Thomas v. Kimpton Hotel & Restaurant Group, LLC

• Court: District Court, N.D. California
• Decided: November 1, 2019
• Docket: 3:19-cv-01860-MMC
• Status: Unknown

Opinion

1 2 3 4 IN THE UNITED STATES DISTRICT COURT 5 FOR THE NORTHERN DISTRICT OF CALIFORNIA 6 7 JAKE THOMAS, et al., Case No. 19-cv-01860-MMC

8 Plaintiffs, ORDER GRANTING DEFENDANT'S 9 v. MOTION TO DISMISS FIRST AMENDED COMPLAINT; AFFORDING 10 KIMPTON HOTEL & RESTAURANT PLAINTIFFS LEAVE TO AMEND GROUP, LLC, 11 Re: Dkt. No. 38 Defendant.

12 13 Before the Court is defendant Kimpton Hotel & Restaurant Group, LLC's 14 ("Kimpton") Motion, filed September 27, 2019, "to Dismiss Plaintiffs' First Amended 15 Complaint." Plaintiffs Jake Thomas, Salvatore Galati, and Jonathan Martin have filed 16 opposition, to which Kimpton has replied. Having read and considered the papers filed in 17 support of and in opposition to the motion, the Court deems the matter suitable for 18 decision on the parties' respective written submissions, VACATES the hearing scheduled 19 for November 8, 2019, and rules as follows. 20 In their First Amended Complaint ("FAC"), plaintiffs allege Kimpton, an entity that 21 "own[s] or manage[s]" hotels, "contracted with Sabre Corporation ('Sabre') to provide a 22 reservation service." (See FAC ¶¶ 1, 3.) Plaintiffs allege that, through Sabre, they made 23 reservations at Kimpton hotels and, in so doing, provided Sabre with "private identifiable 24 information" ("PII"), specifically, their "full name[s], credit and debit card account 25 numbers, card expiration dates, card verification codes, emails, phone numbers, [and] full 26 addresses." (See FAC ¶ 7, 8.) According to plaintiffs. their PII was "collected by an 27 unauthorized third party," i.e., a "hacker" who "obtained credentials for [Sabre] and used 1 subsequently was "misuse[d]" (see FAC ¶¶ 10, 13, 15.) Based on said allegations, 2 plaintiffs assert eight causes of action arising under the laws of various states. 3 By order filed August 8, 2019, the Court dismissed plaintiffs' claims as alleged in 4 their initial complaint. As the Court explained in said order, although plaintiffs had alleged 5 Kimpton did not "'establish and implement appropriate administrative, technical, and 6 physical safeguards to ensure the security and confidentiality of [plaintiffs'] PII'" (see 7 Order, filed August 8, 2019, at 6:13-15 (quoting Complaint)), plaintiffs did not allege any 8 facts to support that allegation or similar conclusory allegations. The Court afforded 9 plaintiffs leave to amend to add factual allegations to cure such deficiency.1 10 In their FAC, plaintiffs have added allegations generally identifying the nature of 11 the safeguards not taken. In that regard, plaintiffs now allege "Sabre enable[d] access to 12 its system with only a single username and static password, which is also known as 13 single factor authorization," instead of implementing "multi-factor authorization solutions" 14 (see FAC ¶ 3), i.e., "multiple levels of authentication" (see FAC ¶ 5);2 additionally, 15 plaintiffs allege, Sabre should have employed "a multi-layered security platform including 16 advanced behavioral analytics able to identify anomalies" such as "unusual patterns of 17 file access, network traffic or user behavior" (see FAC ¶ 6). 18 Kimpton argues that the claims as presently alleged remain subject to dismissal, 19 for the reason that the FAC includes no facts to show Kimpton can be held responsible 20 for Sabre's alleged acts or omissions. As set forth below, the Court agrees. 21 In responding to Kimpton's argument, plaintiffs assert that Sabre was acting as 22 Kimpton's agent. The Court acknowledges that a "principal who personally engages in 23 1In the same order, the Court also dismissed various claims on additional grounds. 24 Specifically, a claim under an Arizona statute was dismissed as time-barred, a claim under a California statute was dismissed to the extent brought on behalf of a plaintiff who 25 did not reside in California, and claims based on fraud were dismissed for failure to plead fraud with specificity. 26 2Although not alleged in the FAC, plaintiffs, in their opposition, explain that "[m]ulti- 27 factor authentication requires at least one extra step, such as entering a code texted to a 1 no misconduct may be vicariously liable for [a] tortious act committed by an agent within 2 the course and scope of the agency." See Peredia v. HR Mobile Services, Inc., 25 Cal. 3 App. 5th 680, 691 (2018). For an "agency relationship to exist," however, "the person 4 represented must have a right to control the actions of the agent." See Mavrix 5 Photographs, LLC v. Livejournal, Inc., 873 F.3d 1045, 1054 (9th Cir. 2017) (internal 6 quotation, alteration, and citation omitted). Here, the FAC includes no facts to support a 7 finding that Kimpton had "a right to control the actions" of Sabre, see id., let alone that 8 Sabre's selection or non-selection of safeguards to protect PII was an act committed 9 within the course and scope of any such agency, see Peredia, 25 Cal. App. 5th at 691.3 10 Given the above-described omission, the FAC is subject to dismissal in its entirety. 11 The Court will, however, afford plaintiffs leave to amend to add factual allegations 12 sufficient to support a finding that Sabre was acting as Kimpton's agent at the relevant 13 time(s) and that Sabre, in engaging in the acts on which plaintiffs base their claims, was 14 acting in the course and scope of any such agency. 15 Plaintiffs are also afforded leave to cure two other deficiencies that Kimpton has 16 pointed out. Specifically, to the extent the FAC includes claims based on Kimpton's 17 having allegedly made fraudulent statements (see FAC ¶¶ 26, 28, 31, 33, 96, 97.vi-ix, 99, 18 108.vi-ix, 110, 116.vi-viii, 128.vi-ix, 129, 142.iv, 143iv-vii, 145), the claims are subject to 19 dismissal, as the FAC fails to include "evidentiary facts" to support a finding that Kimpton 20 knew the statements challenged by plaintiffs were "false when made," see Fecht v. Price 21 Co., 70 F.3d 1078, 1083 (9th Cir. 1995) (setting forth requirements to plead fraud claim). 22 Further, to the extent such claims are based on the statement identified in paragraph 26 23

24 3Plaintiffs argue there exists "some dispute" as to whether they are required to plead facts to support a finding that an agency relationship exists. (See Pls.' Opp. at 25 9:16-18.) In support thereof, plaintiffs rely on Greenberg v. Sala, 822 F.2d 882 (9th Cir. 886), which held "allegations of agency, vicarious liability, and/or respondeat superior are 26 not required." See id. at 886. The ruling in Greenberg, however, predates the pleading standard set forth in Ashcroft v. Iqbal, 556 U.S. 662 (2009), which requires a plaintiff to 27 plead "factual content that allows the court to draw the reasonable inference that the 1 of the FAC, the claims are subject to dismissal for the additional reason that plaintiffs 2 || have failed to allege facts showing any plaintiff was aware of such statement at the time 3 || he made hotel reservations and relied to his detriment thereon. 4 Accordingly, the motion to dismiss is hereby GRANTED, and the First Amended 5 || Complaint is hereby DISMISSED with leave to amend to cure the deficiencies identified 6 || above. If plaintiffs wish to file a Second Amended Complaint for the purpose of curing 7 || the above-referenced deficiencies, plaintiff shall file such amended pleading no later than 8 || forty-five days after the date of this order. Kimpton shall file its response to any such 9 || pleading no later than thirty days after it is filed. 10 IT IS SO ORDERED. 11 12 || Dated: November 1, 2019 5 INE M. CHESNEY 13 United States District Judge

17 18 19 20 21 22 23 24 25 26 27 28