Summary
finding it foreseeable that the plaintiff would suffer injury if the defendant failed to adequately protect the plaintiff's PII
Summary of this case from Huynh v. Quora, Inc.Opinion
Case No. 2:18-cv-06975-ODW (KSx)
2019-07-19
Michael TERPIN, Plaintiff, v. AT&T MOBILITY, LLC; and Does 1-25 Defendants.
Paul A. Blechner, Pierce Henry O'Donnell, Timothy J. Toohey, Greenberg Glusker Fields Claman and Machtinger LLP, Los Angeles, CA, for Plaintiff. Ashley E. Johnson, Pro Hac Vice, Gibson Dunn and Crutcher LLP, Dallas, TX, Eric David Vandevelde, Marcellus A. McRae, Michael M. Lee, Gibson Dunn and Crutcher LLP, Los Angeles, CA, for Defendants.
Paul A. Blechner, Pierce Henry O'Donnell, Timothy J. Toohey, Greenberg Glusker Fields Claman and Machtinger LLP, Los Angeles, CA, for Plaintiff.
Ashley E. Johnson, Pro Hac Vice, Gibson Dunn and Crutcher LLP, Dallas, TX, Eric David Vandevelde, Marcellus A. McRae, Michael M. Lee, Gibson Dunn and Crutcher LLP, Los Angeles, CA, for Defendants.
ORDER GRANTING, IN PART, AND DENYING IN PART, DEFENDANT'S MOTION TO DISMISS [14]; AND DENYING DEFENDANT'S MOTION TO STRIKE [15]
OTIS D. WRIGHT, II, UNITED STATES DISTRICT JUDGE
I. INTRODUCTION
Defendant AT&T Mobility LLC ("AT&T") moves to dismiss Plaintiff Michael Terpin's ("Terpin") Complaint. (See generally Mot. to Dismiss ("MTD"), ECF No. 14.) Additionally, AT&T moves to strike portions of Mr. Terpin's Complaint. (See generally Mot. to Strike ("MTS"), ECF No. 15.) For the reasons that follow, the Court GRANTS, IN PART, AND DENIES, IN PART, Defendant's Motion to Dismiss (ECF No. 14), and DENIES Defendant's Motion to Strike (ECF No. 15).
After carefully considering the papers filed in connection with the motions, the Court deemed the matters appropriate for decision without oral argument. Fed. R. Civ. P. 78 ; C.D. Cal. L.R. 7-15.
II. FACTUAL AND PROCEDURAL BACKGROUND
Mr. Terpin is a prominent and well-known member of the cryptocurrency community. (Compl. ¶¶ 13–14, ECF No. 1.) He is domiciled in Puerto Rico with a residence in California. (Comp. ¶ 1.) On June 11, 2017, Mr. Terpin's phone suddenly became inoperable because his cell phone number had been hacked. (Compl. ¶ 64.) After hackers attempted and failed eleven times to change Mr. Terpin's AT&T password in AT&T stores, the hackers were able to change his password remotely. (Compl. ¶ 64.) Mr. Terpin alleges that this allowed the hackers to gain control of Mr. Terpin's phone number, which allowed them to divert his personal information, including telephone calls and text messages, to gain access to his accounts that use his telephone number for authentication. (Compl. ¶¶ 64–65.) The hackers used Mr. Terpin's telephone number to access his cryptocurrency accounts and also impersonated him by using his Skype account. (Compl. ¶ 65.) By impersonating Mr. Terpin, the hackers convinced Mr. Terpin's client to send them cryptocurrency and diverted the cryptocurrency to themselves. (Compl. ¶ 65.) Later that day, AT&T was able to cutoff the hackers' access to Mr. Terpin's telephone number. (Compl. ¶ 65.) However, by this time, the hackers had stolen substantial funds from Mr. Terpin. (Compl. ¶ 65.)
Around June 13, 2017, Mr. Terpin met with AT&T representatives in Puerto Rico to discuss the hack. (Compl. ¶ 66.) AT&T allegedly promised to place Mr. Terpin's account "on a higher security level with special protection." (Compl. ¶ 67 (internal quotation marks omitted).) This included requiring a six-digit passcode (known only to Mr. Terpin and his wife) of anyone attempting to access or change Mr. Terpin's account or transfer his telephone number to another phone. (Compl. ¶ 67.)
On Sunday, January 7, 2018, Mr. Terpin's phone again became inoperable. (Compl. ¶ 72.) Mr. Terpin eventually learned that an employee at an AT&T store in Norwich, Connecticut assisted an imposter with a SIM card swap. (Compl. ¶¶ 71–72.) This resulted in AT&T transferring Mr. Terpin's phone number to an imposter. (Compl. ¶ 72.) Mr. Terpin alleges that when his phone became inoperable, he attempted to contact AT&T to have his telephone number canceled, but AT&T failed to promptly to cancel his account. (Compl. ¶ 73.) By having access to Mr. Terpin's phone number, Mr. Terpin alleges that "the hackers were able to intercept Mr. Terpin's personal information, including telephone calls and text messages, and gain access to his cryptocurrency accounts." (Compl. ¶ 76.) As a result, between January 7 and 8, 2018, Mr. Terpin alleges that the imposter stole nearly $24 million worth of cryptocurrency from him. (Compl. ¶ 72.)
Mr. Terpin alleges that "SIM swapping consists of tricking a provider ... into transferring the target's phone number to a SIM card controlled by the criminal. Once they get the phone number, fraudsters can leverage it to reset the victims' passwords and break into their online accounts." (Compl. ¶ 53.)
On August 15, 2018, Mr. Terpin filed his Complaint against AT&T alleging sixteen causes of action for: (1) declaratory relief that AT&T's consumer agreement is unconscionable and contrary to public policy; (2) unauthorized disclosure of customer confidential proprietary information, 47 U.S.C. §§ 206, 222 ; (3) assisting unlawful access to computer, California Penal Code section 502 et seq. ; (4) violation of California's Unfair Competition Law ("UCL") – unlawful business practice, California Business and Professions Code section 17200 et seq. ; (5) violation of UCL – unfair business practice, California Business and Professions Code section 17200 et seq. ; (6) violation of UCL – fraudulent business practice, California Business and Professions Code section 17200 et seq. ; (7) violation of California Consumer Legal Remedies Act ("CLRA"), California Civil Code section 1750 et seq. ; (8) deceit by concealment, California Civil Code sections 1709, 1710 ; (9) misrepresentation; (10) negligence; (11) negligent supervision and training; (12) negligent hiring; (13) breach of contract – privacy policy; (14) breach of implied contracts (in the alternative to breach of express contract); (15) breach of covenant of good faith and fair dealing; and (16) violation of California's Customer Records Act – inadequate security, California Civil Code section 1798.81.5. (Compl. ¶¶ 80–241.)
As part of his allegations, Mr. Terpin alleges that on April, 8, 2015, AT&T entered into a consent decree ("Consent Decree") with the Federal Communications Commission ("FCC") to implement detailed measures to protect against unauthorized disclosure of customers' private information. (Compl. ¶¶ 4, 32.)
AT&T moves to dismiss Mr. Terpin's Complaint in its entirety and strike portions of the Complaint referencing the Consent Decree. (See generally MTD; MTS.) The Court will address each in turn. III. MOTION TO DISMISS
A court may dismiss a complaint under Rule 12(b)(6) for lack of a cognizable legal theory or insufficient facts pleaded to support an otherwise cognizable legal theory. Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1988). "To survive a motion to dismiss ... under Rule 12(b)(6), a complaint generally must satisfy only the minimal notice pleading requirements of Rule 8(a)(2)"—a short and plain statement of the claim. Porter v. Jones , 319 F.3d 483, 494 (9th Cir. 2003) ; see also Fed. R. Civ. P. 8(a)(2). The "[f]actual allegations must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). The "complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (internal quotation marks omitted). "A pleading that offers ‘labels and conclusions’ or ‘a formulaic recitation of the elements of a cause of action will not do.’ " Id. (citing Twombly , 550 U.S. at 555, 127 S.Ct. 1955 ).
Whether a complaint satisfies the plausibility standard is a "context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. at 679, 129 S.Ct. 1937. A court is generally limited to the pleadings and must construe all "factual allegations set forth in the complaint ... as true and ... in the light most favorable" to the plaintiff. Lee v. City of Los Angeles , 250 F.3d 668, 679 (9th Cir. 2001). But a court need not blindly accept conclusory allegations, unwarranted deductions of fact, and unreasonable inferences. Sprewell v. Golden State Warriors , 266 F.3d 979, 988 (9th Cir. 2001). Accusations of fraud require a plaintiff to plead with particularity the circumstances constituting fraud. See Fed. R. Civ. P. 9(b). Rule 9(b) requires that the complaint identify the "who, what, when, where, and how" of the fraudulent activity, "as well as what is false or misleading about" it, and why it is false. United States ex rel. Cafasso v. Gen. Dynamics C4 Sys., Inc. , 637 F.3d 1047, 1055 (9th Cir. 2011) (internal quotation marks omitted).
Where a district court grants a motion to dismiss, it should generally provide leave to amend unless it is clear the complaint could not be saved by any amendment. See Fed. R. Civ. P. 15(a) ; Manzarek v. St. Paul Fire & Marine Ins. Co. , 519 F.3d 1025, 1031 (9th Cir. 2008).
A. Proximate Cause
AT&T moves to dismiss the Complaint in its entirety on the basis that Mr. Terpin failed to sufficiently allege proximate cause for each of his claims. (MTD 4.) Specifically, AT&T advances two arguments: (1) the independent, intervening criminal acts of others, the hackers/imposter, destroy proximate cause; and (2) Mr. Terpin failed to adequately allege how the flaws in AT&T's security resulted in Mr. Terpin's funds being stolen. (MTD 4–6.)
Proximate cause "limits the defendant's liability to those foreseeable consequences that the defendant's negligence was a substantial factor in producing." Mendoza v. City of Los Angeles , 66 Cal. App. 4th 1333, 1342, 78 Cal.Rptr.2d 525 (1998). "Ordinarily, proximate cause is a question fact ...." Kane v. Hartford Accident & Indem. Co. , 98 Cal. App. 3d 350, 359, 159 Cal.Rptr. 446 (1979). In California, "a criminal act will be deemed a superseding cause unless it involves a particular and foreseeable hazard inflicted upon a member of a foreseeable class." Id. at 360, 159 Cal.Rptr. 446. "[W]here an intervening act by a third party was foreseeable, it does not amount to a superseding cause relieving the negligent defendant of liability." Ileto v. Glock Inc. , 349 F.3d 1191, 1208 (9th Cir. 2003). At this point, taking the Complaint as true, Mr. Terpin has sufficiently alleged that the criminal acts of a third party were reasonably foreseeable by AT&T. Mr. Terpin alleges that he informed AT&T in June 2017 that he was the victim of a SIM card swap and that AT&T placed his account on a higher security level with special protection. Thus, AT&T was put on actual notice that Mr. Terpin's account was at risk. Despite this knowledge, Mr. Terpin was again the victim of a SIM card swap in January 2018, allegedly as a result of AT&T's assistance. Accordingly, at this stage, Mr. Terpin has sufficiently alleged that the criminal act was reasonably foreseeable such that the claim should not be dismissed on this basis.
Separately, AT&T contends that Mr. Terpin has not sufficiently pleaded how the SIM card swap resulted in Mr. Terpin losing $24 million. Mr. Terpin does not address this issue in his Opposition. (See generally Opp'n to MTD, ECF No. 19.)
"It is a well established principle of [the common] law that in all cases of loss, we are to attribute it to the proximate cause, and not to any remote cause." Bank of Am. Corp. v. Miami , ––– U.S. ––––, 137 S. Ct. 1296, 1305, 197 L.Ed.2d 678 (2017) (alteration in original) (internal quotation marks omitted). "Proximate cause is that cause which, in natural and continuous sequence, unbroken by any efficient intervening cause, produced the injury [or damage complained of] and without which such result would not have occurred." California v. Superior Court , 150 Cal. App. 3d 848, 857, 197 Cal.Rptr. 914 (1984) (alteration in original) (internal quotation marks omitted). The proximate cause requirement "bars suits for alleged harm that is ‘too remote’ from the defendant's unlawful conduct." Lexmark Int'l, Inc. v. Static Control Components, Inc. , 572 U.S. 118, 133, 134 S.Ct. 1377, 188 L.Ed.2d 392 (2014).
Mr. Terpin fails to sufficiently allege proximate cause. Mr. Terpin does not connect how granting the hackers/fraudsters access to Mr. Terpin's phone number resulted in him losing $24 million. Based on the allegations of the Complaint, Mr. Terpin asserts that AT&T assisted the hackers with a SIM card swap, thus granting the hackers access to Mr. Terpin's phone number. This allegedly resulted in Mr. Terpin losing $24 million in cryptocurrency. However, Mr. Terpin does not explain how the hackers accessed Mr. Terpin's cryptocurrency account(s), whether they sold Mr. Terpin's cryptocurrency then transferred the money, or whether they transferred the cryptocurrency to a cold wallet. At this stage, the Court is left to speculate how having access to Mr. Terpin's phone number resulted in the theft of cryptocurrency.
Mr. Terpin alleged in each of his sixteen claims (with the exception of the declaratory relief claim) that AT&T's actions resulted in him losing $24 million worth in cryptocurrency. (See Compl. ¶¶ 109, 118, 130, 142, 153, 163, 175, 181, 189, 201, 213, 221, 227, 233, 239.) Thus, to the extent Mr. Terpin's claims rely on the $24 million in damages, those claims are DISMISSED with leave to amend .
B. Declaratory Relief
AT&T moves to dismiss Mr. Terpin's claim for declaratory relief on the grounds that the claim is not ripe.
The Declaratory Judgment Act provides jurisdiction "[i]n a case of actual controversy ... [to] any court of the United States ... [so that it] may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought." 28 U.S.C. § 2201(a). Declaratory relief is not appropriate unless "there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of declaratory judgment. A case is ripe where the essential facts establishing the right to declaratory relief have already occurred." Boeing Co v. Cascade Corp. , 207 F.3d 1177, 1192 (9th Cir. 2000) (internal quotation marks omitted).
"A claim is not ripe for adjudication if it rests upon ‘contingent future events that may not occur as anticipated, or indeed may not occur at all.’ " Texas v. United States , 523 U.S. 296, 300, 118 S.Ct. 1257, 140 L.Ed.2d 406 (1998) (quoting Thomas v. Union Carbide Agric. Prods. Co. , 473 U.S. 568, 580–81, 105 S.Ct. 3325, 87 L.Ed.2d 409 (1985) ). Article III of the Constitution requires that there exist a "case or controversy" and that the issues presented must be "definite and concrete, not hypothetical or abstract" for them to be ripe for determination. Thomas v. Anchorage Equal Rights Comm'n , 220 F.3d 1134, 1139 (9th Cir. 2000) (quoting Ry. Mail Ass'n v. Corsi , 326 U.S. 88, 93, 65 S.Ct. 1483, 89 L.Ed. 2072 (1945) ). However, "a litigant need not await the consummation of threatened injury to obtain preventive relief. If the injury is certainly impending, that is enough." Addington v. U.S. Airline Pilots Ass'n , 606 F.3d 1174, 1179 (9th Cir. 2010) (internal quotation marks omitted).
Mr. Terpin's claim for declaratory relief is ripe and sufficiently alleged. He seeks to declare AT&T's wireless customer agreement as unconscionable, void against public policy, and unenforceable in its entirety. Mr. Terpin identifies several provisions of the customer agreement with which he takes issue. Specifically, he objects to the exculpatory provision that exempts AT&T from liability from its own negligence, acts or omissions of a third party, or damages or injury caused by the use of the device (Compl. ¶ 87); the damages restriction clause that exempts AT&T from certain forms of damages (Compl. ¶ 90); the indemnity provision requiring customers to indemnify AT&T for claims arising out of the services provided by AT&T (Compl. ¶ 94); and the arbitration provision requiring Mr. Terpin to arbitrate his claims (Compl. ¶ 97). Mr. Terpin alleges that as a result of these illegal contract provisions, the entire customer agreement is unenforceable because the central purpose of the agreement is tainted with illegality. (Compl. ¶ 96.)
There is substantial controversy between AT&T and Mr. Terpin, particularly given the context of this lawsuit. AT&T and Mr. Terpin have adverse legal interests of sufficient immediacy and reality to warrant a claim for declaratory judgment. The terms of the wireless customer agreement are directly implicated by this lawsuit, particularly the terms that Mr. Terpin has identified. The contract between Mr. Terpin and AT&T, if enforceable, would potentially result in a denial Mr. Terpin's claims and/or damages, or at the very least, a transfer of his claims to arbitration. Taking the allegations in the Complaint as true, Mr. Terpin has sufficiently alleged a claim for declaratory relief. Accordingly, the Court finds that the claim for declaratory relief is sufficiently ripe and alleged to survive a motion to dismiss.
C. Unauthorized Disclosure, 47 U.S.C. §§ 206, 222 (Claim 2)
AT&T moves to dismiss Mr. Terpin's second claim for unauthorized disclosure on the basis that Mr. Terpin failed to plead the claim sufficiently. (MTD 8.)
47 U.S.C. § 222(a) provides that "[e]very telecommunications carrier has a duty to protect the confidentiality of proprietary information of, and relating to other telecommunication carriers, equipment manufacturers, and customers." The statute does not define proprietary information; however, as AT&T recognizes, this information includes "information that is extremely personal to customers ... such as to whom, where, and when a customer places a call, as well as the types of service offerings to which the customer subscribes." U.S. W., Inc. v. F.C.C. , 182 F.3d 1224, 1235 (10th Cir. 1999) (alteration in original). 47 U.S.C. § 222 "was principally intended to protect consumer's privacy interests." ICG Commc'ns, Inc. v. Allegiance Telecom , 211 F.R.D. 610, 612 (N.D. Cal. 2002) (citing U.S. W. , 182 F.3d at 1236 ).
The FCC has interpreted proprietary information as broadly encompassing "all types of information that should not be exposed widely to the public, whether that information is sensitive for economic or personal privacy reasons, and that this includes privileged information, trade secrets, and personally identifiable information." In re Cox Commc'ns , 30 FCC Rcd. 12302, 12307 (2015) (footnotes omitted); see also In re Terracom Inc. & Yourtel Am., Inc. , 29 FCC Rcd. 13325, at *6 (2014) (internal quotation marks omitted) (finding that personally identifiable information can include "(1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information").
Additionally, the statute defines customer proprietary network information as "information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier-customer relationship." 47 U.S.C. § 222(h)(1)(A). 47 U.S.C. § 206 holds common carriers liable "for the full amount of damages sustained in consequence of any such violation of the provisions of this chapter, together with a reasonable counsel or attorney's fee."
Mr. Terpin alleges that AT&T disclosed both customer proprietary network information and his customer proprietary information. (Compl. ¶ 115.) AT&T contends that Mr. Terpin failed to adequately allege that AT&T provided any third-party unauthorized access to any information covered by 47 U.S.C. § 222(a). In response, Mr. Terpin points to his allegation that AT&T divulged his telephone number, account information, and his private communications to hackers in the January 7, 2018 SIM card swap. (Compl. ¶ 108.) Mr. Terpin further alleges that "AT&T permitted hackers to access Mr. Terpin's telephone number, telephone calls, text messages and account information to steal nearly $24,000,000 worth of his cryptocurrency." (Compl. ¶ 108.) Although Mr. Terpin has not identified any information that falls within the definition of "customer proprietary network information," Mr. Terpin has sufficiently alleged that AT&T permitted unauthorized access to his proprietary information, specifically his account information and private communications. AT&T argues that the hackers already had Mr. Terpin's account information, which allowed the hackers to access his account in the first place. However, at this stage of the proceeding, the Court must accept the allegations in the Complaint as true, that AT&T divulged this information to the hackers in violation of § 222(a).
Accordingly, Mr. Terpin has sufficiently alleged his second claim for unauthorized disclosure. D. Extraterritoriality of California Statutory Claims (Claims 3–7 and 16)
AT&T moves to dismiss Mr. Terpin's California statutory claims (claims 3–7 and 16) on the basis that the California statutes do not apply extraterritorially. (MTD 11–12.)
The Court does not address the other issues that AT&T raises related to these claims.
California law presumes that the legislature "did not intend the statutes of this state to have force or operation beyond the boundaries of the state." Norwest Mortg., Inc. v. Superior Court , 72 Cal. App. 4th 214, 222, 85 Cal.Rptr.2d 18 (1999). Unless the legislature explicitly indicates otherwise, "if the liability-creating conduct occurs outside of California, California law generally should not govern that conduct." Oman v. Delta Air Lines, Inc. , 889 F.3d 1075, 1079 (9th Cir. 2018). This includes claims under the UCL and CLRA. See Sullivan v. Oracle Corp. , 51 Cal. 4th 1191, 1207, 127 Cal.Rptr.3d 185, 254 P.3d 237 (2011) ("[T]he presumption against extraterritoriality applies to the UCL in full force."); McKinnon v. Dollar Thrifty Auto. Grp. , No. 12-4457 SC, 2013 WL 791457, at *4 (N.D. Cal. Mar. 4, 2013) (internal quotation marks omitted) ("With regard to the UCL and CLRA, non-California residents' claims are not supported where none of the alleged misconduct or injuries occurred in California."). A plaintiff's residence alone is not sufficient to bring claims under the UCL or CLRA where the injuries occur outside of California. McKinnon , 2013 WL 791457, at *5.
Mr. Terpin has not overcome the presumption against extraterritoriality. Mr. Terpin argues two points: (1) he owns a residence in California; and (2) his contract with AT&T is governed by California law. (Opp'n 12.) Neither points are persuasive. As to Mr. Terpin's first point, residence alone is not sufficient. See McKinnon , 2013 WL 791457, at *5. Moreover, Mr. Terpin does not even allege that he is a resident of California, just that he owns a residence in California. Mr. Terpin does not identify any legal authority that states owning property in a given state results in the extraterritorial application of that state's laws unrelated to the property. Mr. Terpin is domiciled in Puerto Rico and was in Puerto Rico at the time of the incidents. Further, Mr. Terpin does not allege that the hacks giving rise to this Complaint occurred in California. After the first hack, Mr. Terpin met with AT&T representatives in Puerto Rico. (Compl. ¶ 66.) Regarding the second hack, Mr. Terpin alleges that an employee of AT&T "in Norwich, Connecticut ported over Mr. Terpin's wireless number to an imposter." (Compl. ¶ 72.)
Further, Mr. Terpin's allegation that his contract with AT&T is governed by California law is also unpersuasive, notwithstanding that he seeks declaratory judgment that the contract is void in its entirety. Mr. Terpin's Complaint does not allege that the contract is governed by California law, just that "Mr. Terpin obtained wireless services from AT&T in Los Angeles County in or about the mid-1990's." (Compl. ¶ 2.) However, Mr. Terpin then alleges that he "entered into a wireless contract with AT&T in or about 2011." (Compl. ¶ 81.) Thus, the Complaint is unclear whether the contract at issue is one for wireless services that Mr. Terpin obtained in California in the mid-1990s, or the contract entered into in 2011 at an undisclosed location. As such, Mr. Terpin has not overcome the presumption against extraterritoriality. Because Mr. Terpin does not adequately allege that the liability-creating conduct occurred in California or establish how any of his California statutory claims apply extraterritorially, these claims fail. Accordingly, the Court GRANTS AT&T's motion to dismiss claims three through seven and sixteen, with leave to amend . Although Mr. Terpin is given leave to amend, he should not replead these claims if he cannot cure these deficiencies.
E. Economic Loss Doctrine (Claims 8–12)
AT&T contends that the economic loss rule bars Mr. Terpin's tort claims because his tort claims are based on the same facts as his contract-based claims. (MTD 19.)
Generally, the economic loss rule "bars tort claims based on contract breaches." UMG Recordings, Inc. v. Global Eagle Entm't , 117 F. Supp. 3d 1092, 1103 (C.D. Cal. 2015). In California, "[t]he economic loss rule requires a purchaser to recover in contract for purely economic loss due to disappointed expectations, unless he can demonstrate harm above and beyond a broken contractual promise." Robinson Helicopter Co., v. Dana Corp. , 34 Cal. 4th 979, 988, 22 Cal.Rptr.3d 352, 102 P.3d 268 (2004). Under the rule, a plaintiff may recover in tort only where she can allege personal injury or damage to property other than the product itself. Jimenez v. Superior Court , 29 Cal. 4th 473, 483, 127 Cal.Rptr.2d 614, 58 P.3d 450 (2002).
The California Supreme Court recognized an exception to the economic loss rule in J'Aire Corporation v. Gregory , wherein the rule does not prevent recovery in tort if a special relationship exists between the plaintiff and the defendant. 24 Cal. 3d 799, 804, 157 Cal.Rptr. 407, 598 P.2d 60 (1979). The exception applies to cases involving contracts for services "where the parties are in contractual privity". N. Am. Chem. Co. v. Superior Court , 59 Cal. App. 4th 764, 783, 69 Cal.Rptr.2d 466 (1997) ; In re Yahoo! Inc. Customer Data Sec. Breach Litig. , 313 F. Supp. 3d 1113, 1132 (N.D. Cal. 2018). The J'Aire exception is available if plaintiffs adequately plead a special relationship. In re Yahoo! , 313 F. Supp. 3d at 1132.
There is no dispute that the contract between AT&T and Mr. Terpin is one for services, not goods. However, AT&T argues that the J'Aire exception does not apply because Mr. Terpin has a contractual relationship with AT&T and is not a third party to the contract. Courts have rejected this argument. See N. Am. Chem. , 59 Cal. App. 4th at 783, 69 Cal.Rptr.2d 466 ("Subsequent cases have extended the application of J'Aire to cases where the parties are in contractual privity."); see also In re Yahoo! , 313 F. Supp. 3d at 1131–32 ("Although Defendants argue that the "special relationship" exception never applies when the plaintiff and the defendant are in privity ... this Court has previously rejected that argument."). Further, as the contract here is for services, AT&T's heavy reliance on cases involving goods, as opposed to services, is unpersuasive.
Accordingly, the issue is whether Mr. Terpin has sufficiently pleaded a special relationship between AT&T and himself. Courts examine six factors to determine whether a special relationship exists:
(1) the extent to which the transaction was intended to affect the plaintiff, (2) the foreseeability of harm to the plaintiff, (3) the degree of certainty that the plaintiff suffered injury, (4) the closeness
of the connection between the defendant's conduct and the injury suffered, (5) the moral blame attached to the defendant's conduct and (6) the policy of preventing future harm.
J'Aire , 24 Cal. 3d at 804, 157 Cal.Rptr. 407, 598 P.2d 60.
Although the Court finds that the J'Aire exception is available in this case, Mr. Terpin has not sufficiently alleged that a special relationship exists. Specifically, as to the second and third J'Aire factors, Mr. Terpin has sufficiently alleged that it was foreseeable that Mr. Terpin would suffer injury if AT&T did not protect his personal information, and the parties agree that Mr. Terpin adequately alleged the degree of certain of his injury. (See Opp'n 20; Reply in Supp. of MTD ("MTD Reply") 10, ECF No. 22.) However, as to the remaining J'Aire factors, Mr. Terpin has not adequately pleaded the extent to which the transaction was intended to benefit Mr. Terpin, the closeness of the connection between AT&T's conduct and the injury suffered, the moral blame attached to AT&T's conduct, or the policy of preventing future harm.
Accordingly, the Court GRANTS AT&T's motion to dismiss claims eight through twelve based on the economic loss rule with leave to amend .
Consequently, the Court does not address whether these claims are sufficiently pleaded.
F. Breach of Implied Contract (Claim 14)
AT&T moves to dismiss Mr. Terpin's claim for breach of implied contract on the basis that he failed to sufficiently plead that the parties entered into an agreement on specific terms and conditions. (MTD 20.)
In California, the elements of a claim for breach of an express or implied contract are the same. Gomez v. Lincare, Inc. , 173 Cal. App. 4th 508, 525, 93 Cal.Rptr.3d 388 (2009). To state a claim for breach of an implied contract, a plaintiff must allege facts sufficient to establish: (1) the existence of a contract; (2) performance by the plaintiff or excuse for nonperformance; (3) breach by the defendant; and (4) damages. First Commercial Mortg. Co. v. Reece , 89 Cal. App. 4th 731, 745, 108 Cal.Rptr.2d 23 (2001). In an implied contract, the existence and terms of the contract are manifested by the parties' conduct. Cal. Civ. Code § 1621.
Mr. Terpin alleges a breach of implied contract as an alternative to his breach of contract claim. (Compl. ¶ 225.) He alleges that AT&T breached the implied contracts "by failing to adhere to the terms of the applicable Privacy Policy and COBC [ (code of business conduct) ] ... to maintain the confidentiality and security of the Personal Information of Mr. Terpin." (Compl. ¶ 226.) However, Mr. Terpin fails to allege the parties' conduct that form the basis of the implied contract. He offers only a conclusory statement that "the opening of an AT&T wireless account by Mr. Terpin created implied contracts between AT&T and Mr. Terpin." (Compl. ¶ 225.) This is not sufficient to state claim for breach of implied contract.
Accordingly, Mr. Terpin's claim for breach of implied contract is DISMISSED with leave to amend .
G. Breach of Implied Covenant of Good Faith and Fair Dealing (Claim 15)
AT&T moves to dismiss Mr. Terpin's claim for breach of the implied covenant of good faith and fair dealing for failing to sufficiently plead the claim. (MTD 21.)
To state a claim for breach of an implied covenant of good faith and fair dealing, the specific contractual obligation from which the implied covenant arose must be alleged. Inter-Mark USA, Inc. v. Intuit, Inc. , 2008 WL 552482, at *6 (N.D. Cal. Feb. 27, 2008). "A breach of the implied covenant of good faith and fair dealing involves something beyond breach of the contractual duty itself." Careau & Co. v. Sec. Pac. Bus. Credit, Inc. , 222 Cal. App. 3d 1371, 1394, 272 Cal.Rptr. 387 (1990) (internal quotation marks omitted). The allegations must show "that the conduct of the defendant ... demonstrates a failure or refusal to discharge contractual responsibilities ... by a conscious and deliberate act." Id. at 1395, 272 Cal.Rptr. 387. The covenant is implied by law in every contract and supplements the express contractual obligations "to prevent a contracting party from engaging in conduct which ... frustrates the other party's rights to the benefits of the contract." Thrifty Payless, Inc. v. Americana at Brand, LLC , 218 Cal. App. 4th 1230, 1244, 160 Cal.Rptr.3d 718 (2013) (internal quotation marks omitted).
AT&T specifically argues that Mr. Terpin has not alleged facts beyond AT&T's breach of the express contract. (MTD 21–22; MTD Reply 11.) As such, AT&T contends that Mr. Terpin has not alleged a separate claim for breach of the implied covenant of good faith and fair dealing. Mr. Terpin states that the "argument raises factual issues that cannot be determined on a motion to dismiss." (Opp'n 21.) Mr. Terpin misses the point. At this point, the Court is concerned only with the allegations in the Complaint, and the Complaint fails to sufficiently allege a claim for breach of the implied covenant of good faith and fair dealing. Mr. Terpin does not allege how AT&T failed or refused to discharge their contractual responsibilities through a conscious or deliberate act to frustrate their contractual agreement. The covenant of good faith and fair dealing "cannot impose substantive duties or limits on the contracting parties beyond those incorporated in the specific terms of their agreement." Guz v. Bechtel Nat'l Inc. , 24 Cal. 4th 317, 349–50, 100 Cal.Rptr.2d 352, 8 P.3d 1089 (2000). At most, Mr. Terpin alleges that AT&T failed to comply with its privacy policy and code of business conduct, but not that AT&T failed to act in good faith in doing so.
Accordingly, Mr. Terpin's claim for breach of implied covenant of good faith and fair dealing is DISMISSED with leave to amend .
As the Court finds that the claims on which Mr. Terpin seeks punitive damages have not been sufficiently pleaded, Mr. Terpin's request for punitive damages is also DISMISSED with leave to amend .
IV. MOTION TO STRIKE
AT&T moves to strike portions of Mr. Terpin's Complaint that reference the Consent Decree as irrelevant, impertinent, and immaterial. (MTS 1, 5.)
Federal Rule of Civil Procedure 12(f) provides that "[t]he court may strike from a pleading an insufficient defense or any redundant, immaterial, impertinent, or scandalous matter." Fed. R. Civ. P. 12(f). The decision on whether to grant a motion to strike is made at the Court's discretion. See Fantasy, Inc. v. Fogerty , 984 F.2d 1524, 1528 (9th Cir. 1993), rev'd on other grounds in Fogerty v. Fantastic, Inc. , 510 U.S. 517, 114 S.Ct. 1023, 127 L.Ed.2d 455 (1994) ). In using its discretion, the court must view the pleadings in the light most favorable to the non-moving party. In re 2TheMart.com Sec. Litig. , 114 F. Supp. 2d 955, 965 (C.D. Cal. 2000).
Courts may grant a motion to strike "to avoid the expenditure of time and money that must arise from litigating spurious issues by dispensing with those issues prior to trial ...." Whittlestone, Inc. v. Handi-Craft Co. , 618 F.3d 970, 973 (9th Cir. 2010) (quoting Fantasy , 984 F.2d at 1527 ). Courts may also grant such a motion in order to streamline the resolution of the action and focus the jury's attention on the real issues in the case. See Fantasy , 984 F.2d at 1528. Yet, motions to strike are generally disfavored due to the limited role that pleadings play in federal practice, and because they are often used as a delay tactic. Cal. Dep't of Toxic Substances Control v. Alco Pac., Inc. , 217 F. Supp. 2d 1028, 1033 (C.D. Cal. 2002).
AT&T argues that the SIM card swap is not covered by the protections of the Consent Decree, and thus references to the Consent Decree are irrelevant and highly prejudicial. (MTS 1, 7.) The question of whether Mr. Terpin's allegations fall within the purview of the Consent Decree is not properly before the Court on a motion to strike. The issue is, in viewing the pleadings in the light most favorable to Mr. Terpin, whether the Consent Decree "could have no possible bearing on the subject matter of the litigation." Color Me Mine Enters., Inc. v. S. States Mktg., Inc. , 2012 WL 12888693, at *1 (C.D. Cal. July 25, 2012). At this stage, the Court is not prepared to find that the Consent Decree has no possible bearing in this litigation. As Mr. Terpin points out, the Consent Decree is relevant to the issue of foreseeability. (Opp'n to MTS 6, ECF No. 18.) Specifically, Mr. Terpin alleges that the FCC investigation discovered that AT&T's "employees had been paid by criminals to hand over customers' information, [AT&T's] employees had used their login credentials to access confidential information, and [AT&T] had not properly supervised its employees' access to its customers' information." (Opp'n to MTS 6 (internal citations omitted).) Thus, the FCC investigation and corresponding Consent Decree could be relevant on the issue of notice, that such actions were previously occurring, and that the acts perpetrated on Mr. Terpin were reasonably foreseeable.
Accordingly, the Motion to Strike is DENIED .
IV. CONCLUSION
For the foregoing reasons, the Court GRANTS IN PART, and DENIES IN PART, AT&T's Motion to Dismiss (ECF No. 14) and DENIES AT&T's Motion to Strike (ECF No. 15). Mr. Terpin may amend his Complaint to address the deficiencies identified above within twenty-one (21) days from the date of this Order.