Helene Cahen et al v. Toyota Motor Corporation et al

Filing 77

ORDER ON MOTIONS TO DISMISS by Judge William H. Orrick re 43 Motion to Dismiss, 47 Motion to Dismiss, and 49 Motion to Dismiss. Defendants' motions to dismiss are GRANTED. Plaintiffs shall file an amended complaint, if any, by January 8, 2016. (jmdS, COURT STAFF) (Filed on 11/25/2015)

Download PDF
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 HELENE CAHEN, et al., Case No. 15-cv-01104-WHO Plaintiffs, 8 ORDER ON MOTIONS TO DISMISS v. Re: Dkt. Nos. 43, 47, 49 9 10 TOYOTA MOTOR CORPORATION, et al., Defendants. United States District Court Northern District of California 11 12 INTRODUCTION 13 Plaintiffs filed this putative class action against defendants Ford Motor Company, General 14 Motors LLC (“GM”), Toyota Motor Corporation and Toyota Motor Sales, U.S.A., Inc. (the latter 15 two collectively as “Toyota”), alleging that defendants have equipped their vehicles with computer 16 technology that is susceptible to being hacked by third parties. They also assert that defendants 17 improperly collect and transmit information about vehicle performance and the geographical 18 location of the cars they sell in violation of plaintiffs’ right to privacy. 19 Plaintiffs have not established specific or general jurisdiction against Ford. Additionally, 20 given the lack of injury flowing from the asserted potential hacking issue, they lack standing to 21 sue the defendants. Their privacy claims are conclusorily pleaded and need more specificity. For 22 these reasons, I GRANT defendants’ motions to dismiss with leave to amend. 23 24 FACTUAL BACKGROUND Plaintiffs’ First Amended Complaint (“FAC”) identifies three classes of plaintiffs: (1) the 25 “California Class,” consisting of plaintiffs who bring California state law and California 26 constitutional law claims against GM and Toyota in connection with vehicles purchased in 27 California; (2) the “Oregon Class,” consisting of plaintiffs who bring Oregon state law claims 28 against Ford in connection with vehicles purchased in Oregon; and (3) the “Washington Class,” 1 consisting of plaintiffs who bring Washington state law claims against Ford in connection with 2 vehicles purchased in Washington. FAC [Dkt. No. 37]. The central problem alleged is that 3 because the cars’ computer systems lack security, basic vehicle functions can be controlled by 4 individuals outside the car, endangering the safety of vehicle occupants. FAC ¶ 2. For example, 5 hacking can result in the loss of driver control over the throttle, brakes, and steering wheel. FAC 6 ¶ 1. 7 Defendants’ vehicles utilize dozens of electronic control units (“ECUs”), which are small 8 computers that control various vehicle operations. FAC ¶ 3. Vehicle safety depends on “near real 9 time” communication between the ECUs. FAC ¶ 28. The ECUs communicate through a controller area network, or “CAN bus,” by sending each other digital messages called “CAN 11 United States District Court Northern District of California 10 packets.” FAC ¶¶ 3-4. Because “there is no ECU source or authentication, nor any encryption, 12 built into CAN packets,” anyone with physical access to a vehicle can utilize the CAN bus to send 13 malicious CAN packets to the ECUs. FAC ¶ 30. Additionally, defendants’ vehicles are equipped 14 with wireless Bluetooth and cell phone integration capabilities that, when activated by the user, 15 make the vehicles susceptible to remote hacking via wirelessly transmitted CAN packets. FAC ¶ 16 34. Plaintiffs do not allege that any of their vehicles have actually been hacked, or that they are 17 aware of any vehicles that have been hacked outside of controlled environments, but instead allege 18 that hacking is an “imminent eventuality.” FAC ¶ 40. “Any expert will tell you that you can’t 19 prevent it; it’s just a question of when.” Id. 20 Plaintiffs assert that defendants have known for a long time that their vehicles can be 21 hacked, and cite numerous research studies and media articles dating back to 2011 that document 22 the electronic security vulnerabilities of defendants’ vehicles. FAC ¶¶ 36-40. In one article, for 23 example, a journalist wrote, 24 25 26 27 28 “As I drove to the top of the parking lot ramp, the car’s engine suddenly shut off, and I started to roll backward . . . . This wasn’t some glitch triggered by a defective ignition switch, but rather an orchestrated attack performed wirelessly, from the other side of the parking lot, by a security researcher.” FAC ¶ 35. Plaintiffs also allege that despite defendants’ knowledge of significant security 2 vulnerabilities, they market their vehicles as safe. FAC ¶¶ 41-48. Toyota’s promotional materials 2 claim, for example, that “Toyota’s Integrated Safety Management Concept sets the direction for 3 safety technology development and vehicle development, and covers all aspects of driving by 4 integrating individual vehicle safety technologies and systems rather than viewing them as 5 independently functioning units.” FAC ¶ 42. Toyota also claims to be developing “advanced 6 driving support systems where the driver maintains control and the fun-to-drive aspect of 7 controlling a vehicle is not compromised.” FAC ¶ 44. Ford makes similar safety claims, such as, 8 “When you look over the impressive list of collision avoidance and occupant protection features, 9 you’ll know how well-equipped Fusion is when it comes to you and your passengers’ safety.” 10 FAC ¶ 46. Ford makes the same claim about the Focus, stating, “You don’t have to pick and 11 United States District Court Northern District of California 1 choose when it comes to safety. Focus is well equipped with an impressive list of safety features.” 12 Id. GM says “Quality and safety are at the top of the agenda at GM, as we work on technology 13 improvements in crash avoidance and crashworthiness to augment the post-event benefits of 14 OnStar, like advanced automatic crash notification.” FAC ¶ 47. GM also touts the “vast test 15 capabilities” of its new “Active Safety Testing Area,” which will “increase GM’s ability to bring 16 the best new safety technologies to the customer.” FAC ¶ 48. 17 Plaintiffs further contend that defendants collect owner data, specifically geographic 18 location, driving history, and vehicle performance, from the vehicle computers and then share that 19 data with third parties without securing the transmission. FAC ¶¶ 49-50, 135. Defendants 20 disclose their data collection practices in owners’ manuals, online privacy statements, and the 21 terms and conditions of specific feature activations, but drivers cannot opt-out of data collection 22 without disabling the relevant feature. FAC ¶ 50. 23 This class action has five named plaintiffs. Helene Cahen resides in Berkeley, California. 24 She purchased a Lexus RX 400 H in September 2008 from a Lexus dealer in San Rafael, 25 California. FAC ¶ 12. Lexus vehicles are manufactured and sold by Toyota. FAC ¶ 8. Merrill 26 Nisam lives in Mill Valley, California, and purchased a Chevrolet Volt in March 2013 from a 27 Chevrolet dealer in Novato, California. FAC ¶ 14. Chevrolet vehicles are manufactured and sold 28 by GM. FAC ¶ 8. Kerry Tompulis lives in Beaverton, Oregon, and leased a Ford Escape in 3 1 August 2014 from a Ford dealer in Tigard, Oregon. FAC ¶ 13. Richard Gibbs and Lucy Langdon 2 purchased a Ford Fusion in 2014 from a Ford dealer in Renton, Washington and, at the time the 3 FAC was filed, resided in Sequim, Washington. 1 FAC ¶ 15. Plaintiffs bring multiple causes of action which differ for each sub-class. The “California 5 Class,” led by plaintiffs Cahen and Nisam, brings eight causes of action against GM and Toyota: 6 (1) violation of the California’s Unfair Competition Law (“UCL”), Cal. Bus. Prof. Code § 17200, 7 et seq.; (2) violation of California’s Consumers Legal Remedies Act (“CLRA”), Cal. Civ. Cod § 8 1250, et seq.; (3) violation of California’s False Advertising Law (“FAL”), Cal. Bus. Prof. Code 9 § 17500, et seq.; (4) breach of California’s Implied Warranty of Merchantability, Cal. Com. Code 10 § 2314; (5) breach of contract at California common law; (6) fraud by concealment at California 11 United States District Court Northern District of California 4 common law; (7) violation of California’s Song-Beverly Consumer Warranty Act, Cal. Civ. Code 12 §§ 1791.1 & 1792; and (8) invasion of privacy under the California Constitution, Cal. Const. art. I, 13 § 1. FAC ¶¶ 62-138. The “Oregon Class,” led by plaintiff Tompulis, brings three causes of action against Ford: 14 15 (1) violation of Oregon’s Unlawful Trade Practices Act, Or. Rev. Stat. § 646.605, et seq.; (2) 16 breach of Oregon’s Implied Warranty of Merchantability, Or. Rev. Stat. § 72.3140; and (3) 17 fraudulent concealment at Oregon common law. FAC ¶¶ 139-167. Finally, the “Washington Class,” led by plaintiffs Gibbs and Langdon, brings four causes 18 19 of action against Ford: (1) violation of Washington’s Consumer Protection Act, Rev. Code Wash. 20 Ann. § 19.86.010, et seq.; (2) breach of Washington’s Implied Warranty of Merchantability, Rev. 21 Code Wash. § 62A.2-614; (3) breach of contract at Washington common law; and (4) fraudulent 22 concealment at Washington common law. FAC ¶¶ 168-200. Plaintiffs seek relief in the form of an injunction that enjoins defendants from continuing to 23 24 market their cars as safe and requires them to establish a recall program and provide free repairs, 25 such as the addition of Trusted Platform Modules. FAC at p. 34-35. They also request costs, fees, 26 27 28 1 Plaintiffs assert that by the time of the hearing on this motion, plaintiffs Gibbs and Langdon had moved their permanent residence to within this judicial district for reasons unrelated to this litigation. Mot at 9 n.4. This does not change the underlying factual allegations or analysis. 4 1 and damages, including punitive damages and disgorgement. Id. After the parties briefed 2 defendants’ motions to dismiss, I heard argument on November 3, 2015. LEGAL STANDARD 3 4 Federal Rule of Civil Procedure 8(a)(2) requires a complaint to contain “a short and plain 5 statement of the claim showing that the pleader is entitled to relief,” Fed. R. Civ. P. 8(a)(2), in 6 order to “give the defendant fair notice of what the claim is and the grounds upon which it rests,” 7 Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotation marks and alterations 8 omitted). 9 A motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of a complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 11 United States District Court Northern District of California 10 2001). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable 12 legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela 13 Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). While a complaint “need not contain 14 detailed factual allegations” to survive a Rule 12(b)(6) motion, “it must plead enough facts to state 15 a claim to relief that is plausible on its face.” Cousins v. Lockyer, 568 F.3d 1063, 1067-68 (9th 16 Cir. 2009) (internal quotation marks and citations omitted). A claim is facially plausible when it 17 “allows the court to draw the reasonable inference that the defendant is liable for the misconduct 18 alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted). 19 In considering whether a claim satisfies this standard, the court must “accept factual 20 allegations in the complaint as true and construe the pleadings in the light most favorable to the 21 nonmoving party.” Manzarek v. St. Paul Fire & Marines Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 22 2008). However, “conclusory allegations of law and unwarranted inferences are insufficient to 23 avoid a Rule 12(b)(6) dismissal.” Cousins, 568 F.3d at 1067 (internal quotation marks omitted). 24 “[I]t is within [the court’s] wheelhouse to reject, as implausible, allegations that are too 25 speculative to warrant further factual development.” Dahlia v. Rodriguez, 735 F.3d 1060, 1076 26 (9th Cir. 2013). 27 DISCUSSION 28 Defendants moved to dismiss on various grounds, including: (1) lack of personal jurisdiction 5 1 against Ford; (2) failure to establish Article III standing; (3) failure to state a claim under the 2 applicable state laws and the California constitution; and (4) preemption of plaintiffs’ claims by 3 state and federal law. Because I find that personal jurisdiction against Ford is lacking and that the 4 plaintiffs have failed to establish standing for their claims, I do not discuss the other arguments. 5 I. 6 PERSONAL JURISDICTION Federal Rule of Civil Procedure 12(b)(2) authorizes a defendant to seek dismissal of an 7 action for lack of personal jurisdiction. Fed. R. Civ. P. 12(b)(2). When a defendant challenges a 8 court's personal jurisdiction over it, the plaintiff bears the burden of establishing that jurisdiction is 9 proper. Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th Cir. 2015). “Where, as here, the defendant's motion is based on written materials rather than an evidentiary hearing, the plaintiff need only 11 United States District Court Northern District of California 10 make a prima facie showing of jurisdictional facts to withstand the motion to dismiss.” Id. 12 (internal quotation marks and citation omitted). Yet, “the plaintiff cannot simply rest on the bare 13 allegations of its complaint.” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 800 (9th 14 Cir. 2004) (internal quotation marks and citation omitted). Uncontroverted allegations in the 15 complaint are accepted as true, and factual disputes created by conflicting affidavits are resolved 16 in the plaintiff's favor. Id. 17 When no federal statute governs personal jurisdiction, a district court applies the long-arm 18 statute of the state in which it sits. Id. California’s long-arm statute permits a court to exercise 19 personal jurisdiction consistent with constitutional due process. Cal. Code Civ. P. § 410.10. Due 20 process requires that a non-resident defendant have “certain minimum contacts” with the forum 21 “such that the maintenance of the suit does not offend traditional notions of fair play and 22 substantial justice.” Int'l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945) (internal quotation 23 marks and citation omitted). 24 The “minimum contacts” requirement can be satisfied in two ways: general jurisdiction or 25 specific jurisdiction. General jurisdiction applies where a nonresident defendant's “affiliations 26 with the State are so ‘continuous and systematic’ as to render it essentially at home in the forum 27 state.” Daimler AG v. Bauman, 134 S. Ct. 746, 761 (2014) (internal citations and quotation marks 28 omitted). In contrast, specific jurisdiction exists when the defendant's contacts with the forum 6 1 state are more limited but the plaintiff's claims arise out of or relate to those contacts. Id. at 754. 2 General jurisdiction is referred to as “all-purpose” jurisdiction whereas specific jurisdiction is 3 referred to as “case-specific” or “case-linked” jurisdiction. Ranza, 793 F.3d at 1069 n.2 (citations 4 omitted). 5 Ford moves to dismiss the claims brought by Tompulis, Gibbs, and Langdon (the “Ford 6 plaintiffs”) on the basis of lack of personal jurisdiction over Ford in California. Ford makes two 7 primary arguments: (1) because none of the Ford plaintiffs’ claims arise out of Ford’s California 8 related activities, there is no specific jurisdiction; and (2) general jurisdiction is lacking because 9 Ford it is neither headquartered nor incorporated in California and does not have the sufficient “minimum contacts” with California in order for general jurisdiction to be appropriate. Ford Mot. 11 United States District Court Northern District of California 10 at 3-9 [Dkt. No. 47]. Ford is correct on both counts. 12 A. 13 The Ford plaintiffs do not address or oppose Ford’s contention that specific jurisdiction 14 15 16 17 18 19 20 Specific Jurisdiction does not lie here. This is apt. A three-prong test is used to determine whether specific jurisdiction exists: (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates to the defendant's forum-related activities; and (3) the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable. 21 Schwarzenegger, 374 F.3d at 802. The Ford plaintiffs bear the burden of satisfying the first two 22 prongs of the test. Id. Personal jurisdiction cannot be established if they fail to do so. Id. 23 The Ford plaintiffs purchased or leased their vehicles in Oregon and Washington. FAC ¶¶ 24 13, 15. Their claims arise from the allegedly defective CAN bus units in their vehicles and 25 deficiencies in Ford’s disclosures to consumers in Oregon and Washington regarding the sale, 26 marketing, and warranties of those cars. However, none of those claims is tied to Ford’s activities 27 in California. The 2014 Ford Escape Tompulis leased was manufactured in Louisville, Kentucky 28 and then sold to her in Oregon. Dwyer Dec. ¶4 [Dkt. No. 47-1]; FAC ¶ 13. The 2013 Ford Fusion 7 1 Gibbs and Langdon purchased was manufactured in Sonora, Mexico and sold in Washington. 2 Dwyer Dec. ¶5; FAC ¶ 15. The CAN bus systems in both cars were neither manufactured nor 3 designed in California. Pappas Decl. ¶¶ 4-5 [Dkt. No. 47-2]. The warranties at issue were 4 disseminated with the new vehicles at the point of sale and are also available on the website 5 (which is administered from Michigan). Ford Mot. at 8. Notably, the Ford plaintiffs, who at the 6 time of the filing of the FAC were all non-California residents, bring no causes of action against 7 the other defendants, Toyota and GM. See FAC ¶¶ 139-200. 8 In short, the Ford plaintiffs bring solely Oregon and Washington causes of action 9 stemming from transactions that occurred in those states. They have failed to demonstrate that 10 specific jurisdiction over Ford is appropriate in California. United States District Court Northern District of California 11 B. General Jurisdiction 12 The Ford plaintiffs argue that general jurisdiction exists over Ford because “Ford is a 13 corporation doing business in all fifty states . . . specifically in the states of California, Washington 14 and Oregon . . ..” FAC ¶ 22. They claim that 103,467 new Ford vehicles have been registered this 15 year already, accounting for 10.5% of the new vehicle market in California. Ford Opp. at 12 [Dkt. 16 No. 54] (citing Dkt. No. 55-7). 2 According to this same source, of sixteen categories of cars and 17 trucks tracked in California, Ford has a top five selling vehicle in nine of those categories. Id. 18 Ford plaintiffs also point to a screen shot of a Google search result for “ford motor company 19 california [sic]” purporting to show that “Ford operates a research center in Palo, Alto, California; 20 21 22 23 24 25 26 27 28 2 Plaintiffs request judicial notice of Exhibit 7 (“copy of California Auto Outlook, Volume 11, Number 3 (August 2015)”)[Dkt. No. 55-7] and Exhibit 8 (“a copy of the opening page of a Google search result for ‘ford motor company california’ done on September, 28, 2015”)[ Dkt. No. 55-8]. Dkt. No. 55. Defendants oppose. Dkt. Nos. 63, 65, 66. Under Federal Rule of Evidence 201(b), a court can take judicial notice of facts outside the docket only if they are “not subject to reasonable dispute” because it is either “generally known” or can be “accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Although this information is inappropriate for a request for judicial notice, it could have been suitably pleaded by affidavit. In determining personal jurisdiction, “[c]onflicts between parties over statements contained in affidavits must be resolved in the plaintiff's favor.” Schwarzenegger, 374 F.3d at 800. Even if such assertions were properly before court, they would still be insufficient to support personal jurisdiction against Ford. Plaintiffs’ request for judicial notice of Dkt. No. 55-7 and Dkt No. 55-8 is DENIED. Plaintiffs’ request for judicial notice of Exhibits 1-6 are GRANTED as to their existence in the public realm at that time but not as to the truth of their contents. See Van Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010). 8 1 is soliciting employees for jobs in California; and at one time operated a large assembly plant in 2 California.” Id. (citing Dkt. No. 55-8). Plaintiffs’ argument rests on the notion that a company’s “continuous and systematic” 3 4 contacts can confer general jurisdiction. See Helicopteros Nacionales de Colombia, S.A. v. Hall, 5 466 U.S. 408, 416 (1984) (finding no general jurisdiction because defendant lacked continuous 6 and systematic contacts with forum state); Bancroft & Masters, Inc. v. Augusta Nat. Inc., 223 F.3d 7 1082, 1086 (9th Cir. 2000) (same). However, their analysis is undercut by Daimler. 3 The Court in Daimler held that Daimler AG, the German manufacturer of Mercedes-Benz 8 automobiles, was not subject to general jurisdiction in California “despite its multiple offices, 10 continuous operations, and billions of dollars' worth of sales there.” Id. at 772 (Sotomayor, J., 11 United States District Court Northern District of California 9 concurring). “[O]nly a limited set of affiliations with a forum will render a defendant amenable to 12 all-purpose jurisdiction there.” Daimler, 134 S. Ct. at 760. “With respect to a corporation, the 13 place of incorporation and principal place of business are paradigm . . . bases for general 14 jurisdiction.” Id. (internal quotation marks, citations, and modifications omitted). “Those 15 affiliations have the virtue of being unique – that is, each ordinarily indicates only one place – as 16 well as easily ascertainable.” Id. The Court rejected the argument that a nonresident defendant should be subject to general 17 18 jurisdiction “in every State in which [the defendant] engages in a substantial, continuous, and 19 systematic course of business,” finding that such a holding would be “unacceptably grasping.” Id. 20 at 760. In order to find that a corporation is subject to general jurisdiction in a forum, the plaintiff 21 must demonstrate not only that the corporation “engages in a substantial, continuous, and 22 systematic course of business,” but that the “corporation's affiliations with the state are so 23 continuous and systematic as to render it essentially at home in the forum State.” Id. at 761 24 3 25 26 27 28 Plaintiffs also cite In re MyFord Touch Consumer Litig., 46 F. Supp. 3d 936, 946 (N.D. Cal. 2014) to support their contention that because Ford has been a defendant in one lawsuit in this district stemming from sales of its vehicles, it should be “keenly aware that its primary conduct should mean that it can be sued in California without offending any traditional notion of fair play or substantial justice.” Ford Opp. at 12. However, specific jurisdiction existed over Ford in MyFord Touch. To state the obvious, the exercise of specific jurisdiction over Ford in a case where it is appropriate to do so does not mean that Ford consents to general jurisdiction in California. 9 1 (internal quotation marks and citations omitted). Only in an “exceptional” case will “a 2 corporation's operations in a forum other than its formal place of incorporation or principal place 3 of business . . . be so substantial and of such a nature as to render the corporation at home in that 4 State.” Id. at 761 n19. 5 Ford is not incorporated in California, nor does it have its principal place of business here. 6 FAC ¶ 22 (noting that Ford is a Delaware corporation with its principal place of business in 7 Michigan). These facts, alone, are strong evidence that Ford is not at home in California. 8 Daimler, 134 S. Ct. at 760; see also Goodyear, 131 S. Ct. at 2853-54 (noting that “the paradigm 9 forum for the exercise of general jurisdiction . . . [is the corporation's] domicile, place of incorporation, and principal place of business” (citation omitted)). “A corporation that operates in 11 United States District Court Northern District of California 10 many places can scarcely be deemed at home in all of them, [o]therwise, ‘at home’ would be 12 synonymous with ‘doing business.’” Daimler, 134 S. Ct. at 762 n.20. 13 The Ford plaintiffs’ reliance on pre-Daimler cases that use a “continuous and systematic” 14 analysis must be reconsidered in light of this relatively recent precedent. Even if Ford’s business 15 contacts with California are continuous and systematic, approving the exercise of general 16 jurisdiction in every state in which a corporation does business would be “unacceptably grasping.” 17 Id. at 761; see also Google Inc. v. Rockstar Consortium U.S. LP., No. 13-cv-5933–CW, 2014 WL 18 1571807, at *5 (N.D. Cal. Apr. 17, 2014) (declining to exercise general jurisdiction over a patent 19 licensing entity, incorporated in Delaware and headquartered in Texas, that had engaged in 20 continuous and systematic business in the forum state by targeting a significant part of its business 21 to Silicon Valley in California). The general jurisdiction inquiry does not “focus solely on the 22 magnitude of the defendant’s in-state contacts” but must take into account a “corporation’s 23 activities in their entirety, nationwide and worldwide.” Daimler, 134 S. Ct. at 762 n.20 (internal 24 citations, modifications and quotation marks omitted). 25 In Daimler, the Court denied the exercise of general jurisdiction even though Daimler’s 26 subsidiary, whose contacts were imputed for the purposes of the Court’s analysis, “ha[d] multiple 27 California-based facilities,” was the “largest supplier of luxury vehicles to the California market,” 28 and its “California sales account[ed] for 2.4% of Daimler’s worldwide sales.” 134 S. Ct. at 752. 10 1 These facts surpass the type of contacts at issue here. Out of approximately 75,000 employees in 2 the United States and 187,000 worldwide, Ford only has 302 employees in California. Pappas 3 Decl. ¶¶7-8 [Dkt. No. 71]. Even if the volume of business the Ford plaintiffs attribute to Ford is 4 true, it would not be enough to render Ford “essentially at home in the forum State.” Daimler, 134 5 S. Ct. at 761; see also Ranza, 793 F.3d at 1069 (declining to exercise general jurisdiction over a 6 foreign company when the defendant’s contacts with the forum states consisted of: (1) 20 to 27 7 employees working in forum state on expatriate assignments at any one time between 2006 and 8 2008; (2) employees’ average of 47 trips per month to the forum state to conduct business 9 meetings between 2006 and 2011; (3) entering into contracts and various business arrangements; and (4) the presence of its products in forum state’s stores); Martinez v. Aero Caribbean, 764 F.3d 11 United States District Court Northern District of California 10 1062, 1070 (9th Cir. 2014) cert. denied, 135 S. Ct. 2310 (2015) (finding no general jurisdiction 12 over defendant that (1) had contracts worth between $225 and $450 million with eleven California 13 component suppliers; (2) sent representatives to California to attend industry conferences, promote 14 defendant’s products, and meet with suppliers; and (3) advertised in trade publications with 15 distribution in California).4 The Court noted that in an “exceptional case,” “a corporation’s operations in a forum other 16 17 than its formal place of incorporation or principal place of business may be so substantial and of 18 such a nature as to render the corporation at home in that State.” Daimler, 134 S. Ct. at 761 n.19. 19 It did not define what an “exceptional case” is, but its discussion of Perkins v. Benguet 20 Consolidated Mining Co., 342 U.S. 437 (1952), indicates that the bar for such a finding is very 21 high. In Perkins, the Court held that the defendant, a mining company based in the Philippines, 22 was subject to general jurisdiction in Ohio because the defendant's president directed all of the 23 company’s activities from Ohio. 342 U.S. at 448. The Daimler Court noted that Perkins was an 24 4 25 26 27 28 At the hearing, plaintiffs attempted to distinguish Daimler because it was a case brought by a foreign plaintiff against a foreign defendant based on events occurring entirely outside the United States. Nothing in the Court’s opinion limits its holding regarding general jurisdiction to those facts, and the cases decided since Daimler treat it as precedent in determining whether general jurisdiction exists. See, e.g., Ivy Bridge Univ., LLC v. Higher Learning Comm'n, No. 15-cv02187-SC, 2015 WL 6555428, at *3 (N.D. Cal. Oct. 28, 2015)(relying on Daimler to determine general jurisdiction despite all pertinent, underlying events occurring in the United States); Rockstar, 2014 WL 1571807, at *5 (same). 11 1 “exceptional case” because the defendant’s mining operations in the Philippines were halted by 2 Japanese wartime occupation of the Philippines. Id. at 761 n.19. As a result, the Court found that 3 Ohio could be considered the defendant's “surrogate for the place of incorporation or head office” 4 and principal, if temporary, place of business. Id. at 756 n. 8 (citations omitted). Here, the Ford 5 plaintiffs allege no similar facts to support the proposition that California can be considered Ford’s 6 surrogate place of incorporation or temporary place of business. See Xilinx, Inc. v. Papst 7 Licensing GMBH & Co.KG, No. 14-cv-4794-LHK, 2015 WL 4149166, at *5 (N.D. Cal. July 9, 8 2015) (“Merely conducting business in California from a home base in Germany is not 9 “exceptional,” even when such business generates substantial revenue.”). In sum, the Ford plaintiffs have failed to establish general personal jurisdiction over Ford in California. 11 United States District Court Northern District of California 10 II. 12 STANDING Defendants assert that plaintiffs lack standing for all of their claims. “[T]he irreducible 13 constitutional minimum of standing contains three elements.” Lujan v. Defenders of Wildlife, 504 14 U.S. 555, 560 (1992). First, the plaintiff must show an “injury in fact” that is “actual or imminent, 15 not conjectural or hypothetical.” Id. (citations and internal quotation marks omitted). Second, the 16 injury must be “traceable to the challenged action of the defendant, and not the result of the 17 independent action of some third party.” Id. (citations and internal quotation marks omitted). 18 Finally, the injury must be redressable by a favorable judicial decision. Id. A plaintiff bears the 19 burden of establishing standing, but that burden is low at the pleading stage, where “general 20 factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to 21 dismiss we presume that general allegations embrace those specific facts that are necessary to 22 support the claim.” Id. at 561 (citations and internal quotation marks omitted). 23 Plaintiffs claim that they have been injured as a result of defendants’ alleged 24 misrepresentation. They assert that “they would not have purchased their [vehicles] or would not 25 have paid as much as they did to purchase them.” FAC ¶ 66. Similarly, they contend that “they 26 paid an inflated purchase or lease price for the [vehicles].” FAC ¶ 78. 27 A. Whether Injury In Fact Exists Based On The Risk Of Future Hacking. 28 Defendants argue that plaintiffs cannot assert injury in fact based on the risk of future harm 12 1 from the alleged product defect (that defendants’ cars are susceptible to hacking by third parties). 2 The crux of defendants’ contention is that the risk of future injury caused by insecure software is 3 not an injury in fact under Article III because such a scenario is too speculative to constitute a 4 “certainly impending” injury. Clapper v. Amnesty Intern. USA, 133 S.Ct. 1138, 1147-48 (2013); 5 GM Mot. at 4 [Dkt. No. 43]; Toyota Mot. at 8 [Dkt. No. 49]; Ford Mot. at 9. Defendants point out 6 that plaintiffs do not allege any hacking incidents that have taken place outside of controlled 7 settings, and that the entire threat rests on the speculative premise that a sophisticated third party 8 cybercriminal may one day successfully hack one of plaintiffs’ vehicles. GM Mot. at 5; Toyota 9 Mot. at 8; Ford Mot. at 10. The Court recently discussed injury in fact in Clapper, where the plaintiffs sought to 11 United States District Court Northern District of California 10 invalidate a federal law that “allows the Attorney General and the Director of National Intelligence 12 to acquire foreign intelligence information by jointly authorizing the surveillance of individuals 13 who are not ‘United States persons’ and are reasonably believed to be located outside the United 14 States.” 133 S. Ct. at 1142. Because the plaintiffs regularly communicated with individuals they 15 believed to be surveillance targets, they claimed injury in fact based on the likelihood that their 16 own communications would be unlawfully acquired by the federal government. Id. at 1143. In 17 finding that plaintiffs failed to establish injury in fact, the Court held that the “theory of future 18 injury [was] too speculative to satisfy the well-established requirement that threatened injury must 19 be ‘certainly impending.’ Id. (emphasis in original). The court explained that plaintiffs could not 20 establish standing based on the “highly attenuated chain of possibilities” that: 21 22 23 24 25 26 27 28 (1) the Government will decide to target the communications of non-U.S. persons with whom they communicate; (2) in doing so, the Government will choose to invoke its authority under § 1881a rather than utilizing another method of surveillance; (3) the Article III judges who serve on the Foreign Intelligence Surveillance Court will conclude that the Government's proposed surveillance procedures satisfy § 1881a's many safeguards and are consistent with the Fourth Amendment; (4) the Government will succeed in intercepting the communications of respondents' contacts; and (5) respondents will be parties to the particular communications that the Government intercepts. Id. at 1148. Defendants place great weight on U.S. Hotel and Resort Management, Inc. v. Onity, Inc., No. 13-499, 2014 WL 3748639 (D. Minn. July 30, 2014), which focused specifically on the 13 1 implications of Clapper in cases where injury in fact rests on the risk of future harm based on a 2 product defect. In Onity, the defendant sought to dismiss claims brought by hotel owners who had 3 purchased electronic door locks that were susceptible to hacking, although no lock had ever been 4 hacked. Id. at *1, 3. Noting that “there are no allegations that the locks are not presently 5 operational,” id. at *3, the court found that injury in fact was not “certainly impending” because 6 plaintiff’s theory of injury necessarily rested on speculation that a third party would hack the 7 locks. Id. at *4. “While it is possible that a potential intruder would in fact attempt to gain entry, 8 ‘allegations of possible future injury’ are not sufficient.” Id. (citing Clapper, 133 S. Ct. at 1147) 9 (emphasis in original) (modifications omitted). 10 Plaintiffs respond that Onity is inapposite because the susceptibility to hacking in Onity United States District Court Northern District of California 11 merely posed the threat of break-in, whereas the potential hacking of plaintiff’s vehicles poses the 12 more substantial risk of serious bodily injury or death. GM Opp. at 12 [Dkt. No. 53]; Toyota Opp. 13 at 13 [Dkt. No. 52]; Ford Opp. at 17-18. But plaintiffs conflate the nature of the future risk at 14 stake with the plausibility of the future risk for standing purposes—that a greater risk may be at 15 stake in this case does not speak to whether the risk is any more plausible. 16 Plaintiffs also note that Onity did not arise in the Ninth Circuit. GM Opp. at 12; Toyota 17 Opp. at 13; Ford Opp. at 17. That is true, but Ninth Circuit precedent is in line with the Onity 18 court’s interpretation of Clapper. For example, although Birdsong v. Apple, Inc., 590 F.3d 955 19 (9th Cir. 2009) predates Clapper, it is consistent with the requirement that a risk of future harm be 20 certainly impending. The Birdsong court dismissed claims against Apple alleging that the iPod 21 posed an unreasonable risk of hearing loss to its users. Id. at 960. In dismissing the complaint for 22 lack of standing, the court noted that the plaintiffs failed to plead that they themselves suffered or 23 would likely suffer any hearing loss. Id. Accordingly, it was insufficient for the plaintiffs to plead 24 injury to “unidentified iPod users” without also pleading injury that was “concrete and 25 particularized as to themselves.” Id. (emphasis in original). The Birdsong plaintiffs further lacked 26 standing because even the injury as pleaded with regard to “unidentified iPod users” was purely 27 hypothetical—indeed, there had been no claim that anybody suffered reduced hearing loss from 28 iPod use. Id. at 961. 14 Onity and Birdsong are instructive. As in Onity, which involved a similar risk of future 2 hacking, here plaintiffs allege only that their vehicles are susceptible to future hacking by third 3 parties. FAC ¶¶ 1-2, 30, 34. Plaintiffs therefore fail to allege that any harm is “certainly 4 impending” because while it is possible that a potential hacker would in fact attempt to gain 5 control of a vehicle, “allegations of possible future injury are not sufficient.” Onity, 2014 WL 6 3748639 at *3 (internal modifications, citations and quotation marks omitted) (emphasis in 7 original). Although plaintiffs do allege that “it’s just a question of when” until hackers start 8 infiltrating the CAN bus in defendants’ vehicles, FAC ¶ 40 (internal citations and quotation marks 9 omitted), plaintiffs do not allege that any future risk of harm is “concrete and particularized as to 10 themselves.” Birdsong, 590 F.3d at 960 (emphasis in original). They allege only that car owners 11 United States District Court Northern District of California 1 in general face a risk of hacking at some point in the future. The risk faced by the individual 12 plaintiffs themselves remains speculative. 13 Judges in this District regularly deny standing in product liability cases where there has 14 been no actual injury and the injury in fact theory rests only on an unproven risk of future harm. 15 In a closely analogous automobile product liability case, the Hon. Jeffrey S. White denied standing 16 to a group of plaintiffs who brought a class action against Toyota alleging that low temperature 17 driving conditions could render the brakes on certain Corolla model cars harder to apply, resulting 18 in increased stopping distances. Contreras v. Toyota Motor Sales USA, Inc., No. 09-cv-06024- 19 JSW, 2010 WL 2528844, at *1 (N.D. Cal. June 18, 2010). In dismissing the complaint without 20 leave to amend, the court held that the injury as pleaded was too speculative to confer standing 21 because “[p]laintiffs do not allege that their vehicles have manifested the alleged defect” and 22 “[p]laintiffs have not alleged that it is reasonably likely that they intend to drive their vehicles in 23 [low temperature] conditions,” which would put them at increased risk of experiencing the defect. 24 Id. at *6. The case for standing here is more speculative than that presented in Contreras, where 25 the alleged brake problems had manifested with other drivers, if not with the plaintiffs themselves. 26 See also Boysen v. Walgreen Co., No. 11-cv-06262-SI, 2012 WL 2953069, at *7 (N.D. Cal. July 27 19, 2012) (upon motion to dismiss, injury in fact was speculative where plaintiff brought claims 28 alleging defendant failed to disclose the presence of lead and arsenic in its juice, but where 15 1 plaintiff failed to plead facts that show a likelihood of physical harm caused by the chemicals). 2 Here, plaintiffs do not allege that any consumer, outside the realm of controlled experiments, has 3 ever been a victim of vehicle hacking. 4 At the hearing on these motions, plaintiffs’ counsel encouraged me to rely on In re 5 MyFord Touch Consumer Litigation to find standing in this case. MyFord Touch is not analogous. 6 The contested defects in MyFord Touch were numerous, had already manifested, and had been 7 experienced by the plaintiffs bringing the case. 46 F. Supp. 3d at 949 (“Plaintiffs have identified 8 various problems with the [car component] system, ranging from the entire system freezing up or 9 crashing (in which case no features connected to [car component] are operational, including the navigation technology, the radio, the rearview camera, and the defroster) to isolated problems such 11 United States District Court Northern District of California 10 as random but frequent screen black outs, nonresponsiveness to touch or voice commands, locking 12 up of the rearview camera, and inaccurate directions on the navigation system.”). None of those 13 factors is present in this case. The FAC does not allege that plaintiffs have suffered a hacking 14 attack, nor does it plead any facts that would establish that they face an increased risk of a future 15 hacking attack on their vehicles as opposed to other vehicle owners. 16 All of this is not to say that a future risk of harm can never satisfy injury in fact analysis. 17 Although a speculative future risk will not suffice, “a credible threat of harm is sufficient to 18 constitute actual injury for standing purposes.” Riva v. Pepsico, Inc., 82 F. Supp. 3d 1045, 1052 19 (N.D. Cal. 2015) (internal citations and quotation marks omitted). In Riva, the court rejected 20 Pepsi drinkers’ claims that they were put at an increased risk of cancer because of carcinogens that 21 were present in Pepsi at levels that exceeded California standards. Id. at 1049-51. Although the 22 Pepsi drinkers cited studies showing an increased risk of cancer in mice exposed to extremely high 23 levels of the carcinogen at issue, they failed to allege that humans experienced the same cancer 24 risk when exposed to the lower levels present in Pepsi. Id. at 1053. The Pepsi drinkers’ claims of 25 risk therefore lacked credibility and “effectively invited the Court to engage in an ‘ingenious 26 academic exercise in the conceivable to explain how defendants' actions caused their injury.’” Id. 27 (internal quotation marks and citations omitted). 28 The requirement that a threat of harm be credible is not an empty one, especially in light of 16 1 Clapper’s requirement that the threat be “certainly impending.” Just as it was impossible for the 2 Riva court to determine whether the Pepsi drinkers faced an increased risk of cancer, it is difficult 3 for me to conclude whether plaintiffs’ vehicles might be hacked at some point in the future, 4 especially in light of the fact that plaintiffs do not allege that anybody outside of a controlled 5 environment has ever been hacked. Plaintiffs have alleged only that their cars are susceptible to 6 hacking but have failed to plead that they consequently face a credible risk of hacking. 7 8 9 B. Whether Injury In Fact Exists Based On The Alleged Economic Loss Flowing From The Risk Of Future Hacking. Plaintiffs argue that they have Article III standing because of the economic loss that flows from the risk of future injury. GM Opp. at 10; Toyota Opp. at 11; Ford Opp. at 15. They 11 United States District Court Northern District of California 10 principally rely on Hinojos v. Kohl’s Corp., 718 F. 3d 1098 (9th Cir. 2013) and In re Toyota 12 Motor Corp. Unintended Acceleration Marketing, Sales Practices, & Products Liability 13 Litigation, 754 F. Supp. 2d 1145 (C.D. Cal. 2010) (hereinafter “In re Toyota I”). However, 14 plaintiffs fail to discuss the specific facts of either Hinojos or In re Toyota I, which are not 15 analogous to the instant case and do not help them. 16 In Hinojos, plaintiffs alleged they were induced to purchase products that were falsely 17 advertised as on sale but had in reality been “marked down” from fictitiously high “original” 18 prices. Hinojos, 718 F.3d at 1101. The court held that “when, as here, [p]laintiffs contend that 19 class members paid more for a product than they otherwise would have paid, or bought it when 20 they otherwise would not have done so[,] they have suffered an Article III injury in fact.” Id. at 21 1104 n.3 (internal quotation marks, modifications and citations omitted). Because Hinojos 22 involved plaintiffs who had purchased products that were falsely advertised as on sale but had 23 actually been “marked down” from fictitiously high “original” prices, the economic injury was not 24 speculative but directly ascertainable. Id. at 1101. Plaintiffs here do not assert any demonstrably 25 false misrepresentations of value, but rather make conclusory allegations that their cars are worth 26 less because of the risk of future injury. FAC ¶¶ 66, 78, 81, 156, 198. The asserted economic 27 harm is much more speculative than that in Hinojos. 28 In re Toyota I involved widespread and well-documented sudden unintended acceleration 17 1 in Toyota model cars. 754 F. Supp. 2d at 1164. The court found that a “manifested defect” was 2 not required to establish standing “[a]s long as plaintiffs allege a legally cognizable loss under the 3 ‘benefit of the bargain’ or some other legal theory.” Id. There the economic harm suffered by the 4 plaintiffs was not at all speculative because of the decrease in value caused by the defect. Id. at 5 1162. The In re Toyota I court found that “[w]hile a statistically significant propensity for [the 6 sudden unintended acceleration] may not be considered ‘actual’ or ‘imminent,’ the market effect of 7 the alleged [sudden unintended acceleration] defect undoubtedly is actual or imminent.” Id. 8 (emphasis in original). 9 While it was appropriate for that court to infer a market effect from widespread and welldocumented acceleration problems, here the market effect is hypothetical. As Ford points out, all 11 United States District Court Northern District of California 10 vehicles manufactured post-2008 are required to be equipped with some form of the CAN bus 12 protocol that plaintiffs allege to be insufficient. This means that potentially all post-2008 cars 13 vehicles on the American market, and not just defendants’ vehicles, lack the allegedly necessary 14 security protections and firewalls. Because the alleged harm is unmanifested and widespread, how 15 that would translate into economic injury is unclear. 16 Additionally, in a later order from that very same case, the court found that “[w]hen 17 economic loss is predicated solely on how a product functions, and the product has not 18 malfunctioned, the Court agrees that something more is required than simply alleging an 19 overpayment for a ‘defective’ product.” In re Toyota Motor Corp. Unintended Acceleration Litig., 20 790 F. Supp. 2d 1152, 1166 n.11 (C.D. Cal 2011) (hereinafter “In re Toyota II”). The court found 21 standing because of “specific allegations of diminution in value, and repeated recalls . . . in 22 millions of vehicles [that] have driven down resale values.” Id. at 1162 (internal quotation marks 23 and citations omitted). There, plaintiffs alleged that the Kelley Blue Book, and other car value 24 guides, had “lowered the values of Toyota vehicles subject to recalls.” Id. at 1159. Here, 25 plaintiffs make no specific allegations of diminution in value. Instead, the economic loss is 26 “predicated solely on how [the vehicles] function[],” namely, that they are susceptible to hacking, 27 but plaintiffs do not plead the required “something more.” Id. at 1165 n.11. 28 Cases in this District hold that conclusory allegations of economic loss stemming from a 18 1 speculative future risk of harm cannot establish Article III standing unless plaintiffs plead 2 “something more.” In Boysen, for example, the court found that economic injury could not 3 establish injury in fact where “plaintiffs did not plead a distinct risk of harm from a defect in 4 defendants’ products that would make such an economic injury cognizable.” 2012 WL 2953069, 5 at *7. In other words, an economic injury that rests on the risk presented by an underlying product 6 defect fails to establish injury in fact if the underlying risk is itself speculative. See Id. The 7 Boysen court found the alleged economic harm speculative because although arsenic and lead 8 were indisputably present in defendant’s juice, plaintiff could not plausibly plead a risk of physical 9 injury from consuming the juice that would affect its value. Id. 10 Similarly, in Contreras, the economic harm stemming from alleged but unmanifested United States District Court Northern District of California 11 deficiencies in Toyota brakes failed to establish injury in fact. Contreras, 2010 WL 2528844, at 12 *7. First, “[p]laintiffs’ allegation that their vehicles are worth substantially less than they would 13 be without the alleged defect is conclusory and unsupported by any facts,” and second, plaintiffs 14 failed to allege “that they were forced to replace their vehicles after learning of the alleged defect 15 or that they incurred any out-of-pocket damages.” Id. 16 Here, the California Class plaintiffs allege that had they known about the lack of electronic 17 security in their vehicles, “they would not have purchased their Class Vehicles or would not have 18 paid as much as they did to purchase them.” FAC ¶¶ 66, 81. The California plaintiffs also 19 contend that they “suffered injury in fact and actual damages resulting from [d]efendants’ material 20 omissions and misrepresentations because they paid an inflated purchase or lease price for the 21 Class Vehicles.” FAC ¶ 78. The plaintiffs in the Oregon and Washington classes similarly allege 22 that they have been injured “[a]s a result of their reliance” upon defendants’ omissions because of 23 “their lost benefit of the bargain and overpayment at the time of purchase or lease and/or the 24 diminished value of their Class Vehicles.” FAC ¶¶ 165, 198. 25 But those allegations cannot obscure that the alleged economic injury rests solely upon the 26 existence of a speculative risk of future harm. Here, as in Contreras, “[p]laintiffs allegation that 27 their vehicles are worth substantially less than they would be without the alleged defect is 28 conclusory and unsupported by any facts.” See Contreras, 2010 WL 2528844, at *7. The 19 1 plaintiffs have not, for example, alleged a demonstrable effect on the market for their specific 2 vehicles based on documented recalls or declining Kelley Bluebook values. In re Toyota II, 790 3 F. Supp. 2d at 1159; In re Toyota I, 754 F. Supp. 2d at 1162. Nor have they alleged a risk so 4 immediate that they were forced to replace or discontinue using their vehicles, thus incurring out- 5 of-pocket damages. See Contreras, 2010 WL 2528844, at *7; Whitson v. Bumbo, No. 07-cv- 6 05597-MHP, 2009 WL 1515597, at *6 (N.D. Cal. Apr. 16, 2009). In short, plaintiffs fail to 7 establish economic injury in fact because they have not alleged the required “something more” 8 beyond the speculative risk of future harm that underlies the allegations of economic damage. In 9 re Toyota II, 790 F. Supp. 2d at 1166 n.11. 10 United States District Court Northern District of California 11 12 C. Whether Injury In Fact Exists Based On The Invasion Of Privacy Claims Asserted By The California Class Against GM And Toyota. Finally, Toyota and GM dispute whether the California Class plaintiffs have established 13 injury in fact to bring the invasion of privacy claim under the California Constitution. All of 14 plaintiffs’ factual allegations with regard to the privacy claim are contained within just three 15 paragraphs of the FAC, reproduced here in their entirety: 16 17 18 19 20 21 22 23 24 25 26 27 49. Without drivers ever knowing, Defendants also collect data from their vehicles and share the data with third parties. While Defendants agreed to adopt voluntary privacy guidelines governing their collection and sharing of this data, the American Automobile Association and Senator Markey of Massachusetts stated that these measures are insufficient, as they do not provide drivers the right to control their own information and fail to allow drivers to withhold sensitive information from collection in the first instance. 50. As detailed in Sen. Markey’s report, Defendants collect large amounts of data on driving history and vehicle performance, and they transmit the data to third-party data centers without effectively securing the data. Defendants only make drivers aware of such data collection in owners’ manuals, online “privacy statements,” and terms & conditions of specific feature activations—but drivers can’t comprehensively opt out of all collection of data by Defendants, and in the limited situations where opting out is permitted, the driver must turn off a feature or cancel a service subscription. .... 135. Plaintiffs maintain a legally protected privacy interest in their personal data collected and transmitted to third parties by Defendants, including but not limited to the geographic location of their vehicles at various times. FAC ¶¶ 49, 50, 135. 28 20 Despite the California Class plaintiffs’ assertion that they “maintain a legally protected 1 2 privacy interest in their personal data,” FAC ¶ 135, “[p]laintiffs have not identified a concrete 3 harm from the alleged collection and tracking of their personal information sufficient to create 4 injury in fact.” In re iPhone Application Litig., No. 11-MD-02250-LHK, 2011 WL 4403963, at *5 5 (N.D. Cal. Sept. 20, 2011). Without showing an “injury in fact” that is “actual or imminent, not 6 conjectural or hypothetical,” plaintiffs cannot establish Article III standing. Lujan, 504 U.S. at 7 560. 8 9 Plaintiffs string cites to various Ninth Circuit and California district court cases to argue that their allegations are sufficient to establish injury for their privacy claims. GM Opp. at 14; Toyota Opp. at 15. Their cases are inapposite because they fail to establish a comparable credible 11 United States District Court Northern District of California 10 risk of future harm that would constitute injury in fact. For example, Krottner v. Starbucks Corp., 12 628 F.3d 1139 (9th Cir. 2010) involved employees who sued their employer after a laptop that 13 contained unencrypted personally identifying information such as names, addresses, and social 14 security numbers was stolen. 628 F. 3d at 1143. Though the employees did not allege their 15 identities had actually been stolen, the court found that an individual Starbucks employee did not 16 need to have his identity actually stolen in order to establish that he faced “a credible threat of 17 harm”—the fact that a computer containing his personal information had already been stolen was 18 enough. Id. at 1142-43. The court was careful to note, however, that no credible risk of harm, and 19 thus no injury in fact, would have existed “if no laptop had been stolen, and Plaintiffs had sued 20 based on the risk that it would be stolen at some point in the future.” Id. at 1143; see also Low v. 21 LinkedIn Corp., No. 11-cv-01468-LHK, 2011 WL 5509848 at *5-6 (N.D. Cal. Nov. 11, 2011) 22 (noting that in the absence of the “publication or theft” of personally identifying information, the 23 plaintiff failed to establish a “credible threat” of future harm). 24 Similarly in In re Sony Gaming Networks & Customer Data Security Breach Litigation, 25 996 F. Supp. 2d 942 (S.D. Cal. 2014), the plaintiffs had their “names, mailing addresses, email 26 addresses, birth dates, credit and debit card information (card numbers, expiration dates, and 27 security codes), and login credentials” compromised after malicious hackers broke into Sony’s 28 servers. 996 F. Supp. 2d at 954. Analogizing to Krottner, the In re Sony court found that a data 21 1 breach purposefully perpetrated by hackers involving sensitive personal identifying information 2 created a “certainly impending” “credible threat” of future harm. Id. at 962-63; see also Doe 1 v. 3 AOL LLC, 719 F. Supp. 2d 1102, 1105 (N.D. Cal. 2010) (cited by the California Class) (finding 4 injury in fact because AOL created a credible risk of future injury when it inadvertently published 5 to its website a database containing AOL users’ search records, “names, social security numbers, 6 addresses, telephone numbers, credit card numbers, user names, passwords, and financial/bank 7 account information,” which was then downloaded and reposted on numerous third party websites 8 around the internet). 9 The California Class plaintiffs fail to establish a comparable credible risk of future identity theft that would establish an injury in fact. At worst, they allege that GM and Toyota “collect 11 United States District Court Northern District of California 10 large amounts of data on driving history and vehicle performance, and transmit the data to third- 12 party data centers without effectively securing the data.” FAC ¶ 50. Nowhere do plaintiffs allege 13 the kind of theft, malicious breach, or widespread accidental publication of sensitive personally 14 identifying information such as social security numbers or credit card information that the 15 Krottner, In re Sony, and Doe I courts found so dangerous. Instead, the only data plaintiffs 16 specifically identify is “the geographic location of their vehicles at various times.” FAC ¶ 135. It 17 is not apparent how the purposeful disclosure of such data to third party data centers would 18 establish any credible risk of future harm. See Low, 2011 WL 5509848 at *4 (finding that to the 19 extent the plaintiff sought to establish future harm, his allegation that sensitive information may be 20 transmitted to third parties without identifying how it would be transmitted or associated with him 21 was too theoretical to establish Article III standing). 22 Furthermore, plaintiffs do not specifically allege that they themselves have been affected 23 by these alleged behaviors. See LaCourt v. Specific Media, Inc., No. 10-cv-1256, 2011 WL 24 1661532, at *4 (C.D. Cal. Apr. 28, 2011) (finding that plaintiffs had not shown injury-in-fact in 25 part because they had not alleged that they were personally affected by the complained of 26 practices). Without any evidence of a breach or data compromise, speculative and generalized 27 allegations of geographic tracking and data collection is insufficient to establish Article III 28 22 1 standing.5 Even if plaintiffs’ allegations were sufficient to establish standing, they would not 2 3 demonstrate a violation of the right to privacy under the California Constitution. In order to 4 establish an invasion of privacy claim under Article I, Section 1 of the California Constitution, a 5 plaintiff must plead “(1) a legally protected privacy interest; (2) a reasonable expectation of 6 privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of 7 privacy.” Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 39-40 (1994). The California Class plaintiffs fail to adequately identify a protected privacy interest. 9 “Legally recognized privacy interests are generally of two classes: interests in precluding the 10 dissemination or misuse of sensitive and confidential information (informational privacy), and 11 United States District Court Northern District of California 8 interests in making intimate personal decisions or conducting personal activities without 12 observation, intrusion, or interference (autonomy privacy).” Id. at 35. As pleaded, defendants’ 13 tracking of a vehicle’s driving history, performance, or location “at various times,” is not 14 categorically the type of sensitive and confidential information the constitution aims to protect. 15 FAC ¶¶49, 135. Plaintiffs rely on a report by Senator Edward Markey of Massachusetts that 16 discusses concerns about vehicle hacking based on responses to letters sent out and responded to 17 by sixteen automobile manufactures. FAC, Exh. 1 at 12 [Dkt No. 37-3]. However, the report does 18 not fill in the missing gaps in plaintiffs’ allegations. For example, it does not identify which car 19 manufactures are collecting data, the frequency of which the data is being tracked, or the type of 20 data is being collected. Id. Without more robust allegations, I am unable to adopt the plaintiffs’ 21 view that “[t]he Court can reasonably infer that simply by driving, Cahen is constantly creating 22 5 23 24 25 26 27 28 Plaintiffs’ additional allegation that defendants collect and transmit the data “without effectively securing” it cannot save them. FAC ¶50. In Whitaker v. Health Net of California, Inc., No. 11-cv0910, 2012 WL 174961, *1 (E.D. Cal. Jan. 20, 2012), defendants lost servers containing personally identifying medical information. In finding no injury in fact, the court found that “plaintiffs do not explain how the loss here has actually harmed them or threatens to harm them, or that third parties have accessed their data,” and distinguished Krottner on its facts, where the “credible threat” of future harm “arose from the theft of information, not its loss.” Whitaker, 2012 WL 174961 at *2. The threat here is even less. If the total loss of personally identifying medical data which might later fall into the hands of an unknown, malicious third party does not create a credible risk, then plaintiffs’ allegations that their data is transmitted to data centers without sufficient security must also fail. Nowhere do plaintiffs explain how such transmission would result in unknown malicious parties accessing the information. 23 1 data about her personal travel locations, which Toyota collects, aggregates, and disseminates.” 2 Toyota Opp. at 22.6 CONCLUSION 3 For the foregoing reasons, defendants’ motions to dismiss are GRANTED. Given the 4 5 upcoming holidays, plaintiffs shall file an amended complaint, if any, by January 8, 2016. IT IS SO ORDERED. 6 7 Dated: November 25, 2015 ______________________________________ WILLIAM H. ORRICK United States District Judge 8 9 10 United States District Court Northern District of California 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 6 If plaintiffs choose to amend their complaint to allege more concrete, particularized allegations of information dissemination or selling to third parties, they should also consider whether they continue to have a reasonable expectation of privacy in light of information previously disclosed to them. In the FAC, plaintiffs recognize that defendants make “drivers aware of such data collection in owners’ manuals, online ‘privacy statements,’ and terms & conditions of specific feature activations….” FAC ¶50. Defendants argue that a consumer cannot reasonably expect privacy in data when a manufacturer has explicitly provided notice and consent. Toyota Mot. at 23; GM Mot. at 17. Even assuming, as plaintiffs’ allege, that a comprehensive opt-out is not feasible and that instead a consumer must cancel an individual feature or subscription to opt out, it is unclear whether the notice and consent would vitiate a plausible invasion of privacy claim under the California Constitution. 24

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?