ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS’ MOTION TO DISMISS PLAINTIFFS’ CONSOLIDATED CLASS ACTION COMPLAINT
Presently before the Court are (1) Defendants’ Motion to Dismiss Plaintiffs’ Consolidated Class Action Complaint; and (2) Defendants’ Supplemental Request for Judicial Notice. [Doc. 94.] Plaintiffs filed an opposition, [Doc. No. 107], and Defendants filed a reply, [Doc. No. 114]. The Court held a hearing on the motion on Thursday, September 27, 2012.
BACKGROUND
I. Factual Background
This action arises out of a criminal intrusion into the computer network system used to provide PlayStation Network (“PSN”) services. Plaintiffs, a putative consumer class, allege that Sony Computer Entertainment America, LLC (“SCEA”), Sony Network Entertainment International, LLC and Sony Network Entertainment America, Inc. (collectively, “SNE”), Sony Online Entertainment, LLC (“SOE”), and Sony Corporation of America (“SCA”) (collectively, “Sony” or “Defendants”) failed to follow basic industry-standard protocols to safeguard its customers personal and financial information, thereby creating foreseeable harm and injury to the Plaintiff class.
Sony develops and markets the PlayStation Portable (“PSP”) hand-held device and the PlayStation 3 (“PSP”) console (collectively, “consoles”).
When establishing accounts with PSN, Qriocity, and SOE, Plaintiffs and other Class members were required to provide personally identifying information to Sony, including their names, mailing addresses, email addresses, birth dates, credit and debit card information (card numbers, expiration dates and security codes) and log-in credentials (“Personal Information”),
Plaintiffs allege that on April 16 or 17, 2011, hackers accessed Sony’s Network, stealing the Personal Information of millions of Sony customers, including Plaintiffs and the other Class members (the “Data Breach”). [Id. ¶ 46.] On April 17, 2011, Sony discovered that PSN and Qriocity user data had been stolen. [Id. ¶ 51.] Three days later, Sony took the PSN and Qriocity offline, stating that “[w]e’re aware certain functions of PlayStation Network are down. We will report back here as soon as we can with more information.” [Id. ¶ 52.] As a result of the Data Breach, Sony was forced to shut down the PSN and Qriocity for almost a month while it conducted a systems audit to determine the cause of the data breach. [Id. ¶ 97.] Meanwhile, SOE remained offline for more than two weeks. During this prolonged downtime, Plaintiffs and the other Class members were unable to access PSN, Qriocity, and SOE, unable to play multiplayer online games with others, and unable to use online services available through the PSN, Qriocity or SOE. Plaintiffs and the other Class members were also unable to access and use prepaid Third Party Services. [See Id. ¶¶ 9-11, 14, 98.]
Between April 21 and April 25, 2011, while the PSN and Qriocity remained offline, Plaintiffs claim Sony continued to misrepresent the circumstances of the breach. [Id. ¶¶ 54-55, 58.] It was not until April 26, 2011, that Sony finally told the public that the personal information had been taken. [Id. ¶ 59.] Shortly thereafter, Sony admitted that its failures “may have had a financial impact on our loyal customers. We are currently reviewing options and will update you when the service is restored.” [Id. ¶ 60.] Sony also conceded that “[s]ome games may require access to PSN for trophy sync, security checks or other network functionality and therefore cannot be played offline.” [Id.] On May 12, 2011, Sony announced that it would compensate SOE users in the United States by offering free identity theft protection services, certain free downloads and online services, and “will consider” helping customers who have been issued new credit cards. [Id. ¶ 66.]
Plaintiffs further allege that Sony knew, or should have known, that its security measures were inadequate and that its network was vulnerable to attack because its network had been previously compromised. In 2011, after a PS3 user successfully “jailbroke” his PS3 console and posted instructions for doing it, Sony sued him to chill others from doing the same.
II. Procedural History
This case is before the Court pursuant to 28 U.S.C. § 1407. On August 16, 2011, the Judicial Panel on Multi-District Litigation transferred certain civil actions from multiple district courts across the country into one consolidated action. [Doc. No. 1.] On November 11, 2011, this Court appointed a Liaison Counsel and a Plaintiffs’ Steering Committee (“PSC”) to streamline the process. [Doc. No. 61.] Thereafter, Plaintiffs were informed that the PSC should file a Consolidated Complaint on behalf of all Plaintiffs, and the Defense could respond to the Consolidated Complaint. [Doc. No. 63.] Plaintiffs filed their Consolidated Class Action Complaint on January 31, 2012, [Doc. No. 78], and Defendants filed the instant motion to dismiss, [Doc. No. 94].
LEGAL STANDARDS
1. Motion to Dismiss Under Rule 12(b)(1)
A Rule 12(b)(1) motion to dismiss tests whether a complaint alleges grounds for federal subject matter jurisdiction. If the plaintiff lacks standing under Article III of the U.S. Constitution, then the court lacks subject matter jurisdiction, and the case must be dismissed. See Steel Co. v. Citizens for a Better Env’t,
A jurisdictional challenge may be facial or factual. Safe Air for Everyone v. Meyer,
II. Motion to Dismiss Under Rule 12(b)(6) and Rule 9(b)
A complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a) (2009). A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of the claims asserted in the complaint. Fed.R.Civ.P. 12(b)(6); Navar
To avoid a Rule 12(b)(6) dismissal, a complaint need not contain detailed factual allegations; rather, it must plead “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly,
But “[w]hen there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief.” Id. at 1950. A claim has “facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 1949 (citing Twombly,
Complaints alleging fraud must satisfy the heightened pleading requirements of Federal Rule of Civil Procedure 9(b). Rule 9(b) requires that in all averments of fraud or mistake, the circumstances constituting fraud or mistake shall be stated with particularity. Malice, intent, knowledge, and other conditions of a person’s mind may be allеged generally. A pleading is sufficient under Rule 9(b) if it “state[s] the time, place and specific content of the false representations as well as the identities of the parties to the misrepresentation.” Misc. Serv. Workers, Drivers & Helpers v. Philco-Ford Corp.,
Regardless of the title given to a particular claim, allegations grounded in fraud are subject to Rule 9(b)’s pleading
III. Leave to Amend
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely given when justice so requires,” bearing in mind “the underlying purpose of Rule 15 to facilitate decision on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith,
SUPPLEMENTAL REQUEST FOR JUDICIAL NOTICE
In support of the instant motion, Sony has requested that the Court take judicial notice of six documents: (1) the SNE PlayStation Network and Qriocity Services Terms of Service and User Agreement (“SNE User Agreement”); (2) the SNE PlayStation Network and Qriocity Services Privacy Policy (“SNE Privacy Policy”); (3) the SCEA Privacy Policy (“SCEA Privacy Policy”); (4) an announcement from SCEA and SNE regarding the PSN service outage, entitled, “Update on PlayStation Network and Qriocity” (“Announcement Update”); (5) a CNET article by author Erica Ogg, entitled, “Sony to Restore PSN Services, Compensate Customers” (“CNET Article”); and (6) a published guidance from the California Office of Privacy Protection (“Privacy Protection Guidelines”). Plaintiffs only oppose the Privacy Protection Guidelines, arguing admission of the document is inappropriate on a motion to dismiss as it admits facts outside the pleadings.
Rule 201 of the Federal Rules of Evidence allows courts to take judicial notice of matters that are “capable of accurate and ready determination by resort to sources whose accuracy cannot reasonably be questioned.” Fed.R.Evid. 201(b). The Court may take judicial notice on a motion to dismiss under Rule 12(b)(6). Lee v. City of Los Angeles,
Although the Privacy Protections Guidelines are also subject to judicial notice because they can be downloaded from a public agency’s website, the document cannot be used as proof of the matters asserted therein. See Cachil Dehe Band of Wintun Indians of the Colusa Indian Comm’ty v. Cal.,
DISCUSSION
Sony moves to dismiss Plaintiffs’ Consolidated Complaint on the following grounds: (1) Plaintiffs lack standing to assert causes of action against SOE and SCA; (2) Plaintiffs lack Article III standing as to all Defendants; (3) Plaintiffs fail to state a claim for negligence because they have not alleged any cognizable injury; (4) Plaintiffs fail to state a claim under the UCL, FAL, or CLRA, as to both non-resident class members and resident class members; (5) Plaintiffs’ UCL and FAL claims fail for lack of any basis to award restitution or injunctivе relief; (6) Plaintiffs’ CLRA claim independently fails because it is inapplicable to the transaction at issue; (7) Plaintiffs’ claim under the Database Breach Act fails both as to the non-resident class members and to resident class members as a matter of law; (8) Plaintiffs fail to state a claim for Unjust Enrichment because there is no such independent cause of action in California; and (9) Plaintiffs fail to state a claim for bailment because the relationship and transaction necessary to support a claim does not exist in this case. The Court addresses each ground for dismissal in turn.
I. Article III Standing
Sony challenges Plaintiffs’ Article III standing to bring the present action. Presumably, Sony does so under Fed.R.Civ.P. 12(b)(1), which allows dismissal of an action for lack of subject matter jurisdiction. Chandler v. State Farm Mut. Auto. Ins. Co.,
To establish Article III standing, Plaintiffs must demonstrate that they satisfy three requirements: (1) they have suffered an “injury in fact,” i.e., “an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical;” (2) the injury is “fairly traceable to the challenged action of the defendant;” and (3) it is “likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision.” Lujan v. Defenders of Wildlife,
Plaintiffs bear the burden of establishing standing. Lujan,
Here, Sony’s standing argument is twofold. First, Sony contends the named plaintiffs fail to allege any basis for standing against SOE and SCA; and second, Plaintiffs fail to allege an “injury in fact” or establish there is a “casual connection” between the alleged misconduct and a “legally protected interest.”
1. Standing to Assert Claims Against SOE and SCA
Sony first argues that the named Plaintiffs lack standing and fail to state any claim as to two of the Sony Defendants— SOE and SCA — and that the Consolidated Complaint should be dismissed in its entirety as to them. Specifically, Sony contends that none of the named Plaintiffs alleges that he/she was a registered user with the SOE Network, provided any information to SOE, or had any subscriptions with SOE. Likewise, the Consolidated Complaint references SCA only in Paragraph 19, and alleges nothing more than that the other defendants are SCA’s subsidiaries. Plaintiffs respond, stating that because “Defendants acted together by contributing to Sony’s failure to secure its Network,” all Defendants are equally liable for the Data Breach. [Doc. No. 107, 9.] Plaintiffs further attempted to bolster this allegation at the motion hearing by stating that all the Defendants work together to provide a specific product, and that SCA was the entity responsible for selling Sony devices in the United States. Finally, Plaintiffs also acknowledged at the hearing that although no current Class representatives subscribe to SOE, such defect could be remedied by adding an additional named Class representative.
On consideration of the parties moving papers and oral arguments advanced at the hearing, the Court finds that Plaintiffs have failed to currently allege any basis for standing against SOE or SCA. See, e.g., Easter v. Am. West Fin.,
2. Injury in Fact and Causal Connection as to All Defendants
Second, Sony claims the named Class representations lack standing with respect to all Defendants for failure to allege any injury-in-fact or causal connection between the alleged misconduct and a legally protected interest. With respect to injury-in-fact, Sony argues that exposure of personal information alone does not constitute Article III standing because Plaintiffs have not alleged that the Data Breach resulted in the theft of their identities or unauthorized use of their Personal Information. Moreover, the only two named Class members who have alleged a cognizable loss-Mr. Johnson and Mr. Howe — fail to show that they were either required to pay out-of-pocket for the fraudulent charges or why standing can be generated merely by spending money on perceived preventive measures. Specifically, Sony states that Johnson does not allege that the unauthorized charges resulted from the Data Breach, or that he was required to pay out-of-pocket for the charges, and that Howe fails to allege “actual” misuse of his data, or what it means that his account was “compromised.”
Conversely, Plaintiffs argue that the mere exposure of their Personal Information is enough to satisfy the injury-in-fact requirement because such exposure has subjected them to an increased risk of identity theft and fraud. Additionally, Plaintiffs contend that Class members have suffered more than just an “exposure of their personal information,” аs alleged by Sony, because they were injured as a result of Sony’s month-long SOS shutdown, the loss of use of their hardware (thereby diminishing its value), the loss of use of the PSN, and the loss of use of prepaid Third Party Services.
On the issue of Article III standing, both Sony and Plaintiffs point to Krottner v. Starbucks Corp.,
In Krottner, Plaintiffs were Starbucks employees whose personal information, including names, addresses, and social security numbers were compromised as the result of the theft of a company laptop. Krottner,
Here, the Court finds Plaintiffs have articulated sufficient particularized and concrete harm to sustain a finding of injury-in-fact at this stage in the pleadings. Similar to the plaintiffs in Krottner, Plaintiffs allege that their sensitive Personal Information was wrongfully disseminated, thereby increasing the risk of future harm. Thus, even though Sony alleges no harm has yet occurred, in certain circumstances, as the Court finds pertinent here, future harm may be regarded as a cognizable loss sufficient to satisfy Article Ill’s injury-in-fact requirement. See Krottner,
With respect to the “causal connection” requirement under Article III, Sony contends Plaintiffs do not allege that they relied upon any promise by Sony of unin
Here, as stated above, Plaintiffs’ Consolidated Class Action Complaint is sufficient to support the causal connection element of Article III at this early stage in the proceedings. As the Supreme Court has noted, the evidence required to support or oppose Article III standing will necessarily increase as the litigation progresses. See Lujan,
II. Motion to Dismiss
The Court next addresses the sufficiency of each of Plaintiffs’ seven claims below, largely in the order they were raised in Sony’s motion to dismiss, beginning first with Plaintiffs’ negligence claim. Moreover, because Plaintiffs allege three causes of action that arise under various California consumer protection statutes, with similar pleading requirements — the UCL, FAL, and CLRA — the Court will address issues common to those three claims, and will next discuss issues specific to each individual claim. Finally, the Court will address Plaintiffs’ allegations under California’s Database Breach Act, and unjust enrichment and bailment causes of action.
A. Negligence Claim (Sixth Cause of Action)
Under California law, the elements of a negligence cause of action are: (1) the existence of a duty to exercise due care; (2) breach of that duty; (3) causation; and (4) damages. Paz v. California,
1. Economic Loss Doctrine
Sony presented substantial support in its moving papers and at the motion hearing to advance its contention that the economic loss doctrine bars Plaintiffs’ negligence claim. According to Sony, Plaintiffs’ damages consist entirely of “economic damages” associated with “credit monitoring, loss of use and value of [PSN] services, lоss of use and value of prepaid Third Party Services, and diminution of the value of their PS3s and/or PSPs.” [Doc. No. 78 ¶ 180.] Furthermore, Sony claims courts in numerous other data breach cases have recognized that such economic losses are not recoverable under a negligence theory.
Conversely, Plaintiffs assumed, without adequately arguing in either its moving papers or at the motion hearing, that the doctrine is inapplicable to the case at bar.
Under the economic loss doctrine, a plaintiffs tort recovery of economic damages is barred unless such damages are accompanied by some form of physical harm (i.e., personal injury or property damage).
In the present case, although Plaintiffs stated at the motion hearing that the applicability of the economic loss doctrine is contingent on whether the negligence claim arises out of a contract for services, as opposed to a contract for the sale of goods or products, the Ninth Circuit has disregarded such a rudimentary distinction. Id. In doing so, the Ninth Circuit stated that if they were to “hold that the economic loss rule does not apply to a claim grounded in the performance of services, the district court must still apply the six criteria set forth in J'Aire to justify recovery of economic loss caused by the negligent performance of a contract.” See
Therefore, the economic loss rule will not bar Plaintiffs’ negligence claim so long as Plaintiffs can satisfy the multifactor “special relationship” test applied in J'Aire, or can set forth some other common law exception to the rule. See J'Aire,
2. Cognizable Injury
Second, Sony argues that even if Plaintiffs’ claim is not barred by the economic loss doctrine, the damages element of a negligence action requires Plaintiffs to show they have suffered some cognizable injury. Here, as discussed above, no Plaintiff alleges any identity theft or unauthorized use of his information causing a pecuniary loss. Sony claims courts have consistently held that mere allegations of exposure of a plaintiffs personal information are insufficient to establish a cognizable injury.
Under California law, appreciable, nonspeculative, present harm is an essential element of a negligence cause of action. Aas v. Super. Ct.,
While Plaintiffs have currently alleged enough to assert Article III standing to sue based on an increased risk of future harm, the Court finds such allegations insufficient to sustain a negligence claim under California law. See Krottner v. Starbucks Corp.,
Plaintiffs alterative grounds for cognizable loss fail for similar reasons. First, Plaintiffs fail to assert a plausible argument, in light of the PSN Terms and Service Agreement to which all Plaintiffs assented to, establishing a separate and distinct duty to provide continuous and uninterrupted service to either the PSN or prepaid Third-Party Services. Blanket assertions that Sony “represented that access to the PSN was a feature of the PSP and PS3” fail to justify a separate and distinct duty of care, and thus fall short of what is required. See Erlich v. Menezes (1999)
3. Allegations of Negligent Conduct Fail to Satisfy Iqbal and Twombly
Third, Sony argues that Plaintiffs’ allegations of negligent conduct and breach of duty fail to satisfy Iqbal and Twombly because they are conclusory and specula
Although Sony’s arguments may be availing at a later juncture, at this stage in the procеedings Sony’s arguments generalize and mischaracterize Plaintiffs’ claims, especially since Plaintiffs allege that Sony knew of potential problems and failed to implement reasonable safeguards. Thus, because Plaintiffs do not need to prove that Sony’s conduct was in fact negligent, or that they did in fact have inadequate safeguards, Plaintiffs have satisfied their burden. Accordingly, the Court finds Plaintiffs have satisfied the requirements of Iqbal and Twombly with respect to their negligence claim. However, because Plaintiffs’ negligence claim fails for the reasons set forth above, the Court DISMISSES Plaintiffs negligence claim with leave to amend.
B. Consumer Protection Claims (First, Second, and Third Causes of Action)
Plaintiffs assert various claims under California’s consumer protection statutes alleging violations of the Unfair Competition Law (“UCL”), False Advertising Law (“FAL”), and the Consumers Legal Remedies Act (“CLRA”), all of which are based on Sony’s alleged misrepresentations that affected Plaintiffs’ access to the Sony Network and disclosure of their Personal Information. In response, Sony asserts that Plaintiffs’ consumer claims fail as to nonresident named Class members because the alleged misrepresentations occurred outside of California. Additionally, Sony alleges Plaintiffs’ claims fail as to resident Class members because Plaintiffs lack standing, they have failed to allege their claims with sufficient particularity, there is no basis for restitution or injunctive relief, and the CLRA is inapplicable to the transaction at issue. Each basis for dismissal is discussed in turn.
1. Non-Resident Named Plaintiffs
Sony first argues that Plaintiffs’ claims under the UCL, FAL, and the CLRA must be dismissed as to the non-resident named Plaintiffs. This argument is inline with the Ninth Circuit’s holding in Mazza v. American Honda Motor Co., wherein the court found that for claims sounding in misrepresentation, the governing consumer protection statute is that of the state where the misrepresentation was received.
2. Standing Under the UCL, FAL and CLRA
Sony next argues that Plaintiffs lack standing to sue under California’s consumer protection statutes because they have not alleged a cognizable injury. To maintain standing under the UCL and FAL, a plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury; and (2) show that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset Corp. v. Super. Ct.,
Although the requirements of federal standing under Article III and the requirements of standing under California’s consumer protection statutes overlap, there are important differences. See Troyk v. Farmers Grp., Inc.,
Plaintiffs allege they have standing under the UCL, FAL, and CLRA because (1) their Personal Information was compromised; (2) they lost use of their consoles as a result of an interruption in PSN Services; (3) they lost use of Third-Party Services; and (4) they suffered a diminution in value of their PS3s and PSPs. Sony contends that none of Plain
First, Plaintiffs’ allegations that the heightened risk of identity theft, time and money spent on mitigation of that risk, and property value in one’s information, do not suffice as injury under the UCL, FAL, and/or the CLRA. See In re iPhone Application Litigation, No. 11-MD-02250LHK,
Second, Plaintiffs’ contentions that the interruption of PSN Services and the Data Breach caused damage to the value of their consoles are simply too speculative to constitute “lost money or property.” In order to have “lost money or property” a plaintiff must demonstrate some form of economic injury. Kwikset,
Finally, Plaintiffs’ claims of diminution in value of their consoles and/or loss of use of prepaid Third-Party Services also fail to establish a loss of money or property. As reaffirmed at the motion hearing, none of the named Class members assert their consoles are somehow defective after the PSN was restored, nor do any Class members assert they value their consoles less as a result of the Data Breach. Moreover, with regard to the loss of Third-Party Services, Plaintiffs have not alleged they were unable to access such services through an alternative medium, even if the PSN was a more preferable medium. Therefore, because none of the named Plaintiffs subscribed to premium PSN services, and thus received the PSN services free of cost, Plaintiffs have not alleged “lost money or profits.”
3. The UCL, FAL, and CLRA Claims Must be Plead with Particularity
Even if the named Plaintiffs have standing, Sony argues they have failed to allege the UCL, FAL, and CLRA violations with
Plaintiffs do not contest that Rule 9(b) applies to their consumer claims. Instead, Plaintiffs allege they have satisfied the requirements of the Rule 9(b) because they have sufficiently plead “what is false and misleading about the statement and why the statement is false.” See Cooper v. Pickett,
i. Actionable Statements that are “Likely to Deceive”
The Consolidated Complaint alleges that Sony violated the UCL, FAL, and CLRA by: (1) misrepresenting the quality of its Network security; (2) misrepresenting it would take “reasonable measures” to protect consumers’ Personal Information; (3) misrepresenting that the PS3s and PSPs could access PSN online services; (4) misrepresenting that the PS3s and PSPs would be able to connect to Qriocity, SOE, and other Third Party Services such as Netflix; and (5) failing to disclose that its Network was unsecure. (Doc. No. 78 ¶¶ 120, 122, 123, 133, 134, 135, 144, 146.). Sony argues that none of these statements are likely to deceive the reasonable consumer.
“To state a claim under the [UCL and FAL] one need not plead and prove the elements of a tort. Instead, one need only show that ‘members of the public are likely to be deceived.’ ” Bank of the West,
Here, Plaintiffs have failed to sufficiently plead statements that would likely deceive the reasonable consumer. First, Sony never represented that the PSPs and PS3s would “always” be аble to access the internet and/or connect to other online services. Instead, similar to the service agreement in Janda v. T-Mobile, which informed consumers who purchased the phone that the “monthly service rate excludes taxes and surcharges,” the SNE Terms of Service explicitly disclaimed that “continuous and uninterrupted” access to the PSN was a feature of Plaintiffs consoles.
Furthermore, Plaintiffs’ claim that Sony misrepresented the quality of its Network Security fails for similar reasons. Before registering for the PSN all Plaintiffs had to agree to Sony’s Privacy Policy, which states that “there is no such thing as perfect security ... we cannot ensure or warrant the security of any information transmitted to us through the [the PSN] ...” Thus, in the presence of clear admonitory language that Sony’s security was not “perfect,” no reasonable consumer could have been deceived. Cf Schnall v. The Hertz Corp.,
ii. Reliance
Sony further alleges that even if Plaintiffs properly alleged actionable deceptive statements, their claims under the UCL, FAL, and CLRA fail because they have not shown actual reliance.
For fraud-based claims under all three consumer statutes the named Class members must allege actual reliance to have standing.
Here, the Consolidated Complaint alleges that Plaintiffs acquired their consoles before consenting to Sony’s Privacy Policy and Terms of Service Agreement, which Plaintiffs allege contain the alleged misrepresentations. Indeed the named Class members contend that they created their PSN accounts — and thus assented to the Terms of Sony’s Terms of Service and Privacy Policy — after they acquired their consoles. Thus, even if the Court found Sony’s alleged misrepresentations material, because Plaintiffs had already purchased or otherwise acquired their consoles when the alleged misrepresentations were made, reliance on such statements in
4. Basis for Restitution and Injunctive Relief under the UCL and FAL
Sony next contends that Plaintiffs’ UCL and FAL claims fail to establish any entitlement to restitution or injunctive relief, which are the only remedies available to a UCL and FAL claimant. With regard to restitution, Sony argues Plaintiffs are not entitled to such relief because Plaintiffs paid monies to third parties-not Sony-any loss of value over the lifetime of the consoles or services did not accrue to Sony, and Sony offered free premium services for the period of interrupted services. Furthermore, with regard to injunctive relief, Sony argues Plaintiffs have failed to state what injunctive relief, if any, they are entitled to, or how such relief would be warranted as there is no continuing wrong that needs to be rectified. The Court is inclined to agree.
Although Plaintiffs seek to justify restitution on the ground that the remedy is permitted to “compel a defendant to return money obtained through an unfair business practice to persons in interest from whom the property was taken,” the remedy requires a corresponding benefit to the defendant. See Trew v. Volvo Cars of N. Amer., No. CIV-S-05-1379,
With regard to injunctive relief, Plaintiffs allegations are conclusory in that they argue relief should be granted because they have been injured by Sony’s conduct. However, such assertions fail to specify the relief they seek, or even the basis on which they seek it.
5. Applicability of the CLRA
In addition to the deficiencies in Plaintiffs’ CLRA claim noted above, Sony also asserts that Plaintiffs have (1) failed to comply with the statute’s procedural notice requirements; and (2) failed to allege an intent to “sell or lease” a “good or service” as required under the statute.
i. CLRA Affidavit Requirement
As a prerequisite to seeking damages under the CLRA, a plaintiff is required to provide notice to the defendant of the alleged statutory infraction, and a demand to rectify the alleged violation.
Here, adequate notice was given. The Consolidated Complaint alleges that on June 8, 2011, Plaintiff Johnson mailed Sony notice in writing, and that the notice expressly set forth the nature of the dispute and declared that damages would be sought if the appropriate corrections were not made. After Sony failed to respond, Plaintiffs instituted the current action. Furthermore, in compliance with Cal. Civ.Code § 1780(d), Plaintiff Johnson attached his affidavit to his complaint, which stated that San Diego County is an appropriate venue. See ECF No. 1-1 (Case 3:11-cv-01268-BTM-WMC). Because the CLRA notice requirement is intended to provide the defendant with an opportunity to cure its conduct and avoid an action for damages, the Court finds Johnson’s letter and affidavit satisfy the requirements under § 1780(a) and (d). See Stearns v. Ticketmaster Corp.,
ii. Applicability of the CLRA to the Transactions at Issues
California’s Consumers Legal Remedies Act (“CLRA”) establishes a nonexclusive statutory remedy for unfair methods of competition and unfair or deceptive acts or practices undertaken by any person in a transaction intended to result or which results in the sale or lease of goods or services to any consumer. McAdams v. Monier, Inc.,
In the Consolidated Complaint, Plaintiffs allege Sony violated the CLRA by inducing Plaintiffs and other consumers to purchase PS3s and PSPs, by inducing
First, although the CLRA does not require a contractual relationship between the consumer and the defendant, the transaction must result or be intended to result in the sale or lease of goods or services to a consumer. See McAdams,
Even if the Court found the transaction resulted in a sale or lease, Plaintiffs’ CLRA claim would fail because the PSN is not a good or service as defined under the statute. “Services” within the context of the CLRA are defined as “work, labor, and services other than a commercial or business use, including services furnished in connection with the sale or repair of goods.” Cal. Civ.Code § 1761(b). “Goods” are defined as “tangible chattels.” Id. § 1761(a). Here, Plaintiffs unavailing argue that the present action fits within the CLRA because “Sony sold PSPs and PS3s, intending them to be used with the PSN and other online services.” However, this does nothing to prove that the shutdown of the PSN, which is the basis for Plaintiffs’ claim, is a good or service as defined by the CLRA. Furthermore, California law is clear that software is not a tangible good or service for the purposes of the CLRA. In Ferrington v. McAfee, Inc., 10-CV-01455-LHK,
C. California Civil Code Section 1798.80 “Breach Act” (Fourth Cause of Action)
Sony next argues that Plaintiffs have failed to state a claim under the California Database Breach Act, Cal. Civ.Code §§ 1798 et seq. (“the Breach Act”), because: (1) the notice provided was timely as a matter of law; (2) no statutory personal information is alleged; (3) Plaintiffs have failed to allege they were injured as a result; and (4) the claim is barred as to non-resident Plaintiffs.
First, Sony claims that its disclosure of the breach was timely as a matter of law bеcause the statute does not require notifi
As to Sony’s remaining allegations, because the Court has already found that Plaintiffs have alleged enough “cognizable injury” to assert standing under Article III, and the parties have not alerted the Court to any case law defining “injury” under the statute, nor did the Court find any through its own independent research, the Court finds Plaintiffs’ allegations of “injury” sufficient. The same is true regarding whether or not Plaintiffs have sufficiently alleged theft of personal information to fall within the purview of the statute. Finally, although Plaintiffs try once again to save the claims of nonresident Plaintiffs, the Breach Act is clear that it applies only to “ensure the personal information [of] California residents [is] protected.” Cal. Civ.Code § 1798.81.5(a).
Finally, although neither party alerted the Court to such in their moving papers, or at oral argument, under Section 1798.84(d), “Unless the violation is willful, intentional, or reckless, a business that is alleged to have not provided all the information required by subdivision (a) of Section 1798.83, to have provided inaccurate information, failed to provide any of the information required by subdivision (a) of Section 1798.83, or failed to provide information in the time period required by subdivision (b) of Section 1798.83, may assert as a complete defense in any action in law or equity that it thereafter provided regarding the information that was alleged to be untimely, all the information, or accurate information, to all customers who were provided incomplete or inaccurate information, respectively, within 90 days of the date the business knew that it had failed to provide the information, timely information, all the information, or the accurate information, respectively.” (emphasis added).
D. Unjust Enrichment (Fifth Cause of Action)
Sony moves to dismiss Plaintiffs’ fifth cause of action alleging there is not an independent cause of action for unjust enrichment. Courts consistently have held
E. Bailment (Seventh Cause of Action)
Finally, Sony seeks dismissal of Plaintiffs’ seventh cause of action because the type of relationship and transaction necessary to support a claim for bailment does not exist in this case. The Ninth Circuit, relying on California law, has defined bailment as “the deposit of personal property with another, usually for a particular purpose.” United States v. Alcaraz-Garcia,
Plaintiffs’ claim for bailment fails for several reasons. First, as Plaintiffs freely admit, Plaintiffs’ Personal Information was stolen as a result of a criminal intrusion of Sony’s Network. Plaintiffs do not allegе that Sony was in any way involved with the Data Breach. Rather, Plaintiffs allege that Sony failed to maintain adequate security procedures to protect against this type of theft. Thus, there are no allegations of conversion or any other intentional conduct by Sony that would indicate that Sony sought to unlawfully retain possession of Plaintiffs’ Personal Information.
Second, the Court is hard pressed to conceive of how Plaintiffs’ Personal Information could be construed to be personal property so that Plaintiffs somehow “delivered” this property to Sony and then expected it be returned. If such a legal theory for bailment exists, Plaintiffs have failed to present the Court with such in its Opposition papers.
CONCLUSION
For the reasons set forth above, the Court GRANTS in part and DENIES in part Defendants’ motion to dismiss. Plaintiffs have until November 9, 2012 to file an amended Consolidated Complaint. Specifically, the Court makes the following findings with respect to Defendants’ instant motion:
1. GRANTS Defendants’ supplemental request for judicial notice as to all documents, but not as to the contents of the Privacy Protection Guidelines;
2. GRANTS Defendants’ motion to dismiss for lack of Article III standing as to Defendants SOE and SCA with leave to amend;
3. DENIES Defendants’ motion to dismiss for lack of Article III standing as to the remaining Sony Defendants;
4. GRANTS Defendants’ motion to dismiss as to the Sixth Cause of Action for negligence with leave to amend;
5. GRANTS Defendants’ motion to dismiss as to the First, Second, and Third Causes of Action under the UCL, FAL, and CLRA with prejudice as to non-resident Plaintiffs and Plaintiffs claims for restitution, and with leave to amend with respect to the remaining claims;
6. GRANTS Defendants’ motion to dismiss as to the Fourth Cause of Action under the Breach Act with prejudice as to non-resident Plaintiffs, and with leave to amend as to resident Plaintiffs and all remaining claims;
7. GRANTS Defendants’ motion to dismiss as to the Fifth Cause of Action alleging unjust enrichment with prejudice;
8. GRANTS Defendants’ motion to dismiss as to the Seventh Cause of Action alleging bailment with prejudice.
IT IS SO ORDERED.
Notes
. Timothy Blood, Brian Strange, and Gayle Blatt appeared in person on behalf of the Plaintiffs, and Paul Geller, Adam Levitt, Ben Barrow, and David McKay appeared telephonically on behalf of the Plaintiffs. William Boggs, Amanda Fitzsimmons, Harvey Wolkoff, Dan Routh, and Mark Szpak appeared on behalf of the Defendants.
. As it must, for purposes of the present Motion to Dismiss, the Court accepts as true the factual allegations set forth by Plaintiffs in the Consolidated Complaint.
. On April 1, 2011, SCEA transferred its online PSN and Qriocity service operations to SNEA, including transferring Plaintiffs' and other Class members' Personal Information to SNEA for handling. [Id. ¶ 39.]
. This prompted an Internet activist group known as "Anonymous” to warn Sony in online, public postings, "You have abused the judicial system in an attempt to censor information on how your products work ... Now you will experience the wrath of Anonymous ... Expect us.” [Id. ¶ 74.]
. The Court previously denied Plaintiffs’ motions to remand related case Nos.: 11cv2119 (Detert) and 11cv2120 (Hinkle).
. Mr. Johnson alleged fraudulent credit card charges and Mr. Howe alleged he incurred credit monitoring costs as a result of the Data Breach. Sony alleges neither has sustained an injury-in-fact. See e.g., Anderson v. Hannaford Bros.,
. Plaintiffs did not specifically respond to Sony’s contentions regarding Johnson and Howe. However, Plaintiffs stated that the losses asserted are "direct financial injuries to Plaintiffs and other Class members, and such economic losses have always conferred Article III standing. [Doc. No. 107, 11:1-4.]
. In support of this contention Sony points to many out of state cases. As such, these sources are only persuasive and not binding authority. See Reilly v. Ceridian Corp.,
. See Webb v. Carter’s Inc.,
. See Webb,
. However, Plaintiffs must be mindful that Article III standing requirements are an “indispensable part of a plaintiffs case.” Lujan,
. However, once again, the cases cited by Sony are only persuasive authority and not binding on this Court. See, e.g., In re TJX Cos. Retail Sec. Breach Litig.,
. Sony's Privacy Policy (which each user must agree to) promises that Sony will “take reasonable measures to protect the confidentiality, security, and integrity of the personal information collected from our website visitors” and that "Sony Online Services use industry standard encryption to prevent unauthorized electronic access to sensitive financial information such as your credit card number.” [Id. ¶ 42.] However, the Privacy Policy also expressly disclaims any promise of immunity from intrusion: "Unfortunately, there is no such thing as perfect security. As a result, although we strive to protect personally identifying information, we cannot ensure or warrant the security of any information transmitted to us through or in connection with our website, Sony Online Services or that we store on our systems or that is stored on our service providers’ systems.” [See Def.’s RJN, Ex. B, 6.]
Additionally, Sony’s Terms of Service agreement (which every user must enter into) expressly provides that Sony does not offer any warranty against uninterrupted service: "No warranty is given about the quality, functionality, availability or performance of Sony Online Services, or any content or service offered on or through Sony Online Services ... SNEA does not warrant that the service and content will be uninterrupted, error-free or without delays ... SNEA assumes no liability for any inability to purchase, access, download or use any content, data or service.” [See Def.'s RJN, Ex. A, 9.]
. At the motion hearing Sony asserted that Plaintiffs failure to address the economic loss doctrine in their opposition waived any right to contest the doctrine’s applicability. However, the Court finds that Plaintiffs did mention the doctrine, albeit insubstantially in their opposition, and is nonetheless unwilling to dismiss the claim offhandedly and without considering its merits.
. As stated by the court in North American Chemical, "economic loss” includes "damages for inadequate value, costs of repair and replacement of the defective product or consequent loss of profits-without any claim of personal injury or damages to other property....” Sacramento Regional Transit Dist. v. Grumman Flxible (1984)
. Among other cases, Sony cites to Krottner,
. Plaintiffs' opposition states that such authority is not instructive as the Ninth Circuit applied Washington law. However, the Court does not find this argument persuasive because the elements required in a negligence action under Washington law and California law are not materially different.
. Scott Lieberman lives in Plantation, Florida; Adam Schucher lives in Surfside, Florida; Rebecca Mitchell lives in East Lansing, Michigan; and Christopher Wilson lives in Dallas, Texas. Kyle Johnsona dn Arthur Howe both live in San Diego, California.
. See TrafficSchool.com, Inc. v. Edriver, Inc.,
. Rule 9(b)'s heightened pleading standards apply equally to claims for violation of the UCL, FAL, or CLRA that are grounded in fraud. See Vess v. Ciba-Geigy Corp. USA,
. The Consolidated Complaint alleges violations under all three prongs of the UCL — the unlawful, unfair, and fraudulent prongs. Although Sony does not specifically contest the validity of Plaintiffs’ claims under the unlawful and unfair prongs, to the extent the Court dismisses the underlying statutory violations those claims would also fail. See Kowalsky v. Hewlett-Packard Co.,
. The Ninth Circuit found it was not necessary to evaluate additional evidence regarding whether the advertising was deceptive because the advertisement itself made it impossible for the plaintiff to prove that a reasonable consumer was likely to be deceived.
. The Court addresses this ground for dismissal in the event Plaintiffs amend their Consolidated Complaint.
. The standing requirements for a CLRA claim and a UCL/FAL claim differ in a class action. Under the CLRA, each class member must present actual injury, whereas under the UCL/FAL, even after Proposition 64, only the named Class representatives must reliance and causation. See In re Steroid Prod. Cases,
. In the class action context, the UCL and FAL only requires named Class members to plead actual reliance, whereby the CLRA requires actual reliance of all Class members. See Mass. Mut. Life Ins. Co.,
. Plaintiffs acknowledged these deficiencies at the motion hearing, but noted any deficiency could be remedied if granted leave to amend.
. Unlike the UCL and FAL, plaintiffs can recover money damages under the CLRA. Here, Plaintiffs seek compensatory and exemplary damages, an order enjoining Sony from continuing the unlawful practices described herein, a declaration that Sony's conduct violated the CLRA, restitution as appropriate, attorneys’ fees, and the costs of litigation. [Doc. No. 153.]
. Plaintiffs Consolidated Complaint included Section 1798.84 subdivisions (a), (b), (c) and (e), but omitted subdivision (d). (Doc. No. 78 at 36-37.)
. The Court finds the present case distinguishable from cases cited by Plaintiffs. See Software Design & Application, Ltd. v. Hoefer & Arnett, Inc.,