Source: http://updates.mwbllp.com/2018_11_25_archive.html
Timestamp: 2020-01-28 21:06:31
Document Index: 345587792

Matched Legal Cases: ['§ 1798', '§ 1750', '§ 17200', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1770', '§ 1761', '§ 17200', '§ 1701', '§ 1701', '§ 445', '§ 1701', '§ 1701', '§ 445', '§ 1701', '§ 1701', '§ 445']

Financial Services Law Developments: 11/25/18 - 12/2/18
FYI: SD Cal Dismisses Data Security Breach Class Action Against Mortgage Company
The U.S. District Court for the Southern District of California recently dismissed a consumer's putative class action lawsuit against a mortgage lending and servicing company for purported damages sustained as a result of a security breach wherein his personal information was compromised, and the hackers attempted to open credit cards in his name.
Although the Court previously concluded that the consumer had standing to bring his claims under Article III of the Constitution, it held that the consumer failed to state causes of action for negligence and violations of various California laws.
A consumer ("Consumer"), on behalf of himself and others similarly situated, sued his mortgage sued a mortgage lender and servicer ("Mortgage Company") after its customer database was hacked, and confidential customer information, such as social security numbers, was compromised.
The consumer claimed that he suffered monetary and emotional distress damages as a result of a cybercriminal's attempts to open credit cards in his name, as a result of the Mortgage Company's inadequate security and failure to timely notify its customers of the breach.
The Consumer filed suit against the Mortgage Company in the Superior Court of California, San Diego County, alleging causes of action for: (i) negligence; (ii) violation(s) of California Constitution (Art. I, § I); (iii) violation(s) of the California Customer Records Act (Civ. Code § 1798.80); (iv) violation(s) of the California Consumers Legal Remedies Act (Cal. Civ. Code § 1750), and; (v) violation(s) of the California Unfair Competition Law (Cal. Bus. & Prof. Code § 17200).
The Mortgage Company removed the action to United States District Court for the Southern District of California under the Class Action Fairness Act, and moved to dismiss the Consumer's complaint for lack of standing and failure to state a claim.
First, in considering the Consumer's Article III standing, the federal trial court rejected the Mortgage Company's arguments that increased risk of identity theft is not an injury in fact, citing the Ninth Circuit's recent holding that data-breach-victims pled "an injury in fact based on a substantial risk that hackers will commit identity fraud" and established a reasonable inference of causation by alleging that his identity was stolen and exploited. In re Zappos.com, Inc.,888 F.3d 1020, 1029 (9th Cir. 2018).
In addition, the Court held that the Mortgage Company's argument that the Consumer failed to allege it possessed his data at the time of the breach or that it was actually stolen was undermined by its admission that it sent notices to customers who may have been affected by the breach -- which consumer received-- and in any event, was waived because it was raised for the first time in the Mortgage Company's reply brief. Thus, the motion to dismiss for lack of standing was denied.
Next, in examining the Consumer's negligence claims, the federal trial court drew analogies to the Ninth Circuit case of Krottner v. Starbucks, wherein the plaintiff consumer similarly alleged that personal information was misused, but the court couldn't find "loss related to the attempt to open a bank account in his name." Krottner v. Starbucks Corp., 406 F. App'x 129, 131 (9th Cir. 2010).
Although the Starbucks court found risk of identity theft following a data breach sufficient to supply an injury-in-fact for standing, the Starbucks consumer plaintiff's claims were insufficient to support actual damages for a negligence claim because the injuries "stem from the danger of future harm." Here, the Consumer failed to distinguish his case from Starbucks, and the Court found his allegations were too vague for the court or Mortgage Company to evaluate. Thus, the Consumer's negligence claims were dismissed, but with leave to amend.
Following amendment by the Consumer, the Court dismissed the negligence claim with prejudice and without leave to amend. The Consumer alleged damages such as "diminution in value of his personal data, overpayments to [Mortgage Company], and continued risk to his financial information." However, as to the alleged continued risk of harm, the Court held the allegation was "still insufficient because it stems from the danger of future harm," which is insufficient under Starbucks. The Court also held that the alleged diminution of value of his personal data failed to allege "enough facts to establish how his personal information is less valuable as a result of the breach." Similarly, as to the alleged overpayment to Mortgage Company, the Consumer failed to "provide any information to show that he paid a premium for [Mortgage Company] to provide reasonable and adequate security measures."
The Consumer also argued that the Mortgage Company's breach of data violated his right to privacy under Art. I, Section I of the California Constitution. However, the loss of personal data through insufficient security fails to constitute "a serious invasion of privacy" that is "an egregious breach of the social norms underlying the privacy right" necessary to meet the standard of actionable conduct under the California Constitution. Hill v. Nat'l Collegiate Athletic Assn., 7 Cal. 4th 1, 37, 40 (1994); In re iPhone Application Litig.,844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012) ("Even negligent conduct that leads to theft of highly personal information, including social security numbers, does not approach the standard of actionable conduct under the California Constitution and thus does not constitute a violation of Plaintiffs' right to privacy." ). Accordingly, these claims, too, were dismissed, with leave to amend.
Next, the court considered the Consumer's claims that the Mortgage Company failed to comply with the Customer Records Act, Civ. Code § 1798.80 ("CRA"), which requires businesses to protect customers' personal information by maintaining "reasonable security procedures," and if a data breach occurs, to notify affected customer's "without unreasonable delay" §§ 1798.81.5, 82.
The Consumer argued that the Mortgage Company waived its argument by failing to address this claim, but the Court found just the opposite, and that the Consumer failed to address the Mortgage Company's arguments that dismissal was warranted for failure to allege injury, and for conclusory allegations about security, data disposal and notification. Thus, the claim was deemed abandoned, and dismissed with leave to amend. See, e.g., Shull v. Ocwen Loan Servicing, LLC, 2014 WL 1404877, at *2 (S.D. Cal. Apr. 10, 2014).
Following amendment by Consumer, the Court also dismissed the CRA claim with prejudice and without leave to amend. The Court noted that, although the CRA requires businesses to notify customers of a data breach "in the most expedient time possible and without reasonable delay" (Cal. Civ. Code § 1798.82(a)), courts have required plaintiffs to "show that the delay in notification led to incremental harm." The Consumer did not do so here.
Moreover, the CRA requires businesses to "implement and maintain reasonable security procedures and practices appropriate to the nature of the information." Cal. Civ. Code § 1798.81.5. The Court held that Consumer "could have identified what made [Mortgage Company]'s security measures unreasonable by comparison to what other companies are doing, but simply knowing of higher-quality security measures is not sufficient to state a claim."
The Consumer's claims under the Consumers Legal Remedies Act ("CLRA") asserted that the Mortgage Company violated various provisions of Cal. Civ. Code § 1770(a)'s ban on unfair business practices that result "in the sale or lease of goods or services to any consumer."
As you may recall, the CLRA defines "services" as "work, labor, and services for other than a commercial or business use, including services furnished in connection with the sale or repair of goods." § 1761.
Here, the Court accepted the Mortgage Company's argument that home loans do not qualify as "the sale of a service" under the CLRA, citing California Supreme Court authority that that "ancillary services that insurers provide to actual and prospective purchasers of life insurance" do not count as a "service" under the CLRA because the activity centers on a "contractual obligation to pay money." Fairbanks v. Superior Court, 46 Cal. 4th 56, 61, 65 (2009). Thus, the Consumer's CLRA claims were dismissed, but without leave to amend.
Lastly, the Consumer claimed that the Mortgage Company violated California's Unfair Competition Law (Cal. Bus. & Prof. Code § 17200) ("UCL") by supposedly engaging in unfair business practices by failing to provide sufficient security for his data.
Here, the Court noted that the Consumer's complaint failed to explain which theory he was advancing under the UCL. Although his opposition brief suggested the Consumer relied upon his CLRA and CRA claims as predicates for an unlawful theory, because those causes of action failed to state a claim, and because the Consumer failed to sufficiently allege "lost money or property," as required, the Consumer's Unfair Competition Law claim also failed to state a cause of action, and was dismissed with leave to amend.
Consumer amended his UCL claim, but the Court held the amendments were insufficient, and this time dismissed the UCL claim with prejudice. The Court noted that a UCL plaintiff must "have suffered an `injury in fact' and `lost money or property as a result of such unfair competition." Consumer argued that he met this element because funds were withdrawn without his consent from his bank account. However, the Court noted, Consumer's bank quickly reversed the transaction, and therefore Consumer suffered no "injury in fact," as required.
Accordingly, the motion to dismiss Consumer's putative class action lawsuit was granted with prejudice and without leave to amend.
Posted by Ralph T. Wutscher at 10:02 AM
FYI: 6th Cir Holds No Federal Jurisdiction for Claim Under Garn-St. Germain Act
In a 2-1 decision, the U.S. Court of Appeals for the Sixth Circuit recently held that, because a complaint's sole federal claim under the Garn-St. Germain Depository Institutions Act of 1982, 12 U.S.C. § 1701j-3 ("Garn-St. Germain Act") did not provide a private cause of action, and because the state law claims did not implicate significant federal issues, the trial court lacked jurisdiction.
Accordingly, the Sixth Circuit vacated the trial court's judgment with instructions to remand the case to state court.
The borrower ("Borrower") died with an outstanding balance on his mortgage loan. Although he was current on his mortgage loan at the time of his death, in the first five months following his death the loan went unpaid.
As a result, the defendant mortgagee ("Mortgagee") foreclosed on the mortgage and purchased the home by sheriff's deed at a public auction. The Mortgagee later sold the home to a third-party purchaser ("Purchaser").
The Borrower's estate ("Estate") subsequently filed a complaint in state court against the Mortgagee asserting claims for lack of standing to foreclose under the Garn-St. Germain Depository Institutions Act of 1982, 12 U.S.C. § 1701j-3 ("Garn-St. Germain Act"), and Mich. Comp. Laws § 445.1626.
The Mortgagee and Purchaser (collectively, "Defendants") then moved for judgment on the pleadings in part based on the argument that the Garn-St. Germain Act does not authorize a private right of action.
The trial court agreed, ruling that the Garn-St. Germain Act does not authorize a private right of action and that the Garn-St. Germain Act did not apply to the Estate's claims. The trial court therefore granted the Defendants' motion on all counts and entered judgment in their favor.
On appeal, the Sixth Circuit first noted that "[a]lthough no one has specifically addressed subject matter jurisdiction to this point, we have an independent obligation to consider it and may do so sua sponte."
The Court observed that "the complaint reference[d] a federal statute, the Garn-St. Germain Act, . . . which is the sole basis for federal question jurisdiction removal from state court."
As you may recall, the Garn-St. Germain Act prohibits states from banning due-on-sale clauses, providing in principal part that "[n]otwithstanding any provision of the constitution or laws (including judicial decisions) of any State to the contrary, a lender may, subject to subsection (c) of this section, enter into or enforce a contract containing a due-on-sale clause with respect to a real property loan." 12 U.S.C. § 1701j-3(b)(1).
Thus, a "due-on-sale clause is presumptively valid unless it qualifies as one of nine exceptions listed in § 1701j-3(d)," and states can therefore only regulate nine types of due-on-sale clauses. In response to the Garn-St. Germain Act, Michigan created its own cause of action for borrowers harmed by one of those nine banned due-on-sale clauses. See Mich. Comp. Laws § 445.1626.
To determine whether it had subject matter jurisdiction, the Sixth Circuit explained that it "must determine whether a private cause of action 'arises under' the statute sufficient to confer federal subject matter jurisdiction."
Moreover, "[t]he 'arising under' gateway into federal court . . . has two distinct paths: 1) 'litigants whose causes of action are created by federal law,' and 2) 'state-law claims that implicate significant federal issues.'"
The Sixth Circuit held that "[b]ecause the Garn-St. Germain Act does not meet this first test, we join those courts, including this one, that have concluded 12 U.S.C. § 1701j-3 does not establish subject matter jurisdiction based on a federal cause of action."
Further, "subject matter jurisdiction is also not established under the second test."
In reaching its conclusion, the Court first examined whether the Garn-St. Germain Act created a private cause of action. To make that determination, the court "begin[s] with the text of the statute," which may provide for an express or implied private cause of action.
The Sixth Circuit concluded that "[t]he Garn-St. Germain Act does not create a express cause of action because it does not state, 'in so many words, that the law permits a claimant to bring a claim in federal court.'"
Moreover, the Garn-St. Germain Act does not create an implied cause of action. To do so, "the statute must specific the right and identify a beneficiary."
However, the Garn-St. Germain Act does not identify specific beneficiaries. "Although mortgagors may benefit, because § 1701j-3 'focus[es] on the person[s] regulated rather than the individuals protected,' . . . and does not unambiguously specify a beneficiary, no right of action can be implied."
The Sixth Circuit next examined whether the state law implicated a "substantial question of federal law" that would open the door to federal court.
To determine whether a "substantial question of federal law" is implicated, the court asks whether: (1) "a state-law claim necessarily raise[s] a stated federal issue," (2) that is "actually disputed and substantial," (3) "which a federal forum may entertain without disturbing any congressionally approved balance of federal and state judicial responsibilities."
In analyzing these factors, the Sixth Circuit determined that although Mich. Comp. Laws §§ 445.1626 and 445.1628 reference the Garn-St. Germain Act, "the question they raise is not sufficiently substantial to justify federal question jurisdiction."
Thus, "because the federal statute does not create a cause of action, and the federal issue nested inside [the Estate's] state law cause of action is not substantial, the [trial] court lacked subject matter jurisdiction."
Accordingly, the Sixth Circuit vacated the trial court's judgment and instructed the district court to remand the matter to state court.