Toretto v. Mediant Communications, Inc.

• Court: District Court, N.D. California
• Decided: March 18, 2020
• Docket: 3:19-cv-05208
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 PHILLIP TORETTO, et al., Case No. 19-cv-05208-EMC

8 Plaintiffs, ORDER GRANTING DEFENDANT’S 9 v. MOTION TO DISMISS

10 MEDIANT COMMUNICATIONS, INC., Docket No. 24 11 Defendant.

12 13 14 I. INTRODUCTION 15 Phillip Toretto (“Mr. Toretto”) and Daniel C. King (“Mr. King”) (collectively “Plaintiffs”) 16 filed this suit as a putative class action. The Defendant is Mediant Communications, Inc. 17 (“Defendant”), a Delaware corporation that is employed by companies and mutual funds to 18 distribute materials to shareholders and coordinate shareholder voting. Plaintiffs’ claims stem 19 from a data breach that occurred in April 2019, during which hackers accessed Mediant’s business 20 email accounts and stole the personal information of thousands of shareholders, including 21 individuals’ names, genders, physical addresses, email addresses, phone numbers, Social Security 22 Numbers, tax identification numbers, account numbers, and various other types of information. 23 Defendant has filed a Motion to Dismiss; for the reasons discussed below, the Court GRANTS the 24 motion to dismiss. 25 II. BACKGROUND 26 A. Factual Background 27 Plaintiffs allege the following. “Phillip Toretto is a resident and citizen of Sausalito, 1 Dover, New Jersey.” Id. ¶ 6. Mediant is a company headquartered in New York and incorporated 2 in Delaware. Id. ¶ 7. “[P]ublic companies and mutual funds hire Mediant as their proxy agent to 3 distribute materials to shareholders, coordinate shareholder votes, and tabulate voting results.” Id. 4 ¶ 1. “[C]ompanies entrust Mediant with sensitive shareholder information in order to effectuate 5 the distribution of materials and the coordination of important votes.” Id. ¶¶ 1, 17. 6 “On April 1, 2019, hackers obtained unauthorized access to Mediant’s business email 7 accounts and exfiltrated the personal information of its customers’ investors.” Id. ¶¶ 2, 12. Both 8 Plaintiffs’ personal information was compromised in the data breach. Id. ¶¶ 5, 6. Mediant 9 contends that “it discovered the unauthorized access that same day and disconnected the affected 10 server from the company’s system.” Id. ¶ 13. The company “then commenced an investigation 11 into the breach.” Id. In May 2019, “Mediant began notifying state attorneys general and sending 12 notices to its customers’ investors whose Personal Information had been stolen.” Id. ¶ 14. 13 In the notices sent to affected shareholders, “Mediant represented that none of the 14 companies who provided investor information had systems involved in the incident or ‘were 15 otherwise at fault in the incident.’” Id. ¶ 19. The notices further represented that “Mediant has 16 ‘taken steps to strengthen [its] protection of personal information, including updating our network 17 security controls and email systems,’” that the company would “continue to closely monitor and 18 take further steps to safeguard such information,” and that it recommended that affected 19 shareholders closely monitor “financial accounts, statements, credit reports and other financial 20 information for any evidence of unusual activity, fraudulent charges or signs of identity theft.” Id. 21 ¶¶ 19–22. 22 Mr. Toretto alleges that, as a result of the breach, he has “expended time and effort 23 regularly monitoring his financial and credit accounts in order to mitigate against potential harm. 24 Given the highly-sensitive nature of the information stolen, [he] remains at a substantial and 25 imminent risk of future harm.” Id. ¶ 28. Mr. King makes the same allegations. Id. ¶ 32. 26 B. Procedural Background 27 Plaintiffs filed their class action Complaint on August 21, 2019. See Docket No. 1. On 1 Procedure 12(b)(2) and 12(b)(6). See Docket No. 24. Shortly thereafter, the parties stipulated to 2 extend the briefing deadlines for the Motion to Dismiss in order to facilitate jurisdictional 3 discovery. See Docket No. 25. The Court granted that stipulation on November 15, 2019. See 4 Docket No. 26. Such discovery was conducted. The Motion to Dismiss is pending before the 5 Court. 6 III. DISCUSSION 7 A. Legal Standard 8 Under Federal Rule of Civil Procedure 12(b)(2), a court must dismiss an action where it 9 does not have personal jurisdiction over a defendant. While the burden is on the plaintiff to 10 demonstrate that the court has jurisdiction, “the plaintiff need only make a prima facie showing of 11 jurisdictional facts to withstand the motion to dismiss.” Brayton Purcell LLP v. Recordon & 12 Recordon, 606 F.3d 1124, 1127 (9th Cir. 2010) (citation omitted). The Court must accept 13 uncontroverted allegations in the plaintiff’s complaint as true and resolve all disputed facts in 14 favor of the plaintiff. Id. 15 “The parties may submit, and the court may consider, declarations and other evidence 16 outside the pleadings in determining whether it has personal jurisdiction.” Kellman v. Whole 17 Foods Mkt., Inc., 313 F. Supp. 3d 1031, 1042 (N.D. Cal. 2018) (citing Doe v. Unocal Corp., 248 18 F.3d 915, 922 (9th Cir. 2001)). “Where not directly controverted, plaintiff’s version of the facts is 19 taken as true for the purposes of a 12(b)(2) motion,” and “conflicts between the facts contained in 20 the parties’ [evidentiary submissions] must be resolved in [plaintiff’s] favor.” Unocal Corp., 248 21 F.3d at 922 (quoting AT&T Co. v. Compagnie Bruxelles Lambert, 94 F.3d 586, 588 (9th Cir. 22 1996)). However, the court may not assume the truth of allegations that are contradicted by the 23 evidence. Data Disc, Inc. v. Sys. Tech. Assocs., Inc., 557 F.2d 1280, 1284 (9th Cir. 1977). “The 24 plaintiff cannot simply rest on the bare allegations of its complaint.” Mavrix Photo, Inc. v. Brand 25 Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011) (citations omitted). 26 B. Jurisdictional Analysis 27 Mediant is headquartered in New York and incorporated in Delaware. See Complaint ¶ 7. 1 Plaintiffs’ Opposition to Defendant’s Motion to Dismiss (“Opp.”) at 2, Docket No. 27. Thus, the 2 question is whether specific personal jurisdiction exists. 3 In the Ninth Circuit, courts “employ a three-part test to assess whether a defendant has 4 sufficient contacts with the forum state to be subject to specific personal jurisdiction.” Picot v. 5 Weston, 780 F.3d 1206, 1211 (9th Cir. 2015). First, “[t]he non-resident defendant must 6 purposefully direct his activities or consummate some transaction with the forum or resident 7 thereof; or perform some act by which he purposefully avails himself of the privilege of 8 conducting activities in the forum, thereby invoking the benefits and protections of its laws.” Id. 9 Second, “the claim must be one which arises out of or relates to the defendant’s forum-related 10 activities.” Id. And third, “the exercise of jurisdiction must comport with fair play and substantial 11 justice, i.e. it must be reasonable.” Id. It is the plaintiff who “has the burden of proving the first 12 two prongs.” Id. at 1211 (citing CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1076 13 (9th Cir. 2011)). But if the plaintiff carries that burden, “the burden shifts to the defendant to set 14 forth a compelling case that the exercise of jurisdiction would not be reasonable.” Id. at 1212 15 (internal citations omitted). 16 1. Purposeful Availment 17 With respect to the first prong, Plaintiffs contend that Mediant purposefully availed itself 18 of the privilege of doing business in California. Opp. at 3. Plaintiff does not rely on the 19 purposeful direction prong. 20 Purposeful availment “requires a finding that the defendant ‘[has] performed some type of 21 affirmative conduct which allows or promotes the transaction of business within the forum state.’” 22 Doe v. Unocal Corp., 248 F.3d 915, 924 (9th Cir. 2001) (quoting Sher v. Johnson, 911 F.2d 1357, 23 1362 (9th Cir. 1990)). “‘[A]n [in-state] individual’s contract with an out-of-state party alone 24 [cannot] automatically establish sufficient minimum contacts’ to support personal jurisdiction.” 25 McGlinchy v. Shell Chem. Co., 845 F.2d 802, 816 (9th Cir. 1988) (quoting Burger King Corp. v. 26 Rudzewicz, 471 U.S. 462, 478 (1985)); see also Ziegler v. Indian River Cty., 64 F.3d 470, 473 (9th 27 Cir. 1995). In evaluating purposeful availment, the Supreme Court has identified four factors as 1 of the contract; and (4) the parties’ actual course of dealing. Burger King Corp. v. Rudzewicz, 471 2 U.S. 462, 479 (1985). The analysis involves a “qualitative evaluation of the defendant’s contact 3 with the forum state.” Harris Rutsky & Co. Ins. Servs., Inc. v. Bell & Clements Ltd., 328 F.3d 4 1122, 1130 (9th Cir. 2003). “Some actions by a defendant may be particularly persuasive under 5 the purposeful availment test,” including: (1) direct solicitation of business in the forum state, (2) 6 conducting negotiations in the forum state, or (3) making the forum state’s laws the governing law 7 under the contract. Decker Coal Co. v. Commonwealth Edison Co., 805 F.2d 834, 840 (9th Cir. 8 1986). In addition, the substantiality of the effect in the forum state may be considered. See, e.g., 9 Haisten v. Grass Valley Med. Reimbursement Fund, Ltd., 784 F.2d 1392, 1398 (9th Cir. 1986) 10 (finding purposeful availment as to California where foreign malpractice fund served only 11 California doctors and “the reason for the Fund’s existence was ‘for the benefit of California 12 residents; to wit, California doctors’”). 13 Here, Plaintiffs have demonstrated none of the indicia for purposeful availment. For one 14 thing, there is no contract between the parties, and Plaintiffs are not one of the Defendant’s clients. 15 See Reply in Support of Motion to Dismiss (“Reply”) at 2, Docket No. 35. Instead, they are 16 clients of Mediant’s clients, or even—in some cases—of Mediant’s client’s clients. Id. In 17 addition, Mediant indicated at the hearing that it has no way of even discerning the location of the 18 shareholders it contacts until it receives their information from clients once its proxy-agent duties 19 on behalf of a fund have begun. As to those fund managers with whom Mediant contracted, 20 nothing in the record indicates that Mediant conducted negotiations in California or that it directly 21 solicited business here. Indeed, in the Response to Interrogatories, Mediant contends that it does 22 not engage in business operations, lobbying, marketing, or advertising in California. See 23 Mediant’s Response to Interrogatories (“Int.”) at Response No. 7, Docket No. 27-3. This fact is 24 not rebutted. 25 Plaintiffs acknowledge that nothing else in the record suggests that Mediant sought 26 business specifically in California. Although Plaintiffs allege that Mediant “takes 8-10 employee 27 business trips to California per year and ‘has regular communications with entities on whose 1 operating in California,’” Opp. at 4–5 (quoting Int. at Response No. 7), Defendant characterized 2 these trips as irregular and repeatedly denied, both their responses to Plaintiffs’ interrogatories and 3 at the hearing, that they solicit business in California. This fact is unrebutted. Nor is there any 4 evidence that California law was made the governing law of any agreement Mediant had with 5 either Plaintiffs or the fund managers. 6 In short, there is nothing which indicates any targeting of, or relationship to, any California 7 residents by Mediant that would distinguish California from any other state. While Plaintiffs 8 argue that Mediant was aware that it was doing business in California and knew that it possessed 9 the personal information of thousands of California residents, the same is true of many other 10 states. Indeed, Plaintiffs concede that more people New York were affected by the breach than 11 were affected in California . 12 Instead, Plaintiffs rely on the fact that seven of the fifteen companies that had shareholder 13 information exposed through Mediant’s data breach “are headquartered and maintain their 14 principal places of business in California,” Opp. at 4–5 (citing Int. at Response No. 31), and that at 15 least 21,703 individuals—of the more than 200,000 whose information was exposed through the 16 data breach—reside in California, id. at 5. Plaintiffs claim the data breach had a “disparate 17 impact” on California residents. But Plaintiffs have not established a disparate impact. 18 Approximately 10% of affected shareholders are located in California. See id. at 5 (“of the more 19 than 200,000 individuals whose information was compromised in the Breach, at least 21,703 20 reside in California”). However, the state of California represents approximately 12% of the U.S. 21 population.2 22

23 1 Although the information from Mediant’s Response to Interrogatories does not appear in the 24 Complaint, “pursuant to Rule 12(b)(2), which governs dismissal for lack of personal jurisdiction, ‘[t]he court may consider evidence presented in affidavits to assist it in its determination and may 25 order discovery on the jurisdictional issues.’” Teeman v. Washington, No. 15-CV-3138-TOR, 2015 WL 6442735, at *2 (E.D. Wash. Oct. 23, 2015) (quoting Doe v. Unocal Corp., 248 F.3d 915, 26 922 (9th Cir. 2001)).

27 2 Annual Estimates of the Resident Population for the United States, Regions, States, and Puerto Rico: April 1, 2010 to July 1, 2019, U.S. CENSUS (December 30, 2019), 1 Moreover, any such disparate impact, alone, would not suffice to establish jurisdiction. To 2 the extent that Plaintiffs argue that the large number of Californians affected by the data breach 3 means that Mediant would have—or should have—foreseen that its actions would have a large 4 impact on California, foreseeability of harm, without more, is insufficient to establish personal 5 jurisdiction. See Asahi Metal Indus. Co., Ltd. v. Sup.Ct. of California, Solano County, 480 U.S. 6 102, 112 (1987); see also Terracom v. Valley Nat. Bank, 49 F.3d 555, 560 (9th Cir. 1995) (“The 7 purposeful availment standard requires more than foreseeability of causing injury in another 8 state.”). 9 The fact that seven of the fifteen companies whose shareholders’ personal information was 10 compromised are headquartered in California is immaterial to purposeful availment analysis. 11 Mediant contracted with fund managers, not these funds. As noted above, Mediant does not have 12 a direct contractual relationship with any of the fifteen businesses involved in the breach and thus 13 Mediant has no direct contractual relationship with any of the seven breach-affected companies 14 located in California. Instead, it is only connected to those companies through an intermediary 15 company (which is located in Illinois). Reply at 2–3. Given this context, this is not a situation 16 where Mediant effectively and knowingly served an exclusively California clientele. Indeed, there 17 is no evidence that, before Mediant begins performing proxy work for a public company or mutual 18 fund, it has any insight into where the shareholders of that company or fund reside. Moreover, 19 there is no evidence that these managers or funds uniquely or even disproportionately served 20 California shareholders. If anything, the fact that only 10% of affected shareholders are California 21 residents suggests the contrary. 22 Plaintiffs’ reliance on Haisten v. Grass Valley Medical Reimbursement Fund, Ltd., 784 23 F.2d 1392 (9th Cir. 1986) is misplaced. Haisten involved the creation of an indemnity insurance 24 fund for doctors at a California hospital. Haisten, 784 F.2d at 1395. Although “[t]he Fund was 25 carefully and deliberately established to appear to be doing business only in the Cayman Islands,” 26 the court in Haisten found it had personal jurisdiction over the fund because (1) its funding came 27 exclusively from California, (2) it paid benefits exclusively to doctors in California, (3) “the 1 doctors,’” (4) it “was created with the purpose of providing” insurance to a certain group of 2 California physicians, and (5) it concerned indemnification against liability “solely under 3 California malpractice law.” Id. at 1398. Thus, the Court found, “as a matter of commercial 4 actuality and of placing substance over form,” that it was appropriate to exercise personal 5 jurisdiction over the fund. 6 Here, there is nothing in the record to suggest that Mediant has anything resembling the 7 types of focused, visible and anticipatable connections to California as in Haisten. Mediant’s 8 existence was not to serve California companies; it was not “created with the purpose” of 9 providing services to entities (or shareholders) in California. Its purpose was to service funds and 10 managers on a national basis. Mediant’s indirect relationship to some California companies is a 11 matter of happenstance. See Walden v. Fiore, 571 U.S. 277, 286 (2014) (“a defendant’s 12 relationship with a plaintiff or third party, standing alone, is an insufficient basis for jurisdiction”); 13 see also Terracom v. Valley Nat. Bank, 49 F.3d 555, 560 (9th Cir. 1995) (citing Burger King, 471 14 U.S. at 475) (“The purposeful availment prong prevents defendants from being haled into a 15 jurisdiction through ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts.”). Unlike the fund in Haisten, 16 which was created to serve exclusively California residents, only a fraction of the affected 17 shareholders are California residents. 18 Plaintiffs have failed to establish purposeful availment, the first prong of the Ninth 19 Circuit’s test for specific personal jurisdiction. 20 2. Whether Claims Arise Out of Defendant’s Forum-Related Activities 21 Assuming, only for the sake of argument, that Plaintiffs had carried their burden on the 22 first prong of the test for specific personal jurisdiction, Plaintiffs would still bear the burden of 23 proving the second prong: whether their claims arise out of or relate to the defendant’s forum- 24 related activities. See Picot, 780 F.3d at 1211. The critical question for the second prong is “but 25 for Defendants’ contacts with California, would Plaintiff’s claims have arisen?” CFA N. Cal., Inc. 26 v. CRT Partners LLP, 378 F. Supp. 2d 1177, 1186 (N.D. Cal. 2005) (emphasis added) (citing 27 Panavision Int’l v. Toeppen, 141 F.3d 1316, 1322 (9th Cir. 1998)). Such but-for contacts “must 1 Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 243 F. Supp. 2d 1073, 1085 (C.D. Cal. 2003) 2 (quoting Doe v. American Nat'l Red Cross, 112 F.3d 1048, 1051–52 (9th Cir. 1997)). In other 3 words, a defendant’s contact with the forum state must be “sufficiently related to the cause of 4 action.” Id. 5 Plaintiffs contend that absent Mediant’s contractual agreements to “provide services to 6 California entities and California residents” and “Mediant’s subsequent failure to secure the 7 personal information that it collected, Plaintiffs’ claims would not have arisen.” Opp. at 5–6. 8 However, it is not at all evident that, absent Mediant’s contractual agreements to provide services 9 to California entities, Plaintiffs’ claims would not have arisen. Mediant is hired, often through an 10 intermediary company, by a number of public companies and mutual funds as their proxy agent, 11 and not all of them are located in California. Even if Defendant had no contracts with California 12 business entities, California residents could still have been affected by the data breach if they 13 owned stock in mutual funds or public companies that hired Mediant via a manager outside of 14 California. 15 Indeed, Plaintiff Toretto (the California Plaintiff) alleges that Mediant received his 16 information from the Blackstone Real Estate Income Trust, Inc. Complaint ¶ 26. However, it 17 appears that Blackstone is headquartered in New York. Similarly, Plaintiff King, the New Jersey 18 Plaintiff, alleges that Mediant received his information from the Ivy Natural Resources Fund. 19 Complaint ¶ 30. Ivy Investments is a Missouri company. Thus, the claims of the California 20 Plaintiff have no casual or proximate relationship to Mediant’s indirect contract with California 21 companies. Accordingly, Plaintiffs have also failed to carry their burden with respect to the 22 second prong of specific personal jurisdiction analysis. 23 3. Purposeful Direction 24 For the sake of exploring all possible avenues to personal jurisdiction, the Court briefly 25 turns to whether Mediant can be said to have purposefully directed its activities toward California, 26 thereby invoking the benefits and protections of its laws and creating a basis for personal 27 jurisdiction. See Picot, 780 F.3d at 1211. The Ninth Circuit has suggested that the purposeful 1 485 F.3d 450, 460 (9th Cir. 2007) (“it is well established that the Calder test applies only to 2 intentional torts, not to the breach of contract and negligence claims presented here”); see also, 3 e.g., Mehr v. Fed’n Internationale de Football Ass’n, 115 F. Supp. 3d 1035, 1049 (N.D. Cal. 4 2015) (citing Wartsila, 485 F.3d at 460) (“In some cases, the Ninth Circuit has limited the 5 “purposeful direction” test to claims involving intentional torts.”); Hernandez v. City of Beaumont, 6 No. EDCV 13-00967 DDP, 2014 WL 6943881, at *3 (C.D. Cal. Dec. 8, 2014) (“Here, the City’s 7 claims are based on negligence and products liability, not intentional torts. Thus, the Court will 8 apply the more general purposeful availment analysis.”). However, district courts have noted that 9 the Ninth Circuit has applied the purposeful direction test to claims of “negligence, wrongful 10 interference with contractual relations, civil extortion, and fraudulent recording of document.” 11 Mehr, 115 F. Supp. 3d at 1049 (citing Menken v. Emm, 503 F.3d 1050, 1059 (9th Cir. 2007)). 12 Even if purposeful direction were applicable here, it is not satisfied. In evaluating 13 purposeful direction, courts proceed “under the three-part ‘effects’ test traceable to the Supreme 14 Court’s decision in Calder v. Jones, 465 U.S. 783 (1984).” Schwarzenegger v. Fred Martin Motor 15 Co., 374 F.3d 797, 803 (9th Cir. 2004). That test requires “that the defendant allegedly have (1) 16 committed an intentional act, (2) expressly aimed at the forum state, (3) causing harm that the 17 defendant knows is likely to be suffered in the forum state.” Id. (quoting Dole Food Co., Inc. v. 18 Watts, 303 F.3d 1104, 1111 (9th Cir. 2002). Here, no evidence suggests that Mediant “expressly 19 aimed” any intentional act at California. “[M]ere untargeted negligence” is not enough. Calder, 20 465 U.S. at 789 (emphasis added); Asahi Metal, 480 U.S. at 112 (“The placement of a product into 21 the stream of commerce, without more, is not an act of the defendant purposefully directed toward 22 the forum State.”). Thus, even under the purposeful direction approach, this Court lacks personal 23 jurisdiction over Mediant. 24 /// 25 /// 26 /// 27 /// 1 IV. CONCLUSION 2 In light of the foregoing analysis, the Court GRANTS Defendant’s Motion to Dismiss and 3 DISMISSES Plaintiffs’ complaint in its entirety for lack of personal jurisdiction. Because the 4 Court dismisses on the basis of personal jurisdiction, it does not reach Defendant’s other 5 challenges to Plaintiffs allegations. 6 This order disposes of Docket No. 24. 7 8 IT IS SO ORDERED. 9 10 Dated: March 18, 2020 11 LL == ED M.C 13 United States District Judge

Se

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28