Crowley v. Cybersource Corp.Crowley v. Cybersource Corp.
MEMORANDUM DECISION AND ORDER
This is а putative class action brought pursuant to the Federal Wiretap Act (“Wiretap Act”),
CyberSource now moves to dismiss Crowley’s first amended complaint (“amended complaint”) for failure to state a claim pursuant to
I.
Crowley filed the amended complaint on behalf of himself and a purported class of persons who “entered into online transactions with Amazon.com prior to August 31, 2000 whosе personal and private information was secretly transmitted, used and/or disclosed by CyberSource and/or Amazon.com without such persons’ authorization or consent.” (Am.ComplJ 56.) Crowley’s allegations arise out of Amazon’s use of CyberSource to verify the identity of a person making a credit card purchase on Amazon’s web site.
Amazon is an online merchant that sells, inter alia, books, CDs, and personal electronics devices over the Internet. Amazon uses CyberSource to verify the identity of persons making credit card purchases on its web site. As noted above, when a person makes a purchase on Amazon’s site, that person transmits his name, address, telephone number, e-mail address, and credit card information to Amazon. Amazon transmits this information to Cy-berSource. CyberSource transmits the information to Amazon’s bank and to the credit card association, which in turn routes the information to the customer’s bank. The customer’s bank responds to the credit card association, informing it that the transaction either has or has not been authorized, and that response is routed to CyberSource. If the transaction has not been authorized, CyberSource notifies Amazon, which cancels the transaction. If the transaction has been authorized, Cy-berSource notifies Amazon, Amazon proceeds with the transaction, and the customer’s bank approves a transfer of funds to Amazon’s bank. (Id. ¶ 32.)
Crowley asserts that Amazon sends Cy-berSource “far more information about Plaintiff and the members of the Class than is necessary to obtain authorization for the proposed purchase.” (Id. ¶34.) He alleges that Amazon sends Cyber-Source “the Intеrnet user’s name, address, phone number, email address and even a description of the type of product being purchased.” (Id.) CyberSource allegedly uses the information as follows:
Defendant CyberSource stores this personally identifiable and confidential information about Plaintiff and the Class Members, without their knowledge or consent, for at least six months for the purpose of creating and maintaining personal profiles on Plaintiff and the Class.
(Id. ¶ 35.) Crowley further asserts that CyberSource, “through its affiliations with entities such as Amazon.com, is able to and does compile historical recоrds on Plaintiff and members of the class, including but not limited to, name, email address, address, phone number, credit card numbers, description of the product purchased and the amount of money expended on online purchases.” (Id. ¶43.) This profile includes information regarding purchases made “at any of the websites of Internet merchants with whom CyberSource has a similar relationship [to that which it has with Amazon].” (Id-¶ 44.)
Prior to August 31, 2000, Amazon posted a Privacy Policy that stated that it was “committed to protecting [its customers’] privacy” and “use[d] the informatiоn [it
Based on this course of conduct, Crowley alleges the following causes of action: (1) interception and disclosure of wire, oral, or electronic communications in violation of the Wiretap Act, against both defendants; (2) violations of the ECPA, against Amazon; (3) unjust enrichment, against both defendants; (4) invasion of privacy, against both defendants; (5) negligence, against both defendants; (6) fraud by concealment, against both defendants; and (7) breach of contract, against Amazon.
Both Amazon and CyberSource filed motions to dismiss, challenging each of the causes of action in the amended complaint pursuant to
II.
A.
Before turning to the motions to dismiss for failure to state a claim, the Court will address Amazon’s motion to dismiss for improper venue pursuant tо
Amazon alleges that a forum selection clause in a contract agreed to by each member of the class applies to this dispute and that the Court must, therefore, dismiss this action for improper venue.
The forum selection clause to which Amazon refers is contained in an agreement entitled the “Participation Agreement,” an agreement to which one had to assent before using Amazon’s “рerson-to-person” transaction services, Amazon Auctions and zShops. These person-to-person transaction services differ from Amazon’s retail sales operation because, when using them, the buyer purchases goods directly from another Amazon user, rather than Amazon itself. Amazon submitted the declaration of Jayashree Kolhatkar, providing that Amazon only used CyberSource for transactions on its Auctions or zShops. Therefore, according to Amazon, the only persons who can complain of CyberSource’s conduct are those who used Auctions or zShops, and each of these persons clicked on the Participation Agreement, thus accepting the forum selection clause.
This argument raises a procedural question regarding definition of the class, because were the Court to accept Amazon’s argument it would narrow the definition of the class at this stage of the litigation. The Court will not, however, reach this question because it finds that the forum selection clause does not apply to the claims in this case. The forum selection clause applies to “any action at law or in equity arising out of or relating to these terms and conditions,” in other words, the terms and conditions of the Participation Agreement.
(See,
Ressmeyer Decl. Ex. A, Participation Agreement. ¶ 17.) The Participation Agreement consists of its terms and conditions and “all policies and guidelines incorporated by reference.”
(Id.
at 1.) The Privacy Policy is referenced in the Participation Agreement, but it is not incorporated by reference.
(Id.
¶ 12.) The claims in this actiоn relate to the Privacy Policy, and not to the Participation Agreement. The amended complaint is based entirely on the use of customers’ credit card and identification information, a sub
B.
1.
A motion to dismiss under
2.
Plaintiff asserts that both Amazon and CyberSource violated the Wiretap Act. His opposition brief makes clear his theory of his Wiretap Act claim:
Amazon intercepted Plaintiffs electronic communications in violation of the Wiretap Act with the tortious purpose of invading Plaintiffs privacy, disclosed those intercepted communications to Cy-berSource in violation of the Wiretap Act, and conspired with CyberSource to use these intercepted communications to compile and store a personal profile of Plaintiff, thereby tortiously invading his privacy.
(Pl.’s Opp’n to Amazon’s Mot. at 1:19-2:1.)
The Wiretap Act proscribes the interception of wire, oral, and electronic communications. It defines “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral communication thrоugh the use of any electronic, mechanical, or other device.”
(a) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication;
(c) intentionally discloses, or endeavors to disclose, to any other person the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection;
(d) intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communiсation, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsectionf.]
It shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.
The Wiretap Act creates both criminal and civil liability for violation of its
The Court finds that the amended complaint fails to allege that Amazon intercepted a communication between it and Crowley within the meaning of the Wiretap Act. The Wiretap Act requires, first, that there be a communication and, second, that there be an acquisition of that communication by an “electronic, mechanical, or other device.”
Crowley’s argument, moreover, would result in an untenable result. Holding that Amazon, by receiving an e-mail, intercepted a communication within the meaning of the Wiretap Act would be akin to holding that one who picks up a telephone to receive a call has intercepted a communication and must seek safety in an exemption to the Wiretap Act. Such a result would effectively remove from the definition of intercept the requirement that the acquisition be through a “device.” Therefore, the amended complaint fails to state a claim against Amazon under thе Wiretap Act, and Amazon’s motion to dismiss that claim is granted.
3.
The Court’s finding that the amended complaint states no Wiretap Act claim against Amazon disposes of any possible use or disclosure case under the Wiretap Act against CyberSource based on Amazon’s interception of communications between Amazon and customers. Crowley’s opposition to CyberSource’s motion to dismiss argues only that CyberSource violated the Wiretap Act by using intercepted information:
Plaintiff has adequately alleged that Amazon.com intercepted Plaintiffs electronic communications in violation of the Wiretap Act. The only question is whether CyberSource’s use of this intercepted information was in violation of the Wiretap Act.
(Pl.’s Opp’n to CyberSource’s Mot. at 6:7-10.) Thus, Crowley’s claim against Cyber-Source rises and falls on whether Cyber-Source used information intercepted by Amazon. Amazon did not intercept the information transmitted to it, and Crowley’s claim against CyberSource fails. Cy-berSource’s motion to dismiss the claims for violation of the Wiretap Act is granted.
Next, Crowley alleges that Amazon violated the ECPA. He alleges that:
Amazon.com ... intentionally accessed without authorization and/or intentionally exceeded its authorization to access Plaintiffs and the Class’ computer systems through which electronic communications systems 1 are provided]/]
(Am.CompU 63.) Further, he alleges that Amazon:
obtained access to [Crowley’s and purported class members’] wire and electronic communications while in electronic storage in such computer systems and/or knowingly divulged the contents of such communications while in electronic stоrage[.]
(Id.)
Thus, this cause of action is based on two provisions of the ECPA: the one addressing unauthorized access to facilities through which electronic communication services are provided, and the other addressing disclosure of information by persons or entities providing electronic communication services and remote computing services to the public. The Court will first address the applicability of the second provision, which deals with disclosure by service providers.
The ECPA provides that, with certain exceрtions, a person or entity providing either an electronic communication service or remote computing service to the public shall not “knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service^]”
The amended complaint alleges that Amazon is an online merchant, not an electronic communication service provider. In an effort to save this claim, Crowley argues that Amazon is an electronic communication service provider because it receives electronic communications from customers, saying that “without recipients such as Amazon.com, users would have no ability to send electronic information.” (Pl.’s Opp’n to Amazon’s Mot. at 4:12-13.) This argument was expressly rejеcted in
Andersen Consulting LLP v. UOP,
[T]he fact that Andersen could communicate to third-parties over the Internet and that third-parties could communicate with it did not mean that UOP provided an electronic communication service to the public.... UOP must purchase Internet access from an electrоnic communication service provider ...; it does not independently provide such services.
Id. at 1043. The Court agrees with Andersen Consulting, and rejects the argument that because Amazon receives emails from Crowley it provides an electronic communication service. Additionally, such a definition would equate a user with a provider and, thus, ignore language in § 2701(c) that treats users and providers as different.
If Crowley is to state a claim for relief under the ECPA, therefore, that
These provisions, which govern unauthorized access to stored communications, found at
(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility;
and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system[.]
Subsection (c) of the statute provides that subsection (a) does not apply “to conduct authorized” “(1) by the person or entity providing a wire or electronic communications service; [or] (2) by a user of that service with respect to a communication of or intended for that user[.]”
Crowley argues both that the facility to which Amazon gained unauthorized access was his computer (Am.ComplY 63) and that the facility was Amazon’s own computer system:
The “facility” at issue in this case is Amazon.com’s own computer system, which stores and holds Plaintiffs and the Class’ personally identifiable and confidential information. This facility, through which Amazon provided an eleсtronic communications service, is protected against unauthorized access under the Stored Communications Act.
(Pl.’s Opp’n at 4:6-8 (citation omitted) (footnote omitted).) The Court will address both assertions, starting with the one found in the amended complaint.
First, the Court notes that the success of Crowley’s argument depends on a holding that computers of users of electronic communication service, as opposed to providers of electronic communication service, are considered facilities through which such service is provided. This argument seems destined to failure, especially in light of the fact that all one needs to render access to such a facility authorized is consent by a provider of an electronic communication service. See 18 U.S.C. 2701(c)(1). It would certainly seem odd that the provider of a communication service could grant access to one’s home computer to third parties, but that would be the result of Crowley’s argument. The Court, however, need not treat this question any further, because the Court finds no unauthоrized access to have occurred.
The allegations of the amended complaint do not demonstrate that Amazon accessed Crowley’s computer. Although Crowley makes a conclusory allegation to that effect, the Court is not bound to accept such an allegation in ruling on a motion to dismiss pursuant to
Crowley’s second argument in support of his unauthorized access clаim, which is that Amazon had limited access to its own systems, strains credulity. First, Crowley cites no authority in support of this argument. Second, a very similar argument was rejected by the court in
State Wide Photocopy Corp. v. Tokai Financial Services, Inc.,
Amazon’s motion to dismiss Crowley’s ECPA claim is granted.
D.
The Court now turns to the remaining state claims.
1.
Amazon argues that the Court is prevented from hearing state law claims by the dormant commerce clause. Amazon cites to cases holding state statutes unconstitutional on the grounds that only Congress may enact legislation regarding the Internet. For example, in
American Libraries Association v. Pataki,
2.
The Court, however, will not exercise supplemental jurisdiction over the remaining state law claims. With the exception of the invasion of privacy and negligence claims as stated against CyberSource, which the Court was forced to reach to determine the viability of Crowley’s Wiretap Act claim against CyberSource, the Court dismisses Crowley’s state claims without prejudice for lack of jurisdiction.
Section 1367 of Title 28 of the United States Code, provides that distriсt courts may exercise supplemental jurisdiction over all other claims “that are so related to claims in the action within such original jurisdiction that they form part of the same case or controversy under Article III[.]”
The decision to dismiss the remaining state claims without prejudice rests on another factor from
III.
Accordingly,
IT IS HEREBY ORDERED that:
1. Amazon’s motion to dismiss for improper venue is denied.
2. Amazon’s and CyberSource’s motions to dismiss Crowley’s first cause of action for violation of the Wiretap Act are granted, with leave to amend on or before September 21, 2001.
3. Amazon’s motion to dismiss the second cause of action for violation of the ECPA is granted, with leave to amend on or before September 21, 2001.
4.Crowley’s remaining state claims for relief are dismissed without prejudice, based on the Court’s finding that it should not exercise supplemental jurisdiction over them.
Notes
. As the ECPA refers to “electronic communication services,” and not to "electronic communications systems,” the Court will address this allegation as if it used the word "service” rather than "system.”
. The court also rejected the argument that the fax machines and computers constituted facilities through which an electronic communication service was provided, saying the company "is in the business of financing and ... merely uses fax machines and computers as necessary tools[.]”
State Wide Photocopy,