Saffron Rewards, Inc. v. Rossie
4:22-cv-02695
N.D. Cal.Jul 25, 2022Background
- Saffron Rewards was co-founded Nov 10, 2021; Alex Rossie was a director and handled technical operations.
- On Nov 10, 2021 Rossie signed a Technology Assignment Agreement assigning all IP to Saffron and agreeing not to use or disclose assigned materials.
- Rossie created numerous third-party "Company Accounts" (domain, Google Workspace, AWS, bank accounts, etc.) and made himself sole administrator; accounts contain confidential data and some company funds.
- Rossie stopped providing services Feb 23, 2022, remained a director until Apr 29, 2022, then allegedly refused to return administrator rights and accessed Google Workspace in late March; he later (Apr 7) allegedly falsely claimed he had returned access.
- Saffron sued May 4, 2022 asserting breach of contract, breach of fiduciary duty of loyalty, breach of implied covenant of good faith and fair dealing, CFAA violation, and conversion; seeks injunctive relief, damages, disgorgement, and fees.
- Court ruled on Rossie’s 12(b)(6) motion: denied dismissal as to breach of contract, fiduciary duty, implied covenant, and conversion; granted dismissal of the CFAA claim with leave to amend.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Breach of contract | Rossie assigned IP and then withheld admin access to Company Accounts, breaching assignment and harming Saffron | Rossie disputes when contractual obligations arose and contends factual issues (e.g., he returned access) | Claim survives; plausible breach and damages alleged |
| Duty of loyalty (director) | As director Rossie owed loyalty and breached it by withholding company property and acting in bad faith to harm Saffron | Rossie says directors have rights to board information and disputes whether access was wrongful while he remained director | Claim survives; factual disputes not resolved at pleading stage |
| Implied covenant of good faith | Agreement impliedly required Rossie not to interfere with Saffron’s receipt of assignment benefits; withholding accounts breached that covenant | Rossie argues the contract covers the conduct and implied covenant cannot duplicate breach claim | Claim survives; Agreement silent on account-access return, so implied covenant plausible |
| CFAA (18 U.S.C. §1030) | Rossie intentionally accessed protected computers without authorization and caused loss exceeding $5,000 | Rossie contends he retained authorization as director and disputes that Saffron pleaded CFAA-type technological loss | Claim dismissed with leave to amend; complaint fails to allege CFAA "damage" or statutory "loss" within narrow parameters |
| Conversion | Rossie wrongfully exercised dominion over Company Accounts containing Saffron property and confidential information | Rossie argues access was not wrongful while he was director and conversion cannot merely restate contract duties | Claim survives; not duplicative of contract where agreement is silent about account access |
Key Cases Cited
- VLIW Tech., LLC v. Hewlett-Packard Co., 840 A.2d 606 (Del. 2003) (elements of breach of contract under Delaware law)
- Cede & Co. v. Technicolor, Inc., 634 A.2d 345 (Del. 1993) (directors owe fiduciary duty to act in best interests of corporation)
- In re Walt Disney Co. Derivative Litig., 906 A.2d 27 (Del. 2006) (presumptions about directors acting in good faith and how to rebut them)
- Dunlap v. State Farm Fire & Cas. Co., 878 A.2d 434 (Del. 2005) (scope of implied covenant of good faith and fair dealing)
- Nemec v. Shrader, 991 A.2d 1120 (Del. 2010) (courts must assess parties' reasonable expectations and not rewrite contracts)
- Van Buren v. United States, 141 S. Ct. 1648 (U.S. 2021) (definition of "exceeds authorized access" and limits on CFAA scope)
- Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016) (two ways to violate the CFAA: unauthorized access or authorized access used improperly)
- Andrews v. Sirius XM Radio Inc., 932 F.3d 1253 (9th Cir. 2019) (CFAA has a narrow conception of "loss" focusing on technological harms)
- LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009) (requirements for private CFAA action)