Foster, et al v. Essex Property, Inc..

Filing 24

ORDER granting 15 Motion to Dismiss. Plaintiffs have leave to amend, and must file any amended complaint on or before 12/11/2015. The court schedules this case for a Case Management Conference at 10:00 a.m. on 2/25/2016. The parties shall file a Joint Case Management Conference Statement on or before 2/18/2016. Signed by Judge Edward J. Davila on 11/25/2015. (ejdlc4S, COURT STAFF) (Filed on 11/25/2015)

1
2
3
4

UNITED STATES DISTRICT COURT

5

NORTHERN DISTRICT OF CALIFORNIA

6

SAN JOSE DIVISION

7
8

MARK FOSTER, et al., individually and on
behalf of all others similarly situated,

Case No. 5:14-cv-05531-EJD

Plaintiffs,

9

ORDER GRANTING MOTION TO
DISMISS

v.

10

Re: Dkt. No. 15

United States District Court
Northern District of California

11

ESSEX PROPERTY TRUST, INC.,
Defendant.

12

Plaintiffs Mark Foster and Akiko Foster (“Plaintiffs”) filed this putative class action suit

13
14

against Defendant Essex Property Trust, Inc. (“Defendant”), asserting various state claims arising

15

out of a data breach. Presently before the court is Defendant’s Motion to Dismiss pursuant to

16

Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). See Mot., Dkt. No. 15.

17

Federal jurisdiction arises pursuant to 28 U.S.C. § 1332(d). The court found this matter

18

suitable for decision without oral argument pursuant to Civil Local Rule 7-1(b) and previously

19

vacated the associated hearing. Having carefully considered the parties’ pleadings, the court

20

grants Defendant’s motion for the reasons explained below.

21
22

I.

FACTUAL AND PROCEDURAL BACKGROUND
Defendant is a real estate investment trust that invests in apartment communities along the

23

West Coast of the United States. Compl., Dkt. No. 1 at ¶ 10. It develops, redevelops, and

24

manages multifamily communities located in Northern California, Southern California, and Seattle

25

Metro areas. Id. Plaintiffs are husband and wife, and reside in an apartment leased from

26

Defendant in Menlo Park, California. Id. at ¶ 8.

27
28

1
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS

1

Plaintiffs allege that when they leased their apartment from Defendant, they were required

2

to provide Defendant with sensitive personal and financial information. Id. at ¶¶ 1, 4. Defendant

3

allegedly kept this information in its computer systems, servers, and databases. Id. at ¶ 4.
Plaintiff alleges that Defendant sustained one or more security breaches to its computer

4
5

network due to their failure to maintain adequate data security. Id. at ¶¶ 2, 15. These security

6

breaches allegedly placed Plaintiffs’ private information, including their names, mailing addresses,

7

email addresses, private cell phone numbers, birth dates, credit and debit card numbers,

8

employment information, salaries, and social security numbers into the hands of cyber criminals.

9

Id. at ¶¶ 3, 22. Plaintiffs allege that Defendant disclosed the data breach to its customers. Id. at ¶
34. As a result of the data breach, Plaintiffs allege their personal information was used to make

11
United States District Court
Northern District of California

10

unauthorized charges on their credit cards, and exposed them to a greater risk of identity theft and

12

fraud. Id. at ¶¶ 8, 32. Plaintiffs further allege that the information possessed by cyber criminals

13

may be used to harass or stalk them. Id. at ¶ 33.
Plaintiffs commenced the instant action on December 19, 2014, asserting the following

14
15

claims: (1) violation of California’s Unfair Competition Law; (2) violation of California’s

16

Consumers Legal Remedies Act; (3) violation of California Civil Code § 1798.80 et seq; (4)

17

negligence under California law; and (5) breach of duty of good faith and fair dealing. See Dkt.

18

No. 1. Defendant filed its Motion to Dismiss on March 16, 2015. See Dkt. No. 15. This matter

19

has been fully briefed. See Opp’n, Dkt. No. 20; Reply, Dkt. No. 22.

20

II.

LEGAL STANDARD

21

Although Defendant raises two rules in its motion, only one requires discussion. A Rule

22

12(b)(1) motion challenges subject matter jurisdiction and may be either facial or factual. Wolfe

23

v. Strankman, 392 F.3d 358, 362 (9th Cir. 2004). In a factual inquiry like the one presented here,

24

the court may consider materials beyond the complaint. Savage v. Glendale Union High Sch., 343

25

F.3d 1036, 1039-40 n.2 (9th Cir. 2003). “Once the moving party has converted the motion to

26

dismiss into a factual motion by presenting affidavits or other evidence properly brought before

27

the court, the party opposing the motion must furnish affidavits or other evidence necessary to

28

2
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS

1

satisfy its burden of establishing subject matter jurisdiction.” Id.
Standing is properly challenged through a Rule 12(b)(1) motion. White v. Lee, 227 F.3d

2
3

1214, 1242 (9th Cir. 2000). Because it is a jurisdictional requirement, the plaintiff has the burden

4

to establish standing. Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir.

5

2010)

6

III.

7

DISCUSSION
Under Article III of the Constitution, federal courts have jurisdiction over certain “cases”

8

and “controversies.” Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1146 (2013). As part of the

9

case-or-controversy requirement, the plaintiff must have standing to sue. Id. There are three
elements to standing: (1) the plaintiff must have suffered an “injury in fact;” (2) there must be a

11
United States District Court
Northern District of California

10

causal connection between the injury and the conduct complained of; and (3) it must be likely that

12

the injury will be redressed by a favorable decision. Susan B. Anthony List v. Driehaus, 134 S.

13

Ct. 2334, 2341 (2014). The class action plaintiff “bears the burden of showing that he has

14

standing for each type of relief sought.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009).

15

In this case, the parties dispute whether Plaintiff has sufficiently pled an injury in fact.

16

“An injury sufficient to satisfy Article III must be concrete and particularized and actual or

17

imminent, not conjectural or hypothetical.” Driehaus, 135 S. Ct. at 2341 (internal quotations

18

omitted). “An allegation of future injury may suffice if the threatened injury is certainly

19

impending, or there is a substantial risk that the harm will occur.” Id. (internal quotations

20

omitted). “[A]llegations of possible future injury are not sufficient.” Clapper, 133 S. Ct. at 1147

21

(internal quotations omitted).

22

Here, all of Plaintiffs claims rely on one common injury: the theft of their personal

23

information from Defendant’s computer system, which they allege was then used in an

24

unauthorized manner or could be used in that way in the future. In a factual attack on this

25

assertion, Defendant contends Plaintiffs could not have suffered the injury they allege and will not

26

suffer injury in the future because their personal information was not, in fact, stolen. Mot. at 4.

27

To support this argument, Defendant offers declarations of two employees who purportedly have

28

3
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS

1

knowledge of Defendant’s computer system and the breach. According to one of the employees,

2

Plaintiffs’ resident information and credit card information was not accessed because it was not

3

stored in the internally-hosted system that was the subject of the breach. See Decl. of Kevin

4

Moller, Dkt. No. 15-1 at ¶¶ 5-7, 9. According to the second employee, Defendant did not have

5

Plaintiffs’ credit card information because Plaintiffs made rental payments by check. See Decl. of

6

Lisa Demeter, Dkt. No. 15-2 at ¶¶ 4-5, 7-10.

7

In response, Plaintiffs simply repeat allegations from the complaint. They represent that

8

Defendant had their personal information, including credit and debit card numbers, and that this

9

information was accessed during the breach. Opp’n at 2. Plaintiffs, however, did not provide any
evidence in conjunction with their opposition brief, though it appears they certainly could have.

11
United States District Court
Northern District of California

10

Indeed, Plaintiffs make specific representations in the complaint about what information was taken

12

by the purported “cyber criminals,” which includes their credit and debit card numbers. Compl. at

13

¶¶ 1, 22. They further allege that, as a result of the data breach, unknown third parties made

14

unauthorized charges on their credit cards and exposed them to a greater risk of identity theft and

15

fraud. Id. at ¶¶ 8. Given these particular allegations, it should have been a simple matter for

16

Plaintiffs to submit declarations or other evidence showing either that their personal information

17

was entered into Defendant’s computer system, or at the very least, that unauthorized charges were

18

made to their credit and bank accounts after the date of the security breach. The latter category of

19

information, which could consist of Plaintiffs’ own account statements, is presumably available to

20

them without the need for formal discovery. Plaintiffs failed to produce any evidence with their

21

opposition. As such, they have not met their burden of establishing an injury in fact in response to

22

a factual attack on their standing allegations. See Figy v. Frito-Lay N. Am., Inc., 67 F. Supp. 3d

23

1075, 1085-86 (N.D. Cal. 2014) (opining that, even when an evidentiary hearing is not held on a

24

Rule 12(b)(1) motion, a plaintiff’s obligation in response to a factual challenge is to present

25

affidavits or other evidence to support subject matter jurisdiction).

26

Defendant also argues that Plaintiffs’ purported risk of future identity theft does not

27

constitute a “certainly impending” injury. Mot. at 6. In response, Plaintiffs argue there is a

28

4
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS

1

credible threat of immediate harm because the unencrypted data stolen included personal

2

information, the data was accessed by an unknown third party since Defendant’s information has

3

been misused, and hackers have used and continue to use the stolen source code to infiltrate

4

Defendant’s computers. Opp’n at 4. Plaintiffs further contend there is an increased risk of future

5

harm generated by Defendant’s lenient security and the resulting breach. Id.

6

Since Plaintiffs have not shown, contrary to Defendants’ evidence, that any of their

7

information was actually stolen, their theory of potential future harm is implausible. Moreover,

8

their reliance on Krottner v. Starbucks Corporation, 628 F.3d 1139 (9th Cir. 2010), is misplaced.

9

In Krottner, an unknown third party stole a laptop from Starbucks that contained the unencrypted
personal information of approximately 97,000 Starbucks employees. 628 F.3d at 1140.

11
United States District Court
Northern District of California

10

Starbucks, thereafter, sent a letter to the plaintiffs and other affected employees alerting them of

12

the theft. Id. at 1140-41. The plaintiffs alleged that after receiving the letter, they spent a

13

substantial amount of time monitoring their financial accounts, placing fraud alerts on their credit

14

cards, and generating anxiety and stress. Id. at 1141. The Ninth Circuit held that the plaintiffs had

15

suffered an injury sufficient to confer standing even though their personal information was stolen

16

but not misused. Id. at 1140. The Ninth Circuit made two findings that are instructive. First, the

17

allegation that plaintiff had “generalized anxiety and stress” as a result of the laptop theft was a

18

present injury sufficient to confer standing. Id. at 1142. Second, as to whether an increased risk

19

of identity theft could constitute an injury in fact, the Ninth Circuit found that it was sufficient to

20

allege a credible threat of real and immediate harm stemming from the theft of a laptop that

21

contained their unencryped personal data. Id. at 1143.

22

Plaintiffs’ allegations are distinguishable from those at issue in Krottner. Plaintiffs do not

23

allege an emotional injury such as anxiety or stress. Moreover, unlike the laptop in Krottner that

24

indisputably contained the plaintiffs’ personal information, it has not been established here that the

25

data breach could have resulted in the release of Plaintiffs’ personal information. As discussed

26

above, Plaintiffs could have attempted to meet their burden by offering evidence to support the

27

allegation that unauthorized charges were made on their credit cards. Furthermore, unlike the

28

5
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS

1

plaintiffs’ allegations in Krottner which focused on the theft’s personal impact and their

2

engagement in surveilling financial accounts, Plaintiffs’ allegations in this case focus extensively

3

on third-party studies and reports regarding identity theft in general. See Compl. at ¶¶ 16-20, 23-

4

31.
In sum, Plaintiffs have failed to sufficiently show an injury in fact. As such, they have

5
6

failed to meet their burden of establishing standing. Since jurisdiction has yet to be established,

7

the court declines at this time to address the sufficiency of Plaintiffs’ claims.

8

IV.

9

CONCLUSION
Based on the foregoing, Defendant’s Motion to Dismiss under Federal Rule of Civil

Procedure 12(b)(1) is GRANTED due to lack of standing. Plaintiffs’ entire complaint is

11
United States District Court
Northern District of California

10

DISMISSED WITH LEAVE TO AMEND.

12
13

Any amended complaint addressing the deficiencies identified herein must be filed on or
before December 11, 2015.

14

The court schedules this case for a Case Management Conference at 10:00 a.m. on

15

February 25, 2016. The parties shall file a Joint Case Management Conference Statement on or

16

before February 18, 2016.

17
18
19

IT IS SO ORDERED.
Dated: November 25, 2015
______________________________________
EDWARD J. DAVILA
United States District Judge

20
21
22
23
24
25
26
27
28

6
Case No.: 5:14-cv-05531-EJD
ORDER GRANTING MOTION TO DISMISS