Toretto v. Mediant Communications, Inc.

Opinion

PHILLIP TORETTO, et al., Case No. 19-cv-05208-EMC

Plaintiffs, ORDER GRANTING DEFENDANT’S v. MOTION TO DISMISS

MEDIANT COMMUNICATIONS, INC., Docket No. 24 Defendant.

Phillip Toretto (“Mr. Toretto”) and Daniel C. King (“Mr. King”) (collectively “Plaintiffs”) filed this suit as a putative class action. The Defendant is Mediant Communications, Inc. (“Defendant”), a Delaware corporation that is employed by companies and mutual funds to distribute materials to shareholders and coordinate shareholder voting. Plaintiffs’ claims stem from a data breach that occurred in April 2019, during which hackers accessed Mediant’s business email accounts and stole the personal information of thousands of shareholders, including individuals’ names, genders, physical addresses, email addresses, phone numbers, Social Security Numbers, tax identification numbers, account numbers, and various other types of information. Defendant has filed a Motion to Dismiss; for the reasons discussed below, the Court GRANTS the motion to dismiss. A. Factual Background Plaintiffs allege the following. “Phillip Toretto is a resident and citizen of Sausalito, Dover, New Jersey.” Id. ¶ 6. Mediant is a company headquartered in New York and incorporated in Delaware. Id. ¶ 7. “[P]ublic companies and mutual funds hire Mediant as their proxy agent to distribute materials to shareholders, coordinate shareholder votes, and tabulate voting results.” Id. ¶ 1. “[C]ompanies entrust Mediant with sensitive shareholder information in order to effectuate the distribution of materials and the coordination of important votes.” Id. ¶¶ 1, 17. “On April 1, 2019, hackers obtained unauthorized access to Mediant’s business email accounts and exfiltrated the personal information of its customers’ investors.” Id. ¶¶ 2, 12. Both Plaintiffs’ personal information was compromised in the data breach. Id. ¶¶ 5, 6. Mediant contends that “it discovered the unauthorized access that same day and disconnected the affected server from the company’s system.” Id. ¶ 13. The company “then commenced an investigation into the breach.” Id. In May 2019, “Mediant began notifying state attorneys general and sending notices to its customers’ investors whose Personal Information had been stolen.” Id. ¶ 14. In the notices sent to affected shareholders, “Mediant represented that none of the companies who provided investor information had systems involved in the incident or ‘were otherwise at fault in the incident.’” Id. ¶ 19. The notices further represented that “Mediant has ‘taken steps to strengthen [its] protection of personal information, including updating our network security controls and email systems,’” that the company would “continue to closely monitor and take further steps to safeguard such information,” and that it recommended that affected shareholders closely monitor “financial accounts, statements, credit reports and other financial information for any evidence of unusual activity, fraudulent charges or signs of identity theft.” Id. ¶¶ 19–22. Mr. Toretto alleges that, as a result of the breach, he has “expended time and effort regularly monitoring his financial and credit accounts in order to mitigate against potential harm. Given the highly-sensitive nature of the information stolen, [he] remains at a substantial and imminent risk of future harm.” Id. ¶ 28. Mr. King makes the same allegations. Id. ¶ 32. B. Procedural Background Plaintiffs filed their class action Complaint on August 21, 2019. See Docket No. 1. On Procedure 12(b)(2) and 12(b)(6). See Docket No. 24. Shortly thereafter, the parties stipulated to extend the briefing deadlines for the Motion to Dismiss in order to facilitate jurisdictional discovery. See Docket No. 25. The Court granted that stipulation on November 15, 2019. See Docket No. 26. Such discovery was conducted. The Motion to Dismiss is pending before the Court. A. Legal Standard Under Federal Rule of Civil Procedure 12(b)(2), a court must dismiss an action where it does not have personal jurisdiction over a defendant. While the burden is on the plaintiff to demonstrate that the court has jurisdiction, “the plaintiff need only make a prima facie showing of jurisdictional facts to withstand the motion to dismiss.” Brayton Purcell LLP v. Recordon & Recordon, 606 F.3d 1124, 1127 (9th Cir. 2010) (citation omitted). The Court must accept uncontroverted allegations in the plaintiff’s complaint as true and resolve all disputed facts in favor of the plaintiff. Id. “The parties may submit, and the court may consider, declarations and other evidence outside the pleadings in determining whether it has personal jurisdiction.” Kellman v. Whole Foods Mkt., Inc., 313 F. Supp. 3d 1031, 1042 (N.D. Cal. 2018) (citing Doe v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2001)). “Where not directly controverted, plaintiff’s version of the facts is taken as true for the purposes of a 12(b)(2) motion,” and “conflicts between the facts contained in the parties’ [evidentiary submissions] must be resolved in [plaintiff’s] favor.” Unocal Corp., 248 F.3d at 922 (quoting AT&T Co. v. Compagnie Bruxelles Lambert, 94 F.3d 586, 588 (9th Cir. 1996)). However, the court may not assume the truth of allegations that are contradicted by the evidence. Data Disc, Inc. v. Sys. Tech. Assocs., Inc., 557 F.2d 1280, 1284 (9th Cir. 1977). “The plaintiff cannot simply rest on the bare allegations of its complaint.” Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011) (citations omitted). B. Jurisdictional Analysis Mediant is headquartered in New York and incorporated in Delaware. See Complaint ¶ 7. Plaintiffs’ Opposition to Defendant’s Motion to Dismiss (“Opp.”) at 2, Docket No. 27. Thus, the question is whether specific personal jurisdiction exists. In the Ninth Circuit, courts “employ a three-part test to assess whether a defendant has sufficient contacts with the forum state to be subject to specific personal jurisdiction.” Picot v. Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). First, “[t]he non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privilege of conducting activities in the forum, thereby invoking the benefits and protections of its laws.” Id. Second, “the claim must be one which arises out of or relates to the defendant’s forum-related activities.” Id. And third, “the exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.” Id. It is the plaintiff who “has the burden of proving the first two prongs.” Id. at 1211 (citing CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 (9th Cir. 2011)). But if the plaintiff carries that burden, “the burden shifts to the defendant to set forth a compelling case that the exercise of jurisdiction would not be reasonable.” Id. at 1212 (internal citations omitted). 1. Purposeful Availment With respect to the first prong, Plaintiffs contend that Mediant purposefully availed itself of the privilege of doing business in California. Opp. at 3. Plaintiff does not rely on the purposeful direction prong. Purposeful availment “requires a finding that the defendant ‘[has] performed some type of affirmative conduct which allows or promotes the transaction of business within the forum state.’” Doe v. Unocal Corp., 248 F.3d 915, 924 (9th Cir. 2001) (quoting Sher v. Johnson, 911 F.2d 1357, 1362 (9th Cir. 1990)). “‘[A]n [in-state] individual’s contract with an out-of-state party alone [cannot] automatically establish sufficient minimum contacts’ to support personal jurisdiction.” McGlinchy v. Shell Chem. Co., 845 F.2d 802, 816 (9th Cir. 1988) (quoting Burger King Corp. v. Rudzewicz, 471 U.S. 462, 478 (1985)); see also Ziegler v. Indian River Cty., 64 F.3d 470, 473 (9th Cir. 1995). In evaluating purposeful availment, the Supreme Court has identified four factors as of the contract; and (4) the parties’ actual course of dealing. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 479 (1985). The analysis involves a “qualitative evaluation of the defendant’s contact with the forum state.” Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 1130 (9th Cir. 2003). “Some actions by a defendant may be particularly persuasive under the purposeful availment test,” including: (1) direct solicitation of business in the forum state, (2) conducting negotiations in the forum state, or (3) making the forum state’s laws the governing law under the contract. Decker Coal Co. v. Commonwealth Edison Co., 805 F.2d 834, 840 (9th Cir. 1986). In addition, the substantiality of the effect in the forum state may be considered. See, e.g., Haisten v. Grass Valley Med. Reimbursement Fund, Ltd., 784 F.2d 1392, 1398 (9th Cir. 1986) (finding purposeful availment as to California where foreign malpractice fund served only California doctors and “the reason for the Fund’s existence was ‘for the benefit of California residents; to wit, California doctors’”). Here, Plaintiffs have demonstrated none of the indicia for purposeful availment. For one thing, there is no contract between the parties, and Plaintiffs are not one of the Defendant’s clients. See Reply in Support of Motion to Dismiss (“Reply”) at 2, Docket No. 35. Instead, they are clients of Mediant’s clients, or even—in some cases—of Mediant’s client’s clients. Id. In addition, Mediant indicated at the hearing that it has no way of even discerning the location of the shareholders it contacts until it receives their information from clients once its proxy-agent duties on behalf of a fund have begun. As to those fund managers with whom Mediant contracted, nothing in the record indicates that Mediant conducted negotiations in California or that it directly solicited business here. Indeed, in the Response to Interrogatories, Mediant contends that it does not engage in business operations, lobbying, marketing, or advertising in California. See Mediant’s Response to Interrogatories (“Int.”) at Response No. 7, Docket No. 27-3. This fact is not rebutted. Plaintiffs acknowledge that nothing else in the record suggests that Mediant sought business specifically in California. Although Plaintiffs allege that Mediant “takes 8-10 employee business trips to California per year and ‘has regular communications with entities on whose operating in California,’” Opp. at 4–5 (quoting Int. at Response No. 7), Defendant characterized these trips as irregular and repeatedly denied, both their responses to Plaintiffs’ interrogatories and at the hearing, that they solicit business in California. This fact is unrebutted. Nor is there any evidence that California law was made the governing law of any agreement Mediant had with either Plaintiffs or the fund managers. In short, there is nothing which indicates any targeting of, or relationship to, any California residents by Mediant that would distinguish California from any other state. While Plaintiffs argue that Mediant was aware that it was doing business in California and knew that it possessed the personal information of thousands of California residents, the same is true of many other states. Indeed, Plaintiffs concede that more people New York were affected by the breach than were affected in California . Instead, Plaintiffs rely on the fact that seven of the fifteen companies that had shareholder information exposed through Mediant’s data breach “are headquartered and maintain their principal places of business in California,” Opp. at 4–5 (citing Int. at Response No. 31), and that at least 21,703 individuals—of the more than 200,000 whose information was exposed through the data breach—reside in California, id. at 5. Plaintiffs claim the data breach had a “disparate impact” on California residents. But Plaintiffs have not established a disparate impact. Approximately 10% of affected shareholders are located in California. See id. at 5 (“of the more than 200,000 individuals whose information was compromised in the Breach, at least 21,703 reside in California”). However, the state of California represents approximately 12% of the U.S. population.2

1 Although the information from Mediant’s Response to Interrogatories does not appear in the Complaint, “pursuant to Rule 12(b)(2), which governs dismissal for lack of personal jurisdiction, ‘[t]he court may consider evidence presented in affidavits to assist it in its determination and may order discovery on the jurisdictional issues.’” Teeman v. Washington, No. 15-CV-3138-TOR, 2015 WL 6442735, at *2 (E.D. Wash. Oct. 23, 2015) (quoting Doe v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2001)).

2 Annual Estimates of the Resident Population for the United States, Regions, States, and Puerto Rico: April 1, 2010 to July 1, 2019, U.S. CENSUS (December 30, 2019), Moreover, any such disparate impact, alone, would not suffice to establish jurisdiction. To the extent that Plaintiffs argue that the large number of Californians affected by the data breach means that Mediant would have—or should have—foreseen that its actions would have a large impact on California, foreseeability of harm, without more, is insufficient to establish personal jurisdiction. See Asahi Metal Indus. Co., Ltd. v. Sup.Ct. of California, Solano County, 480 U.S. 102, 112 (1987); see also Terracom v. Valley Nat. Bank, 49 F.3d 555, 560 (9th Cir. 1995) (“The purposeful availment standard requires more than foreseeability of causing injury in another state.”). The fact that seven of the fifteen companies whose shareholders’ personal information was compromised are headquartered in California is immaterial to purposeful availment analysis. Mediant contracted with fund managers, not these funds. As noted above, Mediant does not have a direct contractual relationship with any of the fifteen businesses involved in the breach and thus Mediant has no direct contractual relationship with any of the seven breach-affected companies located in California. Instead, it is only connected to those companies through an intermediary company (which is located in Illinois). Reply at 2–3. Given this context, this is not a situation where Mediant effectively and knowingly served an exclusively California clientele. Indeed, there is no evidence that, before Mediant begins performing proxy work for a public company or mutual fund, it has any insight into where the shareholders of that company or fund reside. Moreover, there is no evidence that these managers or funds uniquely or even disproportionately served California shareholders. If anything, the fact that only 10% of affected shareholders are California residents suggests the contrary. Plaintiffs’ reliance on Haisten v. Grass Valley Medical Reimbursement Fund, Ltd., 784 F.2d 1392 (9th Cir. 1986) is misplaced. Haisten involved the creation of an indemnity insurance fund for doctors at a California hospital. Haisten, 784 F.2d at 1395. Although “[t]he Fund was carefully and deliberately established to appear to be doing business only in the Cayman Islands,” the court in Haisten found it had personal jurisdiction over the fund because (1) its funding came exclusively from California, (2) it paid benefits exclusively to doctors in California, (3) “the doctors,’” (4) it “was created with the purpose of providing” insurance to a certain group of California physicians, and (5) it concerned indemnification against liability “solely under California malpractice law.” Id. at 1398. Thus, the Court found, “as a matter of commercial actuality and of placing substance over form,” that it was appropriate to exercise personal jurisdiction over the fund. Here, there is nothing in the record to suggest that Mediant has anything resembling the types of focused, visible and anticipatable connections to California as in Haisten. Mediant’s existence was not to serve California companies; it was not “created with the purpose” of providing services to entities (or shareholders) in California. Its purpose was to service funds and managers on a national basis. Mediant’s indirect relationship to some California companies is a matter of happenstance. See Walden v. Fiore, 571 U.S. 277, 286 (2014) (“a defendant’s relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction”); see also Terracom v. Valley Nat. Bank, 49 F.3d 555, 560 (9th Cir. 1995) (citing Burger King, 471 U.S. at 475) (“The purposeful availment prong prevents defendants from being haled into a jurisdiction through ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts.”). Unlike the fund in Haisten, which was created to serve exclusively California residents, only a fraction of the affected shareholders are California residents. Plaintiffs have failed to establish purposeful availment, the first prong of the Ninth Circuit’s test for specific personal jurisdiction. 2. Whether Claims Arise Out of Defendant’s Forum-Related Activities Assuming, only for the sake of argument, that Plaintiffs had carried their burden on the first prong of the test for specific personal jurisdiction, Plaintiffs would still bear the burden of proving the second prong: whether their claims arise out of or relate to the defendant’s forum- related activities. See Picot, 780 F.3d at 1211. The critical question for the second prong is “but for Defendants’ contacts with California, would Plaintiff’s claims have arisen?” CFA N. Cal., Inc. v. CRT Partners LLP, 378 F. Supp. 2d 1177, 1186 (N.D. Cal. 2005) (emphasis added) (citing Panavision Int’l v. Toeppen, 141 F.3d 1316, 1322 (9th Cir. 1998)). Such but-for contacts “must Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 243 F. Supp. 2d 1073, 1085 (C.D. Cal. 2003) (quoting Doe v. American Nat'l Red Cross, 112 F.3d 1048, 1051–52 (9th Cir. 1997)). In other words, a defendant’s contact with the forum state must be “sufficiently related to the cause of action.” Id. Plaintiffs contend that absent Mediant’s contractual agreements to “provide services to California entities and California residents” and “Mediant’s subsequent failure to secure the personal information that it collected, Plaintiffs’ claims would not have arisen.” Opp. at 5–6. However, it is not at all evident that, absent Mediant’s contractual agreements to provide services to California entities, Plaintiffs’ claims would not have arisen. Mediant is hired, often through an intermediary company, by a number of public companies and mutual funds as their proxy agent, and not all of them are located in California. Even if Defendant had no contracts with California business entities, California residents could still have been affected by the data breach if they owned stock in mutual funds or public companies that hired Mediant via a manager outside of California. Indeed, Plaintiff Toretto (the California Plaintiff) alleges that Mediant received his information from the Blackstone Real Estate Income Trust, Inc. Complaint ¶ 26. However, it appears that Blackstone is headquartered in New York. Similarly, Plaintiff King, the New Jersey Plaintiff, alleges that Mediant received his information from the Ivy Natural Resources Fund. Complaint ¶ 30. Ivy Investments is a Missouri company. Thus, the claims of the California Plaintiff have no casual or proximate relationship to Mediant’s indirect contract with California companies. Accordingly, Plaintiffs have also failed to carry their burden with respect to the second prong of specific personal jurisdiction analysis. 3. Purposeful Direction For the sake of exploring all possible avenues to personal jurisdiction, the Court briefly turns to whether Mediant can be said to have purposefully directed its activities toward California, thereby invoking the benefits and protections of its laws and creating a basis for personal jurisdiction. See Picot, 780 F.3d at 1211. The Ninth Circuit has suggested that the purposeful 485 F.3d 450, 460 (9th Cir. 2007) (“it is well established that the Calder test applies only to intentional torts, not to the breach of contract and negligence claims presented here”); see also, e.g., Mehr v. Fed’n Internationale de Football Ass’n, 115 F. Supp. 3d 1035, 1049 (N.D. Cal. 2015) (citing Wartsila, 485 F.3d at 460) (“In some cases, the Ninth Circuit has limited the “purposeful direction” test to claims involving intentional torts.”); Hernandez v. City of Beaumont, No. EDCV 13-00967 DDP, 2014 WL 6943881, at *3 (C.D. Cal. Dec. 8, 2014) (“Here, the City’s claims are based on negligence and products liability, not intentional torts. Thus, the Court will apply the more general purposeful availment analysis.”). However, district courts have noted that the Ninth Circuit has applied the purposeful direction test to claims of “negligence, wrongful interference with contractual relations, civil extortion, and fraudulent recording of document.” Mehr, 115 F. Supp. 3d at 1049 (citing Menken v. Emm, 503 F.3d 1050, 1059 (9th Cir. 2007)). Even if purposeful direction were applicable here, it is not satisfied. In evaluating purposeful direction, courts proceed “under the three-part ‘effects’ test traceable to the Supreme Court’s decision in Calder v. Jones, 465 U.S. 783 (1984).” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 803 (9th Cir. 2004). That test requires “that the defendant allegedly have (1) committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is likely to be suffered in the forum state.” Id. (quoting Dole Food Co., Inc. v. Watts, 303 F.3d 1104, 1111 (9th Cir. 2002). Here, no evidence suggests that Mediant “expressly aimed” any intentional act at California. “[M]ere untargeted negligence” is not enough. Calder, 465 U.S. at 789 (emphasis added); Asahi Metal, 480 U.S. at 112 (“The placement of a product into the stream of commerce, without more, is not an act of the defendant purposefully directed toward the forum State.”). Thus, even under the purposeful direction approach, this Court lacks personal jurisdiction over Mediant. /// /// /// /// 2 In light of the foregoing analysis, the Court GRANTS Defendant’s Motion to Dismiss and 3 DISMISSES Plaintiffs’ complaint in its entirety for lack of personal jurisdiction. Because the 4 Court dismisses on the basis of personal jurisdiction, it does not reach Defendant’s other 5 challenges to Plaintiffs allegations. 6 This order disposes of Docket No. 24. 7 9 10 Dated: March 18, 2020 11 LL == ED M.C 13 United States District Judge

Se

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28