Low v. Linkedin Corporation
Filing
36
OPPOSITION to ( 34 MOTION to Dismiss Amended Complaint ) filed by Kevin Low, Alan Masand. (Seidman, Peter) (Filed on 2/2/2012) Modified text on 2/3/2012 (dhm, COURT STAFF).
1
2
3
4
5
6
7
8
Sanford P. Dumain
Peter E. Seidman
Charles Slidders
Melissa Ryan Clark
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
(212) 594-5300
Facsimile:
(212) 868-1229
Email: sdumain@milberg.com
Email: pseidman@milberg.com
Email: cslidders@milberg.com
Email: mclark@milberg.com
12
Michael R. Reese (SBN 206773)
Kim E. Richman
REESE RICHMAN LLP
875 Avenue of the Ameircas
New York, NY 10001
Telephone:
(212) 579-4625
Facsimile:
(212) 253-4272
Email: mreese@reeserichman.com
Email: krichman@reeseirchman.com
13
Attorneys for Plaintiff
9
10
11
14
15
UNITED STATES DISTRICT COURT
16
NORTHERN DISTRICT OF CALIFORNIA
17
SAN JOSE DIVISION
18
KEVIN LOW, individually and on behalf of all
others similarly situated,
19
Plaintiff,
20
v.
21
22
23
24
25
LINKEDIN CORPORATION, a California
Corporation, and Does 1 to 50 inclusive,
Defendant.
) Case No. CV-11-01468
)
) PLAINTIFFS' OPPOSITION TO
) DEFENDANT'S MOTION TO DISMISS
) THE AMENDED CLASS ACTION
) COMPLAINT
)
) DATE:
March 22, 2012
) TIME:
1:30 p.m.
HON. LUCY H. KOH
) JUDGE:
) COURTROOM: 4, 5th Floor
)
)
)
)
26
27
28
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
TABLE OF CONTENTS
2
Page
3
INTRODUCTION
1
4
ARGUMENT
3
5
I.
6
PLAINTIFFS HAVE ARTICLE III AND PRUDENTIAL STANDING TO
SUE
A.
7
8
B.
9
10
C.
11
12
II.
13
3
Plaintiffs' Allegations are Far More Concrete and Particularized than
What the Ninth Circuit Requires for Standing Purposes
4
By Alleging Disclosure of Valuable and Sensitive Personal
Information, Plaintiffs Have Established Their Standing With
Respect to All Their Claims
7
LINKEDIN VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION AND COMMON LAW
10
16
LinkedIn Violated California's State Constitution
10
B.
15
Plaintiffs Allege Conduct by Defendant that Constitutes a Serious
Invasion of Privacy
11
LinkedIn's Conduct Is Highly Offensive To A Reasonable Person
And Amounts To A Common Law Invasion Of Privacy
13
C.
17
III.
19
PLAINTIFFS HAVE ALLEGED VIOLATIONS OF THE STORED
COMMUNICATIONS ACT
A.
14
LinkedIn Improperly Divulged Communications in Its Capacity as
an RCS
14
B.
Linkedln Is an RCS that "Carried or Maintained" a Communication
16
C.
Linkedln Divulged the "Content" of Communications
16
20
21
22
1.
25
26
D.
27
IV.
17
Plaintiffs' Linkedln IDs are Content
18
3.
24
Plaintiffs' Linkedln-Related Browsing History Is "Content"
2.
23
28
Plaintiffs Satisfied the Injury in Fact Requirement By Pleading That
Defendant Violated Their Rights Under the SCA and California
Constitution
A.
14
18
3
Even if the Linkedln IDs Were "Records," Linkedln Still
Violated the SCA by Revealing Them With Content
19
Linkedln Was Not Authorized to Divulge Its Subscribers'
Communications
LINKEDIN VIOLATED CALIFORNIA'S FALSE ADVERTISING LAW
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
22
24
1
2
3
4
5
V. PLAINTIFFS' CONTRACT CLAIM ALLEGES RECOVERABLE
DAMAGES
26
VI. DEFENDANT CONVERTED PLAINTIFFS' PROPERTY
26
VII. THE AMENDED COMPLAINT ADEQUATELY STATES A CLAIM
FOR NEGLIGENCE
28
CONCLUSION
28
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- ii PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
TABLE OF AUTHORITIES
2
Page(s)
3
CASES
4
5
6
7
8
Ali v. Fasteners for Retail, Inc.,
544 F. Supp. 2d 1064 (E.D. Cal. 2008)
25
In re Application of U.S. for
an Order Authorizing use of A Pen Register, 396 F. Supp. 2d 45 (D.Mass. 2005)
Boon Rawd Trading Int'l Co., Ltd. v. Paleewong Trading Co.,
688 F. Supp. 2d 940 (N.D. Cal. 2010)
16, 17
24
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
Crispin v. Audigier,
717 F. Supp. 2d 965 (C.D. Cal. 2010)
16, 20
Edwards v. First Am. Corp.,
517 F. Supp. 2d 1199 (C.D. Cal. 2007)
3,, 6
4
Edwards v. First Am. Corp.,
610 F.3d 514 (9th Cir. 2010), cert. granted, 131 S. Ct. 3022 (2011)
3, 4
In re Facebook Privacy Litig.,
791 F. Supp. 2d 705 (N.D. Cal. 2011)
21
In re Facebook Privacy Litig.,
No. 10-02389, 2011 U.S. Dist. LEXIS 147345 (N.D. Cal. Nov. 22, 2011)
21
Folgelstrom v. Lamps Plus Inc.,
195 Cal. App. 4th 986 (2011)
12
Fraley v. Facebook, Inc.,
No. 11-01726-LHK, 2011 U.S. Dist. LEXIS 145195 (N.D. Cal. Dec. 16, 2011)
21
Fulfillment Servs. Inc. v. UPS, Inc.,
528 F.3d 614 (9th Cir. 2008)
3
Hepting v. AT&T Corp.,
439 F. Supp. 2d 974 (N.D. Cal. 2006)
4
Hill v. MCI WorldCom Commc'ns, Inc.,
120 F. Supp. 2d 1194 (S.D. Iowa 2000)
19
Hill v. NCAA,
7 Cal. 4th 1 (1994)
9, 12, 24, 25
28
- iii PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
2
3
4
5
6
7
8
9
10
Jessup-Morgan v. Am. Online, Inc.,
20 F. Supp. 2d 1105 (E.D. Mich. 1998)
19
Jewel v. Nat'l Sec. Agency,
No. 10-15616, 2011 U.S. App. LEXIS 25951 (9th Cir. Dec. 29, 2011)
3,, 6
4
NAACP v. Alabama,
357 U.S. 449 (1958)
10
O'Grady v. Super. Ct.,
129 Cal. App. 4th 1423 (2006)
18
In re Pharmatrak, Inc.,
329 F.3d 9 (1st Cir. 2003)
16
Quon v. Arch Wireless Operating Co.,
529 F.3d 892, rev'd on other grounds sub nom. City of Ontario v. Quon, 130 S. Ct.
2619 (2010)
13
11
12
13
14
15
Rowe v. UniCare Life & Health Ins. Co.,
No. 09-2286, 2010 U.S. Dist. LEXIS 1576 (N.D. Ill. Jan. 5, 2010)
Ruiz v. Gap, Inc.,
540 F. Supp. 2d 1121 (N.D. Cal. 2008)
7
12, 24, 25
Ruiz v. Gap, Inc.,
380 F. App'x 689 (9th Cir. 2010)
9
16
17
18
19
20
21
22
23
24
25
26
In re Tobacco II Cases,
46 Cal. 4th 298 (2009)
23
United States v. Davis,
Crim. No. 10-339, 2011 U.S. Dist. LEXIS 56002 (D. Or. May 24, 2011)
18
United States v. Forrester,
512 F.3d 500 (9th Cir. 2008)
15, 16, 18, 19
United States v. Jones,
No. 10-1259, 2012 U.S. LEXIS 1063 (Jan. 23, 2012)
United States v. Maynard,
615 F.3d 544 (D.C. Cir. 2010), aff'd, United States v. Jones,
No. 1259, 2012 U.S. LEXIS 1063 (Jan. 23, 2012)
10, 11, 12
12, 13
STATUTES
4
12 U.S.C. § 2601
27
14
18 U.S.C. § 2510(8)
28
- iv PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
18 U.S.C. § 2510(12)
2
18 U.S.C. § 2702
3
Cal. Civ. Code § 3344
4
5
6
14
passim
3
OTHER AUTHORITIES
15
1986 U.S.C.C.A.N. 3555
16, 18
H.R. Rep. No. 99-647 (1986)
7
8
9
10
11
12
13
14
15
16
17
18
Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Blealdey, and Michael
Hennessy, Americans Reject Tailored Advertising and Three Activities that Enable It
(Sept. 29, 2009)
24
Orrin S. Kerr, The Future of Internet Surveillance Law,
72 Geo. Wash. L. Rev. 1208 (Aug. 2004)
15
Oirn S. Kerr, Internet Surveillance Law After the USA Patriot Act: The Big Brother That
Isn't, 97 Nw. U. L. Rev. 607 (2003)
15
Pamela Jones Harbour, Federal Trade Center (FTC) Commissioner, FTC Roundtable
Series I on Exploring Privacy (Matter No. P095416), Dec. 7, 2009
22
Paul M. Schwartz, Property, Privacy, and Personal Data, 117 Harv. L. Rev. 2055, 205657 (May 2004)
22
Somini Sengupta & Evelyn M. Rusli, Personal Data's Value? Facebook Is Set To Find
Out, N.Y. Times, Jan. 31, 2012, available at
http://www.nytimes.com/2012/02/01/technology/riding-personal-data-facebook-isgoing-public.html
8
19
20
21
22
23
24
25
26
27
28
-vPLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
INTRODUCTION
2
According to LinkedIn, a doctor could provide your name to a pharmaceutical company
3
that has otherwise-anonymous data regarding your prescription use and health; your Internet
4
service provider could provide your name to a marketing company to which you provided
5
otherwise-anonymous information via a survey; or a government could provide your name to a
6
laboratory through which you obtained otherwise-anonymous HIV testing, and yet this wrongful
7
disclosure of your personal information would not be actionable. According to Defendant, you
8
would lack Article In standing — i.e., even a "trilfe" of interest in the outcome of a litigation
9
unless you can show that the third parties that were wrongfully provided your information were
10
not just motivated by profit to match your identity with the otherwise-anonymous information
11
they possessed, and capable of doing so because of the context of the wrongful disclosure, but
12
that they actually did so. See Def. Mem. at 2. According to Defendant, this conduct would not
13
be a substantial invasion of privacy because disclosing a name alone is not an invasion, and thus
14
disclosing a name in any context is permissible. See id. at 16-17. According to Defendant,
15
explicit assurances that any information provided to third parties about you would "not be
16
personally identifiable" and would be "anonymized," as well as claims that your pirvacy would
17
be taken "very seriously" because "maintaining your trust is [their] top concern," are not
18
sufficiently particular and do not demonstrate that relying on such language resulted in the injury
19
caused when these promises were violated. See id. at 20, 23-24; see also IR 49-56. 1 Linkedln
20
would like this Court to hold that a plaintiff cannot even provide a "short and plain," "plausible"
21
ground for relief when it alleges that a company allowed his personal, private information to be
22
de-anonymized. Such a result is unjust, and unsupported by law.
23
Linkedln also argues that the Amended Complaint still contains deficiencies that were
24
present in the initial complaint, which was dismissed without prejudice for failure to allege
25
Article In standing. Def. Mem. at 1-10. The Court' s order dismissing the initial complaint held,
26
in part, that there were insufficient allegations regarding the harm to Mr. Low, noting that it was
27
28
1 References to "9[ _" are references to paragraphs of the Amended Complaint.
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
"unclear from the face of the complaint what information was actually disclosed to third parties
2
that would lead Plaintiff to suffer emotional harm" or "how third party advertisers would be able
3
to infer Low's personal identity from LinkedIn's anonymous user
4
browsing history." Order Granting Defendant's Motion To Dismiss, Low v. Linkedln Corp., No.
5
11-01468-LHK (N.D. Cal. Nov. 11, 2011), ECF No. 28 ("Order"), at 5 (emphasis in oirginal).
6
The Amended Complaint explains in far greater detail how the third parties can determine
7
Plaintiffs' personal identities through LinkedIn user
8
actually correlated to their personal identities and profiles) and can match those LinkedIn IDs
9
with its own anonymous browsing data (because LinkedIn transmits the LinkedIn
combined with his
(which are not anonymous, but are
together
created by the third party), IN 5, 14-18, 28-36. The Amended Complaint
10
with an anonymous
11
also explains that Plaintiffs' personal browsing histories include visits to websites that they
12
consider private, including political, religious, and health-related websites
13
they would not have knowingly disclosed to third parties. (1[ 5. Thus, in addition to the standing
14
conferred by the Stored Communications Act and the California Constitution, the Amended
15
Complaint alleges standing because it establishes how "the injury [each Plaintiff] suffered was
16
specific to [them]"; how personally-identifiable and Internet behavioral information "has
17
concrete, measurable, and provable value in the economy at large"; and how Linkedln and the
18
third parties to which it divulged information can and do use Plaintiffs' personal information to
19
target advertising across various demographics, i.e., to other consumers, and not just for the
20
benefit of Plaintiffs. See Fraley v. Facebook, No. 11-01726-LHK, 2011 U.S. Dist. LEXIS
21
145195 (N.D. Cal. Dec. 16, 2001).
information that
22
Plaintiffs have stated a plausible claim, alleging that they are entitled to
23
compensatory and statutory damages and to injunctive relief because Linkedln
24
disclosed the profiles they viewed and allowed Third Parties to match their actual
25
identities with their private browsing histories. Consequently, Defendant's motion
26
to dismiss should be denied.2
27
Plaintiffs, recognizing that unjust enrichment is not a stand alone cause of action in California,
are not pursuing this claim. However, Plaintiffs maintain their claim for restitution as a remedy.
See Amended Complaint at 28; Fraley, 2011 U.S. Dist. LEXIS 145195.
28
2
-2PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
2
ARGUMENT
I.
PLAINTIFFS HAVE ARTICLE III AND PRUDENTIAL STANDING TO
SUE
3
A.
4
5
To satisfy Article III standing, Plaintiffs "must allege [] injury-in-fact that is
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Plaintiffs Satisfied the Injury in Fact Requirement By Pleading That
Defendant Violated Their Rights Under the SCA and California
Constitution
concrete and particularized, as well as actual and imminent. "3
Order at 3.
Plaintiffs allege that Defendant invaded their rights under the California
Constitution and the Stored Communications Act ("SCA"), 919165-78. Under clear
Ninth Circuit authority, this alone is sufficient to confer injury in fact with respect
to their constitutional and SCA claims, respectively. Jewel v. Nat'l Sec. Agency,
No. 10-15616, 2011 U.S. App. LEXIS 25951, at *11 (9th Cir. Dec. 29, 2011)
(citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 578 (1992)); Fulifllment
Servs. Inc. v. UPS, Inc., 528 F.3d 614, 618-19 (9th Cir. 2008); Edwards v. First
Am. Corp., 610 F.3d 514, 517 (9th Cir. 2010), cert. granted, 131 S. Ct. 3022
(2011) ("Edwards IP) ("The injury required by Article III can exist solely by
virtue of 'statutes creating legal rights, the invasion of which creates standing.'");
cf. Fraley, 2011 U.S. Dist. LEXIS 145195, at *22 (plaintiff 4alleged a violation of
their individual statutory rights under Califonria Civil Code § 3344, and therefore,
an invasion of a legally protected interest for Article III purposes."). Violation of a
constitutional provision also creates standing. Jewel, 2011 U.S. App. LEXIS
25951, at *4.
In such cases, the "'standing question . . . is whether the
constitutional or statutory provision on which the claim rests properly can be
understood as granting persons in the plaintiff's position a right to judicial relief. '''
Edwards II, 610 F.3d at 517 (citation omitted).
The SCA "explicitly creates a
26
3
27
28
Defendant has not really argued that Plaintiffs fail to meet the other standing requirements, i.e.,
that "(2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely
(not merely speculative) that injury will be redressed by a favorable decision."
-3PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
private right of action for claims of illegal surveillance," and it is now clear that an
2
allegation of violation of the SCA is sufficient to establish Article III standing,
3
Jewel, 2011 U.S. App. LEXIS 25951, at *11.
4
5
6
7
8
9
10
ii
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
B.
Plaintiffs' Allegations are Far More Concrete and Particularized than
What the Ninth Circuit Requires for Standing Purposes
Edwards and Jewel are the most recent Ninth Circuit authority directly
relevant to Article III standing. In both cases, the court held that plaintiffs had
standing to bring constitutional and statutory claims even though their allegations
were far less concrete and particularized than what Plaintiffs allege in the
Amended Complaint. Moreover, the SCA and Constitutional claims do not rely on
an economic value theory of personal information to establish injury-in-fact or
harm but rather on violation of well-established privacy rights.
In Edwards v. First Am. Corp., 517 F. Supp. 2d 1199 (C.D. Cal. 2007)
("Edwards 1"), the plaintiff sued under the Real Estate Settlement Procedures Act
("RESPA"), a statute that prohibits kickbacks nad referral fees that "tend to
increase unnecessarily the costs of certain settlement services. " 12 U.S.C. § 2601.
Plaintiff admitted that she had not suffered an injury but contended that she
nevertheless was entitled to statutory damages in the amount of three times what
she paid for her title insurnace. Edwards I, 517 F. Supp. 2d at 1202. The Court
held the plaintiff need not have suffered an overcharge to invoke the protection of
RESPA. Rather, the court stated, "[i]f Edwards can prove her claim, there is a
statutory injury fairly traceable to Defendants' action nad redressable by a
favorable decision. "
Id. at 1204. In affirming, the Ninth Circuit held that,
"[b]ecause the statutory text does not limit liability to instances in which a plaintiff
is overcharged, we hold that Plaintiff has established an injury sufficient to satisfy
Article III. " Edwards II, 610 F.3d at 517.
In Jewel, decided after this Court's decision in Fraley, the Ninth Circuit held
that the plaintiffs had standing to bring their statutory and constitutional claims
-4PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
against the government arising from what the plaintiffs described as
a
" Jewel, 2011 U.S. App.
2
3
LEXIS 25951, at *2.
4
plaintiffs alleged that they were swept into a "dragnet" that "indiscriminately"
5
captured the communications of millions of Americans. Id. at * 16. The plaintiffs
6
did not specify the content of a single specific communication that was intercepted,
7
they did not identify the specific date or time of any interception, they did not
8
allege that any of their communications were of a sensitive nature, nor she did they
9
allege harm. It was sufficient that "Jewel alleged with particularity that her
The allegations in Jewel were extremely broad
i.e.,
10
communications were part of the dragnet," id. at *17-18
11
and AT&T acquire all or most long-distance domestic and intenrational calls to or
12
from AT&T long distance customers, including both the content of those calls and
13
dialing, routing, addressing and/or signaling information pertaining to those calls.
14
Id. at *16-17; see also Hepting v. AT&T Corp., 439 F. Supp. 2d 974, 1001 (N.D.
15
Cal. 2006) ("this dragnet necessarily inflicts a concrete injury that affects each
16
customer in a distinct way").
i.e., that "'Defendants
17
Here, in addressing this Court's basis for dismissal of the first complaint,
18
Plaintiffs go far beyond that which was alleged in either Edwards or Jewel to show
19
that they suffered the injury the California's Constitution and the SCA were
20
designed to protect. Plaintiffs allege that they provided personally identifiable
21
information to Defendant on the basis of its express assurance that "any
22
information provided to third parties will not be personally identifiable. " 919119,
23
57. Defendant nevertheless "provided personally identifiable information to third
24
parties that possess extensive, private information about users.
25
personally identifiable information disclosed by LinkedIn "gave the Third Parties
26
the ability to correlate Plaintiffs' actual identities with their broader Internet
27
browsing histories. Plaintiffs' browsing histories include visits to websites they
28
consider private, including political, religious, and health-related websites. " 915.
- 5PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
9121. The
1
2
3
4
5
6
7
8
Plaintiffs allege that Defendant represented that it "does not store
unencrypted personally identifiable information. " 91 19. However:
LinkedIn failed to take steps to encrypt its users' LinkedIn IDs or eliminate them
from transmissions to third parties. The Company did not have proper secuirty in
place and failed to use commercially reasonable methods to prevent its users'
LinkedIn IDs (and thus identities) from being associated with their Pirvate
Browsing History.
91 21. The Amended Complaint also articulates "a coherent theory of how
[Plaintiffs] personal information was disclosed or transferred to third parties,"
Order at 8.
9
13
15.
Before any cookie data can be transmitted to a Third Party,
the website that the user is visiting must initiate a command telling
the Internet user's computer to communicate with that Third Party.
The website uses the Internet user's browser as a tool to cause this
communication, and dictates which servers the Intenret user's
browsers should communicate with, and what information it
should send to those servers.
14
16.
For example, with regard to Linkedln's conduct:
15
1.
An Internet user visits a Linkedln profile page while logged
in to Linkedln.
2.
Linkedln loads the Linkedln-related content of that
webpage; Spaces are left open on the page for
advertisements and other content (such as beacons) to be
provided by Third Parties.
3.
Linkedln invisibly sends a command to the Intenret user's
browser to initiate the loading of advertisements and other
content on the webpage. The Linkedln command:
10
11
12
16
17
18
19
20
21
23
• Designates the Third Party with which the browser
should communicate and from which the browser
should obtain the advertisements and other content.
24
• Requires that the communication include:
22
25
26
27
28
[a.] From the Intenret user's hard dirve, the cookie
identification number of any cookie that is
associated with the designated Third Party; with
[b.] The URL of the Linkedln profile the user is
viewing, which includes a Linkedln ID.
- 6PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
4.
The third party receives, bundled together in a single
communication prompted by LinkedIn, the Third Party's
cookie identification number and the LinkedIn ID of the
page being viewed.
5.
The third party sends information back to the browser to
load advertising and other content in the designated areas
of the LinkedIn webpage, and continues to track the user
and communicate with the cookie through that content.
2
3
4
5
6
7
9191 15, 16. Thus Plaintiffs have "alleged how third party advertisers would be able
8
to infer [Plaintiffs'] personal identit[ies] from LinkedIn's naonymous user ID
9
combined with [their] browsing history."
Order at 5; cf. Def. Mem. at 7 ("the
10
Amended Complaint fails to explain how any information purportedly was sent to
11
third parties other than a transmission by a user's web browser of a LinkedIn User
12
ID as a component of a URL address.").
13
Under Jewel, all Plaintiffs had to allege to establish Article III standing were
14
communications of indeterminate nature that were included, without their consent,
15
in a "dragnet" surveillance. In Edwards I, the Court held the plaintiff had standing,
16
even though the plaintiff could not allege she was harmed,
17
she had purchased title insurance that had been tainted by a kickback arrangement.
18
As detailed above, Plaintiffs here alleged much more than this. Accordingly,
19
Defendant's motion to dismiss the Amended Complaint nad constitutional claims
20
on standing grounds should be denied.
21
22
C.
on the ground that that
By Alleging Disclosure of Valuable and Sensitive Personal
Information, Plaintiffs Have Established Their Standing With
Respect to All Their Claims
23
Defendant suggests that the Amended Complaint does not describe "'what
24
information was actually disclosed to third parties that would lead Plaintiff to
25
suffer emotional harrn. ''' Def. Mem. at 7 (quoting Order). But the Amended
26
Complaint specifically provides that "Plaintiffs' browsing histories include visits to
27
websites that they consider private, including political, religious nad health-related
28
-7PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
websites. " 1 5. Linkedln divulged Plaintiffs' browsing histories to third parties
2
who "are able to place a Linkedln user' s actual identity with his/her personal,
3
Private Browsing History." 1 20 (emphasis in original).
4
Amended Complaint does allege that Linkedln did actually disclose "potentially
5
sensitive information. " Defendant' s assertion that "[t]here is no suggestion that
6
Linkedln actually passed any potentially sensitive information to anyone " is
7
simply incorrect. See Def. Mem. at 8. "[G]iven the choice, Plaintiffs would not
8
have disclosed this information" and the "Plaintiffs were embarrassed and
9
humiliated by the disclosure of their personally identifiable browsing history." 1 5.4
10
Thus, Plaintiffs provide sufficient detail concenring the allegations of emotional
11
harm. See Order at 7-8 (citing Doe 1 v. AOL LLC, 719 F. Supp. 2d 1102, 1109-111
12
(N.D. Cal. 2010) ("past publication of sensitive personal information . . . regarding
13
AOL members' personal issues, including sexuality, mental illness, alcoholism,
14
incest, rape, and domestic violence and continuing collection and dissemination of
15
this same sensitive information is sufficient to establish standing.")).
Accordingly, the
Here, Linkedln allegedly disclosed sensitive personal
16
information
17
concerning "Plaintiffs' browsing histories [which] include visits to websites they
18
consider private, including political, religious, and health-related websites. " 1 5.
19
Indeed, even the Wall Street Jounral recognized the highly personal nature of
20
online tracking when it "exposed a fast-growing network of hundreds of companies
21
that collect highly personal details about Internet users
22
their online activities,
"9
1 37
political views, health worries, shopping habits, financial situations
23
(emphasis added).
Accordingly, Plaintiffs have "alleged that [their] sensitive
24
4
25
4
24 )
27
28
In Rowe v. UniCare Life & Health Ins. Co., No. 09-2286, 2010 U.S. Dist. LEXIS 1576, at *8
(N.D. Ill. Jan. 5, 2010), the court held that the "widespread exposure of []information" will
suffice at the pleading stage to establish an inference that actual disclosure took place, noting:
" On a motion to dismiss, the Court draws all reasonable inferences in the plaintiff s favor ...
[and] the Court may properly make the inference that the information was accessed at some
point ... even if the exposure itself does not satisfy [the] requirement of disclosure to a third
party
"
-8PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
personal information has been exposed." Order at 8. As such, Plaintiffs have
2
alleged injury-in-fact. Plaintiffs also have sufficiently alleged loss of money or
3
property for the purpose of California consumer statutes.
4
The Amended Complaint sufficiently alleges that the Plaintiffs suffered
5
economic harm as well. Defendant suggests that Plaintiffs' claim of economic
6
injury is limited to "a theory that plaintiffs' browsing history is 'valuable personal
7
property' and plaintiffs 'relinquished this valuable personal property without the
8
compensation to which each were due. ''' Def. Mem. at 8 (quoting 1 5). It is
9
generally recognized that in the context of Internet use, personal information is the
10
currency that is exchanged for access to Web services. See, e.g., Somini Sengupta
11
& Evelyn M. Rusli, Personal Data's Value? Facebook Is Set To Find Out, N.Y.
12
Times,
13
http://www.nytime s .com/2012/02/01/technology/riding-personal-data-facebook-i s-
14
going-public.html. ("Consumers' time and information are effectively the price
15
they pay for free Web services. Facebook allows its users to keep up with far-flung
16
friends and family, for instance, in exchange for that information. Google allows
17
anyone to search for anything, so long as the company can serve up ads based on
18
those searches.") Moreover, the Amended Complaint includes a named plaintiff
19
who paid for Defendant's services
20
of Linkedln when he purchased a 'Job Seeker Premium' subscription."
21
Defendant, moreover, ignores the Amended Complaint's allegations that Plaintiff
22
Masand paid Linkedln to use its services on the basis that his personally
23
identifiable information would be secure, 1 57, but instead, his personally
24
identifiable information was not securely maintained but was disclosed to third
25
parties. 11 20-23. Plaintiff Masand therefore did not receive the full value in the
26
"value-for-value exchange"
27
subscription to Linkedln. See Def. Mem. at 9. Accordingly, the economic harm
28
suffered by Plaintiff Masand is sufficient to establish Article III stnading.
- 9-
Jan.
31,
2012,
at
Al,
available
at
Plaintiff Alan Masnad "became a paid user
1 2.
when he purchased "Job Seeker Premium"
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
See
1
Order at 4 ("At least one named plaintiff must have suffered an injury in fact.")
2
(citing Lierboe v. State Farm Mut. Auto Ins. Co.,
3
2003)).
4
II.
5
6
7
8
9
10
11
12
350 F.3d 1018, 1022 (9th Cir.
LINKEDIN VIOLATED THE RIGHT TO PRIVACY ARISING FROM
CALIFORNIA'S STATE CONSTITUTION AND COMMON LAW
A.
LinkedIn Violated California's State Constitution
Article 1, Section 1 of the Califonria Constitution was amended on
November 7, 1972, following a ballot initiative to create an express right to
privacy. The "Privacy Initiative"
i.e., the privacy amendment
"is to be
interpreted and applied in a manner consistent with the probable intent of the body
enacting it: the voters of the State of Califonria. " Hill v. NCAA, 7 Cal. 4th 1, 16
(1994). The intent of the voters is clear:
16
The pirncipal focus of the Pirvacy Initiative is readily discernable.
The Ballot Argument warns of unnecessary information gatheirng,
use, and dissemination by public and private entities -- images of
"government snooping,"computer stored and generated "dossiers"
and "'cradle-to-grave' profiles on every American" dominate the
framers' appeal to the voters
The evil addressed is ... business
conduct in "collecting and stockpiling unnecessary information ...
and misusing information ... "
17
Id. at 21 (quoting Ballot Pamp., Proposed Stats. and Amends. to Cal. Const. with
18
arguments to voters, Gen. Elec. (Nov. 7, 1972), at 26, 27).
13
14
15
19
California courts have held that a plaintiff must satisfy three elements to establish a
20
violation of the Privacy Initiative: "(1) a legally protected pirvacy interest; (2) a reasonable
21
expectation of pirvacy in the circumstances; and (3) conduct by defendant constituting a serious
22
invasion of pirvacy." Ruiz v. Gap, Inc., 380 F. App'x 689, 692 (9th Cir. 2010) (quoting Hill, 7
23
Cal. 4th at 66). Here, Defendant asserts that LinkedIn's conduct is not a violation of California's
24
Constitution solely because the allegations do not amount to a "[seirous] invasion of privacy."
25
Def. Mem. at. 21. For the reasons articulated below, Defendant is incorrect, and LinkedIn's
26
alleged behavior violates Plaintiffs' privacy rights under the California constitution.
27
28
- 10 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
B.
2
Plaintiffs Allege Conduct by Defendant that Constitutes a Serious
Invasion of Privacy
California voters amended Article 1, Section 1 of the Constitution because they were
3
alarmed that "[c]omputerization of records makes it possible to create 'cradle-to-grave' profiles
4
on every Ameircan" and believing that such "data collecting is threatening to destroy our
5
traditional freedom." Official Ballot Pamphlet at 27. Here, Plaintiffs allege that LinkedIn
6
disclosed users' identities and their browsing history to third parties, thereby enabling the
7
"collecting and stockpiling" of personal information, not submitted for that purpose, to create
8
"dossiers" about the Plaintiffs and Class Members. 1 5. 5 This is the precisely the type of
9
conduct California voters intended to prevent and, thus, constitutes an actionable invasion of
10
pirvacy.
11
12
13
14
15
16
17
18
19
20
21
22
The purpose and intent of the Privacy Initiative make clear the seriousness
of LinkedIn's misconduct. The voters of California intended that the right to
privacy protect Lbw freedom to associate with the people we choose. " Official
Ballot Pamphlet at 28. The Supreme Court has also "recognized the vital
relationship between freedom to associate and privacy in one's associations. "
NAACP v. Alabama, 357 U.S. 449, 462 (1958) ("Inviolability of privacy in group
association may in many circumstances be indispensable to preservation of
freedom of association, particularly where a group espouses dissident beliefs. "
Id.). Here, Linkedln is disclosing a User Identification connected to a web
browsing history that may disclose information about the users' associations,
mcluding membership in, or an interest in, dissident groups.
Last month, the U.S. Supreme Court unanimously held that GPS tracking of
23
24
25
26
27
28
5 Defendant incorrectly states that "[t]here is . . . no allegation that [Plaintiffs'] general Intenret
browsing histories were disclosed to anyone as a result of conduct of Linkedln. Nor is there any
suggestion as to what specific information about plaintiffs caused (or could cause) them
embaffassment. " Def. Mem. at 20-21. The Amended Complaint speciifcally provides that
"Plaintiffs' browsing histoires include visits to websites that they consider private, including
political, religious and health-related websites," 1 5, and Linkedln divulged Plaintiffs' Linkedln
IDs to third parties who "are able to place a Linkedln user's actual identity with his/her personal,
Private Browsing History," 1 20 (emphasis in original), as well as their personal LinkedInrelated browsing histories. See Section I, supra.
- 11 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
a suspect's vehicle constitutes a search under the Fourth Amendment of the U.S.
2
Constitution. United States v. Jones, No. 10-1259, 2012 U.S. LEXIS 1063 (Jan. 23,
3
2012). Writing for the Court, Justice Scalia relied on a trespass theory that is of
4
limited relevance to this case. 6 In two separate concurrences, however, a majority
5
of the Justices recognized, as an independent basis for finding that a search had
6
occurred, that the monitoring of physical movement via a GPS tracking device
7
does not accord with a reasonable expectation of privacy.
8
In his concurrence, Justice Alito stated that, "the use of longer term GPS
9
monitoring in investigations of most offenses impinges on expectations of
10
privacy." Id. at *51. Justice Sotomayor, in her concurrence, questioned whether
11
"GPS monitoring
12
quantum of intimate information about any person whom the Government, in its
13
unfettered discretion, choose to track
14
and government in a way that is inimical to democratic society
15
whether people reasonably expect that their movements will be recorded and
16
aggregated in a manner that enables to the Government to ascertain, more or less at
17
will, their political and religious beliefs, sexual habits and so on.
18
And with respect to the very conduct at issue at here, she stated:
19
20
21
22
23
by making available at a relatively low cost such a substantial
may 'alter the relationship between citizen
I would ask
Id. at *27-28.
I for one doubt that people would accept without complaint the warrantless
disclosure to the government of a list of every Web site they had visited in
the last week, or month, or year. But whatever the societal expectations, they
can attain constitutionally protected status only if our Fourth Amendment
juirsprudence ceases to treat secrecy as a prerequisite to privacy. I would not
assume that all information voluntairly disclosed to some member of the public
for a limited purpose is, for that reason alone, disentitled to Fourth Amendment
protection.
Id. at *31 (emphasis added.) The same reasoning applies with equal if not greater
24
force in this case where LinkedIn, a private entity that collected Plaintiffs' personal
25
information, not only facilitated the tracking of Plaintiffs' web traffic but
26
27
28
6 See Jones, 2012 U.S. LEXIS 1063, at *8. ("The Government physically occupied private
property for the purpose of obtaining information. We have no doubt that such a physical
intrusion would have been considered a 'search' within the meaning of the Fourth Amendment").
- 12 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
effectively "entered" the website location and tracked their movements within.
2
And unlike the GPS tracking at issue in Jones, there was no offsetting
3
governmental interest in law enforcement.
4
The analogy is clear: "[r]epeated visits to a church [website], a gym
5
[website], a bar [website], or [an online] bookie tell a story not told by any single
6
visit, as does one's not visiting any of these [websites] over the course of a month",
7
and "[a] person who knows all of another's [web browsing history] can deduce
8
whether he is a weekly church goer, a heavy drinker, a regular at the gym, an
9
unfaithful husband, an outpatient receiving medical treatment, an associate of
10
particular individuals or political groups
11
person, but all such facts. " United States v. Maynard, 615 F.3d 544, 562 (D.C. Cir.
12
2010), aff'd, Jones, 2012 U.S. LEXIS 1063. As in Jones, it is the aggregation of
13
disclosed information, the profile or dossier of an individual, created from that
14
person's web browsing history that amounts to a serious breach of privacy.'
15
16
17
18
19
20
21
22
23
24
25
26
27
28
C.
and not just one such fact about a
LinkedIn's Conduct Is Highly Offensive To A Reasonable Person
And Amounts To A Common Law Invasion Of Privacy
Defendant tries to trivialize the effects of LinkedIn's invasion of privacy by
suggesting that the disclosure of Plaintiffs' LinkedIn User Identification "is not a
'private matter' or 'private fact' as this was a number assigned by LinkedIn" and
the "disclosure of user's 'LinkedIn-related browsing history' would not rise to the
level of 'highly offensive' given the ubiquity of cookies and targeted online
advertising." Def. Mem. at 22. Defendant is here apparently suggesting that
"because everyone invades an Internet user's privacy, it is ok for Linkedln to do
7 Defendant's reliance on Ruiz v. Gap, Inc., 540 F. Supp. 2d 1121 (N.D. Cal. 2008), Folgelstrom
v. Lamps Plus Inc., 195 Cal. App. 4th 986 (2011), and Hill, supra, is misplaced. Def. Mem. at
21-22. Those cases involved disclosure of a single piece of unlinked information (social security
numbers or ZIP codes). In contrast, Linkedln has disclosed its users' identifications, thereby deanonymizing their browsing history, and did so in conjunction with their Linkedln-related
browsing history, thereby enabling third parties to "stockpile" information about the user's most
personal habits and preferences (derived from their browsing history) and create the type of
personal "dossier" the Privacy Initiative was intended to prevent.
- 13 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
so."It goes without saying that a reasonable person would be highly offended by
2
somebody eavesdropping on their Internet browsing, an activity that is often
3
conducted in the privacy of one's home and behind closed doors, on a computer
4
that is password-protected, or on mobile devices
5
protected nad, in all cases, inaccessible to public view.
6
III.
7
perhaps also password-
PLAINTIFFS HAVE ALLEGED VIOLATIONS OF THE STORED
COMMUNICATIONS ACT
When Internet users sign up for LinkedIn, they are required to provide personal
8
information including their name; email address; country; zip code; information regarding
9
whether they are employed, looking for a job, or a student; and details regarding their
10
employment or school. 1 24. Linkedln processes this information, stores it as a profile, stores
11
any connections with other Linkedln users that the user has identified or Linkedln has
12
discovered, and creates a Linkedln. Id. 1 25; see supra sec. 1. This number is unique, it' s
13
permanent, and it' s designed for internal use on the website. 8 Despite the expectation of privacy
14
that is both implied by the nature of the information exchanged and explicitly assured in
15
Linkedln's privacy practices, Linkedln divulges this ID to third parties in violation of the SCA.
16
Linkedln also divulges to third parties the vairous profiles that its members view, which is itself
17
a violation of the SCA. And most importantly, Linkedln knowingly divulges this information in
18
a context that allows third parties to correlate the information with an otherwise anonymous
19
browsing history. While the broader browsing histories are collected by third parties, not
20
Linkedln, the information Linkedln divulges to the third parties provides identity, substance, and
21
meaning to the browsing histoires.
22
A.
23
24
Linkedln Improperly Divulged Communications in Its Capacity as an
RCS
A remote computing service ("RCS") provides "computer storage or
25
26
27
28
This process is not unlike that which occurs when one sets up a bank account: the account
holder entrusts the bank with pirvate information, and the bank assigns a private number to
identify his/her account. Rather than identifying an account, however, the number assigned by
Linkedln identifies a person.
8
- 14 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
processing services," § 2711(2), not unlike a "virtual filing cabinet. " Quon v. Arch
2
Wireless Operating Co., 529 F.3d 892, 902, rev'd on other grounds sub nom. City
3
of Ontario v. Quon, 130 S. Ct. 2619 (2010). Here, LinkedIn is an RCS because it
4
stores profiles and creates a network of users
5
personal information and users' connections, as well as users' intentions to view
6
those connections.
like a giant, interactive rolodex of
7
Defendant admits that it is an RCS, but argues that the SCA still does not
8
apply to it because it was not acting like an RCS when it divulged Plaintiffs'
9
personally identifiable information. Def. Mem. at 11-12.
10
The law is clear,
however, that the mechanism by which an RCS like LinkedIn makes the disclosure
in this case, by transmission of a URL
11
is not relevant to its SCA liability.
12
Under § 2702(a)(2), an RCS is prohibited from disclosing the contents of two types
13
of communications that are carried or maintained on its service: 1) those received
14
from the subscriber or 2) those created by means of processing communications
15
received from a subscriber.
16
communications must be "carried or maintained . . . solely for the purpose of
17
providing storage or computer processing services" § 2702(a)(2)(B)). Here,
18
Linkedln received Plaintiffs' personal profile information (the first type of
19
communication), and processed that communication by creating a profile and
20
assigning a User ID (the second type of communication). 9 Linkedln carried or
21
maintained these communications on its service, and did so for no other purpose
22
than to store and process user's profile information nad connections. When
23
browsing Linkedln profiles, Plaintiffs also sent Linkedln communications
24
regarding the pages they would like to visit (the first type of communication) and
25
Linkedln processed that information into a URL (the second type of
(Emphasis added.)
(Additionally, these
26
27
28
"[E]lectronic communication[s]" are defined broadly under the ECPA to extend beyond e-mails
and other messages and include "any transfer of signs, signals, wirting, images, sounds, data, or
intelligence of any nature
" 18 U.S.C. § 2510(12).
9
- 15 -
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
communication). By disclosing these communications to third parties, LinkedIn,
2
an RCS, violated the SCA.
3
B.
4
Defendant's argument that it did not divulge information in "electronic
5
storage is irrelevant, because "electronic storage is not a requirement for an SCA
6
violation by an RCS. All that LinkedIn needed to have done as an RCS is divulge
7
information that it "carried or maintained on [its] service.
8
provision does state that the RCS must have the communication "solely for the
9
purpose of providing storage or computer processing services," but nowhere does
10
it use the SCA' s defined term "electronic storage."). LinkedIn "carries or
11
maintains" the divulged information because it stores personal information,
12
profiles, and connections, and it processes that information into User DIs and
13
URLs. LinkedIn acknowledges this: "Our solutions involve the storage and
14
trnasmission of members' and customers' information, some of which may be
15
private
16
(emphasis added);
17
information and other data
LinkedIn Is an RCS that "Carried or Maintained" a Communication
See §
2702(a) (the
" LinkedIn Corp., Prospectus (Form 424B4) (May 18, 2011) at 14
see also id.
at 15 ("We process, store and use personal
") (emphasis added).
18
C.
19
Under the SCA, "contents"includes "information concerning the substance,
20
purport, or meaning of that communication," 18 U.S.C. § 2510(8), as distinguished
21
from the mere Lexistence of the communication or transactional records about it,"1°
22
1986 U.S.C.C.A.N. 3555, 3567. It is not the communication's type (e.g., data,
23
signals, intelligence) that defines whether it includes "contents," but is instead the
24
communication's "functional role" that "explains the different treatment that the
25
two categories receive in the SCA.
LinkedIn Divulged the "Content" of Communications
Id. Here, the personal information divulged
26
27
28
io Transactional records are non-substantive "information about the communication that the
network uses to deliver and process the content information. " Orrin S. Kerr, The Future of
Internet Surveillance Law, 72 Geo. Wash. L. Rev. 1208, 1228 (Aug. 2004).
- 16 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
by LinkedIn does not merely serve the purpose of "tell[ing] the computer where
2
[the communication] should go and what it should do," but conveys "substance"
3
and "meaning" to advertisers regarding the user's browsing pattenrs, interests, and
4
identity). See Orin S.
5
The Big Brother That Isn' t, 97 Nw. U. L. Rev. 607, 645-46 (2003).
6
7
8
Kerr,
Internet Surveillance Law After the USA Patriot Act:
LinkedIn discloses two types of "contents" of communications: a) Linked-In related
browsing histories, b) LinkedIn IDs.
1.
Plaintiffs' LinkedIn-Related Browsing History Is "Content"
9
LinkedIn discloses its users' LinkedIn-related browsing history by
10
trnasmitting URLs. URLs, or uniform resource locators, identify the particular
11
document (i.e., page) within a website that a person views, thereby revealing
12
information about the person's Internet activity.
13
512 F.3d 500, 510 (9th Cir. 2008) (allowing the disclosure of "record" information
14
because that information did not disclose "the contents of [] messages or
15
particular pages on the websites the person viewed"; "[a] URL, unlike an
16
address, identifies the particular document within a website that a person
17
views and thus reveals much more information about the person's Internet
18
activity, " further stating that such information "might be more constitutionally
19
problematic." (emphasis added)). The webpage is " contents" because it conveys to
20
the user information concerning the "substance, purport, or meaning" of the
21
communication. And furthermore, it implicitly conveys the content of the user's
22
communication to the website, i.e., the request to view a particular page. Here,
23
LinkedIn divulged such content. "
See United States v. Forrester,
the
IP
24
25
26
27
28
ii In Forrester, the Ninth Circuit addressed the "contents" of communications in a Fourth
Amendment context, but the SCA provides even "greater pirvacy protection" than the Fourth
Amendment. Crispin v. Audigier, 717 F. Supp. 2d 965, 971-72 (C.D. Cal. 2010).
- 17 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
2.
Plaintiffs' LinkedIn IDs are Content
2
LinkedIn also improperly divulged Plaintiffs' LinkedIn IDs to its third party
3
advertisers and advertising data aggregators. The First Circuit has recognized that
4
the "definition [of "contents"] encompasses personally identifiable information
5
such as a party's name, date of birth, and medical condition. " In re Pharmatrak,
6
Inc., 329 F.3d 9, 19 (1st Cir. 2003) (citing Gelbard v. United States, 408 U.S. 41,
7
51 n.10 (1972) and Nix v. O'Malley, 160 F.3d 343, 346 n.3 (6th Cir. 1998)). While
8
courts sometimes consider names
9
communication here dictates otherwise.
10
11
12
13
tion-content records," the context of the
The legislative history, regarding the
Electronic Communications Privacy Act, made clear:
Under [the definition of contents], a service provider is allowed to divulge
mailing lists that identify persons fitting broad demographic criteira. Unless
otherwise authoirzed, service providers may not divulge to third parties
information that proifles the activities of individual subscribers through the
divulgence of the contents of a communication.
14
H.R. Rep. No. 99-647, at 64 (1986) (emphasis added). Given the "functional role"
15
of the communication, the User Identification plainly qualifies as EContents. "
16
By divulging Plaintiffs' Linkedln DIs to third parties, it divulged the
17
contents " of communications because the IDs are linked to profiles of the
18
activities of the subscribers on the Web. See H.R. Rep. No. 99-647. In Forrester,
19
512 F.3d 500, the Ninth Circuit recognized this. In Forrester, the Court relied in
20
part on In re Application of U.S. for an Order Authorizing use of A Pen Register
21
and Trap On [xxx] Internet Service Account/User Name, [xxxxxxxx@xxx.com ]
22
("Pen Register"), 396 F. Supp. 2d 45 (D. Mass. 2005), in which the court
23
recognized that "dialing, routing, addressing and signaling information" can reveal
24
the "'contents' of a communication. " Id. at 48. In Pen Register, the court noted
25
that a person may dial a telephone number (which is clearly record information),
26
but also be "asked to dial a second number such as a personal account number or
27
social security number or any other identifying number in order to receive further
28
- 18 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
information" or ECredit card or bank account numbers.
2
"anyone [would] doubt that although dialing this second number creates
3
`...dialing, routing, addressing, or signaling inforrnation . . . this inforrnation ..
4
. contains the 'content' of a communication[d") (emphasis added).
5
Id. (questioning whether
The court in Pen Register also disapproved of disclosing other information typed into
6
websites. The court addressed an issue that is very similar to the one at hand, noting that a
7
"search phrase would appear in the URL after the first forward slash," just as the viewed-
8
page ID appears in this case, and "[t]his would reveal content-that is, it would reveal, in the
9
words of the statute, `...information concerning the substance, purport or meaning of that
10
communication.' The 'substance' and 'meaning' of the communication is that the user is
11
conducting a search for information on a particular topic." Id. at 49 (internal citations omitted).
12
Likewise here, the Linkedln ID conveys 1) the substance and meaning of a
13
communication that the user is interested in visiting a certain page or profile and 2) the substance
14
and meaning of a communication regarding the user's identity, i.e., the most specific type of
15
demographic information available. The very business goal of the Third Parties who receive this
16
information (and indeed, the purpose of the cookies and beacons that these third parties place on
17
users' computers) is to create a profile of the type of person who is interested in certain products,
18
so as to target advertising based on demographic information. IN 38-42. The business is
19
lucrative; these third parties pay Linkedln for the privilege of advertising on its site, and in tunr,
20
sell user information and demographic profiles. Certainly, the identity of the user and his/her
21
demographic information is the "substance, purport, or meaning" of the communication.
22
23
3.
Even if the Linkedln IDs Were "Records," Linkedln Still
Violated the SCA by Revealing Them With Content
Linkedln argues that its IDs fall into the "records" carve-out of the SCA.
24
Def. Mem. at 15-19. However, the carve-out does not allow records to be
25
disclosed together with the contents of communications. 18 U.S.C. § 2702(a)(3)
26
27
(allowing a provider to "divulge a record ... (not including the contents
of
communications . . . ") (emphasis added); see also, e.g., United States v. Davis,
28
- 19 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
Crim. No. 10-339, 2011 U.S. Dist. LEXIS 56002, at *8-9 (D. Or. May 24, 2011)
2
("Basic subscriber data which identifies a call's origination, destination, duration,
3
and time of call enjoy no privacy protection because the data is incidental to the
4
[communication], and contains no content information.' (citing United States v.
5
Reed, 575 F.3d 900, 914-16 (9th Cir. 2009)) (emphasis added)). 12 This clause
6
allows providers to share lists of their users, without permitting them to de-
7
anonymize communications, thus paralleling the intention expressed in the H.R.
8
Report that "mailing lists" can be divulged but "information that profiles the
9
activities of individual users' cannot. See H.R. Rep. No. 99-647, at 64. 13 Indeed,
10
"[t]he SCA does not authorize the disclosure of the identity of the author of a
11
stored message; it authorizes the disclosure of a record . . . pertaining to a
12
subscriber
13
(emphasis added) (citing 18 U.S.C. §2703(c)(1)).
O'Grady v. Super. Ct., 129 Cal. App. 4th 1423, 1448 (2006)
Defendant analogizes its conduct to providing the information that is already
14
15
readily available on the outside of an envelope.
16
Forrester, which held that email to/from addresses and IP addresses are addressing
17
information and thus "records" 512 F.3d at 510 ("at best, the [third party] may
18
make educated guesses about what was said in the messages or viewed on the
19
websites based on its knowledge of the e-mail to/from addresses and IP addresses
20
but this is no different from speculation about the contents of a phone
21
conversation on the basis of the identity of the person or entity that was dialed.").
22
But here, Linkedln is not merely stamping the retunr address on a sealed envelope,
See Def. Mem. at 16-17, citing
23
12
24
25
26
27
28
There is an exception, however, prohibiting records from being divulged to government
entities. 18 U.S.C. § 2702(a). Linkedln has made no attempt to prevent this from happening
(e.g., the information may be divulged to the government for advertisements relating to federal
employment or military recruiting), and that alone violates the SCA.
18 U.S.C. § 2702(a) prohibits the disclosure of content and § 2702(c) allows the
disclosure of certain customer records. The clause in § 2702(c) stating that records "not including
the contents" can be revealed would be meaningless and redundant unless it intends to restirct
record information from being correlated or divulged with records.
13 E.g.,
- 20 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
which may display record information without any indication of the contents. It is
2
stamping the retunr address on the communication itself.
3
In Forrester, the Court found that there was no Fourth Amendment
4
expectation of privacy for IP addresses or email addresses because users Eshould
"
5
know that this information is provided to and used by Internet service providers for
6
the specific purpose of directing the routing of information . . . .
7
voluntarily turned over in order to direct the third party's servers. " 512 F.3d at 510
8
(emphasis added).
9
information to third parties, they merely visited a page within the website that they
10
had entrusted with personal information. While Plaintiffs may have expected that
11
their IP addresses would be used in connection with that page visit (by the ISP,
12
13
perhaps), no reasonable person would have expected that his Linkedln ID or
browsing history would also be transmitted to a Third Patry. 14
14
Linkedln takes this several steps further than sending the to/from
15
information or IP addresses at issue in Forrester: 1) Defendant sends the Linkedln
16
ID with an otherwise anonymous communication (the page visit), eliminating the
17
need for any "speculation" regarding the content of the identified-person' s
18
communications; 2) Defendant contemporaneously sends the user' s last-viewed
19
page along with its Linkedln ID, plainly divulging additional, protected content;
20
and 3) Defendant transmits this information to its paid advertisers, in connection
21
with the Third Parties' cookie identification numbers, used to track their Internet
22
browsing history. 15 Linkedln divulged the contents of communications, or, at the
23
14 Defendant cites to Hill v. MCI WorldCom Communications, Inc., 120 F. Supp. 2d 1194 (S.D.
24
Iowa 2000), where the defendant divulged telephone transaction records (phone numbers and
billing information) which were neither content in that context nor divulged in connection with
content. Here, however, Linkedln transmitted the User Identification with a communication (the
click to visit/interest in a webpage), and simultaneously included contents of an unrelated
communication (the last-viewed page).
25
26
27
28
[They] are
Here, however, Plaintiffs never voluntarily tunred over
Defendant's citation to Jessup-Morgan v. America Online, Inc., 20 F. Supp. 2d 1105 (E.D.
Mich. 1998) (cited Def. Mem. at 17), is of limited use to this Court. That case involved a
particularly egregious set of facts wherein a user publicly, but anonymously, posted a malicious
- 21 15
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
least, divulged records contempornaeously with communications, and therefore
2
violated the SCA.
3
D.
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
LinkedIn Was Not Authorized to Divulge Its Subscribers'
Communications
LinkedIn contends that it was authorized to divulge the contents of its
members' communications because it was '"an addressee or intended recipient of
such communication. ''' Def. Mem. at 14-15 (quoting 18 U.S.C. §2702(b)(1)).
Alternatively, it argues that it was authorized to divulge the contents of the
communications because the Third Parties were the "addressee or intended
recipient." Neither argument holds water.
LinkedIn's first argument is contradicted by the SCA' s plain language.
While the SCA allows ECSs to disclose communications "with the lawful consent
of the originator or an addressee or intended recipient," "in the case of a remote
computing service [RCS], " the service provider needs the consent of "the
subscriber. " § 2702(b)(3); Crispin, 717 F. Supp. 2d at 973 n.17 ("An RCS
provider can avail itself of all but one of the exceptions set forth in § 2702(b).
An RCS provider may divulge the contents of a communication with consent of the
"subscriber," while an ECS provider may divulge the contents with the lawful
consent of an addressee or intended recipient of such communication.) (emphasis
added).
Regarding LinkedIn's second argument
that the Third Parties were the
"addressee or the intended recipient" designated by LinkedIn
the "addressee or
intended recipient" must plainly be designated by the user, not the service provider
itself. An ECS can divulge the contents of a communication with the lawful
consent of (or to) an addressee or intended recipient, because there are two parties
and defaming post while posing as (and providing contact information for) another person. The
court declined to hold the defendant liable for revealing the identity of the malicious user when it
was subpoenaed for such information. Id. at 1108. Moreover, the non-controlling decision in
Jessup was misplaced and does not comport with the plain language of the statute.
- 22 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
to the communication (which is merely facilitated by the ECS), and either party
2
has a right to access or divulge the communication.
3
2710. With regard to an RCS, the user always sends the RCS provider (e.g.,
4
LinkedIn) communications for processing or storage, but that does not render the
5
RCS an ntended recipient" that is permitted to divulge information at will; this is
6
exactly what the SCA protects against.
7
disclosures of communications received by the provider by means of electronic
8
trnasmission from a subscriber). Certainly, if the user designates naother third
9
party to receive that information, the RCS could appropriately divulge the
10
communication to that third party. But Plaintiffs never designated the Third Parties
11
here as addressees or intended recipients.
See 18 U.S.C. §§ 2702(c),
See 18 U.S.C. § 2702 (prohibiting
In support of its arguments, Defendant cites In re Facebook Privacy Litig.,
12
13
No. 10-02389, 2011 U.S. Dist. LEXIS 157345, at *5-13 (N.D. Cal. Nov. 22, 2011)
14
("Facebook II") and In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 714 (N.D.
15
Cal. 2011) ("Facebook I"). In Facebook II, the court noted that the plaintiffs relied
16
on "two mutually inconsistent propositions." 2011 U.S. Dist. LEXIS 147345, at
17
* 11. The first proposition was that "the communications . . . were requests to be
18
connected to specific advertisements; the requests were addressed to advertisers;
19
and that Defendant merely acted as the 'intermediary' for those communications.
20
Id. 16
21
However, the Court noted that the plaintiffs in that case, unlike here, had not
22
alleged that their communications were sent to defendant for "processing or
23
storage. " Id. 17 Given the two inconsistent propositions, and the plaintiffs failure to
24
16 In Facebook I, the court concluded that if "communications were sent to advertisers, then the
25
advertisers were their addressees or intended recipients." 2011 U.S. Dist. LEXIS 157345, at *513. Here, by contrast, Plaintiffs' communications were to Linkedln, and were requests to be
connected with Linkedln pages; there were no user requests to be connected to specific
advertisements, and no communications addressed by the user to advertisers.
17
Also unlike this case, the defendant in Facebook II contended it acted only as an ECS, id. at
n.7; here, Linkedln admits it is also an RCS.
26
27
28
Plaintiffs' second proposition was that the defendant was an RCS.
- 23 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
Id.
1
allege that the defendant was an RCS, the court dismissed the SCA claim.
2
(noting that it did "not reach the merits of Plaintiffs' contention that 'only ECS
3
providers, and not RCS providers like [Defendant], may avail themselves of the
4
SCA' s 'intended recipient' exception.").
Id.
5
LinkedIn acted as an RCS, was not therefore an "addressee or intended
6
recipient" as contemplated by the SCA, and sent Plaintiffs' information to Third
7
Parties with which they had no intention of communicating. LinkedIn is therefore
8
liable under the SCA.
9
IV.
LINKEDIN VIOLATED CALIFORNIA'S FALSE ADVERTISING LAW
10
Plaintiffs already have demonstrated that they each suffered an injury in fact
11
for the purposes of the Article III standing requirement. Supra, sec. I. Defendant's
12
arguments notwithstnading (Def. Br. at 19), Plaintiffs also have adequately pleaded
13
injury in the form of the loss of money or property as a result of false
14
representations by Defendant. The value is determinable by reference to prices set
15
in an active market for personal profiles. 18 For Plaintiff Masand and other Class
16
members who also paid monetarily for Defendant's service, the value is
17
additionally determinable in reference to the amount they paid for the service.
18
Instead of disputing that Plaintiffs' personal information has value,
19
Defendant argues that Plaintiffs' FAL claim fails because there is no allegation that
20
such loss was '"as a result of' any false advertising by LinkedIn. Def. Mem. at 19
21
(citing Cal. Bus. & Prof. Code § 17535).) But Plaintiffs clearly pleaded that they
22
23
24
25
26
27
28
18 Defendant cannot credibly argue that its users' personal profiles do not have monetary value,
as Defendant's business model depends upon the value of personal profiles. See, e.g., LinkedIn
Corp., Registration Statement (Form S-1) (January 2011) (noting that "incomplete or outdated
member information would diminish the ability of our marketing solutions customers to reach
their target audiences"). See also Paul M. Schwartz, Property, Privacy, and Personal Data,117
Harv. L. Rev. 2055, 2056-57 (May 2004) ("Personal information is an important currency in the
new millennium. The monetary value of personal data is large and still growing, and corporate
America is moving quickly to profit from this trend."); Pamela Jones Harbour, Federal Trade
Center (FTC) Commissioner, FTC Roundtable Series I on Exploring Privacy (Matter No.
P095416), Dec. 7, 2009, at 2 ("Data is currency.").
- 24 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
paid for LinkedIn' s services, at least in part, "in exchange for Defendant's
2
promises that it would not make ' [a]ny information provided to third parties
3
through cookies . . . personally identifiable' and that it 'does not provide personally
4
identifiable information to any third party ad network. '"
5
pleaded relinace to their detriment by alleging that "had [they] known Defendant
6
was not keeping their personal information from third parties, they would not
7
have consented [to the dissemination of this information] and Defendant would
8
not have gained commercial advantage from third parties."
9
facts are sufficient to establish for the purposes of the FAL claim that Plaintiffs
10
relied upon, and believed, that Defendant would not share their personally
11
identifiable information.
1 57. Plaintiffs have also
1 117. These alleged
12
Moreover, the Califonria Supreme Court has made clear that Plaintiffs are
13
entitled to an inference of reliance "wherever there is a showing that a
14
misrepresentation was material. " In re Tobacco II Cases, 46 Cal. 4th 298, 327
15
(2009). Plaintiffs have adequately pleaded that Defendant's misrepresentations
16
about its practices with regard to personal information were material. See, e.g.,1 5
17
("Plaintiffs' browsing histories and personal identities are valuable personal
18
property with a market value
As a result of Defendant's unlawful conduct,
19
Plaintiffs relinquished this
valuable
20
compensation to which they were each due.
personal property
(emphasis added));
without
the
1 117.
21
Additionally, Defendant ignores that Plaintiffs' theory of harm is, in part,
22
premised on omissions. The Amended Complaint clearly states that Plaintiffs
23
exchanged money and/or valuable personal information as a result of Defendant' s
24
nondisclosure of its practice of providing users' personal information to third
25
parties. See, e.g.,1 117. Plaintiffs have pleaded sufficient reliance on Defendant' s
26
omissions in that they would not have allowed Defendant to use their personal
27
information to its advantage and to their detriment. Id.
28
- 25 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
V.
2
3
4
5
6
7
8
PLAINTIFFS' CONTRACT CLAIM ALLEGES RECOVERABLE
DAMAGES
Plaintiffs have established that their personal information is valuable
property. See sec. I, supra. Plaintiffs have also established that they entered a
contract pursuant to which they provided personal information for expressly stated
hrnited purposes in exchange for LinkedIn's services.
See 1 57. Linkedln
breached the contract by using the information for purposes other than expressly
stated in its terms of service by disclosing it to third parties. Plaintiffs, therefore,
are entitled to contractual damages.
9
VI.
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
DEFENDANT CONVERTED PLAINTIFFS' PROPERTY
Defendant tries to avoid liability for conversion by arguing that Plaintiffs'
personal browsing histories and other personal information are intnagible interests
that are not merged with or reflected in something tangible. Def. Mem. at 23-24.
Defendant is wrong.
"[T]he Ninth Circuit recently held that to the extent 'California retains some
vestigial merger requirement, it is clearly minimal, and at most requires only some
connection to a document or tangible object."' Boon Rawd Trading Int'l Co., Ltd.
v. Paleewong Trading Co., Inc., 688 F. Supp. 2d 940, 954 (N.D. Cal. 2010)
(quoting Kremen v. Cohen, 337 F.3d 1024, 1033 (9th Cir.2003)). Plaintiffs here
have established at least a minimal connection by alleging the monetary value of
their personal information. See, e.g.,1 44 ("[w]ebsites and stores ... can easily buy
and sell information on valued visitors with the intention of merging behavioral
with demographic and geographic data in ways that will create social categories
that advertisers covet and target with ads tailored to them or people like them. "
(quoting Joseph Turow, Jennifer King, Chris Jay Hoofnagle, Amy Bleakley, and
Michael Hennessy, Americans Reject Tailored Advertising and Three Activities
that Enable It (Sept. 29, 2009), available at http://ssrn.com/abstract =1478214).
Additionally, every Linkedln member, including Plaintiffs, has a property
28
- 26 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
interest — in the form of an informational privacy interest, see Hill, 7 Cal. 4th at 35
2
— in preventing third parties from collecting and disseminating private browser
3
histories and other personally identifiable information. This legally recognized
4
informational privacy interest is one which protects the dissemination or misuse of
5
confidential information. Id. California's inalienable right to privacy protects this
6
interest and provides the person whose information is at issue with control over the
7
use of that information. Id.
8
Defendant makes no argument, as it could not, that Plaintiffs do not have a
9
legitimate claim to the exclusive possession of their personal information. 19 The
10
Plaintiffs' personal information Defendant discloses is a commodity sold in
11
discrete units, in which Plaintiffs have a legally protectable interest and, as such
12
°property, that is subject to conversion.
13
Plaintiffs had a precisely defined, legally protected privacy interest.
14
order to determine whether an intangible property right existed . . . (1) there must
15
be an interest capable of precise definition; (2) it must be capable of exclusive
16
possession or control; and (3) the putative owner must have established a
17
legitimate claim to exclusivity." Ali v. Fasteners for Retail, Inc., 544 F. Supp. 2d
18
1064, 1072 (E.D. Cal. 2008). A legally recognized informational privacy interest
19
is one which protects the dissemination or misuse of confidential information. Hill,
20
865 P.2d at 642.
21
informational privacy interest in preventing third parties from collecting and
22
disseminating private browser histories and other personally identifiable
"In
Every Linkedln member, including Plaintiffs, has an
23
24
25
26
27
28
9 Defendant argues that such information is not subject to exclusive possession or control. Def.
Mem. at 23 (citing Ruiz, 540 F. Supp. 2d at 1126). In Ruiz, though, the plaintiffs provided no
support for the argument that Social Security numbers were property subject to bailment. 540 F.
Supp. 2d at 1127. In contrast, Plaintiffs here have provided sufficient support for their theory of a
property interest in the personal information provided to Linkedln. See sec. I.C., supra.
- 27 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
information. The privacy amendment to the Califonria Constitution was enacted to
2
guard against exactly such an intrusion. /d. 2°
3
VII.
4
THE AMENDED COMPLAINT ADEQUATELY STATES A CLAIM FOR
NEGLIGENCE
Plaintiffs have identified an independent legal duty that Defendant owed to protect
5
against invasion of its users' pirvacy. See sec. II, supra. See sec. II, supra.21 Defendant breached
6
this duty by providing its users' private, sensitive information to third parties without consent.
7
1 124. As to causation, Plaintiffs provided details throughout the Amended Complaint of the
8
mechanism by which Defendant obtained private information and then transmitted that private
9
information without their consent to the emotional and financial detriment of Plaintiffs.
10
CONCLUSION
11
Accordingly, Plaintiffs respectfully request that Defendant's motion to dismiss be denied.
12
DATED: February 2, 2012
Respectfully Submitted,
13
MILBERG LLP
/s/ Peter E. Seidman
14
15
Sanford P. Dumain
Peter E. Seidman
Charles Slidders
Melissa Ryan Clark
MILBERG LLP
One Pennsylvania Plaza
New York, NY 10119
Telephone:
(212) 594-5300
Facsimile:
(212) 868-1229
Email: sdumain@milberg.com
Email: pseidman@milberg.com
Email: cslidders@milberg.com
Email: mclark@milberg.com
16
17
18
19
20
21
22
23
20
24
25
26
27
28
Defendant argues that such information is not subject to exclusive possession or control. Def.
Mem. at 23 (citing Ruiz, 540 F. Supp. 2d at 1126). In Ruiz, though, the plaintiffs provided no
support for the argument that Social Security numbers were property subject to bailment. 540 F.
Supp. 2d at 1127. In contrast, Plaintiffs here have provided sufficient support for their theory of a
property interest in the personal information provided to Linkedln. See sec. I.C., supra.
21 Additionally, the California Supreme Court has recognized that the common law creates a duty
for private parties to protect others pirvate information in an objectively reasonable manner. See
Hill, 7 Cal. 4th at 27.
- 28 PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
1
Michael R. Reese
Kim Richman
REESE RICHMAN LLP
875 Avenue of the Americas
New York, NY 10001
Telephone: (212) 579-4625
Facsimile: (212) 253-4272
Email: mreese@reeserichman.com
Email: krichman@reeserichman.com
2
3
4
5
6
7
Attorneys for Plaintiffs
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- 29 -
PLAINTIFFS' OPPOSITION TO DEFENDANT'S MOTION TO DISMISS
THE AMENDED CLASS ACTION COMPLAINT
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?