MDL No. 2357 - IN RE: Zappos.com, Inc., Customer Data Security Breach Litigation
3:12-cv-00325
D. Nev.Aug 29, 2016Background
- January 2012 data breach of Zappos servers exposed PII of ~24 million customers; Zappos notified customers and litigation followed, consolidated as MDL No. 2357.
- Plaintiffs (Prior Plaintiffs) amended complaints multiple times; Zappos moved to dismiss for lack of standing and failure to state a claim; Court previously dismissed without prejudice and gave leave to amend to allege actual identity theft or fraud.
- A consolidated Third Amended Complaint (TAC) added two New Plaintiffs (O’Brien and Wadsworth) and asserted breach-of-settlement and covenant claims based on purported settlement negotiations; Zappos moved to dismiss and to strike class allegations.
- The Court dismissed certain claims and struck class allegations, finding lack of standing and that the proposed class was overbroad and plaintiffs had not alleged certainly impending or actual injury.
- Plaintiffs moved for reconsideration and for an extension of time to amend; the Court partially granted reconsideration (changed dismissal with prejudice to without prejudice) but denied reconsideration as to breach claims and class-striking; granted a 14-day extension to file an amended complaint.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing to assert breach-of-settlement and covenant claims (New Plaintiffs) | New Pls: as class members they can assert breach because class settlements bind non‑opt‑outs and Rule 23(e) covers class members | Zappos: Rule 23(e) applies only to certified classes; New Pls were not class members at time of negotiations and the alleged settlement is unenforceable | Denied: New Pls lack standing; breach claims dismissed without leave to amend because contract was unenforceable and no literal compliance alleged |
| Prior Plaintiffs' dismissal with prejudice | Prior Pls: dismissal for lack of standing should be without prejudice per circuit precedent | Zappos: dismissal with prejudice justified after repeated failed amendments and because plaintiffs still lack standing | Court granted reconsideration: dismissal converted to without prejudice (Plaintiffs may refile if they later suffer cognizable injury) but denied further leave to amend in this action due to repeated failures |
| Striking class allegations | Pls: reconsideration warranted; invoke Spokeo to argue intangible injuries can be concrete | Zappos: class is overbroad, fails commonality and typicality; plaintiffs allege only speculative future harms | Denied: Spokeo does not change requirement that risk of harm be certainly impending; class remains stricken for being overbroad and not limited to those with actual injury |
| Extension of time to amend | Pls: request 30 days to file an amended complaint conforming to Court's rulings | Zappos: (opposed or not relevant) | Granted in part: Court allowed 14 days from the order date to file an amended complaint |
Key Cases Cited
- Carroll v. Nakatani, 342 F.3d 934 (9th Cir. 2003) (motion to reconsider is an extraordinary remedy)
- School Dist. No. 1J, Multnomah Cnty. v. ACandS, Inc., 5 F.3d 1255 (9th Cir. 1993) (standards for reconsideration)
- Hilton Hotels Corp. v. Butch Lewis Prods., Inc., 808 P.2d 919 (Nev. 1991) (elements for breach of covenant of good faith and fair dealing)
- Fleck & Associates, Inc. v. City of Phoenix, 471 F.3d 1100 (9th Cir. 2006) (dismissal for lack of standing should be without prejudice)
- Brereton v. Bountiful City Corp., 434 F.3d 1213 (10th Cir. 2006) (court lacks authority to adjudicate merits without jurisdiction)
- Steel Co. v. Citizens for Better Environment, 523 U.S. 83 (1998) (court powerless to reach merits without jurisdiction)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (risk of future harm must be certainly impending to establish standing)
- Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (intangible injuries can be concrete but do not relax imminence requirements)
- Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010) (standing in data-breach context requires more than speculative future harm)
- Carvalho v. Equifax Info. Servs., LLC, 629 F.3d 876 (9th Cir. 2010) (leave to amend may be denied for repeated failure to cure)
- Susan B. Anthony List v. Driehaus, 134 S. Ct. 2334 (2014) (clarifies substantial-risk standard for imminence)