Summary
alleging that data breach caused plaintiff to suffer harm in forum state is “insufficient to establish specific jurisdiction under either a purposeful direction or purposeful availment analysis”
Summary of this case from Lee v. NetGain Tech.Opinion
CIV. NO. 19-00677 JMS-WRP
08-25-2020
DALE A. PATAO, Plaintiff, v. EQUIFAX, INC., Defendant.
ORDER GRANTING DEFENDANT'S JOINT MOTION TO (1) QUASH SERVICE OF SUMMONS; AND (2) DISMISS COMPLAINT , ECF NO. 7
I. INTRODUCTION
On December 19, 2019, pro se Plaintiff Dale A. Patao ("Plaintiff") filed a Complaint against Defendant Equifax, Inc. ("Equifax" or "Defendant"), regarding a data breach announced by Equifax in September 2017. ECF No. 1. Defendant moves to quash service of summons for lack of personal jurisdiction and to dismiss the Complaint for failure to state a claim. ECF No. 7. For the reasons discussed below, the court GRANTS the motion.
II. BACKGROUND
A. Factual Background
As alleged in the Complaint, Plaintiff is a citizen and resident of Hawaii, and Equifax is a Georgia corporation with its principal place of business in Atlanta, Georgia. See ECF No. 1 at PageID #1-4. On June 18, 2019, Plaintiff mailed a letter to Equifax alleging that Plaintiff was "personally, financially, socially and economically injured" as a result of being a "victim of the fraudulent data breach" that occurred at Equifax and was reported in September 2017. Id. at PageID #7, 10. Plaintiff further states that "I am . . . injured by this data breach in that I now DO NOT know who may have my personal data or where my data is being used as a result of the fraudulent data breach." Id. at PageID #7. The letter asked Equifax to provide "Proofs of Claim," as to Equifax's conduct, knowledge of events related to the data, and liability. ECF No. 1 at PageID #7-8. Plaintiff asked that Equifax respond within ten days, and stated that a "non-response" or "failure to provide Proof of Claim" will "equate to commercial acquiescence to the terms outlined by the undersigned in a final Affidavit ad Notice of Default." Id. at PageID #8.
The letter includes the following twelve "Proofs of Claim": 1. PROOF OF CLAIM that on September 8, 2017 Equifax, Inc. did NOT report that over 148 Million Americans' personal data housed by Equifax, Inc. had been stolen and/or compromised. 2. PROOF OF CLAIM that Equifax, Inc. did NOT know of said data breach six months before reporting said data breach on September 8, 2017. 3. PROOF OF CLAIM that Equifax, Inc. did NOT intentionally try to cover up the data breach only to be forced to reveal said data breach six months after the breach actually occurred. 4. PROOF OF CLAIM that Equifax, Inc. protected my personal data and did NOT allow my personal data to be breached and stolen by unknown entities. 5. PROOF OF CLAIM that Equifax, Inc. knows exactly where the personal data of 148 Million Americans is. 6. PROOF OF CLAIM that Equifax, Inc. knows exactly who stole the personal data of 148 Million Americans. 7. PROOF OF CLAIM that Equifax, Inc. is NOT liable to the 148 Million Americans whose data was stolen as a result of the data breach at Equifax, Inc. reported on September 8, 2017. 8. PROOF OF CLAIM that Equifax, Inc. HAS corrected ALL security lapses and has taken ALL security measures possible to ensure that this data breach will not happen again. 9. PROOF OF CLAIM that the U.S. General Accounting Office (GAO) did NOT on September 8, 2018 release a comprehensive report examining the reasons for the massive breach of personal information from Equifax, Inc. 10. PROOF OF CLAIM that the U.S. General Accounting Office (GAO) report did NOT summarize an array of errors inside the company, largely related to a failure to use well-known security best practices and a lack of internal controls and routine security reviews. 11. PROOF OF CLAIM that through the fraudulent data breach at Equifax, Inc. I have NOT been personally injured and my ability to obtain credit has NOT been negatively affected resulting in economic hardships. 12. PROOF OF CLAIM that Equifax, Inc. is NOT liable to me for damages no less than a minimum of $10,000,000.00 Ten Million Dollars including triple damages and costs. ECF No. 1 at PageID #7-8.
Equifax apparently did not respond, because on July 9, 2019, Plaintiff mailed a "Notice of Fault and Opportunity to Cure and Contest Acceptance," informing Equifax that by its non-response, it was "in fault" and had "agree[d] and . . . stipulated to the terms of the undersigned's dated presentment through [its] dishonor." Id. at PageID #12, 14. And on August 5, 2019, Plaintiff mailed Equifax an "Affidavit and Notice of Default," again informing Equifax that by failing to respond to Plaintiff's prior mailings, it had "agreed and acquiesced" to the allegations set forth in the original letter and reasserted in the "Affidavit and Notice of Default." Id. at PageID #15-17.
On December 19, 2019, Plaintiff filed a Complaint claiming that by failing to respond to his documents, Equifax "accepted" the asserted facts, is "in default under contract," has "injured [Plaintiff] personally," and is therefore liable to Plaintiff for "$75,000,000.00" including "triple damages, punitive damages and all court costs." Id . at PageID #4-5.
B. Procedural Background
Equifax filed the instant Motion on February 19, 2020. ECF No. 7. On April 14, 2020 and again on May 6, 2020, the court ordered Plaintiff to file a written statement indicating whether he intends to oppose Equifax's Motion to Dismiss, and if so, why he failed to meet his deadlines. See ECF Nos. 13, 14. On May 22, 2020, Plaintiff filed an Affidavit opposing the Motion. ECF No. 15. On June 5, 2020, Equifax filed a Reply. ECF No. 17. Pursuant to Local Rule 7.1(c), the court decides this matter without a hearing.
III. STANDARDS OF REVIEW
A. Rule 12(b)(2)
To withstand a motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction, the plaintiff bears the burden of establishing jurisdictional facts. See In re Boon Global Ltd., 923 F.3d 643, 650 (9th Cir. 2019). "Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, 'the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss.'" CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1073 (9th Cir. 2011) (quoting Brayton Purcell LLP v. Recordon & Recordon, 606 F.3d 1124, 1127 (9th Cir. 2010)).
"[U]ncontroverted allegations in [the] complaint must be taken as true, and conflicts between the facts contained in the parties' affidavits must be resolved in [the plaintiff's] favor." Brayton Purcell, 606 F.3d at 1127 (quoting Rio Props., Inc. v. Rio Int'l Interlink, 284 F.3d 1007, 1019 (9th Cir. 2002)). But when a defendant's affidavit conflicts with the complaint, the plaintiff "cannot simply rest on the bare allegations of [the] complaint." Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004) F.3d 797, 800 (9th Cir. 2004). That is, the court "may not assume the truth of allegations in a pleading which are contradicted by affidavit." CollegeSource, Inc., 653 F.3d at 1073 (quotation omitted).
B. Rule 12(b)(6)
Federal Rule of Civil Procedure 12(b)(6) permits a motion to dismiss for "failure to state a claim upon which relief can be granted." To state a claim, a pleading must contain a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). In considering whether a complaint fails to state a claim, the court must set conclusory factual allegations aside, accept non-conclusory factual allegations as true, and determine whether these allegations state a plausible claim for relief. Ashcroft v. Iqbal, 556 U.S. 662, 677-80 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)); see also Weber v. Dep't of Veterans Affairs, 521 F.3d 1061, 1065 (9th Cir. 2008). A Rule 12(b)(6) dismissal is proper when there is either a "lack of a cognizable legal theory or the absence of sufficient facts alleged." UMG Recordings, Inc. v. Shelter Capital Partners, LLC, 718 F.3d 1006, 1014 (9th Cir. 2013) (quoting Balistreri v. Pacifica Police Dep't, 901 F.3d 696, 699 (9th Cir. 1990)).
Rule 8 requires more than "the-defendant-unlawfully-harmed-me accusation[s]" and "[a] pleading that offers labels and conclusions or a formulaic recitation of the elements of a cause of action will not do." Iqbal, 556 U.S. at 678 (citations and quotations omitted). "Nor does a complaint suffice if it tenders naked assertions devoid of further factual enhancement." Id. (quotation signals omitted). Rather, "[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. (citing Twombly, 550 U.S. at 556); see also Moss v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009).
Because Plaintiff is proceeding pro se, the court liberally construes the Complaint and resolves all doubts in her favor. See Erickson v. Pardus, 551 U.S. 89, 94 (2007); Hebbe v. Pliler, 627 F.3d 338, 342 (9th Cir. 2010) (citations omitted). The court must grant leave to amend if it appears that Plaintiff can correct the defects in his Complaint, Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000), but if a claim or complaint cannot be saved by amendment, dismissal with prejudice is appropriate. Sylvia Landfield Tr. v. City of L.A., 729 F.3d 1189, 1196 (9th Cir. 2013); see also Leadsinger, Inc. v. BMG Music Pub., 512 F.3d 522, 532 (9th Cir. 2008) (reiterating that a district court may deny leave to amend for, among other reasons "repeated failure to cure deficiencies by amendments previously allowed . . . [and] futility of amendment") (citation omitted).
IV. DISCUSSION
A. Plaintiff Fails to Establish Personal Jurisdiction
Where, as here, no federal statute governs personal jurisdiction, the court follows the law of the forum state. See, e.g., Daimler AG v. Bauman, 571 U.S. 117, 125 (2014) (citing Fed. R. Civ. P. 4(k)(1)(A)); Boschetto v. Hansing, 539 F.3d 1011, 1015 (9th Cir. 2008). Hawaii's long-arm statute authorizes personal jurisdiction to the extent permitted by the United States Constitution. See Cowan v. First Ins. Co. of Haw., 61 Haw. 644, 649, 608 P.2d 394, 399 (1980) (citing Haw. Rev. Stat. § 634-35). To comport with constitutional due process requirements, a court may exercise personal jurisdiction over a nonresident defendant if the defendant has "certain minimum contacts with [the forum state] such that the maintenance of the suit does not offend traditional notions of fair play and substantial justice." Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915, 923 (2011) (quoting Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)) (internal quotation marks omitted).
Depending on the defendant's contacts with the forum state, personal jurisdiction may be exercised upon a showing of either general or specific jurisdiction. See Freestream Aircraft (Bermuda) Ltd. v. Aero Law Grp., 905 F.3d 597, 602 (9th Cir. 2018) (citing Helicopteros Nacionales de Colombia, S.A. v. Hall, 466 U.S. 408, 413-15 (1984)). General jurisdiction permits a plaintiff to bring any claim against the defendant and requires a showing that the defendant's contacts with the forum state are "so continuous and systematic as to render them essentially at home in the forum State." Daimler AG, 571 U.S. at 127 (internal quotation marks omitted). Specific jurisdiction, on the other hand, permits a plaintiff to bring a claim against a defendant in the forum state only if the claim "aris[es] out of or relate[s] to the defendant's contacts with the forum [state]." Id. (quoting Hall, 466 U.S. at 414). Courts in the Ninth Circuit apply a three-part minimum-contacts test to determine whether they have specific jurisdiction over a defendant:
(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
(2) the claim must be one which arises out of or relates to the defendant's forum-related activities; andFreestream Aircraft (Bermuda) Ltd., 905 F.3d at 603; see In re Boon Global, 923 F.3d at 651 (explaining that courts use the "purposeful direction" analysis for tort claims and the "purposeful availment" analysis for contract claims).
(3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e., it must be reasonable.
Here, the Complaint alleges that Equifax is incorporated in Georgia and that it has its principal place of business in Georgia. ECF No. 1 at PageID #4. And Equifax provided documentation of business information from the State of Georgia confirming these facts. See ECF No. 7 at PageID #64, 66. The Complaint further alleges that Plaintiff's claims arise from a "data breach that occurred at your company." ECF No. 1 at PageID #7. Nowhere in the Complaint does Plaintiff allege facts showing that Equifax has contacts or affiliations with Hawaii that are so continuous and systematic as to render it at home in Hawaii. See Daimler AG, 571 U.S. at 127. Thus, Plaintiff has failed to establish general jurisdiction. See Caces-Tiamson v. Equifax, 2020 WL 1322889, at *3 (N.D Cal. Mar. 20, 2020) (finding that plaintiff asserting nearly identical claims against Equifax failed to establish general jurisdiction in California); Tiamson v. Equifax, Inc., 2020 WL 3972582, at *6 (N.D. Cal. July 14, 2020) (same).
And as to specific jurisdiction, the Complaint fails to allege that any action or failure to act—by Equifax in connection with the data breach and/or failure to respond to Plaintiff's notices—occurred in Hawaii as opposed to Georgia. At most, the Complaint alleges that the data breach caused Plaintiff to suffer harm in Hawaii. But this is insufficient to establish specific jurisdiction under either a purposeful direction or purposeful availment analysis. See In re Packaged Seafood Prods. Antitrust Litig., 338 F. Supp. 3d 1118, 1161 (S.D. Cal. 2018) ("As the Supreme Court made clear in Walden v. Fiore, [571 U.S. 277 (2014)], something more is required than 'imposition of an injury . . . to be suffered by the plaintiff while she is residing in the forum state.'"). Nor is the fact that "Equifax provides services to customers nationwide, including but not limited to [Hawaii]," sufficient to establish specific jurisdiction. Cases-Tiamson, 2020 WL 1322889, at *3 (citing Asahi Metal Indus. Co. v. Sup. Ct. of Cal., Solano Cty., 480 U.S. 102, 112 (1987) (stating that "[t]he 'substantial connection' between the defendant and the forum State necessary for a finding of minimum contacts must come about by an action of the defendant purposefully directed toward the forum State" and that "[t]he placement of a product into the stream of commerce, without more, is not an act the defendant purposefully directed toward the forum state") (emphasis in original); see also id., at *4 (explaining that "the purposeful availment standard requires more than foreseeability of causing injury in another state") (quoting Terracom v. Valley Nat'l Bank, 49 F.3d 555, 560 (9th Cir. 1995)).
In sum, Plaintiff has failed to establish personal jurisdiction over Equifax. For the foregoing reasons, the Complaint is DISMISSED, and service of summons is QUASHED. The court further finds that amendment would be futile. See, e.g., Tiamson, 2020 WL 3972582, at *6-7 (granting dismissal with prejudice based, in part, on finding that given nearly identical facts, amendment to cure lack of personal jurisdiction would be futile); Yorty v. Equifax, Inc., 2020 WL 3052526, at *3 (W.D. Mich. May 14, 2020) (recommending dismissal with prejudice based on substantially similar facts), report and recommendation adopted, 2020 WL 3050551 (W.D. Mich. June 8, 2020); Caces-Tiamson, 2020 WL 1322889, at *4 (same). Thus, the Complaint is DISMISSED without leave to amend.
B. The Complaint Fails to Establish Subject-Matter Jurisdiction
A plaintiff generally may establish the court's subject matter jurisdiction in one of two ways: (1) by asserting that a defendant violated the Constitution, a federal law, or treaty of the United States, see 28 U.S.C. § 1331; or (2) by invoking the court's "diversity jurisdiction," which applies "where the matter in controversy exceeds the sum or value of $75,000, exclusive of interest and costs, and is between . . . citizens of different States," 28 U.S.C. § 1332(a)(1). As to the amount in controversy, a claim made in good faith in the complaint satisfies the jurisdictional requirement for diversity. St. Paul Mercury Indem. Co. v. Red Cab Co., 303 U.S. 283, 288-89 (1938). But "[t]he '[m]ere averment of the amount claimed to be in controversy is not enough to confer jurisdiction.'" Mosley v. Equifax, Inc., 2019 WL 2539349, at *1 (E.D. Mich. June 20, 2019) (quoting Breault v. Feigenholtz, 380 F.2d 90, 92 (7th Cir. 1967)). Thus, if "from the face of the pleadings, it is apparent, to a legal certainty, that the plaintiff cannot recover the amount claimed" the action must be dismissed. St. Paul Mercury Indem. Co., 303 U.S. at 289.
Here, the Complaint alleges that Plaintiff and Equifax are citizens of Hawaii and Georgia, respectively, and that the amount in controversy is $75 million. ECF No. 1 at PageID #3-5. But the Complaint does not allege any actual damages that Plaintiff has suffered as a result of the data breach. That is, there is no allegation that any unauthorized use of Plaintiff's personal information has occurred, that Plaintiff incurred any cost for heightened financial monitoring, or that Plaintiff suffered any actual injury or damages as a result of the data breach or of Equifax's failure to respond to Plaintiff's various notices. Thus, the court finds that Plaintiff has failed to claim in good faith an amount in controversy sufficient to invoke diversity jurisdiction. See, e.g., Turman v. Equifax, Inc., 2020 WL 1493859, at *3-4 (N.D. Ohio Mar. 27, 2020) (dismissing case based on substantially similar facts for failing to allege sufficient facts to establish diversity jurisdiction, and citing cases); Mason v. Equifax, Inc, 2018 WL 1023599, at *2 (N.D. Ga. Jan. 19, 2018) (citing Bradley v. Kelly Servs., Inc., 224 F. App'x 893, 895 (11th Cir. 2007) (per curiam) (determining that the plaintiff's mere speculation that the amount in controversy exceeds $75 thousand is insufficient to meet the required threshold for diversity jurisdiction), report and recommendation adopted by Mason v. Equifax, Inc, 2018 WL 1014629 (N.D. Ga. Feb. 22, 2018).
Plaintiff's Complaint is also DISMISSED for failure to establish diversity subject-matter jurisdiction. Moreover, based on Plaintiff's sole alleged injury—"that I now DO NOT know who may have my personal data or where my data is being used," ECF No. 1 at PageID #7—the court finds that granting leave to amend to cure the jurisdictional amount in controversy would be futile. That is, based on Plaintiff's alleged injury, he cannot in good faith allege sufficient facts to establish damages of $75,000. See, e.g., Mason, 2018 WL 1014629, at *1 (adopting recommendation to dismiss without leave to amend substantially similar action for failure to meet jurisdictional amount in controversy). Thus, the Complaint is DISMISSED without leave to amend. /// /// /// /// C. The Complaint Fails to State a Claim
This order does not address whether Plaintiff has sufficiently alleged a case or controversy to establish subject-matter jurisdiction. See Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016).
In addition, neither the Complaint nor the attached documents identifies any cognizable legal theory or asserts any specific, let alone plausible, claim for relief.
In the document setting forth the "Proofs of Claim," Plaintiff asserts that in connection with the "fraudulent data breach," Equifax committed "torts." ECF No. 1-1 at PageID #7. But Plaintiff fails to identify any specific tort Equifax committed and fails to allege facts to support some unspecified tort. To the extent Plaintiff may be attempting to assert a fraud claim, the Complaint fails to allege facts with the requisite particularity to state a plausible claim. See Fed. Rule of Civ. Proc. 9(b) (requiring that "[i]n all averments of fraud or mistake, the circumstances constituting fraud or mistake shall be stated with particularity"); see also In re GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1547-48 (9th Cir. 1994) (en banc), superseded on other grounds by 15 U.S.C. § 78u-4 ("Rule 9(b) requires particularized allegations of the circumstances constituting fraud."). Thus, the Complaint fails to state a plausible tort claim.
Further, the Complaint alleges that by failing to respond, Equifax is "in default under contract." ECF No. 1 at PageID #4. But Plaintiff fails to identify or provide a copy of any applicable contract between the parties. The documents Plaintiff sent to Equifax do not constitute binding contracts because there is no indication that Equifax agreed to Plaintiff's terms. See Carson v. Saito, 53 Haw. 178, 182, 489 P.2d 636, 638 (1971) (recognizing that as a "fundamental principle of law[,] there must be mutual assent or a meeting of the minds on all essential elements or terms in order to form a binding contract") (quoting Honolulu Rapid Transit Co. v. Paschoal, 51 Haw. 19, 26, 449 P.2d 123, 127 (1968)); see also In re Estate of Tahilan v. Friendly Care Home Health Servs., Inc., 731 F. Supp. 2d 1000, 1006 (D. Haw. 2010) (explaining that mutual assent must include "an offer, an acceptance, and consideration") (citing Douglass v. Pflueger Haw., Inc., 110 Haw. 520, 525, 135 P.3d 129, 134 (2006)); Orman v. C. Loan Administration & Reporting, 2019 WL 6841741, at *4-5 (D. Ariz. Dec. 16, 2019) ("It is a fundamental principle of contract law that silence does not constitute acceptance of a contract.") (citing Restatement (Second) of Contracts § 69 and cases).
Plaintiff appears to base this action solely on Equifax's failure to respond to Plaintiff's documents. But absent some duty or contractual obligation, Equifax's failure to respond does not create a cognizable claim. Plaintiff has alleged neither. Rather, Plaintiff contends that "no more than (affidavits) is necessary to make the prima facie case." ECF No. 1 at PageID #15 (citing United States v. Kis, 658 F.2d 526, 536 (7th Cir. 1981), abrogated on other grounds by Church of Scientology of Cal. v. United States, 506 U.S. 9 (1999)). To the extent Plaintiff relies on Kis to support the contention that based solely on the "Affidavit of Certificate of Non-Response," Plaintiff has stated a claim for relief, such reliance is misplaced. Kis recognized that in the context of an action for issuance of an Internal Revenue Service ("IRS") summons, an agent's affidavit is generally sufficient to prove the requisite four elements of a prima facie case establishing the existence of necessary conditions for such summons. 658 F.2d at 536. Here, the instant action does not involve an IRS summons. Moreover, Kis does not hold that an agent's affidavit alone was sufficient to create a claim. Rather, Kis held that the affidavit was sufficient to prove the four elements of a legally cognizable claim for enforcement of an IRS summons.
In short, even construed liberally, Plaintiff's Complaint neither asserts a claim or cognizable legal theory nor alleges facts under a cognizable legal theory sufficient to state a plausible claim for relief. See UMG Recordings, Inc., 718 F.3d at 1014; Balistreri, 901 F.2d at 699. Based on the foregoing, the Complaint is DISMISSED for failure to state a claim. /// ///
VI. CONCLUSION
Based on the foregoing, Defendant's Joint Motion to (1) Quash Service of Summons; and (2) Dismiss Complaint, ECF No. 7, is GRANTED. And because leave to amend would be futile, the Complaint is DISMISSED without leave to amend.
The Clerk of Court is DIRECTED to enter judgment and close this case.
IT IS SO ORDERED.
DATED: Honolulu, Hawaii, August 25, 2020.
/s/ J. Michael Seabright
J. Michael Seabright
Chief United States District Judge