Judge Recognizes Loss of Value to PII as Basis of Standing for Data Breach Plaintiff — Claridge v. RockYou

[Post by Venkat Balasubramani with comments from Eric]

Claridge v. RockYou, 2011 WL 1361588 (N.D. Cal.; Apr. 11, 2011)

RockYou is a developer and publisher of applications for use with Facebook, MySpace, hi5, and Bebo. RockYou’s applications allow users to share photos, write text on a friend’s page, or play games with other users. In order to sign up, users are asked to provide an email address and create a password. Users may also be required to provide their social network user name and passwords. RockYou displays advertisements on the apps. RockYou claims to have “more than 130 million unique customers using its application on a monthly basis.”

RockYou was alerted to an alleged security problem with its SQL database in late December 2009 by an online security firm. Plaintiff claims that RockYou failed to act quickly enough to address this problem, and as a result

at least one confirmed hacker known as ‘igigi’ accessed RockYou’s database, and in the process accessed and copied the email and social networking login credentials of at least 32 million registered RockYou users.

Plaintiff sued RockYou in a putative class action, alleging a slew of claims: breach of contract, the Stored Communications Act, negligence, California’s anti-hacking statute, and California’s unfair competition and consumer protection statutes.

Standing: RockYou argued that plaintiff lacked standing – i.e., that the unauthorized access of plaintiff’s login credentials did not cause plaintiff any “concrete, tangible, non-speculative harm.” In response, plaintiff argued that:

[RockYou’s] customers, including plaintiff, ‘pay’ for the products and services they ‘buy’ from [RockYou] by providing their PII, and that the PII constitutes valuable property that is exchanged not only for [RockYou’s] products and services, but also in exchange for [RockYou’s] promise to employ commercially reasonable methods to safeguard the PII.

The court agreed with plaintiff and found that plaintiff alleged an injury in fact sufficient to confer standing. The court noted that the case law is mixed on the question of whether data breach plaintiffs have standing to sue. The court recognized the novel context in which the claims arose:

the unauthorized disclosure of personal information via the Internet – is itself relatively new, and therefore more likely to raise issues of law not yet settled in the courts.

Although the court expressed “doubts about the plaintiff’s ultimate ability to prove [plaintiff’s] damages theory,” the court declines to dismiss on the basis of standing.

Contract Claims: The court initially rejects RockYou’s request to dismiss the contract claims (based on a breach of RockYou’s privacy policy) on the basis that plaintiff did not lose anything of value. For pleading purposes,

plaintiff . . . sufficiently alleged a general basis for harm by alleging that the breach of his PII has caused him to lose some ascertainable but unidentified ‘value’ and/or property right inherent in the PII.

RockYou argued that the privacy policy terms expressly provided that it could not be held liable for any unauthorized third party access to users’ personal information, but the court disagrees, citing to RockYou’s privacy policy. The policy disclaims liability where a third party accesses user information contained in RockYou’s “secure servers,” but the court notes that RockYou’s servers were not in fact secure. The court also cites to flowery language in RockYou’s privacy policy to the effect that RockYou takes “commercially reasonable . . . safeguards” to protect user information.

Consumer Protection Claims: Plaintiff loses on his California consumer protection act claims. With respect to his claim under California’s unfair competition law, one of the two requirements is that the plaintiff has to have lost “money or other property” in order to bring a claim. The court holds that the UCL’s standing requirements are stricter than Article III standing requirements, and require the plaintiff to have paid money or “parted with some particular item of property he formerly possessed.” The court does not buy plaintiff’s novel theory that plaintiff’s “PII constitutes ‘currency'” under the statute. No luck for plaintiff under the UCL.

Similarly, the court rejects plaintiff’s claim under the California Consumer Legal Remedies Act, because the statute only applies to plaintiffs who “purchase or lease” goods or services for “personal, family, or household purposes.” Here, plaintiff has not purchased or leased any goods or services.

__

Plaintiff’s other claims received mixed results. The court dismissed the Computer Fraud and Abuse Act claim with leave to amend (plaintiff admitted that it cited the wrong statutory provision), found that RockYou was not liable under California’s anti-hacking statute (section 502), and found that plaintiff adequately stated a negligence claim.

Data breach cases have uniformly rejected the claims of plaintiffs who have not actually lost any money out of pocket. Some cases have done so on the merits, and other cases have done so on the basis of standing (some cases, such as Krottner v. Starbucks, have rejected the claims on the merits but have expressly found standing). The big question is whether this ruling moves the needle in any way. I’m inclined to say no, but the way in which the plaintiff cast his claim and the court characterized it is interesting.

The privacy policy / breach of contract analysis was also interesting. There is case law expressing skepticism as to whether a privacy policy is even a contract that can support a breach of contract action (“When Does a Privacy Policy Breach Support a Breach of Contract Claim?“), but courts lately don’t think twice about analyzing privacy policy claims under the breach of contract framework. Companies (for whatever reason) continue to include flowery language in their privacy policies that courts latch on to when putting them on the hook for privacy foibles.

Related posts:

9th Circuit Affirms Rejection of Data Breach Claims Against Gap — Ruiz v. Gap

Acxiom Not Liable for Security Breach–Bell v. Acxiom

The [Non]enforceability of Privacy Promises–Pinero v. Jackson Hewitt

Claims Brought by Express Scripts Data Breach Plaintiffs Rejected on Standing Grounds — Amburgy v. Express Scripts, Inc.

__

Eric’s comments

There is a lot to dislike about this opinion.

First, RockYou’s privacy policy promised “RockYou! uses commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of your personal information…” This is industry-standard fluff language in a privacy policy. I bet we could find tens of thousands of privacy policies with similar language. I believe the prevailing view among lawyers is that this language couldn’t be actionable. It doesn’t promise security or integrity; it just promises the company will deploy *some* safeguards. Further, the efforts are only supposed to be “commercially reasonable”–language which many lawyers believe is equivalent to “we’ll try.”

Here, the plaintiff attacks the language by arguing that RockYou didn’t encrypt its data. Now, I recommend to clients that they encrypt their databases of user data in all circumstances, but is it commercially unreasonable to do so? The defendant doesn’t get the decisive win it expected on that point. (The plaintiff also asserts that the defendant was derelict in patching a security flaw that allowed the bad guys to do an SQL injection attack, so the two arguments may have reinforced each other enough to convince the judge there may be something to this case). As Venkat suggests, it’s time to cut the fluffy language from privacy policies. Courts and plaintiffs are overresponding to it.

Second, the court’s decision not to use Article III standing to kick out the case was unfortunate. Although I am sympathetic that Article III standing dismissals are harsh on plaintiffs–they never get a chance to say anything–the doctrine has been very useful at squelching unmeritorious privacy cases early. This case is effectively indistinguishable from the other cases where Article III standing has been used; it’s a garden-variety security breach with no known tangible consequences (other than lawyers looking for a little gravy). Based on the precedent, an Article III standing dismissal would have been a logical outcome.

The court’s acquiescence to the plaintiff’s argument (“defendant’s customers, including plaintiff, “pay” for the products and services they “buy”from defendant by providing their PII, and that the PII constitutes valuable property”) smacks of the old academic debates in the late 1990s/early 2000s about whether personal data should be propertized. It was a weird debate because many of the academics who oppose copyright doctrinal expansion were simultaneously advocating for increased propertization of personal data as a privacy/anti-advertising technique. Personally, I had hoped all of those theories had been lost in the dustbins of history. Instead, this court moves in that direction. Privacy advocates might rejoice, but be careful what you wish for.

The court’s embrace of a “novel” theory is especially frustrating because the court goes on to say that it has doubts about the plaintiffs’ ability to prove damages in the end. So instead of doing the socially optimal thing–killing a meritless lawsuit early–the court embraces a theory likely to fuel privacy advocates to bring other meritless cases; while keeping this case open may very well cause both parties to spend a lot of money only to kill a meritless case later. This may be a situation where the judge is being just a bit too careful.

Third, assuming that personal data is “property,” this isn’t a situation where the vendor sold the data or misused it for advertising. Instead, there was no impairment to the users’ “property right”; it was a security breach. So this is a particularly poor case for the personal-data-as-property meme.

One small piece of good news from this opinion: the court interprets California Penal Code Sec. 502 narrowly and effectively prevents the plaintiffs from converting it into a sword to be used against companies that get hacked. We don’t have many Penal Code 502 rulings, but most of the extant rulings read the statute pretty broadly. I’m glad to see the court was more circumspect on that point.