Thomas v. Kimpton Hotel & Restaurant Group, LLC

• Court: District Court, N.D. California
• Decided: June 30, 2020
• Docket: 3:19-cv-01860-MMC
• Status: Unknown

Opinion

1 2 3 4 IN THE UNITED STATES DISTRICT COURT 5 FOR THE NORTHERN DISTRICT OF CALIFORNIA 6 7 JAKE THOMAS, et al., Case No. 19-cv-01860-MMC

8 Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT'S 9 v. MOTION TO DISMISS; AFFORDING PLAINTIFFS LEAVE TO AMEND; 10 KIMPTON HOTEL & RESTAURANT CONTINUING CASE MANAGEMENT GROUP, LLC, CONFERENCE 11 Defendant.

12 13 Before the Court is defendant Kimpton Hotel & Restaurant Group, LLC's 14 ("Kimpton") Motion, filed February 25, 2020, "to Dismiss Plaintiff's Third Amended 15 Complaint." Plaintiffs Jake Thomas ("Thomas"), Salvatore Galati ("Galati"), and Jonathan 16 Martin ("Martin") have filed opposition, to which Kimpton has replied. Having read and 17 considered the papers filed in support of and in opposition to the motion, the Court rules 18 as follows.1 19 BACKGROUND 20 In the operative complaint, the Third Amended Complaint ("TAC"), plaintiffs allege 21 Kimpton, an entity that "own[s] or manage[s]" a number of hotels (see TAC ¶ 1), 22 contracted with Sabre Corporation ("Sabre") "to provide a reservation system" (see TAC 23 ¶ 3).2 Plaintiffs further allege they booked hotel reservations at Kimpton hotels (see TAC 24 ¶ 2), and, in so doing, provided Sabre with their "private identifiable information" ("PII") 25 (see TAC ¶¶ 11, 13, 15), including "full name, credit and debit card account numbers, 26 1By Clerk's notice filed March 18, 2020, the matter was taken under submission. 27 1 card expiration dates, card verification codes, emails, phone numbers, full addresses and 2 other . . . information" (see TAC ¶ 8), which PII was subsequently "accessed by hackers" 3 who "obtained credentials" for Sabre's "Central Reservations system" and "used those 4 credentials to access customer data" (see TAC ¶¶ 6, 12, 14, 16). According to plaintiffs, 5 if Sabre had "employed multiple levels of authentication," rather than "single factor 6 authorization," the "breach" would not have occurred. (See FAC ¶ 6.) 7 Based on the above allegations, plaintiffs assert nine Claims for Relief arising 8 under the laws of various states. 9 LEGAL STANDARD 10 Dismissal under Rule 12(b)(6) of the Federal Rules of Civil Procedure "can be 11 based on the lack of a cognizable legal theory or the absence of sufficient facts alleged 12 under a cognizable legal theory." See Balistreri v. Pacifica Police Dep't, 901 F.2d 696, 13 699 (9th Cir. 1990). Rule 8(a)(2), however, "requires only 'a short and plain statement of 14 the claim showing that the pleader is entitled to relief.'" See Bell Atlantic Corp. v. 15 Twombly, 550 U.S. 544, 555 (2007) (quoting Fed. R. Civ. P. 8(a)(2)). Consequently, "a 16 complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual 17 allegations." See id. Nonetheless, "a plaintiff's obligation to provide the grounds of his 18 entitlement to relief requires more than labels and conclusions, and a formulaic recitation 19 of the elements of a cause of action will not do." See id. (internal quotation, citation, and 20 alteration omitted). 21 In analyzing a motion to dismiss, a district court must accept as true all material 22 allegations in the complaint and construe them in the light most favorable to the 23 nonmoving party. See NL Indus., Inc. v. Kaplan, 792 F.2d 896, 898 (9th Cir. 1986). "To 24 survive a motion to dismiss, a complaint must contain sufficient factual material, accepted 25 as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 26 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). "Factual allegations must be 27 enough to raise a right to relief above the speculative level[.]" Twombly, 550 U.S. at 555. 1 allegation." See Iqbal, 556 U.S. at 678 (internal quotation and citation omitted). 2 DISCUSSION 3 By order filed November 1, 2019 ("November 1 Order"), the Court dismissed with 4 leave to amend each of the claims asserted in plaintiffs' First Amended Complaint 5 ("FAC"), after which ruling plaintiffs filed a Second Amended Complaint ("SAC"). 6 Thereafter, the Court approved the parties' stipulation to allow plaintiffs to file the TAC. 7 By the instant motion, Kimpton argues that the TAC does not cure the deficiencies 8 identified in the Court's November 1 Order, and, in addition, that seven of the claims 9 asserted in the TAC are subject to dismissal for other reasons. 10 At the outset, the Court addresses whether, as Kimpton argues, the TAC includes 11 insufficient facts to support a finding that Kimpton can be held liable for the acts and 12 omissions of Sabre, which argument applies to each of the claims asserted in the TAC. 13 In the November 1 Order, the Court found the FAC lacked any factual allegations 14 to support such a finding. In the TAC, plaintiffs now allege that Sabre, in operating 15 Kimpton's reservations services, acted as an agent for Kimpton. Kimpton contends the 16 TAC does not include factual allegations sufficient to show an agency relationship 17 existed. As set forth below, the Court disagrees. 18 A "principal who personally engages in no misconduct may be vicariously liable for 19 [a] tortious act committed by an agent within the course and scope of the agency." See 20 Peredia v. HR Mobile Services, Inc., 25 Cal. App. 5th 680, 691 (2018). "For an agency 21 relationship to exist, an agent must have authority to act on behalf of the principal and the 22 person represented must have a right to control the actions of the agent." See Mavrix 23 Photographs, LLC v. Livejournal, Inc., 873 F.3d 1045, 1054 (9th Cir. 2017) (internal 24 quotation, alteration, and citation omitted). 25 Here, plaintiffs allege facts sufficient to show Sabre had the authority to act on 26 behalf of Kimpton. In particular, plaintiffs allege Kimpton's "online reservation system is 27 operated by . . . Sabre" (see TAC ¶ 23) pursuant to an agreement between Kimpton and 1 reservations from customers on behalf of Kimpton (see TAC ¶ 23). Additionally, plaintiffs 2 allege sufficient facts to show Kimpton had the right to control Sabre's actions, 3 specifically, that Kimpton set the prices Sabre charged for rooms, selected the rooms 4 Sabre could show as available to customers, decided how Sabre "would be portrayed on 5 [Kimpton's] website," e.g., that Sabre would be "completely in the background," and, 6 perhaps most importantly here, decided "how Sabre would safeguard customer 7 information." (See id.) 8 Accordingly, as plaintiffs have sufficiently alleged the existence of an agency 9 relationship between Kimpton and Sabre, the Court next considers, in turn, Kimpton's 10 arguments that seven of the nine Claims for Relief are subject to dismissal for additional 11 reasons.3 12 A. Second Claim for Relief: Breach of Contract 13 In the Second Claim for Relief, plaintiffs allege Kimpton breached the "agreement 14 between Sabre and Kimpton," which agreement was "for the express intended benefit of 15 Kimpton's customers." (See TAC ¶¶ 79, 81, 83.) Kimpton argues said claim is 16 procedurally improper and substantively deficient. 17 As Kimpton observes, the November 1 Order, in dismissing the claims in the FAC, 18 afforded plaintiffs leave to amend to cure the deficiencies the Court had identified. As the 19 FAC did not include a claim that Kimpton had breached its contract with Sabre, plaintiffs' 20 inclusion in the TAC of such claim is procedurally improper.4 In their opposition, plaintiffs 21 do not argue their assertion of this new claim was procedurally proper; rather, plaintiffs, in 22 essence, request they be afforded leave to amend to include such claim in the TAC. 23 Under Rule 15(a) of the Federal Rules of Civil Procedure, a "court should freely 24 3Kimpton raises no additional arguments as to the First and Third Claims for 25 Relief. 26 4Although the claim was included in the SAC, the TAC, as noted, was filed pursuant to stipulation. In the stipulation, Kimpton reserved the right to "contest whether 27 [p]laintiffs improperly added the new second cause of action alleging third party breach of 1 give leave [to amend] when justice so requires." See Fed. R. Civ. P. 15(a)(2). Leave to 2 amend, however, "need not be granted where the amendment of the complaint would 3 cause the opposing party undue prejudice, is sought in bad faith, constitutes an exercise 4 in futility, or creates undue delay." See Ascon Properties, Inc. v. Mobil Oil Co., 866 F.2d 5 1149, 1160 (9th Cir. 1989). 6 Here, the Second Claim for Relief, as pleaded, is futile, as it is subject to dismissal 7 for failure to state a claim. At the outset, the Court notes the TAC fails to include any 8 facts to support a finding that customers of Kimpton hotels, such as plaintiffs, were 9 intended third-party beneficiaries of the contract by which Sabre agreed to operate a 10 reservation system for Kimpton. See Balsam v Tucows Inc., 627 F.3d 1158, 1161 (9th 11 Cir. 2010) (holding, under California law, "third party qualifies as a beneficiary under a 12 contract if the parties intended to benefit the third party and the terms of the contract 13 make that intent evident"; affirming dismissal, where nothing in contract indicated parties 14 to agreement "intended to benefit, or confer any rights upon, [plaintiff]"). Moreover, the 15 TAC lacks factual allegations to support plaintiffs' conclusory assertion that Kimpton 16 "breached" its contract with Sabre by "failing to comply with the PCI DSS [Payment Card 17 Industry Data Security Standards]." (See TAC ¶¶ 81-83.) Although it would appear 18 plaintiffs are basing the claim on Sabre's alleged use of "single factor" as opposed to 19 "multi-factor" authorization (see TAC ¶ 3), the TAC includes no facts to support a finding 20 that Kimpton was contractually obligated to require Sabre to do so. See Frances T. v. 21 Village Green Owners Ass'n, 42 Cal. 3d 490, 512-13 (1986) (holding "rights and 22 responsibilities of contracting parties are determined by the terms of their contract"; 23 affirming dismissal of breach of contract claim, based on defendant's failure to "install 24 additional lighting," where plaintiff failed to allege contract included provision requiring 25 defendant to so act). 26 Accordingly, the Second Claim for Relief is subject to dismissal. 27 // 1 B. Fourth Claim for Relief: Violation of California's Unfair Competition Law 2 In the Fourth Claim for Relief, plaintiffs allege Kimpton violated § 17200 of the 3 California Business & Professions Code, which prohibits, inter alia, "unlawful" business 4 practices. See Cal. Bus. & Prof. Code § 17200. Plaintiffs base their claim on Kimpton's 5 alleged violations of two statutes: (1) California Civil Code § 1798.81.5 (see TAC ¶ 97), 6 which statute requires a "business that owns, licenses, or maintains personal information 7 about a California resident" to "implement and maintain reasonable security procedures 8 and practices" to "protect the personal information from unauthorized access," see Cal. 9 Civ. Code. § 1798.81.5(b); and (2) 15 U.S.C. § 45 (see TAC ¶¶ 98-101), which statute 10 prohibits "[u]nfair methods of competition in or affecting commerce" and "unfair or 11 deceptive acts or practices in or affecting commerce," see 15 U.S.C. § 45(a)(1). 12 The remedies available to a plaintiff under § 17200 are "limited"; specifically, a 13 plaintiff may only seek injunctive relief and/or restitution. See Korea Supply Co. v. 14 Lockheed Martin Corp., 29 Cal. 4th 1134, 1152 (2003). Kimpton argues plaintiffs have 15 failed to allege any facts to support either a claim for injunctive relief or a claim for 16 restitution. As set forth below, the Court agrees. 17 As Kimpton notes, the TAC does not make clear the nature of the injunctive relief 18 sought. In their opposition, plaintiffs describe their need for injunctive relief as follows: 19 "[T]here exists a hazard – [Kimpton's] data security measures – which, if not ameliorated, 20 will likely result in additional damages to [p]laintiffs . . . [;] there is a real risk that 21 [Kimpton] will move forward with its plainly inadequate security features{;] [and] [Kimpton] 22 has not represented that it has instituted multi-factor authentication, and its single-factor 23 system poses a significant risk of continuing harm." (See Pls.' Opp. at 18:2-7.) As the 24 TAC does not allege Kimpton itself has inadequate data security measures, but, rather, 25 that Sabre's measures were inadequate, the Court understands plaintiffs to be asserting 26 they intend to seek an injunction requiring Kimpton to cause Sabre to institute multi-factor 27 authentication. To have standing to seek injunctive relief, however, the plaintiff must 1 see City of Los Angeles v. Lyons, 461 U.S. 95, 111 (1983), and, here, plaintiffs do not 2 allege facts from which the Court can infer they face, by reason of Sabre's alleged 3 inadequate data security system, a real or immediate threat of another breach.5 4 Consequently, plaintiffs have not shown they are entitled to injunctive relief. 5 As to restitution, plaintiffs, in their opposition, clarify that they're seeking to recover 6 the price they paid for Kimpton hotel rooms. Plaintiffs appear to base their claim to 7 restitution on their allegation that they would not have stayed at a Kimpton hotel had they 8 known of "the improper security" (see TAC ¶¶ 11, 13, 15), i.e., that Sabre employed 9 inadequate data security measures in connection with on-line bookings. A claim for 10 restitution is dependent, however, on a plaintiff's showing his entitlement to "the return of 11 the excess of what the plaintiff gave the defendant over the value of what the plaintiff 12 received." See Cortez v. Purolator Air Filtration Products Co., 23 Cal. 4th 163, 174 13 (2000). Here, plaintiffs do not allege facts to support a finding that the hotel rooms for 14 which they paid were in any manner inadequate, that some portion of the room charges 15 were attributable to data security, or that some other basis exists upon which to support a 16 finding that they did not receive the value paid for the hotel rooms. Consequently, 17 plaintiffs have not shown they are entitled to restitution. 18 Accordingly, the Fourth Claim for Relief is subject to dismissal in its entirety. 19 C. Fifth Claim for Relief: Violation of Colorado Consumer Protection Act 20 In the Fifth Claim for Relief, brought on behalf of Thomas only, plaintiffs allege 21 Kimpton violated the Colorado Consumer Protection Act ("CCPA"), which Act prohibits 22 "deceptive trade practice[s]." See Colo. Rev. Stat. § 6-1-105(1). Plaintiffs allege Kimpton 23 engaged in the following nine deceptive trade practices: (1) "[r]epresenting to its 24 customers it would employ reasonable security and privacy measures," while "permitting 25 to be employed single factor authorization on its reservation system," (2) "[r]epresenting 26

27 5Plaintiffs do not allege, for example, that Sabre still possesses plaintiffs' PII, let 1 to its customers that it would employ reasonable security and privacy measures and yet 2 failing to implement a multi-layered security platform"; (3) "[f]ailing to implement and 3 maintain reasonable security and privacy measures to protect . . . PII"; (4) "[f]ailing to 4 identify foreseeable security and privacy risks, remediate identified security and privacy 5 risks, and adequately improve security and privacy measures"; (5) "[f]ailing to comply 6 with common law and statutory duties pertaining to the security and privacy"; 7 (6) "[m]isrepresenting that it would protect the privacy and confidentiality of . . . PII, 8 including by implementing and maintaining reasonable security measures"; 9 (7) "[m]ispresenting that it would comply with common law and statutory duties pertaining 10 to the security and privacy"; (8) "[o]mitting, suppressing, and concealing the material fact 11 that it did not reasonably or adequately secure . . . PII"; and (9) "[o]mitting, suppressing, 12 and concealing the material fact it did not comply with common law and statutory duties 13 pertaining to the security and privacy." (See TAC ¶ 110.) 14 Kimpton argues the CCPA does not apply extraterritorially and, consequently, that 15 the claim is subject to dismissal, as Thomas is a resident of Arizona and plaintiffs do not 16 allege the conduct on which the claim is based occurred in Colorado. 17 Under Colorado law, "a statute cannot be presumed to have any extraterritorial 18 effect." See Peerless Ins. Co. v. Clark, 29 Colo. App. 436, 439-41 (1971). Plaintiffs cite 19 to no exception to this rule. Nor do plaintiffs allege that Thomas was in Colorado when 20 he made a reservation, that either Kimpton or Sabre is a resident of Colorado or engaged 21 in any act in Colorado that induced Thomas to make a reservation, or that Sabre's 22 reservation system is located in Colorado. Although plaintiffs rely on their allegation that 23 one of the Kimpton hotels at which Thomas stayed is located in Colorado (see TAC 24 ¶ 11.iv.), plaintiffs fail to allege any facts from which it reasonably can be inferred that a 25 causal or any other legally cognizable relationship exists between the location of the hotel 26 where Thomas stayed and the harm he is alleged to have incurred. 27 Accordingly, the Fifth Claim for Relief is subject to dismissal. 1 D. Sixth Claim for Relief: Violation of Pennsylvania UTPCPL 2 In the Sixth Claim for Relief, brought on behalf of Thomas only, plaintiffs allege 3 Kimpton violated the Pennsylvania Unfair Trade Practices and Consumer Protection Law 4 ("UTPCPL"), which Law prohibits "[u]nfair or deceptive acts in the conduct of any trade or 5 commerce." See Pa. Cons. Stat. § 201-3. The practices on which the claim is based are 6 the same nine practices on which plaintiffs base the Fifth Claim for Relief. (Compare 7 TAC ¶ 121 with TAC ¶ 110.) 8 Kimpton argues the UTPCPL does not apply extraterritorially and, consequently, 9 that the claim is subject to dismissal, as Thomas is a resident of Arizona and plaintiffs do 10 not allege the conduct on which the claim is based occurred in Pennsylvania. 11 Plaintiffs do not allege that Thomas was in Pennsylvania when he made a 12 reservation, that either Kimpton or Sabre is a resident of Pennsylvania or engaged in any 13 act in Pennsylvania that induced Thomas to make a reservation, or that Sabre's 14 reservation system is located in Pennsylvania.6 Rather, similar to their argument made 15 with respect to the Fifth Claim for Relief, plaintiffs rely on their allegation that one of the 16 Kimpton hotels at which Thomas stayed is located in Pennsylvania. (See TAC ¶ 11.v.) 17 As noted above with respect to the Fifth Claim for Relief, however, plaintiffs fail to allege 18 any facts from which it be inferred that a causal or any other legally cognizable 19 relationship exists between the location of the hotel where Thomas stayed and the harm 20 he is alleged to have incurred. 21 Accordingly, the Sixth Claim for Relief is subject to dismissal. 22 // 23 // 24

25 6Although the Pennsylvania Supreme Court has held that a claim under the UTPCPL may be brought by a non-Pennsylvania resident based on conduct occurring 26 outside Pennsylvania where the defendant is headquartered in Pennsylvania, see Danganan v. Guardian Protection Services, 645 Pa. 181, 195-96 (2018), plaintiffs here 27 allege Kimpton is a resident of California and Delaware (see TAC ¶ 18), not of 1 E. Seventh Claim for Relief: Violation of New York General Business Law § 349 2 In the Seventh Claim for Relief, brought on behalf of Thomas only, plaintiffs allege 3 Kimpton violated New York General Business Law § 349, which Law prohibits 4 "[d]eceptive acts or practices in the conduct of any business." See N.Y. Gen. Bus. Law 5 § 349(a). The practices on which plaintiffs base this claim, with one exception, are the 6 same practices on which plaintiffs base the Fifth Claim for Relief. (Compare TAC ¶ 129 7 with TAC ¶¶ 110.)7 8 Kimpton argues § 349 does not apply extraterritorially and, consequently, that the 9 claim is subject to dismissal, as Thomas is a resident of Arizona and plaintiffs do not 10 allege the conduct on which the claim is based occurred in New York. 11 As the Second Circuit has explained, a split of authority exists as to the "proper 12 territorial analysis under section § 349"; some courts "focus on where the deception of 13 the plaintiff occurs and require, for example, that a plaintiff actually view a deceptive 14 statement while in New York," while others "focus on where the underlying deception 15 'transaction' takes place, regardless of the plaintiff's location or where the plaintiff is 16 deceived." See Cruz v. FXDirectDealer, LLC, 720 F.3d 115, 123 (2nd Cir. 2013). 17 Here, under either line of authority, plaintiffs fail to state a claim. Plaintiffs do not 18 allege Thomas was deceived while in New York, nor do plaintiffs allege facts to support a 19 finding that any of the alleged deceptive acts took place in New York, e.g., that either 20 Kimpton or Sabre engaged in any act in New York that induced Thomas to make a 21 reservation. To the extent plaintiffs rely on their allegation that one of the Kimpton hotels 22 at which Thomas stayed is located in New York (see TAC ¶ 11.vi.), such reliance is 23 unavailing, as plaintiffs fail to allege any facts from which it be inferred that a causal or 24 any other legally cognizable relationship exists between the location of the hotel where 25

26 7The one exception is that the Seventh Claim for Relief, unlike the Fifth Claim for Relief, is not based on an allegation that Kimpton "misrepresent[ed] that it would comply 27 with common law and statutory duties pertaining to [plaintiffs'] security and privacy." (See 1 Thomas stayed and the harm he is alleged to have incurred. 2 Accordingly, the Seventh Claim for Relief is subject to dismissal. 3 F. Eighth Claim for Relief: Violation of Texas Deceptive Trade Practices Act 4 In the Eighth Claim for Relief, brought on behalf of Thomas and Martin only, 5 plaintiffs allege Kimpton violated the Texas Deceptive Trade Practices – Consumer 6 Protection Act ("TDTPA"), which Act prohibits "[f]alse, misleading, or deceptive acts or 7 practices in the conduct of any trade or commerce." See Tex. Bus. & Com. Code 8 § 17.46. The practices on which the claim is based are the same nine practices on which 9 plaintiffs base the Fifth Claim for Relief. (Compare TAC ¶ 141 with TAC ¶ 110.) 10 Kimpton argues that, to the extent the claim is brought on behalf of Thomas, it is 11 subject to dismissal on the ground the TDTPA does not apply extraterritorially and, 12 consequently, that the claim is subject to dismissal, as Thomas is a resident of Arizona 13 and plaintiffs do not allege the conduct on which his claim is based occurred in Texas. 14 To the extent the claim is brought on behalf of Martin, who is a Texas resident, Kimpton 15 argues the claim is subject to dismissal in part, specifically, as to those portions of his 16 claim that are based on fraud. 17 1. Thomas 18 Under Texas law, "the presumption is that [a] statute is intended to have no 19 extraterritorial effect." See Marmon v. Mustang Aviation, Inc., 430 S.W. 2d 182 (Tex. 20 1968) (internal quotation and citation omitted). Plaintiffs do not assert such presumption, 21 as applied to the TDTPA, can be rebutted. Nor do plaintiffs allege Thomas was in Texas 22 when he made a reservation, that either Kimpton or Sabre is a resident of Texas or 23 engaged in any acts in Texas that induced Thomas to make a reservation, or that Sabre's 24 reservation system is located in Texas. Although plaintiffs rely on their allegation that 25 one of the Kimpton hotels at which Thomas stayed is located in Texas (see TAC 26 ¶ 11.vii.), plaintiffs fail to allege any facts from which it can be inferred that a causal or 27 any other legally cognizable relationship exists between the location of the hotel where 1 Accordingly, the Eighth Claim for Relief is subject to dismissal to the extent it is 2 asserted on behalf of Thomas. 3 2. Martin 4 Kimpton argues that, to the extent the Eighth Claim for Relief is based on 5 Kimpton's having made false statements (see, e.g., TAC ¶ 141.i), the claim is subject to 6 dismissal. In particular, Kimpton argues, plaintiffs have failed to allege facts sufficient to 7 support a finding that Kimpton knew the subject statements were false when they were 8 made. 9 The representations on which plaintiffs rely are the following

10 Your card is safe. Credit and Debit Card Safety. We at IGH8 are committed to keeping your personal information safe. Our secure service software 11 (SSL) is the industry standard and among the best software available today for secure commerce transactions. It encrypts all of your personal 12 information, including payment card number, name, and address, so that it cannot be read as the information travels over the Internet. 13 (See TAC ¶ 27; see also TAC ¶ 30.) 14 How we secure your information. We are committed to protecting the 15 confidentiality and security of the information that you provide to us. To do this, technical, physical and organizational security measures are put in 16 place to protect against any unauthorized access, disclosure, damage or loss of your information. The collection, transmission and storage of 17 information can never be guaranteed to be completely secure[;] however, we take steps to ensure that appropriate security safeguards are in place to 18 protect your information. 19 (See TAC ¶ 32 (emphasis in original).)

20 [T]he privacy and security of your information is very important to us. Whether you are booking a room or are a member of one of our loyalty 21 programs, we want you to trust that the information that you have provided to us is being properly managed and protected. 22 (See TAC ¶ 35.) 23 Data Privacy and Site Security. IGH takes your privacy seriously and works 24 to protect you. All personal information you provide is encrypted and secure. 25 (See id.) 26 27 1 Plaintiffs allege the above-quoted statements were false when made because 2 Sabre did not have "the best security standards, as "it always used only single factor 3 authentication, which has proven to be unsafe years before this data breach" (see TAC 4 ¶ 28), and because Kimpton "permitted" Sabre to employ "single factor authorization" 5 rather than "implement a multi-layered security platform including advanced behavioral 6 analytics to recognize potential intrusions at the outset and stop them before they 7 become serious" (see TAC ¶ 33). 8 Under Texas law, a plaintiff alleging a fraud claim must show "the defendant knew 9 the representation was false or made it recklessly as a positive assertion without any 10 knowledge of its truth." See JPMorgan Chase Bank, N.A. v. Orca Assets G.P., L.L.C., 11 546 S.W. 3d 648, 653 (Tex. 2018) (internal quotation and citation omitted). Here, the 12 TAC, while including a conclusory assertion that "Kimpton was aware that its agent, 13 Sabre, did not have the best security standards" (see TAC ¶ 28), lacks facts to support 14 such conclusion, e.g., that Kimpton knew, at the time it made the challenged statements, 15 Sabre used single factor authorization and that it knew such a system was insufficient to 16 protect PII. 17 Plaintiffs, in their opposition, rely on the principle that a defendant's knowledge of 18 the falsity of a statement is often proven circumstantially, including by "acts that were 19 subsequent to the actions at issue." See United States v. DiRoberto, 686 Fed. Appx. 458 20 (9th Cir. 2017). Although plaintiffs' opposition fails to identify any such act, it appears 21 plaintiffs are relying on their allegation that, subsequent to Kimpton's becoming "aware" 22 of the data breach, "the statement noted [in ¶ 27 of the TAC] that 'Your card is safe' was 23 still present" on Kimpton's website. (See TAC ¶ 28.) Plaintiffs do not, however, suggest 24 how Kimpton's continued use of such language evidences its knowledge that the 25 statements it made to Martin, namely, statements made before the data breach, were 26 false when made. Moreover, plaintiffs do not allege that, at the time Kimpton learned of 27 the breach, Sabre was still operating Kimpton's reservation system and was using single 1 Accordingly, the Eight Claim for Relief is subject to dismissal to the extent it is 2 asserted on behalf of Martin and is based on Kimpton's having made false statements. 3 G. Ninth Claim for Relief: Violation of Maryland Consumer Protection Act 4 In the Ninth Claim for Relief, brought on behalf of Martin only, plaintiffs allege 5 Kimpton violated the Maryland Consumer Protection Act ("MCPA"), which Act prohibits 6 "any unfair, abusive, or deceptive trade practice." See Md. Com. Law § 13-303. The 7 practices on which plaintiffs base this claim, with two exceptions, are the same practices 8 on which plaintiffs base the Fifth Claim for Relief. (Compare TAC ¶ 155 with TAC 9 ¶¶ 110.)9 10 Kimpton argues the MCPA does not apply extraterritorially and, consequently, the 11 claim is subject to dismissal, as Martin is a resident of Texas and plaintiffs do not allege 12 the conduct on which the claim is based occurred in Maryland. 13 Under Maryland law, "unless an intent to the contrary is expressly stated, acts of 14 the legislature will be presumed not to have any extraterritorial effect." See Chairman v. 15 Waldron, 285 Md. 175, 183-84 (1979). Plaintiffs do not assert such presumption, as 16 applied to the MCPA, can be rebutted. Nor do plaintiffs allege that Martin was in 17 Maryland when he made a reservation, that either Kimpton or Sabre is a resident of 18 Maryland or engaged in any conduct in Maryland that induced Martin to make a 19 reservation, or that Sabre's reservation system is located in Maryland. Although plaintiffs 20 rely on their allegation that Martin stayed in a Kimpton hotel located in Maryland (see 21 TAC ¶ 15), plaintiffs fail to allege any facts from which it be inferred that a causal or any 22 other legally cognizable relationship exists between the location of the hotel where 23 Thomas stayed and the harm Martin is alleged to have incurred. 24

25 9The two exceptions are that the Ninth Claim for Relief, unlike the Fifth Claim for Relief, is not based on the allegations that Kimpton (1) "[r]epresent[ed] to its customers it 26 would employ reasonable security and privacy measures," while "permitting to be employed single factor authorization on its reservation system" and (2) "[r]epresent[ed] to 27 its customers that it would employ reasonable security and privacy measures and yet 1 Accordingly, the Ninth Claim for Relief is subject to dismissal. 2 CONCLUSION 3 For the reasons stated above, Kimpton's motion to dismiss is hereby GRANTED in 4 part and DENIED in part, as follow: 5 1. The Second, Fourth, Fifth, Sixth, Seventh, and Ninth Claims for Relief are 6 || hereby DISMISSED. 7 2. To the extent the Eighth Claim for Relief is brought on behalf of Thomas, and to 8 || the extent it is brought on behalf of Martin and based on Kimpton's having made false 9 || statements, the Eighth Claim for Relief is hereby DISMISSED. 10 3. In all other respects, the motion is DENIED. 11 4. Should plaintiffs wish to amend for purposes of curing the deficiencies g 12 || discussed above, plaintiffs shall file their Fourth Amended Complaint no later than July s 13 17, 2020. If plaintiffs elect not to amend, the instant action shall proceed on the 14 remaining claims, specifically, the First Claim for Relief, the Third Claim for Relief, and 2 15 || the remaining portion of the Eighth Claim for Relief. a 16 In light of the above, the Case Management Conference Is CONTINUED from July g 17 || 24, 2020, to August 21, 2020, at 10:30 a.m., at which time the parties shall appear 18 || telephonically. A Joint Case Management Statement shall be filed no later than August 19 14, 2020. 20 IT IS SO ORDERED. 21 22 || Dated: June 30, 2020 lane ll, Chats MAXINE M. CHESNEY 23 United States District Judge 24 25 26 27 28