EDWARD BATON, et al., Case No. 21-cv-02470-EMC
Plaintiffs, ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANTS' MOTIONS TO DISMISS LEDGER SAS, et al., Defendants. Docket Nos. 153, 154
Plaintiffs are customers who purchased a Ledger SAS hardware wallet to protect their cryptocurrency assets. Ledger’s hardware wallets store customer’s “private keys” for their crypto- assets. TAC ¶ 2. The private keys are similar to a bank-account password in that the private key can be used to allow an individual to transfer their crypto-assets. See id. In 2020, Ledger’s customer database was hacked, and Plaintiffs’ personal identifying information (“PII”) was accessed by hackers. Plaintiffs bring a putative class action seeking redress for harms they allegedly suffered stemming from the data breach. See Docket No. 151 (Third Amended Complaint or “TAC”). The data breach occurred when two of TaskUs’s “rogue” employees conspired with a “California man” who accessed and distributed Ledger users’ PII. Plaintiffs bring this action against Ledger, Shopify, and TaskUs. Shopify is Ledger’s subcontractor who helps Ledger with purchases over its website. Shopify was dismissed from the case for forum non conveniens in the last round of briefing. Prior Order MTD (“Prior Order”) re: Second Amended Complaint (“SAC”), Docket No. 148. TaskUs is Shopify’s subcontractor who helps Shopify with Ledger’s customer service operations. Ledger for lack of personal jurisdiction. See Amended Motion to Dismiss Order, Docket No. 79. Plaintiffs appealed and the Ninth Circuit affirmed in part and reversed and remanded in part. Baton v. Ledger SAS, 2022 WL 17352192, at *3 (9th Cir. 2022). The Ninth Circuit reversed the dismissal of Seirafi’s California consumer law claims, but otherwise affirmed the dismissal of the claims against Ledger. Baton v. Ledger SAS, No. 21-17036, 2022 WL 17352192, at *2 (9th Cir. Dec. 1, 2022). The Ninth Circuit also found that Ledger’s forum selection clause was enforceable and that Plaintiffs remaining claims against Ledger should be sent to France, “except with respect to Plaintiffs who are ‘California resident plaintiffs bringing class action claims under California consumer law.’” Baton v. Ledger SAS, No. 21-17036, 2022 WL 17352192, at *2 (9th Cir. Dec. 1, 2022) (quoting Doe 1 v. AOL LLC, 552 F.3d 1077, 1084 (9th Cir. 2009)). Plaintiffs then filed a SAC. In this Court’s Order re: the Motion to Dismiss the SAC (“Prior Order”), the Court found “Plaintiffs have standing except with respect to Mr. Seirafi’s injunctive relief claim against Ledger, the California Consumer Subclass is stricken with leave to amend, the Court has personal jurisdiction over Shopify and TaskUs, Ledger’s forum selection clause does not apply to Plaintiffs’ Unfair Competition Law (“UCL”) claim against Ledger, and Shopify may avail itself of Ledger’s forum selection clause.” Further “[w]ith respect to Ledger’s Rule 12(b)(6) motion, Plaintiffs have plausibly pled a UCL claim under the “unfair” and “unlawful” prongs, but Plaintiffs’ CRLA and “fraudulent” UCL claim is dismissed. See Cal. Bus. & Prof. Code § 17200. With respect to TaskUs’s Rule 12(b)(6) motion, Plaintiffs have plausibly pled a negligence claim and a New York Deceptive Trade Practices Act claim, but Plaintiff’s negligence per se claim is dismissed.” Prior Order, Docket No. 148. This effectively removed Shopify from this case, left only UCL and CLRA claims against Ledger, and left unresolved the claims against TaskUs. Defendant TaskUs now brings a motion to dismiss for forum non conveniens, Docket No. 153, arguing they are similarly situated, and as “closely related” as Shopify was previously found to be, and should be similarly dismissed in favor of the French forum selection clause in Ledger’s contracts with Plaintiffs. arguing Plaintiff Seirafi (a) lacks Article III standing for injunctive relief; (b) Seirafi fails to satisfy basic pleading standards and the heightened pleading standard for his UCL and CLRA claims, which sound in fraud; (c) Seirafi fails to state a claim for relief under the UCL or CLRA; and (d) Seirafi’s California Consumer Subclass allegations are facially overbroad. Id. at 1. For the following reasons, the Court GRANTS Defendant TaskUs’s Motion, and GRANTS IN PART AND DENIES IN PART Defendant Ledger’s Motion. Plaintiff Seirafi entered this case in the First Amended Complaint (“FAC”) filed on June 9, 2021. Docket No. 33. Seirafi and other plaintiffs asserted claims against Ledger under the UCL, CLRA, and other statutes, individually and on behalf of several proposed classes, including a California Consumer Subclass. Id. This Court dismissed all of the claims against Ledger for lack of personal jurisdiction. Docket No. 79 at 7-12. Seirafi and other plaintiffs appealed. The Ninth Circuit reversed the dismissal of Seirafi’s California consumer law claims, but otherwise affirmed the dismissal of the claims against Ledger. Baton v. Ledger SAS, No. 21-17036, 2022 WL 17352192, at *2 (9th Cir. Dec. 1, 2022). Seirafi then filed a Second Amended Complaint (“SAC”) on December 7, 2023. Docket No. 110. Again, he asserted UCL and CLRA claims against Ledger. Id. This Court partially dismissed Seirafi’s claims against Ledger on July 16, 2024. Prior Order. Seirafi then filed the TAC, once again asserting UCL and CLRA claims against Ledger, individually and on behalf of a California Consumer Subclass. A. Third Amended Complaint (“TAC”) On August 22, 2024, Plaintiffs filed the TAC. In the TAC, Plaintiffs assert claims for negligence, declaratory judgment and injunctive relief, and a claim under the NYDTPA against TaskUs. TAC at ¶¶ 197-214; 269-273. Notably, all of those claims were previously asserted against Shopify in the SAC but were dismissed pursuant to the forum selection clauses. Prior Order at 28-30. In the TAC, Seirafi largely repeats many of the allegations in the SAC, with a few new “would purchase Ledger products again in the future if Ledger’s products, e-commerce, and support services actually maintained the level of security that Ledger promises to uphold— extending to Ledger’s vendors as well.” TAC ¶¶ 23, 109. To support his claims under the UCL and CLRA, Seirafi alleges in the TAC three new statements by Ledger, though he does not allege he saw or relied on any of them. First, he alleges that Ledger made various representations in a short advertisement for the Ledger Nano X on YouTube. Id. ¶ 93. Second, he cites Ledger’s privacy policy dated July 31, 2018 (as captured by web.archive.org on March 31, 2019), quoting various parts and alleging that Ledger omitted disclosing that “customer information would be entrusted to an outsourcing operation that employs individuals located in overseas locations like the Philippines and that Ledger provides no meaningful oversight of such subcontractors.” Id. ¶¶ 242, 259. The July 31, 2018 privacy policy, like the July 28, 2020 privacy policy cited in the SAC, warns that “transmission of information on the Internet is not fully secure.” Id. ¶ 242 n.61 (citing Ledger’s privacy policy). Finally, Seirafi slightly modifies the proposed California Consumer Subclass by limiting it to “prior to December 21, 2020.” TAC ¶ 187. The proposed class now includes all California residents “who purchased a Ledger Nano X wallet or a Ledger Nano S wallet from Ledger or an authorized reseller within the limitations period, as may be extended or tolled by any applicable rule of law or equitable doctrine, prior to December 21, 2020,” regardless of whether their contact information was conveyed to Ledger or whether it was accessed by criminals. Id. Seirafi continues to assert claims under the CLRA and under the “unfair,” “unlawful,” and “fraudulent” prongs of the UCL. TAC ¶¶ 215-268. Seirafi’s CLRA claim and “fraudulent” UCL claim rely on alleged misrepresentations and omissions by Ledger. Id. ¶¶ 240, 257. Seirafi’s “unfair” and “unlawful” UCL claims rely on both the alleged misrepresentations and on an alleged failure by Ledger to “implement and maintain reasonable security measures to protect [his] . . . personal information from unauthorized disclosure, release, data breaches, and theft, which was a direct and proximate cause of the Data Breach.” Id. ¶¶ 225, 229, 234, 237. Because Seirafi defines the “Data Breach” only as the TaskUs incident, his UCL claim regarding Ledger’s security A. Article III Standing Under Rule 12(b)(1), a party may move to dismiss for lack of subject matter jurisdiction. “[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction under [Rule] 12(b)(1).” Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). The “irreducible constitutional minimum” of standing requires that a “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins (“Spokeo II”), 136 S. Ct. 1540, 1547 (2016). These three elements are referred to as, respectively, injury-in-fact, causation, and redressability. Planned Parenthood of Greater Was. & N. Idaho v. U.S. Dep't of Health & Human Servs., 946 F.3d 1100, 1108 (9th Cir. 2020). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these elements,” which at the pleadings stage means “clearly . . . alleg[ing] facts demonstrating each element.” Spokeo II, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). B. Motions to Strike Before responding to a pleading, a party may move to strike from a pleading any “redundant, immaterial, impertinent, or scandalous matter.” Fed. R. Civ. P. 12(f). The essential function of a Rule 12(f) motion is to “avoid the expenditure of time and money that must arise from litigating spurious issues by dispensing with those issues prior to the trial.” Wang v. OCZ Tech. Grp., Inc., 276 F.R.D. 618, 624 (N.D. Cal. Oct. 14, 2011) (quoting Whittlestone, Inc. v. Handi-Craft Co., 618 F.3d 970, 973 (9th Cir. 2010)). Motions to strike are generally disfavored. See Shaterian v. Wells Fargo Bank, N.A., 829 F. Supp. 2d 873, 879 (N.D. Cal. 2011); Platte Anchor Bolt, Inc. v. IHI, Inc., 352 F. Supp. 2d 1048, 1057 (N.D. Cal. 2004). A motion to strike should only be granted if the matter sought to be stricken clearly has no possible bearing on the subject matter of the litigation. See Colaprico v. Sun Microsystems, Inc., 758 F. Supp. 1335, 1339 (N.D. Cal. 1991); Fantasy, Inc. v. Fogerty, 984 F.2d 1524, 1527 (9th Cir. 1993), rev’d on other grounds, Fogerty v. Fantasy, Inc., 510 U.S. 517 (1994) (“Immaterial matter is that which has no Statements that do not pertain to, and are not necessary to resolve, the issues in question are impertinent. Id. If there is any doubt whether the portion to be stricken might bear on an issue in the litigation, the Court should deny the motion to strike. Platte Anchor Bolt, 352 F. Supp. 2d at 1057. Just as with a motion to dismiss, the Court should view the pleading sought to be struck in the light most favorable to the nonmoving party. Id. C. Personal Jurisdiction Under Rule 12(b)(2), a court must dismiss an action where it does not have personal jurisdiction over a defendant. Fed. R. Civ. P. 12(b)(2). “[T]he plaintiff bears the burden of establishing that jurisdiction is proper.” Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011). However, “[w]here, as here, the defendant’s motion is based on written materials rather than an evidentiary hearing, the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss.” Id. In addition, “[u]ncontroverted allegations in the complaint must be taken as true, and factual disputes are construed in the plaintiff’s favor.” Freestream Aircraft (Berm.) Ltd. v. Aero Law Grp., 905 F.3d 597, 602 (9th Cir. 2018). D. 12(b)(6) Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. Civ. P. 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss after the Supreme Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v. Twombly, 550 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . . suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014). The Court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads factual content that allows the court to draw the reasonable inference that the Defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). A. TaskUs’s Motion to Dismiss for Forum Non Conveniens 1. Forum-Selection Clause TaskUs moves to dismiss the claims asserted against it with prejudice pursuant to forum selection clauses contained in the contracts between Plaintiffs and Ledger. “[T]he appropriate way to enforce a forum-selection clause pointing to a state or foreign forum is through the doctrine of forum non conveniens.” Atlantic Marine Const. Co., Inc. v. United States Dist. Ct. for Wester Dist. of Texas, 571 U.S. 49, 60 (2013). “A motion to dismiss based on forum non conveniens is not the same as a motion to dismiss for improper venue. The United States Supreme Court has held that under the doctrine of forum non conveniens, a court has the discretion to dismiss a case ‘even if jurisdiction and proper venue are established.’” Chateau Des Charmes Wines Ltd. v. Sabate USA, Inc., 2003 WL 22682483, at *3 (N.D. Cal. Nov. 10, 2003) (quoting American Dredging Co. v. Miller, 510 U.S. 443, 448 (1994)). In the present case, the Ninth Circuit has already confirmed that Ledger’s three agreements with its consumers “contain extremely broad forum selection clauses providing that covered disputes will be subject to the exclusive jurisdiction of the French courts” which covered the claims in this case with respect to Ledger. Baton, 2022 WL 17352192, at *2 (“These forum- selection clauses are enforceable except with respect to Plaintiffs who are ‘California resident plaintiffs bringing class action claims under California consumer law.’” (citing Doe 1 v. AOL LLC, 552 F.3d 1077, 1084 (9th Cir. 2009) (per curiam)). In particular, the Ninth Circuit quoted Ledger’s relating to” the agreement. Id. This Court, in its Prior Order, dismissed previous defendant Shopify due to the forum-selection clause, and stated as follows: “Whether Shopify breached any duty owed to Plaintiffs could well be informed by the terms of the Ledger agreement (and any expressed or implied promise of privacy and security) with the Plaintiffs. Parker, 2017 WL 3034517, at *6 (a non-signatory may be bound by a forum selection clause via “their relation to the contract, not by their relation to the party”). The duties that both Ledger and Shopify owed to Plaintiffs are intertwined. Plaintiffs’ claims against Shopify arose out of their contract with Ledger and Plaintiffs would have had every reason to expect that the privacy rights ensured in their contract with Ledger would obtain to Ledger’s subcontractors. Thus, Shopify’s connection to the conduct at issue is “closely related” to the signatories of the contract with the forum selection clause, and to the contract’s terms and enforcement. See McNally, 2020 WL 7786539, at *2. Since Plaintiffs believed they were entrusting Ledger with their PII, and therefore any of Ledger’s vendors who had access to their PII, it is “foreseeable” that said vendors would be able to enforce their forum selection clause in Plaintiffs’ agreement with Ledger. See Magi XXI, 714 F.3d at 722. As in Robeson, 2014 WL 1392922, and Pat Pelligrini, 2010 WL 1005318, Shopify may avail itself of Ledger’s forum selection clause as an agent or third-party vendor to the Ledger contract, which is closely related to the signatories and the contract at issue. Thus, Shopify is dismissed from this suit in favor of the forum in France which presently does not include any California-specific consumer claims, such as the CLRA and UCL, which would be exempt from the forum selection clause.” To avoid the same fate, Plaintiffs argue that TaskUs is not similarly situated to the Ledger contract, and thus cannot benefit from Ledger’s forum selection clause as a non-signatory. Plaintiffs also contend that regardless, TaskUs has waived this argument for failure to raise in the last round of briefing. The Court takes each argument in turn. a. Non-Signatory Bound In the TAC, Plaintiffs allege that Shopify employed TaskUs to provide “customer support and data security consulting services for Ledger’s sales website and the Ledger Live services, in which Ledger customers could obtain live support for their investments and effectuate transfers of their assets on Ledger’s website.” TAC at ¶ 9. TaskUs was “entrusted with the information collected by the Ledger Live service and Shopify’s collection of the data through their e- commerce services to Ledger. TaskUs therefore had access to, and was entrusted with, the TaskUs played an active role in Ledger’s transactions with customers. TaskUs argues its alleged conduct is “closely related” to Ledger and Shopify; it points to Plaintiffs allegations in the TAC that Ledger had the right to control the conduct of both Shopify and TaskUs, such that both had an active role in Ledger’s relationship with Plaintiffs. TaskUs Reply at 8. Specifically, Plaintiffs allege that: • “Ledger has failed to utilize the promised security measures, employed multiple vendors, and failed to oversee such vendors’ (including Shopify and TaskUs) handling of the data.” TAC at ¶ 8 (emphasis added). • Shopify employed TaskUs to provide “customer support and data security consulting services for Ledger’s sales website and the Ledger Live services, in which Ledger customers could obtain live support for their investments and effectuate transfers of their assets on Ledger’s website.” Id. at ¶ 9. • TaskUs was “entrusted with the information collected by the Ledger Live service and Shopify’s collection of the data through their e-commerce services to Ledger. TaskUs therefore had access to, and was entrusted with, the sensitive user PII . . ..” Id. at ¶ 10. • “Ledger and Shopify failed to oversee the handling of the data [by TaskUs]” such that Ledger and TaskUs should both be liable. Id. at ¶ 15 (emphasis added). As this Court has previously held, “TaskUs engaged in consumer-oriented conduct when it supplied a necessary component of Ledger’s overall product,” and “[t]hus, Plaintiffs have alleged that TaskUs engaged in consumer-oriented conduct given that its subcontractor relationship with Ledger affects the public interest.” Prior Order at 72. As it was contracted to provide an essential component of Shopify’s work for Ledger and its conduct constituted the core of the alleged wrong injurious to Ledger’s customers, TaskUs’ “conduct at issue is ‘closely related’ to the signatories of the contract with the forum selection clause, and to the contract’s terms and enforcement. Id. at 20. The duties that Ledger, Shopify, and TaskUs “owed to Plaintiffs are intertwined.” Id. at 50. Plaintiffs’ claims “arose out of their contract with Ledger and Plaintiffs would have had every reason to expect that the privacy rights ensured in their contract with Ledger would obtain to subcontractor of Shopify, and not of Ledger directly, so there is no vertical privity between TaskUs and Ledger. However, vertical privity does exist – there is a straight line of responsibility between Ledger, Shopify, and TaskUs. The fact that Task Us is one step further away from Ledger as Shopify does not negate the line of privity. In any event, vertical privity is not the determining factor for permitting a non-signatory to the Ledger contract to assert rights thereunder where there is otherwise a “close connection,” and Plaintiffs fail to cite any case law to the contrary. It remains that Plaintiffs believed they were entrusting Ledger with their PII, and therefore any of Ledger’s vendors who had access to their PII, it is “foreseeable” that said vendors would be able to enforce their forum selection clause in Plaintiffs’ agreement with Ledger. There is no reason to hold that entrustment would not extend to subcontractors as well as contractors of Ledger. TaskUs may avail itself of Ledger’s forum selection clause as an agent (or sub-agent) or third-party vendor to the Ledger contract. b. No Waiver Plaintiffs argue that Defendant TaskUs has waived their ability to raise the forum-selection clause because in their prior motion to dismiss, they did not raise the clause, and did not join Shopify in arguing for the forum-selection clause’s applicability to them. Further, Plaintiffs argue because the Court has previously decided TaskUs’s previous 12(b)(6) arguments, it is too late to raise this procedural issue. As a general matter, courts have found waiver of forum-selection clauses when “the party invoking it has taken actions inconsistent with it, or delayed its enforcement, and enforcement would prejudice other parties.” Azod v. Robinson, 2023 WL 1479076 (C.D. Cal. Jan. 30, 2023) at *7 (quoting S&J Rentals, Inc. v. Hilti, Inc., 294 F.Supp.3d 978, 984 (E.D. Cal. 2018)). “The party waiving their right to enforce the clause must demonstrate ‘clear, decisive, and unequivocal conduct manifesting such an intent.” Id. (quoting Bindman v. MH Sub I, LLC, 2020 WL 978618, at *2 (N.D. Cal. Feb. 28, 2020)). This happens when a party ‘substantially participated in the litigation to a point inconsistent with an intent.’” S.E. Power. Grp., Inc. v. Vision 33, Inc., 855 Fed App’x 531, 534 (11th Cir. 2021). Courts have found an intent to not enforce a forum-selection Grp., 855 Fed.App’x at 534-39 (finding waiver where a party served initial disclosures, propounded discovery, and began exchanging discovery); Edwards Vacuum, LLC v. Hoffman Instrumentation Supply, Inc., 2021 U.S. Dist. LEXIS 108095, at *15 (D. Or. June 9, 2021) (finding waiver where a party waived its right to enforce the forum selection clause through its litigation efforts by moving to bifurcate and stay counterclaims); Cable News Network L.P. v. CNNews.com, 177 F.Supp.2d 506, 515, 528 (E.D. Va. 2001) (denying a motion for forum non conveniens based on public policy factors whereby Virginia had a substantial interest in the litigation and where the defendant delayed the filing for eight months, in the interim engaging in “a period of discovery [and] the parties filed cross motions for summary judgment.”). There is no waiver here. Defendant TaskUs has participated in only one round of motion to dismiss briefing. No discovery has been propounded, and no summary judgment motions have been filed. The case is still within the pleading stage, as Plaintiffs filed their TAC just a few short months ago. Though TaskUs did not raise this issue in the last round of briefing, this slight delay does not arise to the level of a waiver. Plaintiffs could have foreseen that any subcontractors to the Ledger contract would raise the forum-selection clause issue. c. Public Interest Factors Finally, and for good measure, the Court addresses whether the public interest factors favor a dismissal for forum non conveniens. The factors are: [T]he administrative difficulties flowing from court congestion; the local interest in having localized controversies decided at home; the interest in having the trial of a diversity case in a forum that is at home with the law that must govern the action; the avoidance of unnecessary problems in conflict of laws, or in the application of foreign law; and the unfairness of burdening citizens in an unrelated forum with jury duty. White Knight Yacht, 407 F. Supp 3d. at 948 (quoting Piper Aircraft Co. v. Reyno, 454 U.S. 235, 241 n.6 (1981)). This case arises from Plaintiffs who “purchased a crypto wallet from a French company pursuant to a contract with a French forum selection clause. France has the greater interest in this case.” TaskUs Reply at 15. The forum selection clause holds France to be the proper forum for law differs from American law, France has been found to be an adequate forum. Harris v. France Telecom, S.A., 2011 WL 3705078, *4-5 (N.D. Ill. Aug. 22, 2011) (finding France adequate alternative forum even though state statutory claims had no equivalents in France because “avenues for redress need not be as comprehensive or favorable as the specific causes of action pursued in the American jurisdiction.”). It would be inefficient for this Court to determine TaskUs’s liability, when TaskUs is only in this case through its connections with Shopify, and Shopify has been dismissed from this case due to the forum-selection clause. Shopify’s and TaskUs’s liabilities are intertwined. It would be inefficient to try the two similar sets of claims in different forums. Further, only one of the four Plaintiffs is from California. California does not have a strong interest in deciding TaskUs’s liability in this case. Accordingly, Defendant TaskUs’s Motion to dismiss for forum non conveniens is GRANTED. Defendant TaskUs is dismissed from the case. B. Ledger’s Motion to Dismiss the TAC 1. Standing for Injunctive Relief Plaintiff Seirafi contends he has standing for two forms of injunctive relief: (i) an order prohibiting Ledger from making misrepresentations and omissions; and (ii) an order compelling Ledger to “implement and maintain reasonable security measures.” Opp. at 5:27-6:10. The Court previously dismissed Seirafi’s claim for injunctive relief against Ledger because the Court found that under Davidson, Seirafi does not plead any sort of actual imminent harm. “Mr. Seirafi does not allege that he seeks to purchase Ledger’s products in the future or otherwise rely on Ledger’s advertisements or labels. Thus, Mr. Seirafi does not have standing to seek prospective injunctive relief against further misrepresentations.” Prior Order at 24-25.1 1 “In Davidson, Plaintiff had standing for injunctive relief because she alleged that she would be unable to rely on the product’s label in future when deciding whether to purchase the product and that the company’s false advertising threatened to invade her statutory right, created by the UCL, CLRA, and FAL, to receive truthful information about the product at issue. Id. at 966-67. In addition, a consumer may have standing if they might purchase the product in the future on the incorrect assumption that the product is as represented. See id. at 969 (“Knowledge that the Seirafi has added in additional language in their TAC to reach this Davidson bar as the Court previously articulated. Specifically, he now alleges: “Seirafi would purchase Ledger products again in the future if Ledger’s products, e-commerce, and support services actually maintained the level of security that Ledger promises to uphold—extending to Ledger’s vendors as well.” TAC at ¶ 23. Defendant Ledger argues these are just “rote and conclusory” statements that include “Broad-sweeping buzzwords—‘products, e-commerce, and support services’—and the absence of any specifically alleged promises on the part of Ledger render the meaning of this allegation entirely unclear.” Ledger Motion at 7. Relying on Julian v. TTE Tech., Inc. No. 20-CV-02857- EMC, 2021 WL 810228, at *9 (N.D. Cal. Mar. 3, 2021) (Chen, J.), whose complaint the Court dismissed for failure to plead an imminent purchase, Ledger argues Plaintiffs fail to specifically describe their intent to purchase the wallet again—and in fact, Ledger states this type of wallet is a one-time purchase altogether, so Plaintiff cannot plausibly plead an intent to repurchase this type of “durable good” that is not susceptible to repeat purchases. Ledger Motion at 5; Ledger Reply at 5. Further Ledger argues that there is no “false or misleading” conduct to enjoin (which the Court addresses below). Ledger argues that Plaintiff’s allegation of an intent to purchase another wallet within the near or reasonably foreseeable future strains credibility and that conclusory allegation of such intent are not sufficient to establish standing for injunctive relief. As Ledger contends, there is a distinction between durable and non-durable goods. That distinction is especially pronounced where the good at issue is of a nature of being a one-time purchase at least for a foreseeable period of time. In Julian v. TTE Tech., Inc., No. 20-CV-02857-EMC, 2021 WL 810228, at *9 (N.D. Cal. Mar. 3, 2021), this Court recognized the distinction between durable and consumable goods with respect to standing: The Court concludes that, based on the current allegations in the pleading, Plaintiffs have failed to establish standing to seek injunctive relief. Plaintiffs’ conclusory allegation that they intend to purchase a TTE television without any factual allegations to suggest sufficient, at least in the context where, as here, the goods are not, e.g., consumable items that are bought on a repeat basis as in Davidson, but rather a durable good not typically purchased on a regular basis. The Court, however, shall have Plaintiffs one final opportunity to cure this deficiency, if they can do so in good faith. See Fed. R. Civ. P.11. Julian v. TTE Tech., Inc., No. 20-CV-02857-EMC, 2021 WL 810228, at *9 (N.D. Cal. Mar. 3, 2021). The likelihood of repurchase of a durable good is even further diminished where the good is not likely to be purchased again. The likelihood of repurchasing a cryptowallet where there is no indication of a problem with the product – the problem lay with the security of the personal data obtained from the purchasers when the wallet was purchased, not the security of the information contained in the hard wallet itself – is less than the likelihood of, e.g., a television in Julian, a solid state hard drive in In re Sandisk SSDS Litig., 2024 WL 3422597, at *2 (N.D. Cal. June 5, 2024), or a bicycle product in Hawkins v. Shimano N. Am. Bicycle Inc., No. 8:23-CV- 02038-JVS (JDE), 2024 WL 2105596, at *7 (C.D. Cal. Apr. 12, 2024). Under the circumstances and the nature of the particular product of this case, more specific allegations demonstrating an intent to repurchase a cryptowallet than those alleged by Plaintiffs herein are required. Plaintiffs lack standing to seek injunctive relief. Accordingly, Defendant’s motion to dismiss Plaintiffs’ claim for injunctive relief is GRANTED.
2. Claim Under UCL and CLRA The Plaintiffs charge Ledger with violations of the UCL and the CLRA. The UCL defines “unfair competition” to include “any unlawful, unfair or fraudulent business act or practice” and “unfair, deceptive, untrue or misleading advertising.” Cal. Bus. & Prof. Code § 17200. The law’s scope is “broad.” Cel-Tech Commc’ns, Inc. v. L.A. Cellular Tel. Co., 20 Cal. 4th 163, 180-81 (1999). The UCL’s prongs on “unlawful,” “unfair” or “fraudulent” practices give rise to separate and distinct theories of liability. See id. at 180. “Whether a practice is deceptive, fraudulent, or unfair is generally a question of fact which requires ‘consideration and weighing of evidence from both sides’ and which usually cannot be made on demurrer.” Linear Tech. Corp. v. Applied Materials, Inc., 61 Cal. Rptr. 3D 221, 236 (Cal. App. Ct. 2007) (quoting McKell v. Washington Mutual, Inc., 142 Cal. App. 4th 1472, 1473 (Cal. App. Ct. 2006)). “The ‘unfair’ prong of the UCL creates a cause of action for a business practice that is unfair even if not proscribed by some other law.” Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1143 (2003). Under the “unlawful” prong of the UCL, violations of state or federal law are “unlawful practices that the unfair competition law makes independently actionable.” Velazquez v. GMAC Mortg. Corp., 605 F. Supp. 2d 1049, 1068 (C.D. Cal. 2008) (citations omitted). Under the “fraudulent” prong of the UCL, claims for misrepresentation may be “affirmative untrue statements[,]” “false” representations, and “a broader category of representations that have ‘a capacity, likelihood[,] or tendency to deceive or confuse the public.’” Rothman v. Equinox Holdings, Inc., 2021 WL 1627490, at *10 (C.D. Cal. Apr. 27, 2021) (quoting Colgan v. Leatherman Tool Grp., Inc., 135 Cal.App.4th 663, 683 (2003); Williams, 552 F.3d at 938). The Court has already held that Plaintiffs’ claims for fraud are “subject to Rule 9(b)’s heightened pleading standard.” Prior Order at 51. Plaintiff’s claims under the UCL and CLRA centrally allege that Ledger misrepresented the security of purchaser’s personal data underlying the purchase of its hardware wallets and that Ledger failed to prevent the incident involving employees of its sub-sub-contractor TaskUs. TAC ¶¶ 6, 19, 21. The Court previously analyzed Plaintiffs’ claims and rejected Seirafi’s misrepresentation theory because: • “[C]onsumers could not have been misled into thinking that providing Ledger with their PII online would be fully secure;” • “Ledger’s representations regarding the security of its hardware wallets do not pertain to the security of Mr. Seirafi’s PII which was not on the hardware wallet at all;” and • “Since Shopify did not announce this incident to Ledger until December, Ledger could not have noticed its customers of Shopify’s involvement in the incident in May and July.” Prior Order at 54-56. UCL and CLRA claim should be dismissed because Seirafi’s misrepresentation claim has again failed “because he still (1) fails to plausibly identify any statements or omissions that are misrepresentations, and (2) fails to identify the purported statements or omissions on which he relied.” Ledger Motion at 9. Further, Ledger argues Plaintiffs’ UCL “unfair” and “unlawful” claims fall because Plaintiffs fail to describe “with reasonable particularity the facts supporting the violation.” Ledger Motion at 13. a. Misrepresentations, CLRA and “fraudulent” prong of UCL “Misrepresentation claims brought pursuant to the UCL … and CLRA are each judged against the same ‘reasonable consumer’ test, which asks whether ‘members of the public are likely to be deceived’ by the alleged misrepresentation.” Rothman v. Equinox Holdings, Inc., 2021 WL 1627490, at *9 (C.D. Cal. Apr. 27, 2021) (quoting Williams v. Gerber Prod. Co., 52 F.3d 934, 938 (9th Cir. 2008)). Claims for misrepresentation may be “affirmative untrue statements[,]” “false” representations, and “a broader category of representations that have ‘a capacity, likelihood[,] or tendency to deceive or confuse the public.’” Id. at *10 (quoting Colgan v. Leatherman Tool Grp., Inc., 135 Cal. App. 4th 663, 683 (2003); Williams, 552 F.3d at 938). “Under … the UCL or the CLRA, when a defendant truthfully and clearly discloses an alleged misrepresentation or omission, a plaintiff cannot plausibly state a claim for relief.” Hammerling v. Google, LLC, 615 F. Supp. 3d 1069, 1082 (N.D. Cal. 2022) (citing Dinan v. Sandisk LLC, 2019 WL 2327923, at *2 (N.D. Cal. May, 31, 2019)); see also Fabozzi v. StubHub, Inc., 2021 WL 506330, at *6 (N.D. Cal. Feb. 15, 2012) (J., Chen) (a ticket reseller did not fraudulently omit that it sold its tickets at a “premium” compared to the ticket’s face value because the ticket reseller disclosed on its website that its tickets “may be … above face value.”). Plaintiffs predicate their fraud claim entirely on a combination of a misrepresentation and an omission in Ledger’s July 2018 privacy policy. Plaintiffs argue that Ledger misrepresented its level of supervision over its contractors and omitted Ledger’s failure to supervise its subcontractors from this privacy policy. Plaintiffs argue that Ledger’s privacy policy states it will (i) implement certain safeguards to secure data “throughout our Services,” (ii) enforce those (iv) “ensure” that “service providers acting on [their] behalf” provide for the “necessary guarantees with respect to the [General Data Protection Regulation.]” (“GDPR”). Opp. at ¶¶ 7:10- 21 (citing TAC ¶¶ 242, 259). From those statements, Seirafi argues that Ledger omitted that it did not take steps to oversee TaskUs or to ensure that TaskUs followed certain measures, such as Ledger’s guidelines and the GDPR. (Opp. at 7:24-8:18.) Plaintiffs do not allege standalone omissions not tied to the privacy policy statements. Plaintiffs have pled with sufficient particularity their fraud claim in the TAC. Though the promises Ledger made in its privacy policy are not particularly specific, Defendant Ledger is on sufficient notice of the alleged affirmative statements and omissions to defend against Plaintiffs’ assertions that Ledger did not apply its own safeguards or those under the GDPR. See In re Yahoo! Inc. Customer Data Sec. Breach Litig., 2017 WL 3727318, *26-27 (N.D. Cal. Aug. 30, 2017) (finding defendants’ representation that they had “physical, electronic, and procedural safeguards that comply with federal regulations to protect personal information about you” actionable.”). However, Plaintiffs failed to plead any allegations that Plaintiff actually saw or relied on the July 31, 2018 privacy policy, a predicate to their claim of fraud – the alleged omissions is tied to the statements made therein. Thus, absent reliance, their claim for misrepresentation under the CLRA and the “fraudulent” prong under the UCL both fail. In re Actimmune Marketing Litig., No. 08-02376 MHP 2010 WL 3463491, at *8 (N.D. Cal. Sept. 1, 2010) (holding a plaintiff’s claim “grounded in misrepresentation or deception” must plead “actual reliance” on the alleged deception). Plaintiff was put on notice in the Court’s last order that reliance was a requirement of a fraud claim. Prior Order at 56 n.15. Though Plaintiffs try to save their claim by pointing to cases that allow fraud claims rooted in “omissions” to proceed without pleading reliance, Opp. at 10-11, these cases are inapposite as Plaintiffs’ fraud claims are not based purely on an omission, but rather omissions tied to express misrepresentations in the privacy policy. TAC ¶¶ 242, 259 (“And these representations also give rise to a claim based on Ledger’s omissions”). When asked about this at the hearing, Plaintiff agreed to the Court that their fraud theory was one of a misrepresentation that then led to an omission. Therefore, Plaintiffs have failed to plead any Accordingly, Defendant Ledger’s motion as to Plaintiff’s CLRA claim and “fraudulent” prong of the UCL is GRANTED. b. UCL “unfair” and “unlawful prong” To support Plaintiffs’ claim under the UCL “unfair” and “unlawful” prong, Seirafi relies on the same allegations as noted above to claim that Ledger erred by “fail[ing] to implement and maintain reasonable security measures to protect” his personal information from disclosure in the TaskUs incident. TAC ¶¶ 229, 237. Plaintiffs further allege: Had Defendants been diligent and responsible, they would have known about and acted upon warnings published in 2017 that 93% of data security breaches were avoidable and the key avoidable causes for data security incidents are: • Lack of a complete risk assessment, including internal, third-party, and cloudbased systems and services; • Not promptly patching known/public vulnerabilities, and not having a way to process vulnerability reports; • Misconfigured devices/servers; • Unencrypted data and/or poor encryption key management and safeguarding; • Use of end-of-life (and thereby unsupported) devices, operating systems, and applications; • Employee errors and accidental disclosures — lost data, files, drives, devices, computers, improper disposal; • Failure to block malicious email; and • Users succumbing to business email compromise (BEC) and social exploits. TAC ¶ 173. To succeed on bringing a claim under the “unlawful” prong of the UCL, Plaintiffs must “plead with particularity how the facts of this case pertain to that specific statute.” Baba v. Hewlett-Packard Co., No. C 09-05946 RS, 2010 WL 2486353, at *6 (N.D. Cal. June 16, 2010). “By proscribing any unlawful business practice, section 17200 borrows violations of other laws and treats them as unlawful practices that the unfair competition law makes independently actionable.” Chabner v. United of Omaha Life Ins. Co., 225 F.3d 1042, 1048 (9th Cir.2000). Plaintiffs connect the alleged deficiencies of Ledger in supervising TaskUs to the following statutes: Ledger’s failures to implement and maintain reasonable security measures also were contrary to legislatively declared public policy that seeks to protect consumers’ data and ensure that entities that are trusted with it use appropriate security measures. These policies are California’s Consumer Records Act, Cal. Civ. Code § 1798.81.5.
Ledger has engaged in “unlawful” business practices by violating multiple laws, including California’s Consumer Records Act, Cal. Civ. Code §§ 1798.81.5 (requiring reasonable data security measures) and 1798.82 (requiring timely breach notification); California’s Consumers Legal Remedies Act, Cal. Civ. Code § 1780, et seq.; the FTC Act, 15 U.S.C. § 45; and California common law. TAC ¶¶ 238, 239. Plaintiffs have thus met their pleading burden, alleging at minimum, a violation of the California’s Consumer Records Act which requires that “a business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” Cal. Civ. Code § 1798.81.5. To succeed on bringing a claim under the “unfair” prong of the UCL, courts have split on the appropriate test to apply. See Svenson v. Google Inc., No. 13–CV–04080–BLF, 2015 WL 1503429, at *9 (N.D. Cal. Apr. 1, 2015) (explaining the split in California Courts of Appeal): With respect to the unfair prong [. . .] [t]hree lines of authority have developed among the California Courts of Appeal. In the first line, the test requires “that the public policy which is a predicate to a consumer unfair competition action under the unfair prong of the UCL must be tethered to specific constitutional, statutory, or regulatory provisions.” Drum v. San Fernando Valley Bar Ass'n, 182 Cal.App. 4th 247, 257 (2010) (internal quotation marks and citation omitted). A second line of cases applies a test to determine whether the identified business practice is “immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers and requires the court to weigh the utility of the defendant's conduct against the gravity of the harm to the alleged victim.” Id. (internal quotation marks and citation omitted). The third test draws on the definition of “unfair” from antitrust law and requires that “(1) the consumer injury must be substantial; (2) the injury must not be outweighed by any countervailing benefits to consumers or competition; and (3) it must be an injury that consumers themselves could not reasonably have avoided.” Id. The Court notes that nowhere in either Parties’ briefing do they address either of the three tests. Nevertheless, the Court finds that Plaintiffs allegations are sufficient to allege that Defendant’s conduct, at minimum, violated the balancing test. “Plaintiffs allege that Defendants promised in their Privacy Policy to protect their customers’ data, but that Defendants knowingly failed to employ adequate safeguards to protect their customers’ data, in violation of Defendants’ Privacy Policy.” See In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752- LHK, 2017 WL 3727318, *24 (N.D. Cal. Aug. 30, 2017) (finding plaintiffs adequately alleged unfair conduct under the balancing test where the complaint alleged that defendant failed to adequately protect customer data, which was allegedly in violation of several statutes that reflected California's public policy of protecting customer data) (collecting cases). Accordingly, Plaintiffs have adequately plead claims under the “unfair” and “unlawful” prongs under the UCL. The motion to dismiss those prongs of the UCL claim is DENIED. i. Adequate remedy at law Ledger argues Plaintiffs again fail to plead no adequate remedy at law, as is required to state a claim for equitable relief under the UCL or CLRA. Sonner v. Premier Nutrition Corp., 971 F.3d 834, 841 (9th Cir. 2020). The Court previously deferred ruling on this until the pleadings were settled. The Court has now dismissed with prejudice Plaintiffs’ remaining CLRA claim, the legal basis for recovery of damages. Thus, Sonner does not apply, as Plaintiffs do not have a remedy at law. This is not a case where the plaintiff’s failure to exercise diligence resulted in the forfeiture of an otherwise available legal remedy. Cf Guzman v. Polaris Industries Inc., 49 F.4th 1308, 1312 (9th Cir. 2022) (finding Sonner did apply wherein the plaintiff had a viable CLRA claim except that it was time-barred because a plaintiff “cannot have neglected his opportunity to pursue his CLRA damages claim, which was an adequate remedy at law, and then be rewarded for that neglect with the opportunity to pursue his equitable UCL claim in federal court.”). Instead, the facts do not afford the Plaintiffs a right under the CRLA but do afford a basis to assert equitable claims under the UCL. Therefore, Defendant Ledger’s motion as to Plaintiff’s remaining claims of the UCL is 3. Motion to Strike California Subclass In the Court’s Prior Order, the Court held that the California Consumer Subclass was incidents occurred and were thus [presumably] aware of the alleged ‘inadequate’ security practices at the time of their purchase.” Prior Order at 26 (quoting Ledger Reply at 15). Accordingly, Plaintiffs revised the class definition in the TAC so it ends in December 2020, TAC, ¶ 187, which is when Ledger first made a public announcement making clear the massive scope of the data breach and a hacker published Ledger customer data online, TAC, ¶¶ 158, 161. Ledger argues the current class definition is still too broad because it includes individuals who never purchased their wallet from Ledger, and thus there is “no nexus with Seirafi’s claims and Seirafi, who seeks to represent them, is atypical.” Ledger Reply at 14. The Court previously found it appropriate to strike overly broad class definition because the claims were not typical of the class. In the Court’s Prior Order, the Court found that Seirafi alleged an injury-in-fact because his contact information was disclosed. See Prior Order at 15-20 (holding Plaintiff’s claims for privacy injury, benefit-of-the-bargain injury, and lost value of PII stemmed from disclosure of his information). Thus, if a putative class member did not purchase their wallet from Ledger, it is unclear, and Plaintiffs do not allege, that such an indirect purchaser would have given their contact information to Ledger, which was then share with Shopify and TaskUs and became subject to exfiltration. Though Plaintiffs attempt to argue that a class member’s connection to the alleged breach is not relevant because Plaintiffs argue under a “benefit-of-the-bargain” theory, the value of all Ledger wallets was depreciated by this alleged breach, the Court is not persuaded. Here, there is no allegation that the product itself was defective – the basis of the typical benefit-of-the-bargain or “premium price” theory. See, e.g. Siqueiros v. General Motors LLC, 2022 WL 74182, at *11 (N.D. Cal. Jan 7, 2022); see also Nguyen v. Nissan N. Am., Inc., 932 F.3d 811, 819–822 (9th Cir. 2019). Here the problem lay with the PII Ledger obtained in connection with the sale of the wallet, not the wallet itself. If an indirect purchaser never provided PII to Ledger in the process of purchasing the wallet, it was not exposed to the data breach and there would be no basis of asserting overpayment of a premium price. Accordingly, Plaintiffs must redefine the class definition to include only purchases of Ledger’s wallet who purchased directly from Ledger. 2 For the foregoing reasons, the Court GRANTS Defendant TaskUs’s Motion, and 3 GRANTS IN PART AND DENIES IN PART Defendant Ledger’s Motion. Plaintiffs’ third 4 cause of action against Ledger under the “unjust” and “unlawful” prongs of the UCL is all that 5 } remains. 6 Plaintiffs are granted leave solely to modify the class definition and shall have 30 days 7 from the date of this Order to file the amended complaint. Otherwise, as this is already the third 8 amended complaint, Plaintiffs’ claims that are inadequately plead are dismissed with prejudice. 9 10 3s 12
13 Dated: February 6, 2025
EDWA . CHEN A 16 United States District Judge
Z 18 19 20 21 22 23 24 25 26 27 28