Riordan v. Western Digital Corporation

Opinion

KEVIN RIORDAN, et al., Case No. 21-cv-06074-EJD

Plaintiffs, ORDER GRANTING DEFENDANT’S MOTION TO DISMISS CLAIMS 1, 3, & v. 4 OF PLAINTIFFS’ SECOND AMENDED COMPLAINT Defendant. Re: ECF No. 62

Plaintiffs Kevin Riordan, Ashley Laurent, Jeremy Bobo, and Nagui Sorial (together, “Plaintiffs”) bring this putative class action against Defendant Western Digital Corporation (“Defendant” or “Western Digital”), a manufacturer of data storage devices, alleging that Defendant failed to properly secure and safeguard information Plaintiffs stored on Defendant’s devices. The operative Second Amended Complaint (“SAC”) asserts claims for (1) violation of the Song-Beverly Consumer Warranty Act (the “Song-Beverly Act” or the “Act”), California Civil Code §§ 1792, et seq.; (2) negligence / failure to warn; (3) violation of the California Unfair Competition Law (“UCL”), California Business & Professions Code §§ 17200, et seq.; and (4) unjust enrichment. See SAC ¶¶ 127–70, ECF No. 61. Now pending before the Court is Defendant’s Motion to Dismiss Plaintiff’s Second Amended Complaint (the “Motion”), which requests that the Court dismiss Plaintiffs’ first, third, and fourth claims, as well as any claims for injunctive relief, without leave to amend. See Mot., ECF No. 62. The Court took the motion under submission for decision without oral argument pursuant to Civil Local Rule 7-1(b). For the reasons discussed herein, the Court GRANTS Defendant’s Motion without leave to amend. A. Factual Allegations1 Western Digital is a “leading global data storage brand” incorporated in Delaware and headquartered in San Jose, California. SAC ¶¶ 68, 71. It develops, manufactures, and provides data storage devices, including the “My Book Live” and “My Book Live Duo” (the “Data Storage Devices”). Id. ¶¶ 6–7. Plaintiffs are four individuals who reside in Tennessee (Mr. Riordan), Minnesota (Mr. Laurent), and California (Mr. Bobo and Mr. Sorial). Id. ¶¶ 23, 34, 47, 56. Plaintiffs all purchased and used at least one of the Data Storage Devices. Id. Plaintiffs bring this class action against Western Digital for failure to properly secure and safeguard Plaintiffs’ and proposed class members’ personal, commercial, and proprietary information (the “Stored Data”) within the Data Storage Devices. SAC ¶ 2. The Data Storage Devices were “configured to operate remotely and/or utilizing Defendant’s web portal for such purposes,” id. ¶ 6, and Plaintiffs used the web portal to access their data remotely, id. ¶ 72. Defendant marketed the web portal remote access as a key feature of the Data Storage Devices. Id. ¶¶ 11, 86. Plaintiffs allege that each Data Storage Device had at least two security flaws—the “2018 Vulnerability” and the “2021 Vulnerability”—in its software at the time of the cyber attack. Id. ¶¶ 8, 18, 92. Plaintiffs further allege that the 2018 Vulnerability was listed on the National Institute of Standards and Technology’s National Vulnerability Database on June 19, 2019, so that Defendant knew or should have known of the 2018 vulnerability by at least this date. Id. ¶ 133. Plaintiffs also allege that Defendant “created/caused the 2021 Vulnerability insofar as it was Defendant that, much earlier than 2021, disabled at least five lines of code . . . that were intended to prevent anyone lacking the [relevant] password(s) from accessing and/or performing a factory reset” of a given Data Storage Device. SAC ¶ 89. Due to the 2018 and 2021 Vulnerabilities, unauthorized persons accessed and deleted data on Data Storage Devices beginning on June 23, 2021, and each Plaintiff lost personal and business

1 The following recitation is taken in large part from the Court’s order on Defendant’s motion to dismiss Plaintiffs’ First Amended Complaint (“FAC”). See ECF No. 59. data in one or more cyber attacks. See id. ¶¶ 1, 9. The hackers performed factory resets on Plaintiffs’ Data Storage Devices—thereby wiping Plaintiffs’ Stored Data from the devices—and users were unable to log into their devices using their own credentials. SAC ¶ 95. Various Plaintiffs have consulted unsuccessfully with numerous data recovery services. See, e.g., id. ¶ 67. Defendant has offered to provide a data recovery service and device trade-in, but given the hackers’ data wipe procedure, the recovery attempt would be largely ineffectual in reversing the deletion of the Stored Data. Id. ¶¶ 102–04. Plaintiffs are unaware of whether their Stored Data was merely deleted or whether the information is also in the hands of cyber criminals. Id. ¶ 100. B. Procedural History Plaintiffs filed this lawsuit on August 6, 2021. See Compl., ECF No. 1. Defendant responded by moving to dismiss. See ECF No. 22. The Court granted the motion on the ground that Plaintiffs had failed to plead facts sufficient to establish Article III standing. See ECF No. 34. Plaintiffs then filed the First Amended Complaint (“FAC”), and the Court granted Defendant’s subsequent motion to dismiss. See Order Granting in Part & Denying in Part Deft.’s Mot. to Dismiss (“FAC Order”), ECF No. 59. Plaintiffs then filed the SAC in October 2023. See SAC. Defendant filed the pending Motion, which was fully briefed in November 2023 and set for hearing in January 2024. See Mot.; Opp’n, ECF No. 63; Reply, ECF No. 64. The Court took the Motion under submission in January 2024. See ECF No. 65. A. Subject Matter Jurisdiction Federal courts are courts of limited jurisdiction. They “have only the power that is authorized by Article III of the Constitution and the statutes enacted by Congress thereto.” Couch v. Telescope Inc., 611 F.3d 629, 632 (9th Cir. 2010) (quoting Bender v. Williamsport Area Sch. Dist., 475 U.S. 534, 541 (1986)). “Article III confines the federal judicial power to the resolution of ‘Cases’ and ‘Controversies,’” meaning that the plaintiff must have “a ‘personal stake’ in the case—in other words, standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (citation omitted). To establish Article III standing, a plaintiff must show “(i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). “[A] plaintiff must demonstrate standing separately for each form of relief sought.” Friends of the Earth, Inc. v. Ladlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185 (2000) (citations omitted). A party may assert a defense of lack of subject matter jurisdiction, including for Plaintiffs’ lack of Article III standing, under Federal Rule of Civil Procedure 12(b)(1). A jurisdictional attack may be “facial,” such that the defendant “asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). “The district court resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court’s jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). B. Rule 12(b)(6) Rule 8(a)(2) of the Federal Rules of Civil Procedure requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” A complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). Rule 8(a) requires a plaintiff to plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). While plaintiffs must allege “more than a sheer possibility that a defendant has acted unlawfully,” the plausibility standard “is not akin to a probability requirement.” Id. For purposes of ruling on a Rule 12(b)(6) motion, the Court generally “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). The Court need not, however, “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam). Mere “conclusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004). The Court may also “look beyond the plaintiff’s complaint to matters of public record” without converting the Rule 12(b)(6) motion into a motion for summary judgment. Shaw v. Hahn, 56 F.3d 1128, 1129 (9th Cir. 1995). Plaintiffs assert four claims, namely, violation of the Song-Beverly Act; negligence / failure to warn; violation of the UCL; and unjust enrichment. See SAC ¶¶ 127–70. Defendant argues that the Court should (1) dismiss any claims for injunctive relief under Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction due to Plaintiffs’ failure to establish Article III standing, and (2) dismiss Plaintiffs’ Song-Beverly Act, UCL, and unjust enrichment claims under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. See Mot. 6–7. The Court first turns to the issue of subject matter jurisdiction over Plaintiffs’ claims for injunctive relief before addressing the parties’ Rule 12(b)(6) arguments. A. Article III Standing / Subject Matter Jurisdiction (Fed. R. Civ. P. 12(b)(1)) Defendant argues that Plaintiffs fail to allege facts about Defendant’s future misuse of data sufficient for the injury-in-fact element of Article III standing, so that the Court does not have subject matter jurisdiction over Plaintiffs’ requests for injunctive relief and should accordingly dismiss those claims under Federal Rule of Civil Procedure 12(b)(1). See Mot. 7–9. Plaintiffs respond that they submit to the Court’s prior finding that Plaintiffs “did not establish a sufficient risk of future injury for Article III standing purposes,” and thus “agree any remaining vestige of injunctive relief” can be struck. Opp’n 4. The Court determined in the FAC Order that Plaintiffs’ alleged injury-in-fact “rel[ied] on mere speculation and conjecture that their data may have been stolen,” and held that Plaintiffs lacked standing to pursue claims for injunctive relief. FAC Order 8; see generally id. at 6–9. The SAC does not contain any more concrete allegations related to future data misuse. See generally SAC. Given Plaintiffs’ express agreement that they do not have standing to request injunctive relief, and the lack of relevant new allegations in the SAC, the Court reiterates its prior finding that Plaintiffs have not established Article III standing to request injunctive relief. Accordingly, the Court will grant Defendant’s motion to dismiss Plaintiffs’ requests for injunctive relief for lack of subject matter jurisdiction, including but not limited to Plaintiffs’ requests for a class-wide injunction and an injunction under the UCL. See SAC ¶¶ 82, 162; id. at Prayer for Relief, nos. 3–5. As Plaintiffs have agreed that “any remaining vestige” of injunctive relief may be stricken from the SAC, the dismissal will be without leave to amend. B. Failure to State a Claim (Fed. R. Civ. P. 12(b)(6)) Defendant next argues that Plaintiffs fail to state a claim for violation of the Song-Beverly Act, violation of the UCL, and unjust enrichment. See Mot. 9–21. The Court turns to each challenged claim in turn. 1. Song-Beverly Act Plaintiffs’ first claim asserts that Defendant violated the Song-Beverly Act’s implied warranty of merchantability and fitness “on the basis of [Defendant’s] defective products themselves but also due to Defendant’s maintenance of faulty web portals.” See SAC ¶¶ 127–39. “Under the Song-Beverly Act, every retail sale of ‘consumer goods’ in California includes an implied warranty by the manufacturer and the retail seller that the goods are ‘merchantable’ unless the goods are expressly sold ‘as is’ or ‘with all faults.’” Mexia v. Rinker Boat Co., Inc., 174 Cal. App. 4th 1297, 1303 (2009) (citing Cal. Civ. Code §§ 1791.3, 1792); see also Daniel v. Ford Motor Co., 806 F.3d 1217, 1223 (9th Cir. 2015) (“While California federal district courts have given Mexia mixed treatment . . . we must adhere to state court decisions—not federal court decisions—as the authoritative interpretation of state law.”) (citations omitted). The Act includes a duration provision stating that “the implied warranty of merchantability and where present the implied warranty of fitness . . . in no event shall . . . have a duration of less than 60 days nor more than one year following the sale of new consumer goods to a retail buyer.” Cal. Civ. Code § 1791.1(c). “Where no duration for an express warranty is stated . . . the duration of the implied warranty period shall be the maximum period [of one year] prescribed above.” Id. Thus, “[a]ccording to [the Act’s] plain language, the implied warranty exists for . . . at most one year after delivery of the product; after that time, the warranty ceases to exist.” Mexia, 174 Cal. App. 4th at 1309. “To say that a warranty exists is to say that a cause of action can arise for its breach,” so that the duration provision “defines the time period during which the warranty can be breached.” Id. A claim for breach of implied warranty may therefore arise for up to one year following the date of sale. Id. (noting the “change from the Uniform Commercial Code, under which the implied warranty could be breached only at the time of delivery”). The Act’s implied warranty may be breached at the time of sale or during the warranty period even if the defect causing the breach is latent and not discovered for months or years after a sale. Id. at 1305; see also Flat v. Ford Motor Co., 678 F. Supp. 3d 1138, 1141 (N.D. Cal. 2023) (“Mexia concluded that the implied warranty of merchantability may be breached by a latent defect undiscoverable at the time of sale but must occur no later than the durational limit set forth in Section 1791.1(c).”) (citation omitted). A four-year statute of limitations applies to claims brought under the Song- Beverly Act. Mexia, 174 Cal. App. 4th at 1306 (citing Cal. Com. Code § 2725(1)).2 Defendant argues that Plaintiffs have failed to allege when they purchased the Data Storage Devices, and thus can neither satisfy the four-year statute of limitations nor plead a related element of the breach claim, i.e., that any security vulnerability existed within the warranty period. See Mot. 9–12. Plaintiffs counter that the date of purchase is irrelevant to this action because “[n]o harm befell Plaintiffs then.” Opp’n 7. Plaintiffs argue that Defendant knowingly put forth (and heavily marketed) a defective web portal that was required for the remote operation of the Data Storage Devices, so that Defendant remained necessary for Plaintiffs’ use of the Data Storage

2 The Court applies California’s statute of limitations because it has diversity jurisdiction over this action. See SAC ¶ 19 (alleging class action diversity jurisdiction under 28 U.S.C. § 1332(d)); G & G Prods. LLC v. Rusic, 902 F.3d 940, 946 (9th Cir. 2018) (“Because our jurisdiction rests on the parties’ diversity of citizenship, we apply substantive state law, including state law regarding statutes of limitations and tolling.”) (citations omitted). Devices and was accordingly capable of a warranty breach “well into any recognizable applicable limitations period.” Id. at 6–7. Plaintiffs concede that a claim generally accrues at the time of breach, but argue that their claim did not accrue until the hackers deleted their Stored Data on June 23, 2021. Id. at 6–8. Plaintiffs argue that their initiation of this lawsuit in August 2021 was within the four-year statute of limitations applicable to a June 2021 breach, or even the discovery of the 2018 Vulnerability, and that the SAC sufficiently alleges the facts of the breach of the implied warranty. Id. at 7–8 & n.1. Mexia unambiguously instructs that the Song-Beverly Act’s duration provision “defines the time period during which the [implied] warranty can be breached” as running from the time of delivery to a maximum of one year after delivery. Mexia, 174 Cal. App. 4th at 1309. The Court therefore rejects Plaintiffs’ argument—for which Plaintiffs offer no legal support—that Defendant’s ongoing maintenance of the allegedly defective web portal continuously extended the warranty period. See Opp’n 6–8. Because Plaintiffs filed this action on August 6, 2021, the four- year statute of limitations requires that the breach of the implied warranty have occurred no earlier than August 6, 2017, and thus Plaintiffs must have purchased the Data Storage Devices no earlier than August 6, 2016. The SAC contains no allegations establishing the date of purchase of any Plaintiff’s Data Storage Device. See generally SAC. Plaintiffs argue that the breach occurred during June 2021 cyber attack or when the 2018 Vulnerability was first identified, see Opp’n 7–8 & n.1, but do not allege facts sufficient to show that either date is within the one-year warranty period during which a claim can arise. The Court therefore finds that Plaintiffs’ Song-Beverly Act claim is both time-barred and insufficiently pled. The Court made the same finding in the FAC Order, dismissing the claim “with leave to amend to assert . . . when the devices were purchased.” FAC Order 11. Given that Plaintiffs filed the SAC with no such allegations, the Court finds that amendment would be futile, and will dismiss the claim without leave to amend. The Court therefore does not and need not address the parties’ arguments regarding the sufficiency of the allegations regarding the location of Mr. Sorial’s purchase of his Data Storage Device. See Mot. 12; Opp’n 8. 2. UCL Plaintiffs assert a claim for violation of each of the unfair, unlawful, and fraudulent prongs of the UCL, and seek equitable relief including “restitution[,] . . . disgorgement o[f] ill-gotten gains, refunds of moneys, interest, reasonable attorneys’ fees, filing fees, and . . . costs.” SAC ¶ 162. See SAC ¶ 162; see id. ¶¶ 150–62.3 A plaintiff seeking equitable relief under the UCL must first establish that she lacks an adequate remedy at law. Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020) (citations omitted). Defendant argues that Plaintiffs’ UCL claim must be dismissed because Plaintiffs fail to show they lack an adequate alternative remedy at law. See Mot. 12–15. Plaintiffs admit that they seek damages for the same conduct underlying their UCL claim, but argue that the Court has equitable jurisdiction over the UCL claim because they also seek remedies without an alternative at law. See Opp’n 9. However, the identified remedy is an order requiring Defendant to implement or maintain security solutions addressing the vulnerabilities in the web portal, see id., which would constitute injunctive relief for which Plaintiffs have not established Article III standing, see supra, at Part III(A). The sole allegation to which Plaintiffs point requests the same injunctive relief. See SAC ¶ 161; Opp’n 9. The Court finds that Plaintiffs once again fail to allege that they lack an adequate remedy at law, so that the UCL claim must be dismissed. See, e.g., In re Cal. Gasoline Spot Mkt. Antitrust Litig., No. 20-cv- 03131, 2021 WL 1176645, at *8 (N.D. Cal. Mar. 29, 2021) (collecting cases dismissing UCL claims at pleading stage for failure to allege lack of adequate remedy at law). Defendant’s remaining arguments in support of dismissing the UCL claim, see Mot. 15–20, are moot. The Court granted Defendant’s motion to dismiss the FAC’s UCL claim on the same ground. See FAC Order 15. It therefore finds that granting further leave to amend would be futile. 3. Unjust Enrichment Plaintiffs assert a claim for unjust enrichment on the basis that they did not receive the

3 The SAC also alleges a request for injunctive relief, which is unavailable due to the Court’s finding that Plaintiffs lack the requisite Article III standing. See supra, at Part III(A). benefit of their bargain when purchasing Defendant’s Data Storage Devices, and seek restitution and disgorgement. See SAC ¶¶ 163–70. Defendant argues that the unjust enrichment claim, like the UCL claim, is a request for equitable relief that is barred under Sonner because Plaintiffs have an adequate remedy at law, i.e., damages. See Mot. 20–21. Defendant additionally states that it previously moved to dismiss the claim on the ground that unjust enrichment is not a standalone claim, and that the Court denied the motion and construed the unjust enrichment claim as a quasi- contract claim for restitution. Id. at 20 (citing FAC Order 16). Plaintiffs respond that the Court denied Defendant’s motion to dismiss the FAC’s unjust enrichment claim, so that Defendant should not be permitted another opportunity to dismiss the unchanged claim. See Opp’n 12. The Court first notes that Federal Rule of Civil Procedure 12 provides that “a party that makes a motion under this rule must not make another motion under this rule raising a defense or objection that was available to the party but omitted from its earlier motion.” Fed. R. Civ. P. 12(g)(2). Where Rule 12(b)(6) motions are concerned, “a defendant who fails to assert a failure- to-state-a-claim defense in a pre-answer Rule 12 motion” generally “cannot assert that defense in a later pre-answer motion under Rule 12(b)(6).” In re Apple iPhone Antitrust Litig., 846 F.3d 313, 318 (9th Cir. 2017); see also Fed. R. Civ. P. 12(h)(2) (providing that omitted 12(b)(6) defense may be raised in later 12(c) motion). However, the Ninth Circuit has recognized that “[d]enying late- filed Rule 12(b)(6) motions and relegating defendants to [Rule 12(c), e.g.] can produce unnecessary and costly delays,” and determined that it will “generally be forgiving of a district court’s ruling on the merits of a late-filed Rule 12(b)(6) motion.” Id. at 318–19; see also, e.g., Alaei v. Gov’t Emps. Ins. Co., No. 20-cv-00262, 2021 WL 5303268, at *4 (S.D. Cal. Nov. 15, 2021) (“A district court may exercise its discretion to adjudicate a defense or objection that would normally be foreclosed by Rule 12(g)(2) if doing so advances the efficient administration of cases.”) (citing In re Apple, 846 F.3d at 319). Given this guidance, the Court will address Defendant’s Sonner argument despite Defendant’s prior failure to raise the available argument. Although Sonner itself discussed only the requirement that a plaintiff asserting claims for equitable relief under the UCL and California’s Consumers Legal Remedies Act (“CLRA”) must 1 first establish a lack of adequate remedy at law, district courts apply the requirement to unjust 2 enrichment claims as well. See, e.g., Sharma v. Volkswagen AG, 524 F. Supp. 3d 891, 907 (N.D. 3 Cal. 2021) (“In light of the foregoing [discussion of Sonner)], [plaintiffs] ‘must establish that they 4 lack an adequate remedy at law before securing equitable restitution for past harm’ under their 5 UCL, CLRA, and unjust enrichment claims.”) (alterations omitted) (quoting Sonner, 971 F.3d at 6 844); Forrett v. Gourmet Nut, Inc., 634 F. Supp. 3d 761, 768 (N.D. Cal. 2022) (holding that 7 Sonner’s pleading requirement applies generally to claims for equitable relief, including unjust 8 enrichment). Plaintiffs’ unjust enrichment claim seeks the same equitable relief as their UCL 9 claim, and the Court dismisses the claim without leave to amend for the same reasons explained in 10 its discussion of the UCL claim. See supra, at Part III(B)(2). 11 Iv. CONCLUSION 12 For the foregoing reasons, the Court hereby ORDERS that: 13 1. Defendant’s motion to dismiss is GRANTED, such that: 14 a. Plaintiffs’ claims for violation of the Song-Beverly Act, violation of the 3 15 UCL, and unjust enrichment are DISMISSED WITHOUT LEAVE TO a 16 AMEND; and 3 17 b. Plaintiffs’ requests for injunctive relief are DISMISSED WITHOUT LEAVE TO AMEND. 19 2. Plaintiffs’ claim for negligence / failure to warn is the sole remaining claim in this 20 action. 21 3. Defendant’s answer is due within 14 days of the entry of this order. 22 24 Dated: June 5, 2024 25 26 eLOp. EDWARD J. DAVILA 27 United States District Judge 28 Case No.: 21-cv-06074-EJD ORDER GRANTING DEFT.’S MOT. TO DISMISS CLS. 1, 3, 4 OF SECOND AM. COMPL.