Thomas v. Kimpton Hotel & Restaurant Group, LLC

Opinion

JAKE THOMAS, et al., Case No. 19-cv-01860-MMC

Plaintiffs, ORDER GRANTING DEFENDANT'S v. MOTION TO DISMISS FIRST AMENDED COMPLAINT; AFFORDING KIMPTON HOTEL & RESTAURANT PLAINTIFFS LEAVE TO AMEND GROUP, LLC, Re: Dkt. No. 38 Defendant.

Before the Court is defendant Kimpton Hotel & Restaurant Group, LLC's ("Kimpton") Motion, filed September 27, 2019, "to Dismiss Plaintiffs' First Amended Complaint." Plaintiffs Jake Thomas, Salvatore Galati, and Jonathan Martin have filed opposition, to which Kimpton has replied. Having read and considered the papers filed in support of and in opposition to the motion, the Court deems the matter suitable for decision on the parties' respective written submissions, VACATES the hearing scheduled for November 8, 2019, and rules as follows. In their First Amended Complaint ("FAC"), plaintiffs allege Kimpton, an entity that "own[s] or manage[s]" hotels, "contracted with Sabre Corporation ('Sabre') to provide a reservation service." (See FAC ¶¶ 1, 3.) Plaintiffs allege that, through Sabre, they made reservations at Kimpton hotels and, in so doing, provided Sabre with "private identifiable information" ("PII"), specifically, their "full name[s], credit and debit card account numbers, card expiration dates, card verification codes, emails, phone numbers, [and] full addresses." (See FAC ¶ 7, 8.) According to plaintiffs. their PII was "collected by an unauthorized third party," i.e., a "hacker" who "obtained credentials for [Sabre] and used subsequently was "misuse[d]" (see FAC ¶¶ 10, 13, 15.) Based on said allegations, plaintiffs assert eight causes of action arising under the laws of various states. By order filed August 8, 2019, the Court dismissed plaintiffs' claims as alleged in their initial complaint. As the Court explained in said order, although plaintiffs had alleged Kimpton did not "'establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of [plaintiffs'] PII'" (see Order, filed August 8, 2019, at 6:13-15 (quoting Complaint)), plaintiffs did not allege any facts to support that allegation or similar conclusory allegations. The Court afforded plaintiffs leave to amend to add factual allegations to cure such deficiency.1 In their FAC, plaintiffs have added allegations generally identifying the nature of the safeguards not taken. In that regard, plaintiffs now allege "Sabre enable[d] access to its system with only a single username and static password, which is also known as single factor authorization," instead of implementing "multi-factor authorization solutions" (see FAC ¶ 3), i.e., "multiple levels of authentication" (see FAC ¶ 5);2 additionally, plaintiffs allege, Sabre should have employed "a multi-layered security platform including advanced behavioral analytics able to identify anomalies" such as "unusual patterns of file access, network traffic or user behavior" (see FAC ¶ 6). Kimpton argues that the claims as presently alleged remain subject to dismissal, for the reason that the FAC includes no facts to show Kimpton can be held responsible for Sabre's alleged acts or omissions. As set forth below, the Court agrees. In responding to Kimpton's argument, plaintiffs assert that Sabre was acting as Kimpton's agent. The Court acknowledges that a "principal who personally engages in 1In the same order, the Court also dismissed various claims on additional grounds. Specifically, a claim under an Arizona statute was dismissed as time-barred, a claim under a California statute was dismissed to the extent brought on behalf of a plaintiff who did not reside in California, and claims based on fraud were dismissed for failure to plead fraud with specificity. 2Although not alleged in the FAC, plaintiffs, in their opposition, explain that "[m]ulti- factor authentication requires at least one extra step, such as entering a code texted to a no misconduct may be vicariously liable for [a] tortious act committed by an agent within the course and scope of the agency." See Peredia v. HR Mobile Services, Inc., 25 Cal. App. 5th 680, 691 (2018). For an "agency relationship to exist," however, "the person represented must have a right to control the actions of the agent." See Mavrix Photographs, LLC v. Livejournal, Inc., 873 F.3d 1045, 1054 (9th Cir. 2017) (internal quotation, alteration, and citation omitted). Here, the FAC includes no facts to support a finding that Kimpton had "a right to control the actions" of Sabre, see id., let alone that Sabre's selection or non-selection of safeguards to protect PII was an act committed within the course and scope of any such agency, see Peredia, 25 Cal. App. 5th at 691.3 Given the above-described omission, the FAC is subject to dismissal in its entirety. The Court will, however, afford plaintiffs leave to amend to add factual allegations sufficient to support a finding that Sabre was acting as Kimpton's agent at the relevant time(s) and that Sabre, in engaging in the acts on which plaintiffs base their claims, was acting in the course and scope of any such agency. Plaintiffs are also afforded leave to cure two other deficiencies that Kimpton has pointed out. Specifically, to the extent the FAC includes claims based on Kimpton's having allegedly made fraudulent statements (see FAC ¶¶ 26, 28, 31, 33, 96, 97.vi-ix, 99, 108.vi-ix, 110, 116.vi-viii, 128.vi-ix, 129, 142.iv, 143iv-vii, 145), the claims are subject to dismissal, as the FAC fails to include "evidentiary facts" to support a finding that Kimpton knew the statements challenged by plaintiffs were "false when made," see Fecht v. Price Co., 70 F.3d 1078, 1083 (9th Cir. 1995) (setting forth requirements to plead fraud claim). Further, to the extent such claims are based on the statement identified in paragraph 26

3Plaintiffs argue there exists "some dispute" as to whether they are required to plead facts to support a finding that an agency relationship exists. (See Pls.' Opp. at 9:16-18.) In support thereof, plaintiffs rely on Greenberg v. Sala, 822 F.2d 882 (9th Cir. 886), which held "allegations of agency, vicarious liability, and/or respondeat superior are not required." See id. at 886. The ruling in Greenberg, however, predates the pleading standard set forth in Ashcroft v. Iqbal, 556 U.S. 662 (2009), which requires a plaintiff to plead "factual content that allows the court to draw the reasonable inference that the 1 of the FAC, the claims are subject to dismissal for the additional reason that plaintiffs 2 have failed to allege facts showing any plaintiff was aware of such statement at the time 3 he made hotel reservations and relied to his detriment thereon. 4 Accordingly, the motion to dismiss is hereby GRANTED, and the First Amended 5 Complaint is hereby DISMISSED with leave to amend to cure the deficiencies identified 6 above. If plaintiffs wish to file a Second Amended Complaint for the purpose of curing 7 the above-referenced deficiencies, plaintiff shall file such amended pleading no later than 8 forty-five days after the date of this order. Kimpton shall file its response to any such 9 pleading no later than thirty days after it is filed. 11 12 Dated: November 1, 2019 INE M. CHESNEY 13 United States District Judge

17 18 19 20 21 22 23 24 25 26 27 28