MDL No. 2357 - IN RE: Zappos.com, Inc., Customer Data Security Breach Litigation

Filing 287

ORDERED that Defendant's Motion to Reconsider (ECF No. 282 ) is GRANTED in part and DENIED in part. FURTHER ORDERED that Defendant's Motion for Extension of Time (ECF No. 281 ) is GRANTED in part and DENIED in part. Amended Complaint due by 9/12/2016. Signed by Judge Robert C. Jones on 8/29/2016. (Copies have been distributed pursuant to the NEF - DRM)

1
2
3
UNITED STATES DISTRICT COURT

4

DISTRICT OF NEVADA

5
6

3:12-cv-00325-RCJ-VPC

7
8

In re ZAPPOS.COM, INC., CUSTOMER
DATA SECURITY BREACH LITIGATION

MDL No. 2357

9

ORDER

10
11
12
13
14
15
16
17
18
19
20
21
22
23

This multidistrict litigation case arises out of a security breach of Zappos.com’s customer
data. Pending before the Court is a Motion to Reconsider (ECF No. 282). Also pending is a
Motion for Extension of Time (ECF No. 281). For the reasons given herein, the Court grants the
motions in part and denies them in part.
I.

FACTS AND PROCEDURAL HISTORY
On January 15, 2012, a hacker or group of hackers targeted Zappos’s servers located in

Kentucky and Nevada. The servers contained the personal identifying information (“PII”) of
approximately 24 million Zappos customers. On January 16, 2012, Zappos sent an email to its
customers notifying them that its servers had been breached and that data had been stolen,
including customers’ names, account numbers, passwords, email addresses, billing and shipping
addresses, phone numbers, and the last four digits of their credit cards used to make purchases.
Shortly thereafter, a number of lawsuits were filed against Zappos seeking damages, which were
consolidated and assigned to this Court.

24
25
26

1

1

After the Court denied a motion by Zappos to compel arbitration, Plaintiffs amended their

2

pleadings into two separate consolidated class action complaints, and Zappos filed a motion to

3

dismiss the amended complaints for lack of standing and for failure to state a claim. (ECF No.

4

62). On September 9, 2013, the Court granted in part and denied in part Zappos’s motion. (ECF

5

No. 114). Thereafter, Plaintiffs Preira, Ree, Simon, Hasner, Habashy, and Nobles (“the Preira

6

Plaintiffs”) filed their Second Amended Consolidated Complaint (the “Preira SAC”). (ECF No.

7

118). And Plaintiffs Stevens, Penson, Elliot, Brown, Seal, Relethford, and Braxton (the “Stevens

8

Plaintiffs”) filed their Second Amended Consolidated Class Action Complaint (the “Stevens

9

SAC”). (ECF No. 119).

10

On November 4, 2013, Zappos moved to dismiss the Preira SAC and the Stevens SAC.

11

(ECF No. 122). While that motion was pending, the parties engaged in mediation in an attempt

12

to reach a settlement. The parties stipulated to stay the proceedings various times, each time

13

representing to the Court that settlement negotiations were progressing. (See ECF Nos. 192, 196,

14

201). Despite the progress made during mediation as to class-wide relief, a final agreement could

15

not be reached between the parties due to a disagreement over attorneys’ fees. However, on

16

December 4, 2014, Plaintiffs filed a motion to enforce a supposed settlement, which the Court

17

denied. (ECF No. 227). Zappos then renewed its previous dismissal arguments. The Court

18

granted the motion to dismiss, holding that Plaintiffs have no standing because, among other

19

reasons, they failed to allege a threat of imminent future harm or instances of actual identity theft

20

or fraud. (ECF No. 235). The Court dismissed the complaints without prejudice, granting

21

Plaintiffs leave to amend their complaints to allege instances of actual identity theft or fraud.

22
23

Following the Court’s order, the Preira Plaintiffs and the Stevens Plaintiffs (“Prior
Plaintiffs”) filed a consolidated Third Amended Complaint (“TAC”). (ECF Nos. 245, 246). In

24
25
26

2

1

the TAC, two new Plaintiffs—Kristin O’Brien and Terri Wadsworth (“New Plaintiffs”)—were

2

added to the case. Zappos moved the Court to dismiss the TAC or, alternatively, to strike the

3

class allegations in the TAC. On May 6, 2016, the Court granted the motion to dismiss in part

4

and denied it in part and granted the motion to strike. (ECF No. 280). Plaintiffs now move the

5

Court to reconsider its order.

6

II.

LEGAL STANDARDS
Granting a motion to reconsider is an “extraordinary remedy, to be used sparingly in the

7
8

interests of finality and conservation of judicial resources.” Carroll v. Nakatani, 342 F.3d 934,

9

945 (9th Cir. 2003) (quoting 12 James Wm. Moore et al., Moore’s Federal Practice § 59.30[4]

10

(3d ed. 2000)). A motion to reconsider “may not be used to raise arguments or present evidence

11

for the first time when they could reasonably have been raised earlier in the litigation.” Id.

12

“Reconsideration is appropriate if the district court (1) is presented with newly discovered

13

evidence, (2) committed clear error or the initial decision was manifestly unjust, or (3) if there is

14

an intervening change in controlling law.” Sch. Dist. No. 1J, Multnomah Cnty., Or. v. ACandS,

15

Inc., 5 F.3d 1255, 1263 (9th Cir. 1993); Fed. R. Civ. P. 59. In some cases, “other, highly unusual,

16

circumstances” may warrant reconsideration.” ACandS, 5 F.3d at 1263.

17

III.

18

DISCUSSION
Plaintiffs move the Court to reconsider three aspects of its prior order: (1) the dismissal

19

of Plaintiffs’ claim of breach of the covenant of good faith and fair dealing and their claim of

20

breach of the settlement agreement; (2) the dismissal of Prior Plaintiffs’ claims with prejudice;

21

and (3) the striking of Plaintiffs’ class allegations.

22

///

23

///

24
25
26

3

1

A.

2

The Court dismissed New Plaintiffs’ claims of breach of the covenant of good faith and

3

fair dealing and breach of the settlement agreement because they did not have standing to make

4

the claims, as they were not parties to the case when Prior Plaintiffs and Zappos discussed

5

possible settlement. New Plaintiffs argue that they do have standing to assert these claims as

6

members of the putative class because a class action settlement binds all class members who do

7

not opt out of the class. To support their position, New Plaintiffs quote one unpublished case and

8

Federal Rule of Civil Procedure 23(e). The unpublished case is not binding on the Court, and

9

Rule 23(e) does not apply here. Rule 23(e) applies to “[t]he claims, issues, or defenses of a

Dismissal of the Breach Claims

10

certified class.” Plaintiffs’ proposed class is not yet certified. Indeed, the Court granted Zappos’s

11

motion to strike the class allegations and reaffirms that decision today. Furthermore, on March

12

27, 2015, the Court expressly ruled that the alleged settlement agreement, which is the source of

13

both breach claims, (see TAC ¶¶ 193, 195, 198, 201–03, ECF No. 246), is not enforceable, (see

14

Order, ECF No. 227). Furthermore, New Plaintiffs cannot prevail on a claim of breach of the

15

covenant of good faith and fair dealing because they do not allege that the parties complied with

16

the literal terms of the contract. See Hilton Hotels Corp. v. Butch Lewis Prods., Inc., 808 P.2d

17

919, 922–23 (Nev. 1991). As a result, New Plaintiffs cannot prevail on these claims, even if they

18

did have standing to assert them. The Court denies New Plaintiffs’ motion to reconsider as to

19

these claims.

20

Prior Plaintiffs argue that they have standing to assert the breach claims independent of

21

their claims of identity theft and fraud. They provide no binding authority to support their

22

position. Although the Court tends to agree that Prior Plaintiffs have standing to assert these

23

claims, the settlement agreement is not enforceable and Prior Plaintiffs do not allege that the

24
25
26

4

1

parties complied with the literal terms of the contract. Once again, the Court dismisses the breach

2

claims, without leave to amend.
Dismissal of Prior Plaintiffs’ Claims with Prejudice

3

B.

4

The Court dismissed Prior Plaintiffs’ claims with prejudice because they failed to allege

5

instances of actual identity theft or fraud, even after the Court gave them leave to amend.

6

Plaintiffs argue that the Court erred because dismissal for lack of standing should always be

7

without prejudice. They cite Fleck & Associates, Inc. v. Phoenix, City of, an Arizona Mun. Corp.,

8

in which the plaintiff lacked standing to bring the suit, and the Ninth Circuit instructed the

9

district court to dismiss the case without prejudice, noting that “dismissal for want of standing

10

must be without prejudice.” 471 F.3d 1100, 1106–07 (9th Cir. 2006) (citing Brereton v. Bountiful

11

City Corp., 434 F.3d 1213, 1216–20 (10th Cir. 2006)) (internal quotations omitted). The holding

12

in Fleck makes sense because a district court should not dismiss a claim with prejudice unless it

13

has adjudicated the merits of the claim, and a district court lacks authority to address the merits

14

of a claim if it lacks jurisdiction over it. See id. (noting that “if court lacks jurisdiction it is

15

powerless to reach the merits”) (citing Steel Co. v. Citizens for Better Env’t, 523 U.S. 83, 95

16

(1998)); Brereton, 434 F.3d at 1217 (“once a court determines it lacks jurisdiction over a claim,

17

it perforce lacks jurisdiction to make any determination of the merits of the underlying claim”).

18

Here, the Court lacks jurisdiction over Prior Plaintiffs’ claims arising from the data breach

19

because they do not have standing to make them.

20

In some cases, a district court can dismiss claims with prejudice if “any proposed

21

amendment would be futile,” Caldwell v. Caldwell, 420 F. Supp. 2d 1102, 1108 (N.D. Cal.

22

2006), aff’d, 545 F.3d 1126 (9th Cir. 2008), but amendment here would not be futile if in the

23

future Prior Plaintiffs actually suffer some concrete injury from the data breach. Still, the Court

24
25
26

5

1

reaffirms its decision to deny leave to amend in this case for “repeated failure to cure

2

deficiencies by amendments previously allowed,” Carvalho v. Equifax Info. Servs., LLC, 629

3

F.3d 876, 892–93 (9th Cir. 2010); and yet, Prior Plaintiffs should have an opportunity to bring

4

their claims in another case if they suffer a cognizable injury. As the Court noted in a prior order,

5

if “there is clearly an injury that can be compensated with money damages . . . a plaintiff would

6

be free to return to court and would have standing to recover her losses.” (Order, 19, ECF NO.

7

235 (quotation omitted)).

8
9

Plaintiffs argue correctly that the Court should have dismissed Prior Plaintiffs’ claims
arising from the data breach without prejudice. In this case, the Court will not allow Prior

10

Plaintiffs to have yet another bite at the apple, but they may attempt to establish standing in a

11

future case if they suffer actual injury from the data breach. The Court grants the motion to

12

reconsider as to this issue.
Striking of Plaintiffs’ Class Allegations

13

C.

14

The Court granted Zappos’s motion to strike the class allegations from the TAC “because

15

it is clear from the face of the TAC that Plaintiffs cannot make a prima facie showing of Rule

16

23’s prerequisites.” (Order, 15, ECF No. 280). Specifically, “[t]he proposed class is far too

17

broad, which prevents Plaintiffs from meeting the requirements of commonality and typicality.”

18

(Id. at 16). The Court gave Plaintiffs leave to amend the TAC “to limit the proposed class to

19

individuals who have suffered actual injury as a result of the Zappos data breach.” (Id.).

20

In their motion to reconsider, Plaintiffs mostly rehash arguments they made in their prior

21

briefing and raise new arguments they could have raised before. Their only appropriate argument

22

is that Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1549 (2016), a Supreme Court decision made

23

after this Court’s order, requires the Court to reverse its decision to strike the class allegations.

24
25
26

6

1

But Spokeo does not change the controlling law on this issue; it merely confirms what the Court

2

recognized in its prior order—that “intangible injuries can . . . be concrete” and that the “risk of

3

real harm can[] satisfy the requirement of concreteness.” Id. However, as the Court also held, for

4

an intangible injury to present a risk of real harm, the harm must still be “certainly impending,”

5

and allegations “of possible future harm are not sufficient.” Clapper v. Amnesty Int’l USA, 133 S.

6

Ct. 1138, 1147 (2013) (emphasis in original). The Supreme Court essentially affirmed these

7

requirements by citing Clapper while not holding anything to the contrary. See Spokeo, 136 S.

8

Ct. at 1549. Plaintiffs have failed to identify a change in controlling law.

9

As the Court has stated, Plaintiffs’ proposed class is too broad because it is not limited to

10

individuals who have suffered actual injury. It is possible that other individuals will suffer actual

11

injury from the data breach, but there is no risk of real harm because the possible injury is not

12

certainly impending and there is not “a ‘substantial risk’ that the harm will occur.” Susan B.

13

Anthony List v. Driehaus, 134 S. Ct. 2334, 2342 (2014) (quoting Clapper, 133 S. Ct. at 1147,

14

1150, n. 5). In other words, the threat of future harm is only speculative, not immediate. See

15

Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010). (See also Order, ECF No.

16

235). The Court denies the motion to reconsider as to the motion to strike.

17

D.

18

Plaintiffs ask the Court for clarification regarding whether its prior order was final in

Request for Clarification

19

respect to any plaintiff and how the order or an amended complaint will affect a possible appeal

20

by Plaintiffs. Plaintiffs’ primary concern regarding the finality of the order is based on the

21

Court’s dismissal of Prior Plaintiffs’ claims with prejudice. Because the Court is now dismissing

22

their claims without prejudice, their concern is moot. As for an appeal, the Court has clearly

23

stated that it has made no determination on the merits of Prior Plaintiffs’ claims arising from the

24
25
26

7

1

data breach. The Court advises Plaintiffs to perform additional research as to what effect the

2

Court’s decisions or another amended complaint will have on appeal.

3

E.

4

Plaintiffs move the Court to grant an extension of time to file an amended complaint so

Extension of Time

5

they can adapt it to the Court’s decisions in this order. They request thirty days from the date of

6

this order, but on May 31, 2016 they stated that they were “fully prepared to file an amended

7

complaint in accordance with the time and content limitations set forth in the [prior] Order.”

8

(Mot., ¶ 5, ECF No. 281, at 2). As a result, the Court grants the motion but gives Plaintiffs just

9

fourteen days to file an amended complaint.

10
11
12
13

CONCLUSION
IT IS HEREBY ORDERED that Defendant’s Motion to Reconsider (ECF No. 282) is
GRANTED in part and DENIED in part.
IT IS FURTHER ORDERED that Defendant’s Motion for Extension of Time (ECF No.

14

281) is GRANTED in part and DENIED in part. Plaintiffs shall have 14 days from the date of

15

this order to file an amended complaint.

16
17
18
19

IT IS SO ORDERED.
DATED: This 29th day July, 2016. 2016.
Dated this 18th day of of August,
_____________________________________
ROBERT C. JONES
United States District Judge

20
21
22
23
24
25
26

8