Conner v. Quora, Inc., a Delaware corporation
508 F.Supp.3d 633
N.D. Cal.2020Background
- Quora experienced a data breach discovered Nov. 30, 2018 and disclosed to users (including plaintiff Jeri Connor) on Dec. 3, 2018; disclosed data included email, IP, user ID, encrypted password, account settings, and imported/linkable account data.
- Connor purchased a premium ClickFreeScore credit‑monitoring subscription in Jan. 2019 (five months) and testifies she spent about an hour per day monitoring her accounts after the disclosure; she does not allege actual identity theft or fraud.
- Plaintiffs brought a consolidated putative class action; after motions to dismiss, negligence and UCL claims remained. Quora moved for summary judgment on those claims.
- The court denied Plaintiff’s Rule 56(d) request for additional discovery and overruled Daubert/Form‑of‑question objections to Plaintiff’s expert and deposition testimony for purposes of the motion.
- Ruling: summary judgment DENIED as to negligence (triable issues remain on cognizable harm, causation, and economic‑loss/special‑relationship analysis) and GRANTED as to the UCL claim (injunctive relief precluded because plaintiff has an adequate remedy at law).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether spending time and money on credit monitoring and increased account vigilance is a cognizable injury for negligence | Connor: out‑of‑pocket cost and specific time spent responding to the breach are concrete, non‑speculative harms | Quora: no actual identity theft; harms are speculative and analogous to preclusion cases involving stolen hardware | Court: Harm is cognizable — plaintiff’s specific time and expense are sufficient to survive summary judgment |
| Causation for negligence — did Quora’s breach substantially cause Connor’s mitigation expenditures and monitoring | Connor: temporal and logical link — notice of breach then purchase/greater monitoring; the breach was the ‘‘last straw’’ | Quora: prior breaches and other causes break the causal chain; no proof breach enabled identity theft | Court: factual dispute exists; evidence permits a reasonable jury to infer the breach was a substantial factor; summary judgment denied on causation |
| Applicability of the economic‑loss rule / existence of a special relationship (J’Aire/Biakanja factors) | Connor: users entrust PII to Quora under its Privacy Policy — transaction intended to affect users; foreseeability and other J’Aire factors favor a special relationship | Quora: no special relationship as a matter of law; harms are purely economic and contract‑based | Court: on the developed record, J’Aire factors weigh for plaintiff; economic‑loss rule does not bar negligence claim |
| UCL standing and availability of injunctive relief | Connor: payment for enhanced monitoring is a monetary loss caused by Quora’s unfair practices; seeks injunction (disclosure and security practices) | Quora: no cognizable UCL injury; alternative free services available; plaintiff has adequate legal remedies so injunctive relief is unavailable | Court: triable dispute as to UCL standing (economic injury), but injunctive relief is barred because plaintiff has an adequate remedy at law (Sonner) — UCL claim dismissed on that basis |
Key Cases Cited
- Celotex Corp. v. Catrett, 477 U.S. 317 (summary judgment movant’s initial burden)
- Anderson v. Liberty Lobby, 477 U.S. 242 (standard for genuine issue of material fact)
- Daubert v. Merrell Dow Pharm., Inc., 509 U.S. 579 (expert admissibility gatekeeping)
- Kumho Tire Co. v. Carmichael, 526 U.S. 137 (Daubert applies to all expert testimony)
- Aas v. Superior Court, 24 Cal.4th 627 (California requirement of appreciable, nonspeculative present harm)
- Potter v. Firestone Tire & Rubber Co., 6 Cal.4th 965 (medical‑monitoring theory and factors)
- J’Aire Corp. v. Gregory, 24 Cal.3d 799 (factors for special relationship / duty)
- Kwikset Corp. v. Superior Court, 51 Cal.4th 310 (UCL standing requires economic injury causally related to alleged unfair practice)
- Sonner v. Premier Nutrition Corp., 971 F.3d 834 (equitable UCL/CLRA remedies require inadequacy of legal remedies)
- Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942 (data‑breach negligence/economic‑loss and medical/credit‑monitoring discussion)
- In re Yahoo! Inc. Customer Data Sec. Litig., 313 F. Supp. 3d 1113 (data‑breach standing and foreseeability in privacy/data contexts)