12–16.) Nowhere does Erhart argue or discuss why a backdated approval of the Strategic Plan had any bearing on the Bank's internal controls over financial reporting and the preparation of external financial statements. See 17 C.F.R. § 240.13a–15(a). And although the connection may be obvious to Erhart, it is not to the Court. He must do more to meet his burden in response to the Bank's motion.

Erhart's reliance on a shareholder fraud theory is similarly inadequate. (See Erhart's Opp'n 7:10–14.) He does not mention the elements of securities fraud or explain why this conduct approximates such a claim. Cf. Van Asdale , 577 F.3d at 1001, 1005 (reversing grant of summary judgment where the plaintiffs' fraud theory at least approximated the elements of shareholder fraud). Erhart's stone-skipping claim that he understood "the OCC and the SEC were interested in corporate governance and [therefore] the Bank was misrepresenting itself to shareholders as being in good regulatory standing" is insufficient. (See Erhart's Opp'n 7:10–14.) See Nielsen , 762 F.3d at 223 (affirming dismissal of Sarbanes–Oxley retaliation claim where the "connection between [the plaintiff's] claims and supposed fraud against shareholders [was] simply too tenuous").

Accordingly, because Erhart does not demonstrate a reasonable factfinder could conclude this conduct violated a law listed in § 1514A, the Court grants the Bank's request for partial summary judgment on this issue.

iii. 6th Category: Misleading Response to SEC Subpoena

The Securities Act of 1933, the Securities Exchange Act of 1934, and the Investment Advisors Act of 1940 all empower the SEC to investigate potential violations of these securities laws, including by issuing subpoenas. Securities Act §§ 19(c), 20(a), 15 U.S.C. §§ 77s(c), 77(t)(a) ; Exchange Act § 21(a)(1); 15 U.S.C. § 78u ; Investment Company Act § 209(a), 15 U.S.C. § 80b–9. There are also a variety of SEC rules that apply to the agency's informal investigations, formal investigations, and adjudicative hearings. See generally 17 C.F.R. Parts 200 to 203.

On December 11, 2014, the SEC issued a subpoena In the Matter of Elm Tree Investment Advisors ("ETIA") to BofI. (JSUF ¶ 23; SEC ETIA Subpoena, BofI's Mot. Ex. T, ECF No. 127-26.) This subpoena required the Bank to produce information "showing only the name, current address, account number, and type of account of the customer or customers associated with" a bank account. (SEC ETIA Subpoena.) The subpoena further directed that BofI "not otherwise produce any ... information ... from any record ... in relation to an account in the name of a customer." (Id. )

The face of the subpoena plainly demonstrates the SEC was investigating potential securities law violations. The subpoena reported that the SEC had "issued a formal order authorizing this investigation under Section 20(a) of the Securities Act of 1933, Section 21(a) of the Securities Exchange Act of 1934, and Section 209(a) of the Investment Advisers Act of 1940." (SEC ETIA Subpoena.) The subpoena also cautioned, "FEDERAL LAW REQUIRES YOU TO COMPLY WITH THIS SUBPOENA . Failure to comply may subject you to a fine and/or imprisonment." (Id. ) On December 18, 2014, BofI responded to the SEC by letter, informing it:

We searched our records based on the criteria provided in the Subpoena Attachment; however, we were unable to locate the account number at BofI Federal Bank. Accordingly, we are unable to produce any information or documentation requested in the Subpoena.

(BofI's Mot. Ex. U, ECF No. 127-27.)

In early January 2015, Erhart "became aware of the SEC subpoena," and states he "knew that the Bank did indeed have a loan file containing information regarding" the targeted customer—ETIA. (Erhart Prelim. Inj. Decl. ¶ 27.) Erhart further claims "a file had been created in response to the SEC subpoena, containing the information located regarding ETIA." (Id. ) Therefore, Erhart formed the belief "that the Bank had improperly responded to the SEC that no responsive documents existed in response to the ETIA Subpoena." (Erhart Summ. J. Opp'n Decl. ¶ 12.) Erhart states he "reported this issue to [VP] Ball" and "alerted the Legal Department ... about the fact that the Bank indeed had responsive documents." (Id. ) In response, a member of BofI's legal department asked Erhart "about the account number in the subpoena and told [him] she would follow up." (Id. )

After learning his investigation of the subpoena upset a BofI executive, Erhart alerted the SEC about the subpoena issue. (Erhart Prelim. Inj. Decl. ¶¶ 28–29; Erhart Summ. J. Opp'n Decl. ¶ 12; see also BofI's Mot. Ex. V, ECF No. 127-28.) About a month after its initial response to the subpoena, BofI also contacted the SEC, stating that the Bank had "finally determined that the Account Number referenced in the Subpoena is a BofI Federal Bank [General Ledger] Account." (BofI's Mot. Ex. W, ECF No. 127-29.) In other words, apparently an internal account number matched the number listed on the SEC Subpoena, but not a BofI bank account number. (See id. ; see also SEC ETIA Subpoena.) BofI also submits that the Bank was already in regular contact with the SEC regarding the subpoena between the time of its initial response and Erhart's discovery of the subpoena, and that "there was sufficient information available to Mr. Erhart" in the Bank's "subpoena-tracking system" to conclude this. (Tolla Rule 30(b)(6) Dep. 29:19–30:1, ECF No. 127-19.)

BofI moves to summarily adjudicate this category, arguing it complied with the subpoena because the SEC's request was limited to the account number identified. (BofI's Mot. 12:12–14:27.) The Bank thus challenges whether there is enough evidence for a trier of fact to conclude Erhart's belief of a violation was objectively reasonable.

The Bank, however, does not meet its burden under Rule 56 to show the absence of a genuine issue of material fact on this category. Although an attorney may have concluded there was no wrongdoing in light of the subpoena's scope, the reasonableness component under § 1514A "is evaluated based on the knowledge available to a reasonable person in the same factual circumstances with the same training and experience as the aggrieved employee.' " Wadler , 916 F.3d at 1188 (quoting Sylvester , 2011 WL 2517148, at *12 ); see also Rhinehimer , 787 F.3d at 811 ("[T]he inquiry into whether an employee had a reasonable belief is necessarily fact-dependent, varying with the circumstances of the case."). Erhart is not an attorney. And viewing the evidence in the light most favorable to Erhart, someone in his circumstances could reasonably believe—or mistakenly believe—that the Bank was providing a misleading response to the SEC's subpoena. Further, although "the evidence needed to support a whistleblower's reasonable belief will necessarily vary with the circumstances, [ § 1514A ] generally does not require an employee to undertake an investigation before reporting his concerns." Wadler , 916 F.3d at 1188. The Court thus rejects the Bank's arguments that summary judgment is appropriate because Erhart should have "bother[ed] to follow-up" regarding the subpoena and that he unnecessarily contacted the SEC because the Bank "was taking steps to ensure that it properly responded." (BofI's Mot. 14:16–18; 24–25 (emphasis omitted).)

Because the Bank fails to demonstrate an absence of a genuine issue of material fact on this issue, the Court denies BofI's request for partial summary judgment.

iv. 7th Category: Undisclosed Customer Accounts

BofI's primary regulator, the OCC, "conducts an annual examination of BofI's Bank Secrecy Act (‘BSA’) compliance practices." (JSUF ¶ 28.) "As part of the January 2015 BSA examination, and specifically in connection with its examination of BofI's ‘Customer Identification Program’ (‘CIP’)," the OCC requested certain information from the Bank regarding taxpayer identification numbers ("TINs"). (Id. ¶ 29.) Erhart was not responsible for responding to the OCC's request. (Id. ¶ 30.) But he claims the Bank's response to the OCC's request "was false" based on a list of accounts he saw in a spreadsheet. (Erhart Prelim. Inj. Decl. ¶ 32.)

In response, the Bank states its answer to the OCC's request was correct based on the Bank's custom and practice and interpretation of the OCC's request. (Tolla Decl. ¶ 4, ECF No. 127-2.) The Bank states Erhart also had access to information that would have demonstrated the Bank's response was supposedly not false. (Id. ¶¶ 5–6.) BofI thus argues no reasonable person in Erhart's position would have believed BofI withheld information from the regulator. (BofI's Mot. 15:1–16:16.) Regardless, the Bank also argues "there is no connection between the suspected conduct and any [Sarbanes–Oxley]-enumerated violation." (Id. 16:17–22.) Hence, the Bank challenges this category on both common issues.

The Court need not assess the first issue here because the Bank's challenge is persuasive on the second one: Erhart does not demonstrate a connection between this conduct and the segments of laws listed in § 1514A. The Court underscores that § 1514A is not a general compliance statute. It does not police all employee grievances and suspicions of wrongdoing. See, e.g. , Day , 555 F.3d at 54 ("The plain language of SOX does not provide protection for any type of information provided by an employee but restricts the employee's protection to information only about certain types of conduct."). A failure to comply with the Bank Secrecy Act or an OCC examination does not fit § 1514A's categories.

Erhart also relies upon the Books-and-Records Rule, but he does not explain how the Bank's response to the OCC falls under the scope of this rule. (See Erhart's Opp'n 10:24–27; 39:8–13.) A purportedly incorrect response to an OCC inquiry is not the type of corporate book, record, and account identified in 15 U.S.C. § 78m(b)(2)(A). It is not an accounting record. And there is no evidence that this response caused the Bank to fail to keep books that accurately recorded its assets or expenses. Cf. Jensen , 532 F. Supp. 2d at 1195–96 (reasoning falsified meeting minutes fell within the scope of 15 U.S.C. § 78m(b)(2)(A) because they had the effect of understating corporate expenses). Simply put, Erhart fails to demonstrate as a matter of law that this conduct falls within the segments of laws listed in § 1514A. The Court thus grants BofI's request for summary judgment on this category.

v. 8th Category: Undisclosed Subpoenas

Erhart claims the Bank failed to disclose documents that were responsive to an OCC request concerning subpoenas. (Erhart Prelim. Inj. Decl. ¶ 33.) Erhart believes the Bank's response was incorrect because he saw a Bank Secrecy Act "spreadsheet that identified many subpoenas, including from law enforcement agencies, grand juries, and even the US Department of the Treasury, of which [the] OCC is a part." (Id. ) Like its attack on the prior category of conduct, the Bank argues "no reasonable person in Erhart's position with access to the same information would have concluded that BofI's response to [the OCC's request] was false and purposefully concealed information, or that it was a [Sarbanes–Oxley]-enumerated violation." (BofI's Mot. 18:14–17.) Partial summary judgment on this issue is appropriate for the same reasons as the prior category concerning the OCC. Erhart argues "such a misleading or false communication from the Bank amounted to shareholder fraud, securities law violations, and/or SEC rule violations." (Erhart's Opp'n 11:13–16.) This scattershot approach is unavailing. See Day , 555 F.3d at 57 n.14 (rejecting § 1514A argument where the brief made "an unspecified reference to SEC regulations"). This conduct does not fit into the Books-and-Records Rule. Nor does it relate to the Internal Controls Rule, which addresses controls over financial reporting and the preparation of financial statements.

As for Erhart's other recurring theory—shareholder fraud—he argues the "existence of such subpoenas could indicate criminal wrongdoing at the Bank which could materially weigh on the Bank's valuation and its status with rating agencies and/or regulators." (Erhart's Opp'n 11:15–18.) Although the reasonable belief standard is a minimum threshold requirement, Erhart does not even discuss the elements of shareholder fraud or demonstrate how a factfinder could connect the dots to conclude he had a reasonable belief—or a reasonably mistaken belief—that shareholder fraud was occurring. See Nielsen , 762 F.3d at 223 (affirming dismissal of § 1514A claim where the "connection between [the plaintiff's] claims and supposed fraud against shareholders [was] simply too tenuous" and thus the plaintiff had not alleged "any facts plausibly suggesting that this supposed misconduct implicated any of the enumerated provisions in § 1514A"); see also Van Asdale , 577 F.3d at 1001, 1005 (reversing grant of summary judgment where the plaintiffs' fraud theory at least approximated the elements of shareholder fraud). Because Erhart does not demonstrate a genuine issue for trial, the Court grants the Bank's request for summary adjudication of this issue.

vi. 9th Category: Unauthorized Risky Loans

A primary part of BofI's business is originating loans. (JSUF ¶ 2.) In January 2015, Erhart was performing a "Loan Origination Audit." (Erhart Summ. J. Opp'n Decl. ¶ 14.) Erhart claims he discovered the Bank "had made loans to Politically Exposed Persons." (Id. ) He also claims he uncovered that "many of the Bank's borrowers were criminals, even notorious criminals convicted for large-scale fraud schemes, attorneys who had been suspended from the practice of law for fraud, and other suspicious persons." (Id. ) Erhart believed these customers "put the Bank at high risk for violating the Bank Secrecy Act's ... Anti-Money Laundering Rules ..., as well as violating the [Sarbanes–Oxley] internal controls regulation, given that BofI was violating its own policy by accepting these loans." (Id. ) The referenced BofI policy prohibited the Bank from establishing a relationship with certain customers, including politically exposed persons, due to compliance risk. (Erhart's Opp'n Ex. 160, ECF No. 157-14.) Thus, viewing the evidence in the light more favorable to Erhart, he discovered the Bank was disbursing loans to risky customers against the Bank's own directive. And a review of Erhart's whistleblower discussion notes reveals he believed the problematic loans totaled tens of millions of dollars. (See OCC Whistleblower Notes.)

The Bank argues beliefs of potential violations of the Bank Secrecy Act's Anti-Money Laundering Rules are insufficient as a matter of law for Erhart's Sarbanes–Oxley claim. (BofI's Mot. 24:15–16.) The Bank claims this conduct "simply does not fall within the ambit of any laws specified in Section 1514A" because the relevant duties "are imposed on financial institutions by statute, and implemented through regulations that are jointly promulgated by, among other agencies, the OCC, but not the SEC." (Id. 25:6–10 (citations omitted).)

Potential violations of the Bank Secrecy Act may not fall within the scope of § 1514A, but Erhart also states he believed this conduct violated the Internal Controls Rule. As the Court has discussed, this rule does not require a system of controls that ensures compliance with all laws and regulations. It does, however, require policies and procedures that provide reasonable assurance (1) that "receipts and expenditures of the issuer are being made only in accordance with authorizations of management" and (2) "regarding [the] prevention or timely detection of unauthorized acquisition, use or disposition of the issuer's assets that could have a material effect on the financial statements." See 17 C.F.R. § 240.13a–15(a). Erhart states he believed tens of millions of dollars in loans were being made by the Bank to risky customers against management's directive to not establish relationships with these customers. When the evidence is construed in Erhart's favor, a reasonable factfinder could conclude Erhart reasonably believed—or mistakenly believed—that this conduct amounted to a violation of the Internal Controls Rule. See Van Asdale , 577 F.3d at 1001 (providing the reasonable belief standard is a "minimal threshold requirement"). The Court thus denies BofI's motion for partial summary judgment on this category.

vii. 10th Category: Miscalculated ALL

Another instance of perceived wrongdoing involves BofI's allowance for loan and lease losses ("ALL"). "ALL is a valuation reserve a bank maintains to cover probable and estimable credit losses in its loan portfolio." (JSUF ¶ 20; see also BofI's Req. for Judicial Notice ("RJN") Ex. 8, ECF No. 127-70.) In other words, the allowance is a reserve for bad debts. (See BofI's RJN Ex. 8.)

In early 2015, Erhart states he "discovered that the Bank recently calculated [ALL] to exclude unfunded commitments for lines of credit." (Erhart Prelim. Inj. Decl. ¶ 36.) Erhart testified he made this discovery while assisting a colleague in performing an audit for a quarterly reporting process where the Bank provides information on its financial condition to regulators via a "call report." (See Erhart Dep. 528:6–14, 564:8–14, 586:4–15, ECF No. 127-9.) He claims the "documentary evidence" in this audit "indicated that the Bank had hundreds of millions of dollars in unfunded commitments." (Id. 586:10–13.) Erhart also states "[t]he size of the unfunded commitments excluded from ALL meant the ALL may have been materially miscalculated, which could materially impact the Bank's earnings." (Erhart Prelim. Inj. Decl. ¶ 36; see also Erhart Dep. 598:9–14.)

When Erhart asked VP Ball about this issue, he was informed it could be due to "the way that the particular [underlying credit] contracts were written" and that VP Ball was not aware that the Bank's external auditors had examined this issue. (Erhart Dep. 586:16–25.) Erhart did not follow-up on this issue beyond speaking with VP Ball, "do any calculations," or review additional documents such as the underlying credit contracts. (See id. 590:21–591:6, 598:15–25.) BofI submits that Erhart's belief is incorrect because the "unfunded commitments" at issue were actually advances that the Bank had the absolute discretion to make or deny; meaning, the commitments "did not have to be included in the ALL calculation." (Micheletti Decl. ¶ 5, ECF No. 127-3.) BofI argues no "reasonable person in Erhart's position, without more information would have rushed to conclude that BofI's ALL calculation was an effort to deceive BofI shareholders." (BofI's Mot. 10:20–22.) And had Erhart inquired of those who calculated BofI's ALL, reviewed the underlying contracts, or reviewed the OCC's ALL handbook, he would have realized the ALL was not miscalculated. (Id. 11:2–11.)

The Court agrees. Although the "reasonable belief" standard is a "minimal threshold requirement," Erhart does not meet that standard for this category of conduct. See Van Asdale , 577 F.3d at 1001. He does not provide what his understanding of ALL was at the time he formed this belief. (See Erhart Prelim. Inj. Decl. ¶ 36.) Nor does Erhart explain why it would be reasonable for someone in his circumstances—with his knowledge and financial background—to conclude BofI miscalculated this metric to the tune of hundreds of millions of dollars and violated one of the categories of laws listed in § 1514A. (See id. ; see also Erhart's Opp'n 20:11–15; Erhart Dep. 590:21–591:16, ECF No. 127-9.) Nor does Erhart demonstrate the Bank's ALL was intentionally miscalculated or manipulated in an attempt to conduct any form of "fraud." See In re ChinaCast , 809 F.3d at 472, 474 (noting "scienter or intent to defraud" is "a bedrock requirement of Rule 10b–5").

Because Erhart does not demonstrate there is a genuine issue of material fact on this issue, the Court grants BofI's request for partial summary judgment.

viii. 11th Category: Incomplete FDPA Audit

When BofI makes loans secured by a property located in a "special flood hazard area" subject to the National Flood Insurance Program, the property must be covered by flood insurance pursuant to the Flood Disaster Protection Act of 1973 ("FDPA") and its implementing regulations. (See generally Comptroller's Handbook, Consumer Compliance, FDPA, at 3, BofI's RJN Ex. 9, ECF No. 127-71.) In September 2014, BofI retained The Compliance Group, Inc., a legal compliance support services firm, to perform regulatory compliance reviews to supplement BofI's internal compliance efforts, including FDPA compliance. (Tolla Decl. ¶ 12, ECF No. 127-2; BofI's Mot. Ex. BBB, ECF No. 127-60.)

Erhart was later assigned to the "FDPA audit." (JSUF ¶ 57.) The audit's objectives "included determining whether previous FDPA deficiencies had been corrected, and the scope included assessing the adequacy of BofI's FDPA program." (Id. ¶ 58.) Erhart declares he "investigated and verified the negative findings made by [his] predecessors" and "presented them to management." (Erhart Prelim. Inj. Decl. ¶ 38.) Erhart further claims management "caused most of the negative findings to be excluded from the Audit Report, leaving in only a small fraction of the findings." (Id. ) That said, when asked at his deposition to identify the potential Sarbanes–Oxley issue related to FDPA compliance, Erhart only identified an allegation regarding withholding this information from a regulator. (See Erhart Dep. 1143:23–1145:18, ECF No. 127-11.)

Summary judgment on this category for Erhart's Sarbanes–Oxley claim is appropriate. Erhart does not demonstrate his belief that this conduct violated a segment of laws in § 1514A was objectively reasonable. Compliance with the FDPA is not listed in the statute. And to the extent Erhart argues he believed this conduct was wrongful because BofI was purportedly withholding information from a bank regulator, that theory fails under Sarbanes–Oxley for the reasons discussed above. Hence, while this conduct may support one of Erhart's other whistleblower retaliation claims, the Court grants partial summary judgment in BofI's favor on this issue.

ix. 12th Category: Sanitized Global Cash Card Review

BofI issues prepaid and payroll "cash" cards marketed by third-party service providers, including the "Global Cash Card" ("GCC"). (See Erhart Summ. J. Opp'n Decl. ¶ 15; Erhart Prelim. Inj. Decl. ¶¶ 40–43.) Erhart claims that when GCC reviewed its customer base for "high risk" customers, a resulting list of these customers revealed "approximately 30% of the customers on the list were ‘bad’ – i.e., the verification process produced alerts," including Social Security numbers that could not be found in public records and suspiciously high cash balances. (Erhart Prelim. Inj. Decl. ¶ 41.) Erhart further claims, however, that when SVP Tolla learned of this list, he "demanded that a new list be produced, and one was dutifully done that did not feature any ‘bad’ " customer data. (Id. ¶ 42.) Finally, Erhart claims BofI then "terminated its relationship with GCC" and "repeatedly instructed staff not to inform the OCC about why the relationship was terminated." (Id. ) These events were documented in an internal audit memorandum dated February 12, 2015. (Erhart's Opp'n Ex. 83, ECF No. 157-10.)

Like its challenges to Erhart's previous beliefs concerning the OCC, BofI argues this conduct has "no connection" to a violation enumerated in § 1514A. (BofI's Mot. 19:2–4.) The Court agrees. This alleged misconduct again concerns the Bank's purported dishonesty with a banking regulator. While this conduct may conceivably support a different theory of liability, Erhart fails to demonstrate to the Court that a factfinder could conclude this conduct amounted to mail fraud, wire fraud, bank fraud, or securities fraud or a violation of "any rule or regulation of the [SEC]" or "any provision of Federal law relating to fraud against shareholders." See 18 U.S.C. § 1514A. Erhart's conclusory argument that this conduct could violate the Books-and-Records Rule is insufficient for the same reasons as discussed for other categories above. (See Erhart's Opp'n 39:8–13.) The Court thus grants summary judgment on this basis.¹³

13 The Bank also moves for partial summary judgment on Erhart's allegation concerning reports under BofI's Bank Secrecy Act program that were allegedly altered. (BofI's Mot. 25:16–27:12.) Erhart does not meaningfully develop this allegation in his opposition or explain why this conduct violates a segment of laws identified in § 1514A. (See Erhart's Opp'n 13:2–5; 39:8–19.) Hence, the Court did not classify this conduct as a separate category above. Regardless, however, the Court's analysis applies with equal force to this allegation. The Court thus grants BofI's request for partial summary judgment on this issue.

x. 13th Category: Improprieties in CEO's Account

Erhart's Second Amended Complaint alleges one of BofI's businesses involves purchasing "structured settlements from plaintiffs in litigation," where it offers "them a lump sum in lieu of the periodic payments they are receiving." (Erhart's SAC ¶ 12.) Erhart further alleges that while he was conducting "a review of personal deposit accounts of senior management," he discovered "CEO Garrabrants was depositing third-party checks for structured settlement annuity payments into a personal account, including nearly $100,000 in checks made payable to third parties." (Id. ¶ 44.) Erhart generally alleged this conduct and other events he witnessed at the Bank violated the "mail fraud and wire fraud statutes" and "also ... the bank fraud statute." (Id. ¶ 74A.) In denying BofI's motion to dismiss Erhart's Sarbanes–Oxley claim, the Court determined "Erhart sufficiently pleads he reported at least some conduct that could constitute a reasonable belief of a violation of the laws enumerated in Sarbanes–Oxley's anti-retaliation provision." (ECF No. 44.) As an example, the Court reasoned that when Erhart's allegations were construed in his favor, a reasonable person could conclude the alleged "improprieties" in the CEO's personal account involving more than $100,000 in third-party checks could be believed to be a form of bank fraud. (Id. )

BofI moves for partial summary judgment on these allegations, providing additional information about what was transpiring in CEO Garrabrants's personal account. (BofI's Mot. 27:13–34:24.) BofI explains that CEO Garrabrants was not diverting checks from BofI's structured settlement business into his personal account; rather, he was independently also purchasing structured settlement payment streams and depositing them into a family titling trust at the Bank. (Id. ) Moreover, BofI demonstrates that the Bank's Board approved the CEO's purchase of less than $150,000 of structured settlements in 2009, and the Bank had the appropriate court orders and assignment agreements that validated the conduct at issue. (Id. )

Accordingly, BofI argues "what Erhart observed presented no risk to BofI's property interests, and thus could raise no suggestion of bank fraud as the transactions lacked the very essence of bank fraud." (BofI's Mot. 29:8–10.) BofI also highlights "that the evidence shows that Erhart himself did not actually believe that Garrabrants's conduct constituted bank fraud" because Erhart testified he believed CEO Garrabrants may be involved in evading federal tax law. (Id. 29:21–23 (citing Erhart Dep. 645:8–10, ECF No. 127-9).)

In response, Erhart states: "I had not seen any transfer and assignment agreements, court orders, or board minutes evidencing any approval Mr. Garrabrants had to deposit the checks, although I asked for such documentation. Mr. Ball's response was to tell me the board had told the CEO to stop doing it." (Erhart Summ. J. Opp'n Decl. ¶ 16.) And given VP Ball's response to Erhart, Erhart further states, "I had no reason to think that six years earlier the board had approved such transactions." (Id. ) As for what segment of § 1514A this conduct could fall under, Erhart only identifies a "failure to implement a system of internal accounting controls." (Erhart's Opp'n 39:12–13.)

Partial summary judgment on this category is warranted. Preliminarily, concerns over tax evasion or money laundering are not mentioned in the segments of laws enumerated in § 1514A. And Erhart regardless does not provide a theory for how these concerns could be encompassed by § 1514A. Rather, the only theory Erhart mentions in his opposition for this conduct is a violation of the Internal Controls Rule. But beyond a conclusory argument that this conduct "would clearly fit" this rule, Erhart offers no assistance to the Court. (See Erhart's Opp'n 39:12–14.) He does not show why CEO Garrabrants's conduct possibly reveals a failure to implement a system that maintains records that "accurately and fairly reflect the transactions and dispositions of the assets of the" Bank. See 17 C.F.R. § 240.13a–15(f)(1). Nor does Erhart show CEO Garrabrants's conduct reveals a failure to maintain internal control over financial reporting or provide reasonable assurance regarding the unauthorized use of BofI's assets "that could have a material effect on the [Bank's] financial statements." See id. § 240.13a–15(f)(3). Hence, while it may be possible that this conduct violated some other law, Erhart fails to aid the Court in connecting this conduct to the rules under § 1514A he identifies. The Court thus grants partial summary judgment on this issue.

xi. 14th Category: Improprieties in CEO's Brother's Account

Erhart states that while reviewing employee deposit accounts at the Bank, he discovered "the largest consumer account at the Bank" had the tax identification number of the CEO's brother. (Erhart Prelim. Inj. Decl. ¶ 45.) Erhart "could find no evidence of how [the brother] had come legally into possession of the $4 million wired into the account." (Id. ) Erhart thus claims he "was concerned about whether CEO Garrabrants could be involved in tax evasion and/or money laundering." (Id. )

In launching a similar summary judgment attack on this claim, BofI submits that if Erhart "had bothered to obtain the relevant information – which, as an auditor he should have obtained before jumping to any unsubstantiated conclusions – he would have learned that Garrabrants's conduct regarding funds in his brother's account was simply family financial planning." (BofI's Mot. 35:21–24.) CEO Garrabrants testified that he transferred BofI shares he owned to his brother as a gift. (Garrabrants Dep. 169:8–16, 172:22–174:8, ECF No. 127-17.) After his brother sold the stock, the proceeds were deposited into the account at the Bank. (Id. 174:5–10, 175:22–24.)

BofI moves for summary judgment, arguing "there is no evidence that Erhart reported during his employment that he believed that a [Sarbanes–Oxley]-enumerated violation ... had occurred, or would imminently occur." (BofI's Mot. 34:25–38:6.) The Court agrees. Again, regardless of the legality of this conduct, Erhart does not demonstrate that concerns over potential money laundering or tax evasion fall under § 1514A's listed laws. He makes no reasoned argument that this particular conduct could constitute shareholder fraud or violate either the Books-and-Records Rule or the Internal Controls Rule. He has simply not met his burden in response to BofI's challenge.

In sum, BofI is entitled to partial summary judgment on Erhart's Sarbanes–Oxley claim's protected activity element. The Court concludes Erhart fails to demonstrate a genuine issue for trial for this claim for various categories of believed misconduct.¹⁴ The Court, however, denies the Bank's request to summarily adjudicate the protected activity element of Erhart's claim with respect to the 6th Category – Misleading Response to SEC Subpoena and the 9th Category – Unauthorized Risky Loans.¹⁵

14 These items are: 3rd Category – Untimely 401(k) Payments; 4th Category: Improper Strategic Plan Approval; 7th Category – Undisclosed Customer Accounts; 8th Category – Undisclosed Subpoenas; 10th Category – Miscalculated ALL; 11th Category – Incomplete FDPA Audit; 12th Category – Sanitized Global Cash Card Review; 13th Category – Improprieties in CEO's Account; and 14th Category – Improprieties in CEO's Brother's Account.

15 BofI's motion does not address the 1st Category – Corrupted Structured Settlements & Lottery Audit or the 5th Category – High Deposit Concentration Risk in its challenge to Erhart's Sarbanes–Oxley claim's protected activity element. (See BofI's Mot. 8:25–38:6.)

C. Knowledge of Protected Activity

BofI further moves for partial summary judgment on the third element of Erhart's burden to demonstrate a prima facie case of retaliatory discrimination: that BofI "knew or suspected, actively or constructively, that he engaged in the protected activity." See Tides , 644 F.3d at 814. BofI claims "in regard to his work on certain internal audits, Erhart failed to communicate or act in a manner that, as a matter of law, was sufficient to cause BofI to know or suspect ‘protected activity’ on his part." (BofI's Mot. 38:12–14.) Rather, BofI claims Erhart's "alleged disclosures all occurred within the confines of assigned audit work," and "no factfinder reasonably could conclude that the method and content of Erhart's audit related disclosures placed BofI on notice that Erhart harbored a suspicion that the audits had uncovered [Sarbanes–Oxley]-enumerated violations." (Id. 38:14–39:1.)

BofI thus claims that for "certain alleged categories of suspected wrongdoing, BofI did not have any knowledge of Erhart's concerns until it first learned that Erhart provided ‘information’ to the OCC on March 10, 2015." (BofI's Mot. 38:2–5.) BofI highlights that Erhart's direct supervisor, VP Ball, never thought Erhart "was a whistleblower" while Erhart was reporting to him. (Ball Dep. 89:23–90:10, ECF No. 127-12.) In response, Erhart's declaration states:

I spoke to Mr. Ball about all the factual predicates that BofI attempts to challenge in its Motion for Summary Judgment. I communicated that the Bank was engaging in illegal or otherwise regulatory non-compliant activity to Mr. Ball either via email, over the telephone, or in person. I always hoped that Mr. Ball would let me know if I were mistaken or misguided. He did not do so as to any of the predicates at issue here. He encouraged me to go where the evidence led me, and generally let me know he agreed with me about the seriousness of the concerns I raised. I also reported my concerns to other members of BofI management, including Senior Vice President/Head of Compliance John Tolla, Chief Legal Officer Eshel Bar-Adon and Chief Risk Officer Thomas Williams.

(Erhart Summ. J. Opp'n Decl. ¶ 4.)

BofI's challenge is unconvincing. There is no requirement that Erhart "use[ ] the words ‘fraud,’ ‘fraud on shareholders,’ or ‘stock fraud’ " when reporting his beliefs. See Van Asdale , 577 F.3d at 997. Viewing the evidence in the light most favorable to Erhart, a reasonable factfinder could conclude Erhart's reports to his supervisor and other BofI personnel put the Bank on actual or constructive notice of his protected activity under § 1514A, including before March 10, 2015. Because there is a genuine issue for trial on the knowledge element of Erhart's claim, the Court denies BofI's request for partial summary judgment on this issue.

Overall, for Erhart's Sarbanes–Oxley claim, the Court grants in part BofI's request for partial summary judgment on exhaustion grounds. The Court similarly grants in part the Bank's request to summarily adjudicate the protected activity element of Erhart's claim for all but two of the categories BofI challenges. The Court denies, however, BofI's request to partially adjudicate the knowledge element of Erhart's claim.

II. Dodd–Frank § 21F, 15 U.S.C. § 78u-6

"Like Sarbanes–Oxley, [Dodd–Frank] was passed in the wake of a financial scandal—the subprime mortgage bubble and subsequent market collapse of 2008." Somers v. Digital Realty Tr. Inc. , 850 F.3d 1045, 1048 (9th Cir. 2017), rev'd on other grounds , ––– U.S. ––––, 138 S. Ct. 767, 200 L.Ed.2d 15 (2018). Dodd–Frank "provided new incentives and employment protections for whistleblowers by adding Section 21F to the Securities Exchange Act of 1934." Id. The Act defines a "whistleblower" as "any individual who provides ... information relating to a violation of the Securities laws to the Commission, in a manner established, by rule or regulation, by the Commission." 15 U.S.C. § 78u-6(a)(6). To protect whistleblowers from retaliation, Exchange Act § 21F provides:

No employer may discharge ... or in any other manner discriminate against, a whistleblower in the terms and conditions of employment ... because of any lawful act done by the whistleblower:

(i) in providing information to the [SEC] in accordance with this section; [or]

...

(iii) in making disclosures that are required or protected under the Sarbanes–Oxley Act of 2002 ....

Id. § 78u-6(h)(1)(A).

Both Sarbanes–Oxley and Dodd–Frank "shield whistleblowers from retaliation, but they differ in important respects." Digital Realty Tr., Inc. v. Somers , ––– U.S. ––––, 138 S. Ct. 767, 772, 200 L.Ed.2d 15 (2018). Although Sarbanes–Oxley "applies to all ‘employees’ who report misconduct to the [SEC], any other federal agency, Congress, or an internal supervisor ... Dodd–Frank delineates a more circumscribed class." Id. As mentioned, the Act defines a "whistleblower" as a person who provides "information relating to a violation of the securities laws to the Commission," 15 U.S.C. § 78u-6(a)(6), and a whistleblower is protected from retaliation for "making disclosures that are required or protected under" Sarbanes–Oxley, id. § 78u–6(h)(1)(A)(iii). In Somers , the Supreme Court interpreted these sections to mean that "[t]o sue under Dodd–Frank's anti-retaliation provision, a person must first ‘provide[e] ... information relating to a violation of securities laws to the Commission.’ "¹⁶ 138 S. Ct. at 772–73.

16 This limitation does not outright bar Erhart's Dodd–Frank claim. He states he submitted a whistleblower complaint to the SEC before some of the alleged retaliation occurred. (Erhart Summ. J. Opp'n Decl. ¶ 20.)

BofI moves for partial summary judgment on Erhart's Dodd–Frank claim. (BofI's Mot. 47:1–18.) It highlights that making disclosures under Sarbanes–Oxley is the "broadest" type of protected reporting under Dodd–Frank. (Id. 47:11–12.) Hence, the Bank argues that if Erhart's reporting of alleged wrongdoing does not meet the protected activity standard for Sarbanes–Oxley, his Dodd–Frank claim similarly fails to the same extent. (Id. 47:16–18.)

The Court agrees. The Court has already determined various categories of believed misconduct are not actionable under Sarbanes–Oxley's whistleblower retaliation provision. The Court concludes these beliefs similarly fail to constitute protected activity for Erhart's Dodd–Frank claim because they were not "disclosures ... protected under the Sarbanes Oxley Act." See 15 U.S.C. § 78u-6(h)(1)(A)(iii). Nor does Erhart demonstrate the deficient categories sufficiently relate "to a violation of the Securities laws," see id. § 78u-6(a)(6), which would make them independently protected under Dodd–Frank, see id. § 78u-6(h)(1)(A)(iii).¹⁷ The Court thus grants BofI's request and summarily adjudicates Erhart's Dodd–Frank claim as to those categories of beliefs the Court eliminated above. III. California Labor Code Section 1102.5

17 For these reasons, the Court need not reach the Bank's argument that Erhart's Dodd–Frank claim fails for two categories of conduct because he purportedly did not report this conduct to the SEC. (See BofI's Mot. 50:20–28.)

BofI also seeks to partially adjudicate Erhart's whistleblower retaliation claim under California Labor Code section 1102.5. (BofI's Mot. 46:1–47:10.) Section 1102.5 provides:

An employer ... shall not retaliate against an employee for disclosing information, or because the employer believes that the employee disclosed or may disclose information, to a government or law enforcement agency [or] to a person with authority over the employee ... if the employee has reasonable cause to believe that the information discloses a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information is part of the employee's job duties.

Cal. Labor Code § 1102.5(b). This provision is "California's general whistleblower statute." McVeigh v. Recology San Francisco , 213 Cal. App. 4th 443, 468, 152 Cal.Rptr.3d 595 (2013). It reflects the state's "broad public policy interest in encouraging workplace whistle-blowers to report unlawful acts without fearing retaliation." Green v. Ralee Eng'g Co. , 19 Cal. 4th 66, 77, 78 Cal.Rptr.2d 16, 960 P.2d 1046 (1998).

Like the federal whistleblower retaliation provisions analyzed above, a claim under section 1102.5 requires a plaintiff to first establish a prima facie case of retaliation. Ross v. Cty. of Riverside , 36 Cal. App. 5th 580, 591, 248 Cal.Rptr.3d 696 (2019). The plaintiff must demonstrate: "(1) the plaintiff engaged in protected activity, (2) the defendant subjected the plaintiff to an adverse employment action, and (3) there is a causal link between the two." Id.

As to the first element, "[a]n employee engages in activity protected by the statute when the employee discloses ‘reasonably based suspicions’ of illegal activity." Ross , 36 Cal. App. 5th at 592, 248 Cal.Rptr.3d 696 (quoting Green , 19 Cal. 4th at 87, 78 Cal.Rptr.2d 16, 960 P.2d 1046 ). Hence, this California statute's scope is much broader than the two federal whistleblower protection provisions discussed above. Whereas Sarbanes–Oxley's and Dodd–Frank's provisions are generally concerned with securities law violations and corporate fraud, section 1102.5 encompasses violations of a "state or federal statute" or "a local, state, or federal rule or regulation." Compare 18 U.S.C. § 1514A, and 15 U.S.C. § 78u-6(h)(1)(A), with Cal. Labor Code § 1102.5(b). Decisions involving section 1102.5 confirm its sweeping breadth. See generally Hawkins v. City of Los Angeles , 40 Cal. App. 5th 384, 393–94, 252 Cal.Rptr.3d 849 (2019) (state vehicle code violations); Ross , 36 Cal. App. 5th at 592, 248 Cal.Rptr.3d 696 (prosecutor's ethical obligations under state law); see also Ferretti v. Pfizer Inc. , 855 F. Supp. 2d 1017, 1025–27 (N.D. Cal. 2012) (Food and Drug Administration regulations under section 1105.2(c)).

The Bank argues partial summary judgment on Erhart's section 1102.5 claim is appropriate for certain conduct because he fails to demonstrate a factfinder could conclude he reported a reasonable belief of a violation of any law. (BofI's Mot. 48:3–8.) Of these challenged categories, the Court already determined there is a triable issue on the 6th Category – Misleading Response to SEC Subpoena. Therefore, the remaining items that the Bank seeks to foreclose are:

2nd Category:	Altered Financial Statements
4th Category:	Improper Strategic Plan Approval
5th Category:	High Deposit Concentration Risk
7th Category:	Undisclosed Customer Accounts
8th Category:	Undisclosed Subpoenas
10th Category:	Miscalculated ALL
12th Category:	Sanitized Global Cash Card Review

(See BofI's Mot. 48:3–8.)¹⁸ The Court will thus consider whether Erhart meets his burden to demonstrate a factfinder could conclude he engaged in protected activity under section 1102.5 based on these beliefs.

18 Thus, the Bank does not challenge whether the following categories may support Erhart's state law whistleblower retaliation claim: 1st Category – Corrupted Structured Settlements & Lottery Audit; 3rd Category – Untimely 401(k) Payments; 9th Category – Unauthorized Risky Loans; 11th Category – Incomplete FDPA Audit; 13th Category – Improprieties in CEO's Account; and 14th Category – Improprieties in CEO's Brother's Account. (See BofI's Mot. 48:3–8.)

A. 2nd Category: Altered Financial Statements

In January 2014, Erhart participated in a meeting that included VP Ball, Chief Risk Officer Thomas Williams, and Chief Credit Officer Thomas Constantine. (Erhart Dep. 545:17–25, ECF No. 127-9.) During this meeting, Erhart states Mr. Constantine said that "he is not responsible for any of the Bank's numbers after they are turned over to the Chief Financial Officer." (See id. 548:1–13; Erhart Prelim. Inj. Decl. ¶ 17.) Mr. Constantine "reiterated that he could and would not vouch for the accuracy of the numbers once the CFO had them." (Erhart Prelim. Inj. Decl. ¶ 17.) Erhart further claims the meeting participants "paused with this awkward look" and "[i]t got quiet ... and no one said anything." (Erhart Dep. 545:17–25.) Erhart states he interpreted this incident "to mean that senior Bank management, at the CFO level and above, may be falsifying the Company's financials." (Erhart Prelim. Inj. Decl. ¶ 17 (emphasis added).)

BofI argues partial summary judgment is appropriate because Erhart did not disclose a reasonable belief of a violation of law on this basis. (BofI's Mot. 47 n.33, 48:3–5; see also id. 9:9–10:7.) The Bank highlights that Erhart never performed any type of investigation to attempt to figure out what Mr. Constantine meant.¹⁹ (Erhart Dep. 549:17–24, 559:2–560:4.) The Bank also argues his belief lacked any specificity: "It concerned no particular item in a financial statement, nor specified the nature of any financial statement alteration." (BofI's Mot. 9:24–25.) Consequently, BofI argues no reasonable internal auditor in Erhart's position would reasonably suspect BofI was falsifying its financial statements. (Id. 9:1–7.)

19 BofI also submits a declaration from Mr. Constantine, where he declares his statement that he is "not responsible for any of the Bank's numbers after they are turned over to the Chief Financial Officer" simply "demarcated the routine delegation of responsibility for financial information from a business division within BofI to BofI's Finance and Accounting department and CFO." (Constantine Decl. ¶ 3, ECF No. 127-4.) Mr. Constantine "did not intend this statement to mean anyone at BofI ... was falsifying BofI's financials." (Id. )

The Court agrees. For one, Erhart never goes so far to state he believed financial statement fraud was occurring. (See Erhart Prelim. Inj. Decl. ¶ 17.) But regardless, Erhart does not produce sufficient evidence for a reasonable factfinder to conclude he engaged in protected activity on this basis. It is not objectively reasonable as a matter of law for an internal auditor in Erhart's position—with his background and experience—to believe the Bank was falsifying its financial statements because Mr. Constantine said "he is not responsible for any of the Bank's numbers after they are turned over to" the Bank's CFO. (See id. ) Given that Erhart's belief must be reasonable, this "scintilla of evidence" is inadequate to for a factfinder to conclude he had a reasonably based suspicion of financial statement fraud. See Anderson , 477 U.S. at 252, 106 S.Ct. 2505 ; cf. Nielsen , 762 F.3d at 223 (affirming dismissal of Sarbanes–Oxley retaliation claim where the "connection between [the plaintiff's] claims and supposed fraud against shareholders [was] simply too tenuous"). The Court thus grants partial summary judgment on this basis.

B. 4th Category: Improper Strategic Plan Approval

As outlined above, this category involves Erhart's belief that the Bank backdated its internal approval of a fiscal strategic plan. The Court concluded Erhart failed to demonstrate this conduct falls into any of the categories enumerated in Sarbanes–Oxley's whistleblower retaliation provision. The Bank further moves for a determination that this conduct does not support the protected activity element of Erhart's California whistleblower retaliation claim. (BofI's Mot. 48:3–7.) The Court grants the request. Erhart does not explain why this conduct may nevertheless violate a provision of law not encompassed by Sarbanes–Oxley or Dodd–Frank.²⁰ Because he fails to convincingly demonstrate a reasonable factfinder could conclude he reported a violation of the law,²¹ the Court grants partial summary judgment on his California whistleblower retaliation claim.

20 Unlike his Second Amended Complaint and his Preliminary Injunction Declaration, Erhart's Summary Judgment Opposition Declaration explicitly mentions he believed the signatures on the minutes approving the Strategic Plan may have been "forged." (Compare SAC ¶ 21, and Erhart Prelim. Inj. Decl. ¶ 21, with Erhart Summ. J. Opp'n Decl. ¶ 10.) Erhart's opposition similarly mentions the word "forged" twice. (Erhart's Opp'n 7:8; 34:12.) His memorandum, however, is otherwise unhelpful—it never mentions the elements of forgery under state law or cites to any relevant provisions of the California Penal Code. For this reason alone, the Court concludes Erhart does not meet his burden to show reporting this conduct was protected activity on the theory that the allegedly backdated Strategic Plan approval amounted to forgery.
Nonetheless, for the avoidance of doubt, the Court notes that the California Penal Code provides that a "person who, with intent to defraud another, makes, forges, or alters any entry in any book of records ... is guilty of forgery." Cal. Penal Code § 471. "The statute does not limit the term ‘book of records’ in any fashion; rather, it broadly refers to ‘any’ such book." People v. Dunbar , 209 Cal. App. 4th 114, 117, 146 Cal.Rptr.3d 673 (2012). Thus, the provision is not limited to public records. Id. at 119, 146 Cal.Rptr.3d 673. The crime still, however, requires a specific intent to "defraud another." Cal. Penal Code § 471. In interpreting the same requirement in another forgery statute—section 470—the California Court of Appeal noted that "only schemes to prejudice, damage or defraud persons as to their legal rights, generally money or property, are within the ambit of section 470." Lewis v. Superior Court , 217 Cal. App. 3d 379, 398–99, 265 Cal.Rptr. 855 (1990). Erhart fails to demonstrate as a matter of law that the Strategic Plan approval was part of such a scheme here. Cf. Dunbar , 209 Cal. App. 4th at 119–20, 146 Cal.Rptr.3d 673 (reasoning where criminal defendant used forged bank deposit slip receipts to cause false entries to be made into private company's financial records as part of a scheme to short the company $6.8 million, this conduct fell within the ambit of section 471 ). The Court thus also rejects a forgery theory on this second rationale.

21 In the same vein, Erhart fails to explain to the Court why handbook guidance from the OCC—absent a specific underlying law or regulation—would be a "federal statute ... or federal rule or regulation." See Cal. Labor Code § 1102.5(b). Hence, although Erhart states he believed OCC handbooks required approval of the Bank's Strategic Plan, he does not connect the dots for the Court to demonstrate he has a triable section 1102.5(b) claim on this basis. The Court will not "go fishing through [banking] law and regulation for provisions [Erhart] may have believed were violated." See Lamb , 249 F. Supp. 3d at 915 n.4.

C. 5th Category: High Deposit Risk Concentration ²²

22 The Bank did not challenge whether this conduct could be protected activity for Erhart's Sarbanes–Oxley claim. (See BofI's Mot. 8:23–9:8.)

BofI assigned Erhart "to the Enterprise Risk Management (‘ERM’) audit in 2014." (JSUF ¶ 53.) This audit's objections "were to determine if BofI had an ERM program in place to identify potential events that may adversely affect BofI, manage risk, and provide reasonable assurances regarding strategic objectives." (Id. ¶ 54.)

"For Erhart's use in conducting the ERM audit, [SVP] Tolla instructed a BofI analyst to run a deposit concentration report." (JSUF ¶ 56.) Erhart later sent an e-mail to the Bank's Chief Risk Officer Thomas Williams regarding the Bank's deposit concentration risk. (Erhart Prelim. Inj. Decl. ¶ 22; BofI's Mot. Ex. DD, ECF No. 127-36.) In the e-mail, Erhart wrote:

In preparing for the upcoming Enterprise Risk Management Audit I noticed that as of 11/20/2014 the four (4) largest Business Banking customers together account for approximately 25% of the total bank deposits, and that the nine (9) largest Business Banking customers together account for approximately 40% of the total bank deposits (see the link to the Report below). Do you think this presents a deposit concentration risk to the Bank having such a large percentage of the Bank's deposits spread across only a few number of customers?

(BofI's Mot. Ex. DD.) In his declaration, Erhart explains he was concerned because deposit concentration is a "serious concern" for the Bank and could affect "its compliance with regulators." (Erhart Prelim. Inj. Decl. ¶ 22.) Williams responded to his concerns. (BofI's Mot. Ex. DD.) Erhart states he was later "summoned" to SVP Tolla's office who then commented on Erhart's e-mail to Williams and "instructed [him] to not put [his] concerns in writing." (Erhart Prelim. Inj. Decl. ¶ 24.) Erhart claims BofI was "instructing audit staff not to create written evidence of its non-compliance and illegal conduct." (Id. ) In his opposition, he argues in a conclusory fashion that he reasonably believed this conduct "was both a books and records violation as well as an internal control and shareholder fraud violation." (Erhart's Opp'n 8:18–20.)

The Bank argues Erhart fails to demonstrate protected activity on this basis. (BofI's Mot. 48:7–8.) The Court agrees. Erhart does not explain why a reasonable jury could conclude this conduct was a violation of the Books-and-Records Rule. Assuming Erhart was told not to put his concern over deposit concentration risk in writing, this does not implicate a failure to keep "books, records, and accounts, which, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the issuer." See 15 U.S.C. § 78m(b)(2)(A). The same conclusion is true for his conclusory invocation of the Internal Controls Rule. Erhart does not demonstrate this conduct reveals a failure of the Bank to maintain internal control over financial reporting. See 17 C.F.R. § 240.13a–15(a). As for potential shareholder fraud, Erhart's opposition again does not even mention the elements of this theory, and he does not meet his burden to show he disclosed an objectively reasonable belief of this type of violation. See Van Asdale , 577 F.3d at 1001 ; see also In re ChinaCast , 809 F.3d at 472, 474 (noting "scienter or intent to defraud" is "a bedrock requirement of Rule 10b–5"). The Court will not patch together a triable retaliation claim for him.

Moreover, although a high deposit concentration risk and this conduct may violate some type of banking regulation or other state or federal law, Erhart's opposition does not attempt to connect the dots for the Court. The Court again declines to "go fishing through [banking] law and regulation for provisions [Erhart] may have believed were violated." See Lamb , 249 F. Supp. 3d at 915 n.4. The Court thus grants partial summary judgment on this issue.

D. 7th, 8th, and 12th Categories: Undisclosed Customer Accounts, Undisclosed Subpoenas, and Sanitized Global Cash Card Review

These categories all concern the Bank's interactions with its principal regulator, the OCC. Erhart states he believes the Bank was defrauding its regulator by (1) instructing him to remove negative findings from audit reports, (2) making misleading or false communications to the OCC, and (3) hiding information from it. (See Erhart Summ. J. Opp'n Decl. ¶¶ 6, 13, 15; see also Erhart Prelim. Inj. Decl. ¶¶ 32–33, 39, 41–43, 49, 50, 52; Erhart's Opp'n 4:27–28, 14:6–7, 19:16–19; 20:26–27; 33:8–9.) The Bank also purportedly refused to let internal audit employees communicate in writing during the OCC's regulatory examination. (See Erhart Prelim. Inj. Decl. ¶ 44.) And when Erhart's boss, the VP of Internal Audit, abruptly resigned under disputed but questionable circumstances around the time of the examination, BofI purportedly instructed audit staff "not to inform the OCC that Mr. Ball had resigned." (Id. ¶ 45.)

For the reasons explained above, the Court concluded Erhart fails to demonstrate this conduct implicates the types of laws listed in Sarbanes–Oxley's and Dodd–Frank's whistleblower protection provisions. The Bank maintains, however, that there is also "no evidence" that Erhart disclosed "any potential violation of law" for these items to support his broader California whistleblower retaliation claim. (BofI's Mot. 48:4–5.)

The Court is unconvinced. As part of the Department of the Treasury, the OCC is a bureau "charged with assuring the safety and soundness of, and compliance with laws and regulations, fair access to financial services, and fair treatment of customers by, the institutions and other persons subject to its jurisdiction." 12 U.S.C. § 1. The OCC "is authorized, under such regulations as [it] may prescribe ... to provide for the organization, incorporation, examination, operation, and regulation of associations to be known as Federal savings associations (including Federal savings banks)." 12 U.S.C. § 1464(a). Thus, given that BofI is a federal savings association, the OCC is its primary regulator. (JSUF ¶¶ 1, 4.)

The OCC has the authority to appoint examiners to examine subject banks like BofI as often as the OCC deems necessary. 12 U.S.C. § 1. Under its regulations, the OCC "is required to conduct a full-scope, on-site examination of every national bank and Federal savings association at least once during each 12–month period." 12 C.F.R. § 4.6. And "[i]n the course of any examination of a savings association, upon request by the [OCC], prompt and complete access shall be given to all savings association officers, directors, employees, and agents, and to all relevant books, records, or documents of any type ." 12 U.S.C. § 1464(d)(1)(B) (emphasis added). Indeed, the Bank itself acknowledges that the "OCC has its own specific rules that prohibit financial institutions subject to its regulations from withholding information or refusing to disclose information." (BofI's Mot. 21:5–8 (citing 12 U.S.C. § 481 ; 12 C.F.R. § 4.6 ).)

Beyond this specific regulatory regime, the law also more broadly prohibits defrauding a federal regulator. The federal conspiracy statute, 18 U.S.C. § 371, makes it a crime for "two or more persons" to "conspire ... to defraud the United States, or any agency thereof in any manner or for any purpose." The phrase "to defraud ... in any manner or for any purpose" covers "any conspiracy for the purpose of impairing, obstructing or defeating the lawful function of any department of Government." United States v. Rodman , 776 F.3d 638, 642 (9th Cir. 2015) (quoting Tanner v. United States , 483 U.S. 107, 128, 107 S.Ct. 2739, 97 L.Ed.2d 90 (1987) ). This prohibition includes "obstructing the operation of any government agency by any ‘deceit, craft or trickery, or at least by means that are dishonest." Id. (quoting United States v. Caldwell , 989 F.2d 1056, 1058 (9th Cir. 1993) ). The Ninth Circuit has "also clarified that a conspiracy need not deprive the government of property, involve any detrimental reliance by the government, or involve independently illegal goals or means." Id. Hence, 18 U.S.C. § 371 prohibits "(1) ... an agreement (2) to obstruct a lawful function of the government (3) by deceitful or dishonest means and (4) at least one overt act in furtherance of the conspiracy." Id. ; see also United States v. Hughes Aircraft Co. , 20 F.3d 974, 976, 981 (9th Cir. 1994) (upholding corporate defendant's conviction under § 371 where employee submitted false paperwork to the Government and the employee's "supervisors did nothing about it").

When the evidence is construed in Erhart's favor, a reasonable factfinder could conclude he "disclose[d] ‘reasonably based suspicions’ of illegal activity" concerning the Bank's interactions with the OCC. See Ross , 36 Cal. App. 5th at 592, 248 Cal.Rptr.3d 696 (quoting Green , 19 Cal. 4th at 87, 78 Cal.Rptr.2d 16, 960 P.2d 1046 ). At minimum, a factfinder could conclude Erhart reasonably suspected the Bank was violating the law by withholding or refusing to provide accurate information to the OCC. See 12 U.S.C. § 1464(d)(1)(B) (providing the OCC upon request shall be given "prompt and complete access ... to all relevant books, records, or documents of any type"). Further, giving credence to Erhart's beliefs, his observations, and statements purportedly made by senior Bank officials, a factfinder could also conclude Erhart disclosed reasonably based suspicions that individuals at the Bank were attempting to obstruct the OCC's lawful examination and regulation of the Bank by "deceit, craft or trickery, or at least by means that are dishonest." See Rodman , 776 F.3d at 642.

Again, the Court emphasizes that it is not drawing any conclusions about the legality of BofI's conduct. The Bank submits evidence suggesting Erhart's beliefs were incorrect, his concerns were overblown, and nothing nefarious happened involving the OCC. (See BofI's Mot. 15:1–23:25.) But the test is whether when viewing the evidence in the light most favorable to Erhart, a reasonable factfinder could conclude he had "reasonable cause to believe that the information" he reported "disclose[d] a violation of state or federal statute, or a violation of or noncompliance with a local, state, or federal rule or regulation, regardless of whether disclosing the information [was] part of [his] job duties." See Cal. Labor Code § 1102.5(b). Erhart has demonstrated there is a genuine issue for trial with respect to his beliefs concerning the Bank's interactions with the OCC. Hence, the Court denies the Bank's request for partial summary judgment on the categories that involve these beliefs.

E. 10th Category: Miscalculated ALL

To recap, this category concerns Erhart's stated belief that BofI was possibly miscalculating its ALL—a reserve for bad debts. The Court determined above that it was not objectively reasonable as a matter of law for Erhart to believe BofI was violating one of the laws listed in § 1514A. Erhart does not show the outcome should be any different for his section 1102.5 claim. Therefore, he similarly does not demonstrate it was reasonable for someone in his circumstances to believe this conduct violated a "state or federal statute" or "a local, state, or federal rule or regulation." See Cal. Labor Code § 1102.5(b). The Court thus grants summary judgment on Erhart's section 1102.5 claim on this basis.²³

23 BofI also seeks partial summary judgment on Erhart's allegation regarding altered Bank Secrecy Act reports. (BofI's Mot. 48:7.) The Court noted above that Erhart does not meaningfully develop this allegation in his opposition or explain why this conduct violates a segment of laws identified in § 1514A. Erhart similarly does not produce sufficient evidence for a factfinder to conclude he had an objectively reasonable belief that a law was being violated. The Court thus grants BofI's request for partial summary judgment on this issue for Erhart's section 1102.5 claim as well.

In sum, the Court grants BofI's request for partial summary adjudication of Erhart's section 1102.5 claim as to Erhart's beliefs concerning the 2nd Category – Altered Financial Statements, 4th Category – Improper Strategic Plan Approval, 5th Category – High Deposit Risk Concentration, and 10th Category – Miscalculated ALL. The Court denies BofI's request for partial summary judgment on Erhart's claims for his beliefs regarding the 7th, 8th, and 12th Categories – Undisclosed Customer Accounts, Undisclosed Subpoenas, and Sanitized GCC Review.

IV. Wrongful Discharge in Violation of Public Policy

Last, BofI challenges Erhart's state law claim for wrongful discharge in violation of public policy. (BofI's Mot. 48:8–10.) "[W]hen an employer's discharge of an employee violates fundamental principles of public policy, the discharged employee may maintain a tort action and recover damages traditionally available in such actions." Tameny v. Atl. Richfield Co. , 27 Cal. 3d 167, 170, 164 Cal.Rptr. 839, 610 P.2d 1330 (1980). "The elements of a claim for wrongful discharge in violation of public policy are (1) an employer-employee relationship, (2) the employer terminated the plaintiff's employment, (3) the termination was substantially motivated by a violation of public policy, and (4) the discharge caused the plaintiff harm." Yau v. Santa Margarita Ford, Inc. , 229 Cal. App. 4th 144, 154, 176 Cal.Rptr.3d 824 (2014). This cause of action protects reporting "a statutory violation for the public's benefit." Green , 19 Cal. 4th at 76, 78 Cal.Rptr.2d 16, 960 P.2d 1046. "[A]n employee need not prove an actual violation of law; it suffices if the employer fired him for reporting his ‘reasonably based suspicions’ of illegal activity." Id. ; see also Wadler , 916 F.3d at 1189–91 (discussing this claim in the whistleblower retaliation context).

BofI argues Erhart's wrongful termination claim is derivative of his Sarbanes–Oxley, Dodd–Frank, and California Labor Code section 1102.5 claims. (BofI's Mot. 48:8–10.) The Bank contends partial summary judgment on this claim is therefore appropriate "for the same reasons and to the same extent." (Id. ) Erhart does not meaningfully argue otherwise. (See Erhart's Opp'n 44:3–6.) And the Court agrees. To the extent the Court has summarily adjudicated Erhart's other claims discussed above in the Bank's favor, the Court similarly grants partial summary judgment in BofI's favor on Erhart's state law wrongful discharge claim. However, to the extent the Court has denied the Bank's requests for partial summary judgment, the Court similarly denies its request to summarily adjudicate Erhart's wrongful discharge claim.

ERHART'S MOTION

Erhart moves for summary judgment on all of the Bank's claims. (Erhart's Mot. 1:6–1:10, ECF No. 137.) The Bank's claims center on Erhart's access to confidential information and his alleged misuse of this information. (BofI's First Am. Compl. ("FAC") ¶¶ 47–98, No. 15-cv-2353-BAS-NLS, ECF No. 12.) The Bank defines its "confidential information" as:

(i) information containing BofI's intellectual property, including, without limitation, that which it licenses from third parties;

(ii) confidential and proprietary information belonging to BofI, its employees, its business counterparties, and/or its clients; and

(iii) information containing the non-public personal information of BofI employees, business counterparties, and clients[.]

(Id. ¶ 11.) As mentioned above, the Bank claims Erhart abused his access to this information, performed "rogue investigations," and failed to complete his assigned audits. (Id. ¶¶ 23–29.) BofI further claims that Erhart improperly took and disclosed its confidential information and deleted data from his company-issued laptop. (Id. ¶¶ 43–46.)

Based on these allegations, the Bank brings eight claims against Erhart, including breach of contract, breach of the duty of loyalty, and violation of the Computer Fraud and Abuse Act. (BofI's FAC ¶¶ 44–98.) The Court addressed these claims when analyzing Erhart's affirmative defenses and his Rule 12(c) motion. Because these orders influence the Court's summary judgment analysis, the Court reviews them before turning to Erhart's challenges.

I. Prior Determinations

A. Rule 12(c) Order

Erhart moved under Federal Rule of Civil Procedure 12(c) for judgment on the pleadings as to almost all of BofI's claims. Although the Court expressed skepticism about portions of these claims, it noted that "with few exceptions, it is limited under Rule 12(c) to considering the factual allegations contained in the pleadings." ( Rule 12(c) Order 4:27–28, ECF No. 123.) The Court also underscored that "a pleadings motion is not the proper venue to resolve the parties' competing factual contentions regarding what transpired during Erhart's tenure at the Bank." (Id. 5:5–7.) The Court then analyzed the legal sufficiency of each challenged claim and concluded BofI's allegations withstand scrutiny under Rule 12(c). (Id. 5:10–17:21.) In doing so, the Court addressed a variety of legal issues, including whether BofI could sue its former employee under several state law causes of action. (See id. ) Hence, although Erhart now challenges BofI's claims under Rule 56, the Court's legal determinations apply with equal force. The Court will incorporate its prior determinations as it addresses Erhart's revived challenges to BofI's claims below.

B. Affirmative Defenses Order

The Court also commented on BofI's claims when addressing Erhart's whistleblower-related affirmative defenses. (Affirmative Defenses Order, ECF No. 40.) The Bank moved for summary adjudication of these defenses, arguing they fail because at least some of Erhart's conduct cannot be considered protected whistleblower activity as a matter of law. To resolve the Bank's motion, the Court analyzed Erhart's defenses primarily in the context of the Bank's breach of contract claim. (Id. 11:11–32:16.) This claim is based on an Employee Confidentiality, Non-Disclosure, and Non-Recruitment Agreement ("Confidentiality Agreement") that Erhart executed as a condition of his employment. (Id. 3:7–20.) The Court construed Erhart's whistleblower defenses to allege that enforcing the Confidentiality Agreement would be illegal. (Affirmative Defenses Order 11:20–12:8.) The Court thus analyzed under California law whether the Confidentiality Agreement should not be enforced—or at least not be enforced fully. (Id. 12:9–15:12.) This analysis required the Court to consider the interest in enforcing the Confidentiality Agreement, the public policy against enforcement, and whether the public policy clearly outweighs the interest in enforcement. (Id. 15:14–19:19.) The Court did so for five categories of Erhart's conduct to determine if enforcement would be against public policy. (Id. 19:22–32:16.) These categories were: (1) Erhart's communications with the Government; (2) Erhart's appropriation of BofI's files; (3) Erhart's disclosure of some confidential information for safekeeping purposes; (4) Erhart's and his counsel's purported disclosures to the press; and (5) Erhart's disclosure of information in his whistleblower retaliation complaint. (Id. )

In brief, the Court determined the Confidentiality Agreement cannot be enforced as to Erhart's whistleblower communications with the Government. (Affirmative Defenses Order 19:21–20:6.) As to the second item, the Court determined a public policy exception may cover Erhart's appropriation of BofI's files, and there is a genuine issue for trial as to whether Erhart's removal of documents was "reasonably necessary" to support his allegations of wrongdoing. (Id. 20:8–25:6.) The Court similarly determined there was a question of fact as to whether Erhart's disclosure of some of the Bank's information for safekeeping purposes could be shielded by his affirmative defenses. (Id. 25:8–28:4.) Fourth, the Court determined purported disclosures to the press are not shielded by the relevant whistleblower statutes. (Id. 29:1–30:1.) Finally, factual issues remained for the final category of conduct regarding Erhart's whistleblower allegations. (Id. 30:23–32:16.)

Although the Court's analysis focused on BofI's claim for breach of the Confidentiality Agreement, the Court also briefly addressed BofI's state law tort claims. (Affirmative Defenses Order 32:18–33:14.) The Court construed Erhart's whistleblower protection defenses as raising a defense of justification or privilege to the tort claims under state law. (Id. ) The Court reasoned: "It is implicit in the various whistleblower protection provisions that if an employee is permitted to provide information regarding believed wrongdoing to the government, including documents, the employer cannot then seek to impose tort liability on the employee for the same conduct." (Id. 33:7–10.) The Court thus denied BofI's request for summary adjudication of Erhart's whistleblower protection defenses, concluding genuine issues of fact remained for trial. (Id. 12:13–34:4.)

Even though the Court made these determinations when considering Erhart's affirmative defenses, the Court's legal conclusions similarly apply to Erhart's request to dispose of BofI's claims under Rule 56. Hence, if BofI demonstrates a factfinder could conclude Erhart did not engage in protected activity—or that he exceeded what is permitted under the relevant whistleblower statutes—the Court cannot summarily dispose of BofI's claims on account of Erhart's "whistleblower" status. The Court rejects Erhart's arguments contending otherwise. With that backdrop in mind, the Court turns to Erhart's Rule 56 challenges to BofI's claims.

II. CUTSA Displacement

The Court first addresses Erhart's threshold argument concerning California's Uniform Trade Secrets Act ("CUTSA"). The Court recognized the possibility that CUTSA may impact BofI's claims in the Court's Rule 12(c) Order, but the Court declined to address this issue because Erhart did not raise it. ( Rule 12(c) Order 5 n.3.) Erhart now argues CUTSA displaces BofI's claims for fraud, negligence, conversion, and breach of the duty of loyalty, and the Bank has had the opportunity to respond. (Erhart's Mot. 5:17–7:20, BofI's Opp'n 8:14–11:18, ECF No. 155.)

Under CUTSA, a party may recover for the "actual loss" or other injury caused by the misappropriation of trade secrets. Cal. Civ. Code § 3426.3. CUTSA defines misappropriation as (1) the improper acquisition of a trade secret or (2) the non-consensual disclosure or use of a trade secret. Id. § 3426.1(b). A "trade secret" is information that derives "independent economic value" from its confidentiality and is subject to "efforts that are reasonable under the circumstances to maintain its secrecy." Id. § 3426.1(d). "CUTSA provides the exclusive civil remedy for conduct falling within its terms." Silvaco Data Sys. v. Intel Corp. , 184 Cal. App. 4th 210, 236, 109 Cal.Rptr.3d 27 (2010), disapproved on other grounds by Kwikset Corp. v. Superior Court , 51 Cal. 4th 310, 337, 120 Cal.Rptr.3d 741, 246 P.3d 877 (2011).

Because CUTSA provides an exclusive remedy, Courts have reasoned it displaces common law tort claims in two circumstances. First, CUTSA displaces claims that are "based on the same nucleus of facts as the misappropriation of trade secrets claim for relief."²⁴ K.C. Multimedia, Inc. v. Bank of Am. Tech. & Operations, Inc. , 171 Cal. App. 4th 939, 958, 90 Cal.Rptr.3d 247 (2009). Stated differently, CUTSA displaces tort claims where they "do not genuinely allege ‘alternative legal theories’ but are a transparent attempt to evade the strictures of CUTSA by restating a trade secrets claim as something else." Silvaco , 184 Cal. App. 4th at 240, 109 Cal.Rptr.3d 27 ; see also K.C. Multimedia , 171 Cal. App. 4th at 960–92, 90 Cal.Rptr.3d 247 (concluding CUTSA displaced breach of confidence, interference with contract, and unfair competition claims).

24 The terms "displacement," "preemption," and "supersession" have all been used to describe CUTSA's effect. The California Court of Appeal has reasoned:

"Technically, the doctrine of preemption concerns whether a federal law has superseded a state law or a state law has superseded a local law, not whether one provision of state law has displaced other provisions of state law. Here, the [relevant claims] are all matters of state law. Accordingly, we will use the word ‘displace’ in discussing this issue." Although another Court of Appeal prefers the term "supersession" in discussing the impact [C]UTSA has on other laws and nominally non-[C]UTSA claims, we will adopt the nomenclature employed by our Supreme Court and discuss whether another law or claim has been "displaced" by [C]UTSA.

Angelica Textile Servs., Inc. v. Park , 220 Cal. App. 4th 495, 498, 163 Cal.Rptr.3d 192 (2013) (alterations omitted) (citations omitted) (citing Zengen, Inc. v. Comerica Bank , 41 Cal. 4th 239, 247, 59 Cal.Rptr.3d 240, 158 P.3d 800 (2007) ; Silvaco , 184 Cal. App. 4th at 232 n. 14, 109 Cal.Rptr.3d 27 ). The Court will similarly use this nomenclature.

Second, CUTSA displaces "all claims premised on the wrongful taking and use of confidential business and proprietary information, even if that information does not meet the statutory definition of a trade secret." ChromaDex, Inc. v. Elysium Health, Inc. , 369 F. Supp. 3d 983, 989 (C.D. Cal. 2019) ; accord Copart, Inc. v. Sparta Consulting, Inc. , 277 F. Supp. 3d 1127, 1158 (E.D. Cal. 2017) ; Mattel, Inc. v. MGA Entm't, Inc. , 782 F. Supp. 2d 911, 987 (C.D. Cal. 2011). Afterall, a "prime purpose" of the Uniform Trade Secrets Act "was to sweep away the adopting states' bewildering web of rules and rationales and replace it with a uniform set of principles for determining when one is—and is not—liable for acquiring, disclosing, or using ‘information ... of value.’ " Silvaco , 184 Cal. App. 4th at 239 n.22, 109 Cal.Rptr.3d 27. "Information that does not fit" the definition of a trade secret, "and is not otherwise made property by some provision of positive law, belongs to no one, and cannot be converted or stolen." Id. Hence, "if the basis of the alleged property right is in essence that the information ... is ‘not ... generally known to the public,’ then the claim is sufficiently close to a trade secret claim that it should be superseded notwithstanding the fact that the information fails to meet the definition of a trade secret." SunPower Corp. v. SolarCity Corp. , No. 12-CV-00694-LHK, 2012 WL 6160472, at *5 (N.D. Cal. Dec. 11, 2012) (citing Cal. Civ. Code § 3426.1(d)(1) ).

BofI's tort claims implicate these principles.²⁵ BofI does not plead a trade secrets misappropriation claim. But the gravamen of BofI's tort claims is that Erhart wrongfully accessed and took its "confidential and proprietary information." (See BofI's FAC ¶¶ 11, 13, 26, 55–56, 65, 70, 75–76.) Indeed, the Bank repeatedly uses the terms "misappropriate" and "misappropriation" in its pleading. (Id. ¶¶ 35, 38, 39, 59, 70, 88.) By not pleading a trade secrets misappropriation claim, BofI sidesteps CUTSA's requirements, including proving that the information rises to the level of a protectable trade secret. See Cal. Civ. Code § 3426.1(d). Yet the Bank still seeks to impose liability on Erhart for "acquiring, disclosing, or using" confidential information of purported value. See Silvaco , 184 Cal. App. 4th at 239 n.22, 109 Cal.Rptr.3d 27. (See also BofI's Opp'n 16:3–5 (arguing "there was value in the information Erhart converted because BofI invested time and expense in creating, assembling, and maintaining its data").)

25 CUTSA does not displace "contractual remedies, whether or not based upon misappropriation of a trade secret." Cal. Civ. Code § 3426.7(b). Consequently, CUTSA does not displace BofI's claim for breach of the Confidentiality Agreement based on similar allegations.

BofI nonetheless maintains that CUTSA does not displace its tort claims. The Bank's primary argument is that CUTSA is inapplicable because the information at issue "was not capable of securing some trade advantage." (BofI's Opp'n 10:2–26.) In other words, BofI argues the confidential information it is seeking to protect is not a trade secret, and therefore none of its claims are "sufficiently close to a trade secret claim." (Id. ) This argument is unpersuasive. It does not address the rule that CUTSA displaces "all claims premised on the wrongful taking and use of confidential business and proprietary information, even if that information does not meet the statutory definition of a trade secret." ChromaDex , 369 F. Supp. 3d at 989. And regardless, there is little doubt that some of the information BofI is trying to protect could be entitled to trade secret protection. (See Affirmative Defenses Order 16:16–19 (reasoning information contained in BofI's confidential Strategic Plan is likely subject to trade secret protection) (citing Whyte v. Schlage Lock Co. , 101 Cal. App. 4th 1443, 1454, 125 Cal.Rptr.2d 277 (2002) (holding company's strategic plan documents were trade secrets under California law)).)

That said, BofI demonstrates some of the allegations underlying its tort claims are distinguishable on another basis. The Bank argues Erhart improperly took nonpublic "customer financial information," which BofI has a duty to safeguard. (BofI's Opp'n 10:10–11.) For instance, Erhart sent a spreadsheet that contained BofI customers' Social Security numbers outside the Bank's systems—and not to the Government. (See Affirmative Defenses Order 5:19–21.) He also printed copies of documents, including "customer bank account information," and downloaded to his personal laptop "account information, wire transfer details, [and] account lists." (Id. 4:21–5:1.) Erhart admittedly kept documents containing information "in a bag that was buried in [his] closet under a bunch of items." (Erhart Dep. 192:8–13, ECF No. 155-2.) And there is a factual dispute as to whether he had permission to take documents home. (See Ball Dep. 93:5–15, ECF No. 155-5.)

Given this conduct, the Bank argues CUTSA does not displace BofI's tort claims that pursue Erhart for the damages it incurred to recover this sensitive information and prevent unauthorized disclosures. (See BofI's Opp'n 6:21–7:6; 14:17–19.) This argument has merit. BofI has an obligation to protect the nonpublic personal information of its customers.²⁶ In this sense, BofI's allegations concerning Erhart's unauthorized taking of customer financial information are more akin to a data breach claim than either a disguised trade secrets claim, see K.C. Multimedia , 171 Cal. App. 4th at 958, 90 Cal.Rptr.3d 247, or a "claim premised on the wrongful taking and use of confidential business and proprietary information," see ChromaDex , 369 F. Supp. 3d at 989. In the same vein, the Court finds distinguishable the Bank's allegation that Erhart wrongfully took nonpublic personal information of BofI's employees, such as BofI's CEO's personal tax returns. (See BofI's FAC ¶ 11; Erhart Dep. 639:7–640:14, ECF No. 155-3; Ball Dep. 318:7–18, ECF No. 155-6.) For CUTSA displacement, the Court finds there is a meaningful distinction between BofI's efforts to safeguard this information, as compared to the Bank's efforts to impose liability on Erhart for wrongfully taking "information containing BofI's intellectual property" and the Bank's "confidential and proprietary information." (See BofI's FAC ¶ 11.) Cf. CTC Real Estate Servs. v. Lepe , 140 Cal. App. 4th 856, 860, 44 Cal.Rptr.3d 823 (2006) (noting that one's personal identifying information "is a valuable asset" because its misuse "can have serious consequences to that person" and it can be the object of theft).

26 See, e.g. , 15 U.S.C. § 6801 ("[E]ach financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information."); Cal. Fin. Code § 4052.5 (providing that unless an exception applies, a "financial institution shall not sell, share, transfer, or otherwise disclose nonpublic personal information ... without the explicit prior consent of the consumer to whom the nonpublic personal information relates"); see also Cal. Civ. Code § 1798.81.5(b) ("A business that owns or licenses personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure."); In re Sony Gaming Networks & Customer Data Sec. Breach Litig. , 996 F. Supp. 2d 942, 966 (S.D. Cal. 2014) (finding "common sense and California" law support "a legal duty to safeguard a consumer's confidential information entrusted to a commercial entity").

Given this blended result, the Court finds CUTSA displaces portions of BofI's common law tort claims. To the extent that the Bank seeks to impose liability on Erhart for taking and misusing its amorphous confidential and proprietary business information, the Court finds CUTSA displaces BofI's tort claims. See ChromaDex , 369 F. Supp. 3d at 989 ; see also Silvaco , 184 Cal. App. 4th at 239 n.22, 109 Cal.Rptr.3d 27. It would defeat the purpose of CUTSA to allow BofI to maintain claims based on these allegations. See Silvaco , 184 Cal. App. 4th at 239 n.22, 109 Cal.Rptr.3d 27. The Court also rejects the Bank's conclusory, eleventh-hour request for leave to amend its complaint to plead a trade secrets misappropriation claim.²⁷ That said, the Court finds CUTSA does not displace BofI's tort claims with respect to the Bank's allegation that Erhart improperly took and misused its customers' and employees' nonpublic personal information. See Copart , 277 F. Supp. 3d at 1160 (summarily adjudicating portions of claims based on CUTSA displacement but concluding the claims survived for trial to the extent that they relied on other conduct).

27 In a footnote, BofI "seeks leave to amend its complaint to add a CUTSA claim" to the extent the Court believes CUTSA displaces the Bank's claims. (BofI's Opp'n 10 n.7.) The Court has discretion to permit amendment in response to a motion for summary judgment. See Desertrain v. City of Los Angeles , 754 F.3d 1147, 1154 (9th Cir. 2014) ; but see La Asociacion de Trabajadores de Lake Forest v. City of Lake Forest , 624 F.3d 1083, 1089 (9th Cir. 2010) (noting the plaintiff "may not effectively amend its Complaint by raising a new theory of standing in its response to a motion for summary judgment"); Wasco Prods., Inc. v. Southwall Techs., Inc. , 435 F.3d 989, 992 (9th Cir. 2006) ("Simply put, summary judgment is not a procedural second chance to flesh out inadequate pleadings.").
Rule 15 advises that "leave shall be freely given when justice so requires." Fed. R. Civ. P. 15(a). "Five factors are taken into account to assess the propriety of a motion for leave to amend: bad faith, undue delay, prejudice to the opposing party, futility of amendment, and whether the plaintiff has previously amended the complaint." Johnson v. Buckley , 356 F.3d 1067, 1077 (9th Cir. 2004). Because BofI has not shown these factors favor amendment, the Court denies its request. The Court regardless concludes granting leave would be inappropriate, particularly because it would be prejudicial to Erhart. Discovery has long since closed and only trial remains in this action. See Howey v. United States , 481 F.2d 1187, 1190 (9th Cir. 1973) ("[T]he crucial factor is the resulting prejudice to the opposing party.").

Accordingly, to the extent that BofI's tort claims seek to impose liability on Erhart for taking information, the Court will restrict the Bank's tort claims at trial to only those allegations involving its customers' and employees' nonpublic personal information. Thus, the Court grants in part Erhart's request for partial summary judgment on BofI's claims for fraud, negligence, conversion, and breach of the duty of loyalty. The Court will consider Erhart's other challenges to these claims separately below.

III. Negligence

BofI's negligence claim alleges Erhart harmed the Bank when he "misappropriated, destroyed, disclosed, and/or took BofI's Confidential Information." (BofI's FAC ¶¶ 68–71.) "The elements of a negligence cause of action are the existence of a legal duty of care, breach of that duty, and proximate cause resulting in injury." Castellon v. U.S. Bancorp , 220 Cal. App. 4th 994, 998, 163 Cal.Rptr.3d 637 (2013). "The first element, duty, ‘may be imposed by law, be assumed by the defendant, or exist by virtue of a special relationship.’ " Doe v. U.S. Youth Soccer Ass'n, Inc. , 8 Cal. App. 5th 1118, 1128, 214 Cal.Rptr.3d 552 (2017) (quoting Potter v. Firestone Tire & Rubber Co. , 6 Cal. 4th 965, 985, 25 Cal.Rptr.2d 550, 863 P.2d 795 (1993) ). Absent certain circumstances, "[e]veryone is responsible, not only for the result of his or her willful acts, but also for an injury occasioned to another by his or her want of ordinary care or skill in the management of his or her property or person." Cal. Civ. Code § 1714 ; see also Rowland v. Christian , 69 Cal. 2d 108, 112, 70 Cal.Rptr. 97, 443 P.2d 561 (1968).

In the Court's Rule 12(c) Order, it addressed Erhart's argument that he did not owe BofI—his former employer—a duty of care. The Court rejected this argument and found BofI sufficiently pleads a negligence claim. ( Rule 12(c) Order 9:1–9.) Aside from challenging this claim on CUTSA displacement grounds, which the Court finds persuasive in part for the reasons described above, Erhart argues BofI "cannot prove" it was damaged by Erhart's conduct. (Erhart's Mot. 11:8–4.) In response, BofI highlights several possible examples of harm, including the cost it incurred for a digital risk management firm to analyze Erhart's company-issued laptop and other electronic media he returned during this litigation. (BofI's Opp'n 14:27–15:5; see also id. 6:21–7:6.)

" ‘Damages’ are monetary compensation awarded to parties who suffer detriment for the unlawful act or omission of another; they are assessed by a court against wrongdoers for the commission of a legal wrong of a private nature." Meister v. Mensinger , 230 Cal. App. 4th 381, 396, 178 Cal.Rptr.3d 604 (2014) (citing Cal. Civ. Code § 3281 ). "Tort damages are awarded to compensate a plaintiff for all of the damages suffered as a legal result of the defendant's wrongful conduct." N. Am. Chem. Co. v. Superior Court , 59 Cal. App. 4th 764, 786, 69 Cal.Rptr.2d 466 (1997) (citing Cal. Civ. Code § 3333 ). But regardless of "its measure in a given case, it is fundamental that ‘damages which are speculative, remote, imaginary, contingent, or merely possible cannot serve as a legal basis for recovery.’ " Piscitelli v. Friedenberg , 87 Cal. App. 4th 953, 989, 105 Cal.Rptr.2d 88 (2001) (quoting Frustuck v. City of Fairfax , 212 Cal. App. 2d 345, 368, 28 Cal.Rptr. 357 (1963) ).

The Court concludes a negligence claim remains for trial. A reasonable jury could conclude Erhart breached his duty of care to the Bank as an internal auditor by mishandling customers' and bank employees' nonpublic personal information. A jury could also find Erhart damaged the Bank. BofI's reliance on the cost it paid for an outside firm to investigate Erhart's purported "data breach" is sufficient. Viewing this evidence in the light most favorable to the Bank, these damages are not "speculative, remote, [or] imaginary," see Piscitelli , 87 Cal. App. 4th at 989, 105 Cal.Rptr.2d 88, and a jury could determine BofI is entitled to recover tort damages to compensate it for this harm suffered due to Erhart's assumedly wrongful conduct, see N. Am. Chem. Co. , 59 Cal. App. 4th at 786, 69 Cal.Rptr.2d 466. Thus, the Court denies Erhart's request to summarily adjudicate the remainder of BofI's negligence claim.

IV. Breach of the Duty of Loyalty

The Bank argues Erhart breached his duty of loyalty by, among other things, misappropriating and wrongfully distributing its confidential information to unauthorized recipients. (BofI's FAC ¶¶ 61–67.) "The elements of a cause of action for breach of a duty of loyalty, by analogy to a claim for breach of fiduciary duty, are as follows: (1) the existence of a relationship giving rise to a duty of loyalty; (2) one or more breaches of that duty; and (3) damage proximately caused by that breach." Huong Que, Inc. v. Luu , 150 Cal. App. 4th 400, 410, 58 Cal.Rptr.3d 527 (2007). "During the term of employment, an employer is entitled to its employees' ‘undivided loyalty.’ " Fowler v. Varian Assocs., Inc. , 196 Cal. App. 3d 34, 41, 241 Cal.Rptr. 539 (1987) (quoting Sequoia Vacuum Sys. v. Stransky , 229 Cal. App. 2d 281, 287, 40 Cal.Rptr. 203 (1964) ). "The duty of loyalty is breached, and the breach ‘may give rise to a cause of action in the employer, when the employee takes action which is inimical to the best interests of the employer.’ " Id. at 414, 58 Cal.Rptr.3d 527 (quoting Stokes v. Dole Nut Co. , 41 Cal. App. 4th 285, 295, 48 Cal.Rptr.2d 673 (1995) ). Inimical means: "1. Behaving like an enemy; hostile. 2. Opposite or adverse in effect or tendency." Inimical , Black's Law Dictionary (10th ed. 2014).

Moreover, the California Court of Appeal has explained that "[t]he duty of loyalty embraces several subsidiary obligations." Huong , 150 Cal. App. 4th at 416, 58 Cal.Rptr.3d 527. These obligations include: (1) "the duty ‘to refrain from competing with the principal and from taking action on behalf of or otherwise assisting the principal's competitors’ "; (2) "the duty ‘not to acquire a material benefit from a third party in connection with ... actions taken ... through the agent's use of the agent's position’ "; and (3) "the duty ‘not to use or communicate confidential information of the principal for the agent's own purposes or those of a third party.’ " Id. at 416, 58 Cal.Rptr.3d 527 (quoting Restatement (Third) of Agency §§ 8.02, 8.04, 8.05(2) ).

In the Court's Rule 12(c) Order, it rejected Erhart's argument that he did not owe BofI a duty of loyalty as a matter of law. Erhart's argument was based on his status as a purported "lower-level employee," but the Court noted "California courts generally have not distinguished between managerial employees and lower-level employees with respect to the duty of loyalty." ( Rule 12(c) Order 7:3–7 (quoting E.D.C. Techs., Inc. v. Seidel , 216 F. Supp. 3d 1012, 1016 (N.D. Cal. 2016) ).) The Court doubles-down on this conclusion. See Arriaga v. Lara , No. H046183, 2020 WL 995141, at *20 (Cal. Ct. App. Mar. 2, 2020) ("We do not agree with respondents' contention that lower-level employees are exempt from any duty of loyalty. California law generally affords a broad scope to employees' duty of loyalty.").

BofI does not demonstrate a triable duty of loyalty claim based on the duty's first two "subsidiary obligations" identified by the California Court of Appeal in Huong . See 150 Cal. App. 4th at 416, 58 Cal.Rptr.3d 527. There is no evidence that Erhart competed with the Bank or took action on behalf of BofI's competitors. See id. Nor has the Bank produced sufficient evidence that Erhart "acquired a material benefit from a third party in connection with" actions Erhart took through the use of his position at the Bank. See id.

That said, the Court finds there is a genuine issue of material fact concerning whether Erhart violated the third subsidiary obligation: "the duty ‘not to use or communicate confidential information of the principal for the agent's own purposes or those of a third party.’ " See Huong , 150 Cal. App. 4th at 416, 58 Cal.Rptr.3d 527 (quoting Restatement (Third) of Agency § 8.05(2) ). There is evidence suggesting Erhart used and disclosed customers' and employees' nonpublic personal information.²⁸ This issue largely overlaps with the Court's discussion of Erhart's whistleblower defenses in the Affirmative Defenses Order. (See Affirmative Defenses Order 32:18–33:14.) A jury could conclude Erhart violated his duty of loyalty; it also could conclude he engaged in activity protected by whistleblower statutes and his extraneous conduct did not breach his duty of loyalty to the Bank. (See id. ) See Reporter's Notes to Restatement (Third) of Agency § 8.05(2) (noting that "in many whistleblowing cases the dispositive question is whether an employee's conduct is covered by a statute that explicitly protects whistleblowing activity"). Because there are disputed issues of fact concerning this issue, the Court denies Erhart's request to summarily adjudicate the remainder of BofI's breach of the duty of loyalty claim.

28 For the reasons discussed above, the Court concludes CUTSA displaces BofI's claim that Erhart violated his duty of loyalty by misusing the Bank's confidential and proprietary business information.

V. Conversion

BofI claims Erhart is liable for conversion because he took personal possession of BofI's property, including "documents containing Confidential Information" and a disc named "Bank of Internet," without the Bank's authorization. (BofI's FAC ¶¶ 31–33, 55–56.) "Conversion is the wrongful exercise of dominion over the property of another. The elements of a conversion claim are: (1) the plaintiff's ownership or right to possession of the property; (2) the defendant's conversion by a wrongful act or disposition of property rights; and (3) damages." Lee v. Hanley , 61 Cal. 4th 1225, 1240, 191 Cal.Rptr.3d 536, 354 P.3d 334 (2015).

The tort of conversion was traditionally limited to tangible personal property, but the tort has since "expanded well beyond its original boundaries." Welco Elecs., Inc. v. Mora , 223 Cal. App. 4th 202, 210, 166 Cal.Rptr.3d 877 (2014). "In determining whether property that was taken is subject to a conversion claim, courts have recognized that ‘[p]roperty is a broad concept that includes every intangible benefit and prerogative susceptible of possession or disposition.’ " Id. at 211, 166 Cal.Rptr.3d 877 (internal quotation marks omitted) (quoting Kremen v. Cohen , 337 F.3d 1024, 1030 (9th Cir. 2003) ); see also Lepe , 140 Cal. App. 4th at 860, 44 Cal.Rptr.3d 823 (reasoning one's personal identifying information can be "a valuable asset"). Therefore, courts have entertained cases for conversion of various property including credit card information, bootlegged copies of musical recordings, and a company's net operating loss amounts. Id. at 210–14, 166 Cal.Rptr.3d 877 (collecting cases). Consequently, "the unauthorized taking of an intangible property interest not merged with or reflected in tangible properly can be an actionable conversion." Id. at 211, 166 Cal.Rptr.3d 877. Furthermore, absolute ownership of the property is not required; the plaintiff "need only allege it is entitled to immediate possession at the time of conversion." Farmers Ins. Exch. v. Zerin , 53 Cal. App. 4th 445, 452, 61 Cal.Rptr.2d 707 (1997) (emphasis omitted) (quoting Bastanchury v. Times-Mirror Co. , 68 Cal. App. 2d 217, 236, 156 P.2d 488 (1945) ). A conversion claim still, however, can be displaced by CUTSA for the reasons outlined above. See, e.g. , Silvaco , 184 Cal. App. 4th at 238–40, 109 Cal.Rptr.3d 27.

Erhart claims BofI's conversion claim should be summarily adjudicated because he had authority to access the information BofI claims he took without permission. (Erhart's Mot. 12:6–13:19.) He also argues he returned any property belonging to the Bank, including his work laptop. (Id. ) The Bank counters that evidence exists that Erhart did not have authority to take BofI's property, and BofI further argues that Erhart's return of any property does not defeat the Bank's conversion claim—it simply affects the Bank's damages. (Id. )

The Court has already determined that CUTSA displaces part of this claim for the reasons discussed above. Hence, BofI's claim that Erhart broadly converted its confidential and proprietary information fails. The Bank's claim that Erhart converted nonpublic personal information of the Bank's customers and employees survives. Cf. Lepe , 140 Cal. App. 4th at 860, 44 Cal.Rptr.3d 823 ; see also Welco , 223 Cal. App. 4th at 212–13, 166 Cal.Rptr.3d 877 (noting private payment information can be subject to conversion (citing In re Easysaver Rewards Litig. , 737 F. Supp. 2d 1159 (S.D. Cal. 2010) )). Similarly, the Bank may maintain its claim that Erhart wrongfully took some of its personal property, such as keys and an access card, which BofI claims created a security risk. (See BofI's Opp'n 11:15–18, 19 n.11 (citing Erhart Dep. 81:14–21).)

Further, the Bank is correct that Erhart returning the property during the litigation may limit BofI's damages, but this change does not mean BofI lacks a triable conversion claim. See Krusi v. Bear, Stearns & Co. , 144 Cal. App. 3d 664, 673, 192 Cal.Rptr. 793 (1983) ("[A]lthough good faith and mistake are not defenses to an action for conversion, the plaintiff's damages will be reduced if the defendant returns the property or the plaintiff otherwise recovers the property."); see also Haines v. Parra , 193 Cal. App. 3d 1553, 1559, 239 Cal.Rptr. 178 (1987) (providing the plaintiff "may be able to demonstrate that he did properly expend some time and money in pursuit of the converted property for which he is entitled to a fair compensation"). Erhart may also argue to the jury that some or all of the property at issue was worthless and therefore cannot be the subject of a conversion claim. See Angelica , 220 Cal. App. 4th at 510, 163 Cal.Rptr.3d 192 ; U.S. Rubber Co. v. Union Bank & Tr. Co. , 194 Cal. App. 2d 703, 708–09, 15 Cal.Rptr. 385 (1961). These parts of BofI's conversion claim involve disputed issues of fact.

Because there are disputed issues of fact concerning BofI's conversion claim, the Court denies Erhart's request to dispose of this claim in its entirety.

VI. Fraud

BofI's fraud claim is predicated on Erhart purportedly conducting rogue investigations at the Bank. (BofI's FAC ¶¶ 72–79.) Under California law, the elements of a cause of action for fraud are: "(1) misrepresentation (false representation, concealment, or nondisclosure), (2) knowledge of falsity (or ‘scienter’), (3) intent to defraud (i.e., to induce reliance), (4) justifiable reliance, and (5) resulting damage." Lazar v. Superior Court , 12 Cal. 4th 631, 632, 49 Cal.Rptr.2d 377, 909 P.2d 981 (1996). "[F]raudulent intent is an issue for the trier of fact to decide." Beckwith v. Dahl. , 205 Cal. App. 4th 1039, 1061, 141 Cal.Rptr.3d 142 (2012). A fraud action "may arise from conduct that is designed to mislead, and not only from verbal or written statements." Tenet Healthsystem Desert, Inc. v. Blue Cross of Cal. , 245 Cal. App. 4th 821, 839, 199 Cal.Rptr.3d 901 (2016).

Aside from arguing CUTSA displaces this claim, Erhart argues the claim fails because BofI fails to demonstrate his investigations were "rogue." Rather, he argues his investigations were "within the scope of his duties as an internal auditor." (Erhart's Mot. 8:1–9:5.) The Court has noted that BofI's fraud claim "is not compelling." ( Rule 12(c) Order 6:11–12.) The Court previously concluded, however, that BofI pleads this claim with enough particularity to allow Erhart to "defend against the charge." (Id. 6:23–25 (citing Bly-Magee v. California , 236 F.3d 1014, 1019 (9th Cir. 2001) ).) The Bank's fraud claim remains feeble based on the evidence. However, the Bank makes a sufficient showing to rebut Erhart's Rule 56 challenge.

BofI policy requires that employees fully cooperate with internal auditors and respond to their requests for information. (Tolla Decl. ¶ 4, ECF No. 155-32.) And as highlighted above, the Bank produces evidence indicating Erhart may have lied to other Bank employees to have them run due diligence reports to dig up dirt on other employees, including a bank executive's son, and to conduct other improper investigations. (See Tolla Rule 30(b)(6) Dep. 50:13–51:4, ECF No. 155-11; Ball Dep. 329:8–14, ECF No. 155-6.) These reports contained customer information that were subject to a "need-to-know policy." (Ball Dep. 329:12–14, ECF No. 155-6; Tolla Rule 30(b)(6) Dep. 50:15–51.) There is an issue of fact as to what exactly transpired. (See Austin-Rios Dep. 70:13–71:5 (testifying she does not recall Erhart asking her to run such a report).) But the Court must view the evidence in the light most favorable to BofI. See Matsushita , 475 U.S. at 587, 106 S.Ct. 1348. In doing so, there are triable issues concerning whether Erhart engaged in some conduct that survives CUTSA displacement and supports a fraud claim.

In addition, the Court construes Erhart's argument that he was authorized to conduct investigations as a challenge to the first three elements of BofI's claim—that is, whether Erhart's requests were (1) misrepresentations that (2) were made with scienter and (3) the intent to defraud. See Lazar , 12 Cal. 4th at 632, 49 Cal.Rptr.2d 377, 909 P.2d 981. (See Erhart's Mot. 8:14–9.) There are genuine issues for trial on all of these issues. A jury could conclude Erhart did not exceed his authority in seeking to uncover wrongdoing as part of his purported whistleblowing activities or that this conduct was privileged. (See Affirmative Defenses Order 32:18–33:14.) But a jury could also conclude Erhart's conduct was outside the scope of his duties; he knew it was; and he intended to defraud the Bank's other employees as part of a personal vendetta to "bring down the Bank." See Beckwith , 205 Cal. App. 4th at 1061, 141 Cal.Rptr.3d 142 ("[F]raudulent intent is an issue for the trier of fact to decide."); see also Yellow Creek Logging Corp. v. Dare , 216 Cal. App. 2d 50, 58, 30 Cal.Rptr. 629 (1963) (providing an intent to defraud requires only "an intent to induce action," not necessarily "an intent to deceive").

Overall, there are genuine issues for trial on BofI's fraud claim. The Court therefore denies Erhart's request to summarily adjudicate this claim in its entirety.

VII. Unfair Competition

Erhart's motion also targets BofI's claim under California's Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code § 17200. (Erhart's Mot. 16:1–17:25.) The UCL prohibits "unfair competition," which includes "any unlawful, unfair or fraudulent business act or practice." Cal. Bus. & Prof. Code § 17200. "The UCL's purpose is to protect both consumers and competitors by promoting fair competition in commercial markets for goods and services." Kasky v. Nike, Inc. , 27 Cal. 4th 939, 949, 119 Cal.Rptr.2d 296, 45 P.3d 243 (2002). The Bank alleges Erhart violated the UCL by "conducting rogue investigations" and wrongfully "emailing, taking, removing, refusing to return, deleting, and disclosing BofI's Confidential Information." (BofI's FAC ¶ 98.)

At oral argument, the Court expressed skepticism about the viability of this claim. (ECF No. 179.) It reasoned BofI is "trying to fit a square peg into a round hole" because Erhart does not appear to have engaged in any relevant "business practices." (ECF No. 179.) In response, the Bank said it "would be willing to drop [this] claim." (Id. ) The Court thus finds the UCL is inapplicable and grants summary judgment in favor of Erhart on this claim.

VIII. Breach of Contract

As noted, BofI brings a breach of contract claim based on the Confidentiality Agreement Erhart executed as a condition of his employment. (BofI's FAC ¶¶ 47–53.) BofI claims Erhart breached the Confidentiality Agreement by misappropriating and disclosing "Confidential Information" within the meaning of the agreement. (Id. ¶ 51.)

It is undisputed that California law governs this agreement. (See Confidentiality Agreement § 12, BofI's Opp'n Ex. T, ECF No. 155-21.) To prevail on a claim for breach of contract, "the plaintiff must prove (1) the contract, (2) the plaintiff's performance of the contract or excuse for nonperformance, (3) the defendant's breach, and (4) the resulting damage to the plaintiff." Richman v. Hartley , 224 Cal. App. 4th 1182, 1186, 169 Cal.Rptr.3d 475 (2014).

Erhart initially challenges BofI's claim on two related fronts. He argues the Confidentiality Agreement is contrary to public policy and void. (Erhart's Mot. 13:22–16:7.) He also argues it is overbroad and includes shocking terms and therefore the agreement is void. (Id. 16:8–19:11.) These issues are subsumed within the Court's discussion of this claim in its Affirmative Defenses Order, and the Court incorporates its analysis here. Just as the Court concluded factual issues preclude BofI's request for summary adjudication of Erhart's whistleblower-related defenses, the Court finds factual issues prevent it from granting summary judgment on BofI's claim. (See Affirmative Defenses Order 11:20–34:4.) The Court cannot conclude as a matter of law that all of Erhart's conduct was protected by the whistleblower statutes he invokes. Hence, Erhart is not entitled to a determination that the Confidentiality Agreement is completely unenforceable in light of public policy. The Court is similarly unpersuaded that the Confidentiality Agreement is void because it is overbroad.

Erhart next argues this claim fails because there was no material breach of the Confidentiality Agreement. (Erhart's Mot. 19:12–21:11.) Whether there was a breach of contract is generally a question of fact. Ash v. N. Am. Title Co. , 223 Cal. App. 4th 1258, 1268, 168 Cal.Rptr.3d 499 (2014) ; see also Bos. LLC v. Juarez , 245 Cal. App. 4th 75, 87, 199 Cal.Rptr.3d 452 (2016) (" ‘Normally the question of whether a breach of an obligation is a material breach ... is a question of fact,’ however ‘if reasonable minds cannot differ on the issue of materiality, the issue may be resolved as a matter of law.’ " (quoting Brown v. Grimes , 192 Cal. App. 4th 265, 277–78, 120 Cal.Rptr.3d 893 (2011) )). Erhart argues "the clear weight of the evidence demonstrates" that his purported "breach was not material." (Erhart's Mot. 20:14–15.) However, he must demonstrate no reasonable factfinder could conclude he materially breached the Confidentiality Agreement. See Bos. LLC , 245 Cal. App. 4th at 87, 199 Cal.Rptr.3d 452. Erhart does not do so. The Court again incorporates its analysis of BofI's claim in the context of Erhart's affirmative defenses, including as to Erhart's conduct that did not involve communications to the Government. (See Affirmative Defenses Order 11:20–34:4.) A jury will have to decide whether Erhart materially breached the Confidentiality Agreement.

Finally, Erhart argues this claim fails because BofI suffered no damages. (Erhart's Mot. 21:12–22.) Erhart claims he "did not do anything with the information that damaged BofI in any way; rather [he] used this information for his whistleblowing activities and for his own protection." (Id. 21:17–20 (citing Erhart Dep. 60:21–24; 63:10–23; 66:20–22).) The Court is unconvinced. Genuine issues of fact permeate this element of BofI's breach of contract claim. The Bank has produced sufficient evidence for a factfinder to conclude it suffered at least some recoverable damages on this claim.

In sum, because there are genuine issues of material fact regarding BofI's claim for breach of the Confidentiality Agreement, the Court denies Erhart's request for summary judgment on this cause of action.

IX. California Penal Code Section 502

BofI alleges Erhart violated California Penal Code section 502 by "damaging, deleting, [and] destroying" BofI's data on his company-issued laptop and BofI's computer network. (BofI's FAC ¶¶ 80–88.) Among other things, section 502 imposes criminal liability on a person who "[k]nowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network." Cal. Penal Code § 502(c)(4). The statute also grants a private right of action for compensatory damages and other relief to "the owner ... of the computer ... or data who suffers damage or loss by reason of a violation." Id. § 502(b)(8).

Section 502 punishes a person who "[k]nowingly accesses" a computer system for specified unauthorized uses. See Cal. Penal Code § 502(c)(1)–(3), (4), (11). The statute defines "access" as meaning "to gain entry to, instruct, cause input to, ... or communicate with, the ... memory function resources of a computer, computer system, or computer network." Id. § 502(b)(1). Therefore, section 502(c) "does not require unauthorized access. It merely requires knowing access." United States v. Christensen , 828 F.3d 763, 789 (9th Cir. 2015). And "[a] plain reading of the statute demonstrates that its focus is on unauthorized taking[, deletion,] or use of information," as opposed to unauthorized access to the computer system. See id. ; see also Cal. Penal Code § 502(c)(4).

Erhart moves for summary judgment on BofI's section 502 claim, arguing he had permission to access the information at issue on BofI's computer systems and his conduct was within the scope of his employment as an internal auditor. (Erhart's Mot. 21:23–22:20.) Section 502 exempts conduct occurring during the course and scope of employment:

[ Section 502(c) ] does not apply to punish any acts which are committed by a person within the scope of his or her lawful employment. For purposes of this section, a person acts within the scope of his or her employment when he or she performs acts which are reasonably necessary to the performance of his or her work assignment.

Cal. Penal Code § 502(h) ; but see Chrisman v. City of Los Angeles , 155 Cal. App. 4th 29, 37, 65 Cal.Rptr.3d 701 (2007) (providing that a police officer who logged in to a police database to satisfy personal curiosity about celebrities was acting within the scope of his employment); see also Christensen , 828 F.3d at 789 n.8 (discussing section 502(h) ).

BofI counters that "there is substantial evidence that Erhart, without authorization," accessed, took, and deleted the Bank's confidential information all in violation of section 502. (BofI's Opp'n 21:25–22:23.) The Court agrees that there are triable issues for this claim. Erhart can argue to a jury that his conduct was within the scope of his employment as an internal auditor, but the Court cannot reach this conclusion as a matter of law. After Erhart went out on sick leave, the Bank notified him that it had suspended his remote access to its network and requested that he return his company-issued laptop "as soon as possible." (BofI's Opp'n Ex. V, ECF No. 154-4.) A forensic analysis of Erhart's company-issued laptop notes he later deleted 3,100 "files and folders" on or around March 11 and 12, 2015—several days before it was returned to the Bank. (BofI's Opp'n Ex. X, ECF No. 155-25.) Erhart testified that he wanted "to make it more difficult to – for the bank to identify [his] investigations." (Erhart Dep. 116:14–24; 164:22–25, ECF No. 155-2.) A jury could conclude this conduct did not fall within the course and scope of his employment and that Erhart violated section 502.

Erhart also argues summary judgment on this claim is appropriate because "Erhart gave back all documents that were allegedly unlawfully taken from BofI," and the Bank has therefore "suffered no damages." (Erhart's Mot. 22:22–24.) Again, the Court finds there is a triable issue on this point. BofI demonstrates that it expended time and money to investigate Erhart's purportedly wrongful conduct under section 502, which is sufficient to withstand summary judgment. See Cal. Penal Code § 502(e)(1) ("Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner ... to verify that ... data was or was not altered, damaged, or deleted by the access."); see also Copart , 277 F. Supp. 3d at 1162 (denying summary judgment where company submitted evidence indicating it had spent over eighty hours investigating the defendants' unauthorized access to its computer systems); Mintz v. Mark Bartelstein & Assocs. Inc. , 906 F. Supp. 2d 1017, 1032 (C.D. Cal. 2012) (concluding the plaintiff had experienced sufficient damage to support a claim under section 502 where the plaintiff "spent some time restoring his Gmail password and investigating who had hacked the Gmail account").

There are genuine issues for trial regarding BofI's claim under California Penal Code section 502. Consequently, the Court denies Erhart's request for summary judgment on this cause of action.

X. Computer Fraud and Abuse Act

BofI's lone federal claim pleads a violation of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030. The Bank alleges Erhart violated the CFAA by "knowingly delet[ing] large amounts of data from" and causing damage to his company-issued laptop—a protected computer. (BofI's FAC ¶¶ 89–95.) "The CFAA prohibits acts of computer trespass by those who are not authorized users or who exceed authorized use." Facebook, Inc. v. Power Ventures, Inc. , 844 F.3d 1058, 1065 (9th Cir. 2016). One type of forbidden computer trespass occurs when an individual "intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss." 18 U.S.C. § 1030(a)(5)(C). The term "protected computer" includes a computer that is "exclusively for the use of a financial institution." Id. § 1030(e)(2)(A). A "financial institution" includes an institution "with deposits insured by the Federal Deposit Insurance Corporation." Id. § 1030(e)(4)(A).

In addition, the CFAA provides a private right of action for a "person who suffers damage or loss by reason of a violation of [the statute] ... against the violator to obtain compensatory damages and injunctive relief or other equitable relief," but "only if the conduct involves 1 of the factors set forth" elsewhere in the CFAA. 18 U.S.C. § 1030(g). Of the five possible factors, the one relevant for BofI's claim is that the offense caused "loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value." See id. § 1030(c)(4)(A)(i)(I). (See BofI's FAC ¶ 95 (alleging BofI "has sustained, and will continue to sustain, loss and damages according to proof, but in excess of $5,000" due to Erhart's alleged CFAA violation).)

The CFAA defines "loss" as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." 18 U.S.C. § 1030(e)(11). Hence, "the CFAA is ‘an anti-hacking statute,’ not ‘an expansive misappropriation statute.’ " Andrews v. Sirius XM Radio Inc. , 932 F.3d 1253, 1263 (9th Cir. 2019) (quoting United States v. Nosal , 676 F.3d 854, 857 (9th Cir. 2012) (en banc)). "The statute's ‘loss’ definition—with its references to damage assessments, data restoration, and interruption of service—clearly limits its focus to harms caused by computer intrusions, not general injuries unrelated to the hacking itself." Id.

Erhart moves for summary judgment on this claim, arguing he had the authority to access the company-issued laptop at issue to perform his job duties.²⁹ (Erhart's Mot. 23:12–16.) As the Court noted in its Rule 12(c) Order, the Ninth Circuit has explained that "an employer gives an employee ‘authorization’ to access a company computer when the employer gives the employee permission to use it." LVRC Holdings LLC v. Brekka , 581 F.3d 1127, 1133 (9th Cir. 2009). On the other hand, "a person uses a computer ‘without authorization’ under [the CFAA] ... when the employer has rescinded permission to access the computer and the defendant uses the computer anyway." Id. at 1135 ; see also United States v. Nosal , 844 F.3d 1024, 1029 (9th Cir. 2016). There is a triable issue for this element of BofI's CFAA claim. As mentioned, although Erhart initially had authorization to use his BofI laptop, the Bank informed Erhart via his medical leave letter that his remote network access was suspended and he was required to return his laptop as soon as possible. (BofI's Opp'n Ex. V.) A jury could conclude that BofI had thus "rescinded permission to access the computer," making Erhart's future use unauthorized. See LVRC Holdings , 581 F.3d at 1135. Erhart also testified that he did not have permission from BofI to delete information from the protected computer. (See Erhart Dep. 117:8–12, ECF No. 155-2.)

29 Erhart does not challenge BofI's claim that the company laptop was a "protected computer" under the CFAA. (See Erhart's Mot. 23:1–21.) BofI claims the laptop was a protected computer because it "was provided to Erhart exclusively for his use as a Staff Internal Auditor at BofI, a financial institution with deposits insured by the Federal Deposit Insurance Corporation, and it was used in, or affected, interstate and foreign commerce." (BofI's FAC ¶ 93.) See 18 U.S.C. § 1030(e)(2)(A), (e)(4)(A).

Erhart also contends BofI's CFAA claim fails because the Bank cannot establish it suffered damages. Erhart argues that although he "did delete files from the computer, BofI retained originals of the files, therefore suffering no damages from [his] conduct." (Erhart's Mot. 23:18–20.) There is similarly a genuine issue for trial on this point. BofI submits that due to Erhart's conduct, it had to retain a computer forensic firm to "analyze Erhart's laptop to determine the extent of the injury to BofI, and to mitigate that injury." (BofI's Opp'n 24:11–16 (citing Ex. X).) As the Court mentioned, "loss" under the CFAA includes "any reasonable cost to any victim, including the cost of responding to an offense [and] conducting a damage assessment." See 18 U.S.C. § 1030(e)(11). BofI has produced sufficient evidence for a jury to conclude it suffered loss, including a loss "aggregating at least $5,000 in value." See id. § 1030(c)(4)(A)(i)(I).

Because BofI demonstrates there are genuine issues for trial regarding its CFAA claim, the Court denies Erhart's motion for summary judgment on this claim.

CONCLUSION

In light of the foregoing, the Court GRANTS IN PART and DENIES IN PART BofI's motion for summary judgment (ECF No. 127). The Court grants in part the Bank's request for summary judgment on Erhart's Sarbanes–Oxley claim. The Court agrees that Erhart failed to exhaust his allegation concerning the 2nd Category – Altered Financial Statements. The Court otherwise denies the Bank's request to determine Erhart failed to exhaust five other categories of conduct underpinning his claim.

Further, the Court summarily adjudicates the protected activity element of Erhart's Sarbanes–Oxley claim for various categories of believed misconduct. These categories are the following:

3rd Category:	Untimely 401(k) Payments
4th Category:	Improper Strategic Plan Approval
7th Category:	Undisclosed Customer Accounts
8th Category:	Undisclosed Subpoenas
10th Category:	Miscalculated ALL
11th Category:	Incomplete FDPA Audit
12th Category:	Sanitized Global Cash Card Review
13th Category:	Improprieties in CEO's Account
14th Category:	Improprieties in CEO's Brother's Account

The Court denies BofI's request for summary judgment on this element concerning the 6th Category – Misleading Response to SEC Subpoena and the 9th Category – Unauthorized Risky Loans. Finally, the Court denies BofI's request to summarily adjudicate the knowledge element of Erhart's Sarbanes–Oxley claim.

As for Erhart's Dodd–Frank claim, the Court summarily adjudicates this claim's protected activity element as to those categories of beliefs the Court eliminated for Erhart's Sarbanes–Oxley claim on protected activity grounds. The Court otherwise denies BofI's request for summary judgment on this claim.

Turning to Erhart's California Labor Code section 1102.5 claim, the Court grants in part BofI's request to eliminate the protected activity element of this claim. The Court concludes Erhart fails to demonstrate a triable issue regarding the following categories of believed misconduct: 2nd Category – Altered Financial Statements; 4th Category – Improper Strategic Plan Approval; 5th Category – High Deposit Risk Concentration; and 10th Category – Miscalculated ALL. The Court denies, however, BofI's request for summary judgment with respect to the 7th Category – Undisclosed Customer Accounts, 8th Category – Undisclosed Subpoenas, and 12th Category – Sanitized Global Cash Card Review.

In addition, the Court summarily adjudicates Erhart's wrongful termination claim under state law to the same extent the Court has summarily adjudicated Erhart's other claims on protected activity grounds. The Court otherwise denies BofI's request for summary judgment on this claim.

The Court also GRANTS IN PART and DENIES IN PART Erhart's motion for summary judgment (ECF No. 137). The Court grants in part Erhart's request to summarily adjudicate BofI's fraud, negligence, conversion, and breach of the duty of loyalty claims in light of CUTSA displacement. The Court otherwise denies Erhart's request to summarily adjudicate what remains of these claims because there are genuine issues for trial. Further, the Court denies Erhart's request for summary judgment on BofI's breach of contract, California Penal Code section 502, and CFAA claims. There are disputed issues of fact concerning each of these claims. Finally, the Court grants summary judgment on BofI's UCL claim in favor of Erhart. Subject to the Order of the Chief Judge No. 18, In re Suspension of Jury Trials and Other Proceedings During the Covid-19 Public Emergency (S.D. Cal. Mar. 17, 2020), the Court orders the parties to contact the Magistrate Judge's chambers to reset their mandatory settlement conference. Upon conclusion of this conference, the parties shall coordinate with the Magistrate Judge to set new dates for a pretrial conference and trial.

IT IS SO ORDERED.