Summary
holding that the theft of a retail store's laptop containing personal information, including the social security numbers, of job applicants did not constitute an egregious breach of privacy and therefore was not sufficient to state a claim
Summary of this case from Vashisht-Rota v. Ottawa Univ.Opinion
Case No. 07-5739 SC.
March 24, 2008.
Mark Punzalan, Christine Pedigo Bartholomew, Rosemary M. Rivas, Finkelstein, Thompson LLP, San Francisco, CA, Ben Barnow, Barnow and Associates P.C., Chicago, IL, Karen J. Marcus, Mila Bartos, Finkelstein Thompson Loughran, Tracy D. Rezvani, Finkelstein Thompson LLP, Duvall Foundry, Washington, DC, for Plaintiffs.
Claudia Maria Vetesi, William Lewis Stern, Morrison Foerster LLP, San Francisco, CA, for Defendants.
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION FOR JUDGMENT ON THE PLEADINGS
I. INTRODUCTION
This matter comes before the Court on Defendant Gap, Inc.'s Motion for Judgment on the Pleadings ("Motion"). Docket No. 8. Plaintiff Joel Ruiz filed an Opposition and Gap submitted a Reply. Docket Nos. 18, 23. For the reasons stated herein, the Defendant's Motion is GRANTED IN PART and DENIED IN PART. All dismissals are with prejudice as none of the dismissed claims is curable by amendment.
Gap's Motion also devotes itself to demonstrating that Ruiz has failed to state a claim. Thus, the Motion is treated as both a motion for judgment on the pleadings and a motion to dismiss for failure to state a claim. Moran v. Peralta Comm. College Dist., 825 F. Supp. 891, 893 (N.D. Cal. 1993).
Various other motions have also been submitted, including a motion to strike Ruiz's class allegations, Gap's request for judicial notice, and a motion to dismiss Gap's counterclaim. The motion to strike the class allegations merely reargues Gap's standing arguments and makes premature arguments regarding class certification. Neither argument is persuasive or appropriate and the motion is DENIED.
Gap's request for judicial notice is also DENIED. Federal Rule of Evidence 201 permits courts to take judicial notice of facts that are "not subject to reasonable dispute." Gap seeks judicial notice for two sets of materials: a study from an internet site on identity theft, and a list, also from an internet site, of data breach incidents reported in California in the last two years. Neither of these documents contain information which is "generally known within the territorial jurisdiction of the trial court" or "capable of accurate and ready determination." Fed.R.Evid. 201. In short, these materials are not remotely akin to the type of facts which may be appropriately judicially noticed.
Finally, Ruiz has moved to dismiss Gap's counterclaim. Gap's counterclaim seeks a declaratory judgment "that its actions were in compliance with federal and state laws, and that Mr. Ruiz and the putative class he purports to represent are not entitled to any relief." Counterclaim, Docket No. 3, ¶ 15. Gap's counterclaim raises no new issues of law or fact and is completely superfluous to Ruiz's lawsuit. Ruiz's motion to dismiss the counterclaim is GRANTED.
II. BACKGROUND
The following facts are taken from Plaintiff's Complaint, unless otherwise noted. Ruiz, a citizen of Texas, applied online for a position with one of Gap's stores in late 2006. Gap is a clothing store based in San Francisco. As part of the application, Ruiz was required to provide personal information, including his social security number. On September 28, 2007, Gap disclosed that two laptop computers were stolen from a vendor with whom Gap had contracted for recruiting purposes. The laptops contained the personal information, including social security numbers, of approximately 800,000 Gap job applicants. The information was not encrypted and was therefore easily accessible. In response to these thefts, Gap notified the applicants whose personal information was on the computers and offered to provide these applicants, including Plaintiff, with twelve months of credit monitoring and fraud assistance without charge. Gap also is providing $50,000 worth of identity theft insurance. Opp'n at 3.
As a condition of receiving the credit monitoring, the applicants were apparently required to waive their right to a jury trial should the credit monitoring service prove inadequate. Compl., Docket No. 1, ¶ 38.
In reaction to the theft of the laptops, Ruiz filed the present class action, asserting the following causes of action: (1) negligence; (2) bailment; (3) violation of California Business and Professions Code § 17200 et seq.; (4) violation of the California Constitutional right to privacy; and (5) violation of California Civil Code § 1798.85. Plaintiff seeks damages and injunctive relief.
California Civil Code § 1798.85 prohibits a company from "[r]equiring an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site."
III. LEGAL STANDARD
A Federal Rule of Civil Procedure 12(c) motion for "judgment on the pleadings is properly granted when, taking all the allegations in the non-moving party's pleadings as true, the moving party is entitled to judgment as a matter of law." Fajardo v. County of Los Angeles, 179 F.3d 698, 699 (9th Cir. 1999).
A Federal Rule of Civil Procedure 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Dismissal pursuant to Rule 12(b)(6) is appropriate if the plaintiff is unable to articulate "enough facts to state a claim to relief that is plausible on its face." Bell Atlantic Corp. v. Twombly, 127 S. Ct. 1955, 1974 (2007). For purposes of such a motion, the complaint is construed in the light most favorable to the plaintiff and all properly pleaded factual allegations are taken as true. Jenkins v. McKeithen, 395 U.S. 411, 421 (1969); Everest Jennings, Inc. v. Am. Motorists Ins. Co., 23 F.3d 226, 228 (9th Cir. 1994). All reasonable inferences are to be drawn in favor of the plaintiff. Id. Unreasonable inferences or conclusory legal allegations cast in the form of factual allegations, however, are insufficient to defeat a motion to dismiss. W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981).
IV. DISCUSSION
A. Standing
The only harm Ruiz alleges in his Complaint is that, as a result of the laptop thefts, he is now "at an increased risk of identity theft." Compl. ¶¶ 56, 63. Ruiz does not allege that his identity has been stolen. Id. "It goes without saying that those who seek to invoke the jurisdiction of the federal courts must satisfy the threshold requirement imposed by Article III of the Constitution by alleging an actual case or controversy." City of Los Angeles v. Lyons, 461 U.S. 95, 101 (1983). "[T]he core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III." Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). "[T]he irreducible constitutional minimum of standing contains three elements." Id. "First, the plaintiff must have suffered an `injury in fact' — an invasion of a legally protected interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural or hypothetical."Id. (internal citations and quotation marks omitted). "Second, there must be a causal connection between the injury and the conduct complained of. . . ." Id. "Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Id. (internal quotation marks omitted).
The dispute in the present case centers on the first element. The Ninth Circuit has addressed the issue of when the risk of a future harm may give rise to an injury in fact. In Hartman v. Summers, 120 F.3d 157, 160 (9th Cir. 1997), the court stated that to "confer standing, the threat of future injury must be credible rather than remote or hypothetical." Id. Thus, a plaintiff "must show a very significant possibility that the future harm will ensue." Id.
The injury that underlies all of Plaintiff's claims — the fact that Plaintiff faces an increased risk that his identity may be stolen at some time in the future — seems, at first blush, conjectural or hypothetical, rather than actual or imminent. Nonetheless, the Court must presume "that general allegations embrace those specific facts that are necessary to support the claim." Lujan, 504 U.S. at 561 (internal quotation marks omitted). Although Ruiz has asserted that the risk of identity theft he and other putative class members face is now "increased," there is nothing else from which the Court can determine whether this risk is actual, imminent, credible, or any of the other adjectives courts have used in defining what types of risk of future harm may confer standing.
At this stage of the proceedings, the Court cannot conclude that Ruiz lacks standing. Nonetheless, Ruiz must be mindful that the elements of standing "are not mere pleading requirements but rather an indispensable part of the plaintiff's case. . . ."Lujan, 504 U.S. at 561. Should it become apparent that Ruiz's alleged injury is in fact too speculative or hypothetical, the Court will conclude, as it must, that Ruiz lacks standing.
B. Ruiz's Claims
1. Negligence
"An action in negligence requires a showing that the defendant owed the plaintiff a legal duty, that the defendant breached the duty, and that the breach was a proximate or legal cause of injuries suffered by the plaintiff." Ann M. v. Pac. Plaza Shopping Ctr., 6 Cal. 4th 666, 673 (1993). The only element at issue is whether Ruiz has suffered an injury. As discussed in the discussion on standing, the Court finds that Ruiz has alleged an injury in fact. His negligence claim, therefore, survives Gap's Motion. The Court notes, however, that it is far from clear what damages, if any, Ruiz will be able to recover if he eventually prevails on his negligence claim.
2. Bailment
Courts have suggested various, mostly similar definitions of bailment. The Ninth Circuit, relying on California law, has defined bailment as "the deposit of personal property with another, usually for a particular purpose." United States v. Alcaraz-Garcia, 79 F.3d 769, 774 n. 11 (9th Cir. 1996); see also Whitcombe v. Stevedoring Servs. of Am., 2 F.3d 312, 317 (9th Cir. 1993) (stating "California law generally defines a bailment as the delivery of a thing in trust for a purpose upon an implied or express contract") (internal citation omitted); Earhart v. Callan, 221 F.2d 160, 163 (9th Cir. 1955) (defining a bailment as "the relationship arising when personal property is delivered to another for some particular purpose upon an express or implied contract to redeliver the goods when the purpose has been fulfilled or to otherwise deal with the goods according to the bailor's directions").
Ruiz's claim for bailment fails for several reasons. First, as Ruiz freely admits, the laptops were stolen from Gap. Ruiz does not allege that Gap was in any way involved with this theft. Rather, he alleges that Gap failed to maintain adequate security procedures to protect against this type of theft. Compl. ¶ 8. Thus, there are no allegations of conversion or any other action by Gap that would indicate that Gap sought to unlawfully retain possession of Ruiz's social security number.
Second, the Court is hard pressed to conceive of how Ruiz's social security number could be construed to be personal property so that Ruiz somehow "delivered" this property to Gap and then expected it be returned. If such a legal theory for bailment exists, Ruiz has failed to present it to the Court in his Opposition papers and the Court, on its own, has found nothing to support it.
Finally, because the only allegation against Gap regarding the theft of the laptops was that Gap was negligent, Ruiz's claim for bailment is duplicative of his claim for negligence. Damages under bailment are typically related to the reasonable value of the property that was not returned. See Weisberg v. Loughridge, 253 Cal. App. 2d 416, 428 (Ct.App. 1967) (stating "[o]ne who is in possession of personal property as a bailee and thereafter converts it by excluding therefrom the person rightfully entitled to possession without the consent of the owner is liable for its reasonable value"). Any damages Ruiz might be able to recover under this unorthodox claim for bailment would be recoverable under his negligence claim. For the reasons stated above, the Court GRANTS Gap's Motion for Judgment on the Pleadings for Ruiz's claim for bailment. 3. Violations of California Business and Professions Code § 17200 et seq.
"California's unfair competition statute prohibits any unfair competition, which means `any unlawful, unfair or fraudulent business act or practice.'" In re Pomona Valley Med. Group, 476 F.3d 665, 674 (9th Cir. 2007) (citing Cal. Bus. Prof. Code § 17200, et seq.). Ruiz alleges that Gap's conduct was unfair and unlawful under § 17200. "[T]o pursue either an individual or a representative claim under the California unfair competition law, Business and Professions Code section 17200 et seq.," a plaintiff "must have suffered an `injury in fact' and `lost money or property as a result of such unfair competition.'" Hall v. Time Inc., 158 Cal. App. 4th 847, 849 (Ct.App. 2008). Ruiz has lost neither money nor property. His attempt to allege that the theft of the laptops somehow constitutes a loss of property because his personal information was contained on the laptop is unavailing. Nor has Ruiz presented any authority to support the contention that unauthorized release of personal information constitutes a loss of property. Without any such authority, the Court is constrained to find that Ruiz has not alleged any loss of property and therefore has not stated a valid claim under § 17200.
Gap's Motion is GRANTED with respect to Ruiz's § 17200 claim for unfair business practices.
4. Violation of the California Constitutional Right to Privacy
A "plaintiff alleging an invasion of privacy in violation of the state constitutional right to privacy must establish each of the following: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy, and (3) conduct by defendant constituting a serious invasion of privacy." Hill v. Nat'l Collegiate Athletic Assn., 7 Cal. 4th 1, 26 (1994). Only the third factor is at issue in this case. "Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right." Id. at 37. The factual allegations in Ruiz's Complaint do not approach this standard. The Court has found that Ruiz has standing to pursue several of his claims because of the alleged increased risk of identity theft. This increased risk and the manner in which it was allegedly created, however, do not constitute an egregious breach and therefore are not violations of the California Constitutional right to privacy. Gap's Motion is GRANTED with respect to this claim.
5. Violation of California Civil Code § 1798.85
California Civil Code § 1798.85 states, in part, "a person or entity may not . . . [r]equire an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site." Ruiz has alleged that he was required to enter his social security number, without a password or other authentication device, in order to enter and use Gap's online application process.
Although the Court presumes "that general allegations embrace those specific facts that are necessary to support the claim,"Lujan, 504 U.S. at 561 (internal quotation marks omitted), if further evidence reveals that Ruiz's social security number was necessary only to submit his application, and was not required to access any website, then this claim will also fail.
Gap, without any authority, asserts that § 1798.85 does not create a private right of action. As Gap has filed the motion for judgment on the pleadings, it is Gap's burden to demonstrate that it is entitled to judgment as a matter of law. The Court declines to shoulder Gap's burden at this stage and embark on an expedition in search of authority supporting Gap's contention. Gap's motion for judgment on the pleadings of this claim is DENIED.
V. CONCLUSION
For the reasons stated above, the Court GRANTS IN PART AND DENIES IN PART Gap's Motion for Judgment on the Pleadings. The Motion is GRANTED with respect to Ruiz's second, third, and fourth claims and DENIED with respect to Ruiz's first and fifth claims. Gap's Request for Judicial Notice is DENIED. Gap's Motion to Strike Class Allegations is DENIED. Ruiz's Motion to Dismiss Gap's Counterclaim is GRANTED.
IT IS SO ORDERED.