Summary
holding the same as to plaintiff's negligence claims because both breach of contract and negligence require a showing of actual damages
Summary of this case from Holly v. Alta Newport Hosp., Inc.Opinion
Case No. 16-cv-05834-JST
03-13-2017
SHATRI SION, Plaintiff, v. SUNRUN, INC., Defendant.
ORDER GRANTING MOTION TO DISMISS
Re: ECF No. 19
Before the Court is Defendant SunRun, Inc.'s Motion to Dismiss Plaintiff Shatri Sion's First Amended Complaint. ECF No. 19. For the reasons below, the Court will grant the motion without prejudice.
I. INTRODUCTION
On October 10, 2016, Sion filed suit against SunRun, alleging that SunRun "acquired Plaintiff's credit information through an unauthorized inquiry of Plaintiff's 'consumer report.'" ECF No. 1 ¶ 14. Sion argued that these actions constituted both negligent and willful violations the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681-1681x. Id. ¶¶ 40-43. Her complaint contains both individual and putative class claims. Id. ¶ 28.
On December 12, 2016, SunRun moved to dismiss Sion's complaint, arguing that "Plaintiff's claim for a negligent violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681o, fails to adequately plead the necessary element of actual damages" and that "Plaintiff's claim for a willful violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681n, fails to adequately plead the necessary element of willfulness." ECF No. 16 at 2. Sion then filed an amended complaint ("FAC"), which added allegations related to willfulness. FAC ¶ 21. Sion did not modify her damages allegations. Those allegations read, in their entirety:
24. Plaintiff was affected personally because when she realized the behavior of Defendant described above (pulling her credit report without any authorization), Plaintiff felt that her privacy had been invaded and that her personal and private information had been disclosed to Defendant, who had no right to Plaintiff's private information. Defendant's behavior caused Plaintiff to suffer mental and emotional distress as a result of Defendant's invasion of Plaintiff's privacy.FAC ¶¶ 24, 26.
. . .
26. Further, Defendant increased the risk that Plaintiff will be injured if there is a data breach on Defendant's computer systems by acquiring additional highly sensitive information about Plaintiff and the class members and saving that information onto its computer system.
SunRun moved to dismiss the FAC on January 13, 2017. ECF No. 19. SunRun no longer argues for dismissal of the willfulness claim, id. at 3 n.1, but continues to argue that Sion's FAC does not adequately plead the damages element of her negligence claim, id. at 3.
II. LEGAL STANDARD
A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). While a complaint need not contain detailed factual allegations, facts pleaded by a plaintiff must be "enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. While the legal standard is not a probability requirement, "where a complaint pleads facts that are merely consistent with a defendant's liability, it stops short of the line between possibility and plausibility of entitlement to relief." Id. (internal quotation marks omitted). The Court must "accept all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party." Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005).
III. ANALYSIS
To state a negligence claim under FCRA, a plaintiff must plead actual damages stemming from the defendant's violation. Burnthorne-Martinez v. Sephora USA, Inc., No. 16-CV-02843-YGR, 2016 WL 6892721, at *6 (N.D. Cal. Nov. 23, 2016). The Ninth Circuit has made clear that "FCRA permits 'recovery for emotional distress and humiliation.'" Drew v. Equifax Info. Servs., LLC, 690 F.3d 1100, 1109 (9th Cir. 2012) (quoting Guimond v. Trans Union Credit Info. Co., 45 F.3d 1329, 1333 (9th Cir. 1995)).
Here, SunRun argues that Sion's allegations are too conclusory to give rise to a plausible inference that she suffered actual damages. Sion's FAC contains two paragraphs that relate to damages. The first states that "Plaintiff was affected personally" by SunRun's behavior, that she "felt that her privacy had been invaded and that her personal and private information had been disclosed to Defendant," and that she "suffer[ed] mental and emotional distress as a result of Defendant's invasion of Plaintiff's privacy." FAC ¶ 24. The second alleged that "Defendant increased the risk that Plaintiff will be injured if there is a data breach on Defendant's computer systems by acquiring additional highly sensitive information about Plaintiff and the class members and saving that information onto its computer system." FAC ¶ 26.
The Court agrees with SunRun that these allegations are too sparse and conclusory to support Sion's negligence claim. Although actual damages can include emotional distress, "a plaintiff must support her claim for pain and suffering 'with something more than [her] own conclusory allegations,' such as specific claims of genuine injury." Dewi v. Wells Fargo Bank, No. CV 12-2891 SHX, 2012 WL 10423239, at *8-9 (C.D. Cal. Aug. 8, 2012) (quoting Myers v. Bennett Law Offices, 238 F. Supp. 2d 1196, 1206 (D. Nev. 2002). The Dewi court found, for example, that "identif[ying] the category of 'pain and suffering' in a laundry list of categories of damages [was] insufficient to state a plausible entitlement to these damages." Id. Similarly, in Burnthorne-Martinez, the court noted that although the plaintiff argued that "her violation of privacy and the emotional distress caused by such can give rise to a claim for actual damages," the "only allegations to that effect [were] general and conclusory" and were therefore "insufficient to sustain a claim." 2016 WL 6892721, at *6. The same is true here. Sion states that she "suffer[ed] mental and emotional distress as a result of Defendant's invasion of Plaintiff's privacy," FAC ¶ 24, but offers no specific facts about how she suffered those damages.
The cases Sion cites in her opposition brief do not support her argument. In Drew, for example, the plaintiff "and his psychological expert explained [how] the identity theft caused Drew grave post-traumatic stress due to his weakened condition and his continued association with the fraudulent accounts exacerbated his condition." Drew, 690 F.3d at 1109. This is more specific than any of the allegations in Sion's FAC. The same distinction can be drawn with Guimond v. Trans Union Credit Info. Co., where the plaintiff alleged that she suffered "emotional distress, manifested by sleeplessness, nervousness, frustration, and mental anguish resulting from the incorrect information in her credit report." 45 F.3d 1329, 1332 (9th Cir. 1995). Neither case stands for the proposition that a bald assertion of emotional distress suffices to show actual damages. Sion also relies on Banga v. Chevron U.S.A. Inc., No. C-11-01498 JCS, 2013 WL 71772, at *14 (N.D. Cal. Jan. 7, 2013). But in that case, the court only referenced emotional damages when explaining the legal standard for negligence claims. Not only did the plaintiff not argue that she suffered emotional distress, but the court also held that the plaintiff had failed raise a genuine issue of material fact as to actual damages. Id. Simply put, Sion points the Court to no case where allegations like those in the FAC were sufficient to defeat a motion to dismiss.
In addition to emotional distress damages, the FAC states that "Defendant increased the risk that Plaintiff will be injured if there is a data breach on Defendant's computer systems by acquiring additional highly sensitive information about Plaintiff and the class members and saving that information onto its computer system." FAC ¶ 26. Sion asserts that this allegation also sufficiently supports her claim of actual damages.
Neither party points to a case from this district in which a court considered whether increased risk of identity theft—Sion's second damage allegation—sufficed to show actual damages in a FCRA case, and the Court did not did not locate any case that was directly on point. Sion's only authority, Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 514 (D.C. Cir. 2016), is not particularly helpful. Hancock only refers to identify theft as one of several types of damages the plaintiff could have alleged (but did not) in order to demonstrate standing. Id. at 515. The decision did not analyze actual damages, and did not suggest that the magic words "identity theft" alone would have satisfied the plausibility test at the motion to dismiss stage.
SunRun, in reply, identifies a number of out-of-circuit cases, mostly involving laws other than FCRA, where a court found conclusory allegations of increased risk of identity theft too speculative to establish actual damages. See, e.g., Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 639 (7th Cir. 2007) (holding that, under Indiana state law, "allegations of increased risk of future identity theft . . . [are not] a harm that the law is prepared to remedy"). SunRun does point the Court to one case from this district, in which the court found a bare allegation of increased risk of identity theft "too speculative to satisfy the pleading requirement of contract damages." Svenson v. Google Inc., 65 F. Supp. 3d 717, 725 (N.D. Cal. 2014) (emphasis added). Although that case involved a contract claim, not a FCRA claim, both require a showing of actual damages. See Ruiz v. Gap, Inc., 622 F. Supp. 2d 908, 917-18 (N.D. Cal. 2009). Given that identical requirement, Svenson's conclusion is persuasive here. The Court finds that Sion's conclusory statement that "Defendant increased the risk that [Sion] will be injured if there is a data breach on Defendant's computer systems" is insufficient, even when coupled with Sion's allegation of emotional distress, to defeat SunRun's motion to dismiss.
The Court considers Sun Run's new authority on reply because it responds to Sion's opposition brief, and because it relates to the same general argument SunRun made in its motion to dismiss.
The present case is distinguishable from those in which the defendant maintains the plaintiff's personal information on its server and the server is breached. In those cases, the risk is not that there will be a breach - that event has occurred - but that the plaintiff's personal information will be misused by the persons who committed the breach. In that instance, some courts have concluded that the risk of misuse is sufficient injury to confer standing. In re Adobe Sys., Inc. Privacy Litig., 66 F. Supp. 3d 1197, 1214 (N.D. Cal. 2014) ("the risk that Plaintiffs' personal data will be misused by the hackers who breached Adobe's network is immediate and very real"). There is no allegation here that SunRun's servers were breached.
CONCLUSION
In sum, Sion's allegations are too speculative and vague to plausibly show actual damages stemming from SunRun's alleged negligent violation of FCRA. The Court therefore dismisses / / / / / / / / / / / / Sion's negligence claim, but grants Sion leave to amend her complaint to allege additional facts to support her claim for actual damages. Sion must file any amended complaint by March 27, 2017.
The case management conference currently scheduled for March 15, 2017 is CONTINUED to June 7, 2017 at 2:00 p.m.
IT IS SO ORDERED. Dated: March 13, 2017
/s/_________
JON S. TIGAR
United States District Judge