1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 10 11 JUAN FLORES-MENDEZ and AMBER COLLINS 12 No. C 20-04929 WHA Plaintiffs, 13 v. 14 ORDER RE MOTIONS TO ZOOSK, INC. and SPARK NETWORKS, SE, DISMISS AND REQUEST FOR 15 DISCOVERY Defendants. 16 17 INTRODUCTION 18 In this putative class action by data-breach victims, defendants move to dismiss for failure 19 to state a claim on which relief can be granted. Additionally, a Germany-based defendant 20 moves to dismiss for lack of personal jurisdiction. For the following reasons, the motions are 21 GRANTED IN PART AND DENIED IN PART. 22 STATEMENT 23 According to the first amended complaint, defendant Zoosk, Inc., runs a free dating 24 platform. Spark Networks, SE, is Zoosk’s parent company; Spark acquired it in 2019. Upon 25 sign-up for Zoosk’s dating site, singles must enter personal information. The complaint defines 26 personal information as a limited universe of financial, email, identity, address, birthdate, and 27 1 additional features. Plaintiffs, California residents, used defendant Zoosk’s online 2 matchmaking platform during the relevant period. Plaintiff Juan Flores-Mendez joined the 3 dating platform in “2015 or 2016” and his membership was active in early 2020 when the 4 events giving rise to this suit occurred. Per the amended complaint, Flores-Mendez disclosed 5 his personal information to Zoosk when he joined the platform. Amber Collins similarly joined 6 “in or about 2016,” shared personal information to set up a profile, and remained active through 7 early 2020. No other facts differentiate plaintiffs’ claims. 8 Parties agree that Zoosk maintains its headquarters in San Francisco. Spark maintains its 9 principal business office in Berlin. The amended complaint alleges personal jurisdiction over 10 both defendants because of their “continuous and systematic contacts with” California, because 11 they “conduct substantial business in” California, and because the events arise out of 12 “[d]efendants’ connection with the District” (Amd. Compl. ¶¶ 2, 3, 18, 19, 23, 32, 33, 35). 13 In addition, the amended complaint states that Spark maintains an office in California. A 14 declaration by Spark’s general counsel, Gitte Bendzulla, declares that Spark does not operate 15 offices in California; instead, Spark’s contacts with the district are limited to secondary ones 16 through its subsidiaries. The subsidiaries allegedly include other dating applications operating 17 in the state. Spark declares that one of these (not Spark) runs an office in the state and that its 18 own contact with California is limited to revenue collection and serving residents via subsidiary 19 dating platforms. The subsidiaries serve residents of California at a rate roughly proportional 20 by population to residents of other states. Spark denies targeting ads to California. The 21 complaint alleges that Spark “owned and operated” Zoosk before, during, and after the period 22 of the breach. It alleges that Spark’s other dating-site subsidiaries share a “common database” 23 with Zoosk under Spark’s umbrella. Spark responds that it does not provide the centralized 24 services. It states that another of its subsidiaries provides centralized marketing to all other 25 subsidiary dating applications (Bendzulla Decl. ¶¶ 4–17, Amd. Compl ¶¶ 2, 3, 18, 19, 23, 32, 26 33, 35). 27 In early 2020, according to the amended complaint, hackers styling themselves 1 learned of this in May 2020. It sent notices to its users allegedly 22 days after learning of the 2 breach. Both plaintiffs purportedly received notices of the hack at the end of May or beginning 3 of June 2020. The amended complaint explains that Zoosk, at present, claims to use multi- 4 factor authentication and other security features thus rendering its systems safe, but the 5 complaint in its request for a declaratory judgment calls this “unverified” (Amd. Compl. ¶¶ 7, 6 13, 14, 80, 95). 7 After defendants filed initial motions to dismiss, plaintiffs filed the first amended 8 complaint in October 2020. The instant motions to dismiss, accompanied by declarations and 9 extraneous documents supplementing the issue of personal jurisdiction, followed. This order 10 follows full briefing and oral argument (telephonic due to COVID-19). 11 ANALYSIS 12 1. PERSONAL JURISDICTION. 13 Defendant Spark challenges personal jurisdiction under Rule 12(b)(2). Zoosk does not. 14 The basic dispute relates to Spark’s connections to personal jurisdiction and Spark’s degree of 15 control over Zoosk. 16 It seems undisputed that the headquarters for Spark lies in Germany. Parties present 17 conflicting information (all either declared or supported by affidavit) about whether Spark had a 18 physical presence in the district during the relevant period. The amended complaint contains 19 allegations suggesting additional connections between Spark and California, through Spark’s 20 “operation” of Zoosk and targeting of the California market. Spark’s sworn declaration 21 articulates the substantial separation between the companies, rebutting the notion that Spark ran 22 Zoosk. 23 Plaintiffs attempt to rebut Spark’s representations through other extraneous documents. 24 For example, in September 30, 2019, open letter to shareholders, Spark disclosed that it was 25 “integrat[ing] efforts at Zoosk,” “consolidate[ing] our marketing teams and technology efforts,” 26 and allowing [them] to reduce “shed more than two-thirds of the San Francisco headcount by 27 year end” (Grombacher Decl. Exh. E at 2). In its investor presentation in fall 2020, Spark 1 numerous cost-saving initiatives” and that a goal for 2020 was the, “the timing of the 2 integration of the Zoosk technology function” (Grombacher Decl. Exh. D at 2). Spark has 3 contested this representation, declaring that the quoted San Francisco office belonged to a 4 different subsidiary, not Spark itself, that that “Spark Network” refers to Spark’s web of 5 subsidiaries, not Spark the parent company, and that one of its subsidiaries runs all centralized 6 services (See also Bendzulla Decl. ¶¶ 4–17, Amd. Compl. ¶¶ 2, 3, 18, 19, 23, 32, 33, 35). 7 Discovery is warranted to resolve these disputes. Defendants must cooperate with 8 expedited discovery on pain of adverse inferences. Plaintiffs will be allowed discovery on the 9 issue of jurisdiction (both specific and general), including with respect to their alter-ego theory. 10 Plaintiffs may take up to three depositions of seven hours each and may have up to 12 narrowly- 11 drawn and reasonable document requests. Plaintiffs will have until APRIL 1, 2021, AT NOON to 12 complete this discovery and submit a supplemental brief. Defendants will have seven days 13 from the date of the supplemental brief to respond. 14 2. RULE 12(b)(6). 15 To survive a motion to dismiss under Rule 12(b)(6), a complaint must contain sufficient 16 factual matter, accepted as true, to state a claim for relief that is plausible on its face. See 17 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A claim is facially plausible when there are 18 sufficient factual allegations to draw a reasonable inference that defendants are liable for the 19 misconduct alleged. While a court must take all of the factual allegations in the complaint as 20 true, it is “not bound to accept as true a legal conclusion couched as a factual allegation.” Bell 21 Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). 22 A. NEGLIGENCE. 23 To state a claim for negligence in California, a plaintiff must establish a duty, a breach of 24 duty, proximate cause, and damages. See Corales v. Bennett, 567 F.3d 554, 572 (9th Cir. 2009).
Free access — add to your briefcase to read the full text and ask questions with AI
1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 10 11 JUAN FLORES-MENDEZ and AMBER COLLINS 12 No. C 20-04929 WHA Plaintiffs, 13 v. 14 ORDER RE MOTIONS TO ZOOSK, INC. and SPARK NETWORKS, SE, DISMISS AND REQUEST FOR 15 DISCOVERY Defendants. 16 17 INTRODUCTION 18 In this putative class action by data-breach victims, defendants move to dismiss for failure 19 to state a claim on which relief can be granted. Additionally, a Germany-based defendant 20 moves to dismiss for lack of personal jurisdiction. For the following reasons, the motions are 21 GRANTED IN PART AND DENIED IN PART. 22 STATEMENT 23 According to the first amended complaint, defendant Zoosk, Inc., runs a free dating 24 platform. Spark Networks, SE, is Zoosk’s parent company; Spark acquired it in 2019. Upon 25 sign-up for Zoosk’s dating site, singles must enter personal information. The complaint defines 26 personal information as a limited universe of financial, email, identity, address, birthdate, and 27 1 additional features. Plaintiffs, California residents, used defendant Zoosk’s online 2 matchmaking platform during the relevant period. Plaintiff Juan Flores-Mendez joined the 3 dating platform in “2015 or 2016” and his membership was active in early 2020 when the 4 events giving rise to this suit occurred. Per the amended complaint, Flores-Mendez disclosed 5 his personal information to Zoosk when he joined the platform. Amber Collins similarly joined 6 “in or about 2016,” shared personal information to set up a profile, and remained active through 7 early 2020. No other facts differentiate plaintiffs’ claims. 8 Parties agree that Zoosk maintains its headquarters in San Francisco. Spark maintains its 9 principal business office in Berlin. The amended complaint alleges personal jurisdiction over 10 both defendants because of their “continuous and systematic contacts with” California, because 11 they “conduct substantial business in” California, and because the events arise out of 12 “[d]efendants’ connection with the District” (Amd. Compl. ¶¶ 2, 3, 18, 19, 23, 32, 33, 35). 13 In addition, the amended complaint states that Spark maintains an office in California. A 14 declaration by Spark’s general counsel, Gitte Bendzulla, declares that Spark does not operate 15 offices in California; instead, Spark’s contacts with the district are limited to secondary ones 16 through its subsidiaries. The subsidiaries allegedly include other dating applications operating 17 in the state. Spark declares that one of these (not Spark) runs an office in the state and that its 18 own contact with California is limited to revenue collection and serving residents via subsidiary 19 dating platforms. The subsidiaries serve residents of California at a rate roughly proportional 20 by population to residents of other states. Spark denies targeting ads to California. The 21 complaint alleges that Spark “owned and operated” Zoosk before, during, and after the period 22 of the breach. It alleges that Spark’s other dating-site subsidiaries share a “common database” 23 with Zoosk under Spark’s umbrella. Spark responds that it does not provide the centralized 24 services. It states that another of its subsidiaries provides centralized marketing to all other 25 subsidiary dating applications (Bendzulla Decl. ¶¶ 4–17, Amd. Compl ¶¶ 2, 3, 18, 19, 23, 32, 26 33, 35). 27 In early 2020, according to the amended complaint, hackers styling themselves 1 learned of this in May 2020. It sent notices to its users allegedly 22 days after learning of the 2 breach. Both plaintiffs purportedly received notices of the hack at the end of May or beginning 3 of June 2020. The amended complaint explains that Zoosk, at present, claims to use multi- 4 factor authentication and other security features thus rendering its systems safe, but the 5 complaint in its request for a declaratory judgment calls this “unverified” (Amd. Compl. ¶¶ 7, 6 13, 14, 80, 95). 7 After defendants filed initial motions to dismiss, plaintiffs filed the first amended 8 complaint in October 2020. The instant motions to dismiss, accompanied by declarations and 9 extraneous documents supplementing the issue of personal jurisdiction, followed. This order 10 follows full briefing and oral argument (telephonic due to COVID-19). 11 ANALYSIS 12 1. PERSONAL JURISDICTION. 13 Defendant Spark challenges personal jurisdiction under Rule 12(b)(2). Zoosk does not. 14 The basic dispute relates to Spark’s connections to personal jurisdiction and Spark’s degree of 15 control over Zoosk. 16 It seems undisputed that the headquarters for Spark lies in Germany. Parties present 17 conflicting information (all either declared or supported by affidavit) about whether Spark had a 18 physical presence in the district during the relevant period. The amended complaint contains 19 allegations suggesting additional connections between Spark and California, through Spark’s 20 “operation” of Zoosk and targeting of the California market. Spark’s sworn declaration 21 articulates the substantial separation between the companies, rebutting the notion that Spark ran 22 Zoosk. 23 Plaintiffs attempt to rebut Spark’s representations through other extraneous documents. 24 For example, in September 30, 2019, open letter to shareholders, Spark disclosed that it was 25 “integrat[ing] efforts at Zoosk,” “consolidate[ing] our marketing teams and technology efforts,” 26 and allowing [them] to reduce “shed more than two-thirds of the San Francisco headcount by 27 year end” (Grombacher Decl. Exh. E at 2). In its investor presentation in fall 2020, Spark 1 numerous cost-saving initiatives” and that a goal for 2020 was the, “the timing of the 2 integration of the Zoosk technology function” (Grombacher Decl. Exh. D at 2). Spark has 3 contested this representation, declaring that the quoted San Francisco office belonged to a 4 different subsidiary, not Spark itself, that that “Spark Network” refers to Spark’s web of 5 subsidiaries, not Spark the parent company, and that one of its subsidiaries runs all centralized 6 services (See also Bendzulla Decl. ¶¶ 4–17, Amd. Compl. ¶¶ 2, 3, 18, 19, 23, 32, 33, 35). 7 Discovery is warranted to resolve these disputes. Defendants must cooperate with 8 expedited discovery on pain of adverse inferences. Plaintiffs will be allowed discovery on the 9 issue of jurisdiction (both specific and general), including with respect to their alter-ego theory. 10 Plaintiffs may take up to three depositions of seven hours each and may have up to 12 narrowly- 11 drawn and reasonable document requests. Plaintiffs will have until APRIL 1, 2021, AT NOON to 12 complete this discovery and submit a supplemental brief. Defendants will have seven days 13 from the date of the supplemental brief to respond. 14 2. RULE 12(b)(6). 15 To survive a motion to dismiss under Rule 12(b)(6), a complaint must contain sufficient 16 factual matter, accepted as true, to state a claim for relief that is plausible on its face. See 17 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A claim is facially plausible when there are 18 sufficient factual allegations to draw a reasonable inference that defendants are liable for the 19 misconduct alleged. While a court must take all of the factual allegations in the complaint as 20 true, it is “not bound to accept as true a legal conclusion couched as a factual allegation.” Bell 21 Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). 22 A. NEGLIGENCE. 23 To state a claim for negligence in California, a plaintiff must establish a duty, a breach of 24 duty, proximate cause, and damages. See Corales v. Bennett, 567 F.3d 554, 572 (9th Cir. 2009). 25 Both parties devote considerable time to the question of a “special relationship” between 26 plaintiffs and Zoosk, which is necessary to overcome California’s economic loss doctrine. The 27 “special relationship” allows for recovery of purely economic losses despite the general rule 1 (1965). Put simply, “the economic loss rule prevent[s] the law of contract and the law of tort 2 from dissolving one into the other.” Robinson Helicopter Co. v. Dana Corp., 34 Cal. 4th 979, 3 988 (2004) (quotation marks omitted). The rule serves to “limit liability in commercial 4 activities that negligently or inadvertently go awry.” Id. at 991 n.7. 5 Defendants argue that the economic loss rule bars plaintiffs’ negligence claim under the 6 “duty” prong: “Because the [first amended complaint] does not adequately plead a special 7 relationship between Zoosk and its users, Plaintiffs cannot establish that Zoosk owed them a 8 duty to protect their information” (Mot. at 5). Defendants either misread or misrepresent the 9 law on point. The “special relationship” question only emerges with respect to the economic 10 loss doctrine, and all of defendants’ cited cases say as much. See Kalitta Air, L.L.C. v. Cent. 11 Texas Airborne Sys., Inc., 315 F. App'x 603, 605 (9th Cir. 2008), quoting J'Aire Corp. v. 12 Gregory, 24 Cal.3d 799, 804 (1979) (discussing the exceptions to the general prohibition in tort 13 on pure economic recovery); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 14 996 F. Supp. 2d 942, 966 (S.D. Cal. 2014), order corrected, No. 11MD2258 AJB (MDD), 2014 15 WL 12603117 (S.D. Cal. Feb. 10, 2014) (Judge Anthony J. Battaglia) (finding a duty of care 16 but no special relationship that overcame the economic loss doctrine). 17 Nevertheless, to the extent that Zoosk argues that the economic loss rule bars plaintiffs’ 18 negligence claim, this order considers it. Generally, purely economic losses are not recoverable 19 in tort. See Seely v. White Motor Co., 63 Cal. 2d 9, 16–17 (1965). Put simply, “the economic 20 loss rule prevent[s] the law of contract and the law of tort from dissolving one into the other.” 21 Robinson Helicopter Co. v. Dana Corp., 34 Cal. 4th 979, 988 (2004) (internal quotation 22 omitted). The rule serves to “limit liability in commercial activities that negligently or 23 inadvertently go awry.” Id. at 991 n.7. If plaintiffs’ harms were purely economic, this order 24 would be required to reach the question of whether any exception, such as a “special 25 relationship,” exists. J'Aire Corp., supra, 24 Cal.3d at 804 (six-factor test for special 26 relationship that can overcome the economic loss doctrine). No need. 27 Plaintiffs allege their loss of time, risk of embarrassment, and enlarged risk of identity 1 Worldwide, Inc., Case No.: 3:16-cv-00014-GPC-BLM, 2016 WL 6523428, at *12 (S.D. Cal. 2 Nov. 3, 2016) (Judge Gonzalo P. Curiel), a district court did find that the economic loss 3 doctrine barred a negligence claim. The victims of a data breach had alleged costs related to 4 breached credit card information. A subsequent decision is more analogous to our facts. Stasi 5 v. Inmediata Health Grp. Corp., No. 19-CV-2353 JM (LL), 2020 WL 6799437, at *7 (S.D. Cal. 6 Nov. 19, 2020) (Judge Jeffrey T. Miller), held that data breach plaintiffs did not plead an 7 economic injury because the loss was not based upon “the ‘costs’ of their lost time and lost 8 productivity.” See also In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., No. 9 3:19-CV-2284-H-KSC, 2020 WL 2214152, at *4 (S.D. Cal. May 7, 2020) (Judge Marilyn L. 10 Huff). Plaintiffs allege they lost time responding to the breach and suffered from increased 11 anxiety. They do not allege purely economic losses and the economic loss rule therefore does 12 not apply. 13 This order returns now to the elements of a negligence claim. 14 First, plaintiffs Flores-Mendez and Collins have plausibly pled a duty of care. A dating 15 app contains sensitive information about sexual preferences, which means that a hack and 16 subsequent use of the private information could plausibly lead to blackmail and embarrassment. 17 From an incentives standpoint, to hold that Zoosk has no duty of care would suggest that 18 companies may profit off users’ data while cutting corners on privacy. As such, the duty of care 19 is adequately alleged. 20 Second, virtually all of the details that defendants insist on are in possession of the 21 defendants, and not in possession of plaintiff. It is unreasonable for defendant to insist that the 22 details be laid out in the initial complaint. The common law doctrine of res ipsa loquitur has 23 some application here. The consuming public has come to believe that the internet companies, 24 which take in their private information, have taken adequate security steps to protect the 25 security of that information from any and all hackers or interventions. The ordinary consumer, 26 however, has no clue what internet companies’ security steps are. There would be no way for 27 users to know what security steps were actually in place. Therefore, when a breach occurs, the 1 thing speaks for itself. The breach would not have occurred but for inadequate security 2 measures, or so it can be reasonably inferred at the pleadings stage. 3 Third, proximate cause is plain. 4 Fourth, plaintiffs adequately allege damages in the form of a heightened risk of future 5 identity theft, loss of privacy with respect to highly sensitive information, loss of time, and risk 6 of embarrassment. This is surely enough to justify our plaintiffs taking discovery from Zoosk 7 to determine exactly what security measures were in place and how the breach occurred. 8 3. SECTION 17200. 9 To establish the right to sue under Section 17200, plaintiffs must show that they 10 personally lost money or property “as a result of the unfair competition.” Cal. Bus. & Prof. 11 Code § 17204; Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 330 (2011). 12 So far, plaintiffs have alleged a loss of privacy, heightened risk of future identity theft, 13 loss of time, and anxiety. They do not, for example, allege that they had to buy credit- 14 monitoring services, nor do they adequately allege the value of their time in terms of 15 opportunity cost. 16 Plaintiffs have not alleged a right to sue under Section 17200. 17 4. DECLARATORY JUDGMENT. 18 Plaintiffs seek a declaratory judgment that Zoos’s existing security measures do not 19 comply with its obligations to provide adequate security and duties of care to plaintiffs’ 20 personal identifiable information. A dispute exists as to what, if any, continued risk plaintiffs 21 and similarly-situated Zoosk users face. Dismissal of the declaratory judgment relief would be 22 premature here. 23 5. CALIFORNIA CONSUMER PRIVACY ACT. 24 Plaintiffs have agreed to dismiss their CCPA claim without prejudice. The Rule 12(b)(6) 25 motion with respect to this claim is DENIED AS MOOT. 26 Plaintiffs may have leave to amend with respect to all claims above. 27 1 CONCLUSION 2 For the foregoing reasons, defendant Spark’s Rule 12(b)(2) motion to dismiss the 3 amended complaint is HELD IN ABEYANCE. Plaintiffs’ request for discovery on personal 4 jurisdiction as to defendant Spark is GRANTED. Defendant Zoosk’s motion to dismiss is 5 DENIED IN PART AND GRANTED IN PART. The motion for a declaratory judgment is DENIED. 6 7 IT IS SO ORDERED. 8 9 Dated: January 30, 2021. | i □□ Pee 11 ILLIAM ALSUP 12 UNITED STATES DISTRICT JUDGE
15 16
= 17
Z 18 19 20 21 22 23 24 25 26 27 28