Foster v. Digital Safety Products, LLC

• Court: District Court, W.D. Virginia
• Decided: May 23, 2025
• Docket: 4:24-cv-00051
• Status: Unknown

Opinion

CLERK’S OFFICE U Ss. DISTRIC T COURT AT eLED VA 5/23/2025 IN THE UNITED STATES DISTRICT COURT BY FOR THE WESTERN DISTRICT OF VIRGINIA ees DANVILLE DIVISION KAREN MARIE FOSTER, ) ) Plaintiff, ) Case No. 4:24-cv-00051 ) Vv. ) MEMORANDUM OPINION ) DIGITAL SAFETY PRODUCTS, LLC, ) By: Hon. Thomas T. Cullen ) United States District Judge Defendant. )

Plaintiff Karen Foster (“Foster’’) brought this action against Defendant Digital Safety Products, LLC (“DSP”’) alleging violations of the Fair Credit Report Act (“FCRA”’) and state law. This matter is before the court on two motions to dismiss filed by DSP. DSP’s first motion to dismiss seeks dismissal of Foster’s original Complaint. DSP’s second motion to dismiss seeks dismissal of Foster’s Amended Complaint, which Foster filed before the court had the opportunity to adjudicate the first motion to dismiss. For the reasons below, the court will deny DSP’s first motion to dismiss as moot and grant DSP’s second motion to dismiss because the court concludes that it lacks personal jurisdiction over DSP. I. STATEMENT OF FACTS The facts are taken from Foster’s Amended Complaint and, for purposes of this motion, are presumed to be true. See Combs v. Bakker, 886 F.2d 673, 676 (4th Cir. 1989). All reasonable inferences are drawn in favor of the existence of jurisdiction. See zd. In May 2022, Foster began working at Morningstar’s Bed, Bath and Curtain (“Morningstar”), a bed and linen store. (Am. Compl. {ff 32, 84-85 [ECF No. 16].) She handled Morningstar’s social-media presence and performed some office work. (id. 4 85.) As a result

of her excellent performance, she engaged in some “advanced discussions with her supervisor about jointly opening a new business venture.” (Id. ¶ 86.) DSP is a California corporation with its principal place of business in California,

although it does business throughout the United States. (Id. ¶ 2.) DSP is a consumer reporting agency that compiles and maintains consumer-information files on individuals nationwide. (Id. ¶ 2.) The information that DSP compiles includes public criminal-record information. DSP sells this consumer information to users through its website, “www.Spyfly.com,” in the form of reports generated from its database. (Id. ¶¶ 3, 27.) Users consider these “comprehensive background check[]” reports during the background-check process for employment and other

decisions. (Id. ¶ 3.) The criminal-background check industry creates such background checks by searching aggregated criminal-record data and disseminating the resulting reports, often “with little to no manual, in-person review.” (Id. ¶ 73.) Foster alleges that an unidentified third-party engaged DSP “to conduct a criminal public records search about” Foster without Foster’s “knowledge or authorization.” (Id. ¶ 88.) DSP sold a comprehensive background-check report to that third-party user, falsely reporting

that Foster was a convicted felon.1 (Id. ¶¶ 5, 92–97.) But Foster has never been charged with or convicted of any felony. (Id. ¶¶ 7, 98, 113.) Rather, the reported convictions belong to a different “Karen Foster,” who is distinguishable from Foster at least by date of birth, social security number, and address information. (Id. ¶ 10.) Foster alleges that DSP failed to engage in reasonable procedures to confirm the accuracy of the information it reported, causing DSP

1 The report also included a number of misdemeanor charges and convictions as well as “offenses, infractions, and other unspecified charges” that do not belong to Foster. (Am. Compl. ¶ 94, 96.) to sell the report, which falsely labeled Foster a “felon,” to the unidentified third-party user. (Id. ¶¶ 9–17, 99–102.) Upon receipt of the report, the unidentified third-party user transmitted that report to

Morningstar. (Id. ¶¶ 5, 41, 104.) Based on that information, Morningstar terminated Foster’s employment. (Id. ¶¶ 8, 41, 103.) The report was also shared with Foster’s fellow employees and her significant other, causing further harm to Foster, including the end of her relationship with her significant other. (Id. ¶¶ 17–20, 106–07.) The planned business venture between Foster and her supervisor also did not come into fruition as a result of the dissemination of the false report. (Id. ¶ 105.)

After obtaining a copy of the report and learning of its contents, Foster contacted DSP to dispute the contents of the report, requesting that DSP investigate the inaccuracies and delete the inaccurate information from the report. (Id. ¶¶ 104, 116–23.) DSP did not correct the report in response to Foster’s inquiries. (Id. ¶¶ 124–26.) On December 18, 2024, Foster filed suit in this court, bringing claims against DSP under the FCRA and state law relating to its dissemination of the false report about her. (See

generally Compl. [ECF No. 1].) DSP moved to dismiss the Complaint on February 28, 2025. (ECF No. 13.) Foster responded to that first motion to dismiss on March 11. (ECF No. 14.) On March 18, before the court could rule on the motion, Foster filed an amended complaint. (ECF No. 16.) DSP moved to dismiss the Amended Complaint on April 1. (ECF No. 17.) Both motions to dismiss have been fully briefed by the parties and are now ripe for disposition. II. STANDARD OF REVIEW Motions to dismiss under Rule 12(b)(2) challenge a court’s personal jurisdiction over a defendant. Carefirst of Md., Inc. v. Carefirst Pregnancy Ctrs., Inc., 334 F.3d 390, 396 (4th Cir. 2003).

In resolving motions to dismiss under Rule 12(b)(2), the court’s review is not confined to the complaint; rather, the court may consider “the parties’ motion papers, affidavits attached to the motion, supporting legal memoranda, and the allegations in the complaint” in resolving a personal-jurisdiction challenge. Grayson v. Anderson, 816 F.3d 262, 268 (4th Cir. 2016). When a defendant challenges personal jurisdiction “based on the contents of a complaint and supporting affidavits, the plaintiff has the burden of making a prima facie showing in support

of its assertion of jurisdiction.” Universal Leather, LLC v. Koro AR, S.A., 773 F.3d 553, 558 (4th Cir. 2014). At that stage, the court “must construe all relevant pleading allegations in the light most favorable to the plaintiff, assume credibility, and draw the most favorable inferences for the existence of jurisdiction.” Combs, 886 F.2d at 676. III. ANALYSIS When Foster filed the Amended Complaint on March 18, 2025, the first motion to

dismiss became moot because the Amended Complaint superseded the pleading at which that motion was directed. See Young v. City of Mt. Ranier, 238 F.3d 567, 573 (4th Cir. 2001), abrogated on other grounds by Short v. Hartman, 87 F.4th 593, 609 (4th Cir. 2023) (“[A]n amended pleading supersedes the original pleading, rendering the original pleading of no effect.”). Accordingly, DSP’s first motion is moot. In its second motion to dismiss, DSP argues that Foster’s Amended Complaint should

be dismissed for 6 reasons: (1) the court lacks personal jurisdiction over DSP; (2) venue is improper in this district; (3) DSP is immune from suit under the Communications Decency Act; (4) the Amended Complaint fails to state a claim under the FCRA and state law; (5) the Amended Complaint fails to join a necessary party; and (6) Plaintiff’s state law claims are

precluded by the FCRA. (See generally Def.’s Second Mot. Dismiss [ECF No. 17].) Because the court concludes that it lacks personal jurisdiction over DSP, the court will not address DSP’s remaining arguments for dismissal. A court may “assert personal jurisdiction over a nonresident defendant” if two conditions are met: “(1) the exercise of jurisdiction must be authorized under the” forum state’s—here, Virginia’s—long-arm statute; and “(2) the exercise of jurisdiction must comport

with the due process requirements of the Fourteenth Amendment.” Carefirst of Md., 334 F.3d at 396. The Supreme Court of Virginia has interpreted the Virginia long-arm statute to be co- extensive with “the outer bounds of due process,” so this two-step inquiry collapses into a single question. Tire Eng’g & Distrib., LLC v. Shandong Linglong Rubber Co., Ltd., 682 F.3d 292, 301 (4th Cir. 2012); see AESP, Inc. v. Signamax, LLC, 29 F. Supp. 3d 683, 688 (E.D. Va. 2014). Accordingly, the proper inquiry is whether the defendant has “sufficient minimum contacts

with the forum state” to permit the court’s exercise of jurisdiction. See CFA Inst. v. Inst. of Chartered Fin. Analysts of India, 551 F.3d 285, 292 (4th Cir. 2009). There are “two types of personal jurisdiction: general and specific.” CFA Inst. v. Inst. of Chartered Fin. Analysts of India, 551 F.3d 285, 292 n.15 (4th Cir. 2009). General personal jurisdiction requires “‘continuous and systematic’ contacts with the forum state, such that a defendant may be sued in that state for any reason, regardless of where the relevant conduct

occurred.” Id. (quoting Perkins v. Benguet Consol. Mining Co., 342 U.S. 437, 438 (1957)). Specific personal jurisdiction “requires only that the relevant conduct have such a connection with the forum state that it is fair for the defendant to defend itself in that state.” Id. Foster concedes that DSP is not subject to general jurisdiction in Virginia, so the court’s exercise of personal

jurisdiction, if permissible, must be based on the specific conduct giving rise to this litigation. (See Resp. at 7 n.1 [ECF No. 18].) The Fourth Circuit has established a three-part test for courts to apply in determining whether the due-process requirements for an exercise of specific personal jurisdiction are met: “(1) the extent to which the defendant purposefully availed itself of the privilege of conducting activities in the State; (2) whether the plaintiff[’s] claims arise out of those activities directed at

the State; and (3) whether the exercise of personal jurisdiction would be constitutionally reasonable.” ALS Scan, Inc. v. Digit. Serv. Consultants, Inc., 293 F.3d 707, 712 (4th Cir. 2002). But where the exercise of personal jurisdiction is based solely on “Internet activity” directed at the forum state, the Fourth Circuit has adopted a modified test to replace the first prong of that three-part test. Under the modified test, a court may exercise personal jurisdiction over a person who “(1) directs electronic activity into the State, (2) with the manifested intent of

engaging in business or other interactions within the State, and (3) that activity creates, in a person within the State, a potential cause of action cognizable in the State’s courts.” Id. at 714. The court understands the modified electronic-activity test to replace the purposeful- availment prong of the more broadly applicable specific personal jurisdiction test. Therefore, to have personal jurisdiction over a defendant based on its electronic activity, the court must effectively apply a five-prong test, first evaluating the three electronic-activity prongs and then asking whether the claims “arise from” that electronic activity and whether the exercise of personal jurisdiction would be constitutionally reasonable.2 Foster asserts that DSP purposefully availed itself of the privilege of doing business in

Virginia by (1) reaching into Virginia to obtain Virginia public records and (2) structuring its website in a manner that permits users to narrow their search of DSP’s database to only individuals who reside in Virginia and further narrowing their search to residents of specific localities in Virginia. (See Pl.’s Resp. at 1 [ECF No. 18].) That DSP reaches into Virginia to obtain Virginia public records would be relevant to the court’s exercise of personal jurisdiction if Foster’s claims were about the manner in which

DSP aggregates information, but they are not. Rather, what Foster challenges in this suit is DSP’s dissemination of that information without adequate prior review to ensure accuracy. Because Foster does not allege that DSP did anything wrong in the manner in which it collected Virginia public records information, her claims do not “arise out of” that activity. See ALS Scan, Inc., 293 F.3d at 712. Consequently, that activity cannot justify the court’s exercise of personal jurisdiction over DSP. 3

2 To the extent that the Fourth Circuit instead intended to wholly supplant the more broadly applicable personal jurisdiction test with the electronic-activity personal jurisdiction test, the court would consider, under the third prong of the electronic-activity test, whether the claims are sufficiently related to the identified electronic activity such that the activity “creates” the alleged cause of action (i.e., whether the alleged claims “arise from” the identified electronic activity), so the court’s analysis and conclusion would remain the same. 3 Miller v. Cleara, LLC, which Foster cites, concludes that personal jurisdiction over the non-resident defendant is proper under similar circumstances. 743 F. Supp. 3d 1357, 1366 (D. Utah 2024). The Utah court based its conclusion on the defendant’s collection of Utah public records. See id. But this court cannot agree with the Utah court that claims of the type at issue in this case and in Miller arise out of such records-collection activities. Rather, these claims arise out of the subsequent dissemination of information after it was improperly compiled by the defendant. A plaintiff’s harm in cases such as this arises from the dissemination of improperly compiled or inaccurate information, not from the manner in which the defendant obtained certain public records. Because all credit reporting agency defendants in cases like this collect public records from all 50 states, Miller’s reasoning would mandate different outcomes for two plaintiffs to whom a prior Virginia conviction is falsely Foster’s argument about the format of DSP’s website fares no better. Foster argues that because DSP’s website is structured to permit users to easily search for information about Virginia residents, DSP expressly aimed its conduct at Virginia, such that it can be subject to

suit in Virginia. (See Pl.’s Resp. at 8.) But the electronic activity giving rise to the suit is DSP’s dissemination of a background-check report containing false information about Foster. The format of DSP’s website or the ease with which users can locate Virginia residents on the website is unrelated to the electronic activity of disseminating the report. Foster does not argue that she is harmed by users endeavoring to locate her information on DSP’s website. Rather, the harm occurs only when DSP disseminates a background-check report containing false

information to a user. Because Foster has not alleged that she is harmed by the manner in which DSP’s website is structured, her claims to not “arise out of” the structure of DSP’s website, just as they do not “arise out of” DSP obtaining Virginia public records. See ALS Scan, Inc., 293 F.3d at 712. Therefore, the format of DSP’s website does not create the requisite nexus to permit Foster to sue DSP in Virginia. Further, users of DSP’s website can narrow their search to specifically search for a

resident of any state. If Foster could succeed on this argument, DSP would be subject to suit in every state, an outcome the Fourth Circuit has expressly rejected. See ALS Scan, Inc., 293 F.3d at 712 (rejecting a “broad interpretation of minimum contacts” in the context of

attributed only because one plaintiff continues to reside in Virginia while the other plaintiff moved out of state in the intervening years. See id. at 1367 (describing the case as one in which the defendant collected information “from Utah court and other Utah public records about Utah residents” subsequently sold to a third party who then provided the information to a company “in Utah, that then denied Mr. Miller housing in Utah,” but neglecting to consider that the defendant also collected public records from every other state). Rules of personal jurisdiction cannot apply in such an inconsistent manner. Accordingly, the court rejects Miller’s reasoning. electronic activity under which “State jurisdiction over persons would be universal, and notions of limited State sovereignty and personal jurisdiction would be eviscerated”). In the end, this argument is little more than a repackaged effort to hold a defendant liable because

the plaintiff resides in the forum state and thus experienced harm in the forum state. But it is well established—as Foster herself acknowledges—that “[t]he proper question is not where the plaintiff experienced a particular injury or effect but whether the defendant’s conduct connects him to the forum in a meaningful way” because “the plaintiff cannot be the only link between the defendant and the forum.” (See Pl.’s Resp. at 8 (quoting Walden v. Fiore, 571 U.S. 277, 285, 290 (2014)).)

Courts in at least four other districts—including the Eastern District of Virginia—have held that preparation or dissemination of a background-check report containing harmful information that should not have been included in the report about a plaintiff residing in the forum state does not establish personal jurisdiction over the defendant in the forum state. See Kelley v. Am. Checked, Inc., No. 3:22-cv-12, 2022 WL 3021129, at *6 (E.D. Va. July 29, 2022); Hunter v. Backgroundchecks.com, No. 2:24-cv-01098, 2025 WL 459507, at *4 (E.D. Cal. Feb. 11,

2025); Eckelman v. Rentgrow, Inc., No. 6:21-cv-01801, 2022 WL 17852799, at *6 (D. Or. Nov. 28, 2022); White v. CoreLogic Nat'l Background Data, LLC, No. 3:22-cv-00072, 2023 WL 2712778, at *4 (D. Conn. Mar. 30, 2023); see also Kambarov v. Accurate Background, LLC, No. 3:23-cv-01103, 2024 WL 5395289, at *6 (D. Or. Dec. 2, 2024) (collecting cases). So too here.4

4 Myers v. Bennett Law Offices and Cole v. American Family Mutual Insurance, which Foster cites, are not to the contrary. Rather, both cases are clearly distinguishable because the defendants were the party requesting the credit report, analogous to the unidentified third party in this case—not the credit reporting company. See Myers v. Bennett Law Offs., 238 F.2d 1068, 1071 (9th Cir. 2001); Cole v. Am. Family Mut. Ins. Co., 333 F. Supp. 2d 1038, 1041 (D. Kan. 2004). With respect to the electronic activity actually giving rise to the claims in this case— DSP’s dissemination of a background-check report containing false information about Foster—Foster has not alleged any nexus to Virginia. Though Foster alleges that the report

ultimately ended up in the hands of her Virginia employer, Morningstar, she likewise alleges that DSP did not disseminate the report directly to Morningstar. Rather, DSP sold the report to an unidentified third-party user who then transmitted the report to Morningstar. (See Am. Compl. ¶ 100.) Because personal jurisdiction must be based on DSP’s own acts, the court cannot base its exercise of personal jurisdiction on what a third party did with the report after DSP relinquished control. See Walden, 571 U.S. at 285 (“[I]t is the defendant’s conduct that must

form the necessary connection with the forum State that is the basis for its jurisdiction over him.” (emphasis added)). Consequently, the relevant question is where the unidentified third-party user was located when it received the report from DSP. To this, neither the Amended Complaint nor the parties briefing provides an answer. In fact, to date, Foster has not provided any information about the identity of this third party.5 Because the burden is on the plaintiff to

“mak[e] a prima facie showing in support of its assertion of jurisdiction,” Universal Leather,

5 An affidavit from counsel for Foster, which was filed as an exhibit to Foster’s response to DSP’s first motion to dismiss, asserts that the third party is “a Virginian,” without further explanation or elaboration. (See Decl. of Susan M. Rotkis ¶ 4 [ECF No. 14-2].) This conclusory assertion is insufficient to support a conclusion that the electronic activity of disseminating the report was directed at Virginia. First, alleging that someone is “a Virginian” is not the same as alleging that they were in Virginia at the relevant time such that they received certain information while physically present in the state. Second, this two-word allegation does not establish the foundation for the assertion (as the court is left to guess how counsel has personal knowledge of the facts of the case as opposed to basing her affidavit on the statements of third parties), and the court cannot base its exercise of personal jurisdiction on such a conclusory, unsupported statement. LLC, 773 F.3d at 558, this void of factual allegations supporting the court’s exercise of personal jurisdiction is fatal to Foster’s case. Plaintiff requests leave to conduct jurisdictional discovery “[i]f the court has any

question as to the propriety of personal jurisdiction.” (Pl.’s Resp. at 18.) Courts have broad discretion in determining whether to permit jurisdictional discovery. See Mylan Lab’ys, Inc. v. Akzo, N.V., 2 F.3d 56, 64 (4th Cir. 1993). “If a plaintiff presents factual allegations that suggest with reasonable particularity the possible existence of the requisite contacts between the party and the forum state, the plaintiff’s right to conduct jurisdictional discovery should be sustained.” Toys “R” Us, Inc. v. Step Two, S.A., 318 F.3d 446, 456 (3d Cir. 2003) (cleaned up).

Here, the relevant factual basis for jurisdiction concerns the circumstances surrounding DSP’s dissemination of the background-check report to the unidentified third party. Though Foster seeks jurisdictional discovery concerning a litany of factual issues, none have any bearing on those circumstances. (See Pl.’s Resp. at 18–19.) Accordingly, the court will deny Foster’s request for jurisdictional discovery. But, if she chooses, Foster may seek leave to file a second amended complaint elaborating on the circumstances surrounding DSP’s dissemination of the

background-check report. IV. CONCLUSION For the foregoing reasons, the court denies DSP’s first motion to dismiss (ECF No. 13) as moot and grants DSP’s second motion to dismiss (ECF No. 17) under Rule 12(b)(2) because the court concludes that it lacks personal jurisdiction over DSP. The court does not address DSP’s remaining arguments because the lack of personal jurisdiction alone requires dismissal of the Amended Complaint in its entirety. The court also denies Foster’s request for leave to conduct jurisdictional discovery. The Clerk is directed to forward a copy of this Memorandum Opinion and the

accompanying Order to the parties. ENTERED this 23rd day of May, 2025. /s/ Thomas T. Cullen_________________ HON. THOMAS T. CULLEN UNITED STATES DISTRICT JUDGE