Summary
holding that the theft of a retail store's laptop containing personal information, including the social security numbers, of job applicants did not constitute an egregious breach of privacy and therefore was not sufficient to state a claim
Summary of this case from Gonzales v. Uber Techs., Inc.Opinion
No. 09-15971.
Argued and Submitted April 12, 2010.
Filed May 28, 2010.
Mark Punzalan, Rosemary M. Rivas, Finkelstein Thompson LLP, San Francisco, CA, Ben Barnow, Esquire, Sharon Ann Harris, Esquire, Barnow and Associates, P.C., Chicago, IL, Karen Jennifer Marcus, Tracy D. Rezvani, Finkelstein, Thompson Loughran, Washington, DC, for Plaintiff-Appellant.
William L. Stern, Esquire, Geoffrey Pittman, Morrison Foerster LLP, San Francisco, CA, Teresa Neet Burlison, Morrison Foerster LLP, Palo Alto, CA, Brian Matsui, Deanne Maynard, Morrison Foerster, LLP, Andrew N. Goldfarb, Zuckerman Spaeder LLP, Douglas Ryan Miller, Esquire, Zuckerman Spaeder LLP, Washington, DC, for Defendants-Appellees.
Appeal from the United States District Court for the Northern District of California, Samuel Conti, District Judge, Presiding. D.C. No. 3:07-cv-05739-SC.
Before: KLEINFELD, TASHIMA and THOMAS, Circuit Judges.
MEMORANDUM
This disposition is not appropriate for publication and is not precedent except as provided by 9th Cir. R. 36-3.
Joel Ruiz appeals the district court's grant of summary judgment in favor of Gap, Inc. and Vangent, Inc. in Ruiz's diversity putative class action lawsuit, seeking damages and injunctive relief based on the theft of a laptop computer that contained Ruiz's social security number. We affirm. Because the parties are familiar with the facts and procedural history, we need not recount it here.
I
The district court correctly held that Ruiz has standing to pursue his claims. To satisfy the standing requirement of Article III of the Constitution, there must be the "irreducible constitutional minimum" of an injury-in-fact. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). An injury-in-fact is "an invasion of a legally protected interest which is (a) concrete and particularized . . . and (b) actual or imminent, not conjectural or hypothetical." Id. (internal citations and quotation marks omitted). "[T]he possibility of future injury may be sufficient to confer standing." Cent. Delta Water Agency v. United States, 306 F.3d 938, 947 (9th Cir. 2002); see also Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000). "[A] credible threat of harm is sufficient to constitute actual injury for standing purposes." Cent. Delta Agency, 306 F.3d at 950. Ruiz alleged, with support from an expert affidavit, that he was at greater risk of identity theft. As the district court properly concluded, this alleged prospective injury presents enough of a risk that the concerns of plaintiffs are real, and not merely speculative. Ruiz has sufficient Article III standing to pursue his claims.
II.
The district court did not err in granting summary judgment on Ruiz's state law negligence claim. The elements of a negligence cause of action under California law are (1) the existence of a duty to exercise due care, (2) breach of that duty, (3) causation, and (4) damages. Paz v. California, 22 Cal.4th 550, 93 Cal.Rptr.2d 703, 994 P.2d 975, 980-81 (2001).
The district court concluded that Ruiz had failed to establish sufficient appreciable, nonspeculative, present harm to sustain a negligence cause of action under California law. California has long held that "[i]t is fundamental that a negligent act is not actionable unless it results in injury to another." Fields v. Napa Milling Co., 164 Cal.App.2d 442, 330 P.2d 459, 462 (1958). California also holds that "[n]ominal damages, to vindicate a technical right, cannot be recovered in a negligence action, where no actual loss has occurred." Id. In addition, in different contexts, the California courts have indicated that the mere threat of future harm is insufficient. See Jordache Enters., Inc. v. Brobeck, Phleger Harrison et al., 18 Cal.4th 739, 76 Cal.Rptr.2d 749, 958 P.2d 1062, 1065 (1998) ("[N]ominal damages, speculative harm, and the mere threat of future harm are not actual injury."); Adams v. Paul, 11 Cal.4th 583, 46 Cal. Rptr.2d 594, 904 P.2d 1205, 1209 (1995) (same).
California courts have not considered whether time and money spent on credit monitoring as the result of the theft of personal information are damages sufficient to support a negligence claim. We do not need to reach that question here. Even assuming, without deciding, that such damages are cognizable under California law, Ruiz failed to establish a genuine issue of material fact on whether he suffered damages because he offered no evidence on the amount of time and money he spent on the credit monitoring, or that Gap's offer would not fully recompense him.
California has recognized monitoring costs as sufficient to state a negligence claim in the context of exposure to toxic chemicals. Potter v. Firestone Tire Rubber Co., 6 Cal.4th 965, 25 Cal.Rptr.2d 550, 863 P.2d 795, 824-25 (1993). Under Potter, the specific factors for determining the reasonableness and necessity of medical monitoring are: (1) the significance and extent of the plaintiff's exposure to chemicals; (2) the toxicity of the chemicals; (3) the relative increase in the chance of onset of disease in the exposed plaintiff as a result of the exposure, when compared to (a) the plaintiff's chances of developing the disease had he or she not been exposed, and (b) the chances of the members of the public at large of developing the disease; (4) the seriousness of the disease for which the plaintiff is at risk; and (5) the clinical value of early detection and diagnosis. Potter, 25 Cal.Rptr.2d 550, 863 P.2d at 824-25.
III.
The district court did not err in granting summary judgment on Ruiz's breach of contract claim against Vangent. The district court concluded that Ruiz had failed to adduce any evidence of the appreciable and actual damage necessary to sustain a contract claim under California law. See St. Paul Fire Marine Ins. Co. v. Am. Dynasty Surplus Lines Ins. Co., 101 Cal. App.4th 1038, 124 Cal.Rptr.2d 818, 834 (2002) ("An essential element of a claim for breach of contract are damages resulting from the breach.") (emphasis omitted).
On appeal, Ruiz contends that the district court erred because nominal damages are available in contract actions in California. This argument has support in California law. See, e.g., Sweet v. Johnson, 169 Cal.App.2d 630, 337 P.2d 499, 500 (1959) (holding nominal damages are presumed as a matter of law to stem merely from the breach of a contract).
However, our circuit has already examined that question, and concluded that "under California law, a breach of contract claim requires a showing of appreciable and actual damage." Aguilera v. Pirelli Armstrong Tire Corp., 223 F.3d 1010, 1015 (9th Cir. 2000) (citing Patent Scaffolding Co. v. William Simpson Const. Co., 256 Cal.App.2d 506, 64 Cal.Rptr. 187, 191 (1967) ("A breach of contract without damage is not actionable.")).
Aguilera binds us, as it did the district court. Thus, the district court correctly applied Aguilera in granting summary judgment on the breach of contract claim.
IV.
The district court did not err in granting summary judgment on Ruiz's statutory un-fair competition claim. "California's unfair competition statute prohibits any unfair competition, which means `any unlawful, unfair or fraudulent business act or practice.'" In re Pomona Valley Med. Group, Inc., 476 F.3d 665, 674 (9th Cir. 2007) (citing CAL. BUS. PROF. CODE §§ 17200 et seq. (UCL)).
The district court concluded that Ruiz lacked standing to pursue this claim because he did not suffer actual injury that was cognizable under the statute. "[T]o pursue either an individual or a representative claim under the California unfair competition law," a plaintiff "must have suffered an `injury in fact' and have `lost money or property as a result of such unfair competition.'" Hall v. Time Inc., 158 Cal.App.4th 847, 70 Cal.Rptr.3d 466, 467 (2008).
Consistent with that requirement, we have held that standing under the UCL is limited to individuals who suffer actual losses of money or property, and thus are eligible for restitution. Walker v. Geico Gen. Ins. Co., 558 F.3d 1025, 1027 (9th Cir. 2009). Under California law, to claim a loss of money or property for restitution purposes, a plaintiff must have either prior possession or a vested legal interest in the money or property lost. Korea Supply Co. v. Lockheed Martin Corp., 29 Cal.4th 1134, 131 Cal.Rptr.2d 29, 63 P.3d 937, 947 (2003).
Thus, given the allegations of the complaint and the tendered evidence of damage, the district court did not err in concluding that Ruiz lacked standing to pursue a statutory UCL claim.
V
The district court did not err in granting summary judgment on Ruiz's claim under the California Constitution for invasion of privacy. A "plaintiff alleging an invasion of privacy in violation of the state constitutional right to privacy must establish each of the following: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy." Hill v. Nat'l Collegiate Athletic Ass'n, 7 Cal.4th 1, 26 Cal.Rptr.2d 834, 865 P.2d 633, 657 (1994). "Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right." Id., 26 Cal. Rptr.2d 834, 865 P.2d at 655.
Although Ruiz is correct that California has not explicitly required a finding of intentional conduct as a prerequisite for the cause of action to be asserted, California courts have yet to extend the cause of action to include accidental or negligent conduct. In addition, as the district court noted, California courts have not extended as yet the concept of an "egregious breach" to include an increased risk of privacy invasion, rather than an actual privacy invasion. Therefore, the district court did not err in granting summary judgment on this claim.
VI.
The district court did not err in granting summary judgment on Ruiz's claims under California Civil Code § 1798.85. That section provides that a person or entity may not "[r]equire an individual to use his or her social security number to access an Internet Web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet Web site." CAL. CIV. CODE § 1798.85(a)(4). Ruiz alleges that Gap and Vangent violated this provision by requiring him to use his social security number in conjunction with filling out the online job application.
The plain language of § 1798.85(a)(4) is directed to the initial act of logging onto a website, rather than as information that is subsequently requested after the user enters the website. Indeed, the statute permits the use of a social security number if "a password or unique personal identification number or other authentication device is also required to access the Internet Web site." Id. The purpose of the section was "to reduce the incidence of identity theft by ending the practice of using social security numbers as identification or account numbers." Cal. Bill Analysis, A.B. 3016 Sen., June 8, 2004.
Thus, the district court correctly concluded that requesting social security information from applicants after the pass-word-protected website was accessed through other means did not violate the statute.
VII.
No one can doubt that those individuals whose private information was potentially exposed by the theft of the laptop have reason to be aggrieved and concerned. However, the sole question for us is whether the district court properly analyzed the legal claims raised by Ruiz. We conclude that it did.