Sharti Sion v. SunRun, Inc.

Filing 38

ORDER GRANTING MOTION TO DISMISS by Judge Jon S. Tigar granting 19 Motion to Dismiss. (wsn, COURT STAFF) (Filed on 3/13/2017)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7

SHATRI SION,
Plaintiff,

8

SUNRUN, INC.,

Re: ECF No. 19

Defendant.

11
United States District Court
Northern District of California

ORDER GRANTING MOTION TO
DISMISS

v.

9
10

Case No. 16-cv-05834-JST

12
13

Before the Court is Defendant SunRun, Inc.’s Motion to Dismiss Plaintiff Shatri Sion’s

14

First Amended Complaint. ECF No. 19. For the reasons below, the Court will grant the motion

15

without prejudice.

16

I.

INTRODUCTION

17

On October 10, 2016, Sion filed suit against SunRun, alleging that SunRun “acquired

18

Plaintiff’s credit information through an unauthorized inquiry of Plaintiff’s ‘consumer report.’”

19

ECF No. 1 ¶ 14. Sion argued that these actions constituted both negligent and willful violations

20

the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681-1681x. Id. ¶¶ 40-43. Her complaint

21

contains both individual and putative class claims. Id. ¶ 28.

22

On December 12, 2016, SunRun moved to dismiss Sion’s complaint, arguing that

23

“Plaintiff’s claim for a negligent violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681o,

24

fails to adequately plead the necessary element of actual damages” and that “Plaintiff’s claim for a

25

willful violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681n, fails to adequately plead the

26

necessary element of willfulness.” ECF No. 16 at 2. Sion then filed an amended complaint

27

(“FAC”), which added allegations related to willfulness. FAC ¶ 21. Sion did not modify her

28

damages allegations. Those allegations read, in their entirety:

1

24.
Plaintiff was affected personally because when she realized the behavior of
Defendant described above (pulling her credit report without any authorization),
Plaintiff felt that her privacy had been invaded and that her personal and private
information had been disclosed to Defendant, who had no right to Plaintiff’s private
information. Defendant’s behavior caused Plaintiff to suffer mental and emotional
distress as a result of Defendant’s invasion of Plaintiff’s privacy.
...

2
3
4
5

26.
Further, Defendant increased the risk that Plaintiff will be injured if there is
a data breach on Defendant’s computer systems by acquiring additional highly
sensitive information about Plaintiff and the class members and saving that
information onto its computer system.

6
7

FAC ¶¶ 24, 26.
8
SunRun moved to dismiss the FAC on January 13, 2017. ECF No. 19. SunRun no longer
9

argues for dismissal of the willfulness claim, id. at 3 n.1, but continues to argue that Sion’s FAC

10
does not adequately plead the damages element of her negligence claim, id. at 3.
11
United States District Court
Northern District of California

II.
12
13
14
15

LEGAL STANDARD

A complaint must contain “a short and plain statement of the claim showing that the
pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While a complaint need not contain detailed
factual allegations, facts pleaded by a plaintiff must be “enough to raise a right to relief above the
speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). “To survive a motion

16
to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to
17
18

relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation
marks omitted). “A claim has facial plausibility when the plaintiff pleads factual content that

19
allows the court to draw the reasonable inference that the defendant is liable for the misconduct
20
21
22
23
24

alleged.” Id. While the legal standard is not a probability requirement, “where a complaint pleads
facts that are merely consistent with a defendant’s liability, it stops short of the line between
possibility and plausibility of entitlement to relief.” Id. (internal quotation marks omitted). The
Court must “accept all factual allegations in the complaint as true and construe the pleadings in the
light most favorable to the nonmoving party.” Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir.

25
2005).
26
III.

ANALYSIS

27
To state a negligence claim under FCRA, a plaintiff must plead actual damages stemming
28
2

1

from the defendant’s violation. Burnthorne-Martinez v. Sephora USA, Inc., No. 16-CV-02843-

2

YGR, 2016 WL 6892721, at *6 (N.D. Cal. Nov. 23, 2016). The Ninth Circuit has made clear that

3

“FCRA permits ‘recovery for emotional distress and humiliation.’” Drew v. Equifax Info. Servs.,

4

LLC, 690 F.3d 1100, 1109 (9th Cir. 2012) (quoting Guimond v. Trans Union Credit Info. Co., 45

5

F.3d 1329, 1333 (9th Cir. 1995)).

6

Here, SunRun argues that Sion’s allegations are too conclusory to give rise to a plausible

7

inference that she suffered actual damages. Sion’s FAC contains two paragraphs that relate to

8

damages. The first states that “Plaintiff was affected personally” by SunRun’s behavior, that she

9

“felt that her privacy had been invaded and that her personal and private information had been
disclosed to Defendant,” and that she “suffer[ed] mental and emotional distress as a result of

11
United States District Court
Northern District of California

10

Defendant’s invasion of Plaintiff’s privacy.” FAC ¶ 24. The second alleged that “Defendant

12

increased the risk that Plaintiff will be injured if there is a data breach on Defendant’s computer

13

systems by acquiring additional highly sensitive information about Plaintiff and the class members

14

and saving that information onto its computer system.” FAC ¶ 26.

15

The Court agrees with SunRun that these allegations are too sparse and conclusory to

16

support Sion’s negligence claim. Although actual damages can include emotional distress, “a

17

plaintiff must support her claim for pain and suffering ‘with something more than [her] own

18

conclusory allegations,’ such as specific claims of genuine injury.” Dewi v. Wells Fargo Bank,

19

No. CV 12-2891 SHX, 2012 WL 10423239, at *8–9 (C.D. Cal. Aug. 8, 2012) (quoting Myers v.

20

Bennett Law Offices, 238 F. Supp. 2d 1196, 1206 (D. Nev. 2002). The Dewi court found, for

21

example, that “identif[ying] the category of ‘pain and suffering’ in a laundry list of categories of

22

damages [was] insufficient to state a plausible entitlement to these damages.” Id. Similarly, in

23

Burnthorne-Martinez, the court noted that although the plaintiff argued that “her violation of

24

privacy and the emotional distress caused by such can give rise to a claim for actual damages,” the

25

“only allegations to that effect [were] general and conclusory” and were therefore “insufficient to

26

sustain a claim.” 2016 WL 6892721, at *6. The same is true here. Sion states that she “suffer[ed]

27

mental and emotional distress as a result of Defendant’s invasion of Plaintiff’s privacy,” FAC ¶

28

24, but offers no specific facts about how she suffered those damages.
3

1

The cases Sion cites in her opposition brief do not support her argument. In Drew, for

2

example, the plaintiff “and his psychological expert explained [how] the identity theft caused

3

Drew grave post-traumatic stress due to his weakened condition and his continued association

4

with the fraudulent accounts exacerbated his condition.” Drew, 690 F.3d at 1109. This is more

5

specific than any of the allegations in Sion’s FAC. The same distinction can be drawn with

6

Guimond v. Trans Union Credit Info. Co., where the plaintiff alleged that she suffered “emotional

7

distress, manifested by sleeplessness, nervousness, frustration, and mental anguish resulting from

8

the incorrect information in her credit report.” 45 F.3d 1329, 1332 (9th Cir. 1995). Neither case

9

stands for the proposition that a bald assertion of emotional distress suffices to show actual
damages. Sion also relies on Banga v. Chevron U.S.A. Inc., No. C-11-01498 JCS, 2013 WL

11
United States District Court
Northern District of California

10

71772, at *14 (N.D. Cal. Jan. 7, 2013). But in that case, the court only referenced emotional

12

damages when explaining the legal standard for negligence claims. Not only did the plaintiff not

13

argue that she suffered emotional distress, but the court also held that the plaintiff had failed raise

14

a genuine issue of material fact as to actual damages. Id. Simply put, Sion points the Court to no

15

case where allegations like those in the FAC were sufficient to defeat a motion to dismiss.

16

In addition to emotional distress damages, the FAC states that “Defendant increased the

17

risk that Plaintiff will be injured if there is a data breach on Defendant’s computer systems by

18

acquiring additional highly sensitive information about Plaintiff and the class members and saving

19

that information onto its computer system.” FAC ¶ 26. Sion asserts that this allegation also

20

sufficiently supports her claim of actual damages.

21

Neither party points to a case from this district in which a court considered whether

22

increased risk of identity theft—Sion’s second damage allegation—sufficed to show actual

23

damages in a FCRA case, and the Court did not did not locate any case that was directly on point.

24

Sion’s only authority, Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 514 (D.C. Cir. 2016), is

25

not particularly helpful. Hancock only refers to identify theft as one of several types of damages

26

the plaintiff could have alleged (but did not) in order to demonstrate standing. Id. at 515. The

27

decision did not analyze actual damages, and did not suggest that the magic words “identity theft”

28

alone would have satisfied the plausibility test at the motion to dismiss stage.
4

SunRun, in reply,1 identifies a number of out-of-circuit cases, mostly involving laws other

1
2

than FCRA, where a court found conclusory allegations of increased risk of identity theft too

3

speculative to establish actual damages. See, e.g., Pisciotta v. Old Nat. Bancorp, 499 F.3d 629,

4

639 (7th Cir. 2007) (holding that, under Indiana state law, “allegations of increased risk of future

5

identity theft . . . [are not] a harm that the law is prepared to remedy”). SunRun does point the

6

Court to one case from this district, in which the court found a bare allegation of increased risk of

7

identity theft “too speculative to satisfy the pleading requirement of contract damages.” Svenson

8

v. Google Inc., 65 F. Supp. 3d 717, 725 (N.D. Cal. 2014) (emphasis added). Although that case

9

involved a contract claim, not a FCRA claim, both require a showing of actual damages. See Ruiz
v. Gap, Inc., 622 F. Supp. 2d 908, 917–18 (N.D. Cal. 2009). Given that identical requirement,

11
United States District Court
Northern District of California

10

Svenson’s conclusion is persuasive here. The Court finds that Sion’s conclusory statement that

12

“Defendant increased the risk that [Sion] will be injured if there is a data breach on Defendant’s

13

computer systems” is insufficient, even when coupled with Sion’s allegation of emotional distress,

14

to defeat SunRun’s motion to dismiss.2
CONCLUSION

15

In sum, Sion’s allegations are too speculative and vague to plausibly show actual damages

16
17

stemming from SunRun’s alleged negligent violation of FCRA. The Court therefore dismisses

18

///

19

///

20

///

21

///

22
23
24

1

The Court considers Sun Run’s new authority on reply because it responds to Sion’s opposition
brief, and because it relates to the same general argument SunRun made in its motion to dismiss.
2

25
26
27
28

The present case is distinguishable from those in which the defendant maintains the plaintiff’s
personal information on its server and the server is breached. In those cases, the risk is not that
there will be a breach – that event has occurred – but that the plaintiff’s personal information will
be misused by the persons who committed the breach. In that instance, some courts have
concluded that the risk of misuse is sufficient injury to confer standing. In re Adobe Sys., Inc.
Privacy Litig., 66 F. Supp. 3d 1197, 1214 (N.D. Cal. 2014) (“the risk that Plaintiffs' personal data
will be misused by the hackers who breached Adobe's network is immediate and very real”).
There is no allegation here that SunRun’s servers were breached.
5

1

Sion’s negligence claim, but grants Sion leave to amend her complaint to allege additional facts to

2

support her claim for actual damages. Sion must file any amended complaint by March 27, 2017.

3
4
5
6
7
8

The case management conference currently scheduled for March 15, 2017 is
CONTINUED to June 7, 2017 at 2:00 p.m.
IT IS SO ORDERED.
Dated: March 13, 2017
______________________________________
JON S. TIGAR
United States District Judge

9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
6