Filed 9/16/22 CERTIFIED FOR PUBLICATION

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SECOND APPELLATE DISTRICT

DIVISION FOUR

APRIL KAY MOORE , et al.

,

Plaintiff s and Appellant s ,

v.

CENTRELAKE MEDICAL GROUP

, INC.,

Defendant and Responde nt

. B 3 10859

(Los Angeles County Super. Ct. No. 19STCV19196 )

APPEAL from a judgment of the Superior Court of
Los Angeles County, Kenneth R

. Freeman , Judge. Affirmed in part and reversed in part

.2 Wilshire Law Firm

, Bobby Saadian

, J u stin F. Marquez

, Thiago M. Coelho, Robert J. Dart and Jessica Behmanesh for
Plaintiff s and Appellant s

. Baker & Hostetler

, Paul Karlsgodt

, Matthew D.
Pearson and Teresa C. Chow for Defendant and Respondent.

_____________________________________________

INT RODUCTION Appellants April Kay Moore, Kimberly Joy, and Yvette McKinley are patients at medical facilities operated by respondent Centrelake Medical Group. In reliance on Centrelake’s allegedly false representations that it employed reasonable safeguards for patients’ personal identifying information (PII), appellants entered into contracts with
Centrelake. Their contracts allegedly incorporated a privacy policy, in which Centrelake promised to maintain adequate data security practices to protect appellan ts’ PII from unauthorized access by third parties. In early 2019, Centrelake suffered a data breach, in which appellants’ PII was allegedly stolen by hackers and disseminated into the public domain. In April 2019, Centrelake issued a notice of
the data b reach, acknowledging that patient records and data might have been taken, and encouraging patients to protect themselves from identity theft or fraud, including by monitoring their credit and financial accounts. Appellants spent time on such monitoring, a nd appellant McKinley purchased credit and identity monitoring services.3 In June 2019, appellants brought this action against Centrelake on behalf of themselves and a putative class of patients affected by the data breach. The complaint
contained causes of action for breach of contract, negligence, and violations of the Unfair Competition Law (UCL), Business and Professions Code section 17200 et seq. Appellants alleged they suffered several injuries as a result of Centrelake’s failure to maintain adequa te data security, including : (1) overpayments for Centrelake’s services, which did not include the adequate data security for which they had bargained ; (2) time and money spent on credit monitoring and other measures to mitigate risks posed by
the data bre ach; and (3) deprivation of some portion of the
value of their PII. Centrelake demurred, arguing that appellants had failed to adequately plead any cognizable injury, and that their negligence claim was barred by the economic loss rule. Appellants opposed the demurrer. In a footnote to their opposition brief, and at the hearing on the demurrer

, appellants requested leave to amend their complaint to add allegations of future harm, viz., future costs to be incurred retaking medical tests in order to replace medical records
that had been lost in the data breach. The trial court sustained the demurrer to all claims without leave to amend, concluding : (1) appellants had failed to adequately plead any injury sufficient to support either (a) standing to bring th eir UCL claim, or (b) the damages elements of their contract and negligence claims; and (2) appellants’ negligence claim4 was barred by the economic loss rule. The court entered a judgment dismissing all claims. On appeal, appellants contend the court erre d in sustaining the demurrer with respect to each of their claims, and abused its discretion in denying their request for leave
to amend. We conclude appellants adequately alleged UCL standing and contract damages under their benefit

- of

- the

bargain theory

, and appellant McKinley , who purchased monitoring services, did the same under appellants’ monitoring

- costs theory. However, appellants have not show n the court erred in dismissing their negligence claim under the economic loss rule; nor have they shown the court
abused its discretion in denying their request for leave to amend. Accordingly, we affirm the judgment with respect to the dismissal of appellants’ negligence claim without leave to amend, but reverse with respect to appellants’ UCL and

contract claims . For guidance on remand, we address appellants’ lost

- value

- of

- PII theory, and conclude they failed to adequately plead it as a basis for either UCL standing or contract damages.

PROCEEDINGS BELOW
A. Appellants’ Complaint In June 2019, appellants fil ed the complaint in this action on behalf of themselves and a putative class of all California residents whose PII was compromised as a result
of Centrelake’s early 2019 data breach. The facts stated in this subsection are taken from the complaint’s factu al5 allegations, which we presume to be true for purposes of reviewing the trial court’s ruling on Centrelake’s demurrer.

1. The Data Breach Centrelake is a medical provider operating eight medical facilities in southern California. Prior to January 9, 2019, appellants became patients of Centrelake. Centrelake “made repeated promises and representations” to appellants “that it would protect its patients’ PII from disclosure to unauthorized third parties.” Each appellant signed a
contract with Centrelake tha t incorporated a contractually binding privacy policy, viz., Centrelake’s Notice of Privacy Practices (attached to the complaint as an exhibit), in which Centrelake promised to take appropriate steps to attempt to safeguard any medical or other personal in formation provided to it. Centrelake also published its Notice of Privacy Practices to the public on its website. However, the Notice of Privacy Practices contained false statements concerning data security

. Centrelake failed to implement reasonable se curity practices to protect appellants’ PII. As a result, from January 9 to February 19, 2019, Centrelake suffered a data breach, during which appellants’ PII was “stolen” (in other words, “acquired” or “harvested”) by hackers, and “disseminat[ed] into th e public domain.” The stolen PII included contact information (names, addresses, and phone numbers), Social Security numbers, driver’s license information, and medical information (services performed,6 diagnosis information, health insurance information,

r eferring provider information, medical record number, and dates of service). In April 2019, Centrelake issued a Notice of Data Breach (attached to the complaint as an exhibit). The Notice stated that “suspicious activity” began on Centrelake’s
network o n January 9, 2019 and continued for over a month
until

, on February 19, Centrelake discovered that a hacker
had infected Centrelake’s system with a virus that prohibited its access to its files. Centrelake announced that its ongoing investigation had yet to uncover any evidence that the hacker viewed or took patient information, or any
indication that such information had been misused. However, Centrelake acknowledged that the hacker might have gained access to patient records and data. Centrelake

encour aged affected individuals to “remain vigilant against incidents of identity theft and fraud” by regularly reviewing
their credit reports, financial account statements, and explanations of benefits for suspicious activity. Centrelake provided a toll

- free p hone line staffed with individuals familiar with the data breach, and invited calls from patient s with questions regarding how to protect themselves from “potential harm resulting from this incident,” including how to place fraud alert s on the patient s’ cr edit file s

.

2. Causes of Action Appellants’ first and second causes of action were for breach of contract and breach of the covenant of good faith7 and fair dealing (contract claims). 1 Appellants alleged
Centrelake breached its contracts with them by (1) fa iling to “implement and maintain reasonable security procedures to protect Plaintiffs’ and Class Members’ PII from unauthorized access, destruction, use, modification, or disclosure”; and (2) failing to prevent unauthorized third parties from obtaining suc h access. Appellants’ third and fourth causes of action were for “negligence per se” and negligence. 2 Appellants alleged: (1) Centrelake entered into a “‘special relationship’” with appellants “when [Centrelake] contracted with [them] for
medical service s and obtained their PII from them”; (2) Centrelake owed appellants a duty of care in protecting their PII, because inadequate data security practices would foreseeably cause them harm; and (3) Centrelake breached that duty by adopting inadequate safeguard s to protect their
PII.

1 T he parties and the trial court analyzed the contract claims together. (See Sheen v. Wells Fargo Bank, N.A. (2 022) 12 Cal.5th 905, 929 ( Sheen ) [“‘The remedy for breach of [the implied] covenant [of good faith and fair dealing] is generally limited to contract damages’”].) W e do the same

.

2 Appellants expressly do not challenge the trial court’s conclusion that their purported cause of action for negligence per se failed to state a claim, as negligence per se is not an independent cause of action, but rather an evidentiary doctrine applied in negligence actions. We need not further address the negligence per se claim.8 Appellants’ fifth and final cause of action was for violations of the UCL. Appellants alleged Centrelake violated the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) (42 U.S.C. § 1320d et seq.) and the public policy expressed therein, rendering its business practices both unlawful and unfair, by (1) failing to “implement and maintain reasonable security procedures to protect Plaintiffs’ and Class Members’ PII from unauthorized access, destruction, use, modifica tion, or disclosure”; and (2) failing to prevent unauthorized third parties from obtaining such access. Appellants further alleged Centrelake’s business practices were fraudulent “because they involved representations to the public which [we]re likely to deceive,” including false statements concerning data security in its Notice of Privacy Practices. Appellants sought compensatory damages, restitution, and injunctive relief requiring Centrelake to implement reasonable data security practices.

3. Alleged I njuries Appellants alleged they suffered several injuries. First, appellants alleged they overpaid for Centrelake’s medical services, in that they paid for but did not receive reasonable and adequate security for their PII. In other words, appellants “pa id more for [Centrelake]’s services than they [otherwise] would have paid” had they known their PII would not be protected. Relatedly, appellants “ relied on [Centrelake]’s [privacy] representations in entering into9 contracts with Defendants for medical se rvices, which they would not have entered had they known their PII would be unprotected.” Second, appellants alleged they suffered “[a]scertainable losses in the form of out

- of

- pocket expenses and the value of their time reasonably incurred to remedy or

m itigate the effects of the data breach.” As a result of Centrelake’s failure to implement adequate data security, the data breach placed appellants at risk of suffering identity theft and fraud, and they were “forced to adopt costly and time

- consuming pre ventive and remediating efforts.” All appellants were required to spend time, inter alia, monitoring their credit reports and accounts for unauthorized activity. In addition, appellant McKinley purchased credit and personal identity monitoring services, as a “reasonable and necessary” prophylactic measure. Although appellants Moore and Joy had not made such purchases, they would be forced to do so in the future. Finally, appellants alleged they suffered “[a]scertainable losses in the form of deprivatio n of the value of their PII, for which there is a well

- established national
and international market.” In general terms, appellants alleged that hackers and other criminals value stolen PII

, and that some legitimate businesses pay users for PII. Appellan ts did not allege they ever had receive d payment for
their PII , or expected to do so in the future

.10 B. Centrelake’s Demurrer In August 2020, Centrelake demurred to the complaint. It challenged each of appellants ’ causes of action on the ground that appell ants failed to allege any cognizable
injury. 3 With respect to appellants’ allegations that they overpaid for Centrelake’s services in reliance on its representations concerning data security, Centrelake argued
this benefit

- of

- the

- bargain theory was too “‘ flimsy’” to establish cognizable injury, as appellants paid for and received medical services, which they did not allege were
deficient. Further, Centrelake challenged appellants’ reliance on costs incurred in monitoring their credit

, arguing
th eir monito ring

- costs theory was deficient because (1) mere time spent monitoring credit was not cognizable; (2) appellants Moore and Joy had not purchased monitoring

3 Neither in the trial court nor in its appellate brief did Centrelake contend that appellants failed to adequately plead the existence of enforceable contracts incorporating its Notice of Privacy Practices. At oral argument, Centrelake argued fo r the first time that appellants failed to adequately plead consideration for such contracts, because Centrelake was required to issue its Notice of Privacy Practices under HIPAA and one of its implementing regulations (45 C.F.R. § 164.520). Centrelake ha s forfeited this untimely argument. (See In re I.C. (2018) 4 Cal.5th 869, 888 , fn. 5 [respondent forfeited argument raised for first time at oral argument “by failing to raise it in a timely manner”]; J & A Mash & Barrel, LLC v. Superior Court of Fresno C ounty (2022) 74 Cal.App.5th 1, 32 , fn. 9 [“‘ “ [C]ontentions raised for the first time at oral argument are disfavored and may be rejected solely on the ground of their untimeliness ” ’”].)11 services, instead merely alleging they expected to do so in the future; and (3) although appellant M cKinley had purchase d monitoring services, her purchase was prompted by mere risks of identity theft and fraud, not by any actual
occurrence of such crimes . Finally, Centrelake argued appellants’ theory that the data breach diminished the value
of their P II was insufficient to establish cognizable harm, because appellants did not alleg e they ever intended to sell their PII or were foreclosed from using it in a value

- for

- value
transaction. Centrelake challenged appellants’ negligence cause of
action on the additional ground that it was barred by the economic loss rule, which generally bars recovery in negligence for purely economic losses, meaning financial harm unaccompanied by personal injury or property damage. (See Sheen

, supra , 12 Cal.5th at 922.) An ticipating appellants’ contention that the rule did not apply because the parties entered into a special relationship, Centrelake argued this special

- relationship exception was inapplicable because, inter alia, appellants alleged their relationship with
Ce ntrelake was contractual. In September 2020, appellants opposed the demurrer. Appellants argued they had adequately pled cognizable injuries under benefit

- of

- the

- bargain, monitoring

- costs, and
lost

- value

- of

- PII theories. Appellants further argued the

e conomic loss rule did not bar their negligence claim because (1) the parties entered into a special relationship; (2) appellants’ time spent monitoring their credit and12 identi ties was a non

- economic loss; and (3) independent of the parties’ contracts, Cent relake had a duty under HIPAA to protect appellants’ PII. 4 In a footnote, appellants referenced purported allegations (not included in their complaint) that they “lost access to medical records due to the encryption of their data,” and added: “To the exte nt that the Court finds that this theory is not adequately alleged in the Complaint, Plaintiffs respectfully request leave to
amend.” In reply, Centrelake generally repeated the arguments in its initial brief. In addition, Centrelake argued appellants
al leged no facts to “support the proposition” that their PII
was taken by the hackers

. Centrelake asserted: “[This case]
is not even a data

- breach case. It is a ransomware

- attack case where criminals unlawfully encrypted Centrelake’s data
and refused to de

- encrypt it absent a fee.”

4 Appellants also argued Centrelake had an independent duty under Civ il Code section 1798.81.5 and the Federal Trade Commission Act (15 U.S.C. § 41 et seq.). On appeal, appellants do not mention either statute, instead relying solely on HIPAA. We note that where HIPAA applies, Civil Code section 1798.81.5 does not. (See Civ. Code, § 1798.81.5, subd. (e)(3) [“The provisions of this section do not apply to .

. . [a] covered entity governed by the medical privacy and security rules issued .

. . pursuant to [HIPAA]”].)13 C. Hearing and Ruling In October 2020, the trial court held a hearing on Centrelake’s demurrer. Centrelake argued appellants’ lost

value

- of

- PII and benefit

- of

- the

- bargain theories were insufficient to plead cognizable injury. In support of these arguments, Centrelake asserted the complaint did not allege the hackers obtained patients’ PII, as opposed to merely encrypting it. In response, appellants observed their complaint did, in fact, allege the hackers obtained their PII, and argued the court was required to accept this allegation as true in ruling on Centrelake’s demurrer. Appellants’ counsel also elaborated on their request for leave to amend: “[A]fter the complaint was filed, we found out that the plaintiffs no longer h ad access to their records. So that means that in the future they will have to have those same tests done again and they will have to pay for it. That future harm is the cost of the additional records for [ sic ] which they lost. [¶] So we ask simply for leave to amend as to the future
risk of harm .

. . .” The court took the matter under
submission. In November 2020, the court issued an order sustaining Centrelake’s demurrer to all appellants’ claims
without leave to amend. 5 The court concluded appell ants failed to adequately plead a loss of money or property, as

5 The court did not address appellants’ request for lea ve to amend their complaint to add allegations concerning a future need to retake medical tests.14 required to establish standing to bring their UCL claim, or cognizable damages, as required to state their contract and negligence claims. Appearing to accept Centrelake’s
characterization of the complaint as alleging mere encryption of PII in a ransomware attack, the court stated the complaint contained “no allegation that the security breach has, in fact, resulted in a dissemination of the PII.” Relying on this characterization, the court d eemed appellants’ benefit

- of

- the

- bargain theory insufficient: “Plaintiffs allege only that there was a security breach stemming from the Ransomware Attack. Without more, such as an allegation

. . . that there was actual misappropriation of the PII, the be nefit of the bargain theory fails. [¶] Plaintiffs have not made that allegation and cannot, based on the allegations on the face of the complaint.” The court further rejected appellants’ monitoring

- costs theory, reasoning that “‘general allegations
of lo st time are too speculative to constitute cognizable injury,’” and that even appellant McKinley’s completed purchase of monitoring services did not constitute present injury, because it was made in response to a mere future risk of harm. Finally, the cour t rejected appellants’ lost

- value

- of

PII theory, reasoning that (1) such a theory had been rejected in federal cases

, including In re Jetblue Airways Corp. Privacy Litigation (E.D.N.Y. 2005) 379 F.Supp.2d 299 ( Jetblue ) ; and (2) to the extent other federal cases approved such a theory, they were distinguishable

, because appellants15 did not allege Centrelake voluntarily disclosed their PII or
that their PII had been misused. The court additionally concluded appellants’ negligence claim was barred by the eco nomic loss rule, because appellants sought recovery for financial losses unaccompanied by personal injury or property damage. The court rejected appellants’ reliance on the special

- relationship exception to the rule, reasoning that appellants did not
alle ge any “third party relationship” with Centrelake, but instead alleged they and Centrelake were “in direct contractual privity.” In concluding the rule barred appellants ’ recovery of their asserted damages for lost time,
the court declined to follow Bass v. Facebook, Inc. (N.D. Cal. 2019) 394 F.Supp.3d 1024 ( Bass ), on which appellants relied,
instead follow ing two cases it deemed better reasoned. (See Dugas v. Starwood Hotels & Resorts Worldwide, Inc. (S.D. Cal., Nov. 3, 2016, No. 3 : 16

- CV

- 00014

- GPC

- BLM) 2 016 U.S.
Dist. LEXIS 152838 , * 36

- *37 ( Dugas ) [economic loss rule barred recovery of lost

- time damages]; Castillo v. Seagate Technology, LLC (N.D. Cal., Sept. 14, 2016, No. 16

- CV

01958

- RS) 2016 U.S. Dist. LEXIS 187428 , at * 5, *17

- *20 [same]. ) In January 20 21, the court entered a judgment dismissing all appellants’ claims. Appellants timely appealed.16 DISCUSSION “On appeal from a judgment of dismissal after a demurrer is sustained without leave to amend, appellate courts assume the truth of all facts prop erly pleaded by the plaintiff

- appellant and may also consider matters subject to judicial notice, [but] ‘not contentions, deductions, or conclusions of fact or law.’ [Citations.] [¶] Likewise, the reviewing court .

. . considers all evidentiary facts fou nd in recitals of exhibits attached to the complaint [citation].” (Eisenberg et al., Cal. Practice Guide: Civil Appeals & Writs (The Rutter Group 20 21 ) ¶ 8:136.) “Appellate courts will examine the complaint’s factual allegations to ‘determine de
novo whe ther the complaint states facts sufficient to state a cause of action under any possible legal theory.’” ( Ibid. ) “If facts appearing in exhibits to a complaint conflict with the allegations of the complaint, .

. . the appellate court will accept as true the factual contents of the exhibits rather than the factual allegations of the complaint. [Citations.] [¶] However, where the exhibits are ambiguous and can be construed as suggested by plaintiff, the court must accept plaintiff’s construction.” ( Id. a t ¶ 8:136.1a.) Applying these standards, we reject Centrelake’s
continued attempts on appeal to mis characteriz e appellants’ complaint as failing to allege that appellants’ PII was obtained by any third party. In fact, the complaint alleged
that “unautho rized individuals gained access to and
harvested” appellants’ PII , that “patient information was stolen

, ” and that the stolen PII was “disseminat[ed] into the17 public domain.” These allegations were consistent with
Centrelake’s Notice of Data Breach

, attac hed as an exhibit

. Although the Notice of Data Breach stated Centrelake’s ongoing investigation had yet to uncover evidence that patients’ PII had been taken, the Notice also acknowledged
that a hacker had gained access to Centrelake’s servers containing patients’ PII over a month earlier , and that the hacker might have accessed patient records and data. Indeed, that is precisely why Centrelake encouraged patients to remain vigilant against identity theft and fraud,
and established a hotline to assist the m in doing so. Accordingly, in reviewing the ruling on Centrelake’s
demurrer below , we accept as true appellants’ allegations that their PII was stolen and publicly disseminated. (See Eisenberg et al., Cal. Practice Guide: Civil Appeals & Writs,

supra , ¶ ¶ 8:136, 8:136.1a.)

A. Appellants Adequately Pled a UCL Claim Appellants contend the trial court erred in sustaining
Centrelake’s demurrer to their UCL claim on the basis of the
court’s conclusion they failed to allege a loss of money or property, as require d to plead UCL standing. We agree

.

1. Principles A private plaintiff has standing to bring a UCL claim if the plaintiff “has suffered injury in fact and has lost money or property as a result of the unfair competition.” (Bus.
& Prof. Code, § 17204.) In ot her words, the plaintiff must18 have suffered a “loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury

. . . .” ( Kwikset Corp. v. Superior Court (2011) 51 Cal.4th 310, 322 ( Kwikset ).) The UCL incorporates t he meaning of injury in fact as a requirement for Article III standing to sue in federal court, under which it suffices to allege “ ‘“some specific, ‘identifiable trifle’ of injury.”’” ( Id. at 322, 324; see also id. at 325 [“If a party has alleged or prove n a personal, individualized loss of money or property in any nontrivial amount, he or she has also alleged or proven injury in fact”].) “There are innumerable ways in which economic injury from unfair competition may be shown. A plaintiff may (1) surren der in a transaction more, or acquire in a transaction less, than he or she otherwise would have; (2) have a present or future property interest diminished; (3) be deprived of money or property to which he or she has a cognizable claim; or (4) be required to enter into a transaction, costing money or property, that would otherwise have been unnecessary.” ( Id. at 323.)

2. Benefit of the Bargain We conclude appellants adequately pled UCL standing
under their benefit

- of

- the

- bargain theory. “[A] ‘benefit of t he bargain’ approach to establishing UCL standing is rooted in the California Supreme Court’s recognition that a plaintiff may demonstrate economic injury from unfair competition by establishing he or she ‘surrender[ed] in a transaction more, or acquire[d] in a transaction less, than he or she19 otherwise would have.’” ( Cappello v. Walmart Inc. (N.D. Cal. 2019) 394 F.Supp.3d 1015, 1019

- 1020, quoting Kwikset

, supra , 51 Cal.4th at 323; see also Kwikset , at 332 [plaintiffs adequately pled UCL standing, where pl aintiffs alleged “[t]hey bargained for locksets that were made in the United States” but “got ones that were not,” and thus did not receive
the benefit of their bargain].) Here, appellants alleged they relied on Centrelake’s false representations and prom ises concerning data security in entering contracts with Centrelake and accepting its pricing terms, paying more than they would have had they known the truth that Centrelake had not implemented and would not maintain adequate data security practices. We conclude these allegations adequately pled UCL standing under Kwikset

. (See Kwikset , at 330 [plaintiffs alleged they selected locksets for purchase in part because locksets were mislabeled as made in USA: “because of the misrepresentation the consumer (al legedly) was made to part with more money than he or she otherwise would have been willing to expend

. . . . That increment, the extra money paid, is economic injury and affords the consumer standing to sue”].) Indeed, many federal courts, applying Kwiks et in the context of data

breach litigation, have held plaintiffs adequately pled UCL standing under similar benefit

- of

- the

- bargain theories. (See,

e.g., In re Solara Medical Supplies, LLC Customer Data Security Breach Litigation (S.D. Cal., May 7, 2020, No. 3:19

- CV

- 2284

- H

- KSC) 2020 U.S. Dist. LEXIS 80736

, at *4, * 27 ( Solara ) [“Plaintiffs have all pled that ‘they acquired less in20 their transactions with [ medical supplier] than they would
have if [supplier] had sufficiently protected their Personal
Informat ion.’ [Citation.] These allegations are enough to establish standing for purposes of the UCL”]; In re Marriott International, Inc., Customer Data Security Breach Litigation (D. Md. 2020) 440 F.Supp.3d 447, 492 [“Plaintiffs allege that ‘had consumers know n the truth about Defendants’ data security practices

-- that they did not adequately protect and store their data

-- they would not have stayed at a Marriott Property, purchased products or services at a Marriott Property, and/or would have paid less.’ [ Citation.] This is sufficient to establish standing for the UCL claim”].) 6

6 We find these cases more persuasive than the federal cases on which Centrelake relies, which did not cite Kwikset . (See Fernandez v. Leidos, Inc. (E.D. Cal . 2015) 127 F.Supp.3d 1078, 1089 [ plaintiff failed to adequately plead UCL standing , where plaintiff alleged defendant contracted with plaintiff’s employer to provide data security, but defendant left data tapes containing plaintiff’s PII unattended in car

, allowing PII to be stolen ]; Estrada v. Johnson & Johnson (E.D. Cal., Mar. 2 6 , 2015, No. 2:14

- CV

- 01051

- TLN

- EFB ) 2015 U.S. Dist. LEXIS 39581 , * 12

- *13 [ same , where plaintiff alleged defendant failed to warn her that defendant’s talc

- based baby powder would increase her risk of ovarian cancer]; Dozier v. Walmart Inc. (C.D. Cal., Mar. 5, 2021, No. CV20

- 05286

- AB ( PVCX ) ) 2021 U.S. Dist. LEXIS 76852, at *4

- *5, *12

- *16 [same, where plaintiff alleged retailer from which he bought new tires failed to comply with fede ral regulation requiring it to facilitate registration of tires with manufacturer].)21 We disagree with the trial court’s conclusion that appellants’ benefit

- of

- the

- bargain theory failed because appellants did not allege “actual misappropriation of the PII.” As exp lained above, at this stage of the litigation, we are required to accept as true appellants’ allegations that their PII was stolen and disseminated into the public domain. In any event, appellants ’ economic injury allegedly
occurred at the time Centrelake unlawfully caused them to pay more than they otherwise would have. (See Kwikset

, supra , 51 Cal.4th at 334 [“in the eyes of the law, a buyer forced to pay more than he or she would have is harmed at the moment of purchase”].) This alleged injury was not contingent upon any subsequent misappropriation of appellants’ PII. We also disagree with Centrelake’s contention that appellants’ benefit

- of

- the

- bargain theory fails because data security was at most “incidental” to appellants’ bargain for
medical servic es. To the contrary, appellants alleged that data security was sufficiently material to them that had they known the truth of the matter, they would not have entered into contracts for medical services with Centrelake, or would not have accepted Centrelak e’s pricing terms. Such materiality is to be expected in light of the sensitive and
confidential nature of the information appellants entrusted to Centrelake, including medical diagnoses and services performed, as well as Social Security numbers , driver’s
license numbers

, and health insurance information. F ew prospective patients would entrust such information

-- and22 pay full market prices

-- to a medical provider known to be
careless with it

. Indeed, the Legislature has acted to protect patients’ expect ations that their information will be kept
confidential and secure

. (See Civ. Code, § 56.101, subd s

. (a)

- (b) [requiring health care providers to maintain medical information in manner that preserves its confidentiality, and
electronic medical record s syst ems to protect and preserve integrity of electronic medical information] ; cf. Kwikset

, supra , 51 Cal.4th at 333 [ by prohibiting fraudulent made

- in

America representations, Legislature made clear that products’ American origin “is precisely the sort of

cons ideration reasonable people can and do attach importance to in their purchasing decisions”].) Moreover, “ a s ‘materiality is generally a question of fact’ [citation], it is not

a basis on which to decide this case on demurrer.” 7 ( Kwikset

, at 333. )

7 Centrelake argues that under Kwikset , even a material misrepresentation cannot support a UCL claim unless the misrepresentation was “ relate[d] to the product ” purchased by the plaintiff. Under this reading of Kwikset , Centrelake suggests, its alleged misrepresentations concerning data security did not support appellants’ UCL standing because its misrepresentations did not “describe[] its medical services.” Centrelake i dentifies no support for this reading of Kwikset in the opinion itself, and we discern none. At oral argument, Centrelake argued for the first time that Kwikset is distinguishable because Centrelake’s Notice of Privacy Practices was required under HIPAA. As noted above, Centrelake forfeited its untimely arguments concerning this (Fn. is continued on the next page.)23 Centrel ake’s reliance on Irwin v. Jimmy John’s Franchise, LLC (C.D. Ill. 2016) 175 F.Supp.3d 1064 is misplaced. There, the plaintiff used debit and credit cards to purchase food at Jimmy John’s restaurant, which suffered a data breach potentially exposing the pl aintiff’s financial information to unauthorized third parties, prompting the plaintiff to sue Jimmy John’s in federal court on behalf of herself and a putative class of affected consumers. ( Id. at 1068.) In the portion of the opinion on which Centrelake relies, the court dismissed the plaintiff’s unjust enrichment claim under Arizona and Illinois law, reasoning: “[Plaintiff] paid for food products. She did not pay for a side order of data security and protection; it was merely incident to her food purcha se .

. . .” ( Id. at 1071

- 1072.) But in a separate, more relevant portion of the opinion, the court held the plaintiff had adequately pled a claim under an Arizona

consumer

- protection statute similar to the UCL, by alleging
the restaurant induced her and other consumers to make purchases in reliance on the restaurant’s deceptive
indications that their financial information would be secure. (See id. at 1072

- 1073.) Thus, to the extent this case is
relevant to appellant s ’ UCL claim, it supports their benefi t

of

- the

- bargain theory. We conclude appellants adequately pled that theory as a basis for UCL standing.

HIPAA requirement. (See, e.g., In re I.C.

, supra , 4 Cal.5th at 888.)24 3. Monitoring Costs We further conclude appellant McKinley adequately pled UCL standing under appellants’ monitoring

- costs theory. Under Kwikset , econo mic injury may be shown where, as a result of the defendant’s unlawful conduct, the plaintiff is “required to enter into a transaction, costing money or property, that would otherwise have been unnecessary.” ( Kwikset

, supra , 51 Cal.4th at 323.) Here,
McK inley alleged just that: because of Centrelake’s unlawful failure to implement adequate data security, which resulted in the theft of McKinley’s PII and an attendant risk of identity theft and fraud, she was forced to purchase credit and identity monitorin g services as a reasonable and necessary prophylactic measure. We conclude t hese allegations adequately pled economic injury under Kwikset

. (See , e.g., Huynh v. Quora, Inc. (N.D. Cal. 2020) 508 F.Supp.3d 633, 659

- 661 [ plaintiff raised triable issue of fa ct regarding UCL standing by presenting evidence that defendant’s challenged conduct compelled her to spend money on credit monitoring services: “payments toward enhanced credit monitoring that arise from a data breach
and that are not reimbursed

. . . ‘co nstitute economic injury, sufficient to confer UCL standing’” (collecting cases applying
Kwikset ) ]; accord, Witriol v. LexisNexis Grp. (N.D. Cal. Feb. 10, 2006) No. C05

- 02392 MJJ, 2006 U.S. Dist. LEXIS 26670,
at *18

- *19 [ plaintiff adequately pled UCL stand ing by alleging he incurred costs monitoring and repairing credit
after defendants released his PII to third parties without25 authorization] ; cf. Ghazarian v. Magellan Health, Inc. (2020) 53 Cal.App.5th 171, 193 [ reversing summary judgment for
defendant on UCL claim: “Due to the wrongful denial of their insurance claim, plaintiffs retained and paid an attorney to assist them with the IMR process. This is sufficient to establish standing under the UCL. .

. . The transaction would have been unnecessary witho ut defendants’ conduct”].) 8 Centrelake argues McKinley’s purchase of monitoring services was unreasonable and unnecessary, relying on factors articulated by our Supreme Court in a toxic tort case

, for assessing the reasonableness and necessity of medical

m onitoring. (See Potter v. Firestone Tire & Rubber Co. (1993) 6 Cal.4th 965, 1009.) Centrelake does not attempt to reconcile this argument with its own Notice of Data Breach, which encouraged patients to remain vigilant against identity theft and fraud, i ncluding by monitoring their credit
and financial accounts. (See Huynh v. Quora, Inc.

, supra , 508 F.Supp.3d at 652

- 653 [jury could reasonably find plaintiff’s purchase of credit monitoring services in wake of data breach was reasonable and necessary, wher e

8 Again, C entrelake relies on federal cases that did not cite Kwikset

. (See Ruiz v. Gap, Inc. (N.D. Cal. 20 09) 622 F.Supp.2d 908, 914; Gardner v. Health Net, Inc. (C.D. Cal., Aug. 12, 2010, No. CV 10

- 2140 PA (CWX)) 2010 U.S. Dist. LEXIS 157448 , at

* 11; Storm v. Paytime, Inc. (M.D. Pa. 2015) 90 F.Supp.3d 359, 367; In re SuperValu, Inc. (D. Minn. Jan. 7, 2016, No . 14

- MD

2586 ADM/TNL) 2016 U.S.Dist.LEXIS 2592, at * 19

-- *20 .)26 defendant’s notice of data breach could reasonably be interpreted to indicate “the severity of the Data Breach, and therefore the threat of identity theft or fraud, was still unknown”].) More over, appellants alleged McKinley’s purchase was reasonable an d necessary

. Nothing in the
record permits us to decree these allegations untrue

, as a matter of law , at this early stage of the litigation

. (See Schmitt v. SN Servicing Corp. (N.D.Cal. Aug. 9, 2021, No.
21

- cv

- 03355

- WHO) 2021 U.S.Dist. LEXIS 149252, at * 25 [ “To the extent that [defendant] factually disputes whether plaintiffs’ credit monitoring costs were ‘required’ or ‘necessary,’ that cannot be resolved at this [motion to dismiss] stage”]; cf. Potter v. Firestone Tire & Rubber Co.

, supra , at 1009 [medic al

- monitoring factors are to be applied by trier of fact on basis of competent medical testimony] ; Ruiz v. Gap, Inc.

, supra , 622 F.Supp.2d at 914 [granting
defendants summary judgment on plaintiff’s negligence claim, where plaintiff sought to recover costs of c redit monitoring, but had not “presented evidence sufficient to
overcome the kind of evidentiary burdens that apply in medical monitoring cases” (italics added)].) We need not decide whether appellants Moore and Joy, who did not allege they had purch ased monitoring services, adequately pled UCL standing under their monitoring

- costs theory. A s explained above, they adequately pled UCL standing under their benefit

- of

- the

- bargain theory.27 B. Appellants Adequately Pled Contract Claims Appellants contend t he trial court erred in sustaining
Centrelake’s demurrer to their contract claims based on the
court’s conclusion that they failed to adequately plead any cognizable contract damages. We agree

.

1. Principles “Contract damages compensate a plaintiff for its lost expectation interest. This is described as the benefit of the bargain that full performance would have brought.’” ( New West Charter Middle School v. Los Angeles Unified School
Dist. (2010) 187 Cal.App.4th 831, 844 ( New West ) ; accord, 24
Williston on Contracts (4th ed. 2022) § 64:3.) “Contractual damages are of two types

-- general damages (sometimes called direct damages) and special damages (sometimes called consequential damages).” ( Lewis Jorge Construction Management, Inc. v. Pomona Unified Scho ol Dist. (2004) 34 Cal.4th 960, 968 ( Lewis Jorge ).) “General damages are often characterized as those that flow directly and necessarily from a breach of contract, or that are a natural result of a breach.” ( Ibid. ) General damages “‘are based on the val ue of the performance itself, not on the value of some consequence that performance may produce.’” ( Id. at 971 ; see also 24 Williston on Contracts, supra , § 64:3 [“When the promisor fails to perform as promised, the promisee becomes entitled to damages de signed to compensate him or her for .

. . the
loss .

. . [of] the value to the promisee of the promise that was broken”].)28 “Special damages .

. . represent loss that ‘occurred by reason of injuries following from’ the breach.” ( Lewis Jorge

, supra , 34 Cal.4th at 969 ; see also 24 Williston on Contracts,

supra , § 64: 16 [“Consequential damages are those damages that do not flow directly and immediately from the breach, but only from some of the consequences or results of the breach”].) “Special damages fo r breach of contract are limited to losses that were either actually foreseen [citation] or were ‘reasonably foreseeable’ when the contract was formed.” ( Lewis Jorge

, at 970.) Foreseeability is an issue of fact. ( Ash v. North American Title Co. (2014) 2 23 Cal.App.4th 1258, 1268; cf. Lewis Jorge , at 977 [ relying on
trial evidence in holding contractor’s lost profits were neither foreseen nor foreseeable].)

2. Benefit of the Bargain We conclude appellants adequately pled general damages under their benefit

- o f

- the

- bargain theory. Centrelake allegedly made and breached a contractually binding promise to take appropriate steps to secure appellants’ PII. General damages for this alleged breach include the value to appellants of the promised data security (i.e., performance itself). (See Lewis Jorge , 34 Cal.4th at 968; New West , supra , 187 Cal.App.4th at 844 [ proper measure of damages for school district’s breach of promise to
allow charter school to co

- locate with another school was value of promised co

- locatio n, minus costs charter school
would have incurred in co

- locating] ; cf. In re Adobe Systems,29 Inc. Privacy Litigation (N.D. Cal. 2014) 66 F.Supp.3d 1197, 1224 [plaintiffs adequately pled UCL standing, where plaintiffs alleged they spent more on Adobe product s than they would have had they known Adobe was not providing reasonable data security as it represented it was: “It is

. . . plausible that a company’s reasonable security practices reduce the risk of theft of customer’s personal data and thus that a comp any’s security practices have economic value”].) Indeed, federal cases applying California law have allowed plaintiffs to seek contract damages for the lost value of promised data security or privacy

. (See In re Anthem, Inc. Data Breach Litigation (N.D. Cal., May 27, 2016, No. 15

- MD

02617

- LHK), 2016 U.S. Dist. LEXIS 70594 , * 123

- *128 [plaintiffs adequately pled contract damages, where plaintiffs alleged defendants deprived them of “‘the
difference in value between what Plaintiffs should have
received from Defendants when they enrolled in and/or purchased insurance from Defendants that Defendants represented, contractually and otherwise, would be protected by reasonable data security, and Defendants’ partial, defective, and deficient performance by failing t o provide reasonable and adequate data security’” (citing New West , at 844)] ; Svenson v. Google Inc. (N.D. Cal., Apr. 1, 2015, No. 13

- CV

- 04080

- BLF) 2015 U.S. Dist. LEXIS 43902, *12

- *15 [same, where plaintiff alleged Google’s payment

- processing
service was “worth quantifiably less” as a result of Google’s breach of its promise not to share plaintiff’s personal information with app vendor]; cf. In re Marriott30 International, Inc., Customer Data Security Breach Litigation

, supra , 440 F.Supp.3d at 465

- 466, 494

- 4 95 [same,
addre ssing data

- breach contract claims under Maryland, New York, and Oregon law].) In challenging appellants’ benefit

- of

- the

- bargain theory as applied to their contract claims

, Centrelake makes the same argument we have rejected with respect to t he UCL claim, viz., that data security was at most “incidental” to the parties’ bargains. As explained above, w e are unpersuaded. Centrelake does not address appellants’ allegation that Centrelake’s promises to maintain adequate data security were incorp orated into their contracts . Nor does Centrelake cite any authority

-- state or federal

-- addressing contract damages under California law. We reject Centrelake’s further argument that appellants’ benefit

- of

- the

- bargain theory is fatally “implausible ” because appellants did not allege “ how, or even whether, the cost of data protection varied among
Centrelake clientele. ” Although appellants may be required to address such variations among the members of their putative class at later stages of the litiga tion, their failure to address them in the complaint is not fatal to their claim s at the pleading sta ge. Again, Centrelake cites no California authority. The federal cases it cites are distinguishable

. (See In re Target Corp. Data Sec. Breach Litigation (D. Minn. 2014) 66 F.Supp.3d 1154, 1178 ( In re Target ) [ unjust
enrichment claim against retailer was fatally implausible,
where plaintiffs alleged they paid for data security when31 purchas ing goods with payment cards

, but retailer charged

same p rices to cu stomers who paid with cash and thus had
no need for data security ] ; Gordon v. Chipotle Mexican Grill,
Inc. (D. Colo., Aug. 1, 2018, No. 17

- CV

- 1415

- CMA

- MLC)
2018 U.S. Dist. LEXIS 129928 , * 9

- *10 [following In re Target ; plaintiffs’ allegations that restauran t’s purchase prices incorporated charges for data security were too implausible to support Article III standing, because cash customers paid same price s ], report and recommendation adopted in part, rejected in part (D. Colo. 2018) 344 F.Supp.3d 1231 .) Ind eed, In re Target distinguished a case
decided on allegations similar to appellants’ . (See Resnick v. AvMed, Inc. (11th Cir. 2012) 693 F.3d 1317, 1328 ( Resnick ) [plaintiffs adequately pled unjust enrichment claim against health care plan, from which lapto ps containing plaintiffs’ PII had been stolen, by alleging their health insurance premiums incorporated pa yments for data security that health care plan did not provide]; In re Target

, supra , 66 F.Supp.3d at 1178 [deeming Resnick “not on point” because
in Resnick , all members of health care plan

-- unlike
retailer ’s cash customers

-- shared their PII in their relevant
transactions

, and therefore paid for adequate data security].) We conclude appellants’ allegations sufficed to plead general contract damage s under their benefit

- of

- the

- bargain theory.

3. Monitoring Costs We further conclude appellant McKinley adequately pled special contract damages under a ppellants’ monitoring

-32 costs theory. McKinley’s financial loss in purchasing credit and identity monitorin g services did not flow directly from Centrelake’s alleged breach of contract ( failure to provide promised dat a security), but did flow from an alleged

consequence thereof (the data breach). (See Lewis Jorge

, supra , 34 Cal.4th at 969.) Further, McKinley’ s purchase

may well have been foreseeable . I ndeed, Centrelake’s Notice of Data Breach encouraged patients to monitor their credit and financial accounts to protect against harm resulting
from the breach ; Centrelake might have foreseen that McKinley would pay for assistance in doing so. In any event, foreseeability is an issue of fact. ( Ash v. North American
Title Co.

, supra , 223 Cal.App.4th at 1268.) Centrelake does not argue otherwise, instead contending McKinley’s purchase was unreasonable and unneces sary. F or the

reasons explaine d in our UCL analysis above , we reject that
contention at this early stage of the litigation

. Similarly, for reasons explai ned above , we need not decide whether appellants Moore and Joy adequately pled contract damages
under their monitoring

- costs theory.

C. Appellants Fail to Show the Court Erred in Dismissing Their Negligence Claim Without
Leave to Amend Appellants contend the trial court erred in sustaining Centrelake’s demurrer to appellants’ negligence claim under
the econ omic loss rul e , because : (1) the parties entered a special relationship, as established by an analysis of six33 factors first articulated in Biakanja v. Irving (1958) 49 Cal.2d 647, 650 ( Biakanja ) ; (2) independent of the parties’ contracts, Centrelake had a duty to protect appellants’ PII; and (3) appellants’ asserted damages for lost time are non

economic losses. Appellants further contend the court abused its discretion in denying their request for leave to amend their complaint. We address each contentio n in turn.

1. Economic Loss Rule “The [economic loss] rule itself is deceptively easy to state: In general, there is no recovery in tort for negligently inflicted ‘purely economic losses,’ meaning financial harm unaccompanied by physical or property damage.” ( Sheen

, supra , 12 Cal.5th at 922; see also id. at 915 [defining economic losses as “pecuniary losses unaccompanied by property damage or personal injury”]; Southern California
Gas Leak Cases (2019) 7 Cal.5th 391, 398 [economic loss is “shorthand for ‘pec uniary or commercial loss that does not arise from actionable physical, emotional or reputational injury to persons or physical injury to property’”].) The economic loss rule applies , inter alia, where the parties are in contractual privity and the plaint iff’s claim arises from the contract (in other words, the claim is not independent of the contract). ( Sheen , at 923 [“Not all tort claims for monetary losses between contractual parties are barred by
the economic loss rule. But such claims are barred whe n they arise from

-- or are not independent of

-- the parties’ underlying contracts”].) In such circumstances, there is no34 need to analyze the Biakanja special

- relationship factors. ( Sheen , at 915, 942.) We conclude appellants have fail ed to show error i n the trial court’s application of the economic loss rule. As the court observed, appellants alleged they and Centrelake were “in direct contractual privity.” Further, appellants have
fail ed to show their claim is independent of their contracts
with Cent relake. Appellants provided their PII to Centrelake pursuant to the contracts establishing their provider

- patient relationships , and appellants’ asserted injuries arose from Centrelake’s failure to provide data security allegedly promised in the ir contrac ts. A ppellants identify only one potential source of an independent duty, viz., a federal regulation implementing HIPAA. But the sole California authority on which they rely did not address an independent duty of care under any statute (much less HIPAA), instead addressing the evidentiary doctrine of negligence per se, which concerns standards of care. (See Satterlee v. Orange Glenn School Dist. Of San Diego County (1947) 29 Cal.2d 581, 567

- 590 [under negligence per se doctrine, standard of care may be p rescribed by statute, but “liability is also dependent upon proof that a duty was owed to persons in the class of the plaintiff”]; 6 Witkin, Summary of Cal. Law ( 11th ed. 2022) Torts

, § 1004 [“It is the tort of negligence, and not the violation of the stat ute itself, that entitles a plaintiff [asserting negligence per se] to recover damages. Either the courts or the Legislature must have created a duty of care. The presumption of negligence35 created by [California’s statute codifying the negligence per

se doctrine] concerns the standard of care, rather than the duty of care”].) 9 In their reply brief, appellants make no mention of HIPAA, instead relying on a federal case concluding the economic loss rule did not bar a claim of negligent misrepresentation. (See Whittington v. KidsEmbrace, LLC (C.D. Cal., July 19, 2021, No. CV 21

- 1830

- JFW(JPRX)) 2021 U.S. Dist. LEXIS 138713 , at

* 16

- *18 .) That case is inapposite, as negligent

9 Similarly, appellants’ out

- of

- state authorities do not support their reliance on HIPAA, except perhaps as a basis for applying the evidentiary doctrine of negligence per se. (See Tuck v. Cit y of Gardiner Police Department (D. Me., Feb. 13, 2019, No. 1:18

- CV

- 00212

- JDL) 2019 U.S. Dist. LEXIS 23180 , at * 9 [ noting defendant medical provider did not dispute plaintiff’s contention that defendant had duty to ensure privacy of patients’ medical infor mation], citing Bonney v. Stephens Memorial Hosp. (Me. 2011) 17 A.3d 123, 128 [stating, in dicta, HIPAA standards “may be admissible to establish the standard of care associated with a state tort claim” (italics added)]; Acosta v. Byrum (N.C. Ct. App. 2006 ) 180 N.C.App. 562, 571

- 572 ( Acosta ) [trial court erred in purporting to dismiss HIPAA cause of action, where complaint included no such cause of action, and plaintiff merely cited HIPAA as “evidence of the appropriate standard of care”]; Ilene N. Moore et al., Confidentiality and Privacy in Health Care from the Patient's Perspective: Does HIPAA Help? (2007) 17 Health Matrix 215, 230

- 231 [citing Acosta for proposition that HIPAA regulations have been used as “evidence of standards in state tort actions”].)36 misrepresentation is a tort “‘separate and distinct’” from negligence. 10 ( Sheen

, sup ra , 12 Cal.5th at 943.) We reject appellants’ contention that their asserted
lost

- time damages a re non

- economic losses and therefore exempt from the economic loss rule. Appellants ’ complaint alleged they suffered “[a]scertainable losses in the form of

. . . the value of their time,” implicitly referring to their time’s financial value. Appellants do not claim these
financial losses were accompanied by any personal injury or property damage. Accordingly, appellants fail to show the
trial court erred in c oncluding these losses were economic

. (See Sheen

, supra , 12 Cal.5th at 915, 922; Castillo v. Seagate Technology, LLC

, supra , 2016 U.S. Dist. LEXIS 187428

, *5,
*17

- *20 [concluding plaintiffs ’ expenditures of “considerable
time and effort” were economic los ses ] ; Dugas

, supra , 2016 U.S. Dist. LEXIS 152838, at *36

- *37 [concluding plaintiff ’s “time spent and loss of productivity” were economic

losses ] .) 11

10 Because the parties are in contractual privity and appellants have fail ed to show t heir claim is independent of the parties’ contracts, we need not address the parties’ arguments concerning the existence of a special relationship under the Biakanja fact ors. (See Sheen , at 915, 942.) We note that appellants ’ complaint alleged the parties entered into a special relationship “when they contracted” for medical services.

11 Appellants misrepresent Dugas

, asserting it “clearly holds that loss of time is com pensable,” but citing its discussion of (Fn. is continued on the next page.)37 We are not persuaded by the cases on which appellants rely . The sole California case they cite is inapposit e. (See Rupp v. Summerfield (1958) 161 Cal.App.2d 657, 667 [trial court did not erroneously permit double recovery in malicious prosecution action, where court instructed jury it could award plaintiff damages for both lost earnings and lost time during pl aintiff’s underlying incarceration].) As the trial court did, we decline to follow Bass

, supra , 394 F.Supp.3d 1024, the leading federal case on which appellants rely. (See, e.g., Solara

, supra , 2020 U.S. Dist. LEXIS 80736, at *11 [following Bass on this issue].) In Bass , the court
concluded the economic loss rule did not bar a negligence
claim arising from a data breach, because the plaintiff alleged a non

- economic loss, viz., time spent sorting through phishing emails. ( Bass

, at 1039.) But Bass neithe r articulated any reasoning for concluding the plaintiff’s lost

time damages were non

- economic, nor cited any authority for this conclusion. In fact, this conclusion was undermined by the very authority Bass cited in determining that the plaintiff’s lost time was an injury in fact. (See Bass , at 1035 [“loss of time establishes injury in fact,” because “‘the value of one’s own time needed to set things straight is a loss from an opportunity

- cost perspective’” (quoting Dieffenbach v. Barnes & Noble, Inc. (7 th Cir. 2018) 887 F.3d 826, 828 ( Dieffenbach ) )] ; Dieffenbach , at 828

- 829 [where hackers stole

Article III standing. (See Dugas

, supra , 2016 U.S. Dist. LEXIS 152838, at *18

- *20.)38 plaintiff’s payment card information from retailer, plaintiff’s resulting loss of time sorting matters with police and bank

was loss, “at least in economic terms, ” under California authority indicating “significant time and paperwork costs incurred to rectify violations

. . . can qualify as economic losses” (italics added)]; cf. Perdue v. Hy

- Vee, Inc. (C.D. Ill. 2020) 455 F.Supp.3d 749, 761 [following Dieffenbach ; plaintiffs’ los ses of time in wake of data breach w ere economic loss es , which plaintiffs were barred from recovering under Illinois economic loss rule ].) We conclude appellants have fail ed to show the trial court erred in applying the economic loss rule t o sustain Centrelake’s demurrer to appellants’ negligence claim.

2. Proposed Amendment “Review of the trial court’s failure to grant leave to
amend is conducted under the abuse of discretion standard.” (Eisenberg et al., Cal. Practice Guide: Civil Appeals & Writs,

supra , ¶ 8:136.2.) “The plaintiff

- appellant has the burden of demonstrating abuse of discretion by showing how the complaint can be amended to state a cause of action.” ( Id. at ¶ 8:136.3; accord, Weil & Brown, Cal. Practice Guide: Civil
Procedure Before Trial (The Rutter Group 2022) Ch. 7(I)

- A ¶ 7:130 [“It is not up to the judge to figure out how the complaint can be amended to state a cause of action. Rather, the burden is on plaintiff to show in what manner plaintiff can amend the complaint, an d how that amendment will change the legal effect of the pleading”].) Although “such39 showing may be made in the first instance to the appellate court,” the plaintiff

- appellant “must still offer details on how the amendment would cure the defects.” (Weil & Brown, Cal. Practice Guide: Civil Procedure Before Trial, supra , ¶ 7:130.) We conclude appellants have fail ed to show the trial court abused its discretion in sustaining Centrelake’s demurrer to their negligence claim without leave to amend.
A ppellants fault the court for failing to allow them to add allegations of a future need to retake medical tests, asser ting
that “ [e] ven if Plaintiffs’ other damages theories were deficient, an amendment to the Complaint fully alleging this new theory would clearly cure the defect.” They do not specify any defect, much less explain how the proposed
amendment would cure it. Nor do they attempt to explain how the proposed amendment might enable their negligence
claim to overcome the economic loss rule. Accordingly, they have forfeited any such argument. (See People v. Guzman (2019) 8 Cal.5th 673, 683, fn. 7 [appellant forfeited due process claim by failing to “develop the argument”]; In re
Phoenix H. (2009) 47 Cal.4th 835, 845 [“‘“Contentions supported neither by ar gument nor by citation of authority
are deemed to be without foundation and to have been abandoned”’”].) We conclude appellants have fail ed to show
an abuse of discretion in the court’s dismissal of their negligence claim without leave to amend . (See Eis enberg et al., Cal. Practice Guide: Civil Appeals & Writs, supra ,40 ¶ 8:136.3; Weil & Brown, Cal. Practice Guide: Civil Procedure Before Trial, supra , ¶ 7:130.)

D. Guidance on Remand As explained above, although appellants have fail ed to show error in the tria l court’s dismissal of their negligence claim without leave to amend, we have conclude d the court erred in sustaining Centrelake’s demurrer to appellants’
UCL and contract claims . Accordingly, we will affirm the judgment with respect to the negligence cla im, reverse with respect to the UCL and contract claims, and remand for further proceedings on the latter claims. To provide guidance to the court and the parties on remand, we address appellants’ allegations that the data breach deprived them of

some por tion of the value of their PII . We conclude appellants failed to adequately plead their lost

- value

- of

- PII theory as a basis for either UCL stan ding or an award of contract damages. First, we conclude appellants’ lost

- value

- of

- PII theory, as pled, is ins ufficient to support UCL standing. We need not accept as true appellants’ allegation that they suffered “[a]scertainable losses in the form of deprivation of the value of their PII,” as this constitutes a conclusion or deduction, unsupported by any proper ly pled facts. (See Eisenberg et al., Cal. Practice Guide: Civil Appeals & Writs, supra , ¶ 8:136.) Appellants properly pled only that their PII was stolen and disseminated, and that a market for it existed. They did not allege they ever attempted or int ended to41 participate in this market, or otherwise to derive economic value from their PII. Nor did they allege that any prospective purchaser of their PII might learn that their PII had been stolen in this data breach and, as a result, refuse to
enter int o a transaction with them

, or insist on less favorable

terms. In the absence of any such allegation, appellants
failed to adequately plead that they lost money or property
in the form of the value of their PII . (See, e.g., In re Google
Inc. Cookie Placem ent Consumer Privacy Litigation (3d Cir. 2015) 806 F.3d 125, 149, 152 [affirming dismissal of UCL claim against Google, where plaintiffs alleged Google allowed defendant advertisers to circumvent plaintiffs’ cookie blockers and track plaintiffs’ internet

- h istory information in contravention of Google’s own public statements: “when it comes to showing ‘loss,’ the plaintiffs’ argument lacks traction. They allege no facts suggesting that they ever participated or intended to participate in the market they ide ntify, or that the defendants prevented them from capturing the full value of their internet usage information for themselves”]; Bass

, supra , 394 F.Supp.3d at 1040 [“That the information has external value, but no economic value to plaintiff, cannot serve to establish that plaintiff has personally lost money or property”]; cf. Folgelstrom v. Lamps Plus, Inc. (2011) 195 Cal.App.4th 986, 989, 994 [plaintiff failed to adequately plead UCL standing, where plaintiff alleged retailer obtained plaintiff’s zip code under false pretenses and , using zip code, paid third party for license to use plaintiff’s address : “The fact that the42 address had value to [the retailer] , such that the retailer paid [the third party] a license fee for its use, does not mean
that its val ue to plaintiff was diminished in any way”]; Archer v. United Rentals, Inc. (2011) 195 Cal.App.4th 807, 816 [ same, where plaintiffs claimed retailers unlawfully collected and recorded their PII as condition to accepting credit card payments ].)
We further c onclude appellants’ lost

- value

- of

- PII theory, as pled, is insufficient to support an award of contract damages. We find persuasive Jetblue

, supra , 379 F.Supp.2d 299 , on which the trial court relied. There, the plaintiffs alleged they made reservations to fly with JetBlue
airline

, in reliance on JetBlue’s contractual promises not to share their PII with third parties, but JetBlue breached the

contracts by sharing their PII with a federal government subcontractor. ( Id. at 324

- 325.) At a hearing on JetBlue ’s motion to dismiss, the plaintiffs requested leave to amend their complaint ’s contract claim to allege they were deprived of the economic value of their PII. ( Id. at 326.) Denying this request , the court dismissed the contract claim. ( Id. at 326

- 327.) The court explained that the proposed damages theory “ignore[d] the nature of the contract asserted,” under which appellants had no expectation interest in the economic value of their PII: “Plaintiffs may well have expected that in return for providing t heir personal information to JetBlue and paying the purchase price, they would obtain a ticket for air travel and the promise that their personal information would be safeguarded consistent with the terms of the43 privacy policy. They had no reason to expec t that they would be compensated for the ‘value’ of their personal information. In addition, there is absolutely no support for the proposition that the personal information of an individual JetBlue passenger had any value for which that passenger could
h ave expected to be compensated. It strains credulity to believe that, had JetBlue not provided [plaintiffs’] data en masse to [the subcontractor], [the subcontractor] would have gone to each individual JetBlue passenger and compensated
him or her for acce ss to his or her personal information

. ” 12 ( Id. at 327.) Although Jetblue applied New York contract law, its focus on the expectations of the parties is consistent
with California law . (See New West

, supra , 187 Cal.App.4th at 844.) Jetblue is also consis tent with other federal cases

, including Pruchnicki v. Envision Healthcare Corporation (9th Cir. 2021) 845 Fed.Appx. 613 ( Pruchnicki ). There, the
Ninth Circuit affirmed dismissal of a breach of contract claim where, despite studies showing PII “may have v alue in general,” the plaintiff failed to adequately allege that as a
result of a data breach, her PII “actually lost value

. ” (Id. at
614

- 615, citing In re Google, Inc. Privacy Policy Litigation (N.D. Cal., July 15, 2015, No. 5:12

- CV

- 001382

- PSG) 2015 U.S. Dist. LEXIS 92736, at *18, fn. 63 ; see also

12 In purporting to distinguish Jetblue , appellants ignore its holding on the contract claim, instead citing its separate holding

c oncerning a claim of trespass to chattels. (See Jetblue

, supra , 379 F.Supp.2d at 328.)44 LaCourt v. Specific Media, Inc. (C.D. Cal., Apr. 28, 2011, No.
SACV 10

- 1256 GW ( JCGX ) ) 2011 U.S. Dist. LEXIS 50543

, at *3

- *4, *11

- * 12 [ plaintiffs failed to adequately plead Article III standing, where plaintiffs alleged defendant’s
unauthorized collection and use of plaintiffs’ internet

- history
information deprived them of its economic value, but did not allege they personally “ascribed an economic value” to such
information or were “foreclosed from entering into a ‘value

for

- value exchange’ as a result of [defendant’s] alleged conduct”] .) We find these cases, including the Ninth Circuit’s
recent decision in Pruchnicki , more persuasive than an older Ninth Circuit case on which appellants rely. (See In re
Facebook Privacy Litigation (9th Cir. 2014) 572 Fed.Appx. 494, 494 ( Facebook Privacy ) [district court erred in dismissing breach of contract claims for failure to adequately plead damages: “Plaintiffs allege that the information disclosed by Facebook [to third

- par ty advertisers] can be used to obtain personal information about plaintiffs, and that they were harmed .

. . by losing the sales value of that information. In the absence of any applicable contravening state law, these allegations are sufficient to show t he element of damages for their breach of contract and fraud claims”].) In relying on the purported absence of contravening state law, Facebook Privacy put the cart before
the horse

-- damages are not recoverable unless authorized by law. The scant Calif ornia authority cited by Facebook Privacy did not address the value of PII , much less any45 deprivation thereof . (See Gautier v. General Tel. Co. (1965) 234 Cal.App.2d 302, 305

- 306 [trial court properly sustained demurrer to plaintiffs’ claim that defendant telephone company breached contract by refusing to transfer calls]; Lazar v. Superior Court (1996) 12 Cal.4th 631, 637, 648

- 649 [trial court erred in sustaining demurrer to plaintiff’s claim that defendant fraudulently induced him to leave former job
for new job in another state].) W e find Facebook Privacy

un persuasive. 13

13 Accordingly, we are unpersuaded by appellants ’ reliance on federal district court cases that followed Facebook Privacy on this issue. (See, e.g., Calhoun v. Google LLC (N.D. Cal. 2021) 526 F.Supp.3d 605, 636 ( Calhoun ) [following Facebook Privacy and three district court cases that had followed it, including two earlier cases decided by same judge , in holding plaintiffs adequately pled UCL standing by alleging Google collected information from them without authorization , diminishing information’s property value ].) In their appellate reply brief, appellants misrepresent Calhoun , asserting “the court held broadly that loss of privacy in personal information is a legally recognized injury

. . . . ” In fact, Calhoun addressed a loss of privacy

-- as opposed to a loss of property value

-- only in holding th e plaintiffs had adequately pled a n intrusion

- upon

- seclusion claim (one variety of the tort of invasion of privacy). ( See id. at 629

- 631 .) In any event, a ppellants forfeited any contention that “‘privacy harm ’

. . . itself adequately demonstrates damages,” by failing to raise such a contention before the trial court or in their opening appellate brief. (See People v. Mo rales (2020) 10 Cal.5th 76, 98 [finding argument “doubly forfeited” by appellant ’ s failure to object in trial court or raise issue in opening appellate brief].)46 M any other cases on which appellants rely are inapposite. (See Fraley v. Facebook, Inc. (N.D. Cal. 2011) 830 F.Supp.2d 785, 791

- 792, 798

- 799, 811 [distinguishing
Jetblue , where plaintiff s alleged Facebook misappropriated their names and likenesses by using them in commercial
endorsements

, but did not allege “that their personal information ha[d] inherent economic value and that the mere disclosure of such data constitute[d] a loss of mone y or property”]; CTC Real Estate Services v. Lepe (2006) 140 Cal.App.4th 856, 858

- 861 [trial court erred in denying identity

- theft victim’s unopposed claim for recovery of remaining proceeds of the theft , on unjust enrichment theory ]; KNB Enterprises v. Ma tthews (2000) 78 Cal.App.4th 362, 364

- 365 [federal copyright law did not preempt statutory claims based on defendant’s misappropriation of photography models’ right of publicity] ; In re Facebook, Inc. Internet Tracking Litigation (9th Cir. 2020) 956 F.3d 5 89,
610

- 611 ( Facebook Tracking ) [affirming dismissal of contract claim, where plaintiffs failed to adequately plead existence of contract].) In the portion of Facebook Tracking on which appellants rely, the court held the plaintiffs had Article III
standi ng to bring certain claims not at issue here, based on
Facebook’s unauthorized collection and use of the plaintiffs’
internet

- history information, which the court recognized had value to Facebook. ( Facebook Tracking , 956 F.3d at 599

- 601 .) But the court d id not suggest the plaintiffs suffered any corresponding loss of value

-- on the contrary, it relied

on unjust enrichment law

, under which each plaintiff had a47 stake in Facebook’s profits “ regardless of whether

. . . the individual’s data [wa]s made less v aluable.” ( Id. at 60 0 .) Here, in contrast, appellants rely on a theory that
Centrelake made their PII less valuable to them. We conclude they did not adequately ple a d this theory as a basis for either UCL standing or contract damages.48 DISPOSITION The judgment is affirmed with respect to the dismissal of appellants’ negligence claim without leave to amend . The judgment is otherwise reversed. The matter is remanded for further proceedings consistent with this opinion. Appellants

a re awarded their costs on appeal.

CERTIFIED FOR PUBLICATION

MANELLA, P. J.

We concur:

WILLHITE, J.

C URREY , J.