Arik Lainer v. Citigroup Inc.

NOTICE OF MOTION AND MOTION to Dismiss Case

C.D. Cal.September 8, 2016

DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Admitted Pro Hac Vice) lnale@mayerbrown.com DEBRA BOGO-ERNST (Admitted Pro Hac Vice) dernst@mayerbrown.com MICHAEL H. BORNHORST (Admitted Pro Hac Vice) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Admitted Pro Hac Vice) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. d.b.a CITIBANK, N.A., Defendant. Case No. 2:16-cv-03466-FMO-RAO DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT [Fed. R. Civ. P. 12(b)(1) and 12(b)(6)] Date: January 5, 2017 Time: 10:00 a.m. Judge: Hon. Fernando M. Olguin Court: Room 22 - 5th Floor United States Courthouse 312 North Spring Street Los Angeles, CA 90012-4701 Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 25 Filed 09/08/16 Page 1 of 3 Page ID #:175 1 DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TO PLAINTIFF AND HIS ATTORNEYS OF RECORD: PLEASE TAKE NOTICE that on January 5, 2017 at 10:00 a.m. in Room 22 – 5th Floor, before Judge Fernando M. Olguin, or as soon thereafter as the matter may be heard in the above-entitled Court, located at 312 North Spring Street, Los Angeles, CA 90012-4701, Defendant Citigroup Inc. (“Citigroup”) will, and hereby does, move the Court to dismiss this action pursuant to Fed. R. Civ. P. 12(b)(1) because Plaintiff lacks Article III standing to bring suit. In the alternative, Citigroup moves this Court to dismiss this action pursuant to Fed. R. Civ. P. 12(b)(6) because (1) Plaintiff has not pled any facts to support imposing liability against Citigroup for alleged acts of its indirect subsidiary, Citibank, N.A., and (2) Plaintiff’s Complaint fails to state a claim against Citigroup upon which relief can be granted for each cause of action alleged. The Motion to Dismiss is based upon this Notice of Motion and Motion, the accompanying Memorandum of Points and Authorities and Request for Judicial Notice, the operative pleadings, all matters upon which this Court has taken and/or may take judicial notice, and upon such evidence and argument, both written and oral, as may be introduced at, or prior to, the hearing on this Motion. Pursuant to L.R. 7-3 and Section IV(A)(2) of the Court’s Initial Standing Order, counsel for Citigroup sent two e-mails to Plaintiff’s counsel, on September 1 and September 6, 2016 respectively, asking Plaintiff’s counsel to provide times for the parties to hold a Local Rule 7-3 conference prior to September 8, 2016 via a communications method that allows for realtime communication. On September 7, 2016, counsel for Citigroup left a voicemail message for Plaintiff’s counsel, Meghan George, requesting a call back so the parties could hold a Local Rule 7-3 conference. Plaintiff’s counsel did not respond to any of these requests. However, counsel for Citigroup apprised Plaintiff’s counsel of the basis for this Motion by e- mail on September 1, 2016. Plaintiff’s counsel has not responded to that e-mail. Case 2:16-cv-03466-FMO-RAO Document 25 Filed 09/08/16 Page 2 of 3 Page ID #:176 2 DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Opposition, if any, to the granting of the Motion to Dismiss shall be in writing and shall be filed and served not less than twenty-one (21) days preceding the noticed (or continued) hearing date. A responding party who has no opposition to the granting of the motion shall serve and file a statement to that effect, specifically designating the motion in question. No party will be entitled to be heard in opposition to a motion at oral argument if opposition to the motion has not been timely filed by that party. See L.R. 7-12. The written opposition must be served on Bronwyn F. Pollock, Mayer Brown, LLP, 350 South Grand Avenue, 25th Floor, Los Angeles, CA 90071-1503. Dated: September 8, 2016 Mayer Brown LLP By: /s/ Andrew Z. Edelstein Andrew Z. Edelstein Attorney for Defendant Citigroup Inc. Case 2:16-cv-03466-FMO-RAO Document 25 Filed 09/08/16 Page 3 of 3 Page ID #:177 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Admitted Pro Hac Vice) lnale@mayerbrown.com DEBRA BOGO-ERNST (Admitted Pro Hac Vice) dernst@mayerbrown.com MICHAEL H. BORNHORST (Admitted Pro Hac Vice) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Admitted Pro Hac Vice) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. d.b.a CITIBANK, N.A., Defendant. Case No. 2:16-cv-03466-FMO-RAO DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT [Fed. R. Civ. P. 12(b)(1) and 12(b)(6)] Date: January 5, 2017 Time: 10:00 a.m. Judge: Hon. Fernando M. Olguin Court: Room 22 - 5th Floor United States Courthouse 312 North Spring Street Los Angeles, CA 90012-4701 Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 1 of 28 Page ID #:178 TABLE OF CONTENTS Page i DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 INTRODUCTION ....................................................................................................1 PLAINTIFF’S ALLEGATIONS ..............................................................................3 ARGUMENT ............................................................................................................4 I. MOTION TO DISMISS UNDER RULE 12(b)(1) FOR LACK OF SUBJECT MATTER JURISDICTION..........................................................4 A. LEGAL STANDARD ..........................................................................4 B. PLAINTIFF LACKS STANDING TO BRING THIS CASE .............5 1. Lost benefit of bargain ...............................................................7 2. Increased risk of future losses....................................................8 3. Mitigation costs........................................................................11 4. Delayed or inadequate notification ..........................................13 5. Alleged statutory violations .....................................................13 II. MOTION TO DISMISS UNDER RULE 12(b)(6) FOR FAILURE TO STATE A CLAIM ........................................................................................14 A. LEGAL STANDARD ........................................................................14 B. CITIGROUP CANNOT BE HELD LIABLE FOR ALLEGED ACTS OF AN INDIRECT SUBSIDIARY........................................15 C. PLAINTIFF FAILS TO STATE A VIABLE CLAIM FOR RELIEF...............................................................................................17 1. The California “Data Breach Act”...........................................17 2. The Unfair Competition Law...................................................20 D. THE DEFECTS IN PLAINTIFF’S CLAIMS CANNOT BE CURED BY AMENDMENT.............................................................21 CONCLUSION.......................................................................................................21 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 2 of 28 Page ID #:179 ii DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Page(s) Cases A–Z Int’l v. Phillips, 323 F.3d 1141 (9th Cir. 2003) ..............................................................................4 Allen v. United Fin. Mortg. Corp., 660 F. Supp. 2d 1089 (N.D. Cal. 2009)..............................................................16 Ashcroft v. Iqbal, 556 U.S. 662 (2009)................................................................................14, 15, 19 Assoc. Gen. Contractors of Cal. v. Cal. State Council of Carpenters, 459 U.S. 519 (1983)............................................................................................15 Attias v. CareFirst, Inc., No. 15-cv-882, 2016 WL 4250232 (D.D.C. Aug. 10, 2016)..........................8, 10 In re Barnes & Noble Pin Pad Litig., No. 12-8617, 2013 WL 4759588 (N.D. Ill. Sept. 3, 2013).................................13 Bell Atlantic v. Twombly, 550 U.S. 544 (2007)......................................................................................14, 15 Berryman v. Merit Property Mgmt., Inc., 152 Cal. App. 4th 1544 (Cal. App. 4th Dist. 2007)............................................20 Burton v. MAPCO Exp., 47 F. Supp. 3d 1279 (N.D. Ala. 2014)................................................................10 Cattie v. Wal-Mart Stores, Inc., 504 F. Supp. 2d 939 (S.D. Cal. 2007)...........................................................16, 17 Chambliss v. Carefirst, Inc., No. RDB-15-2288, 2016 WL 3055299 (D. Md. May 27, 2016).................passim United States ex rel. Chunie v. Ringrose, 788 F.2d 638 (9th Cir. 1986) ..............................................................................14 In re Circuit Breaker Litig., 175 F.R.D. 547 (C.D. Cal. Apr. 1, 1997)............................................................21 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 3 of 28 Page ID #:180 iii DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Clapper v. Amnesty Int’l USA, 133 S. Ct., 1150 (2013)................................................................................passim Current Inc. v. State Board of Equalization, 24 Cal. App. 4th 382 (Cal. Ct. App. 1994).........................................................16 Duqum v. Scottrade, No. 15-cv-1537, 2016 WL 3683001 (E.D. Mo. July 12, 2016) .........................10 Fernandez v. Leidos, Inc., 127 F. Supp. 3d 1078 (E.D. Cal. 2015) ................................................................8 Friends of the Earth, Inc. v. Laidlaw Envir. Servs. (TOC), Inc., 528 U.S. 167 (2000)..............................................................................................5 FW/PBS, Inc. v. Dallas, 493 U.S. 215 (1990)..............................................................................................5 Galaria v. Nationwide Mut. Ins., 998 F. Supp. 2d 646 (S.D. Ohio 2014) ...............................................................10 Green v. eBay, Inc., No. 14-1688, 2015 WL 2066531 (E.D. La. May 4, 2015) .................................10 Gutierrez v. Bank of Am, N.A., 2014 WL 1379883 (E.D. Cal. Apr. 8, 2014) ......................................................14 Guttierez v. Wells Fargo Bank, NA, 704 F.3d 712 (9th Cir. 2012) ..............................................................................20 Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122 (9th Cir. 2003) ............................................................................16 Hollingsworth v. Perry, 133 S. Ct. 2652 (2013)........................................................................................13 In re Horizon Healthcare Servs., Inc. Data Breach Litig., No. 13-7418, 2015 WL 1472483 (D.N.J. Mar. 31, 2015) ..................................10 Kearns v. Ford Mot. Co., 567 F.3d 1120 (9th Cir. 2009) ............................................................................20 Khan v. Children’s Nat’l Health Sys., No. TDC-15-2125, 2016 WL 2946165 (D. Md. May 19, 2016)........................13 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 4 of 28 Page ID #:181 iv DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375 (1994)..............................................................................................4 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) ........................................................................9, 10 Laird v. Capital Cities/ABC, Inc., 68 Cal. App. 4th 727 (Cal. Ct. App. 1998).........................................................16 Lee v. Am. Nat’l Ins. Co., 260 F.3d 997 (9th Cir. 2001) ........................................................................13, 14 Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012)..............................................................21 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992)......................................................................................5, 6, 7 Marder v. Lopez, 450 F.3d 445 (9th Cir. 2006) ............................................................................1, 2 McDonald v. Coldwell Banker, 543 F.3d 498 (9th Cir. 2008) ........................................................................20, 21 Mir v. Fosburg, 646 F.2d 342 (9th Cir. 1980) ..............................................................................21 O’Shea v. Littleton, 414 U.S. 488 (1974)..............................................................................................5 Pantoja v. Countrywide Home Loans, Inc., 640 F. Supp. 2d 1177 (N.D. Cal. 2009)........................................................16, 17 Patton v. Experian Data Corp., No. SACV 15-1871, 2016 WL 2626801 (C.D. Cal. May 6, 2016)....................10 Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d 847 (S.D. Tex. 2015)..................................................................10 Raines v. Byrd, 521 U.S. 811 (1997)..............................................................................................6 Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011) .............................................................................9, 11 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 5 of 28 Page ID #:182 v DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 In re Science App. Int’l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14 (D.D.C. 2014)..................................................................10, 12 Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26 (1976)................................................................................................5 Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016).................................................................................passim Spokeo Inc. v. Robins, 742 F.3d 409 (9th Cir. 2014) ................................................................................6 Storm v. Paytime, Inc., 90 F. Supp. 3d 359 (M.D. Pa. 2015)...................................................................10 Strautins v. Trustwave Holdings, 27 F. Supp. 3d 871 (N.D. Ill. 2014)....................................................................10 Summers v. Earth Island Institute, 555 U.S. 488 (2009)..............................................................................................6 In re SuperValu, Inc., No. 14-MD-2586, 2016 WL 81792 (D. Minn. Jan. 7, 2016) ......................passim United States v. Bestfoods, 524 U.S. 51 (1998)..............................................................................................16 Valley Forge Christian College v. Americans United for Separation of Church and State, 454 U.S. 464 (1982)..............................................................................................5 Velaquez v. GMAC Mortg. Corp., 605 F. Supp. 2d 1049 (C.D. Cal. 2008) ................................................................1 Warth v. Seldin, 422 U.S. 490 (1975)..............................................................................................6 Whalen v. Michael Stores, Inc., No. 14-7006, 2015 WL 9462108 (E.D.N.Y. Dec. 28, 2015) .............................10 Wolfe v. Strankman, 392 F.3d 358 (9th Cir. 2004) ................................................................................5 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 6 of 28 Page ID #:183 vi DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 In re Zappos.com, Inc., 108 F. Supp. 3d 949 (D. Nev. 2015)............................................................passim In re Zappos.com, Inc., 2016 WL 4521681 (D. Nev. Aug. 29, 2016)........................................................8 Statutes 12 U.S.C. § 1843......................................................................................................18 Cal. Bus. & Prof. Code § 17200 ..............................................................................20 Cal. Civ. Code §§ 1798.80.......................................................................................17 Cal. Civ. Code § 1798.81.5...............................................................................passim Cal. Civ. Code § 1798.82..................................................................................passim Cal. Civ. Code § 1798.84...................................................................................18, 20 Cal. Fin. Code § 4052 ..............................................................................................18 Constitutional Authorities U.S. Const. art. III, § 2 ...............................................................................................5 Federal Rules Fed. R. Civ. P. 12 ..............................................................................................passim Fed. R. Civ. P. 9 .......................................................................................................20 Fed. R. Evid. 201 .......................................................................................................1 Other Authorities Black’s Law Dictionary 479 (9th ed. 2009) ..............................................................6 Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 7 of 28 Page ID #:184 1 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 INTRODUCTION Plaintiff’s initial Complaint (“Cmplt.”) [Dkt. # 1] was fatally deficient and failed to state a claim against Defendant Citigroup Inc. (“Citigroup”).1 Accordingly, Citigroup filed a Motion to Dismiss [Dkt. # 12] and Memorandum of Points and Authorities (“Memo”) [Dkt. # 12-1] showing that the Complaint should be dismissed under Fed. R. Civ. P. (“Rule”) 12(b)(1) for lack of subject matter jurisdiction or under Rule 12(b)(6) for failure to state a claim. Rather than responding to these arguments, Plaintiff instead chose to file his FAC, which deletes four of the six counts alleged in the Complaint. However, the FAC fails to cure any of the deficiencies in the Complaint concerning the two remaining counts. The FAC also makes clear that Plaintiff’s remaining claims against Citigroup fail for several additional reasons. 1 As explained below, Citigroup is not properly named as a Defendant. Plaintiff’s mortgage loan was not funded by Citigroup, but by Citibank, N.A. (“Citibank”). Contrary to the suggestion in the caption of Plaintiff’s First Amended Complaint (“FAC”) [Dkt. # 17], Citibank is not a “doing business as” name of Citigroup. Rather, Citigroup and Citibank are separate legal entities. The publicly recorded Deed of Trust securing Plaintiff’s loan from Citibank is attached hereto as Exhibit A. As explained in the accompanying Request for Judicial Notice, the Court can consider the Deed of Trust without converting this Motion to Dismiss to a Motion for Summary Judgment because the contents of the Deed of Trust are “central to” Plaintiff’s claims and the document’s authenticity is undisputed. See, e.g., Marder v. Lopez, 450 F.3d 445, 448 (9th Cir. 2006). In addition, the Court may consider the Deed of Trust because it is a matter of public record. As shown on the first page, the Deed of Trust was recorded and filed in the official records of the Los Angeles County Recorder’s Office. See Exhibit A at 1; see also Velaquez v. GMAC Mortg. Corp., 605 F. Supp. 2d 1049, 1057-58 (C.D. Cal. 2008) (taking notice of documents—including deed of trust—that were “recorded with the Los Angeles Recorder’s Office” because “a district court may take judicial notice of ‘matters of public record,’ see Fed. R. Evid. 201(b), without converting a motion to dismiss into a motion for summary judgment.”). Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 8 of 28 Page ID #:185 2 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 As in the Complaint, the FAC alleges that Plaintiff provided certain personal information to Citigroup in October 2015 in connection with his application to refinance his mortgage. FAC ¶¶ 15-16. At some point after the loan was “funded” in January 2016, Plaintiff allegedly received a letter stating that his “personal information was provided” to another “Citibank mortgage loan applicant in error.” Id. ¶¶ 17-18. Plaintiff alleges that the letter offered a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 30. Plaintiff did not attach the letter to his Complaint or his FAC. For the Court’s reference, Citigroup is attaching a copy of the letter to this Motion to Dismiss as Exhibit B. Because this letter is referenced in Plaintiff’s Complaint and FAC and is “central to” his claims, the Court can consider this letter without converting this Motion to Dismiss into a Motion for Summary Judgment. See, e.g., Marder, 450 F.3d at 448. As Plaintiff concedes in his FAC, the letter references Citibank, not Citigroup. See, e.g., Exhibit B, at 1 (“At that time, your personal information was provided to another Citibank mortgage loan applicant in error.”); (“At our expense, Citibank, N.A. would like to offer you a free one year subscription to Identity Guard®, a credit monitoring and identity theft protection service.”); 3 (“If you have any further questions regarding this incident, please call Citibank, N.A. …”). Like the Complaint, the FAC does not contain any allegation that Plaintiff suffered actual harm as a result of his information allegedly being provided to another loan applicant. Plaintiff does not allege that the other loan applicant has misused his information or even that the other applicant was aware of receiving the information. Instead of alleging any actual harm, the FAC includes several new paragraphs that purport to allege that Plaintiff was harmed because he allegedly “would never have secured the refinance” from Citigroup if he “had known that his personal information was compromised.” Id. ¶¶ 23-28. In other words, Plaintiff alleges that he lost the benefit of his alleged bargain with Citigroup in refinancing Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 9 of 28 Page ID #:186 3 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 his loan and that he may be subject to hypothetical and alleged future injuries. See id. ¶¶ 61-62. The United States Supreme Court has made clear that those types of alleged injuries are not actual or imminent. Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147 (2013). Because Plaintiff cannot allege an actual injury in fact, he lacks Article III standing to bring suit. See Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016), as revised May 24, 2016. Thus, as with the Complaint, the Court should dismiss the FAC under Rule 12(b)(1). In the alternative, the FAC should be dismissed under Rule 12(b)(6) for two reasons. First, Plaintiff has not pled any facts to support imposing liability against Citigroup for alleged acts of Citibank. Second, both remaining claims fail as a matter of law and cannot be salvaged through re-pleading. Accordingly, the Court should dismiss this case with prejudice. PLAINTIFF’S ALLEGATIONS2 Plaintiff alleges that he contacted Citigroup around October 2015 “about refinancing a home purchase with a residential mortgage.” FAC ¶ 15. Plaintiff alleges that Citigroup provided him with “information concerning the policies and procedures” relating to the protection of his personal information. Id. In addition, Plaintiff allegedly provided Citigroup with certain personal information, including “his name, address, date of birth, and social security number.” Id. ¶ 16. Plaintiff alleges his mortgage was “completed” on January 12, 2016. Id. ¶ 17. According to Plaintiff, at some unspecified time after his mortgage was completed, he received a letter titled “NOTICE OF DATA BREACH.” Id. ¶ 18. 2 Citigroup must accept the allegations in the FAC for purposes of this motion to dismiss, but reserves the right to challenge all allegations and denies Plaintiff’s claims. The FAC also purports to bring suit on behalf of a putative class. FAC ¶¶ 36-47. Citigroup denies that the claims against it are suitable for class certification and is also contemporaneously filing a motion to strike the class allegations against it from the FAC. Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 10 of 28 Page ID #:187 4 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Plaintiff did not attach the letter to the Complaint or the FAC, but according to Plaintiff, the letter stated that his “personal information” had been “provided to another Citibank mortgage loan applicant in error” at some point between “Mid- September 2015 to October 15, 2015.” Id. ¶ 18. The letter allegedly informed Plaintiff that the “only personal information that could potentially be exposed to unauthorized access as a result of this incident was your social security number.” Id. ¶ 19. Plaintiff alleges that the letter further stated that Citigroup had “investigated the matter and adopted measures to prevent it from happening again.” Id. ¶ 20. Plaintiff also states that the letter offered him a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 30. ARGUMENT This case should be dismissed on at least two grounds. First, the case should be dismissed under Rule 12(b)(1) because Plaintiff cannot allege an actual injury in fact and therefore lacks standing to bring this case. In the alternative, the case should be dismissed with prejudice under Rule 12(b)(6) because Plaintiff has not pled any facts to support imposing liability against Citigroup for alleged acts of Citibank and because Plaintiff cannot state a claim for relief against Citigroup or Citibank. I. MOTION TO DISMISS UNDER RULE 12(b)(1) FOR LACK OF SUBJECT MATTER JURISDICTION A. LEGAL STANDARD Rule 12(b)(1) allows for a motion to dismiss based on lack of subject matter jurisdiction. “A federal court is presumed to lack jurisdiction in a particular case unless the contrary affirmatively appears.” A–Z Int’l v. Phillips, 323 F.3d 1141, 1145 (9th Cir. 2003). The plaintiff has the burden of establishing jurisdiction. See Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). A Rule 12(b)(1) motion may be either facial, where the inquiry is confined to the allegations in the complaint, or factual, where the court is permitted to look Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 11 of 28 Page ID #:188 5 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 beyond the complaint to extrinsic evidence. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). In this case, Citigroup raises a facial challenge to Plaintiff’s claims, so the question for the court is whether the lack of federal jurisdiction appears from the face of the pleading itself. See id. B. PLAINTIFF LACKS STANDING TO BRING THIS CASE. Under Article III of the U.S. Constitution, the “judicial Power of the United States” extends only to “Cases” and “Controversies.” Art. III, § 2. “Standing to sue is a doctrine rooted in the traditional understanding of a case or controversy.” Spokeo, 136 S. Ct. at 1547. “The doctrine limits the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong.” Id. (citing Valley Forge Christian College v. Americans United for Separation of Church and State, 454 U.S. 464, 473 (1982)).3 The Supreme Court has established that the “irreducible constitutional minimum” of standing consists of three elements. Id. (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. (citing Lujan, 504 U.S. at 560-61); Friends of the Earth, Inc. v. Laidlaw Envir. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000)). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id. (citing FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990)). “Where, as here, a case is at 3 In a putative class action lawsuit, “named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 40 n.20 (1976). “[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.” O’Shea v. Littleton, 414 U.S. 488, 494 (1974) (internal quotations omitted). Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 12 of 28 Page ID #:189 6 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the pleading stage, the plaintiff must ‘clearly … allege facts demonstrating’ each element.” Id. (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). Injury in fact is the “[f]irst and foremost” of the three elements of standing and is “a constitutional requirement” that Congress “cannot erase.” Id. at 1547-48 (quoting Raines v. Byrd, 521 U.S. 811, 820, n.3 (1997)). Under established Supreme Court precedent, a plaintiff attempting to establish an injury in fact “must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 1548 (quoting Lujan, 504 U.S. at 560). For an injury to be “concrete,” it must be “‘de facto’; that is, it must actually exist.” Id. at 1548 (citing Black’s Law Dictionary 479 (9th ed. 2009)). “For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’” Id. Particularization and concreteness are independent requirements, and a plaintiff must establish both elements to prove standing. Id. In the recent Spokeo decision, the Supreme Court considered an appeal from a decision of the Ninth Circuit, which found that “the violation of a statutory right is usually a sufficient injury in fact to confer standing.” Id. at 1546 (quoting 742 F.3d 409, 413 (9th Cir. 2014)). The Court rejected that contention, holding that a plaintiff does not “automatically” satisfy “the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. at 1549. Instead, “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. The required showing of concrete harm may be based on either a “tangible” or “intangible” injury. Id. But an allegation of “a bare procedural violation, divorced from any concrete harm” is not sufficient to “satisfy the injury-in-fact requirement.” Id. (citing Summers v. Earth Island Institute, 555 U.S. 488, 496 (2009)). In addition to concreteness and particularity, an injury must be “actual or imminent.” Id. at 1548. Imminence requires “that the injury proceed with a high Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 13 of 28 Page ID #:190 7 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 degree of immediacy, so as to reduce the possibility of deciding a case in which no injury would have occurred at all.” Lujan, 504 U.S. at 564 n.2. Additionally, where a threatened injury hinges on speculation about the actions of third parties, standing is less likely to exist. See Clapper, 133 S.Ct. at 1150 (expressing “reluctance to endorse standing theories that rest on speculation about the decisions of independent actors”); id. at 1150 n.5 (“Plaintiffs cannot rely on speculation about the unfettered choices made by independent actors not before the court.”). Although the FAC is not entirely clear on this point, Plaintiff appears to allege or attempt to allege a number of potential forms of injury, each of which is discussed in turn below. As shown below, none of these allegations satisfies the requirements for an injury in fact and Plaintiff thus lacks standing. 1. Lost benefit of bargain. As an initial matter, it is important to observe that Plaintiff does not allege a prototypical data breach case here. In most of the published cases involving data breaches, the plaintiffs’ information was accessed by a hacker who specifically set out to obtain private information for purposes of stealing the plaintiffs’ identity or otherwise misusing their private information. See, e.g., In re SuperValu, Inc., No. 14-MD-2586, 2016 WL 81792, at *4 (D. Minn. Jan. 7, 2016) (collecting cases). By contrast, in this case, Plaintiff alleges only that certain of his personal information was accidentally sent to another “mortgage loan applicant in error.” FAC ¶ 18. Plaintiff does not allege that the other loan applicant has misused his information or will misuse his information or even that the other applicant was aware of receiving the information. The new allegations that Plaintiff has added to the FAC (¶¶ 23-28) suggest that Plaintiff is now relying principally on an argument that he lost the benefit of his alleged bargain with Citigroup. Those paragraphs assert that Plaintiff “would never have secured the refinance” from Citigroup if he “had known that his personal information was compromised.” Id. ¶¶ 26-27. Plaintiff asserts that he Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 14 of 28 Page ID #:191 8 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 “suffered harm in the amount he paid … for his refinance of the mortgage in January 2016.” Id. ¶ 28. However, as the SuperValu court explained, “[t]his theory is consistently rejected in data breach cases where plaintiffs have not alleged that the value of the goods or services they purchased was diminished as a result of the data breach.” 2016 WL 81792, at *8. For example, in In re Zappos.com, Inc., the court rejected the benefit-of-the- bargain theory because the plaintiffs failed to explain how the data breach affected the value of the goods purchased. 108 F. Supp. 3d 949, 962, n.5 (D. Nev. 2015), motion to reconsider denied in relevant part, 2016 WL 4521681, at *2-3 (D. Nev. Aug. 29, 2016). The court found the plaintiffs had not alleged any facts “showing how the price they paid for such goods incorporated some particular sum that was understood by both parties to be allocated towards the protection of customer data.” Id.; see also Attias v. CareFirst, Inc., No. 15-cv-882, 2016 WL 4250232, at *5 (D.D.C. Aug. 10, 2016) (rejecting argument that “some indeterminate part of [plaintiff’s] insurance premiums went towards paying for security measures” as “too flimsy to support standing”); Chambliss v. Carefirst, Inc., No. RDB-15-2288, 2016 WL 3055299, at *5-6 (D. Md. May 27, 2016); Fernandez v. Leidos, Inc., 127 F. Supp. 3d 1078, 1089 (E.D. Cal. 2015) (finding no standing where plaintiff failed to allege facts from which a plausible inference could be drawn that value of plaintiff’s health care and insurance coverage had been diminished by data breach). As in these cases, Plaintiff does not allege any facts to suggest that the value of his refinancing was diminished when his information allegedly was shared with another loan applicant. Thus, Plaintiff has “not alleged any benefit-of-the-bargain loss that could constitute a cognizable injury in fact.” Chambliss, 2016 WL 3055299, at *6. 2. Increased risk of future losses. Plaintiff also appears to allege (although without any particularity) that he was injured because he allegedly is at an increased risk of future injury. See, e.g., Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 15 of 28 Page ID #:192 9 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 FAC ¶¶ 30 (arguing that “credit monitoring and identity theft protection service” offered to him allegedly “is insufficient to protect” him from future injuries); 44 (arguing that Plaintiff “will continue to face the potential for irreparable harm”). The Supreme Court addressed potential future losses in data breach cases in Clapper. In that case, the plaintiffs, a group of lawyers, challenged the constitutionality of a section of the Foreign Intelligence Surveillance Act (“FISA”) that authorizes surveillance of individuals who are believed to be located outside of the United States. 133 S. Ct. at 1142. The plaintiffs alleged that their work required them to engage in sensitive international communications with individuals that they suspected were targets of surveillance under FISA. Id. The Court held that the alleged harm was entirely speculative and did not support standing since the future injury was not “certainly impending.” Id. at 1148. The Court found that the plaintiffs’ arguments rested on a “highly attenuated chain of possibilities” and was unwilling “to abandon [its] usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors.” Id. at 1148, 1150. Likewise, the Ninth Circuit’s pre-Clapper decision in Krottner v. Starbucks Corp. stressed that a plaintiff alleging a future injury based on a data breach must show that injury presents “a credible threat of harm” and that the harm is “both real and immediate.” 628 F.3d 1139, 1143 (9th Cir. 2010). The court emphasized that standing cannot be based on conjecture but must be actual and imminent. Id. Thus, “the vast majority of courts have held that the risk of future identity theft or fraud is too speculative to constitute an injury in fact for purposes of Article III standing.” SuperValu, 2016 WL 81792, at *4 (collecting cases); see also Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir. 2011); (“Most courts have held that such plaintiffs lack standing because the harm is too speculative. We agree with the holdings in those cases.”) (internal citations omitted); Zappos.com, 108 F. Supp. 3d at 955 (“The majority of courts dealing with data-breach cases post-Clapper have held that absent allegations of actual identity theft or other Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 16 of 28 Page ID #:193 10 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 fraud, the increased risk of such harm alone is insufficient to satisfy Article III standing.”).4 For example, in Zappos.com, a hacker accessed personal identifying information from the defendant’s server. 108 F. Supp. 3d at 951. Applying Clapper and Krottner, the court rejected the plaintiffs’ theory “that they suffer an increased threat of future identity theft and fraud as a result of Zappos’s security breach.” Id. at 954. The court explained “[t]he possibility that the alleged harm could transpire in the as-of-yet undetermined future relegates Plaintiffs’ injuries to the realm of speculation.” Id. at 959. The court therefore found that the plaintiffs had failed to allege an actual injury in fact and dismissed the case. Id. at 962. Likewise, in Patton v. Experian Data Corp., another court in this District dismissed similar claims because the allegedly injury was merely a “speculative fear of identity theft” that was not “credible” or a “real and immediate” threat of harm. No. SACV 15-1871, 2016 WL 2626801, at *4 (C.D. Cal. May 6, 2016). As courts have explained, the “speculative nature of the threatened injury stems from numerous variables upon which the future harm depends, including 4 See also Attias, 2016 WL 4250232, at *3-4 (rejecting risk of future harm as ground for injury in fact); Duqum v. Scottrade, No. 15-cv-1537, 2016 WL 3683001, at *3 (E.D. Mo. July 12, 2016) (same); Chambliss, 2016 WL 3055299, at *4-5 (same); In re Horizon Healthcare Servs., Inc. Data Breach Litig., No. 13- 7418, 2015 WL 1472483, at *6 (D.N.J. Mar. 31, 2015) (same); Whalen v. Michael Stores, Inc., No. 14-7006, 2015 WL 9462108, at *4-*5 (E.D.N.Y. Dec. 28, 2015) (same); Green v. eBay, Inc., No. 14-1688, 2015 WL 2066531, at *3 n.33 (E.D. La. May 4, 2015) (same); Storm v. Paytime, Inc., 90 F. Supp. 3d 359, 364-68 (M.D. Pa. 2015) (same); Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d 847, 853-54 (S.D. Tex. 2015) (same); Galaria v. Nationwide Mut. Ins., 998 F. Supp. 2d 646, 654-56 (S.D. Ohio 2014) (same); Strautins v. Trustwave Holdings, 27 F. Supp. 3d 871, 876-77 (N.D. Ill. 2014) (same); Burton v. MAPCO Exp., 47 F. Supp. 3d 1279, 1280-81 (N.D. Ala. 2014) (same); In re Science App. Int'l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 28 (D.D.C. 2014) (“since Clapper... courts have been even more emphatic in rejecting ‘increased risk’ as a theory of standing in data-breach cases.”). Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 17 of 28 Page ID #:194 11 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 whether the hacker: (1) read, copied, and understood [Plaintiffs’] personal information; (2) intends to commit future criminal acts by misusing the information; and (3) is able to use such information to the detriment of [Plaintiffs] by making unauthorized transactions in [Plaintiffs’] names.” SuperValu, 2016 WL 81792, at *5 (quoting Reilly, 664 F.3d at 42); Zappos.com, 108 F. Supp. 3d at 959 (future harm depends on capabilities and decisions of person in possession of data). Here, there is no credible allegation that Plaintiff’s information has been misused or will be misused, so “the Court is left to speculate” about the possibility of any future harm. SuperValu, 2016 WL 81792, at *5. And unlike the traditional data breach case, the person who allegedly accessed Plaintiff’s personal information is not alleged to be a hacker who broke into a secured system in an attempt to steal private data for purposes of misuse. Rather, Plaintiff alleges that the information was accidentally sent to another “loan applicant.” FAC ¶ 18. He does not provide any reason to think the loan applicant intends to misuse the information or is capable of misusing the information. SuperValu, 2016 WL 81792, at *5; see also Clapper, 133 S.Ct. at 1150 n.5 (“Plaintiffs cannot rely on speculation about the unfettered choices made by independent actors not before the court.”). Indeed, Plaintiff does not allege that the other loan applicant read or understood the information. SuperValu, 2016 WL 81792, at *5. Accordingly, as in the cases cited above, Plaintiff has “failed to allege sufficient facts to show that future harm” from the alleged disclosure of his information is “certainly impending” or that there is a “substantial risk that the harm will occur.” Id. at *7 (quoting Clapper, 133 S.Ct. at 1147, 1150 n.5); see also Zappos.com, 108 F. Supp. 3d at 958-59. 3. Mitigation costs. Plaintiff raises the possibility of harm based on mitigation costs, including “expenses for credit monitoring.” FAC ¶ 61. It should be observed, however, that Plaintiff does not allege that he personally has purchased any credit-monitoring Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 18 of 28 Page ID #:195 12 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 services. Indeed, he alleges that Citigroup offered him a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 30. Instead, Plaintiff posits this potential harm as an issue that may arise at some unspecified future time. For this reason alone, Plaintiff’s allegation of mitigation costs is too speculative to support an injury in fact. Plaintiff does not allege that he has actually taken any steps to monitor his credit (which is unnecessary given the alleged offer by Citigroup) or to mitigate any alleged damages. Plaintiff thus has failed to allege any facts to show that such monitoring or mitigation costs are “certainly impending.” Clapper, 133 S.Ct. at 1148. In any event, even if Plaintiff could allege that he would incur such opportunity or mitigation costs, the Supreme Court has clearly held that a plaintiff “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Clapper, 133 S.Ct. at 1151. The opposite conclusion would allow “an enterprising plaintiff ... to secure a lower standard for Article III standing simply by making an expenditure based on a non-paranoid fear.” Id. “In other words, the harm must be ‘certainly impending’ before mitigation expenses may be considered as further proof of a cognizable injury.” Chambliss, 2016 WL 3055299, at *5. Thus, “[i]n the context of data breach litigation, courts have consistently held that a plaintiff may not use mitigation costs alone to establish a cognizable injury in fact.” Id.; see also SuperValu, 2016 WL 81792, at *7 (“courts consistently hold that the cost to mitigate the risk of future harm does not constitute an injury in fact unless the future harm being mitigated against is itself imminent.”); see also Science Applications, 45 F. Supp. 3d at 26; Zappos.com, 108 F. Supp. 3d at 960-61. Here, the risk of future harm that would allegedly be mitigated against “is not imminent.” SuperValu, 2016 WL 81792, at *7. Accordingly, “the cost to mitigate the risk is not a sufficient injury in fact to confer Article III standing.” Id. Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 19 of 28 Page ID #:196 13 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 4. Delayed or inadequate notification. Plaintiff further alleges that he was injured by Citigroup’s allegedly delayed or inadequate notification that his personal information allegedly had been sent to another mortgage loan applicant. FAC ¶¶ 20-25, 58-59. As the court explained in SuperValu, however, such allegations do not create an actual injury in fact without some allegation that the delay or inadequacy caused the plaintiff some harm. 2016 WL 81792, at *7. Any delay or inability to mitigate alleged damages as a result of a delayed or inadequate disclosure is not sufficient to constitute an injury in fact “unless the risk of future harm is imminent.” Id.; see also In re Barnes & Noble Pin Pad Litig., No. 12-8617, 2013 WL 4759588, at *3 (N.D. Ill. Sept. 3, 2013) (“[e]ven assuming the statutes have been violated by the delay or inadequacy of [Defendants’] notification, breach of these statutes is insufficient to establish standing without any actual damages due to the breach.”). 5. Alleged statutory violations. Finally, it is possible that Plaintiff is alleging that the alleged statutory violations pled in the FAC, standing alone, are sufficient to give rise to an injury in fact. See FAC ¶¶ 61, 71. As shown below, Plaintiff’s statutory claims are without merit. In any event, Plaintiff’s theory cannot survive the Supreme Court’s decision in Spokeo, in which the Court held “Article III standing requires a concrete injury even in the context of a statutory violation.” 136 S. Ct. at 1553. Thus, for example, in the recent case of Khan v. Children’s Nat’l Health Sys., the court applied Spokeo and rejected a claim by a plaintiff in a data breach case that “the violations of state statutes and common law alleged in the Complaint establish standing.” No. TDC-15-2125, 2016 WL 2946165, at *7 (D. Md. May 19, 2016). The court found no support for the argument that “a state legislature or court, through a state statute or cause of action, can manufacture Article III standing for a litigant who has not suffered a concrete injury.” Id. (citing Hollingsworth v. Perry, 133 S. Ct. 2652, 2667-68 (2013)); c.f. Lee v. Am. Nat’l Ins. Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 20 of 28 Page ID #:197 14 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Co., 260 F.3d 997, 1001-02 (9th Cir. 2001) (“[A] plaintiff whose cause of action is perfectly viable in state court under state law may nonetheless be foreclosed from litigating the same cause of action in federal court, if he cannot demonstrate the requisite injury.”). Accordingly, none of Plaintiff’s alleged forms of injury are sufficient to give rise to an injury in fact for purposes of Article III standing. Therefore, Plaintiff cannot meet his burden of demonstrating subject matter jurisdiction, and this case should be dismissed under Rule 12(b)(1). II. MOTION TO DISMISS UNDER RULE 12(b)(6) FOR FAILURE TO STATE A CLAIM As shown above, Plaintiff lacks standing and this case is therefore subject to dismissal under Rule 12(b)(1). If the Court grants dismissal on that ground, it need not reach the Rule 12(b)(6) argument. However, in the alternative to Citigroup’s standing argument, Plaintiff also fails to state a viable claim for relief, so his claims are subject to dismissal under Rule 12(b)(6). A. LEGAL STANDARD In order to survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 697 (2009) (quoting Bell Atlantic v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678 (citing Twombly, 550 U.S. at 556). At the motion to dismiss stage, a court “need not assume the truth of legal conclusions cast in the form of factual allegations.” Gutierrez v. Bank of Am, N.A., 2014 WL 1379883, at *3 (E.D. Cal. Apr. 8, 2014) (quoting United States ex rel. Chunie v. Ringrose, 788 F.2d 638, 643 n.2 (9th Cir. 1986)). A pleading is insufficient if it offers mere “labels and conclusions” or “a formulaic recitation of Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 21 of 28 Page ID #:198 15 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the elements of a cause of action.” Twombly, 550 U.S. at 555; see also Iqbal, 556 U.S. at 678 (“Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.”). It is inappropriate to assume that the plaintiff “can prove facts that it has not alleged or that the defendants have violated the ... laws in ways that have not been alleged[.]” Assoc. Gen. Contractors of Cal. v. Cal. State Council of Carpenters, 459 U.S. 519, 526 (1983). Here, Plaintiff’s FAC is subject to dismissal under Rule 12(b)(6) on two grounds. First, Plaintiff has not pled any facts to support imposing liability against Citigroup for alleged acts of Citibank. Second, both remaining claims fail as a matter of law and cannot be salvaged through re-pleading. Accordingly, the Court should dismiss this case with prejudice. B. CITIGROUP CANNOT BE HELD LIABLE FOR ALLEGED ACTS OF AN INDIRECT SUBSIDIARY. As an initial matter, Plaintiff’s claims against Citigroup should be dismissed because Citigroup cannot be held liable for alleged acts by Citibank. Citigroup explained in its initial Motion to Dismiss (at 1, n.1) that it was not properly named as a Defendant in this case because Plaintiff’s loan is with Citibank, not Citigroup. In addition, Citigroup’s counsel reiterated this point during their initial meet-and- confer conference with Plaintiff’s counsel on August 18, 2016. The publicly recorded Deed of Trust attached as Exhibit A hereto—which was executed by Plaintiff and his wife (at 18)— demonstrates that the “Lender” for Plaintiff’s loan is “Citibank, N.A.,” not Citigroup. Exhibit A, at 2. Moreover, in both the Complaint (¶ 18) and the FAC (¶ 18), Plaintiff concedes that the “NOTICE OF DATA BREACH” letter that forms the basis of his claims references disclosure to “another Citibank mortgage loan applicant.” In addition, the letter references Citibank at least two other times. Exhibit B, at 1 (“At our expense, Citibank, N.A. would like to offer you a free one year subscription to Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 22 of 28 Page ID #:199 16 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Identity Guard®, a credit monitoring and identity theft protection service.”); 3 (“If you have any further questions regarding this incident, please call Citibank, N.A. …”). The letter does not reference Citigroup. Plaintiff’s counsel apparently attempted to remedy this deficiency by changing the name of the Defendant from “Citigroup Inc.” in the caption of the Complaint to “Citigroup Inc. d.b.a. Citibank, N.A.” in the FAC, but this attempt is equally infirm. Citibank is not a “doing business as” name of Citigroup. Rather, Citigroup and Citibank are separate legal entities. Citibank is an indirect subsidiary of Citigroup, a parent-level holding company. See, e.g., Exhibit C, Printout of Federal Deposition Insurance Corporation (“FDIC”), FDIC-Insured Subsidiaries of Bank Holding Companies – Details, Citigroup Inc. (available from https://www5.fdic.gov/idasp/advSearchLanding.asp (last visited Sept. 8, 2016) (showing that Citibank is an indirect subsidiary of Citigroup).5 It is well established under California law that a parent corporation and its subsidiary are separate legal entities. See, e.g., Pantoja v. Countrywide Home Loans, Inc., 640 F. Supp. 2d 1177, 1192 (N.D. Cal. 2009) (citing Laird v. Capital Cities/ABC, Inc., 68 Cal. App. 4th 727, 741 (Cal. Ct. App. 1998); Current Inc. v. State Board of Equalization, 24 Cal. App. 4th 382, 391 (Cal. Ct. App. 1994)). Thus, “a parent-subsidiary relationship alone is an insufficient basis on which to hold a person liable for a subsidiary’s actions.” Cattie v. Wal-Mart Stores, Inc., 504 F. Supp. 2d 939, 944 (S.D. Cal. 2007) (citing United States v. Bestfoods, 524 U.S. 51, 61-62 (1998); Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1134 (9th Cir. 2003)). 5 Documents available on the FDIC’s website are public documents of which the Court can take judicial notice on a motion to dismiss. See Allen v. United Fin. Mortg. Corp., 660 F. Supp. 2d 1089, 1093-94 (N.D. Cal. 2009) (taking judicial notice of purchase agreement on FDIC’s website on motion to dismiss). According, the Court can consider this document without converting this Motion to Dismiss into a Motion for Summary Judgment. Id. Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 23 of 28 Page ID #:200 17 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Here, Plaintiff’s loan was with Citibank, not Citigroup. And Plaintiff does not allege any other relationship with either entity. Plaintiff cannot rely on the alleged parent-subsidiary relationship to seek to impose liability on Citigroup for alleged acts by Citibank. See Pantoja, 640 F. Supp. 2d at 1192 (dismissing claims against corporate parent); Cattie, 504 F. Supp. 2d at 946 (same). Nor does Plaintiff plead any factual allegations to support holding Citigroup liable under a theory that Citibank is an “alter ego” of Citigroup or that Citibank is so controlled by Citigroup as to be a mere instrumentality. See Pantoja, 640 F. Supp. 2d at 1192. C. PLAINTIFF FAILS TO STATE A VIABLE CLAIM FOR RELIEF. Plaintiff fails to state a viable claim for relief on either of the two remaining causes of action pled in his Amended Complaint. Thus, his claims are subject to dismissal under Rule 12(b)(6) and, since amendment would be futile, dismissal should be granted with prejudice. 1. The California “Data Breach Act” Plaintiff’s first cause of action alleges that Citigroup purportedly violated the “California Data Breach Act,” Cal. Civ. Code §§ 1798.80, et seq. FAC ¶¶ 48-64. Specifically, Plaintiff alleges that Citigroup violated two sections of the Act, § 1798.81.5 and § 1798.82. Id. ¶¶ 50-52. Section 1798.81.5 protects “personal information about California residents” by requiring businesses that “own, license, or maintain personal information about Californians to provide reasonable security for that information.” Cal. Civ. Code § 1798.81.5(a)(1).6 “A business that owns, licenses, or maintains personal 6 The statute defines “personal information” as an individual’s first name (or first initial) and last name with one or more of the following: (1) social security number; (2) driver’s license number or California identification-card number; (3) account number or debit or credit card number in combination with the security code, access code, or password that permits access to that financial account, and (4) medical information in the form of medical history, treatment, or diagnosis. Cal. Civ. Code § 1798.81.5(d). Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 24 of 28 Page ID #:201 18 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” Id. § 1798.81.5(b). Section 1798.82 has procedures for notifying California residences when their unencrypted personal information is disclosed in a data breach and thereby acquired by (or reasonably believed to have been acquired by) an unauthorized person. Id. § 1798.82(a). The statute provides that the business “shall disclose” the breach and “shall notify” the affected persons. Id. § 1798.82(a)-(b). Notice can be delayed if a law-enforcement agency determines that notification will impede a criminal investigation. Id. § 1798.82(c). Section 1798.84(b) provides a private right of action authorizing “[a]ny customer injured by a violation of this title” to “institute a civil action to recover damages.” Id. § 1798.84(b). A business also may be enjoined. Id. § 1798.84(e). Plaintiff’s claims under the Data Breach Act fail for at least three independent reasons. First, assuming Plaintiff’s allegations are true—which must be done for purposes of this motion only—the statute does not apply. The Data Breach Act specifically exempts “[a] financial institution as defined in Section 4052 of the Financial Code and subject to the California Financial Information Privacy Act.” Id. § 1798.81.5(e)(2). In turn, Section 4052 of the Financial Code defines “financial institution” as “any institution the business of which is engaging in financial activities as described in [12 U.S.C. § 1843(k)] and doing business in this state.” Cal. Fin. Code § 4052(c). The relevant federal statute defines “financial activities” to include, among other things, the “[l]ending” of “money or securities.” 12 U.S.C. § 1843(k)(4)(A). Here, Plaintiff alleges that Citibank lent money to Plaintiff in California. See, e.g., FAC ¶¶ 16-17 (alleging that Citigroup “d.b.a.” Citibank funded Plaintiff’s mortgage loan); see also Exhibit A at 2 (identifying Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 25 of 28 Page ID #:202 19 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Citibank, N.A. as the “Lender” for Plaintiff’s loan). Thus, according to Plaintiff’s own pleadings, Citibank is a financial institution under Section 1798.81.5(e)(2) and is exempt from the coverage of the Data Breach Act. For this reason alone, Plaintiff’s first cause of action fails as a matter of law. Second, Plaintiff has not alleged facts sufficient to plausibly state a claim under the Act. Section 1798.81.5 does not purport to cover all accidental disclosures of information. Instead, it requires covered entities to “implement and maintain reasonable security procedures and practices.” Cal. Civ. Code § 1798.81.5(b). Plaintiff’s claim under Section 1798.81.5 is premised on his allegation that his personal information was accidentally provided to another loan applicant. FAC ¶¶ 18-19. Plaintiff’s remaining allegations about Citigroup’s policies and procedures are “mere conclusory statements” that are not entitled to any weight. Iqbal, 556 U.S. at 678; see, e.g., FAC ¶ 57 (alleging Citigroup “failed to provide reasonable and adequate security measures”). Plaintiff’s allegation that his information was accidentally provided to another loan applicant fails to plausibly suggest that Citigroup’s policies and procedures are not “reasonable.” Accordingly, Plaintiff cannot state a claim under Section 1798.81.5. Plaintiff likewise cannot state a claim under Section 1798.82, which requires a covered entity to notify affected customers of a data breach “in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.” Cal. Civ. Code § 1798.82(a). Plaintiff does not allege when he received the notification letter but alleges that it was “approximately four months after” the alleged data breach occurred. FAC ¶ 22. Plaintiff fails to allege any non-conclusory facts to suggest that the notification was not provided “in the most expedient time possible.” For example, Plaintiff does not provide any suggestion as to what time period would be considered sufficiently “expedient.” In short, Plaintiff’s allegations with regard to Section 1798.82 are Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 26 of 28 Page ID #:203 20 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 conclusory and are not sufficient to raise a plausible claim that Citigroup violation that statute. Third and finally, the private right of action in the Data Breach Act extends only to customers “injured by a violation of this title.” Cal. Civ. Code § 1798.84(b). As set forth supra in Section I, Plaintiff cannot allege any actionable injury under the statute. Thus, for any of these three independent reasons, Plaintiff cannot state a claim under the Data Breach Act. 2. The Unfair Competition Law Plaintiff’s second cause of action is a boilerplate count under the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200, et seq. FAC ¶¶ 65-73. The UCL allows plaintiffs to bring claims for injunctive relief and restitution only with respect to allegedly unlawful, fraudulent, or unfair business practices. Cal. Bus. & Prof. Code § 17200; Guttierez v. Wells Fargo Bank, NA, 704 F.3d 712, 717 (9th Cir. 2012). However, Plaintiff’s allegations cannot state a UCL claim under any of those three prongs. First, Plaintiff’s “unlawful” claim fails because it is premised on alleged violations of the Data Breach Act, Cal. Civ. Code §§ 1798.81.5 and 1798.82. FAC ¶ 67. As explained supra at Section II(C)(1), however, Plaintiff’s claim under the Data Breach Act fails as a matter of law. See Berryman v. Merit Property Mgmt., Inc., 152 Cal. App. 4th 1544 (Cal. App. 4th Dist. 2007) (affirming dismissal of unlawful claim where plaintiff failed to satisfy elements of a violation of the laws underlying UCL claim). Second, Plaintiff’s “fraud” claim fails because his boilerplate allegations fail to satisfy Rule 9(b)’s heightened pleading standards. Kearns v. Ford Mot. Co., 567 F.3d 1120, 1125 (9th Cir. 2009). Third, Plaintiff’s “unfair” claim fails because his conclusory allegations fail to identify any alleged policy or practice of Citigroup that “either offends an established public policy or is immoral, unethical, oppressive, unscrupulous or substantially injurious to Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 27 of 28 Page ID #:204 21 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 consumers.” McDonald v. Coldwell Banker, 543 F.3d 498, 506 (9th Cir. 2008) (quotations and citations omitted). D. THE DEFECTS IN PLAINTIFF’S CLAIMS CANNOT BE CURED BY AMENDMENT. As shown above, Plaintiff’s claims all suffer from fundamental defects that cannot be cured by amendment. Accordingly, allowing Plaintiff to amend those claims would be futile and amendment should not be granted. See Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1033 (N.D. Cal. 2012) (dismissing similar claims alleging unlawful disclosure of private information without granting leave to amend because amendment would be futile). In addition, Plaintiff has already had an opportunity to amend and failed to cure the deficiencies in his pleading. This additionally supports dismissal with prejudice. See, e.g., Mir v. Fosburg, 646 F.2d 342, 347 (9th Cir. 1980) (“a district court has broad discretion to grant or deny leave to amend, particularly where the court has already given [the party] one or more opportunities to amend.”); In re Circuit Breaker Litig., 175 F.R.D. 547, 552 (C.D. Cal. Apr. 1, 1997) (where parties had “already amended at least once,” dismissal without leave to amend was appropriate). CONCLUSION For the reasons stated above, Plaintiff’s claims against Citigroup should be dismissed under Rule 12(b)(1) or, in the alternative, should be dismissed with prejudice under Rule 12(b)(6). Dated: September 8, 2016 MAYER BROWN LLP By: /s/ Andrew Z. Edelstein Andrew Z. Edelstein Attorney for Defendant CITIGROUP INC. Case 2:16-cv-03466-FMO-RAO Document 25-1 Filed 09/08/16 Page 28 of 28 Page ID #:205 EXHIBIT A Gzjkdkv!C 33 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 1 of 21 Page ID #:206 REDACTED REDACTED REDACTED REDACTED Gzjkdkv!C 34 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 2 of 21 Page ID #:207 REDACTED REDACTED REDACTED Gzjkdkv!C 35 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 3 of 21 Page ID #:208 REDACTED Gzjkdkv!C 36 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 4 of 21 Page ID #:209 REDACTED Gzjkdkv!C 37 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 5 of 21 Page ID #:210 REDACTED Gzjkdkv!C 38 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 6 of 21 Page ID #:211 REDACTED Gzjkdkv!C 39 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 7 of 21 Page ID #:212 REDACTED Gzjkdkv!C 3; Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 8 of 21 Page ID #:213 REDACTED Gzjkdkv!C 41 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 9 of 21 Page ID #:214 REDACTED Gzjkdkv!C 42 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 10 of 21 Page ID #:215 REDACTED Gzjkdkv!C 43 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 11 of 21 Page ID #:216 REDACTED Gzjkdkv!C 44 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 12 of 21 Page ID #:217 REDACTED Gzjkdkv!C 45 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 13 of 21 Page ID #:218 REDACTED Gzjkdkv!C 46 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 14 of 21 Page ID #:219 REDACTED Gzjkdkv!C 47 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 15 of 21 Page ID #:220 REDACTED Gzjkdkv!C 48 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 16 of 21 Page ID #:221 REDACTED Gzjkdkv!C 49 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 17 of 21 Page ID #:222 REDACTED Gzjkdkv!C 4; Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 18 of 21 Page ID #:223 REDACTED Gzjkdkv!C 51 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 19 of 21 Page ID #:224 REDACTED REDACTED REDACTED Gzjkdkv!C 52 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 20 of 21 Page ID #:225 REDACTED Gzjkdkv!C 53 Case 2:16-cv-03466-FMO-RAO Document 25-2 Filed 09/08/16 Page 21 of 21 Page ID #:226 EXHIBIT B I|lmfmx"F 65 Case 2:16-cv-03466-FMO-RAO Document 25-3 Filed 09/08/16 Page 1 of 5 Page ID #:227 Rev. 12-21-15 NOTICE OF DATA BREACH Arik Lainer 10109 Lovelane Place Los Angeles, CA 90064 Dear Mr. Lainer, WHAT HAPPENED: This letter is regarding a recent incident involving your personal information that occurred during the following period of time: Mid-September 2015 to October 15, 2015. At that time your personal information was provided to another Citibank mortgage loan applicant in error. WHAT INFORMATION WAS INVOLVED. The only personal information that could potentially be exposed to unauthorized access as a result of this incident was your social security number. We apologize for this situation and understand your concerns. We want you to know there are steps we are taking to help you monitor your credit and protect you from identity theft. WHAT WE ARE DOING. As soon as we learned of this issue, we investigated the matter and adopted measures to prevent it from happening again. We regard customer privacy very highly and have policies and procedures to prevent customer information from being compromised or disseminated to unauthorized users. WHAT YOU CAN DO: At our expense, Citibank, N.A. would like to offer you a free one year subscription to Identity Guard ® , a credit monitoring and identity theft protection service. Identity Guard provides essential monitoring and protection of not only credit data, but also alerts you of certain activities that could indicate potential identity theft. This program is provided by Intersections Inc. (NASDAQ: INTX), a leading provider of consumer and corporate identity risk management services. This service is complimentary; no method of payment will be collected during enrollment and there is no need to cancel. IDENTITY GUARD® features include: $ 3-Bureau Credit Report and Scores* $ 3-Bureau Daily Monitoring with NOTIFY EXPRESS® Alerts $ 3-Bureau Quarterly Credit Update $ Victim Recovery Service $ Credit Education Specialists $ Up to $20,000 identity theft insurance with $0 deductible** If you wish to take advantage of this monitoring service, you must enroll by February 29, 2016. Enrollment Procedure: To activate this coverage please call the toll-free number or visit the Web site listed below and enter the redemption code. The redemption code is required for enrollment, and can only be used one time by the individual addressed. Toll-Free: 1-)''#*$%#&(*( Web Site: www.identityguard.com/enroll Redemption Code: -YQS* In order to enroll, you will need to provide the following personal information: $ Mailing Address $ Phone Number $ Social Security Number $ Date of Birth $ E-mail Address $ Redemption Code You should remain vigilant over the next twelve to twenty four months and regularly review account statements from your financial institutions and monitor free credit reports. If you discover any suspicious or unusual activity, be sure to report it immediately to the three major credit reporting companies shown below and your financial institutions. If you think identity theft or fraud has been committed, you should notify law enforcement, including REDACTED I|lmfmx"F 66 Case 2:16-cv-03466-FMO-RAO Document 25-3 Filed 09/08/16 Page 2 of 5 Page ID #:228 your Attorney General. You should also notify the Federal Trade Commission (FTC) at 1-877-ID-THEFT (1-877- 438-4338): TTY: 1-866-653-4261, at the website below or write: Federal Trade Commission Consumer Response Center 600 Pennsylvania Avenue, NW Washington, DC 20580 www.consumer.gov/idtheft To learn more about identity theft, you can go to http://www.consumer.gov/idtheft, or http://www.ftc.gov/credit or law enforcement, including your Attorney General. IF YOU ARE AN IOWA RESIDENT: You also may contact local law enforcement or the Iowa Attorney General’s Office to report suspected incidents of identity theft. You may contact the Iowa Attorney General at: Office of the Attorney General 1305 E. Walnut Street Des Moines, IA 50319 (515) 281-5164 1-888-777-4590 or 1-515-281-5164 www.iowa.gov/government/ag IF YOU ARE A MARYLAND RESIDENT: You also may obtain information about avoiding identity theft from the Maryland Attorney General’s Office, which may be reached at: Office of the Attorney General Consumer Protection Division 200 St. Paul Place Baltimore, MD 21202 1-888-743-0023 www.oag.state.md.us IF YOU ARE A MASSACHUSSETTS RESIDENT: Under Massachusetts law, you have the right to obtain any police report that may be filed in connection with misuse of your personal information. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. Massachusetts law also allows consumers to place a security freeze on their credit reports. A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of identity theft, and you provide the credit reporting agency with a valid police report, it cannot charge you to place lift or remove a security freeze. In all other cases, a credit reporting agency may charge you up to $5.00 each to place, temporarily lift, or permanently remove a security freeze. To place a security freeze on your credit report, you must notify each of the major credit reporting agencies listed below. IF YOU ARE A NORTH CAROLINA RESIDENT: You also may obtain information about preventing identity theft from the North Carolina Attorney General’s Office at 1-877-566-7226 or 1-919-716-6400, or write: North Carolina Department of Justice 9001 Mail Service Center Raleigh, NC 27699-9001 http://www.ncdoj.gov Under federal law, you are entitled to one free copy every twelve months of your credit report from each of the three major credit reporting companies. You may obtain a free copy of your credit report by going on the I|lmfmx"F 67 Case 2:16-cv-03466-FMO-RAO Document 25-3 Filed 09/08/16 Page 3 of 5 Page ID #:229 Internet to www.AnnualCreditReport.com, by calling 1-877-FACTACT (1-877-322-8228), or by contacting the credit reporting companies as indicated below: Equifax: 1-800-525-6285 www.equifax.com P.O. Box 740241, Atlanta, GA 30374- 0241 Experian: 1-888-397-3742 www.experian.com P.O. Box 9701, Allen, TX 75013 TransUnion: 1-800-916-8800 www.transunion.com. Fraud Victim Assistance Division P.O. Box 2000, Chester, PA 19022 You also may obtain additional information from the FTC and the nationwide credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert message to your credit report to help protect your credit information. Fraud alerts can help prevent an identity thief from opening accounts in your name. There are two types of fraud alerts: an initial alert, which stays on your credit report for 90 days; and an extended alert, which stays on your credit report for 7 years, when you provide a valid identity theft report that you have filed with a law enforcement agency. Contact the toll-free telephone numbers of any one of the credit reporting companies above to place an alert. As soon as that agency possesses your fraud alert, it will notify the other two agencies, which then also must place fraud alerts on your credit report file. When a business sees the alert on your credit report, the business must verify your identity before issuing credit to you. This process may cause some delays if you are trying to obtain credit, and to compensate for possible delays, you may wish to include a telephone number in your fraud alert where you can easily be reached. Remember to keep all contact information current in your alert. A security freeze prohibits a credit reporting agency from releasing information from your credit report without your prior written authorization. To place a security freeze on your credit report, you must notify each of the major credit reporting agencies listed below. Equifax – 1-800-349-9960 Experian – 1-888-397-3742 TransUnion – 1-888-909-8872 You will need to supply your name, address, date of birth, Social Security Number, and other personal information. The fee to place a credit fee varies based on where you live. After receiving your request, each credit reporting agency will send you a confirmation letter containing a unique PIN or password that you will need in order to lift or remove the freeze. You should keep the PIN or password in a safe place. We apologize for any inconvenience and urge you to take advantage of the offer above and enroll today. If you have any further questions regarding this incident, please call Citibank, N.A. at 1-800-667-8424, ext. 2611534, between 8 am and 5 pm CST. Sincerely, Kimberley Dorsey Business Control Analyst *The scores you receive with identity Guard ® are provided for educational purposes to help you understand your credit. They are calculated using the information contained in your Equifax, Experian and TransUnion credit files. Lenders use many different credit scoring systems, and the scores you receive with Identity Guard are not the same scores used by lenders to evaluate your credit. Credit scores are provided by CreditXpert® based on data from the three major credit bureaus. I|lmfmx"F 68 Case 2:16-cv-03466-FMO-RAO Document 25-3 Filed 09/08/16 Page 4 of 5 Page ID #:230 **Identity Theft Insurance underwritten by insurance company subsidiaries or affiliates of American International Group, Inc. The description herein is a summary and intended for informational purposes only and does not include all terms, conditions and exclusions of the policies described. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. I|lmfmx"F 69 Case 2:16-cv-03466-FMO-RAO Document 25-3 Filed 09/08/16 Page 5 of 5 Page ID #:231 EXHIBIT C Exhibit C 48 Case 2:16-cv-03466-FMO-RAO Document 25-4 Filed 09/08/16 Page 1 of 2 Page ID #:232 Exhibit C 49 Case 2:16-cv-03466-FMO-RAO Document 25-4 Filed 09/08/16 Page 2 of 2 Page ID #:233 DECLARATION OF CHRISTOPHER S. COMSTOCK IN SUPPORT OF DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Admitted Pro Hac Vice) lnale@mayerbrown.com DEBRA BOGO-ERNST (Admitted Pro Hac Vice) dernst@mayerbrown.com MICHAEL H. BORNHORST (Admitted Pro Hac Vice) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Admitted Pro Hac Vice) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. d.b.a CITIBANK, N.A., Defendant. Case No. 2:16-cv-03466-FMO-RAO DECLARATION OF CHRISTOPHER S. COMSTOCK IN SUPPORT OF DEFENDANT CITIGROUP INC.’S MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT Date: January 5, 2017 Time: 10:00 a.m. Judge: Hon. Fernando M. Olguin Court: Room 22 - 5th Floor United States Courthouse 312 North Spring Street Los Angeles, CA 90012-4701 Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 25-5 Filed 09/08/16 Page 1 of 2 Page ID #:234 I, Christopher Comstock, hereby declare as follows: I am an associate with the law firm of Mayer Brown LLP in Chicago, Illinois. Along with my colleagues, I represent Defendant Citigroup Inc. ("Citigroup") in the above-captioned matter. This declaration based on my personal knowledge, and I could and would testify to the matters set forth in this Declaration if called upon as a witness. I submit this Declaration for the purposes of authenticating the exhibits attached to the contemporaneously filed Memorandum of Points and Authorities in Support of Citigroup's Motion to Dismiss Plaintiff's First Amended Complaint ("FAC") [Dkt. # 17]. 1. Attached to the Memorandum of Points and Authorities as Exhibit A is a true and correct copy of the publicly recorded Deed of Trust securing Plaintiff's loan from Citibank, N.A. ("Citibank"). 2. Attached to the Memorandum of Points and Authorities as Exhibit B is a true and correct copy of the letter sent to Plaintiff regarding the alleged data breach. 3. Attached to the Memorandum of Points and Authorities as Exhibit C is a true and correct printout from the Federal Deposition Insurance Corporation ("FDIC") website showing that Citibank is an indirect subsidiary of Citigroup. I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on September 8, 2016, in Chicago, Illinois. By: Christopher S. Comstock 1 DECLARATION OF CHRISTOPHER S. COMSTOCK IN SUPPORT OF DEFENDANT CITIGROUP INC.'S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS PLAINTIFF'S FIRST AMENDED COMPLAINT; CASE NO. 2:16-CV-03466-FMO-RAO Case 2:16-cv-03466-FMO-RAO Document 25-5 Filed 09/08/16 Page 2 of 2 Page ID #:235 [PROPOSED] ORDER; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Admitted Pro Hac Vice) lnale@mayerbrown.com DEBRA BOGO-ERNST (Admitted Pro Hac Vice) dernst@mayerbrown.com MICHAEL H. BORNHORST (Admitted Pro Hac Vice) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Admitted Pro Hac Vice) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. Defendant. Case No. 2:16-cv-03466-FMO-RAO [PROPOSED] ORDER AS TO DEFENDANT CITIGROUP INC.’S MOTION TO DISMISS PLAINTIFF’S FIRST AMENDED COMPLAINT Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 25-6 Filed 09/08/16 Page 1 of 3 Page ID #:236 1 [PROPOSED] ORDER; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 This matter coming before the Court on Defendant Citigroup Inc.’s Motion to Dismiss Plaintiff’s First Amended Complaint (“FAC”) pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6), it is hereby ordered that the motion is GRANTED. The Court dismisses this case pursuant to Fed. R. Civ. P. 12(b)(1) because Plaintiff has not alleged a concrete and particularized injury and therefore lacks Article III standing to bring suit. See, e.g., Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147 (2013); Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016), as revised May 24, 2016. The Court also dismisses this case pursuant to Fed. R. Civ. P. 12(b)(6) for two reasons. First, Plaintiff has not pled any facts to support imposing liability against Citigroup for alleged acts of its indirect subsidiary, Citibank, N.A. (“Citibank”). See Pantoja v. Countrywide Home Loans, Inc., 640 F. Supp. 2d 1177, 1192 (N.D. Cal. 2009); Cattie v. Wal-Mart Stores, Inc., 504 F. Supp. 2d 939, 946 (S.D. Cal. 2007). Second, both of Plaintiff’s remaining claims fail as a matter of law and cannot be salvaged through re-pleading. Plaintiff’s claim under the California Data Breach Act, Cal. Civ. Code §§ 1798.80, et seq., fails as a matter of law because: (1) the statute does not apply to a financial institution like Citibank (Cal. Civ. Code § 1798.81.5(e)(2)); (2) Plaintiff has not alleged facts sufficient to plausibly state a claim under the Act (Ashcroft v. Iqbal, 556 U.S. 662, 697 (2009); Bell Atlantic v. Twombly, 550 U.S. 544, 570 (2007)), and (3) Plaintiff cannot allege any actionable injury under the statute (Cal. Civ. Code § 1798.84(b)). Plaintiff’s claim under the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200, et seq., fails as a matter of law because Plaintiff cannot state a claim under any of the three prongs of the UCL. First, Plaintiff’s “unlawful” claim fails because it is premised on alleged violations of the Data Breach Act, but Plaintiff’s claim under the Data Breach Act fails as a matter of Case 2:16-cv-03466-FMO-RAO Document 25-6 Filed 09/08/16 Page 2 of 3 Page ID #:237 2 [PROPOSED] ORDER; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 law. See Berryman v. Merit Property Mgmt., Inc., 152 Cal. App. 4th 1544 (Cal. App. 4th Dist. 2007) (affirming dismissal of unlawful claim where plaintiff failed to satisfy elements of a violation of the laws underlying UCL claim). Second, Plaintiff’s “fraud” claim fails because his boilerplate allegations fail to satisfy Rule 9(b)’s heightened pleading standards. Kearns v. Ford Mot. Co., 567 F.3d 1120, 1125 (9th Cir. 2009). Third, Plaintiff’s “unfair” claim fails because his conclusory allegations fail to identify any alleged policy or practice of Citigroup that “either offends an established public policy or is immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.” McDonald v. Coldwell Banker, 543 F.3d 498, 506 (9th Cir. 2008) (quotations and citations omitted). Accordingly, Plaintiff’s FAC is DISMISSED in its entirety with prejudice. SO ORDERED Date: __________________ ___________________________ United States District Judge Case 2:16-cv-03466-FMO-RAO Document 25-6 Filed 09/08/16 Page 3 of 3 Page ID #:238