Arik Lainer v. Citigroup Inc.

NOTICE OF MOTION AND MOTION to Dismiss Case [Fed. R. Civ. P. 12

C.D. Cal.August 2, 2016

DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Pro Hac Vice to follow) lnale@mayerbrown.com DEBRA BOGO-ERNST (Pro Hac Vice to follow) dernst@mayerbrown.com MICHAEL H. BORNHORST (Pro Hac Vice to follow) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Pro Hac Vice to follow) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. Defendant. Case No. 2:16-cv-03466-FMO-RAO DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS [Fed. R. Civ. P. 12(b)(1) and 12(b)(6)] Date: September 22, 2016 Time: 10:00 a.m. Judge: Hon. Fernando M. Olguin Court: Room 22 - 5th Floor United States Courthouse 312 North Spring Street Los Angeles, CA 90012-4701 Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 12 Filed 08/02/16 Page 1 of 2 Page ID #:68 1 DEFENDANT CITIGROUP INC.’S NOTICE OF MOTION AND MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TO PLAINTIFF AND HIS ATTORNEYS OF RECORD: PLEASE TAKE NOTICE that on September 22, 2016 at 10:00 a.m. in Room 22 – 5th Floor, before Judge Fernando M. Olguin, or as soon thereafter as the matter may be heard in the above-entitled Court, located at 312 North Spring Street, Los Angeles, CA 90012-4701, Defendant Citigroup Inc. (“Citigroup”) will, and hereby does, move the Court to dismiss this action pursuant to Fed. R. Civ. P. 12(b)(1) because Plaintiff lacks Article III standing to bring suit. In the alternative, Citigroup moves this Court to dismiss this action pursuant to Fed. R. Civ. P. 12(b)(6) because Plaintiff’s Complaint fails to state a claim against Citigroup upon which relief can be granted for each cause of action alleged. The Motion to Dismiss is based upon this Notice of Motion and Motion, the accompanying Memorandum of Points and Authorities, the operative pleadings, all matters upon which this Court has taken and/or may take judicial notice, and upon such evidence and argument, both written and oral, as may be introduced at, or prior to, the hearing on this Motion. Opposition, if any, to the granting of the Motion to Dismiss shall be in writing and shall be filed and served not less than twenty-one (21) days preceding the noticed (or continued) hearing date. A responding party who has no opposition to the granting of the motion shall serve and file a statement to that effect, specifically designating the motion in question. No party will be entitled to be heard in opposition to a motion at oral argument if opposition to the motion has not been timely filed by that party. See L.R. 7-12. The written opposition must be served on Bronwyn F. Pollock, Mayer Brown, LLP, 350 South Grand Avenue, 25th Floor, Los Angeles, CA 90071-1503. Dated: August 2, 2016 Mayer Brown LLP By: /s/ Andrew Z. Edelstein Andrew Z. Edelstein Attorney for Defendant Citigroup Inc. Case 2:16-cv-03466-FMO-RAO Document 12 Filed 08/02/16 Page 2 of 2 Page ID #:69 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Pro Hac Vice to follow) lnale@mayerbrown.com DEBRA BOGO-ERNST (Pro Hac Vice to follow) dernst@mayerbrown.com MICHAEL H. BORNHORST (Pro Hac Vice to follow) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Pro Hac Vice to follow) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. Defendant. Case No. 2:16-cv-03466-FMO-RAO DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS [Fed. R. Civ. P. 12(b)(1) and 12(b)(6)] Date: September 22, 2016 Time: 10:00 a.m. Judge: Hon. Fernando M. Olguin Court: Room 22 - 5th Floor United States Courthouse 312 North Spring Street Los Angeles, CA 90012-4701 Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 1 of 30 Page ID #:70 TABLE OF CONTENTS Page i DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 INTRODUCTION........................................................................................................................ 1 PLAINTIFF’S ALLEGATIONS ................................................................................................ 2 ARGUMENT ................................................................................................................................ 3 I. MOTION TO DISMISS UNDER RULE 12(b)(1) FOR LACK OF SUBJECT MATTER JURISDICTION ............................................................................................ 3 A. LEGAL STANDARD .......................................................................................... 3 B. PLAINTIFF LACKS STANDING TO BRING THIS CASE. ......................... 3 1. Increased risk of future losses. ................................................................... 6 2. Opportunity and mitigation costs. .............................................................. 9 3. Diminished value of personal information. ............................................. 11 4. Delayed or inadequate notification. ......................................................... 11 5. Invasion of privacy. ................................................................................. 12 6. Lost benefit of bargain. ............................................................................ 12 7. Anxiety and emotional distress. ............................................................... 13 8. Alleged statutory violations. .................................................................... 14 II. MOTION TO DISMISS UNDER RULE 12(b)(6) FOR FAILURE TO STATE A CLAIM .......................................................................................................... 15 A. LEGAL STANDARD ........................................................................................ 15 B. PLAINTIFF FAILS TO STATE A VIABLE CLAIM FOR RELIEF. ......... 15 1. The California “Data Breach Act” ........................................................... 16 2. The Unfair Competition Law ................................................................... 18 3. Negligence ............................................................................................... 19 4. Negligence per se ..................................................................................... 20 5. Conversion ............................................................................................... 20 6. Invasion of privacy .................................................................................. 21 C. THE DEFECTS IN PLAINTIFF’S CLAIMS CANNOT BE CURED BY AMENDMENT ............................................................................................ 23 CONCLUSION .......................................................................................................................... 23 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 2 of 30 Page ID #:71 ii DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Page(s) Cases A–Z Int’l v. Phillips, 323 F.3d 1141 (9th Cir. 2003) ...................................................................................................3 Ashcroft v. Iqbal, 556 U.S. 662 (2009) ...........................................................................................................15, 17 Assoc. Gen. Contractors of Cal. v. Cal. State Council of Carpenters, 459 U.S. 519 (1983) .................................................................................................................15 In re Barnes & Noble Pin Pad Litig., No. 12-8617, 2013 WL 4759588 (N.D. Ill. Sept. 3, 2013) ..........................................12, 13, 14 Beaver v. Tarsadia Hotels, 29 F. Supp. 3d 1294 (S.D. Cal. 2014) ......................................................................................20 Bell Atlantic v. Twombly, 550 U.S. 544 (2007) .................................................................................................................15 Berryman v. Merit Property Mgmt., Inc., 152 Cal. App. 4th 1544 (Cal. App. 4th Dist. 2007) .................................................................18 Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279 (N.D. Ala. 2014) .......................................................................................8 Chambliss v. Carefirst, Inc., No. RDB-15-2288, 2016 WL 3055299 (D. Md. May 27, 2016) ..................................... passim Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138 (2013) ..................................................................................................... passim United States ex rel. Chunie v. Ringrose, 788 F.2d 638 (9th Cir. 1986) ...................................................................................................15 Duqum v. Scottrade, No. 15-cv-1537, 2016 WL 3683001 (E.D. Mo. July 12, 2016) .................................................7 In re Facebook Privacy Litig., 791 F. Supp. 2d 705 (N.D. Cal. May 12, 2011) .......................................................................21 Friends of the Earth, Inc. v. Laidlaw Envir. Servs. (TOC), Inc., 528 U.S. 167 (2000) ...................................................................................................................4 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 3 of 30 Page ID #:72 iii DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 FW/PBS, Inc. v. Dallas, 493 U.S. 215 (1990) ...................................................................................................................4 Galaria v. Nationwide Mut. Ins. Co., 998 F. Supp. 2d 646 (S.D. Ohio 2014) ......................................................................................8 Gilmer v. Ellington, 159 Cal. App. 4th 190, 70 Cal. Rptr. 3d 893 (2008) ................................................................19 Green v. eBay, Inc., No. 14-1688, 2015 WL 2066531 (E.D. La. May 4, 2015) ...................................................8, 11 Gutierrez v. Bank of Am, N.A., 2014 WL 1379883 (E.D. Cal. Apr. 8, 2014)............................................................................15 Guttierez v. Wells Fargo Bank, NA, 704 F.3d 712 (9th Cir. 2012) ...................................................................................................18 Hill v. Nat'l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 26 Cal. Rptr. 2d 834, 865 P.2d 633 (1994) .........................................................22 Hollingsworth v. Perry, 133 S. Ct. 2652 (2013) .............................................................................................................14 In re Horizon Healthcare Servs., Inc. Data Breach Litig., No. 13-7418, 2015 WL 1472483 (D.N.J. Mar. 31, 2015) .........................................................8 In re iPhone Application Litig., 844 F. Supp. 2d 1040 (N.D. Cal. 2012) .............................................................................21, 22 Kearns v. Ford Mot. Co., 567 F.3d 1120 (9th Cir. 2009) .................................................................................................18 Khan v. Children’s Nat’l Health Sys., No. TDC-15-2125, 2016 WL 2946165 (D. Md. May 19, 2016) .............................................14 Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375 (1994) ...................................................................................................................3 Kremen v. Cohen, 337 F.3d 1024 (9th Cir. 2003) .................................................................................................21 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) ...............................................................................................7, 8 Lee v. Am. Nat’l Ins. Co., 260 F.3d 997 (9th Cir. 2001) ...................................................................................................14 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 4 of 30 Page ID #:73 iv DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016) ...................................................................................................13 Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-4787, 2014 WL 7005097 (N.D. Ill. Dec. 10, 2014) .......................................................8 Loder v. City of Glendale, 14 Cal. 4th 846, 59 Cal. Rptr. 2d 696, 927 P.2d 1200 (1997) .................................................22 Low v. LinkedIn Corp., 900 F. Supp. 2d 1010 (N.D. Cal. 2012) .......................................................................21, 22, 23 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) ...............................................................................................................4, 5 McDonald v. Coldwell Banker, 543 F.3d 498 (9th Cir. 2008) ...................................................................................................19 O’Shea v. Littleton, 414 U.S. 488 (1974) ...................................................................................................................4 Patton v. Experian Data Corp., No. SACV 15-1871, 2016 WL 262801 (C.D. Cal. May 6, 2016) .............................................8 People of California v. Kinder Morgan Energy Partners, L.P., 569 F. Supp. 2d 1073 (S.D.Cal. 2008) .....................................................................................20 Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d 847 (S.D. Tex. 2015) .........................................................................................8 Pioneer Elec., Inc. v. Sup. Ct. of L.A., 40 Cal. 4th 360, 53 Cal. Rptr. 3d 513 (2007)...........................................................................22 Raines v. Byrd, 521 U.S. 811 (1997) ...................................................................................................................4 Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011)...............................................................................................7, 9, 13 Remijas v. Neiman Marcus Grp., LLC, No. 14-c-1735, 2014 WL 4627893 (N.D. Ill. Sept. 16, 2014) .......................................8, 11, 13 Resolution Trust Corp. v. BVS Dev., 42 F.3d 1206 (9th Cir. 1994) ...................................................................................................19 Rosales v. City of Los Angeles, 82 Cal. App. 4th 419, 98 Cal. Rptr. 2d 144 (2000) ..................................................................20 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 5 of 30 Page ID #:74 v DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121 (N.D. Cal. 2008) aff'd, 380 F. App’x. 689 (9th Cir. 2010) ........................................................................................................................................23 In re Science App. Int'l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14 (D.D.C. 2014) ...................................................................................7, 10, 11 Shroyer v. New Cingular Wireless Servs., 622 F.3d 1035 (9th Cir. 2010) .................................................................................................18 Shulman v. Group W Prods., Inc., 18 Cal. 4th 200, 74 Cal. Rptr. 2d 843, 955 P.2d 469 (1998) ...................................................22 Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26 (1976) .....................................................................................................................4 Sipe v. Countrywide Bank, 690 F. Supp. 2d 1141 (E.D. Cal. 2010)....................................................................................19 Spokeo Inc. v. Robins, 136 S. Ct. 1540 (2016), as revised May 24, 2016 ............................................................ passim Spokeo Inc. v. Robins, 742 F.3d 409 (9th Cir. 2014) .....................................................................................................5 Storm v. Paytime, Inc., 90 F. Supp. 3d 359 (M.D. Pa. 2015) ..........................................................................................8 Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871 (N.D. Ill. 2014) ...........................................................................................8 Summers v. Earth Island Institute, 555 U.S. 488 (2009) ...................................................................................................................5 In re SuperValu, Inc., No. 14-MD-2586, 2016 WL 81792 (D. Minn. Jan. 7, 2016) ........................................... passim Thompson v. Home Depot, Inc., No. 07-cv-1058 IEG, 2007 WL 2746603 (S.D. Cal. Sept. 18, 2007) ......................................21 Valley Forge Christian College v. Americans United for Separation of Church and State, 454 U.S. 464 (1982) ...................................................................................................................4 Vasquez v. Residential Invs., Inc., 118 Cal. App. 4th 269, 12 Cal. Rptr. 3d 846 (2004) ................................................................19 Wagner v. Benson, 101 Cal. App. 3d 27, 161 Cal. Rptr. 516 (1980) ......................................................................19 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 6 of 30 Page ID #:75 vi DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Walters v. Sloan 20 Cal. 3d 199, 142 Cal. Rptr. 152 (1977) ...............................................................................20 Warth v. Seldin, 422 U.S. 490 (1975) ...................................................................................................................4 Whalen v. Michael Stores, Inc., No. 14-7006, 2015 WL 9462108 (E.D.N.Y. Dec. 28, 2015) .....................................................8 Wolfe v. Strankman, 392 F.3d 358 (9th Cir. 2004) .....................................................................................................3 In re Zappos.com, Inc., 108 F. Supp. 3d 949 (D. Nev. 2015) ................................................................................ passim Constitutional Authority U.S. Const. art. III, § 2 ........................................................................................................... passim Federal Rules Fed. R. Civ. P. 9 .............................................................................................................................18 Fed. R. Civ. P. 12(b)(1).......................................................................................................... passim Fed. R. Civ. P. 12(b)(6).......................................................................................................... passim State Statutes Cal. Bus. & Prof. Code § 17200 ....................................................................................................18 Cal. Civ. Code § 1798.81.5 ................................................................................................16, 17, 18 Cal. Civ. Code § 1798.82 ...................................................................................................16, 17, 18 Cal. Civ. Code § 1798.84 .........................................................................................................17, 18 Cal. Evid. Code § 669 ....................................................................................................................20 Other Authorities Black’s Law Dictionary (9th ed. 2009)............................................................................................5 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 7 of 30 Page ID #:76 1 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 INTRODUCTION Plaintiff alleges that he provided certain personal information to Defendant Citigroup Inc. (“Citigroup”) in October 2015 in connection with his application for a mortgage loan. Complaint (“Cmplt.”) [Dkt. # 1], ¶¶ 15-16. 1 At some point after the loan was funded in January 2016, Plaintiff allegedly received a letter stating that his “personal information was provided” to another “mortgage loan applicant in error.” Id. ¶¶ 17-18. Plaintiff alleges that the letter offered a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 24. Plaintiff filed this case as a putative class action and brings six separate state law claims. Id. ¶¶ 30-90. The gravamen of these claims is Plaintiff’s allegation that Citigroup purportedly “failed to implement and maintain reasonable security and privacy procedures and practices.” Id. ¶ 26. Absent from Plaintiff’s Complaint is any allegation that Plaintiff suffered actual harm as a result of his information allegedly being provided to another loan applicant. Plaintiff does not allege that the other loan applicant has misused his information or even that the other applicant was aware of receiving the information. Instead of alleging any actual harm, Plaintiff attempts to rely on hypothetical injuries and alleged potential future injuries – i.e., that he may sustain costs required to monitor his credit (notwithstanding the subscription to a credit 1 Citigroup is not properly named as a Defendant in this case. Plaintiff’s mortgage loan was not funded by Citigroup, which is a parent-level holding company. The letter referenced in Plaintiff’s Complaint that forms the basis for his claims allegedly references “Citibank,” not Citigroup. Cmplt. [Dkt. # 1], ¶ 18. Citigroup and Citibank, N.A. are two separate legal entities. For purposes of this motion to dismiss only, Citigroup accepts Plaintiff’s allegations, but reserves the right to challenge all allegations and to seek dismissal on the ground that Citigroup is not properly named. Citigroup also denies all allegations of wrongdoing. The Complaint also purports to bring suit on behalf of a putative class. Cmplt. ¶¶ 30- 41. Citigroup denies the claims against it are suitable for class certification and is contemporaneously filing a motion to strike the class allegations. Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 8 of 30 Page ID #:77 2 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 monitoring program offered to him by Citigroup) or that he may, at some unspecified time, “initiat[e] [a] new mortgage loan[].” See id. ¶¶ 77, 90. The United States Supreme Court has made clear that those types of alleged injuries are not actual or imminent. Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1147 (2013). Because Plaintiff cannot allege an actual injury in fact, he lacks Article III standing to bring suit. See Spokeo Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016), as revised May 24, 2016. Thus, the Court should dismiss this case under Federal Rule of Civil Procedure (“Rule”) 12(b)(1). In the alternative, this case should be dismissed under Rule 12(b)(6) because Plaintiff has failed to state a claim. Each of Plaintiff’s six state-law claims fails as a matter of law and cannot be salvaged through re-pleading. Accordingly, the Court should dismiss this case with prejudice. PLAINTIFF’S ALLEGATIONS Plaintiff alleges that he contacted Citigroup around October 2015 “about financing a home purchase with a residential mortgage.” Cmplt. ¶ 15. Plaintiff alleges that Citigroup provided him with “information concerning the policies and procedures” relating to the protection of his personal information. Id. In addition, Plaintiff allegedly provided Citigroup with certain personal information, including “his name, address, date of birth, and social security number.” Id. ¶ 16. Plaintiff alleges his mortgage was “funded” on January 19, 2016. Id. ¶ 17. According to Plaintiff, at some unspecified time after his mortgage was funded, he received a letter from Citigroup titled “NOTICE OF DATA BREACH.” Id. ¶ 18. Plaintiff does not attach the letter to the Complaint, but according to Plaintiff, the letter stated that his “personal information” had been “provided to another Citibank mortgage loan applicant in error” at some point between “Mid- September 2015 to October 15, 2015.” Id. ¶ 18. The letter allegedly informed Plaintiff that the “only personal information that could potentially be exposed to unauthorized access as a result of this incident was your social security number.” Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 9 of 30 Page ID #:78 3 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Id. ¶ 19. Plaintiff alleges that the letter further stated that Citigroup had “investigated the matter and adopted measures to prevent it from happening again.” Id. ¶ 20. Plaintiff also states that the letter offered him a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 24. ARGUMENT This case should be dismissed on at least two grounds. First, the case should be dismissed under Rule 12(b)(1) because Plaintiff cannot allege an actual injury in fact and therefore lacks standing to bring this case. In the alternative, the case should be dismissed with prejudice under Rule 12(b)(6) because Plaintiff cannot state a claim for relief and cannot cure the deficiencies in his Complaint. I. MOTION TO DISMISS UNDER RULE 12(b)(1) FOR LACK OF SUBJECT MATTER JURISDICTION A. LEGAL STANDARD Rule 12(b)(1) allows for a motion to dismiss based on lack of subject matter jurisdiction. “A federal court is presumed to lack jurisdiction in a particular case unless the contrary affirmatively appears.” A–Z Int’l v. Phillips, 323 F.3d 1141, 1145 (9th Cir. 2003). The plaintiff has the burden of establishing jurisdiction. See Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). A Rule 12(b)(1) motion may be either facial, where the inquiry is confined to the allegations in the complaint, or factual, where the court is permitted to look beyond the complaint to extrinsic evidence. Wolfe v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). In this case, Citigroup raises a facial challenge to Plaintiff’s claims, so the question for the court is whether the lack of federal jurisdiction appears from the face of the pleading itself. See id. B. PLAINTIFF LACKS STANDING TO BRING THIS CASE. Under Article III of the U.S. Constitution, the “judicial Power of the United States” extends only to “Cases” and “Controversies.” Art. III, § 2. “Standing to sue is a doctrine rooted in the traditional understanding of a case or controversy.” Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 10 of 30 Page ID #:79 4 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Spokeo, 136 S. Ct. at 1547. “The doctrine limits the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong.” Id. (citing Valley Forge Christian College v. Americans United for Separation of Church and State, 454 U.S. 464, 473 (1982)). 2 The Supreme Court has established that the “irreducible constitutional minimum” of standing consists of three elements. Id. (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). “The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. (citing Lujan, 504 U.S. at 560-61); Friends of the Earth, Inc. v. Laidlaw Envir. Servs. (TOC), Inc., 528 U.S. 167, 180-81 (2000)). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements.” Id. (citing FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990)). “Where, as here, a case is at the pleading stage, the plaintiff must ‘clearly … allege facts demonstrating’ each element.” Id. (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). Injury in fact is the “[f]irst and foremost” of the three elements of standing and is “a constitutional requirement” that Congress “cannot erase.” Id. at 1547-48 (quoting Raines v. Byrd, 521 U.S. 811, 820, n.3 (1997)). Under established Supreme Court precedent, a plaintiff attempting to establish an injury in fact “must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or 2 In a putative class action lawsuit, “named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 40 n.20 (1976). “[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.” O’Shea v. Littleton, 414 U.S. 488, 494 (1974) (internal quotations omitted). Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 11 of 30 Page ID #:80 5 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 hypothetical.’” Id. at 1548 (quoting Lujan, 504 U.S. at 560). For an injury to be “concrete,” it must be “‘de facto’; that is, it must actually exist.” Id. at 1548 (citing Black’s Law Dictionary 479 (9th ed. 2009)). “For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’” Id. Particularization and concreteness are independent requirements, and a plaintiff must establish both elements to prove standing. Id. In the recent Spokeo decision, the Supreme Court considered an appeal from a decision of the Ninth Circuit, which found that “the violation of a statutory right is usually a sufficient injury in fact to confer standing.” Id. at 1546 (quoting 742 F.3d 409, 413 (9th Cir. 2014)). The Court rejected that contention, holding that a plaintiff does not “automatically” satisfy “the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. at 1549. Instead, “Article III standing requires a concrete injury even in the context of a statutory violation.” Id. The required showing of concrete harm may be based on either a “tangible” or “intangible” injury. Id. But an allegation of “a bare procedural violation, divorced from any concrete harm” is not sufficient to “satisfy the injury-in-fact requirement.” Id. (citing Summers v. Earth Island Institute, 555 U.S. 488, 496 (2009)). In addition to concreteness and particularity, an injury must be “actual or imminent.” Id. at 1548. Imminence requires “that the injury proceed with a high degree of immediacy, so as to reduce the possibility of deciding a case in which no injury would have occurred at all.” Lujan, 504 U.S. at 564 n.2. Additionally, where a threatened injury hinges on speculation about the actions of third parties, standing is less likely to exist. See Clapper, 133 S.Ct. at 1150 (expressing “reluctance to endorse standing theories that rest on speculation about the decisions of independent actors”); id. at 1150 n.5 (“Plaintiffs cannot rely on speculation about the unfettered choices made by independent actors not before the court.”). Although Plaintiff’s Complaint is not entirely clear on this point, Plaintiff Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 12 of 30 Page ID #:81 6 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 appears to allege or attempt to allege a number of potential forms of injury, each of which is discussed in turn below. As shown below, none of these allegations satisfies the requirements for an injury in fact and Plaintiff thus lacks standing. 1. Increased risk of future losses. As an initial matter, it is important to observe that Plaintiff does not allege a prototypical data breach case. In most of the published cases involving data breaches, the plaintiffs’ information was accessed by a hacker who specifically set out to obtain private information for purposes of stealing the plaintiffs’ identity or otherwise misusing their private information. See, e.g., In re SuperValu, Inc., No. 14-MD-2586, 2016 WL 81792, at *4 (D. Minn. Jan. 7, 2016) (collecting cases). By contrast, in this case, Plaintiff alleges only that certain of his personal information was accidentally sent to another “mortgage loan applicant in error.” Cmplt. ¶ 18. Plaintiff does not allege that the other loan applicant has misused his information or will misuse his information or even that the other applicant was aware of receiving the information. Nonetheless, Plaintiff appears to allege (although without any particularity) that he is at an increased risk of future injury. See, e.g., id. ¶¶ 24 (arguing that “credit monitoring and identity theft protection service” offered to him by Citigroup allegedly “is insufficient to protect” him from future injuries); 77 (arguing that Plaintiff “will continue to suffer actual damages”). The Supreme Court addressed potential future losses in data breach cases in Clapper. In that case, the plaintiffs, a group of lawyers, challenged the constitutionality of a section of the Foreign Intelligence Surveillance Act (“FISA”) that authorizes surveillance of individuals who are believed to be located outside of the United States. 133 S. Ct. at 1142. The plaintiffs alleged that their work required them to engage in sensitive international communications with individuals that they suspected were targets of surveillance under FISA. Id. The Court held that the alleged harm was entirely speculative and did not support standing since Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 13 of 30 Page ID #:82 7 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the future injury was not “certainly impending.” Id. at 1148. The Court found that the plaintiffs’ arguments rested on a “highly attenuated chain of possibilities” and was unwilling “to abandon [its] usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors.” Id. at 1148, 1150. Likewise, the Ninth Circuit’s pre-Clapper decision in Krottner v. Starbucks Corp. stressed that a plaintiff alleging a future injury based on a data breach must show that injury presents “a credible threat of harm” and that the harm is “both real and immediate.” 628 F.3d 1139, 1143 (9th Cir. 2010). The court emphasized that standing cannot be based on conjecture but must be actual and imminent. Id. Thus, “the vast majority of courts have held that the risk of future identity theft or fraud is too speculative to constitute an injury in fact for purposes of Article III standing.” SuperValu, 2016 WL 81792, at *4 (collecting cases); see also Reilly v. Ceridian Corp., 664 F.3d 38, 43 (3d Cir. 2011); (“Most courts have held that such plaintiffs lack standing because the harm is too speculative. We agree with the holdings in those cases.”) (internal citations omitted); In re Zappos.com, Inc., 108 F. Supp. 3d 949, 955 (D. Nev. 2015) (“The majority of courts dealing with data-breach cases post-Clapper have held that absent allegations of actual identity theft or other fraud, the increased risk of such harm alone is insufficient to satisfy Article III standing.”). As another recent case explained, “[b]oth before and after the Supreme Court’s decision in Clapper, most courts addressing standing in data breach cases have found that in the absence of some actual identity theft or other act harming the plaintiffs, the increased risk of future harm following a data breach does not constitute an injury in fact for purposes of Article III standing.” Duqum v. Scottrade, No. 15-cv-1537, 2016 WL 3683001, at *3 (E.D. Mo. July 12, 2016); see also, e.g., In re Science App. Int'l Corp. Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 28 (D.D.C. 2014) (“since Clapper... courts have been even more emphatic Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 14 of 30 Page ID #:83 8 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 in rejecting ‘increased risk’ as a theory of standing in data-breach cases.”). 3 For example, in Zappos.com, a hacker accessed personal identifying information from the defendant’s server. 108 F. Supp. 3d at 951. Applying Clapper and Krottner, the court rejected the plaintiffs’ theory “that they suffer an increased threat of future identity theft and fraud as a result of Zappos’s security breach.” Id. at 954. The court explained “[t]he possibility that the alleged harm could transpire in the as-of-yet undetermined future relegates Plaintiffs’ injuries to the realm of speculation.” Id. at 959. The court therefore found that the plaintiffs had failed to allege an actual injury in fact and dismissed the case. Id. at 962. Likewise, in Patton v. Experian Data Corp., another court in this District dismissed similar claims because the allegedly injury was merely a “speculative fear of identity theft” that was not “credible” or a “real and immediate” threat of harm. No. SACV 15-1871, 2016 WL 262801, at *4 (C.D. Cal. May 6, 2016). As courts have explained, the “speculative nature of the threatened injury stems from numerous variables upon which the future harm depends, including whether the hacker: (1) read, copied, and understood [Plaintiffs’] personal information; (2) intends to commit future criminal acts by misusing the 3 See also Chambliss v. Carefirst, Inc., No. RDB-15-2288, 2016 WL 3055299, at *4-5 (D. Md. May 27, 2016) (rejecting risk of future harm as ground for injury in fact); In re Horizon Healthcare Servs., Inc. Data Breach Litig., No. 13-7418, 2015 WL 1472483, at *6 (D.N.J. Mar. 31, 2015) (same); Whalen v. Michael Stores, Inc., No. 14-7006, 2015 WL 9462108, at *4-*5 (E.D.N.Y. Dec. 28, 2015) (same); Green v. eBay, Inc., No. 14-1688, 2015 WL 2066531, at *3 n.33 (E.D. La. May 4, 2015) (same); Storm v. Paytime, Inc., 90 F. Supp. 3d 359, 364-68 (M.D. Pa. 2015) (same); Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d 847, 853-54 (S.D. Tex. 2015) (same); Lewert v. P.F. Chang’s China Bistro, Inc., No. 14-4787, 2014 WL 7005097, at *3 (N.D. Ill. Dec. 10, 2014) (same); Galaria v. Nationwide Mut. Ins. Co., 998 F. Supp. 2d 646, 654-56 (S.D. Ohio 2014) (same); Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871, 876-77 (N.D. Ill. 2014) (same); Remijas v. Neiman Marcus Grp., LLC, No. 14-c-1735, 2014 WL 4627893, at *3 (N.D. Ill. Sept. 16, 2014) (same); Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279, 1280-81 (N.D. Ala. 2014) (same). Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 15 of 30 Page ID #:84 9 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 information; and (3) is able to use such information to the detriment of [Plaintiffs] by making unauthorized transactions in [Plaintiffs’] names.” SuperValu, 2016 WL 81792, at *5 (quoting Reilly, 664 F.3d at 42); Zappos.com, 108 F. Supp. 3d at 959 (future harm depends on capabilities and decisions of person in possession of data). Here, there is no credible allegation that Plaintiff’s information has been misused or will be misused, so “the Court is left to speculate” about the possibility of any future harm. SuperValu, 2016 WL 81792, at *5. And unlike the traditional data breach case, the person who allegedly accessed Plaintiff’s personal information is not alleged to be a hacker who broke into a secured system in an attempt to steal private data for purposes of misuse. Rather, Plaintiff alleges that the information was accidentally sent to another “loan applicant.” Cmplt. ¶ 18. He does not provide any reason to think the loan applicant intends to misuse the information or is capable of misusing the information. SuperValu, 2016 WL 81792, at *5; see also Clapper, 133 S.Ct. at 1150 n.5 (“Plaintiffs cannot rely on speculation about the unfettered choices made by independent actors not before the court.”). Indeed, Plaintiff does not allege that the other loan applicant read or understood the information. SuperValu, 2016 WL 81792, at *5. Accordingly, as in the cases cited above, Plaintiff has “failed to allege sufficient facts to show that future harm” from the alleged disclosure of his information is “certainly impending” or that there is a “substantial risk that the harm will occur.” Id. at *7 (quoting Clapper, 133 S.Ct. at 1147, 1150 n.5); see also Zappos.com, 108 F. Supp. 3d at 958-59. 2. Opportunity and mitigation costs. Plaintiff raises the possibility of harm based on mitigation costs, including “expenses and/or time spent on credit-monitoring and identity theft insurance; time spent scrutinizing bank statements, credit-card statements, and credit reports;” and/or “time spent initiating new mortgage loans.” Cmplt. ¶¶ 77, 90. It should be observed, however, that Plaintiff does not allege that he personally has purchased Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 16 of 30 Page ID #:85 10 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 any credit-monitoring services or identity theft insurance. Indeed, he alleges that Citigroup offered him a “one-year subscription to a credit monitoring and identity theft protection service.” Id. ¶ 24. Nor does Plaintiff allege that he personally has spent any time “scrutinizing” credit statements or reports or that he has initiated any new mortgage loans. Instead, Plaintiff posits these potential harms as issues that may arise at some unspecified time for himself or for other members of the putative class alleged in the Complaint. For this reason alone, Plaintiff’s allegations of opportunity and mitigation costs are too speculative to support an injury in fact. Plaintiff does not allege that he has actually taken any steps to monitor his credit (which is unnecessary given the alleged offer by Citigroup) or to mitigate any alleged damages. Plaintiff thus has failed to allege any facts to show that such monitoring or mitigation costs are “certainly impending.” Clapper, 133 S.Ct. at 1148. In any event, even if Plaintiff could allege that he would certainly incur such opportunity or mitigation costs, the Supreme Court has clearly held that a plaintiff “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Clapper, 133 S.Ct. at 1151. The opposite conclusion would allow “an enterprising plaintiff ... to secure a lower standard for Article III standing simply by making an expenditure based on a non-paranoid fear.” Id. “In other words, the harm must be ‘certainly impending’ before mitigation expenses may be considered as further proof of a cognizable injury.” Chambliss, 2016 WL 3055299, at *5. Accordingly, “[i]n the context of data breach litigation, courts have consistently held that a plaintiff may not use mitigation costs alone to establish a cognizable injury in fact.” Id.; see also SuperValu, 2016 WL 81792, at *7 (“courts consistently hold that the cost to mitigate the risk of future harm does not constitute an injury in fact unless the future harm being mitigated against is itself imminent.”); see also Science Applications, 45 F. Supp. 3d at 26; Zappos.com, 108 Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 17 of 30 Page ID #:86 11 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 F. Supp. 3d at 960-61; Remijas, 794 F.3d at 694. Here, the risk of future harm that would allegedly be mitigated against “is not imminent.” SuperValu, 2016 WL 81792, at *7. Accordingly, “the cost to mitigate the risk is not a sufficient injury in fact to confer Article III standing.” Id. 3. Diminished value of personal information. In alleging that Citigroup purportedly committed conversion of Plaintiff’s personal information, Plaintiff appears to allege that the value of that information has been diminished. Cmplt. ¶ 80. Assuming for the sake of argument that Plaintiff is trying to raise such an allegation, it nonetheless fails to allege an actual injury in fact for purposes of Article III standing. First, Plaintiff has failed to allege that his personal information had any monetary value. Second, even if the information had value, Plaintiff has “failed to allege any facts explaining how” his information “became less valuable as a result” of allegedly being disclosed to another loan applicant. SuperValu, 2016 WL 81792, at *7. Plaintiff has “not alleged” that he “tried to sell” his information but was “not able to do so” or was “forced to accept a lower price.” Id. Therefore, Plaintiff has not “alleged an injury in fact under this theory.” Id.; see also Chambliss, 2016 WL 3055299, at *6 (finding no injury where plaintiffs argued that “their personal information has an intrinsic value that was diminished as a result of the CareFirst data breach”); see also Science Applications, 45 F. Supp. 3d at 30 (finding no injury in fact where the plaintiffs had not alleged that the data breach compelled them to sell their data at a below-value price); Zappos.com, 108 F. Supp. 3d at 953–54 (finding the same); Green, 2015 WL 2066531, at *5 n. 59 (“Even if the Court were to find that personal information has an inherent value ... Plaintiff has failed to allege facts indicating how the value of his personal information has decreased as a result of the Data Breach.”). 4. Delayed or inadequate notification. Plaintiff further alleges that he was injured by Citigroup’s allegedly delayed Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 18 of 30 Page ID #:87 12 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 or inadequate notification that his personal information allegedly had been sent to another mortgage loan applicant. Cmplt. ¶¶ 52, 71. As the court explained in SuperValu, however, such allegations do not create an actual injury in fact without some allegation that the delay or inadequacy caused the plaintiff some harm. 2016 WL 81792, at *7. Any delay or inability to mitigate alleged damages as a result of a delayed or inadequate disclosure is not sufficient to constitute an injury in fact “unless the risk of future harm is imminent.” Id.; see also In re Barnes & Noble Pin Pad Litig., No. 12-8617, 2013 WL 4759588, at *3 (N.D. Ill. Sept. 3, 2013) (“[e]ven assuming the statutes have been violated by the delay or inadequacy of [Defendants’] notification, breach of these statutes is insufficient to establish standing without any actual damages due to the breach.”). 5. Invasion of privacy. Plaintiff also appears to allege that he was harmed by the alleged invasion of privacy. Cmplt. ¶¶ 88-90. However, as in SuperValu, Plaintiff has “not alleged facts showing that the loss of privacy and confidentiality resulted in a concrete injury.” 2016 WL 81792, at *8. Therefore, “this theory of standing also fails.” Id.; see also Zappos.com, 108 F. Supp. 3d at 962, n.5 (finding no Article III standing under a loss of privacy theory because plaintiffs “failed to show how that loss amounts to a concrete and particularized injury”). 6. Lost benefit of bargain. Plaintiff may also be alleging that he was harmed by allegedly losing the benefit of the bargain made when he allegedly received a mortgage loan from Citigroup. Cmplt. ¶ 25 (alleging that Plaintiff would not have taken out the loan if he had “known about” Citigroup’s allegedly “ineffective privacy protection”). As the SuperValu court explained, “[t]his theory is consistently rejected in data breach cases where plaintiffs have not alleged that the value of the goods or services they purchased was diminished as a result of the data breach.” 2016 WL 81792, at *8. For example, in Zappos.com, the court rejected the benefit-of-the-bargain Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 19 of 30 Page ID #:88 13 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 theory because the plaintiffs failed to explain how the data breach affected the value of the goods purchased. 108 F. Supp. 3d at 962, n.5. The court further observed that the plaintiffs had not alleged any facts “showing how the price they paid for such goods incorporated some particular sum that was understood by both parties to be allocated towards the protection of customer data.” Id.; see also Chambliss, 2016 WL 3055299, at *5-6; Remijas, 794 F.3d at 694-95 (stating that benefit-of-the-bargain injuries or “would not have shopped” damages are “dubious”); Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016) (explaining that such arguments have “been adopted by courts only where the product itself was defective or dangerous and consumers claim they would not have bought it (or paid a premium for it) had they known of the defect.”). As in these cases, Plaintiff does not allege any facts to suggest that the value of his mortgage loan was diminished when his information allegedly was shared with another loan applicant. Thus, Plaintiff has “not alleged any benefit-of-the- bargain loss that could constitute a cognizable injury in fact.” Chambliss, 2016 WL 3055299, at *6. 7. Anxiety and emotional distress. Plaintiff additionally attempts to allege purported injury in the form of “anxiety” and “emotional distress.” Cmplt. ¶ 90. However, courts have explained that “[e]motional distress in the wake of a security breach is insufficient to establish standing, particularly in a case that does not involve an imminent threat to the information.” Barnes & Noble, 2013 WL 4759588, at *5; see also Reilly, 664 F.3d at 42-43 (rejecting standing for an emotional distress claim in a data security breach case and noting “The hacker did not change or injure Appellants’ bodies; any harm that may occur—if all of Appellants’ stated fears are actually realized— may be redressed in due time through money damages after the harm occurs with no fear that litigants will be dead or disabled from the onset of the injury.”). Here, as shown above, Plaintiff has not alleged any facts to suggest that Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 20 of 30 Page ID #:89 14 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 there is “an imminent threat” to him from the information that allegedly was disclosed to another loan applicant by accident. Barnes & Noble, 2013 WL 4759588, at *5. His alleged anxiety and purported emotion distress are not sufficient to give rise to an injury in fact for standing purposes. 8. Alleged statutory violations. Finally, it is possible that Plaintiff is alleging that the alleged statutory violations pled in the Complaint, standing alone, are sufficient to give rise to an injury in fact. See Cmplt. ¶¶ 55, 63. As shown below, Plaintiff’s statutory claims are without merit. In any event, Plaintiff’s theory cannot survive the Supreme Court’s decision in Spokeo, in which the Court held “Article III standing requires a concrete injury even in the context of a statutory violation.” 136 S. Ct. at 1553. Thus, for example, in the recent case of Khan v. Children’s Nat’l Health Sys., the court applied Spokeo and rejected a claim by a plaintiff in a data breach case that “the violations of state statutes and common law alleged in the Complaint establish standing.” No. TDC-15-2125, 2016 WL 2946165, at *7 (D. Md. May 19, 2016). The court found no support for the argument that “a state legislature or court, through a state statute or cause of action, can manufacture Article III standing for a litigant who has not suffered a concrete injury.” Id. (citing Hollingsworth v. Perry, 133 S. Ct. 2652, 2667-68 (2013)); c.f. Lee v. Am. Nat’l Ins. Co., 260 F.3d 997, 1001-02 (9th Cir. 2001) (“[A] plaintiff whose cause of action is perfectly viable in state court under state law may nonetheless be foreclosed from litigating the same cause of action in federal court, if he cannot demonstrate the requisite injury.”). Accordingly, none of Plaintiff’s alleged forms of injury are sufficient to give rise to an injury in fact for purposes of Article III standing. Therefore, Plaintiff cannot meet his burden of demonstrating subject matter jurisdiction, and this case should be dismissed under Rule 12(b)(1). Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 21 of 30 Page ID #:90 15 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 II. MOTION TO DISMISS UNDER RULE 12(b)(6) FOR FAILURE TO STATE A CLAIM A. LEGAL STANDARD In order to survive a motion to dismiss for failure to state a claim under Rule 12(b)(6), a plaintiff must allege “enough facts to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 697 (2009) (quoting Bell Atlantic v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678 (citing Twombly, 550 U.S. at 556). At the motion to dismiss stage, a court “need not assume the truth of legal conclusions cast in the form of factual allegations.” Gutierrez v. Bank of Am, N.A., 2014 WL 1379883, at *3 (E.D. Cal. Apr. 8, 2014) (quoting United States ex rel. Chunie v. Ringrose, 788 F.2d 638, 643 n.2 (9th Cir. 1986)). A pleading is insufficient if it offers mere “labels and conclusions” or “a formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555; see also Iqbal, 556 U.S. at 678 (“Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.”). It is inappropriate to assume that the plaintiff “can prove facts that it has not alleged or that the defendants have violated the ... laws in ways that have not been alleged[.]” Assoc. Gen. Contractors of Cal. v. Cal. State Council of Carpenters, 459 U.S. 519, 526 (1983). B. PLAINTIFF FAILS TO STATE A VIABLE CLAIM FOR RELIEF. As shown above, Plaintiff lacks standing and this case is therefore subject to dismissal under Rule 12(b)(1). Accordingly, the Court need not reach the issue of whether Plaintiff has stated a viable claim under Rule 12(b)(6). However, in the alternative to Citigroup’s standing argument, Plaintiff also fails to state a viable claim for relief on any of the six causes of action pled in his Complaint. Thus, his Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 22 of 30 Page ID #:91 16 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 claims are subject to dismissal under Rule 12(b)(6) and, since amendment would be futile, dismissal should be granted with prejudice. 1. The California “Data Breach Act” Plaintiff’s first cause of action alleges that Citigroup purportedly violated the “California Data Breach Act,” Cal. Civ. Code §§ 1798.80, et seq. Cmplt. ¶¶ 42-56. Specifically, Plaintiff alleges that Citigroup violated two sections of the Act, § 1798.81.5 and § 1798.82. Id. ¶¶ 44-45. Section 1798.81.5 protects “personal information about California residents” by requiring businesses that “own, license, or maintain personal information about Californians to provide reasonable security for that information.” Cal. Civ. Code § 1798.81.5(a)(1). 4 “A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” Id. § 1798.81.5(b). Section 1798.82 has procedures for notifying California residences when their unencrypted personal information is disclosed in a data breach and thereby acquired by (or reasonably believed to have been acquired by) an unauthorized person. Id. § 1798.82(a). The statute provides that the business “shall disclose” the breach and “shall notify” the affected persons. Id. § 1798.82(a)-(b). Notice can be delayed if a law-enforcement agency determines that notification will impede a criminal investigation. Id. § 1798.82(c). 4 The statute defines “personal information” as an individual’s first name (or first initial) and last name with one or more of the following: (1) social security number; (2) driver’s license number or California identification-card number; (3) account number or debit or credit card number in combination with the security code, access code, or password that permits access to that financial account, and (4) medical information in the form of medical history, treatment, or diagnosis. Cal. Civ. Code § 1798.81.5(d). Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 23 of 30 Page ID #:92 17 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Section 1798.84(b) provides a private right of action authorizing “[a]ny customer injured by a violation of this title” to “institute a civil action to recover damages.” Id. § 1798.84(b). A business also may be enjoined. Id. § 1798.84(e). Plaintiff’s claims under the Data Breach Act fail for at least two independent reasons. First, Plaintiff has not alleged facts sufficient to plausibly state a claim under the Act. Section1798.81.5 does not purport to cover all accidental disclosures of information. Instead, it requires covered entities to “implement and maintain reasonable security procedures and practices.” Cal. Civ. Code § 1798.81.5(b). Plaintiff’s claim under Section 1798.81.5 is premised on his allegation that his personal information was accidentally provided to another loan applicant. Id. ¶¶ 18-19. Plaintiff’s remaining allegations about Citigroup’s policies and procedures are “mere conclusory statements” that are not entitled to any weight. Iqbal, 556 U.S. at 678; see, e.g., Cmplt. ¶ 50 (alleging Citigroup “failed to provide reasonable and adequate security measures”). Plaintiff’s allegation that his information was accidentally provided to another loan applicant fails to plausibly suggest that Citigroup’s policies and procedures are not “reasonable.” Accordingly, Plaintiff cannot state a claim under Section 1798.81.5. Plaintiff likewise cannot state a claim under Section 1798.82, which requires a covered entity to notify affected customers of a data breach “in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement.” Cal. Civ. Code § 1798.82(a). Plaintiff does not allege when he received the notification letter but alleges that it was “approximately four months after” the alleged data breach occurred. Cmplt. ¶ 22. Plaintiff fails to allege any non-conclusory facts to suggest that the notification was not provided “in the most expedient time possible.” For example, Plaintiff does not allege when Citigroup learned of the alleged provision of the information to the other loan applicant. Nor does Plaintiff provide any suggestion as to what time Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 24 of 30 Page ID #:93 18 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 period would be considered sufficiently “expedient.” In short, Plaintiff’s allegations with regard to Section 1798.82 are conclusory and are not sufficient to raise a plausible claim that Citigroup violation that statute. Second, the private right of action in the Data Breach Act extends only to customers “injured by a violation of this title.” Cal. Civ. Code § 1798.84(b). As set forth supra in Section (I), Plaintiff cannot allege any actionable injury under the statute. Thus, Plaintiff cannot state a claim under the Data Breach Act. 2. The Unfair Competition Law Plaintiff’s second cause of action is a boilerplate count under the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code §§ 17200, et seq. Cmplt. ¶¶ 57-64. The UCL allows plaintiffs to bring claims for injunctive relief and restitution only with respect to allegedly unlawful, fraudulent, or unfair business practices. Cal. Bus. & Prof. Code § 17200; Guttierez v. Wells Fargo Bank, NA, 704 F.3d 712, 717 (9th Cir. 2012). However, Plaintiff’s allegations cannot state a UCL claim under any of those three prongs. First, Plaintiff’s “unlawful” claim fails because it is premised on alleged violations of the Data Breach Act, Cal. Civ. Code §§ 1798.81.5 and 1798.82. Cmplt. ¶ 59. As explained supra, however, Plaintiff’s claim under the Data Breach Act fails as a matter of law. See Berryman v. Merit Property Mgmt., Inc., 152 Cal. App. 4th 1544 (Cal. App. 4th Dist. 2007) (affirming dismissal of unlawful claim where plaintiff failed to satisfy elements of a violation of the laws underlying UCL claim). 5 Second, Plaintiff’s “fraud” claim fails because his boilerplate allegations fail to satisfy Rule 9(b)’s heightened pleading standards. Kearns v. Ford Mot. Co., 567 F.3d 1120, 1125 (9th Cir. 2009). Third, Plaintiff’s “unfair” claim fails because 5 Plaintiff’s alleged common law causes of action (Counts III-VI) cannot form the predicate of a claim under the UCL. Shroyer v. New Cingular Wireless Servs., 622 F.3d 1035, 1044 (9th Cir. 2010) (“a common law violation such as breach of contract is insufficient” to satisfy the “unlawful” prong). Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 25 of 30 Page ID #:94 19 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 his conclusory allegations fail to identify any alleged policy or practice of Citigroup that “either offends an established public policy or is immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.” McDonald v. Coldwell Banker, 543 F.3d 498, 506 (9th Cir. 2008) (quotations and citations omitted). 3. Negligence Plaintiff’s third cause of action alleges negligence. Cmplt. ¶¶ 65-73. To establish a negligence claim, “it must be shown that (1) the defendant owed the plaintiff a legal duty, (2) the defendant breached that duty, and (3) the breach was a proximate or legal cause of the plaintiff’s injuries.” Sipe v. Countrywide Bank, 690 F. Supp. 2d 1141, 1152 (E.D. Cal. 2010). “The absence of any one of these three elements is fatal to a negligence claim.” Id. (quoting Gilmer v. Ellington, 159 Cal. App. 4th 190, 195, 70 Cal. Rptr. 3d 893 (2008)). “The existence of a legal duty to use reasonable care in a particular factual situation is a question of law for the court to decide.” Id. (quoting Vasquez v. Residential Invs., Inc., 118 Cal. App. 4th 269, 278, 12 Cal. Rptr. 3d 846 (2004)). Here, Plaintiff cannot allege that Citigroup had any legal duty to him. Plaintiff alleges that he purportedly took out a mortgage loan from Citigroup. Cmplt. ¶¶ 16- 17. “Under California law, a lender does not owe a borrower or third party any duties beyond those expressed in the loan agreement, except those imposed due to special circumstance.” Sipe, 690 F. Supp. 2d at 1153 (quoting Resolution Trust Corp. v. BVS Dev., 42 F.3d 1206, 1214 (9th Cir. 1994)). “Special circumstances arise when the lender ‘actively participates in the financed enterprise beyond the domain of the usual money lender.’” Id. (quoting Wagner v. Benson, 101 Cal. App. 3d 27, 35, 161 Cal. Rptr. 516 (1980)). Plaintiff does not allege any such special circumstances here. Accordingly, he cannot allege any legal duty that Citigroup owed to him. Thus, Plaintiff also cannot allege that Citigroup breached any duty or that such breach caused him injury. Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 26 of 30 Page ID #:95 20 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 4. Negligence per se Plaintiff’s fourth cause of action alleges negligence per se. Cmplt. ¶¶ 74-77. Under California’s negligence per se doctrine codified in California Evidence Code section 669, “violation of a statute gives rise to a presumption of negligence in the absence of justification or excuse, provided that the ‘person suffering ... the injury ... was one of the class of persons for whose protection the statute ... was adopted.’” Beaver v. Tarsadia Hotels, 29 F. Supp. 3d 1294, 1321 (S.D. Cal. 2014) (quoting Walters v. Sloan, 20 Cal. 3d 199, 206-07, 142 Cal. Rptr. 152 (1977)). Negligence per se is simply a codified evidentiary doctrine, and thus the doctrine of negligence per se does not establish tort liability. Id. (citing People of California v. Kinder Morgan Energy Partners, L.P., 569 F. Supp. 2d 1073, 1087 (S.D.Cal. 2008)). “To apply negligence per se is not to state an independent cause of action under California law because the doctrine does not provide a private right of action for violation of a statute.” Id. (citing Kinder Morgan, 569 F. Supp. 2d at 1087). “Under California law, an underlying claim of ordinary negligence must be viable before the presumption of negligence per se based on the violation of a statute, regulation, or ordinance may be employed.” Id. (citing Rosales v. City of Los Angeles, 82 Cal. App. 4th 419, 430, 98 Cal. Rptr. 2d 144 (2000)). Accordingly, negligence per se does not give rise to an independent cause of action under California law, and Plaintiff’s claim should be dismissed on this ground alone. In addition, Plaintiff relies on the alleged violation of the Data Breach Act to support his negligence per se claim (Cmplt. ¶ 75) and, as explained above in Part II.B.1, Plaintiff cannot state a claim for violation of the Data Breach Act. Plaintiff also cannot state an underlying negligence claim for the reasons set forth above. 5. Conversion Plaintiff’s fifth cause of action alleges conversion. Cmplt. ¶¶ 78-82. To establish conversion under California law, a plaintiff must show “ownership or Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 27 of 30 Page ID #:96 21 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 right to possession of property, wrongful disposition of the property right, and damages.” In re iPhone Application Litig., 844 F. Supp. 2d 1040, 1074 (N.D. Cal. 2012) (citing Kremen v. Cohen, 337 F.3d 1024, 1029 (9th Cir. 2003)). With respect to the first element, courts apply a three-part test to determine whether a property right exists: “[f]irst, there must be an interest capable of precise definition; second, it must be capable of exclusive possession or control; and third, the putative owner must have established a legitimate claim to exclusivity.” Id. (citing Kremen, 337 F.3d at 1029). Plaintiff argues that he had a property right over his personal information, however, “the weight of authority holds that a plaintiff’s ‘personal information’ does not constitute property.” Id. (citing Thompson v. Home Depot, Inc., No. 07-cv-1058 IEG, 2007 WL 2746603, at *3 (S.D. Cal. Sept. 18, 2007); In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 713-14 (N.D. Cal. May 12, 2011)); see also Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1030 (N.D. Cal. 2012). As courts have explained, personal information constitutes a “broad category of information” and “it is difficult to see how this broad category of information is capable of exclusive possession or control.” iPhone Application Litig., 844 F. Supp. 2d at 1074. Plaintiff also cannot allege any damages resulting from the alleged conversion. As discussed supra in Section I, Plaintiff has not alleged an actual injury or damages resulting from the alleged provision of his personal information to another loan applicant. Accordingly, he cannot allege “how he was ‘deprived of the economic value of [his] personal information.’” Low, 900 F. Supp. 2d at 1030. 6. Invasion of privacy Plaintiff’s sixth and final cause of action alleges “invasion of privacy.” Cmplt. ¶¶ 83-90. The California Constitution creates a privacy right that protects individuals from the invasion of their privacy by private parties. Low, 900 F. Supp. 2d at 1024. “To establish a claim under the California Constitutional right to privacy, a plaintiff must first demonstrate three elements: (1) a legally protected Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 28 of 30 Page ID #:97 22 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 privacy interest; (2) a reasonable expectation of privacy under the circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the protected privacy interest.” Id. (citing Hill v. Nat'l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 35-37, 26 Cal. Rptr. 2d 834, 865 P.2d 633 (1994)). “These elements do not constitute a categorical test, but rather serve as threshold components of a valid claim to be used to ‘weed out claims that involve so insignificant or de minimis an intrusion on a constitutionally protected privacy interest as not even to require an explanation or justification by the defendant.’” Id. (citing Loder v. City of Glendale, 14 Cal. 4th 846, 893, 59 Cal. Rptr. 2d 696, 927 P.2d 1200 (1997)). “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right.” Id. at 1025 (citing Hill, 7 Cal. 4th at 37, 26 Cal. Rptr. 2d 834, 865 P.2d 633). Thus, if the allegations “show no reasonable expectation of privacy or an insubstantial impact on privacy interests, the question of invasion may be adjudicated as a matter of law.” Id. (citing Pioneer Elec., Inc. v. Sup. Ct. of L.A., 40 Cal. 4th 360, 370, 53 Cal. Rptr. 3d 513 (2007)). A “claim for common law invasion of privacy must meet similarly high standards for the type of invasion that is actionable.” Id. “Under a claim for common law ‘invasion of privacy’ tort, Plaintiff must allege: (1) intrusion into a private place, conversation or matter (2) in a manner highly offensive to a reasonable person.” Id. (citing Shulman v. Group W Prods., Inc., 18 Cal. 4th 200, 231, 74 Cal. Rptr. 2d 843, 955 P.2d 469 (1998)) (emphasis in original). As courts have explained, “disclosure of personal information, including social security numbers, does not constitute an ‘egregious breach of the social norms’ to establish an invasion of privacy claim.” Id. (emphasis added); see also iPhone Application Litig., 844 F. Supp. 2d at 1063 (N.D. Cal. 2012) (holding that the disclosure to third parties of unique device identifier number, personal data, and geolocation information did not constitute an egregious breach of privacy); Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 29 of 30 Page ID #:98 23 DEFENDANT CITIGROUP INC.’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF ITS MOTION TO DISMISS; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121, 1127-28 (N.D. Cal. 2008) aff'd, 380 F. App’x. 689 (9th Cir. 2010) (holding that the theft of a retail store’s laptop containing personal information, including the social security numbers, of job applicants did not constitute an egregious breach of privacy and therefore was not sufficient to state a claim for the California Constitutional right to privacy). As in these cases, Plaintiff’s allegation here that his personal information— including his social security number—was accidentally provided to another loan applicant fails “to establish a highly offensive disclosure of information or a ‘serious invasion’ of a privacy interest.” Low, 900 F. Supp. 2d at 1025. Accordingly, Plaintiff’s invasion of privacy claim fails as a matter of law. Id. at 1025-26 (dismissing invasion of privacy claim premised on allegation that defendant disclosed plaintiffs’ personal information to third parties). C. THE DEFECTS IN PLAINTIFF’S CLAIMS CANNOT BE CURED BY AMENDMENT. As shown above, Plaintiff’s claims all suffer from fundamental defects that cannot be cured by amendment. Accordingly, allowing Plaintiff to amend those claims would be futile and amendment should not be granted. See Low, 900 F. Supp. 2d at 1033 (dismissing similar claims alleging unlawful disclosure of private information without granting leave to amend because amendment would be futile). CONCLUSION For the reasons stated above, Plaintiff’s claims against Citigroup should be dismissed under Rule 12(b)(1) or, in the alternative, should be dismissed with prejudice under Rule 12(b)(6). Dated: August 2, 2016 MAYER BROWN LLP By: /s/ Andrew Z. Edelstein Andrew Z. Edelstein Attorney for Defendant CITIGROUP INC. Case 2:16-cv-03466-FMO-RAO Document 12-1 Filed 08/02/16 Page 30 of 30 Page ID #:99 [PROPOSED] ORDER; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 MAYER BROWN LLP BRONWYN F. POLLOCK (SBN 210912) bpollock@mayerbrown.com ANDREW Z. EDELSTEIN (SBN 218023) aedelstein@mayerbrown.com 350 South Grand Avenue, 25th Floor Los Angeles, CA 90071-1503 Telephone: (213) 229-9500 Facsimile: (213) 625-0248 MAYER BROWN LLP LUCIA NALE (Pro Hac Vice to follow) lnale@mayerbrown.com DEBRA BOGO-ERNST (Pro Hac Vice to follow) dernst@mayerbrown.com MICHAEL H. BORNHORST (Pro Hac Vice to follow) mbornhorst@mayerbrown.com CHRISTOPHER S. COMSTOCK (Pro Hac Vice to follow) ccomstock@mayerbrown.com 71 South Wacker Drive Chicago, IL 60606-7463 Telephone: (312) 782-0600 Facsimile: (312) 701-7711 Attorneys for Defendant CITIGROUP INC. UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA – WESTERN DIVISION ARIK LAINER, on behalf of himself and all others similarly situated, Plaintiffs, v. CITIGROUP INC. Defendant. Case No. 2:16-cv-03466-FMO-RAO [PROPOSED] ORDER AS TO DEFENDANT CITIGROUP INC.’S MOTION TO DISMISS Complaint Filed: 05/19/16 Case 2:16-cv-03466-FMO-RAO Document 12-2 Filed 08/02/16 Page 1 of 2 Page ID #:100 1 [PROPOSED] ORDER; CASE NO. 2:16-CV-03466-FMO-RAO 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 This matter coming before the Court on Defendant Citigroup Inc.’s Motion to Dismiss pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6), it is hereby ordered that the motion is GRANTED. Plaintiff’s Complaint is DISMISSED in its entirety with prejudice. SO ORDERED Date: __________________ ___________________________ United States District Judge Case 2:16-cv-03466-FMO-RAO Document 12-2 Filed 08/02/16 Page 2 of 2 Page ID #:101