Giroux v. Essex Property Trust, Inc.

Filing 50

ORDER by Judge Haywood S. Gilliam, Jr. GRANTING 43 MOTION TO DISMISS. Amended Pleadings due by 5/26/2017. (ndrS, COURT STAFF) (Filed on 5/1/2017)

Download PDF
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 ANGELE GIROUX, Plaintiff, 8 ESSEX PROPERTY TRUST, INC., Re: Dkt. No. 43 Defendant. 11 United States District Court Northern District of California ORDER GRANTING MOTION TO DISMISS v. 9 10 Case No.16-cv-01722-HSG Pending before this Court is Defendant Essex Property Trust, Inc.’s motion to dismiss. See 12 13 Dkt. No. 43. For the reasons detailed below, the Court GRANTS the motion to dismiss. 14 I. BACKGROUND 15 A. 16 Plaintiff Angele Giroux alleges that Defendant, her current employer, experienced a large- Factual Background 17 scale cybersecurity data breach. Dkt. No. 42 ¶¶ 1–2. As a result of the breach, cybercriminals 18 accessed personal identifying information — including full names, social security numbers, 2015 19 compensation information, and payroll deduction information — for over 1,500 of Defendant’s 20 current and former employees. Id. ¶¶ 1–2. Defendant notified Plaintiff and the other putative 21 class members of the breach in March 2016. Id. ¶ 5. Plaintiff asserts that the data breach resulted 22 from Defendant’s failure to implement reasonable security measures to detect and prevent cyber- 23 attacks. Id. ¶¶ 6–7. 24 B. 25 On the basis of these facts, Plaintiff filed this action against Defendant under the Class Procedural Posture 26 Action Fairness Act, 28 U.S.C. § 1332(d)(2), in April 2016. Dkt. No. 1. Rather than oppose 27 Defendant’s motion to dismiss, Plaintiff amended the complaint on October 4, 2016. Dkt. No. 42 28 (“FAC”). Plaintiff asserts four claims for relief on behalf of a putative class comprised of 1 Defendant’s current and former employees: (1) negligence; (2) breach of an implied contract to 2 safeguard personal identifying information; (3) invasion of privacy; and (4) declaratory judgment 3 that Defendant’s cybersecurity measures were, and continue to be, inadequate. Plaintiff seeks 4 actual and statutory damages as well as injunctive and declaratory relief. Defendant now brings its 5 second motion to dismiss. See Dkt. No. 43. 6 II. LEGAL STANDARD 7 A defendant may move to dismiss a complaint for failing to state a claim upon which relief 8 can be granted under Federal Rule of Civil Procedure 12(b)(6). “Dismissal under Rule 12(b)(6) is 9 appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th 11 United States District Court Northern District of California 10 Cir. 2008). To survive a Rule 12(b)(6) motion, a plaintiff must plead “enough facts to state a 12 claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). 13 A claim is facially plausible when a plaintiff pleads “factual content that allows the court to draw 14 the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 15 556 U.S. 662, 678 (2009). In reviewing the plausibility of a complaint, courts “accept factual allegations in the 16 17 complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” 18 Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Nonetheless, 19 Courts do not “accept as true allegations that are merely conclusory, unwarranted deductions of 20 fact, or unreasonable inferences.” In re Gilead Scis. Secs. Litig., 536 F.3d 1049, 1055 (9th Cir. 21 2008). 22 III. 23 24 25 ANALYSIS As a threshold issue, Defendant argues that Plaintiff has failed to allege sufficiently concrete and particularized injury from the data breach to support Article III standing. Article III of the Constitution limits the jurisdiction of the federal courts to actual “cases” 26 and “controversies.” U.S. Const., Art. III, § 2. One element of this case-or-controversy 27 requirement is that the plaintiff must have standing to bring a claim. Spokeo, Inc. v. Robins, — 28 U.S. —, 136 S. Ct. 1540, 1547, as revised (May 24, 2016). To establish Article III standing, a 2 1 plaintiff must show: (1) she “suffered an injury in fact”; (2) “that is fairly traceable to the 2 challenged conduct of the defendant”; and (3) “that is likely to be redressed by a favorable judicial 3 decision.” Spokeo, 136 S. Ct. at 1547 (citations omitted). “To establish injury in fact, a plaintiff 4 must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and 5 particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 136 S. Ct. at 6 1548 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). Allegations of future harm 7 can establish Article III standing if the harm is “certainly impending,” whereas speculative 8 “allegations of possible future injury are not sufficient.” Clapper v. Amnesty Int’l USA, 133 S. Ct. 9 1138, 1147 (2013) (quotation omitted). 10 Plaintiff bears the burden of proving that she has standing. Spokeo, 136 S. Ct. at 1547. United States District Court Northern District of California 11 Critically, in the context of a putative class action, the Court must assess whether the named 12 Plaintiff has Article III standing. Gratz v. Bollinger, 539 U.S. 244, 289 (2003) (“[E]ven named 13 plaintiffs who represent a class must allege and show that they personally have been injured, not 14 that injury has been suffered by other, unidentified members of the class to which they belong and 15 which they purport to represent.”) (quotation omitted). 16 Yet Plaintiff has combined allegations describing the harm she has suffered with the harm 17 the larger putative class has suffered. For example, Plaintiff alleges that she and class members 18 have suffered actual damages that include “time spent and costs associated with mitigating the risk 19 of identity theft, reversing the effects of actual identity theft crimes, costs for credit monitoring for 20 their lifetime, identity theft insurance, tax fraud consequences, and costs associated with freezing 21 and unfreezing financial and other accounts.” FAC ¶ 9; see also id. ¶ 4 (listing specific examples 22 of harm that some “[o]ther employees . . . have experienced”). Plaintiff does not specify which of 23 these costs, if any, Plaintiff has personally incurred since Defendant notified her of the data 24 breach. The only allegations that Plaintiff makes about herself are generically that she “will have 25 to remain vigilant for the rest of her life to combat potential identity theft and tax fraud,” id. ¶ 8, 26 and that she “has already expended time, effort, and financial resources . . . .” Id. ¶ 54. Without 27 more clarity about the specific harm that Plaintiff has personally suffered, the Court cannot 28 adequately assess whether Plaintiff has Article III standing. 3 1 2 3 4 5 IV. CONCLUSION Accordingly, the Court GRANTS the motion to dismiss. Plaintiff must amend the complaint with allegations specifying her own injuries by May 26, 2017. IT IS SO ORDERED. Dated: 5/1/2017 6 7 HAYWOOD S. GILLIAM, JR. United States District Judge 8 9 10 United States District Court Northern District of California 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 4

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.

Why Is My Information Online?