In re Google, Inc. Privacy Policy Litigation

RESPONSE

N.D. Cal.April 10, 2015

PLAINTIFFS’ MEMO. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 GARDY & NOTIS, LLP Mark C. Gardy James S. Notis (pro hac vice) Orin Kurtz (pro hac vice) 560 Sylvan Avenue Englewood Cliffs, New Jersey 07632 Tel: 201-567-7377 Fax: 201-567-7337 GRANT & EISENHOFER P.A. James J. Sabella (pro hac vice) Diane Zilka (pro hac vice) Kyle McGee (pro hac vice) 485 Lexington Avenue, 29th Floor New York, New York 10017 Tel: 646-722-8500 Fax: 646-722-8501 BURSOR & FISHER, P.A. L. Timothy Fisher (State Bar No. 191626) 1990 North California Boulevard, Suite 940 Walnut Creek, California 94596 Tel: 925-300-4455 Fax: 925-407-2700 Interim Co-Lead Counsel for the Class and Subclasses [Additional counsel listed on signature page] UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION CASE NO. 12-CV-01382 PSG IN RE GOOGLE, INC. PRIVACY POLICY LITIGATION PLAINTIFFS’ MEMORANDUM OF POINTS AND AUTHORITIES IN OPPOSITION TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT Date: April 28, 2015 Time: 10:00 a.m. Courtroom: 5 – 4th Floor Judge: Honorable Paul Singh Grewal Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page1 of 34 i PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF CONTENTS Page TABLE OF AUTHORITIES ................................................................................................................ ii INTRODUCTION .................................................................................................................................1 FACTUAL SUMMARY .......................................................................................................................3 I. PUBLICATION OF USER INFORMATION OCCURS DURING THE PURCHASE PROCESS. .................................................................................................................................3 II. PUBLICATION OF USER INFORMATION VIOLATES GOOGLE’S AGREEMENTS WITH CLASS MEMBERS. ..........................................................................5 ARGUMENT .........................................................................................................................................7 I. APPLICABLE LEGAL STANDARDS. ...................................................................................7 II. PLAINTIFFS HAVE ARTICLE III STANDING. ....................................................................8 A. ROBERTSON IS PERSUASIVE AUTHORITY THAT SUPPORTS A FINDING OF ARTICLE III STANDING. ................................................................................................10 B. PLAINTIFFS SUFFERED ECONOMIC INJURY AS A RESULT OF GOOGLE’S UNAUTHORIZED DISSEMINATION OF PLAINTIFFS’ PERSONALLY IDENTIFYING INFORMATION. ..............................................................................................................12 C. PLAINTIFFS SUFFERED LOSS OF DEVICE RESOURCES EACH TIME THEY PURCHASED APPS. ........................................................................................................16 D. GOOGLE’S UNAUTHORIZED DISSEMINATION OF PLAINTIFFS’ PERSONAL INFORMATION FURNISHES ARTICLE III STANDING. .......................................................17 III. GENUINE ISSUES OF MATERIAL FACT PREVENT ENTRY OF SUMMARY JUDGMENT ON PLAINTIFFS’ CONTRACT CLAIM. .......................................................19 A. THERE IS A TRIABLE ISSUE AS TO PLAINTIFFS’ CONTRACT DAMAGES. .......................19 B. THERE ARE TRIABLE ISSUES AS TO THE OTHER ELEMENTS OF PLAINTIFFS’ CONTRACT CLAIMS. ......................................................................................................22 IV. GENUINE ISSUES OF MATERIAL FACT PREVENT ENTRY OF SUMMARY JUDGMENT ON PLAINTIFFS’ UCL CLAIMS....................................................................24 V. IN THE EVENT THE MOTION IS GRANTED DUE TO LACK OF STANDING, PLAINTIFFS REQUEST LIMITED LEAVE TO REPLEAD. ..............................................25 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page2 of 34 ii PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Page(s) Anderson v. Liberty Lobby, Inc., 477 U.S. 242 (1986) .........................................................................................................................8 Anderson v. United Finance Co., 666 F.2d 1274 (9th Cir. 1982) .......................................................................................................21 Asis Internet Servs. v. Member Source Media, LLC, No. 08-cv-1321, 2010 U.S. Dist. LEXIS 7055 (N.D. Cal. Jan. 28, 2010) .....................................11 Caballero v. Comm’r of Social Security, No. 12-cv-2357, 2014 U.S. Dist. LEXIS 116315 (E.D. Cal. Aug. 20, 2014) ................................10 Capell Associates, Inc. v. Central Valley Security Co., 260 Cal. App. 2d 773, 67 Cal. Rptr. 463 (Cal. Ct. App. 1968) ......................................................20 Chevron Corp. v. Pennzoil Co., 974 F.2d 1156 (9th Cir. 1992) .........................................................................................................8 Claridge v. RockYou, Inc., 785 F. Supp. 2d 855 (N.D. Cal. 2011) .....................................................................................13, 20 Colwell v. Dept. of Health & Human Servs., 558 F.3d 1112 (9th Cir. 2009) .........................................................................................................9 Cooper v. F.A.A., 596 F.3d 538 (9th Cir. 2010), rev’d, F.A.A. v. Cooper, 132 S. Ct. 1441 (2012) ...........................22 Cummings v. Connell, 402 F.3d 936 (9th Cir. 2005) .........................................................................................................21 Dreier v. United States, 106 F.3d 844 (9th Cir. 1996) .......................................................................................................8, 9 Duong v. Astrue, No. 11-cv-00347, 2012 U.S. Dist. LEXIS 119195 (E.D. Cal. Aug. 22, 2012) ..............................10 Ehret v. Uber Techs., Inc., No. 14-cv-0113, 2014 WL 4640170 (N.D. Cal. Sept. 17, 2014) ...................................................17 Friedman v. Sidley, No. B145784, 2002 WL 124277 (Cal. Ct. App. 2002) ..................................................................19 Gautier v. Gen. Tel. Co., 44 Cal. Rptr. 404 (Cal. Ct. App. 1965) ..........................................................................................19 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page3 of 34 iii PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Goodman v. HTC Am., Inc., No. 11-cv-1793, 2012 WL 2412070 (W.D. Wash. June 26, 2012) ...............................................17 Guimond v. Trans Union Credit Info. Co., 45 F.3d 1329 (9th Cir. 1995) .........................................................................................................21 Hadley v. Baxendale, 1854 WL 7208, 9 Exch. 341, 156 Eng. Rep. 145 (Feb. 23, 1854).................................................20 Hicks v. Dairyland Ins. Co., 441 F. App’x 463 (9th Cir. 2011) ..................................................................................................10 In re Adobe Sys., Inc. Privacy Litig., No. 13-cv-05226, 2014 WL 4379916 (N.D. Cal. Sept. 4, 2014) ...................................................18 In re Carrier IQ, Inc., No. 12-cv-2330, 2015 WL 274054 (N.D. Cal. Jan. 21, 2015) .......................................................17 In re Facebook Privacy Litig., No. 10-cv-02389, 2011 WL 6176208 (N.D. Cal. Nov. 22, 2011) .................................................13 In re Google Android Consumer Privacy Litig., No. 11-md-02264, 2013 WL 1283236 (N.D. Cal. Mar. 26, 2013) ................................................15 In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2014 WL 3707508 (N.D. Cal. July 21, 2014) ........................................8, 17, 25 In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2012 WL 6738343 (N.D. Cal. Dec. 28, 2012) ..................................................15 In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2013 WL 6248499 (N.D. Cal. Dec. 3, 2013) ..............................................15, 17 In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942 (S.D. Cal. 2014) ............................................................................................18 Irving v. Lennar Corp., No. 12-cv-0290, 2014 U.S. Dist. LEXIS 54257 (E.D. Cal. Apr. 16, 2014) .................................11 Jeanty v. McKey & Poague, Inc., 496 F.2d 1119 (7th Cir. 1974) .......................................................................................................22 Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) .......................................................................................................18 Leslie Salt Co. v. United States, 55 F.3d 1388 (9th Cir. 1995) .........................................................................................................11 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page4 of 34 iv PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Low v. LinkedIn, Corp., No. 11-cv-01468, 2011 WL 5509848 (N.D. Cal. Nov. 11, 2011) .................................................15 Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) ...........................................................................................................7, 8, 9, 19 Martinez v. Holland, No. 13-cv-3007, 2014 U.S. Dist. LEXIS 166890 (S.D. Cal. May 12, 2014) ................................11 McCarthy v. U.S., 850 F.2d 558 (9th Cir. 1988) ...........................................................................................................7 McCarty v. Beach, 10 Cal. 461 (1858) .....................................................................................................................1, 19 MDPhysicians & Assoc., Inc. v. State Bd. of Ins., 957 F.2d 178 (5th Cir. 1992) ...........................................................................................................9 Munson v. Splice Commc’ns, Inc., No. 12-cv-05089, 2013 WL 6659454 (N.D. Cal. Dec. 16, 2013) ..................................................24 O’Connor v. Astrue, No. 09-cv-01508, 2010 U.S. Dist. LEXIS 101668 (N.D. Cal. Sept. 27, 2010) .............................10 Opperman v. Path, Inc., No. 13-cv-00453, 2014 WL 1973378 (N.D. Cal. May 14, 2014) ....................................................9 Plantronics, Inc. v. Am. Home Assur. Co., No. 07-cv-06038, 2014 U.S. Dist. LEXIS 75557 (N.D. Cal. May 30, 2014) ................................12 Prospect Med., P.C v. Cigna Corp., No. 09-cv-5912, 2013 U.S. Dist. LEXIS 85753 (D.N.J. June 19, 2013) ......................................12 Public Lands for the People, Inc. v. United States Dept. of Agriculture, 697 F.3d 1192 (9th Cir. 2012) .........................................................................................................9 Roberts Dist. Co. v. Kaye-Halbert Corp., 126 Cal. App. 2d 664, 272 P.2d 886 (Cal. Ct. App. 1954) ............................................................20 Robertson v. Facebook, Inc., 572 F. App’x 494 (9th Cir. 2014) .......................................................................................... passim Ruiz v. Gap, Inc., 380 F. App’x 689 (9th Cir. 2010) ............................................................................................20, 21 Russell v. Comm’r of Internal Revenue, 678 F.2d 782 (9th Cir. 1982) .........................................................................................................11 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page5 of 34 v PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 San Diego Gun Rights Comm. v. Reno, 98 F.3d 1121 (9th Cir. 1996) ...................................................................................................12, 13 Sandoval v. County of Sonoma, No. 11-cv-05817, 2014 U.S. Dist. LEXIS 12400 (N.D. Cal. Jan. 31, 2014) .................................10 Sierra Club v. Morton, 405 U.S. 727 (1972) .................................................................................................................12, 16 Sill Prop., Inc. v. CMAG, Inc., 219 Cal. App. 2d 42, 33 Cal. Rptr. 155 (Cal. Ct. App 1963) .........................................................20 Svenson v. Google Inc., No. 13-cv-04080, Dkt. No. 118, at 8-9 (N.D. Cal. Apr. 1, 2015) ............................................15, 16 Sweet v. Johnson, 169 Cal. App. 2d 630, 337 P.2d 499 (Cal. Ct. App. 1959) ............................................................19 Trujillo v. Warden, No. 12-cv-02627, 2014 U.S. Dist. LEXIS 73971 (E.D. Cal. May 28, 2014) ................................10 United States v. Diebold, Inc., 369 U.S. 654 (1962) .........................................................................................................................8 United States ex rel. Feingold v. AdminaStar Federal, Inc., 324 F.3d 492 (7th Cir. 2003) .........................................................................................................23 United States v. Van Alstyne, 584 F.3d 803 (9th Cir. 2009) .........................................................................................................11 Xebec Dev. Partners, Ltd. v. Natl. Union Fire Ins. Co., 12 Cal. App. 4th 501, 15 Cal. Rptr. 2d 726 (Cal. Ct. App. 1993), overruled, 137 P.3d 192 (2006) .......................................................................................................................19 STATUTES AND RULES 5 U.S.C. § 552 ......................................................................................................................................22 28 U.S.C. § 1332(d) ...............................................................................................................................9 28 U.S.C. § 1367 ....................................................................................................................................9 42 U.S.C. § 3612(c) .............................................................................................................................21 Fed. R. Civ. P. 12(b)(1)..........................................................................................................................7 Fed. R. Civ. P. 12(b)(6)..........................................................................................................................7 Fed. R. Civ. P. 56(a) .........................................................................................................................7, 8 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page6 of 34 vi PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Cal. Civ. Code § 3300 ....................................................................................................................14, 20 Cal. Civ. Code § 3360 ..........................................................................................................................19 Cal. Bus. & Prof. Code § 17200. .....................................................................................................2, 25 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page7 of 34 1 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Plaintiffs Michael Goldberg, Robert DeMars, and Scott McCullough (“Plaintiffs”) respectfully submit this Memorandum in Opposition to Defendant Google, Inc.’s (“Google”) Motion to Dismiss Plaintiffs’ Consolidated Third Amended Class Action Complaint, or in the Alternative for Summary Judgment (the “Motion”).1 INTRODUCTION Google’s Motion studiously ignores the proverbial elephant in the room. As it well knows, following the conclusion of briefing and oral argument on Google’s prior motion to dismiss, the Court of Appeals for the Ninth Circuit issued its opinion in Robertson v. Facebook, Inc., 572 F. App’x 494 (9th Cir. 2014). There, the Court of Appeals held that allegations that plaintiffs were harmed by unauthorized disclosure of personal identifying information require denial of a motion to dismiss breach of contract claims. Id. at 494. This is consistent with California law, as it has long been the law in California that pecuniary injury is not needed to sustain a breach of contract claim. See, e.g., McCarty v. Beach, 10 Cal. 461, 464 (1858). As discussed below, in breach of its agreements Google has disclosed Plaintiffs’ personal identifying information to third party application developers which, under Robertson, requires denial of Google’s Motion. In Robertson, the Ninth Circuit also recognized that personally identifying information has economic value that is lost when it is disseminated without authorization, which further supports denial of a motion to dismiss breach of contract claims. Robertson, 572 F. App’x at 494. Plaintiffs’ economic expert, Fernando Torres, has demonstrated that Plaintiffs’ personal identifying information has objectively quantifiable value and that Google’s practice of disclosing such information to third parties results in economic injury.2 In addition, the allegations of the CTAC suffice to require denial of the motion wholly apart from the impact of Robertson. As this Court previously has held, Google’s unauthorized disclosure 1 The Consolidated Third Amended Class Action Complaint will be referred to herein as the “CTAC.” Citations in the form “¶ ___” are to paragraphs of the CTAC. 2 See Report of Fernando Torres on the Damages to Plaintiffs from Google’s Violations of Android Users’ Privacy Rights (“Torres Rep.”), attached as Ex. A to the Declaration of James J. Sabella (“Sabella Decl.”). All references to “Ex. __” are to exhibits to the Sabella Decl. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page8 of 34 2 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 of Plaintiffs’ personal information to third parties is causally related to the consumption of finite device resources, including battery power and bandwidth. Plaintiffs’ computer science expert, C. Matthew Curtin, has reviewed the record and opined that Google’s publication to third parties of Plaintiffs’ and the other Class members’ personal information is not necessary to process any transaction, and that the consumption of device resources is a necessary condition for Google’s publication of this information.3 The amendments that Plaintiffs made most recently to the CTAC do not change this fundamental fact, notwithstanding Google’s bold assertion that Plaintiffs have “pled their way out of court.” Def. Br. at 1.4 Finally, as shown in greater detail below, Plaintiffs have adduced substantial evidence supporting their contract claim and their claim under California’s Unfair Competition Law, Cal. Bus. & Prof. Code § 17200 et seq. (“UCL”). For example, Google has admitted, inter alia, that (a) for the duration of the Class Period, it caused the names, email addresses, and location information of Android users that purchased at least one paid app through the Android Market/Google Play Store to be made available to the app developer(s) responsible for listing the app(s) purchased, (b) that the process of purchasing an app consumes device resources, including battery power and bandwidth, (c) that purchasers’ information was immediately made available to developers as part of the app purchase process, (d) that there is no reason, other than that a purchase was made, that Google made users’ personal details available to app developers, and (e) that such information need not be provided to any third party to process the purchase transaction or to maintain any account. How Google thinks it is entitled to summary judgment, in the face of these admissions, is bewildering. 3 See Ex. B (Computer Expert Report of C. Matthew Curtin (“Curtin Rep.”)). 4 Other than the addition of Plaintiff Goldberg, the only consequential changes introduced by the CTAC are: (i) the removal of allegations relating to Google’s use of the personal information of Android users that obtained free applications, as distinguished from paid applications, from Google; and (ii) the revision of the Class Period. The Class is now limited to Android users that purchased paid apps through the Android Market/Google Play Store between February 1, 2009 and May 31, 2014. This Class Period represents the period of time during which Google knowingly disclosed to third parties the names, email addresses, and location information belonging to each Android user that purchased a paid app through the Android Market/Google Play Store, in direct contravention of its express promises that it would not do so. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page9 of 34 3 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 FACTUAL SUMMARY I. PUBLICATION OF USER INFORMATION OCCURS DURING THE PURCHASE PROCESS. Between February 1, 2009 and May 31, 2014, Google published on its developer-specific portals (the Checkout Merchant Center, operative from February 2009 to early 2013, and the Play Developer Console, operative from 2012 to May 2014) the name, email address, and location data of each individual Android user that purchased applications listed for sale by app developers.5 During that period, every purchase of a paid application through the Android Market/Google Play Store resulted in the immediate disclosure to the app developer of the purchaser’s name, email address, and location.6 The process of purchasing an app is “an integrated operation with multiple components that work together to form [a] cohesive, tightly-coupled process.”7 Google admitted that, “as part of the process of making that purchase, we create a record of that purchase [which is] available for the Developer Console to read.”8 Specifically, one of the API calls or messages transmitted from Android user devices during the purchase process, “/commitPurchase,” includes user- and device-specific data and is directly responsible for the creation of that immediately- disclosed record.9 As an “integrated operation” that includes exposing the purchase record to 5 Curtin Rep. at 3 (“The purchase process includes publication of buyers’ information to developers. The business logic implemented by user interfaces such as Google Play Developer Console and Google Checkout Merchant Center causes a user’s name, email address, and location to be published once a purchase is made by the user in Google Play.”); see also CTAC ¶136. 6 Ex. C (excerpts of deposition transcript of Ficus Kirkpatrick (“Kirkpatrick Tr.”)) at 85:8-13; 86:12- 13. 7 Curtin Rep. at 5. 8 Kirkpatrick Tr. at 86:23-87:2 (emphasis added). 9 Ex. D (GOOG-00000008-21) at GOOG-00000011 (“The device calls the DFE [Device Frontend] CommitPurchaseAction. The DFE sends a DeliveryInfoRequest to the Mixer, which sends it via the VCA to IMAS, which returns the AndroidAppDeliveryData including the secure URL for the actual download. In parallel the DFE sends a CompletePurchaseRequest to the Blixer. This inserts an Order into Checkout and then waits for status to indicate that the purchase has succeeded (or failed). It then sends a PNR [PurchaseNotificationRequest] via the VCA to IMAS, which updates the purchase record in the user profile.”) (emphasis added); id. at GOOG-00000013 (/commitPurchase also “[c]opies purchase context data (the details of the order to be created) into a CompletePurchaseRequest and sends it to the Blixer, with skip delivery set true. The data sent (Cont’d) Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page10 of 34 4 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 developers, the purchase process consumes “measured or limited resources” including “[e]lectric power,” “CPU cycles,” “[m]ain memory,” and “[n]etwork capacity” or bandwidth.10 Accordingly, the consumption of these resources is necessary for, and so causally related to, the unauthorized disclosure of app purchasers’ personal information to app developers. Plaintiffs did not authorize the use of any device resources for that purpose.11 Google does not appear to deny these facts. Instead, Google places great weight on the fact that developers must log into the Checkout Merchant Center or Play Developer Console to obtain the names, email addresses, and location data about buyers of their apps. On Google’s reasoning, there is no actionable disclosure unless the developer not only receives access to purchasers’ information, but actually reads it – as though, to constitute disclosure, publication on a billboard or in a newspaper would not suffice, because it may be that no one ever looks up at the billboard or turns to that page of the newspaper. As shown below, this unreasonably narrow understanding of “disclosure” is meritless. Google also contends that there is no singular, extraneous transmission of data from users’ devices that is specifically responsible for causing the disclosure of purchaser details to app developers, such that the (admitted) consumption of device resources could be causally tied to the (admitted) publication of user information, but this is a red herring. Because the purchase process is an “integrated operation” of which that publication is admittedly a “part,”12 and neither Plaintiffs nor other Class members authorized the use of any of their device resources for the purpose of publishing their personal information to third parties, it follows that the causal link ____________________ includes the ‘risk hashed device info,’ an obfuscated device identifier (e.g. IMEI) sent by the device, and information about any challenges the user has passed (e.g., providing their Gaia password).” 10 Curtin Rep. at 5-6; see also Curtin Rep. at 3 (“The process of completing a purchase in the store now branded as Google Play consumes limited resources local to or used by the purchaser’s device.”). 11 CTAC ¶¶168 (“Each such disclosure required the consumption of [Plaintiffs’] device battery power because each such disclosure was triggered or initiated by a transmission from the Android device used to purchase the application, though they never consented or authorized Google to cause those transmissions for the purpose of making such disclosures.”) (emphasis added); 169 (same, with respect to bandwidth consumption). 12 Kirkpatrick Tr. at 86:23. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page11 of 34 5 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 between the consumption of resources and the offensive disclosure is established – regardless of whether any extraneous resources, beyond what is required to complete the purchase, are consumed. II. PUBLICATION OF USER INFORMATION VIOLATES GOOGLE’S AGREEMENTS WITH CLASS MEMBERS. During the Class Period, Google promised Android users that it would not share their personally identifying information with third parties, except in the following limited circumstances: (a) “as necessary to process your transaction and maintain your account”;13 (b) “[t]o detect, prevent, or otherwise address fraud, security or technical issues”;14 (c) “[w]e have your consent”;15 (d) to “process[] personal information on [Google’s] behalf” (only with respect to “subsidiaries, affiliated companies or other trusted businesses or persons”);16 (e) as “reasonably necessary” to comply with laws or regulations;17 or (f) as otherwise required under the general Google privacy policy.18 None of these circumstances is remotely applicable. Google ceased providing purchaser details (including name and email address) to app developers in May 2014.19 (Not coincidentally, May 2014 is the very month in which the Ninth Circuit’s Robertson opinion was issued.) Yet Google has continued to process app purchase transactions, to maintain user accounts, and otherwise operate normally since May 2014. This alone demonstrates that the offensive disclosures have nothing to do with processing any transaction or maintaining any account, or with any of the other potential rationales set forth in Google’s policy documents. 13 Ex. E (December 9, 2009 Google Checkout Privacy Policy) at 2; see also Ex. F (November 16, 2011 Google Wallet Privacy Policy) at 4; Ex. G (August 1, 2012 Google Wallet Privacy Notice) at 2. 14 Ex. E (December 9, 2009 Google Checkout Privacy Policy) at 2; see also Ex. F (November 16, 2011 Google Wallet Privacy Policy) at 4. 15 Ex. E (December 9, 2009 Google Checkout Privacy Policy) at 2; see also Ex. F (November 16, 2011 Google Wallet Privacy Policy) at 4; Ex. H (March 1, 2012 Google Privacy Policy) at 5-6. 16 Ex. E (December 9, 2009 Google Checkout Privacy Policy) at 3; see also Ex. F (November 16, 2011 Google Wallet Privacy Policy) at 4; Ex. H (March 1, 2012 Google Privacy Policy) at 6. 17 Ex. E (December 9, 2009 Google Checkout Privacy Policy) at 3; see also Ex. F (November 16, 2011 Google Wallet Privacy Policy) at 4; Ex. H (March 1, 2012 Google Privacy Policy) at 6-7. 18 Ex. G (August 1, 2012 Google Wallet Privacy Notice) at 2. 19 Kirkpatrick Tr. at 81:13-19. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page12 of 34 6 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Indeed, Google’s Product Manager responsible for payment processing, Mark Thomas, testified that the practice of publishing purchasers’ names, email addresses, and location information is not required to “process” the purchase transaction.20 Similarly, after reviewing all the evidence in this case, Mr. Curtin concluded that this practice “is not a technical requirement to completing a purchase transaction nor for the delivery of content to the user.”21 Not a shred of evidence in the record suggests otherwise. The same is true of the “account maintenance” rationale: although (as Mr. Thomas testified) certain apps may require the creation of an account,22 Google did not limit its practice of disclosing purchaser details to such cases. And, again, the fact that Google ceased this practice in May 2014 shows indisputably that it served no legitimate account-maintenance function. The remaining rationales provide no support to Google. On their face, the fraud-detection, external data-processing, and legal compliance rationales have no applicability to the practice of disclosing personal information about Android users to third party app developers. Whether app developers have access to the names and email addresses of purchasers of their apps does not further in any way Google’s anti-fraud efforts (as, indeed, the May 2014 cessation of the practice reveals). Further, app developers simply do not process data on Google’s behalf – that provision is clearly designed to refer to vendors used by Google to manage data, not app developers, as the reference to “subsidiaries, affiliated companies, and other trusted businesses or persons” shows. Finally, there is no law requiring disclosure of purchasers’ personal information to app developers each time an app 20 As Google’s witness Mark Thomas testified: A. Is it necessary to process those transactions [i.e., app purchases] – is the sharing of e-mail and name necessary to process those transactions. No, there is probably other ways of doing it. * * * * Q. But it’s not necessary to process [the transaction]. A. No, there is other ways of doing it. Ex. I (excerpts of deposition transcript of Mark Thomas (“Thomas Tr.”)) at 113:13-114:1. 21 Curtin Rep. at 3. 22 Thomas Tr. at 82:17-19. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page13 of 34 7 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 is purchased.23 That leaves “consent.” Google has presented no evidence even tending to show that Android users consented to the disclosure of their personally identifying information to app developers each time they purchase an app. For example, such users were not asked to agree to this disclosure, and no policy or term of service operative during the Class Period indicated, or even hinted, that it would occur. Absent evidence to the contrary, Google has no grounds to argue that users consented to its arbitrary practice of disclosing their information to app developers each time they purchased an app. No provision in the relevant contracts, therefore, permits Google’s publication to third party app developers of Android users’ personal information each time they purchase an app through the Android Market/Google Play Store. Indeed, each of those contracts expressly forbids this publication. Google’s unilateral decision to run roughshod over its agreements with Android users for a five-year period is an egregious violation of all of the foregoing contracts. ARGUMENT I. APPLICABLE LEGAL STANDARDS. Google moves under Rules 12(b)(1) and 56. Google does not argue that Plaintiffs have failed to state a claim under Rule 12(b)(6).24 A motion under Rule 12(b)(1) does not test the sufficiency of the factual allegations in the complaint, but challenges the existence of subject matter jurisdiction. Fed. R. Civ. P. 12(b)(1). In reviewing such a motion, the Court “is not restricted to the face of the pleadings, but may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction.” McCarthy v. U.S., 850 F.2d 558, 560 (9th Cir. 1988). To successfully oppose a Rule 12(b)(1) motion, the nonmovant must put forth “the manner and degree of evidence required” by the particular “stage[] of the litigation.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992). At 23 With the exception of the “consent” rationale, the foregoing addresses all rationales set forth in the general Google Privacy Policy. See Ex. H (March 1, 2012 Google Privacy Policy) at 5-7. 24 The sole reference to Rule 12(b)(6) in Google’s Motion appears in the pro forma Notice of Motion and Motion document, Def. Br. at i, which appears to be a hold-over from a prior notice of motion. None of Google’s arguments are grounded in Rule 12(b)(6), and the plausibility standard is not even mentioned. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page14 of 34 8 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the summary judgment stage, the Court may examine “affidavit[s] or other evidence” pertaining to the existence of subject matter jurisdiction. Id. However, “[a]t all times the threshold question of standing ‘is distinct from the merits of a claim’ and does not require ‘analysis of the merits.’” In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2014 WL 3707508, at *3 (N.D. Cal. July 21, 2014) (quoting Maya v. Centex Corp., 658 F.3d 1060, 1068 (9th Cir. 2011)). All disputes of fact are resolved in favor of the nonmovant. Dreier v. United States, 106 F.3d 844, 847 (9th Cir. 1996). Google’s challenge to Plaintiffs’ claims proceeds under Rule 56. Summary judgment is warranted only where “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). Google has the burden not only of “identifying,” Def. Br. at 14 n.15, but also of demonstrating that the record (including deposition testimony, documents, and expert evidence introduced during discovery) does not support a triable issue of fact “that might affect the outcome of the suit[.]” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A dispute is genuine “if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Id. Further, “[t]here is no requirement that the trial judge make findings of fact.” Id. at 250. Indeed, “a district court is not entitled to weigh the evidence and resolve disputed underlying factual issues.” Chevron Corp. v. Pennzoil Co., 974 F.2d 1156, 1161 (9th Cir. 1992). All inferences “drawn from the underlying facts … must be viewed in the light most favorable to the party opposing the motion.” U.S. v. Diebold, Inc., 369 U.S. 654, 655 (1962). II. PLAINTIFFS HAVE ARTICLE III STANDING. Article III standing is assessed independently of the merits of any cause of action. This Court has already found that Plaintiffs have Article III standing based on their allegations of device resource consumption, which remain a basis for Plaintiffs’ standing. Google challenges the sufficiency of the causal nexus between the alleged transmissions of data that occur each time an Android user purchases an app and the alleged disclosure of users’ personal information to app developers, but this Court has already determined that that issue “requires a heavily and inherently fact-bound inquiry” inappropriate on a Rule 12 motion. In re Google, Inc. Privacy Policy Litig., 2014 WL 3707508, at *7. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page15 of 34 9 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 In addition to resource consumption, as recognized by numerous courts in this Circuit as well as, more recently, in the Ninth Circuit’s Robertson opinion, Plaintiffs have standing under two additional theories of injury-in-fact: economic injury resulting from Google’s unauthorized dissemination of their personal information to third parties, and the non-economic harm associated with the very fact of this dissemination. Even if this Court were to determine that the causal nexus attacked by Google is too attenuated to substantiate the merits of Plaintiffs’ claims, the foregoing would establish Article III standing. Article III standing requires an injury-in-fact that is fairly traceable to the defendant and has some likelihood of redressability. Lujan, 504 U.S. at 560-61; Public Lands for the People, Inc. v. United States Dept. of Agriculture, 697 F.3d 1192, 1195 (9th Cir. 2012). “The essence of the standing inquiry is to determine whether the plaintiff has ‘alleged such a personal stake in the outcome of the controversy as to assure that concrete adverseness which sharpens the presentation of issues upon which the court so largely depends.’” Opperman v. Path, Inc., No. 13-cv-00453, 2014 WL 1973378, at *24 (N.D. Cal. May 14, 2014) (quoting Baker v. Carr, 369 U.S. 186, 204 (1962)). In determining whether Article III standing exists at the summary judgment stage, the Court may look not only to the complaint’s allegations but also to facts evidenced in the record. Dreier, 106 F.3d at 847; Colwell v. Dept. of Health & Human Servs., 558 F.3d 1112, 1121 (9th Cir. 2009) (“affidavits or any other evidence” may be presented and considered to “satisfy [a party’s] burden of establishing that the court, in fact, possesses subject matter jurisdiction”); see also MDPhysicians & Assoc., Inc. v. State Bd. of Ins., 957 F.2d 178, 181 (5th Cir. 1992) (federal courts are “free to weigh the evidence and satisfy [themselves] as to the existence of [their] power to hear the case”). This Court has subject matter jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d), in part because the aggregated claims of the individual Class members exceed the sum or value of $5,000,000.25 This is based on the economic loss suffered by Plaintiffs and the other Class 25 CTAC ¶20. The Court may also exercise its discretion to hear the two remaining state law causes of action under 28 U.S.C. § 1367 because Plaintiffs’ federal statutory claims, over which the Court has original jurisdiction, remain preserved for appeal. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page16 of 34 10 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 members as a result of Google’s breaches of its contracts. That economic loss has two components: (1) privacy-related damages, including damages for the loss in monetary value of Plaintiffs’ and other Class members’ personally identifying information resulting from Google’s disclosure of such information, as well as for the invasion of Plaintiffs’ and other Class members’ interests in maintaining the privacy of that information26 and (2) damages for the loss of valuable device resources, including battery power and bandwidth, paid for by Plaintiffs and the other Class members.27 Additionally, Google’s unauthorized dissemination of Plaintiffs’ personal information furnishes an independent basis for Article III standing, regardless of whether any pecuniary injury exists. A. ROBERTSON IS PERSUASIVE AUTHORITY THAT SUPPORTS A FINDING OF ARTICLE III STANDING. In Robertson, the Ninth Circuit held that it was reversible error to dismiss breach of contract claims involving disclosure of personal identifying information where the plaintiffs alleged that they “were harmed both by the dissemination of their personal information and by losing the sales value of that information.” 572 F. App’x at 494. As shown below, these two, independent, aspects of injury support Plaintiffs’ claims at bar. Plaintiffs recognize that Robertson is an unpublished opinion that, under 9th Cir. R. 36-3, is not binding precedent. The law is clear, however, that an unpublished decision by the Ninth Circuit is considered “persuasive” notwithstanding its “non-precedential” status. Sandoval v. County of Sonoma, No. 11-cv-05817, 2014 U.S. Dist. LEXIS 12400, at *14 n.7 (N.D. Cal. Jan. 31, 2014).28 “[U]npublished decisions have persuasive value and indicate how the Ninth Circuit applies binding 26 See Torres Report; see also CTAC ¶¶148; 173-174; 318. 27 See Curtin Report; see also CTAC ¶¶147; 170-171. 28 Accord Caballero v. Comm’r of Social Security, No. 12-cv-2357, 2014 U.S. Dist. LEXIS 116315, at *15 n.6 (E.D. Cal. Aug. 20, 2014); Trujillo v. Warden, No. 12-cv-02627, 2014 U.S. Dist. LEXIS 73971, at *37 n.2 (E.D. Cal. May 28, 2014); Duong v. Astrue, No. 11-cv-00347, 2012 U.S. Dist. LEXIS 119195, at *16-17 (E.D. Cal. Aug. 22, 2012); O’Connor v. Astrue, No. 09-cv-01508, 2010 U.S. Dist. LEXIS 101668, at *26 n.7 (N.D. Cal. Sept. 27, 2010); cf. Hicks v. Dairyland Ins. Co., 441 F. App’x 463, 465 n.1 (9th Cir. 2011) (unpublished) (non-precedential state court decisions constitute “persuasive authority”). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page17 of 34 11 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 authority.” Martinez v. Holland, No. 13-cv-3007, 2014 U.S. Dist. LEXIS 166890, at *21 n.2 (S.D. Cal. May 12, 2014). An unpublished Ninth Circuit decision is “persuasive authority and, having been issued by the Ninth Circuit, must be given more weight than” a district court decision to the contrary. Asis Internet Servs. v. Member Source Media, LLC, No. 08-cv-1321, 2010 U.S. Dist. LEXIS 7055, at *3 (N.D. Cal. Jan. 28, 2010). It is expected that Google will argue that this Court’s prior rulings concerning what constitutes sufficient injury is the law of the case and may not be changed. Any such argument should be rejected. “The law of the case doctrine is not an absolute bar to reconsideration of matters previously decided. The doctrine ‘merely expresses the practice of courts generally to refuse to reopen what has been decided, not a limit to their power.’” Leslie Salt Co. v. United States, 55 F.3d 1388, 1393 (9th Cir. 1995); see Russell v. Comm’r of Internal Revenue, 678 F.2d 782, 785 (9th Cir. 1982) (“The law of the case doctrine is not to be applied woodenly.”). In particular, a “‘court may depart from the law of the case if . . . an intervening change in the law has occurred.’” United States v. Van Alstyne, 584 F.3d 803, 813 (9th Cir. 2009) (quoting United States v. Scrivner, 189 F.3d 825, 827 (9th Cir. 1999)). The Ninth Circuit’s decision in Robertson satisfies this test. In Irving v. Lennar Corp., No. 12-cv-0290, 2014 U.S. Dist. LEXIS 54257 (E.D. Cal. Apr. 16, 2014), after the court denied a motion to dismiss, the Ninth Circuit issued an unpublished opinion that undermined the legal basis for the denial of the motion. The defendant moved for reconsideration, which requires showing that there had been “an intervening change in controlling law.” Id. at *6. The plaintiff argued that because the Ninth Circuit decision was “unpublished and therefore not precedential, it cannot constitute a change in controlling law.” Id. at *7. The court rejected that argument, stating that “because the decision has persuasive value and indicate[s] how the Ninth Circuit applies binding authority … the court will consider it.” Id. at *8 (internal quotation marks and citation omitted). Relying on the unpublished Ninth Circuit decision, the court thereupon reversed itself and granted the motion to dismiss. Id. at *10-11. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page18 of 34 12 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Also instructive is Prospect Med., P.C v. Cigna Corp. No. 09-cv-5912, 2013 U.S. Dist. LEXIS 85753 (D.N.J. June 19, 2013) (unpublished), where, in opposing the defendant’s motion to dismiss the third amended complaint, plaintiff argued law of the case based on rulings the court had made on the motion to dismiss the second amended complaint. Id. at *11. The defendant relied on a non-precedential decision by the Third Circuit rendered subsequent to the district court’s decision on a motion to dismiss the second amended complaint. The court stated that while the Third Circuit’s opinion “is not precedential, the Court appreciates the persuasive character of a higher court’s resolution of a legal question on nearly identical facts.” Id. at 12 n.2. Further, clearly reflecting the view that an intervening non-precedential decision by a Court of Appeals can justify departing from the law of the case, in referring to the Third Circuit’s opinion the court observed that “[a]n intervening change in controlling law is an exception to the law of the case doctrine.” Id. (internal quotation marks omitted). To the extent that Robertson merely confirms existing law and does not constitute a change in the law, then this Court’s prior ruling concerning injury is clearly erroneous, another basis for overcoming any law of the case argument. See, e.g., Plantronics, Inc. v. Am. Home Assur. Co., No. 07-cv-06038, 2014 U.S. Dist. LEXIS 75557 at *6 (N.D. Cal. May 30, 2014). The Ninth Circuit’s decision in Robertson constitutes persuasive authority as to how the Ninth Circuit would apply the injury requirement rule in a case involving the disclosure of personal identifying information. Using the Ninth Circuit’s approach, the CTAC and the evidence adduced by Plaintiffs throughout discovery clearly suffice to survive Google’s challenge as to standing. B. PLAINTIFFS SUFFERED ECONOMIC INJURY AS A RESULT OF GOOGLE’S UNAUTHORIZED DISSEMINATION OF PLAINTIFFS’ PERSONALLY IDENTIFYING INFORMATION. “[P]alpable economic injuries have long been recognized as sufficient to lay the basis for standing.” Sierra Club v. Morton, 405 U.S. 727, 733-34 (1972); see also San Diego Gun Rights Comm. v. Reno, 98 F.3d 1121, 1130 (9th Cir. 1996) (“Economic injury is clearly a sufficient basis for standing.”). As the Ninth Circuit recently held, the “los[t] sales value” of personal information that has been disseminated to third parties without authorization suffices to establish injury. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page19 of 34 13 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Robertson, 572 F. App’x at 494;29 see also Claridge v. RockYou, Inc., 785 F. Supp. 2d 855, 861 (N.D. Cal. 2011) (holding that diminution of value of plaintiff’s personally identifying information impermissibly disclosed by defendant to third parties constitutes injury-in-fact sufficient to support Article III standing).30 As explained in detail in the Torres Report, “information privacy is an economic good”31 that can be quantified objectively. Torres analyzed the value of the information disclosed by Google to app developers from several perspectives. First, Torres concludes that the information disclosed by Google has economic value, which Class members have lost. To estimate this, he analyzed and quantified what third parties would pay for a consumer data base containing this information, for mass marketing purposes.32 He also analyzed and quantified the amount of revenue that third parties could realize from use of this information.33 Torres further explained that “[b]ecause GOOGLE has disclosed this information to the application developers, the members of the Subclass have lost the sales value of that information that they otherwise would have had. In short, the [Subclass] members have lost the opportunity to sell the personal information that Google discloses to third- party application developers, the monetary value of which is at least as much as the value that such 29 Although the Robertson opinion did not explicitly address federal standing requirements, the question of standing was argued in the briefs. See, e.g., Brief of Appellant, No. 12-15619, Dkt. No. 10, at 39-40, 48 (9th Cir. Aug. 13, 2012); Brief for Defendant-Appellee Facebook, Inc., No. 12- 15619, Dkt. No. 17, at 1, 42, 43, 46, 49 (9th Cir. Sept. 26, 2012); Reply Brief of Appellant, No. 12- 15619, Dkt. No. 23-1, at 23, 25 (9th Cir. Nov. 19, 2012). Moreover, the Robertson opinion holds that lost value of personal information suffices to establish the element of damages for purposes of a contract (or fraud) claim. A fortiori, such lost value also suffices to establish the lesser injury-in-fact required for Article III standing. “Economic injury is clearly a sufficient basis for standing.” San Diego v. Reno, 98 F.3d at 1130. 30 Importantly, the only Northern District of California opinion to explicitly reject Claridge was In re Facebook Privacy Litig., No. 10-cv-02389, 2011 WL 6176208, at *5 (N.D. Cal. Nov. 22, 2011), which was overturned by the Ninth Circuit’s Robertson decision. That the Ninth Circuit has endorsed the Claridge approach is further demonstrated by the fact that the plaintiffs in Robertson relied extensively on Claridge. See Brief of Appellant at 37, 39-40; Reply Brief of Appellant at 22- 23. 31 Torres Rep. at ¶12. 32 Torres Rep. at ¶¶16(a), 17, 29(b)(i). 33 Torres Rep. at ¶¶22-24, 29(b)(iii). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page20 of 34 14 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 third parties place on the information.”34 In addition, Torres concludes that the Class members are injured because they have a quantifiable interest in protecting the privacy of the information that Google discloses to app developers which can be quantified. He states that “to overcome the user’s interest in maintaining information as private, there is a measurable monetary threshold amount for which, on average, consumers will exchange that privacy.”35 In order to estimate the value that consumers place on their privacy interests, Torres examined relevant literature and empirical studies to determine how much individuals would need to be paid in exchange for surrendering the privacy of their information.36 Google challenges the value of information privacy and the diminution in value of Plaintiffs’ information only superficially, first in connection with the risk of future harm, see Def. Br. at 9-11, and then in connection with the previously dismissed intrusion upon seclusion claim that has been preserved for appeal, see Def. Br. at 11, despite recognizing that privacy-related damages may support Plaintiffs’ contract claims. Id. Google does not argue that these damages are not “fairly traceable” to it or “redressable” by the Court. Instead, it argues only that Plaintiffs’ privacy-related damages do not constitute “injury-in-fact.” But this completely overlooks the Ninth Circuit’s Robertson decision, which establishes that both “dissemination of [plaintiffs’] personal information” and “los[t] sales value of that information” suffice to show the element of damages for breach of contract claim. 572 F. App’x at 494. Moreover, Robertson is fully consistent with California law on the measure of contract damages, which includes “the amount which will compensate the party aggrieved for all the detriment proximately caused thereby, or which, in the ordinary course of things, would be likely to result therefrom.” Cal. Civ. Code § 3300 (emphasis added). Thus, the privacy-related damages outlined above and examined in more detail in the Torres Report are proper contract damages that furnish Article III standing. 34 Torres Rep. at ¶14 (emphasis added). 35 Torres Rep. at ¶19. 36 Torres Rep. at ¶¶19-21, 29(b)(ii). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page21 of 34 15 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 The cases holding that disclosure of personal information does not confer Article III standing are inapposite, therefore, because they were issued before the Robertson opinion, and because in none of them (including this Court’s December 28, 2012 and December 3, 2013 orders) had the plaintiff demonstrated that any privacy-related damages were properly compensable under a contract. See In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2013 WL 6248499, at *5 (N.D. Cal. Dec. 3, 2013) (finding that plaintiffs had not, at that time, “do[ne] more than point to the dollars in [the] defendant’s pocket”); In re Google Android Consumer Privacy Litig., No. 11-md- 02264, 2013 WL 1283236, at *4 (N.D. Cal. Mar. 26, 2013) (finding no Article III standing where plaintiffs had not shown economic impact, on plaintiffs rather than defendant, of improper use of personal information); In re Google, Inc. Privacy Policy Litig., No. 12-cv-01382, 2012 WL 6738343, at *5 (N.D. Cal. Dec. 28, 2012) (allegations of misuse of personal information do not confer Article III standing absent evidence of “concrete harm,” such as “economic injury”); Low v. LinkedIn, Corp., No. 11-cv-01468, 2011 WL 5509848, at *4 (N.D. Cal. Nov. 11, 2011) (finding no Article III standing where plaintiff had not shown that defendant’s disclosure of his browsing history had any economic impact on plaintiff). Additionally, unlike in those cases, Plaintiffs here have shown precisely how Google’s practices have caused them to lose the sales value of their personal information: Plaintiffs (and other Class members) have been deprived of the opportunity to sell their personal information, at the very least, to the very app developers to whom Google has gratuitously disclosed that information without their consent.37 Even if these important factual differences did not distinguish this case from those cited above, Robertson clearly shows that they were wrongly decided. The impact of Robertson was very recently shown in Judge Freeman’s April 1 opinion in Svenson v. Google Inc., No. 13-cv-04080, Dkt. No. 118, at 8-9 (N.D. Cal. Apr. 1, 2015).38 In Svenson, the court rejected Google’s arguments that to establish contract damages from the disclosure of personal identifying information, plaintiffs 37 Torres Rep. at ¶14 (Class members “have lost the opportunity to sell the personal information … to third-party application developers”). 38 A copy of the opinion is attached to the Sabella Decl. as Ex. M. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page22 of 34 16 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 must show “how the defendant’s use of the information deprived the plaintiff of the information’s economic value” or that plaintiffs “attempted to sell their personal information” or that plaintiffs “were foreclosed from entering into” such a transaction. Id. at 9. Judge Freeman observed that “[t]he Ninth Circuit’s holding does not require the type of explication discussed by the district court decisions” requiring detailed allegations of diminished value of personal information. Id. (emphasis in original). Critically, the court also held that, because the plaintiff pleaded contract damages, she necessarily also pleaded injury in fact for Article III standing purposes. Id. at 4. The Torres Report establishes the existence of a market for Plaintiffs’ personal information. That market provides the empirical basis for the valuation of Plaintiffs’ personal information and the privacy thereof.39 And Torres also explains that Plaintiffs have lost the opportunity to sell that information because of Google’s conduct. Robertson requires nothing more. In short, both the information privacy damages and the lost sales value damages are proper contract damages compensable under the agreements Google forged with Plaintiffs and the other Class members. As such, each of these measures is an independently “palpable economic injur[y]” that gives rise to Article III standing. Sierra Club, 405 U.S. at 733-34. C. PLAINTIFFS SUFFERED LOSS OF DEVICE RESOURCES EACH TIME THEY PURCHASED APPS. Torres also quantified the loss of device resources incurred in order to carry out the unauthorized disclosure of Plaintiffs’ and other Class members’ personal information to developers. He opined in particular that the average cost per megabyte of mobile data use across the Class Period is $0.068.40 The transmission of data necessary to trigger the disclosure of Plaintiffs’ and other Class members’ personal information to app developers – which consists not of the user’s actual name and email address in human-readable form but, instead, API calls or messages providing certain computer-readable device- and user-specific data41 – consumes less than one megabyte of 39 See, e.g., Torres Rep. at ¶¶12-17. 40 Torres Rep. at ¶28. 41 See Ex. D at GOOG-00000011, GOOG-00000013. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page23 of 34 17 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 mobile data usage. However, though the quantity consumed is small, it is not de minimis because it is systemically consumed: each and every time a user bought an app through the Android Market/Google Play Store during the Class Period, his or her device resources were used to initiate the creation and immediate dissemination of a purchase record containing personal details, including name, email address, and location information.42 Such systemic resource consumption provides Article III standing, as this Court already held. In re Google, Inc. Privacy Policy Litig., 2014 WL 3707508, at *7 (finding for a second time that “allegations of resource depletion … give[] rise to standing”); In re Google, Inc. Privacy Policy Litig., 2013 WL 6248499, at *7 (where alleged consumption of resources is “systemic rather than episodic,” injury is “more than de minimis” and gives rise to standing); see also In re Carrier IQ, Inc., No. 12-cv-2330, 2015 WL 274054, at *6-7 (N.D. Cal. Jan. 21, 2015) (finding Article III standing where plaintiffs alleged systemic consumption of device resources, including bandwidth and battery power); Goodman v. HTC Am., Inc., No. 11- cv-1793, 2012 WL 2412070, at *7 (W.D. Wash. June 26, 2012) (same). This injury is clearly “fairly traceable” to Google because Google alone is responsible for designing and implementing the Android Market/Google Play Store app purchase process, of which the resource-consuming events leading to disclosure of Plaintiffs’ and other Class members’ personal information is admittedly a “part.”43 It is “redressable” because although Google has terminated the practice, Plaintiffs and the other Class members have never been compensated for their losses. D. GOOGLE’S UNAUTHORIZED DISSEMINATION OF PLAINTIFFS’ PERSONAL INFORMATION FURNISHES ARTICLE III STANDING. Finally, there is no question that “a federal plaintiff’s ‘injury in fact’ may be intangible and need not involve lost money or property[.]” Ehret v. Uber Techs., Inc., No. 14-cv-0113, 2014 WL 4640170, at *5 (N.D. Cal. Sept. 17, 2014) (internal quotation marks omitted). The unauthorized disclosure of Plaintiffs’ personal identifying information, even absent any monetary injury, confers standing. 42 Additionally, Plaintiff Goldberg purchased dozens of paid apps during the Class Period. See Ex. J (GOLDBERG_0000003). 43 Kirkpatrick Tr. at 86:23. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page24 of 34 18 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Courts in this Circuit draw a distinction, for purposes of the Article III standing inquiry, between (a) cases involving allegations of unauthorized collection of personally identifying information and (b) cases involving allegations of unauthorized disclosure of personally identifying information. Allegations of unauthorized disclosure to third parties of such information suffice to establish injury-in-fact, whereas allegations of unauthorized collection or retention alone do not. See In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942, 961-62 (S.D. Cal. 2014) (“[C]ourts in this circuit have routinely denied motions to dismiss based on Article III standing where a plaintiff alleges that his personal information was collected and then wrongfully disclosed, as opposed to alleging that his personal information was collected without his consent.”) (collecting cases) (emphasis added); see also Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (finding allegations of actual disclosure of names, addresses, and SSNs to third party sufficient to confer Article III standing); In re Adobe Sys., Inc. Privacy Litig., No. 13-cv- 05226, 2014 WL 4379916, at *6-10 (N.D. Cal. Sept. 4, 2014) (unauthorized disclosure of personal information constituted a “certainly impending” risk of harm sufficient to confer Article III standing). This basis for Article III standing is not premised solely on the risk of future harm flowing from unknown third parties’ possession of Plaintiffs’ and other Class members’ personally identifying information.44 The very “dissemination” of that information to third parties, as the Ninth Circuit recently held, constitutes a “harm[]” for purposes of a contract claim. Robertson, 572 F. App’x at 494. The Ninth Circuit made clear in Robertson that this harm is independent of, and in addition to, the harm of “losing the sales value” of personal information. Id. (“Plaintiffs allege … that they were harmed both by the dissemination of their personal information and by losing the sales value of that information,” finding such allegations “sufficient to show the element of damages 44 Plaintiffs’ economic expert has nevertheless opined that Google’s disclosure of each Class member’s personal information has resulted in costs to each Class member associated with “mitigating the additional risk” of potential misuse of that information, such as would occur if an app developer suffered a data breach. This cost has been estimated at $6.00 per Class member. Torres Rep. at ¶29(b)(iv). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page25 of 34 19 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 for their breach of contract and fraud claims.”) (emphasis added). Accordingly, because Plaintiffs have alleged and established that their sensitive personal information has been not only collected but actually published or disseminated to third parties, their injuries are not “conjectural” but “actual.” Lujan, 504 U.S. at 560. Thus, the injury-in-fact requirement is satisfied. III. GENUINE ISSUES OF MATERIAL FACT PREVENT ENTRY OF SUMMARY JUDGMENT ON PLAINTIFFS’ CONTRACT CLAIM. Under California law, a breach of contract requires the existence of a contract, a defendant’s breach, a plaintiff’s performance or excuse for nonperformance, and damage. Gautier v. Gen. Tel. Co., 44 Cal. Rptr. 404, 406 (Cal. Ct. App. 1965). Every element of Plaintiffs’ contract claim has been satisfied. In its Motion, Google targets Plaintiffs’ contract damages theories but fails to demonstrate that the evidence supports entry of summary judgment on its behalf. Indeed, the evidence strongly favors a finding that, at the very least, a genuine issue of material fact exists as to whether Plaintiffs can prove damages. A. THERE IS A TRIABLE ISSUE AS TO PLAINTIFFS’ CONTRACT DAMAGES. Plaintiffs’ breach of contract claim is a state law claim. Although “damage” is an element of a California contract claim, see Gautier, 44 Cal. Rptr. at 406, that damage need not take the form of pecuniary injury. See, e.g., McCarty, 10 Cal. 461, 464 (“For the breach of a contract an action lies, though no actual damages be sustained.”); Sweet v. Johnson, 169 Cal. App. 2d 630, 632, 337 P.2d 499, 500 (Cal. Ct. App. 1959) (“[T]he defendant’s failure to perform a contractual duty is, in itself, a legal wrong that is fully distinct from the actual damages.”); see also Friedman v. Sidley, No. B145784, 2002 WL 124277, at *3 (Cal. Ct. App. 2002) (rejecting argument that breach of contract action requires actual damages and citing McCarty).45 45 Further, under well-settled California law, the breach of a contract gives rise to the right to recover nominal damages, even where a plaintiff suffers no actual damages. Cal. Civ. Code § 3360 (“When a breach of duty has caused no appreciable detriment to the party affected, he may yet recover nominal damages.”); Sweet, 337 P.2d at 632 (“[N]ominal damages … are presumed as a matter of law to stem merely from the breach of a contract[.]”) (citing Ross v. Frank W. Dunne Co., 119 Cal. App. 2d 690, 260 P.2d 104 (Cal. Ct. App. 1953)); accord Friedman, 2002 WL 124277, at *3; Xebec Dev. Partners, Ltd. v. Natl. Union Fire Ins. Co., 12 Cal. App. 4th 501, 576, 15 Cal. Rptr. 2d 726 (Cont’d) Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page26 of 34 20 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Plaintiffs have presented expert evidence establishing and quantifying their information privacy damages under their contract claims.46 Thus, these damages are obviously “appreciable and actual.” Ruiz v. Gap, Inc., 380 F. App’x 689, 691-92 (9th Cir. 2010). These damages figures quantify the injury to Plaintiffs’ and the other Class members’ interests in maintaining as private their names and email addresses. This is the sum of which Plaintiffs and the other Class members were deprived as a result of Google’s failure to perform its end of its contracts with Plaintiffs and other Class members. These interests were expressly protected under the terms of the relevant contracts with Google, and as such they are proper contract damages. See Cal. Civ. Code § 3300. Although certain conventionally “tort-based” damages are not generally recoverable in contract (such as a promisee’s emotional distress damages flowing from a breach of a contract containing no promise to safeguard the promisee’s emotional well-being), privacy-based damages are recoverable where a contract contains a promise to keep certain information private. See, e.g., Roberts Dist. Co. v. Kaye-Halbert Corp., 126 Cal. App. 2d 664, 674, 272 P.2d 886, 892 (Cal. Ct. App. 1954) (compensatory damages available for damage that may “reasonably be supposed to have been within the contemplation of the parties at the time of entering into the agreement.”) (citing 14 Cal. Jur. 2d 660, § 32)); Hadley v. Baxendale, 1854 WL 7208, 9 Exch. 341, 156 Eng. Rep. 145 (Feb. 23, 1854) (the damages recoverable for breach of contract are those that arise naturally from the breach or those that were in the contemplation of the parties at the time the contract was made). Plaintiffs’ and the other Class members also lost a portion of the sales value of their personal information, which, as both the Ninth Circuit’s Robertson opinion and the Claridge court held, suffices to establish the element of damages under California contract law. Robertson, 572 F. App’x at 494; Claridge, 785 F. Supp. 2d at 865 (declining to dismiss contract claims where plaintiff alleged lost sales value of personal information resulting from unauthorized disclosure thereof to third ____________________ (Cal. Ct. App. 1993), overruled on other grounds, 38 Cal. 4th 1252, 45 Cal. Rptr. 3d 362, 137 P.3d 192 (2006); Capell Associates, Inc. v. Central Valley Security Co., 260 Cal. App. 2d 773, 785, 67 Cal. Rptr. 463 (Cal. Ct. App. 1968); Sill Prop., Inc. v. CMAG, Inc., 219 Cal. App. 2d 42, 55, 33 Cal. Rptr. 155 (Cal. Ct. App 1963). 46 Torres Rep. at ¶29(b)(ii). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page27 of 34 21 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 parties). As noted above, Plaintiffs’ expert has concluded that the information disclosed has economic value, which he has quantified, and he has further opined that Class members have lost the opportunity to realize such value by reason of Google’s disclosure of this information.47 This also suffices to establish “appreciable and actual” contract damages. Plaintiffs’ and the other Class members’ resource-consumption damages are similarly “appreciable and actual.” Although these damages are measured as a fraction of the $0.068 per megabyte value established in the Torres Report, Plaintiffs are entitled to seek, on their own behalf and on behalf of each Class member, nominal damages as “vindicat[ion]” of their rights not to have their device resources consumed for purposes they did not authorize. Cummings v. Connell, 402 F.3d 936, 942 (9th Cir. 2005). While the Ninth Circuit has upheld an entry of summary judgment where the sole damages sought were nominal, Ruiz, 380 F. App’x at 692, it did so where the plaintiff was unable to show any appreciable damage flowing from the alleged breach. Id. at 691 (noting that district court found plaintiff failed to adduce “any evidence” of appreciable damage) (emphasis added). That is not the case here. Though Plaintiffs’ resource-consumption damages are small, they have been shown with evidence to be appreciable.48 Accordingly, Ruiz is factually distinct and the Court may not enter summary judgment against Plaintiffs, even if Plaintiffs’ damages would be slight on a per-Class member basis. Finally, following Robertson, the unauthorized dissemination of Plaintiffs’ and other Class members’ personal information itself constitutes “harm … sufficient to show the element of damages for their breach of contract” claim. Robertson, 572 F. App’x at 494. This harm is non- pecuniary, but is nevertheless “actual and appreciable.”49 47 Torres Rep. at ¶14, 16, 17, 22, 29(i), 29(iii). 48 See Torres Rep. at ¶28. 49 Cf. Guimond v. Trans Union Credit Info. Co., 45 F.3d 1329, 1332-33 (9th Cir. 1995) (non- pecuniary harms including emotional distress and humiliation qualify as “actual damages” under the Fair Credit Reporting Act, 15 U.S.C. § 1681); Anderson v. United Finance Co., 666 F.2d 1274, 1277 (9th Cir. 1982) (non-pecuniary harm constitutes “actual damages” under the Equal Credit Opportunity Act, 15 U.S.C. § 1691(e)). Other circuit courts have similarly held that the Fair Housing Act’s “actual damages” requirement, 42 U.S.C. § 3612(c), may be established through non- (Cont’d) Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page28 of 34 22 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Accordingly, Plaintiffs have established the element of damages under their contract claims, or at a minimum, have discharged their burden of production for purposes of the Motion. B. THERE ARE TRIABLE ISSUES AS TO THE OTHER ELEMENTS OF PLAINTIFFS’ CONTRACT CLAIMS. Google’s Motion focuses on the sufficiency of the causal nexus between the consumption of device resources and the disclosure to app developers. In doing so, it ignores or downplays the other compensable harms Plaintiffs have demonstrated, including the quantified privacy-related damages examined in the Torres Report and the non-pecuniary harm of dissemination. Neither of these forms of harm turn on the existence of a close causal nexus between device resource consumption and unauthorized disclosure of personal information; rather, they only require proof that Google breached its agreements with Plaintiffs. Thus, the Court need not reach the question of whether the evidence supports a sufficiently close causal nexus between the consumption of device resources and unauthorized disclosure of personal information to app developers. Nevertheless, Plaintiffs have established the existence of such a causal nexus with compelling proof. Google has not challenged the existence of a contract or Plaintiffs’ satisfactory performance thereunder. Google does argue that its practice of sharing purchaser details, including names, email addresses, and location information, with app developers does not constitute “disclosure” of that information, see Def. Br. at 12, but its argument is meritless. Google argues that Plaintiffs (each of whom has proven that he purchased one or more apps50) cannot show that it disclosed anything to anyone, despite plainly admitting that, between February 2009 and May 2014, the name, email address, and location information of users who purchased an app was made immediately available to ____________________ pecuniary harms such as emotional distress and humiliation. See Jeanty v. McKey & Poague, Inc., 496 F.2d 1119, 1121 (7th Cir. 1974). In addition, the Ninth Circuit has held that non-pecuniary harms may constitute “actual damages” under the Privacy Act, 5 U.S.C. § 552 – although the Supreme Court disagreed for reasons peculiar to the statute’s legislative history. Cooper v. F.A.A., 596 F.3d 538 (9th Cir. 2010), rev’d, F.A.A. v. Cooper, 132 S. Ct. 1441 (2012). Thus, the Ninth Circuit has a consistent track record that non-pecuniary harms may qualify as “actual and appreciable damage.” 50 See Ex. J; Ex. K (DEMARS-000029); Ex. L (MCCULLOUGH-0000001). Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page29 of 34 23 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the developer responsible for that app.51 To make such a showing, Google contends, Plaintiffs would need to establish that particular app developers logged into their accounts after Plaintiffs purchased apps and pulled their order history data. Def. Br. at 12. That simply makes no sense. Disclosure requires only that some information has been made available and exposed to view, regardless of whether anyone in particular actually takes advantage of that availability and exposure. Both case law and ordinary usage of the term (“disclose”), as reflected in dictionaries, agree on this point. See, e.g., United States ex rel. Feingold v. AdminaStar Federal, Inc., 324 F.3d 492, 495 (7th Cir. 2003) (“disclose” means “to open up,” “to expose to view” and “to make known or public”); Oxford English Dictionary, entry: “disclose,” definition 1 (“To uncover and expose to view (anything material); to remove a covering from; to reveal, allow to be seen.”). Plaintiffs have also offered evidence that the practice at issue constitutes “publication” in the discourse of internet technologies.52 Google relies on neither evidence nor case law for its argument to the contrary. Google has unequivocally disclosed Plaintiffs’ and the other Class members’ names, email addresses, and locations to app developers, regardless of any app developer’s actions before or after receiving access to that information. This constitutes a patent breach of Google’s contracts with Plaintiffs and the other Class members, as shown above.53 Finally – though, again, the Court need not reach this question – Plaintiffs have adduced substantial evidence supporting the existence of a sufficiently close causal nexus between the consumption of their device resources and the disclosure of their personal information to developers. Google maintains that, to survive its Motion, Plaintiffs must come forth with evidence directly linking users’ Android devices to app developers. Def. Br. at 12. For this proposition, it predictably cites no authority. In truth, the requisite causal nexus has been established, as a review of the 51 Kirkpatrick Tr. at 85:8-13; 86:12-13. 52 See Curtin Rep. at 4 (“Providing content to the Web has long been recognized as publishing. Using security controls to protect data published in this manner has likewise been recognized from the earliest days of the medium. Specifically, publication in this matter occurred when Google made buyer names, email addresses, and location available to developers.”) (citations omitted). 53 See Factual Summary, section II, supra. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page30 of 34 24 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 relevant facts plainly demonstrates: (a) the purchase process is an “integrated operation” that consumes “measured or limited resources” including “[e]lectric power,” “CPU cycles,” “[m]ain memory,” and “[n]etwork capacity” or bandwidth,54 in order to, among other things, transmit from the device the requisite API calls or messages such as “/commitPurchase,” which itself includes user- and device-specific information; (b) this same “integrated operation” results in the inclusion of the user’s personal details in the Checkout Merchant Center/Play Developer Console of the app developer responsible for the app purchased;55 (c) app developers have immediate access to purchaser details following a purchase;56 and (d) the only reason a user’s personal information would ever be published to an app developer is that the user has purchased the developer’s app (or made an in-app purchase).57 At a minimum, there is a genuine issue of material fact regarding the sufficiency of the causal nexus. Accordingly, Google’s Motion should be denied. IV. GENUINE ISSUES OF MATERIAL FACT PREVENT ENTRY OF SUMMARY JUDGMENT ON PLAINTIFFS’ UCL CLAIMS. Plaintiffs’ UCL fraud prong claim requires a showing that Google’s conduct is likely to 54 Curtin Rep. at 5-6; see also Curtin Rep. at 3 (“The process of completing a purchase in the store now branded as Google Play consumes limited resources local to or used by the purchaser’s device.”). 55 Curtin Rep. at 3 (“The purchase process includes publication of buyers’ information to developers. The business logic implemented by user interfaces such as Google Play Developer Console and Google Checkout Merchant Center causes a user’s name, email address, and location to be published once a purchase is made by the user in Google Play.”), 5 (“The name, email address, and location stored by Google and associated with a user’s Google account was made available to a developer account only after a user made a purchase of content published by the developer in the Google Play store. This practice continued between February 2009 and May 2014.”); Kirkpatrick Tr. at 86:23- 87:2. 56 Kirkpatrick Tr. at 85:8-13, 86:12-13. Close temporal proximity between allegedly causative and allegedly resulting events gives rise to a genuine issue of material fact as to the existence of a causal connection. See, e.g., Munson v. Splice Commc’ns, Inc., No. 12-cv-05089, 2013 WL 6659454, at *16 (N.D. Cal. Dec. 16, 2013) (denying summary judgment where “close proximity in time” between events “g[ave] rise to a fact question”). 57 Kirkpatrick Tr. at 92:15-20. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page31 of 34 25 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 mislead the public, as well as that Plaintiffs relied on that conduct and were harmed by it. In re Google, Inc. Privacy Policy Litig., 2014 WL 3707508 at *13. Because Google’s disclosure of app purchaser details (name, email address, location) was done without securing the consent of, or even notifying, the millions of affected Android app purchasers, and in violation of Google’s privacy policies and terms of service, as shown above, its conduct was likely to mislead the public. Google has not submitted any evidence demonstrating that Plaintiffs did not rely on Google’s express promises not to disclose their information to third parties. Finally, the monetary harms discussed in the foregoing – including Plaintiffs’ information privacy damages and lost sales value damages, as well as damages for impermissibly consumed device resources – support Plaintiffs’ UCL claims. For the same reason that Google is not entitled to summary judgment on Plaintiffs’ contract claims, Google is not entitled to summary judgment on Plaintiffs’ UCL claims. V. IN THE EVENT THE MOTION IS GRANTED DUE TO LACK OF STANDING, PLAINTIFFS REQUEST LIMITED LEAVE TO REPLEAD. If the Court determines, despite Robertson and all the evidence presented herein, that Plaintiffs lack Article III standing to assert their contract and UCL claims because the CTAC does not adequately allege the basis for their economic injuries, as discussed herein, Plaintiffs respectfully request leave specifically and solely to replead the basis for their economic injuries. Google cannot claim it was prejudiced by the presentation of the Torres Report or the arguments concerning Plaintiffs’ privacy-related damages, because Google was advised no later than January 29, 2015, that Plaintiffs were relying on these theories. On that date, Plaintiffs served their Mediation Statement, which sets forth in detail the basis for their privacy-related damages, including several computations reflected in the Torres Report. If Google needed additional discovery on these theories, it could have sought such discovery (or an extension) at that time. It failed to do so, or even to raise the issue with Plaintiffs. Moreover, Google has noticed the deposition of Mr. Torres for April 7, 2015, which will provide Google all the discovery it needs on these theories and their evidentiary bases. Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page32 of 34 26 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Dated: April 3, 2015 BURSOR & FISHER, P.A. By: /s/ L. Timothy Fisher L. Timothy Fisher (State Bar No. 191626) 1990 North California Boulevard, Suite 940 Walnut Creek, California 94596 Tel: 925-300-4455 Fax: 925-407-2700 GARDY & NOTIS, LLP Mark C. Gardy James S. Notis (pro hac vice) Orin Kurtz (pro hac vice) 560 Sylvan Avenue Englewood Cliffs, New Jersey 07632 Tel: 201-567-7377 Fax: 201-567-7337 GRANT & EISENHOFER P.A. James J. Sabella (pro hac vice) Diane Zilka (pro hac vice) Kyle McGee (pro hac vice) 485 Lexington Avenue, 29th Floor New York, New York 10017 Tel: 646-722-8500 Fax: 646-722-8501 Interim Co-Lead Counsel for the Class and Subclasses CARELLA, BYRNE, CECCHI OLSTEIN, BRODY & AGNELLO James E. Cecchi 5 Becker Farm Road Roseland, New Jersey 07068 Tel: 973-994-1700 Fax: 973-994-1744 LAW OFFICES OF RICHARD S. SCHIFFRIN LLC Richard S. Schiffrin P.O. Box 2258 West Chester, Pennsylvania 19380 Tel: 610-203-7154 JAMES SCHWARTZ & ASSOCIATES PC Michael Schwartz 1500 Walnut Street, 21st Floor Philadelphia, Pennsylvania 19102 Tel: 215-751-9865 Fax: 215-751-0658 Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page33 of 34 27 PLAINTIFFS’ MEM. OF POINTS AND AUTH. IN OPP. TO DEFENDANT’S MOTION TO DISMISS OR FOR SUMMARY JUDGMENT / CASE NO. 12-CV-01382 PSG 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 LAW OFFICES OF MARTIN S. BAKST Martin S. Bakst (65112) 15760 Ventura Boulevard, Sixteenth Floor Encino, California 91436 Tel: 818-981-1400 Fax: 818-981-5550 Of Counsel for the Class and Subclasses Case5:12-cv-01382-PSG Document113 Filed04/10/15 Page34 of 34