Thomas v. Kimpton Hotel & Restaurant Group, LLC, 3:19-cv-01860-MMC

Background

Plaintiffs (Jake Thomas, Salvatore Galati, Jonathan Martin) booked rooms at Kimpton hotels through Sabre’s Central Reservations system and provided personal identifying information (PII).
Sabre experienced a credential-based breach that exposed customers’ PII; plaintiffs allege Sabre used single-factor authentication and that a multi-factor system would have prevented the breach.
Plaintiffs sued Kimpton (Sabre is not a party), asserting nine state-law claims in a Third Amended Complaint (TAC); the FAC had previously been dismissed with leave to amend.
Plaintiffs allege Sabre acted as Kimpton’s agent and that Kimpton controlled pricing, room availability, Sabre’s website portrayal, and how Sabre would safeguard customer data.
Kimpton moved to dismiss the TAC, arguing (inter alia) insufficient agency allegations, procedural defects, failure to state contractual duties, lack of standing for injunctive relief, and that multiple state consumer-protection statutes lack extraterritorial effect.
The court found the TAC adequately pleaded an agency relationship but dismissed several claims (Second, Fourth, Fifth, Sixth, Seventh, Ninth) and portions of the Eighth; Plaintiffs were given leave to amend by July 17, 2020 and certain claims remained.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Agency / vicarious liability	Sabre operated Kimpton’s online reservation system and thus acted as Kimpton’s agent; Kimpton controlled pricing, availability, website portrayal, and data safeguards	TAC lacks facts showing Sabre was Kimpton’s agent	Court: TAC sufficiently alleges an agency relationship; vicarious liability potentially available
Breach of contract (2nd claim)	Kimpton breached the Sabre–Kimpton agreement intended to benefit customers by failing to require PCI DSS / multi-factor auth	Claim is procedurally improper (new in TAC) and substantively fails: no third‑party beneficiary allegations or contractual duty to require multi‑factor auth	Dismissed as futile (Second Claim dismissed)
UCL (§ 17200) — injunctive relief & restitution (4th claim)	Seek injunction forcing multi‑factor security and restitution (room charges)	No real/immediate threat to support injunctive relief; restitution not shown because room value was received	Dismissed in full (Fourth Claim dismissed)
State consumer‑protection claims (CO, PA, NY, MD — 5th, 6th, 7th, 9th claims)	Kimpton engaged in deceptive practices and misrepresentations; plaintiffs point to where hotels are located	Statutes lack extraterritorial effect; plaintiffs don’t allege the deceptive conduct occurred in those states or that plaintiffs were in those states when deceived	Dismissed for lack of territorial application (Fifth, Sixth, Seventh, Ninth Claims dismissed)
TDTPA / fraud elements (Eighth claim — Texas)	Alleged deceptive statements (e.g., “Your card is safe”) and failure to use multi‑layered security	TDTPA has no extraterritorial effect as to non‑Texas plaintiff (Thomas); for Texas plaintiff (Martin) failure to plead Kimpton’s knowledge of falsity when statements were made	Dismissed as to Thomas; for Martin, fraud‑based portions requiring actual knowledge dismissed, remaining non‑fraud TDTPA allegations may proceed
Remaining claims and amendment	Plaintiffs seek leave to cure defects	Kimpton reserved right to challenge new claims and substantive sufficiency	Court denied dismissal as to First and Third Claims and the non‑fraud portion of Eighth Claim; granted leave to amend by July 17, 2020

Key Cases Cited

Bell Atl. Corp. v. Twombly, 550 U.S. 544 (pleading requires plausibility)
Ashcroft v. Iqbal, 556 U.S. 662 (courts need not accept legal conclusions as facts)
Peredia v. HR Mobile Servs., Inc., 25 Cal. App. 5th 680 (principal may be vicariously liable for agent’s torts)
Mavrix Photographs, LLC v. LiveJournal, Inc., 873 F.3d 1045 (agency: authority and right to control are required)
Balsam v. Tucows Inc., 627 F.3d 1158 (third‑party beneficiary requires contract terms showing intent to benefit third party)
Frances T. v. Village Green Owners Ass’n, 42 Cal.3d 490 (contract rights/duties determined by contract terms)
Cortez v. Purolator Air Filtration Prods. Co., 23 Cal.4th 163 (restitution requires showing value received vs. given)
Korea Supply Co. v. Lockheed Martin Corp., 29 Cal.4th 1134 (UCL remedies limited to injunction and restitution)
City of Los Angeles v. Lyons, 461 U.S. 95 (injunctive relief requires real and immediate threat)
JPMorgan Chase Bank, N.A. v. Orca Assets G.P., L.L.C., 546 S.W.3d 648 (fraud requires knowledge of falsity or reckless assertion)