713 F.Supp.3d 623
N.D. Cal.2024Background
- Two major data breaches occurred in December 2020 and January 2021 involving Accellion, Inc., whose File Transfer Appliance (FTA) software was used by various large institutions to transfer files containing sensitive personal information (PII).
- Plaintiffs are individuals whose PII was compromised in the breach; they allege the exposure resulted in identity theft and various out-of-pocket losses.
- Multiple lawsuits were filed across the country; the cases were consolidated in the Northern District of California with appointed interim co-lead counsel.
- Accellion moved to dismiss several claims in the consolidated complaint, raising questions about duty, causation, statutory interpretation, and proper defendants.
- The court issued an order granting in part and denying in part the motion to dismiss, carefully analyzing each of the 11 claims asserted against Accellion under California and other state laws.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Duty of Care (Negligence) | Special relationship creates duty to protect PII | No duty—no privity or special relationship | Duty exists based on special relationship; motion denied |
| Negligence Per Se | Accellion violated several statutes, establishing breach | Negligence per se not an independent claim | Not an independent claim; dismissed w/o leave to amend; can use as standard for negligence |
| CCPA Applicability | Accellion is a "business" under CCPA | Accellion does not determine why/how PII is processed | Not a CCPA "business" re: PII at issue; dismissed with leave to amend |
| CMIA Coverage | Accellion qualifies as health care provider/software provider under statute | Not organized for maintaining medical info, not direct-to-consumer | Not a covered entity; dismissed with leave to amend |
| CCRA Standing | Plaintiffs are Accellion customers | Plaintiffs didn’t obtain services from Accellion | Plaintiffs aren't "customers"; dismissed with leave to amend |
| Privacy Claims (Intrusion & Constitutional) | Reckless conduct satisfies intent; conduct was highly offensive | No intentional or highly offensive conduct alleged | No intent/high offense; dismissed with leave to amend |
| Breach of Contract (Third-Party Beneficiary) | Plaintiffs are intended beneficiaries | Contracts disclaim third-party beneficiaries | Disclaimer controls; dismissed without leave to amend |
| Unjust Enrichment | Equitable remedy if legal inadequate | Legal remedies sufficient; no lack of adequate remedy alleged | No lack of adequate legal remedy; dismissed with leave to amend |
| WCPA (Washington) | Accellion’s failures are "unfair acts" under statute | No direct duty to downstream parties | Sufficient for claim to proceed; motion denied |
| MCPA (Michigan) | (Plaintiffs conceded) | (N/A) | Dismissed without leave to amend |
Key Cases Cited
- Regents of Univ. of California v. Superior Ct., 4 Cal. 5th 607 (Cal. 2018) (describes features of special relationships for imposing affirmative duties)
- Rowland v. Christian, 69 Cal. 2d 108 (Cal. 1968) (outlines public policy factors in duty analysis)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (pleading standards; courts not bound to accept legal conclusions as fact)
- Brown v. USA Taekwondo, 11 Cal. 5th 204 (Cal. 2021) (framework for recognizing special relationship duties)
- Doe v. Uber Techs., Inc., 79 Cal. App. 5th 410 (Cal. Ct. App. 2022) (limits on special relationship via advertising or contract)
- Jones v. Awad, 39 Cal. App. 5th 1200 (Cal. Ct. App. 2019) (negligence per se is not a standalone claim)
- Seely v. White Motor Co., 63 Cal. 2d 9 (Cal. 1965) (economic loss rule in California)
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (standards for privacy torts and constitutional privacy claims)
- J’Aire Corp. v. Gregory, 24 Cal. 3d 799 (Cal. 1979) (economic loss rule exception for special relationships)
- Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wash. 2d 778 (Wash. 1986) (elements of a private WCPA action)