Giroux v. Essex Property Trust, Inc.

Filing 50

ORDER by Judge Haywood S. Gilliam, Jr. GRANTING 43 MOTION TO DISMISS. Amended Pleadings due by 5/26/2017. (ndrS, COURT STAFF) (Filed on 5/1/2017)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6
7

ANGELE GIROUX,
Plaintiff,

8

ESSEX PROPERTY TRUST, INC.,

Re: Dkt. No. 43

Defendant.

11
United States District Court
Northern District of California

ORDER GRANTING MOTION TO
DISMISS

v.

9
10

Case No.16-cv-01722-HSG

Pending before this Court is Defendant Essex Property Trust, Inc.’s motion to dismiss. See

12
13

Dkt. No. 43. For the reasons detailed below, the Court GRANTS the motion to dismiss.

14

I.

BACKGROUND

15

A.

16

Plaintiff Angele Giroux alleges that Defendant, her current employer, experienced a large-

Factual Background

17

scale cybersecurity data breach. Dkt. No. 42 ¶¶ 1–2. As a result of the breach, cybercriminals

18

accessed personal identifying information — including full names, social security numbers, 2015

19

compensation information, and payroll deduction information — for over 1,500 of Defendant’s

20

current and former employees. Id. ¶¶ 1–2. Defendant notified Plaintiff and the other putative

21

class members of the breach in March 2016. Id. ¶ 5. Plaintiff asserts that the data breach resulted

22

from Defendant’s failure to implement reasonable security measures to detect and prevent cyber-

23

attacks. Id. ¶¶ 6–7.

24

B.

25

On the basis of these facts, Plaintiff filed this action against Defendant under the Class

Procedural Posture

26

Action Fairness Act, 28 U.S.C. § 1332(d)(2), in April 2016. Dkt. No. 1. Rather than oppose

27

Defendant’s motion to dismiss, Plaintiff amended the complaint on October 4, 2016. Dkt. No. 42

28

(“FAC”). Plaintiff asserts four claims for relief on behalf of a putative class comprised of

1

Defendant’s current and former employees: (1) negligence; (2) breach of an implied contract to

2

safeguard personal identifying information; (3) invasion of privacy; and (4) declaratory judgment

3

that Defendant’s cybersecurity measures were, and continue to be, inadequate. Plaintiff seeks

4

actual and statutory damages as well as injunctive and declaratory relief. Defendant now brings its

5

second motion to dismiss. See Dkt. No. 43.

6

II.

LEGAL STANDARD

7

A defendant may move to dismiss a complaint for failing to state a claim upon which relief

8

can be granted under Federal Rule of Civil Procedure 12(b)(6). “Dismissal under Rule 12(b)(6) is

9

appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support
a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th

11
United States District Court
Northern District of California

10

Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff must plead “enough facts to state a

12

claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007).

13

A claim is facially plausible when a plaintiff pleads “factual content that allows the court to draw

14

the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal,

15

556 U.S. 662, 678 (2009).
In reviewing the plausibility of a complaint, courts “accept factual allegations in the

16
17

complaint as true and construe the pleadings in the light most favorable to the nonmoving party.”

18

Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nonetheless,

19

Courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of

20

fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir.

21

2008).

22

III.

23
24
25

ANALYSIS
As a threshold issue, Defendant argues that Plaintiff has failed to allege sufficiently

concrete and particularized injury from the data breach to support Article III standing.
Article III of the Constitution limits the jurisdiction of the federal courts to actual “cases”

26

and “controversies.” U.S. Const., Art. III, § 2. One element of this case-or-controversy

27

requirement is that the plaintiff must have standing to bring a claim. Spokeo, Inc. v. Robins, —

28

U.S. —, 136 S. Ct. 1540, 1547, as revised (May 24, 2016). To establish Article III standing, a
2

1

plaintiff must show: (1) she “suffered an injury in fact”; (2) “that is fairly traceable to the

2

challenged conduct of the defendant”; and (3) “that is likely to be redressed by a favorable judicial

3

decision.” Spokeo, 136 S. Ct. at 1547 (citations omitted). “To establish injury in fact, a plaintiff

4

must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and

5

particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at

6

1548 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Allegations of future harm

7

can establish Article III standing if the harm is “certainly impending,” whereas speculative

8

“allegations of possible future injury are not sufficient.” Clapper v. Amnesty Int’l USA, 133 S. Ct.

9

1138, 1147 (2013) (quotation omitted).

10

Plaintiff bears the burden of proving that she has standing. Spokeo, 136 S. Ct. at 1547.

United States District Court
Northern District of California

11

Critically, in the context of a putative class action, the Court must assess whether the named

12

Plaintiff has Article III standing. Gratz v. Bollinger, 539 U.S. 244, 289 (2003) (“[E]ven named

13

plaintiffs who represent a class must allege and show that they personally have been injured, not

14

that injury has been suffered by other, unidentified members of the class to which they belong and

15

which they purport to represent.”) (quotation omitted).

16

Yet Plaintiff has combined allegations describing the harm she has suffered with the harm

17

the larger putative class has suffered. For example, Plaintiff alleges that she and class members

18

have suffered actual damages that include “time spent and costs associated with mitigating the risk

19

of identity theft, reversing the effects of actual identity theft crimes, costs for credit monitoring for

20

their lifetime, identity theft insurance, tax fraud consequences, and costs associated with freezing

21

and unfreezing financial and other accounts.” FAC ¶ 9; see also id. ¶ 4 (listing specific examples

22

of harm that some “[o]ther employees . . . have experienced”). Plaintiff does not specify which of

23

these costs, if any, Plaintiff has personally incurred since Defendant notified her of the data

24

breach. The only allegations that Plaintiff makes about herself are generically that she “will have

25

to remain vigilant for the rest of her life to combat potential identity theft and tax fraud,” id. ¶ 8,

26

and that she “has already expended time, effort, and financial resources . . . .” Id. ¶ 54. Without

27

more clarity about the specific harm that Plaintiff has personally suffered, the Court cannot

28

adequately assess whether Plaintiff has Article III standing.
3

1
2
3
4
5

IV.

CONCLUSION
Accordingly, the Court GRANTS the motion to dismiss. Plaintiff must amend the

complaint with allegations specifying her own injuries by May 26, 2017.
IT IS SO ORDERED.
Dated: 5/1/2017

6
7
HAYWOOD S. GILLIAM, JR.
United States District Judge

8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
4