Filed 8/19/26 Pacific Valley Bank v. Servi CA6
NOT TO BE PUBLISHED IN OFFICIAL REPORTS California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115.
IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA
SIXTH APPELLATE DISTRICT
PACIFIC VALLEY BANK, H052965 (Monterey County
Plaintiff and Appellant, Super. Ct. No. 22CV001272)
v.
JOSEPH S. SERVI et al.,
Defendants and Appellants.
In these appeals arising from a trade secret misappropriation case, defendant Joseph S. Servi appeals (1) the judgment entered in favor of Servi’s former employer, Pacific Valley Bank (Pacific Valley), for trade secret misappropriation, and (2) the award of damages to Pacific Valley. Pacific Valley appeals the judgment in favor of Servi’s current employer and codefendant, Pinnacle Bank (Pinnacle), for trade secret misappropriation.
The trial court found that Pacific Valley’s customer lists are trade secrets under the California Uniform Trade Secrets Act (UTSA) (Civ. Code,1 § 3426 et seq.). The court further found that Servi misappropriated the customer lists by taking them with him when he left Pacific Valley to join
1 All further unspecified statutory references are to the Civil Code.
Pinnacle and using them to send marketing e-mails from his Pinnacle e-mail address to Pacific Valley customers. The court found Servi’s misappropriation of the customer lists harmed Pacific Valley, and it awarded Pacific Valley damages.
The trial court also found that Pinnacle had neither participated in nor ratified Servi’s misappropriation of Pacific Valley’s customer lists and was not liable for misappropriation.
On appeal, Servi contends the trial court’s conclusions lack factual support and must be reversed. In its appeal, Pacific Valley asserts that Pinnacle is liable for trade secret misappropriation under the doctrine of respondeat superior or, alternatively, under the principle of ratification.
For the reasons explained below, we affirm.
I. FACTS AND PROCEDURAL BACKGROUND2 A. Facts Pacific Valley and Pinnacle are banks in Monterey County whose customers are businesses and consumers in the Monterey County area. Pacific Valley and Pinnacle are competitors.
Pacific Valley hired Servi as a senior vice president and senior business banker in December 2015. In accepting employment, Servi signed Pacific Valley’s offer letter, agreeing (1) to keep confidential any nonpublic information or data shared with him about Pacific Valley or resulting from his work at Pacific Valley, (2) not to use such information or data except as needed to perform his job duties, and (3) not to disclose such information or data without prior written authorization from Pacific Valley. The letter
2 “We recite the essential relevant facts ‘in the manner most favorable
to the judgment, resolving all conflicts and drawing all inferences in favor of respondent.’ ” (Nwosu v. Uba (2004) 122 Cal.App.4th 1229, 1233, fn. 2; Haydon v. Elegance at Dublin (2023) 97 Cal.App.5th 1280, 1287.)
3
stated that these obligations would survive the involuntary or voluntary termination of Servi’s employment.
In addition, Servi understood from the offer letter that he was expected to comply with the employee handbook and not use Pacific Valley’s nonpublic information and data for any purpose other than performing his job duties.
The employee handbook in effect at the time Servi was hired required employees not to “copy, use, or transfer trade secrets or proprietary materials of [Pacific Valley] or others without appropriate authorization,” required them to protect the privacy of its customers, prohibited them from disclosing any proprietary and nonpublic information (including, without limitation, customer information, trade secrets, financial information, and strategic business plans), and directed them not to discuss confidential or proprietary business matters with any other business entities or disclose the bank’s business information “to outside individuals” unless authorized by the bank or its customers. The employee handbook defined confidential information as including client lists.
The employee handbook directed Pacific Valley’s employees and directors to use customer information only for bank purposes. It informed them that “[t]he use of such information for personal, family, or other gain is unethical and illegal under securities rulings and federal statutes” and “may result in disclosure of insider information.” The handbook stated that Pacific Valley “may advise legal officials or appropriate third parties of policy violations and cooperate with official investigations.”
The employee handbook instructed employees leaving Pacific Valley’s employment to return all Pacific Valley property “upon discharge” and stated that Pacific Valley may “seek the return of [its] property through appropriate legal recourse.”
4
In addition to the obligations set forth in its offer letters and employee handbooks, Pacific Valley utilizes security measures to protect its data, including a data loss prevention system, security audits, a confidentiality pop-up agreement incorporated into its login protocol, annual training on handling private customer and trade secret information, and an exit process that addresses the return of confidential information and trade secrets.
Pacific Valley’s data loss prevention system protects its firewalls and e-
mail systems. The bank undergoes approximately eight security audits each year, including social engineering, external penetration testing, internal penetration testing, external vulnerability, and IT audits.
Pacific Valley’s computer system requires users to acknowledge and accept a confidentiality agreement that appears in a pop-up window upon each attempt to log into the system. The pop-up message states: “This computer system and its software is the property of Pacific Valley [] and is for authorized use only. All information obtained through this system is the proprietary property of Pacific Valley []. Installing or copying any unauthorized software to this system is prohibited. The use of this system may be monitored for computer security purposes. Unauthorized access to [t]his computer system is prohibited, and is subject to criminal and civil penalties.”
Pacific Valley employees are required to take training courses, including courses on financial privacy, bank security, privacy essentials, information security, privacy compliance, and cybersecurity. Servi took these courses.
5
During the COVID-19 pandemic, Pacific Valley decided to issue payroll protection program (PPP) loans3 to both existing and new customers and use the loans to develop its relationships with its new customers so that the new customers would use Pacific Valley for other services. As part of this strategy, Pacific Valley prepared lists of its PPP loan customers (the customer lists), supplying one customer list for each of its relationship managers (Servi, Terri Sisk, and two others) and their manager, Sue Storm. Pacific Valley intended that its relationship managers would use their respective customer lists “to nurture [the] relationships” with the PPP loan customers and grow the bank’s business. Pacific Valley shared this marketing strategy with its relationship managers, and Servi understood this to be the bank’s strategy. Approximately 55 percent of the PPP loans issued by Pacific Valley were to existing customers, and 45 percent were to new customers.
To compile the customer lists, Pacific Valley collected and uploaded its customers’ PPP application information, analyzed the data to see if the customers qualified for a PPP loan, got the loans approved by the Small Business Administration (SBA), processed the loans, and opened up new accounts to disburse the funds from the SBA to the customers.
Compiling the customer lists was a lengthy process, involving multiple people at Pacific Valley and requiring the collection of data from “multiple systems.” Each of the customer lists set forth the customers’ business name, customer number, social security number or tax identification number, tax identification description, phone number, e-mail address, physical address,
3 The PPP loan program was a government program designed to assist
small businesses in meeting their payroll obligations and continuing to pay their employees during the pandemic without having to pay fees for the loans.
6
loan number, current balance, loan officer code, original balance, origination date, payment amount, amortization days, payment type, days currently past due, SBA loan servicing status, loan amount disbursed during that period, e- tran loan number, disbursement date, total loan amount undisbursed, next installment due date, interest rate, original term, guaranteed percent, and maturity date.4 The customer number included in the customer lists provided Pacific Valley employees (including Servi) with insight into the length of time the customer had been with the bank. According to Pacific Valley’s president and CEO, Anker Fanoe, “the lower the number, the longer they have been a customer with the bank. So it would signify to somebody else that this has been a long-time customer, most likely a good customer of the bank, and would also signify that they probably have a lending relationship and are creditworthy customers.” Fanoe further testified that the customer lists are also valuable because they provide customer contact information and the loan amount could indicate the size of the borrower (because the larger a customer’s payroll, the larger a PPP loan it could qualify for).
On July 6, 2020, Storm sent an e-mail (the July 2020 e-mail) containing five customer lists to the four relationship managers and asked them each to review their own list and inform Pacific Valley’s controller of any errors. “Shortly after” Storm sent the July 2020 e-mail to the relationship managers, Servi e-mailed the customer lists to his personal e-mail address.5 He
4 The customer lists also contained a column for the customers’ SBA
application ID, which was left blank for all customers.
5 Servi testified at trial that he e-mailed the customer lists to his
personal e-mail address because he encountered difficulties connecting to Pacific Valley’s system while he was working remotely during the COVID-19 pandemic. Both Storm and Pacific Valley’s chief risk officer testified that
7
subsequently downloaded the customer lists to a personal electronic tablet.6 Pacific Valley did not authorize Servi to send the customer lists to his personal e-mail account, download them to his personal device, or use them for any purpose other than for Pacific Valley’s business purposes. Servi confirmed that he never received authorization to transfer the customer lists out of Pacific Valley’s computer system.
On March 2, 2022, Servi received and accepted from Pinnacle an offer of employment as a senior vice president and senior relationship manager. Pinnacle’s offer letter described Servi’s “primary responsibilities” as including “developing profitable client relationships through existing contacts.” Servi knew that Pinnacle expected him to bring in business and did not have an existing portfolio of customers to give him. Pinnacle’s letter informed Servi that Pinnacle did not want him “to bring any confidential or proprietary material of former employers that may violate any obligations set forth by them.”
On March 21, 2022, Servi resigned from Pacific Valley. His official separation date was April 1, 2022. At the time of his resignation from Pacific Valley, Servi was a senior relationship manager.
On the date of his separation from Pacific Valley, Servi initialed and signed an exit interview acknowledgment. He represented in the acknowledgment that he had returned to Pacific Valley, and no longer had in his possession, any Pacific Valley property, including any confidential information, and he agreed that he would preserve as confidential and not
they were not aware of any Pacific Valley employee having difficulty in accessing the bank’s system remotely.
6 It is not clear from the record whether Servi downloaded the customer
lists to his personal tablet before or after he left the employ of Pacific Valley.
8
use for his or others’ benefit any confidential information of economic value to Pacific Valley.
Servi began his employment at Pinnacle in April 2022. On April 14, 2022, Servi sent two e-mails (the April 2022 e-mails) from his Pinnacle e-mail address to Pacific Valley customers listed on the Pacific Valley customer lists. One e-mail was sent to the customers on the customer list assigned to Servi, and the other e-mail was sent to customers on the customer list assigned to Sisk. The e-mails stated: “I wanted to let you know that I am now with Pinnacle Bank[, a] community bank with larger lending options that will help my customers including [sic] construction loans (large and small projects), a SBA department, a robust online banking platform and cash management tools and last but not least . . . very competitive rates. [¶] I will be reaching out once I get settled, but feel free to contact me via cell or my email below if you have a customer with an immediate need.” Servi used the customer lists because it was easier than independently searching for the e-mail addresses.7 Servi testified that he sent the April 2022 e-mails to obtain referrals from Pacific Valley’s customers or to convince those customers to follow him to Pinnacle.
Pacific Valley became aware of the April 2022 e-mails when Pacific Valley customers notified Pacific Valley that Servi had contacted them. Some customers sent Pacific Valley a copy of the e-mail they received. Pacific Valley took steps to address Servi’s misappropriation of the customer lists and correlated data breach: it contacted Servi to request the return of the customer lists, sent cease-and-desist letters to Servi and Pinnacle, consulted
7 Pinnacle’s chief administrative officer, Denise Brown, likewise agreed
that access to the customer lists would make it easier to market to Pacific Valley’s customers.
9
with its legal counsel and regulators, and contacted customers whose information was on the customer lists.
Storm called Servi to request the return of the customer lists, but Servi refused.
Pacific Valley also sent cease-and-desist letters to Servi and Pinnacle.
After receiving this letter from Pacific Valley, Servi “freaked out” and permanently deleted the e-mail that he had used to send the customer lists to his personal e-mail address. However, he did not delete the lists from his personal devices. Servi informed Pinnacle about the cease-and-desist letter, customer lists, and April 2022 e-mails prior to Pinnacle’s receipt of a cease- and-desist letter from Pacific Valley. In response, Pinnacle verbally counseled Servi against sending such e-mails.
Pinnacle took this step against Servi as a disciplinary action for not complying with its “confidentiality policy and bringing information from a previous employer to Pinnacle.” Pinnacle did not put the counseling in writing or otherwise further reprimand or discipline Servi. Pinnacle elected to impose the least severe discipline on Servi, because he “came forward and told [Pinnacle] exactly what he had done and what happened,” Pinnacle believed him to be “honest,” and Pinnacle “had no reason to believe anything else.”
Pinnacle did not conduct an investigation into the scope of Servi’s actions and use of Pacific Valley’s customer lists, including whether he saved them on Pinnacle’s computer system.
Pacific Valley consulted with its legal counsel, who advised that Pacific Valley was required to report the incident to the Federal Deposit Insurance Corporation (FDIC). Pacific Valley communicated with regulators at the
10
FDIC and the California Department of Financial Protection and Innovation (DFPI) to determine how to respond to the data breach.
Pursuant to Pacific Valley’s discussion with legal counsel and regulators, the bank called the customers on the customer lists to notify them of the data breach and, on June 21, 2022, sent them a written notification of the breach.
Pacific Valley also investigated how Servi transferred the customer lists to his personal e-mail and/or devices, but was unable to conclusively establish how Servi was able to bypass Pacific Valley’s security system and transfer out the customer lists.
Pacific Valley employees documented the hours they spent investigating and addressing the data breach, including the time spent contacting Pacific Valley’s customers, holding internal meetings, addressing the incident at board meetings, communicating with the FDIC and DFPI, consulting with legal counsel, and training employees to communicate the incident to customers. The bank created a spreadsheet documenting the number of hours each employee devoted to the data breach and each applicable employee’s hourly compensation. The spreadsheet stated that the total cost to Pacific Valley to respond to the data breach was $228,339.47.
B. Procedural Background On January 4, 2023, Pacific Valley filed the operative complaint (the first amended complaint), alleging Servi and Pinnacle misappropriated Pacific Valley’s trade secrets (first cause of action), Servi breached his employment contract with Pacific Valley (second cause of action), Servi and Pinnacle intentionally interfered with Pacific Valley’s contractual relations with its customers (third cause of action), Servi and Pinnacle intentionally interfered with Pacific Valley’s prospective economic relations with customers
11
and other third parties (fourth cause of action), Servi and Pinnacle engaged in unfair business practices in violation of Business and Professions Code section 17200 (fifth cause of action), and Servi and Pinnacle committed trade libel against Pacific Valley (sixth cause of action). Pacific Valley sought various relief, including, as pertinent on appeal, compensatory damages.
In May 2024, the trial court conducted a bench trial. The court issued its (final) statement of decision on November 26, 2024.8 In its statement of decision, the trial court found that the customer lists were Pacific Valley’s trade secrets because they “contained valuable, nonpublic , confidential information, including loan numbers that revealed established or proven customers, that [Pacific Valley] went to significant efforts to protect.” The court based its finding on Pacific Valley’s efforts to compile the customer lists, the inclusion of nonpublic information in the lists (such as customers’ social security numbers, e-mail addresses, and telephone numbers), and the value of the lists, which Pacific Valley used “as part of its overall marketing strategy to grow [its] business.” The court found the customer lists provided users with “insight into the creditworthiness and/or value of the customers” based on data regarding the length of the relationship between Pacific Valley and the customer.
The trial court also found that Pacific Valley “took reasonable measures” to protect the customer lists, “including implementing a data loss prevention system and technology, storage on computers with restricted access, annual training, annual security audits, confidentiality pop-ups, confidentiality agreements in its [e]mployee [h]andbook and offer letters, and
8 The record does not include the proposed statement of decision or any
written objections or responses thereto. In its respondent’s brief, Pacific Valley concedes that it did not object to the proposed statement of decision.
12
exit interview acknowledgments.” Pacific Valley also limited access to the customers lists to “five relationship managers, who were all ‘veteran bankers’ ” and the person who created the lists for the relationship managers’ use.
The trial court found Servi misappropriated Pacific Valley’s customer lists by (1) improperly acquiring them by forwarding them to his personal e- mail address and transferring them to his personal home device, (2) keeping the customer lists, and (3) using the customer lists after he left Pacific Valley. The court based its finding on evidence that Pacific Valley sent Servi the customer lists “for review and work purposes” and “never authorized” him to transfer the lists to his personal devices or e-mail accounts. Because Servi admitted to intentionally and permanently deleting the e-mail message he used to send the customer lists to his personal e-mail address—which the court found “was particularly damaging to [Servi’s] credibility and defense”— the court drew an adverse inference against Servi under Evidence Code section 413.9 The trial court concluded that the destroyed evidence “likely would have been unfavorable to [Servi], demonstrating perhaps that he emailed the [customer l]ists to himself and that he later forwarded the [l]ists to himself at his new employer, Pinnacle.” In addition, the court relied on evidence demonstrating that, despite having acknowledged his confidentiality obligations and the confidential nature of the customer lists, Servi retained the customer lists and used them to send the April 2022 e-mails.
9 Evidence Code section 413 states: “In determining what inferences to draw from the evidence or facts in the case against a party, the trier of fact may consider, among other things, the party’s failure to explain or to deny by his testimony such evidence or facts in the case against him, or his willful suppression of evidence relating thereto, if such be the case.”
13
The trial court found Servi’s misappropriation of the customer lists harmed Pacific Valley and was a substantial factor in causing that harm. The court concluded that Pacific Valley would not have had to notify its customers of the data breach10 “ ‘but for’ ” Servi’s transfer of the customer lists to his personal device, failure to return the lists when he resigned from Pacific Valley, and use of the information in the lists to solicit business. The court found that Pacific Valley had presented substantial evidence of the time and expense it incurred “to investigate the misappropriation, notify customers, and confer with bank regulators.”
The trial court entered judgment against Servi on the misappropriation of trade secrets claim.11 The court found reasonable the $228,339.47 in damages requested by Pacific Valley for actual losses incurred in responding to the misappropriation and awarded it that amount.
With respect to Pinnacle, the trial court found that Pinnacle “did not participate in or ratify the misappropriation of trade secrets” by Servi and
10 The trial court found that Pacific Valley’s actions in notifying its
customers of the data breach was not unreasonable given the requirements set forth in the California Consumer Privacy Act (CCPA) (§ 1798.82). The version of section 1798.82, subdivision (a) that was in effect at the time Pacific Valley sent notices to its customers provides, in pertinent part, that “[a] person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California . . . whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person . . .. The disclosure shall be made in the most expedient time possible and without unreasonable delay.” (Former § 1798.82, subd. (a), eff. Jan. 1, 2023, to Dec. 31, 2025.)
11 The trial court found Pacific Valley failed to meet its burden of proof
with respect to its other claims against Servi and entered judgment in Servi’s favor on the second through sixth causes of action. Neither party on appeal challenges the court’s decision on the second through sixth causes of action.
14
that Pinnacle was not liable for Servi’s actions. The court did not render any additional findings of fact regarding the misappropriation claim against Pinnacle.12 On November 26, 2024, the trial court entered judgment in favor of Pacific Valley on the first cause of action, in favor of Servi on the second through sixth causes of action, and in favor of Pinnacle on the first and third through sixth causes of action. The court awarded Pacific Valley $228,339.47 in damages.
Both Servi and Pacific Valley appealed the judgment.
II. DISCUSSION
In his appeal, Servi contends that the trial court erred in finding he misappropriated Pacific Valley’s trade secrets because, he asserts, the customer lists were not trade secrets, Pacific Valley failed to take reasonable steps to protect them, and Servi did not misappropriate them.
In addition, Servi contends that the trial court erred in finding Pacific Valley suffered compensable damages as a result of his actions because Pacific Valley failed to prove that (1) it lost customers as a result of Servi’s actions, (2) its expenditures for responding to the data breach were compensable under the UTSA, or (3) the CCPA required notices be sent to all the customers on the list.
In its appeal, Pacific Valley contends that the trial court erred in concluding Pinnacle was not liable for Servi’s misappropriation of the Pacific Valley customer lists. Pacific Valley argues for Pinnacle’s liability under the doctrine of respondeat superior because it hired Servi for the purpose of
12 The trial court also found Pacific Valley failed to meet its burden of
proof with respect to the other claims against Pinnacle and entered judgment in Pinnacle’s favor on the first and third through sixth causes of action.
15
marketing to and soliciting new customers for Pinnacle, which he did by engaging in the subject tortious actions, including sending the April 2022 e- mails. In the alternative, Pacific Valley asserts that Pinnacle ratified Servi’s actions by never investigating his misappropriation of the customer lists and by only minimally disciplining him.
A. General Principles of Appellate Review “[I]t is a fundamental principle of appellate procedure that a trial court judgment is ordinarily presumed to be correct and the burden is on an appellant to demonstrate, on the basis of the record presented to the appellate court, that the trial court committed an error that justifies reversal of the judgment.” (Jameson v. Desta (2018) 5 Cal.5th 594, 608–609, citing Denham v. Superior Court (1970) 2 Cal.3d 557, 564.)
“To demonstrate error, appellant must present meaningful legal analysis supported by citations to authority and citations to facts in the record that support the claim of error.” (In re S.C. (2006) 138 Cal.App.4th 396, 408 (S.C.).) When an appellant asserts a point on appeal “ ‘but fails to support it with reasoned argument and citations to authority’ ” (Nelson v. Avondale Homeowners Assn. (2009) 172 Cal.App.4th 857, 862 (Nelson)), this court may treat the point as forfeited. “We are not bound to develop appellants’ arguments for them.” (In re Marriage of Falcone & Fyke (2008) 164 Cal.App.4th 814, 830.)
In addition, we must sustain explicit and implicit findings of fact “if they are supported by substantial evidence, even though the evidence could also have justified contrary findings.” (Yield Dynamics, Inc. v. TEA Systems Corp. (2007) 154 Cal.App.4th 547, 557 (Yield Dynamics); SFPP v. Burlington Northern & Santa Fe Ry. Co. (2004) 121 Cal.App.4th 452, 461 (SFPP).) “ ‘ “ ‘When a finding of fact is attacked on the ground that there is not any
16
substantial evidence to sustain it, the power of an appellate court begins and ends with the determination as to whether there is any substantial evidence contradicted or uncontradicted which will support the finding of fact.’ ” ’ [Citation.] ‘[W]e presume that the record contains evidence to sustain every finding of fact. [Citation.] It is the appellant’s burden to demonstrate that it does not.’ [Citaton.] An appellant who challenges a trial court’s factual determination following a nonjury trial ‘must marshal all of the record evidence relevant to the point in question and affirmatively demonstrate its insufficiency to sustain the challenged finding.’ ” (Altavion, Inc. v. Konica Minolta Systems Laboratory, Inc. (2014) 226 Cal.App.4th 26, 43 (Altavion); SFPP, at p. 462.)
B. Trade Secret Misappropriation 1. Legal Principles Under the UTSA, a claim for misappropriation of trade secrets requires the plaintiff to demonstrate: (1) the plaintiff owns a trade secret, and (2) the defendant acquired, disclosed, or used the plaintiff’s trade secret through improper means. (§ 3426.1, subd. (b); Applied Medical Distribution Corp. v. Jarrells (2024) 100 Cal.App.5th 556, 569–570.)
The statute defines a trade secret as “information, including a formula, pattern, compilation, program, device, method, technique, or process, that: [¶] (1) Derives independent economic value, actual or potential, from not being generally known to the public or to other persons who can obtain economic value from its disclosure or use; and [¶] (2) [i]s the subject of efforts that are reasonable under the circumstances to maintain its secrecy.” (§ 3426.1, subd. (d).) “A customer list is one of the types of information which can qualify as a trade secret.” (Abba Rubber Co. v. Seaquist (1991) 235
17
Cal.App.3d 1, 18 (Abba Rubber).) “ ‘Improper means’ ” includes a “breach or inducement of a breach of a duty to maintain secrecy.” (§ 3426.1, subd. (a).)
We review the trial court’s finding that Servi misappropriated Pacific Valley’s trade secrets for substantial evidence. (Altavion, supra, 226 Cal.App.4th at p. 42.)
2. Analysis Servi challenges the trial court’s decision on Pacific Valley’s trade secret misappropriation claim on the grounds that the customer lists are not trade secrets, and he did not misappropriate them.13 a. Trade Secret
Servi contends the customer lists are not trade secrets because (1) components of the lists are publicly available and readily ascertainable, (2) the lists do not provide a “substantial competitive advantage” because the information in the lists “was long since stale and out of date” when he sent the April 2022 e-mails, and (3) Pacific Valley did not take reasonable measures to protect them.
Whether information constitutes a trade secret is generally treated as a factual issue. (Global Protein Products, Inc. v. Le (2019) 42 Cal.App.5th 352, 367; In re Providian Credit Card Cases (2002) 96 Cal.App.4th 292, 300.) We
13 “ ‘Rule 8.204(a)(2)(C) of the California Rules of Court imposes a duty
on an appellant to “[p]rovide a summary of the significant facts limited to matters in the record.” The significant facts are not simply the facts favoring the appellant. Rather, “[a]n appellant must fairly set forth all the significant facts, not just those beneficial to the appellant.” ’ ” (Jogani v. Jogani (2026) 118 Cal.App.5th 823, 840; S.C., supra, 138 Cal.App.4th at p. 408.) Servi fails to comply with this rule. His appellate briefing “instead selectively presents those portions of the record favorable to” him. (Jogani, at p. 840.) Nonetheless, because Pacific Valley does not challenge Servi’s recitation of the facts and because the parties have fully briefed the issues on appeal, we exercise our discretion to decide the issues on the merits.
18
therefore review the trial court’s finding that Pacific Valley’s customer lists are protectable trade secrets for substantial evidence. (Morlife, Inc. v. Perry (1997) 56 Cal.App.4th 1514, 1521 (Morlife).)
The customer lists unquestionably satisfy the meaning of “information, including a . . . compilation” since they consist of PPP loan customers’ information (names, contact information, customer numbers, loan details) compiled by Pacific Valley. (§ 3426.1, subd. (d); see also Abba Rubber, supra, 235 Cal.App.3d at p. 18.)
Information about the individuals and businesses who “use the goods or services” the plaintiff sells is valuable to its competitors. (Abba Rubber, supra, 235 Cal.App.3d at p. 19, italics added; id. at p. 20 [concluding that a list “ ‘winnow[ed] down from a generalized list of companies which may utilize’ ” plaintiff’s services is valuable]; Morlife, supra, 56 Cal.App.4th at p. 1522 [“[A] customer list can be found to have economic value because its disclosure would allow a competitor to direct its sales efforts to those customers who have already shown a willingness to use a unique type of service or product as opposed to a list of people who only might be interested.”]; American Credit Indemnity Co. v. Sacks (1989) 213 Cal.App.3d 622, 631 (American Credit).) “[E]ven if the customers’ names could be found in telephone or trade directories, such public sources ‘ “would not disclose the persons who ultimately made up the list of [the] plaintiff’s customers.” ’ ” (Courtesy Temporary Service, Inc. v. Camacho (1990) 222 Cal.App.3d 1278, 1288 (Courtesy).)
The customer lists identified specific individuals and businesses who were Pacific Valley customers. The customer lists contained information about the longevity of the customers’ relationship with Pacific Valley (an indication of their value to the bank), loan information (indicating the size of
19
the company and its creditworthiness14), and the customers’ contact information (which, as Servi and Pinnacle admitted, made it easier to contact the customers than if they had had to independently search for their e-mail addresses).
Pacific Valley and Pinnacle are competitors for customers in the Monterey County banking market. Although Servi asserts that some of the information in the customer lists is publicly available, he neither disputes the nonpublic nature of the lists themselves nor identifies any evidence in the record that would support a finding that the identities of Pacific Valley’s customers are ascertainable from public sources. (See Abba Rubber, supra, 235 Cal.App.3d at p. 20; Courtesy, supra, 222 Cal.App.3d at p. 1288.) Substantial evidence in the record therefore supports the trial court’s finding that Pacific Valley’s customer lists would be valuable to Servi and Pinnacle.
“[W]here the employer has expended time and effort identifying customers with particular needs or characteristics, courts will prohibit former employees from using this information to capture a share of the market.” (Morlife, supra 56 Cal.App.4th at p. 1521.) “As a general principle, the more difficult information is to obtain, and the more time and resources expended by an employer in gathering it, the more likely a court will find such information constitutes a trade secret.” (Id. at p. 1522; Courtesy, supra, 222 Cal.App.3d at p. 1287 [concluding customer lists were protectable trade secrets where the compilation “was the result of lengthy and expensive
14 For the first time in his reply brief, Servi asserts that “[t]he PPP
loans were issued without regard to creditworthiness” and, therefore, “the issuance of a PPP loan bears no relationship to a businesses [sic] creditworthiness.” Servi’s assertion is untimely and we do not consider it. (Allen v. City of Sacramento (2015) 234 Cal.App.4th 41, 52.)
20
efforts, including advertising, promotional campaigns, canvassing, and client entertainment”].)
Pacific Valley presented undisputed evidence that compiling the customer lists was a lengthy process that required the expenditure of a significant amount of its employees’ time and resources and required the collection of information from multiple databases. Servi himself confirmed this fact.
Substantial evidence in the record supports the trial court’s findings that the customer lists were valuable because they contained information not generally known to the public, and Pacific Valley expended considerable time and resources to create the lists.15 (See Morlife, supra, 56 Cal.App.4th at p. 1522; Abba Rubber, supra, 235 Cal.App.3d at p. 20.)
The record does not support Servi’s contention that Pacific Valley did not take reasonable measures to protect the customer lists. Pacific Valley presented evidence of the ways in which it sought to protect its confidential information and trade secrets, including restrictions on access and export, regular security audits, annual employee training on preserving the confidentiality of its data and protecting against unauthorized disclosure, and repeated reminders (in its offer letters, employee handbooks, login pop- ups, and exit interview process) to its employees of the importance of protecting Pacific Valley’s data and using such data only for purposes of performing their job duties. Substantial evidence in the record supports the trial court’s finding that Pacific Valley “took reasonable measures” to protect its customer lists. (See Morlife, supra, 56 Cal.App.4th at p. 1523; Courtesy,
15 Servi’s additional argument that the customer lists do not provide a
“substantial competitive advantage” because the information in the lists was “stale,” a factual inference the trial court did not draw, does not undermine the substantial evidence supporting the court’s conclusion.
21
supra, 222 Cal.App.3d at p. 1288; American Credit, supra, 213 Cal.App.3d at p. 631.)
Servi asserts that his ability to send the customer lists to his personal e-mail address indicates that Pacific Valley did not take reasonable measures to protect its confidential information and trade secrets. Even if that evidence could have justified such a finding, substantial evidence in the record supports the trial court’s contrary conclusion that Pacific Valley “took reasonable measures” to protect its customer lists. (See Altavion, supra, 226 Cal.App.4th at p. 43.)
Servi has not met his burden on appeal. We therefore sustain the trial court’s finding that the customer lists were Pacific Valley’s trade secrets. (Yield Dynamics, supra, 154 Cal.App.4th at p. 557.)
b. Misappropriation
Servi asserts that Pacific Valley failed to adduce evidence establishing that he improperly obtained, retained, used, and/or disclosed the customer lists. Servi does not develop any of his arguments regarding misappropriation, nor does he cite any legal authority to support them.16 His
16 The single case Servi cites to support his contention that Pacific
Valley “failed to establish misappropriation by acquisition” is Mattel, Inc. v. MGA Entertainment, Inc. (C.D. Cal. 2011) 782 F.Supp.2d 911, 962–963 (Mattel). This decision does not aid Servi.
At the specific pages cited by Servi, the district court cites O2 Micro Internat. Ltd. v. Monolithic Power Sys., Inc. (N.D. Cal. 2006) 420 F.Supp.2d 1070, 1089–1090 for the principle that “ ‘[i]t does not matter if a portion of the trade secret is generally known, or even that every individual portion of the trade secret is generally known, so long as the combination of all such information is not generally known.’ ” (Mattel, supra, 782 F.Supp.2d at p. 962.) As discussed ante (pt. II.B.2.a.), despite the allegedly publicly ascertainable nature of some of the information in the customer lists, the lists remain valuable and are protectable trade secrets.
22
conclusory argument does not establish the trial court erred. (S.C., supra, 138 Cal.App.4th at p. 408; Nelson, supra, 172 Cal.App.4th at p. 862.)
Moreover, substantial evidence in the record supports the trial court’s finding of misappropriation. Pacific Valley did not authorize Servi to send the customer lists to his personal e-mail address or to a location outside of the bank’s computer system, and Servi admits that he received no such authorization. Although Servi also testified that he sent the customer lists to his personal e-mail address because of difficulties he had accessing Pacific Valley’s system while working remotely, Pacific Valley proffered testimony that none of its employees, including Servi, complained of any such access issues. Not only may we imply from the trial court’s finding of misappropriation that it made a credibility determination against Servi (Montoya v. McLeod (1985) 176 Cal.App.3d 57, 62 (Montoya)), the court expressly concluded that Servi’s actions in permanently deleting the e-mail he sent to his personal e-mail address containing the five customer lists “particularly damag[ed]” Servi’s credibility. We may not disturb the court’s credibility determination on appeal. (Lenk v. Total-Western, Inc. (2001) 89 Cal.App.4th 959, 968.)
Servi contends that the trial court’s finding that Pacific Valley failed to establish that the bank had an agreement with him imposing a contractual
In addition, the district court rejected MGA’s concern that considering “easily discoverable product ideas as trade secrets” would incentivize overprotection of trade secrets (Mattel, supra, 782 F.Supp.2d at p. 962), stating that “the UTSA does not prevent a person from using independently developed or properly obtained trade secret information already in the possession of another.” (Id. at p. 963.) As Servi admitted in his testimony, he did not independently develop the customer lists, but, rather, copied the e- mail addresses from the customer lists assigned to him and to Sisk into the April 2022 e-mails.
23
obligation of confidentiality necessarily implies that he did not improperly obtain and retain the customer lists.
Servi misapprehends the law. The obligation to protect trade secrets exists independently of and does not require a contractual prohibition against misappropriation. (See Mattson Technology, Inc. v. Applied Materials, Inc. (2023) 96 Cal.App.5th 1149, 1157 [“Th[e] statutory claim [of trade secret misappropriation] exists without regard to [defendant’s] contractual obligations to [plaintiff].”]; see also American Credit, supra, 213 Cal.App.3d at p. 631, fn. 6; Components for Research, Inc. v. Isolation Products, Inc. (1966) 241 Cal.App.2d 726, 729.) The plain language of the UTSA does not require such a contractual relationship. (See generally § 3462 et seq.; see also § 3426.7, subd. (b) [“This title does not affect . . . contractual remedies, whether or not based upon misappropriation of a trade secret.”].)
For these reasons, we are unpersuaded by Servi’s assertions that the trial court erred in its conclusions that Pacific Valley’s customer lists were trade secrets and that Servi misappropriated them.
C. Damages “A complainant may recover damages for the actual loss caused by misappropriation.” (§ 3426.3, subd. (a); see also Altavion, supra, 226 Cal.App.4th at p. 66.) “We review the trial court’s damages award for substantial evidence.” (Altavion, at p. 43.)
Servi contends that the trial court erred in awarding damages to Pacific Valley because the “ ‘data breach’ ” occurred while Servi was employed by Pacific Valley and, therefore, that breach is Pacific Valley’s “responsibility.” Servi neither engages in any reasoned argument nor cites any legal authority to support this conclusory contention. We therefore disregard it as forfeited.
24
(Nelson, supra, 172 Cal.App.4th at p. 862; S.C., supra, 138 Cal.App.4th at p. 408.)
Servi further contends that the trial court erred because he was not the “ ‘but for’ ” cause of the damages, but, rather, Pacific Valley “incurred [the] alleged damages on its own volition.” To support his contention, Servi asserts that the UTSA does not require Pacific Valley to notify regulators or its customers or offer such customers credit monitoring. In addition, Servi asserts that the court improperly based its damages award on the data breach provisions of the CCPA because Pacific Valley did not present any evidence that his transfer of the customer lists from his Pacific Valley e-mail to his personal e-mail was unauthorized and the court made no findings that his action was unauthorized. Servi argues that, even if the CCPA were applicable, the good faith exception to the CCPA applies.17 We are not persuaded by Servi’s contention that, because Pacific Valley was not required (according to Servi) under either the UTSA or the CCPA to notify its customers of Servi’s misappropriation, Pacific Valley was not entitled to recover damages under section 3426.3, subdivision (a) for the costs of doing so. We discern no such prerequisite for a damages award in the UTSA, and Servi cites no legal authority to support his contention. In addition, contrary to Servi’s assertion, the trial court did not base its award
17 Servi also argues that the amount of the trial court’s damages award
is excessive because only a portion of the customers on the customer lists are individuals with social security numbers and, therefore, Pacific Valley was not required to notify all the customers on the lists. Based on our review of the record before us, Servi did not raise this factual argument about the reasonableness of the amount of the damages award in the trial court and we therefore will not consider it on appeal in the first instance. (Transcontinental Ins. Co. v. Insurance Co. of the State of Pennsylvania (2007) 148 Cal.App.4th 1296, 1309.)
25
of damages on the CCPA.18 Although the trial court stated that the CCPA “was arguably triggered” by Servi’s misappropriation of the customer lists, it found Pacific Valley was entitled to damages because it “reasonably took steps to protect the private financial information of its customers by notifying regulators and its customers of the breach” and “to protect its reputation.” (Italics added.)
Contrary to Servi’s assertion that the trial court made no findings that his conduct was unauthorized, the trial court expressly found that, although Servi may have received the customer lists from Pacific Valley, his transfer of the customer lists to his personal e-mail and device and subsequent use while employed by Pinnacle were unauthorized. The court found that, but for Servi’s wrongful conduct, Pacific Valley would not have had to contact its customers regarding the data breach “to protect its reputation and the private information of [] all its customers.” The court’s findings are supported by substantial evidence in the record, including the testimony of Pacific Valley’s president and CEO and Servi himself.
Moreover, the record contains substantial evidence supporting the trial court’s award of damages for actual losses. Pacific Valley offered employee testimony regarding their conversations with the FDIC and DFPI, as well as its legal counsel, regarding the appropriate response to data breach resulting from Servi’s misappropriation of the customer lists. Pacific Valley then implemented the suggested course of action and tracked the time spent by its
18 In its prayer for relief, Pacific Valley sought “incidental and
compensatory damages according to proof” and did not predicate its request on either the UTSA or the CCPA. The UTSA authorizes the award of compensatory damages for actual loss caused by trade secret misappropriation. (Altavion, supra, 226 Cal.App.4th at p. 66, quoting § 3426.3, subd. (a).)
26
employees to confer with regulators and legal counsel and implement the plan. It provided a list of those hours per employee and the employees’ hourly compensation. Multiplying the number of employee hours by the applicable employee compensation, Pacific Valley asserted that it had incurred costs of $228,339.47 to engage in mitigating actions. The record before us contains no indication that Servi presented any evidence in the trial court challenging the reasonableness of this amount.
We discern no error in the trial court’s award of damages to Pacific Valley.
D. Respondeat Superior and Ratification In its appeal, Pacific Valley contends the trial court erred in concluding Pinnacle was not liable for Servi’s misappropriation of Pacific Valley’s trade secrets. Pacific Valley asserts that Pinnacle is liable under the respondeat superior theory because Servi used Pacific Valley’s trade secrets in the course and scope of his employment at Pinnacle. In the alternative, Pacific Valley asserts Pinnacle is liable because it ratified Servi’s actions by failing to investigate his actions or “sincerely discipline” him.
In response, Pinnacle contends Pacific Valley forfeited these arguments on appeal by failing to object to the trial court’s statement of decision. Although Pacific Valley does not dispute Pinnacle’s contention that Pacific Valley did not object to the trial court’s statement of decision, it asserts that there was “nothing to ‘object’ to in the procedural sense” because the court made no factual findings and only stated a “bare conclusion.”
1. Legal Principles
“Under the doctrine of respondeat superior, an employer may be held vicariously liable for torts committed by an employee within the scope of employment.” (Mary M. v. City of Los Angeles (1991) 54 Cal.3d 202, 208.)
27
“[T]he test for determining whether an employee is acting outside the scope of employment is whether ‘ “in the context of the particular enterprise an employee’s conduct is not so unusual or startling that it would seem unfair to include the loss resulting from it among other costs of the employer’s business.” ’ ” (Id. at p. 214; Avila v. Standard Oil Co. (1985) 167 Cal.App.3d 441, 448 (Avila) [stating the foregoing as a “test of foreseeability”].) “ ‘The burden of proof is on the plaintiff to demonstrate that the negligent act was committed within the scope of employment.’ ” (Halliburton Energy Services, Inc. v. Department of Transportation (2013) 220 Cal.App.4th 87, 94.)
“Ordinarily, the determination whether an employee has acted within the scope of employment presents a question of fact; it becomes a question of law, however, when ‘the facts are undisputed and no conflicting inferences are possible.’ ” (Mary M., supra, 54 Cal.3d at p. 213; Tognazzini v. San Luis Coastal Unified School Dist. (2001) 86 Cal.App.4th 1053, 1057; see also Avila, supra, 167 Cal.App.3d at p. 448 [stating foreseeability is a question of fact].)
“As an alternative to respondeat superior, an employee may be liable for an employee’s act where the employer subsequently ratifies the originally unauthorized tort. [Citation.] The failure to investigate or respond to charges that an employee has committed an intentional tort or the failure to discharge the employee may be evidence of ratification.” (Samantha B. v. Aurora Vista Del Mar, LLC (2022) 77 Cal.App.5th 85, 109 (Samanta B.).)
Ratification is generally considered a question of fact. (Samantha B., supra, 77 Cal.App.5th at p. 109; C.R. v. Tenet Healthcare Corp. (2009) 169 Cal.App.4th 1094, 1110.)
“The substantial evidence standard applies to both express and implied findings of fact made by the superior court in its statement of decision rendered after a nonjury trial. [Citation.] The doctrine of implied findings is
28
based on our Supreme Court’s statutory construction of [Code of Civil Procedure] section 634 and provides that a ‘party must state any objection to the statement in order to avoid an implied finding on appeal in favor of the prevailing party . . .. [I]f a party does not bring such deficiencies to the trial court’s attention, that party waives the right to claim on appeal that the statement was deficient . . . and hence the appellate court will imply findings to support the judgment.’ [Citation.] Stated otherwise, the doctrine (1) directs the appellate court to presume that the trial court made all factual findings necessary to support the judgment so long as substantial evidence supports those findings and (2) applies unless the omissions and ambiguities in the statement of decision are brought to the attention of the superior court in a timely manner.” (SFPP, supra, 121 Cal.App.4th at p. 462.)
“When a court’s finding is attacked on the ground that it is not supported by the evidence, the power of an appellate court begins and ends with the determination whether there is any substantial evidence, contradicted or uncontradicted, which will support the finding or verdict. Questions of credibility must be resolved in favor of the fact finder’s determination, and when two or more inferences can reasonably be drawn from the evidence, a reviewing court may not substitute its deductions for those of the trier of fact. If on any material point the evidence is in conflict, it must be assumed that the court resolved the conflict in favor of the prevailing party.” (Montoya, supra, 176 Cal.App.3d at p. 62.)
2. Analysis The trial court’s entire finding with respect to Pinnacle is that Pinnacle “did not participate in or ratify the misappropriation of trade secrets.”
Pacific Valley concedes on appeal that it made no objections to the trial court’s decision regarding Pinnacle’s liability for trade secret
29
misappropriation. We therefore presume the court made the necessary factual findings to support its decision provided substantial evidence supports those findings.19 (SFPP, supra, 121 Cal.App.4th at p. 462; Thompson v. Asimos (2016) 6 Cal.App.5th 970, 981 [“ ‘[U]nder the doctrine of implied findings, the reviewing court must infer, following a bench trial, that the trial court impliedly made every factual finding necessary to support its decision.’ ”]; Chin v. Advanced Fresh Concepts Franchise Corp. (2011) 194 Cal.App.4th 704, 708 [“When the trial court makes no express findings, we infer that it made every implied factual finding necessary to support its order and [we] review those implied findings for substantial evidence.”].)
We first consider respondeat superior and then ratification.
a. Respondeat Superior
Although the parties do not dispute that, when he sent his April 2022 e-mails, Servi was acting within the scope of his employment by Pinnacle, Pinnacle argues that it could not foresee Servi’s actions because it had confidentiality policies in place. Because the issue of whether Servi’s actions were within the scope of his employment turns on disputed facts, we apply the doctrine of implied findings.
We may infer from the trial court’s decision regarding Pinnacle’s liability that it did not find Servi’s actions to be foreseeable by Pinnacle. Substantial evidence in the record supports its decision. Although Pinnacle expected Servi to bring in business and Servi sent the April 2022 e-mails with the intention of obtaining business from the customers targeted, the
19 We are not persuaded by Pacific Valley’s assertion that the trial
court made no findings of fact. The court stated that it found Pinnacle did not participate in or ratify the misappropriation of trade secrets by Servi, and concluded that Pinnacle therefore was not liable for Servi’s actions. The court’s findings about Pinnacle’s actions are largely factual in nature.
30
record indicates that Pinnacle prohibited new employees from bringing with them “confidential or proprietary material of former employers” and disciplined Servi for his noncompliance with Pinnacle’s confidentiality policy.
Pinnacle’s offer letter to Servi expressly stated: “We are interested in working with you because of the general knowledge and experience you have and not because of any information you have obtained in confidence from any prior employer. Accordingly, we wish to impress upon you that we do not wish you to bring any confidential or proprietary material of former employers that may violate any obligations set forth by them.” While more than one inference could reasonably be drawn from the evidence, as the reviewing court, we may not substitute our deductions for those of the trier of fact. (Montoya, supra, 176 Cal.App.3d at p. 62.) Pacific Valley has not persuaded us that the trial court erred in concluding Pinnacle was not liable under the doctrine of respondeat superior.
b. Ratification
The parties dispute whether Pinnacle’s response to its discovery of Servi’s misappropriation rose to the level of ratification of Servi’s wrongdoing. While Pinnacle contends it “investigated and disciplined” Servi, Pacific Valley asserts that Pinnacle “maintained a laissez-faire attitude” about Servi’s actions and presented “a façade of disapproval” while receiving the benefits of his conduct. In support of its assertion, Pacific Valley relies on the contradicted deposition testimony of Brown (Pinnacle’s chief administrative officer) that the verbal counseling was “reserved for ‘bottom-level minor issues.’ ” Because the issue of ratification turns on disputed facts, here, too, we apply the doctrine of implied findings. (SFPP, supra, 121 Cal.App.4th at p. 462.)
31
We decide substantial evidence in the record supports the trial court’s implied findings. Although Pinnacle admitted to not investigating whether Servi imported the customer lists to the Pinnacle system or sent additional e- mails using the customer lists, Servi himself told Pinnacle what he had done.
Further, unrebutted testimony in the record indicates Pinnacle verbally counseled Servi against sending e-mails using the customer lists. That Pinnacle verbally reprimanded Servi provides substantial evidence supporting the trial court’s finding that Pinnacle did not approve of or ratify Servi’s act.
Brown testified that Pinnacle elected to provide verbal counseling—
which she characterized as “the initial discipline for a first incident of something”—because Servi proactively reported his actions to Pinnacle and they “had no reason to believe” he was not being honest in his report. We may infer from the trial court’s finding on non-ratification that the court found credible Brown’s testimony. (SFPP, supra, 121 Cal.App.4th at p. 462.) We may not substitute our own deductions for those of the trial court. (Montoya, supra, 176 Cal.App.3d at p. 62.)
III. DISPOSITION
We affirm the trial court’s judgment. The parties shall bear their own costs in these appeals. (Cal. Rules of Court, rule 8.278(a)(3).)
______________________________________
Danner, J.
WE CONCUR:
____________________________________
Greenwood, P. J.
____________________________________
Bromberg, J.
H052965 Pacific Valley Bank v. Servi