Summary
In Razuki, the defendants waited five months to notify the plaintiffs, but the court dismissed the claim because plaintiffs had not alleged that such delay was unreasonable.
Summary of this case from In re Brinker Data Incident Litig.Opinion
CASE NO. 17cv1718-LAB (WVG)
11-14-2018
SALAM RAZUKI, individually and on behalf of others similarly situated, Plaintiff, v. CALIBER HOME LOANS, INC., Defendant.
ORDER GRANTING MOTION TO DISMISS [Dkt. 31]
Caliber Home Loans (Caliber) moves to dismiss Salam Razuki's Third Amended Complaint (TAC), which relates to a data breach in which hackers obtained Razuki's personal information from Caliber. In its June 8, 2018 Order, this Court dismissed without prejudice Razuki's negligence, California Constitution, Customer Records Act, and Unfair Competition claims for failure to state a claim. Dkt. 27. In his TAC, Razuki re-alleges those four causes of action, and has added a fifth claim of bailment. But Razuki consented to dismissal of the California Constitution and bailment claims in his opposition, so the Court considers those claims dismissed. Dkt. 33 at 3-4. For the reasons below, the Court finds that Razuki's remaining claims are still insufficient and must be dismissed, this time with prejudice.
It also dismissed with prejudice his claim under the California Consumer Legal Remedies Act. --------
1. Negligence
Razuki's second amended complaint failed to state a claim for negligence because his vague allegations of damages were impossible for the Court to evaluate. Dkt. 27 at 3. The Court made it clear that Razuki's negligence claim was essentially indistinguishable from Krottner v. Starbucks Corporation, 406 F. App'x 129, 131 (9th Cir. 2010), in which the Ninth Circuit found the risk of identity theft following a data breach sufficient to supply an injury-in-fact for standing, but insufficient to support actual damages for negligence. Id. at 2-3. In his TAC, Razuki's newly alleged damages include diminution in value of his personal data, overpayments to Caliber, and continued risk to his financial information. Dkt. 30 at ¶ 51. First, his claim alleging continued risk of harm is still insufficient because it stems from the danger of future harm. See Dkt. 27 at 2. Second, his claim alleging diminution of value of his personal data fails to allege enough facts to establish how his personal information is less valuable as a result of the breach. On a similar data breach claim, the court in Sony Gaming Networks and Customer Data Security Breach Litigation found that plaintiffs alleging diminution of value must show how "[p]laintiffs have suffered an appreciable, non-speculative harm." 996 F. Supp. 2d 942, 971 (S.D. Cal. 2014). Here, Razuki's allegations about damages still remain too conclusory and vague to satisfy the pleading standard in a complex, large-scale, data-breach class action. Finally, Razuki alleges that he and the class members overpaid Caliber for financial services during or after the breach. However, it is unclear what payments were made to Caliber and for what services these alleged payments were made. For example, Razuki does not provide any information to show that he paid a premium for Caliber to provide reasonable and adequate security measures. In short, Razuki still has not adequately pled damages that could support a negligence claim.
2. Customer Records Act, Sections 1798.81.5 and 1798.82
Razuki claims "Defendant knew of higher-quality security protocols available to them" but failed to implement these measures, in violation of the California Customer Records Act. Dkt. 30 at ¶23, 74-75. This claim fails because it is precisely the type of "threadbare" claim Iqbal warns of. See Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009) ("Rule 8 . . . does not unlock the doors of discovery for a plaintiff armed with no more than conclusions."). Razuki makes a conclusory statement that Caliber knew of higher-quality security measures, but he does not support that conclusion with any facts about Caliber's protocols or actions it took when choosing appropriate security measures. All section 1798.81.5 requires is that a business "implement and maintain reasonable security procedures and practices appropriate to the nature of the information." Cal. Civ. Code § 1798.81.5. Razuki could have identified what made Caliber's security measures unreasonable by comparison to what other companies are doing, but simply knowing of higher-quality security measures is not sufficient to state a claim.
Further, Razuki's TAC says that "Caliber's misconduct also included its decision not to comply with industry standards for the safekeeping and maintenance of the personal and financial information of Plaintiff and the other Class members." Dkt. 30 at ¶47. The Court has already acknowledged that it may be difficult to definitively show Caliber's practices were insufficient prior to discovery, but again, he needs something more than what he's pleading now. What facts lead him to believe Caliber didn't comply with industry standards? What are other companies doing that Caliber isn't? These are basic questions that Razuki could plead to plausibly show Caliber's conduct was unlawful. Instead, it appears he's simply recited a few buzz words with the hope that he may be able to figure out later what, if anything, Caliber has done wrong. But the Supreme Court tells us that's not enough. This is a large-scale class action involving more than 100,000 potential plaintiffs. As noted in Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 559 (2007), plausibility pleading standards are especially important in cases like this one, where the Defendant faces the "potentially enormous expense of discovery" if the Court denies this motion to dismiss. The requirement that a plaintiff plausibly plead their claim prevents a would-be class plaintiff "with a largely groundless claim [from] be[ing] allowed to take up the time of a number of other people, with the right to do so representing an in terrorem increment of the settlement value." Id. at 558 (quoting Dura Pharmaceuticals, Inc. v. Broudo, 544 U.S. 336, 347 (2005) (internal quotation marks omitted). These factors caution against subjecting Caliber to the "potentially enormous expense of discovery" without a better showing from the Plaintiff that he has a plausible case.
Razuki's other theory of liability under the CRA is that Caliber violated Section 1798.82. This provision requires that a business notify its customers of a data breach "in the most expedient time possible and without reasonable delay." Cal. Civ. Code § 1798.82(a). Razuki claims Caliber didn't notify him of the breach until five months after the breach. Dkt. 30 at ¶26, 74. While in a vacuum this may seem to be a long time between breach and notification, all that section 1798.82 requires is that the notification be without "reasonable delay." Razuki does not allege facts that suggest this time frame is without "reasonable delay." He also fails to establish that even if there was unreasonable delay, the delay caused any alleged injury. As other courts in this Circuit have recognized, a Plaintiff alleging a violation of 1798.82 must show that the delay in notification led to incremental harm, which Plaintiff plainly has not shown here. See, e.g., In re Adobe Sys., Inc. Privacy Litig., 66 F. Supp. 3d 1197, 1218 (N.D. Cal. 2014) ("Plaintiffs have not alleged any injury traceable to Adobe's alleged failure to notify customers of the 2013 data breach in violation of Section 1798.82, because [p]laintiffs do not allege that they suffered any incremental harm as a result of the delay.") (emphasis in original). His claim under 1798.82 fails.
3. Unfair Competition Law (UCL)
California Business and Professions Code section 17200 prohibits any "unlawful, unfair, or fraudulent business act or practice." Cal. Bus. & Prof. Code § 17200. The UCL "borrows violation of other laws and treats them as unlawful practices." Benson v. Kwikset Corp., 152 Cal. App. 4th 1254, 1267 (2007) (internal citations omitted). Razuki appears to be making his UCL claim based on the "unlawful" prong of the statute. See Dkt. 30 at ¶65. He bases the claim on violation of the CRA, Privacy Act of 1974, and the Federal Trade Commission Act ("FTC Act"). Id. As discussed above, his CRA claim fails, so it cannot serve as the basis for his UCL claim. And as Caliber correctly notes, only federal agencies are subject to violations of the Privacy Act of 1974, so that claim fails, too. Dkt. 31-1 at 21. The only theory left for Razuki's UCL claim is the FTC Act. The FTC Act makes unlawful "unfair methods or competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce." 15 U.S.C. § 45(a)(1). Because the Court has already found that the practices Razuki alleged were unfair to be insufficient, his claim under the FTC Act fails.
Further, in order to pursue a claim under the UCL, a plaintiff must "have suffered an 'injury in fact' and 'lost money or property as a result of such unfair competition." Ruiz v. Gap Inc., 540 F. Supp. 2d 1121, 1127 (N.D. Cal. 2008) (quoting Hall v. Time Inc., 158 Cal. App. 4th 847, 849 (2008)). The Court warned Razuki that his SAC failed to allege any lost money or property. Dkt. 27 at 6. At most, Razuki claims that he "suffered lost money from his Wells Fargo bank account, from which funds were transferred without his consent." Dkt. 30 at ¶66. He does not allege how much money was lost or whether Wells Fargo actually allowed the money to be withdrawn from this account. As Caliber points out, Wells Fargo itself alerted him to the withdrawal. See Dkt. 31-1 at 3-4. The logical conclusion to be drawn from this (and one not disputed by Razuki) is that this alert was part of Wells Fargo's efforts to determine whether the withdrawal was fraudulent and, if necessary, reverse the transaction. If Wells Fargo quickly reversed the transaction, he has suffered no loss. His UCL claim fails.
***
Caliber's Motion to Dismiss is GRANTED. Dkt. 31. Leave to amend is granted liberally, but not automatically. In re W. States Wholesale Nat. Gas Antitrust Litig., 715 F.3d 716, 738 (9th Cir. 2013). This is Razuki's fourth complaint and he still has failed to plead basic facts that could supports his claim: When was the money withdrawn from his account? How much was withdrawn? Was it refunded? What are Caliber's security measures that were insufficient? What were other firms doing that Caliber wasn't? The only inference the Court can draw from his failure to plead basic facts is that he is in possession of no facts that would plausibly support his claim, and that amendment would therefore be futile. For that reason, the Court DISMISSES THIS CASE WITH PREJUDICE. The clerk is directed to enter judgment in favor of Caliber and to close the case.
IT IS SO ORDERED. Dated: November 14, 2018
/s/_________
HONORABLE LARRY ALAN BURNS
United States District Judge