United States District Court, S.D. California
In re SONY GAMING NETWORKS AND CUSTOMER DATA SECURITY BREACH LITIGATION.
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
Ben Barnow, Barnow and Associates PC, Bradley M. Baglien, Christopher L. Dore, Jay Edelson, Edelson McGuire LLC, Michael J. Aschenbrener, Aschenbrener Law P.C., Joseph J. Siprut, Siprut PC, Chicago, IL, Brian Russell Strange, Strange & Carpenter, Lionel Z. Glancy, Marc L. Godino, Michael M Goldberg, Glancy, Binkow & Goldberg, LLP, Jon Anders Tostrud, Tostrud Law Group PC, Sandra Watson Cuneo, Cuneo Gilbert & Laduca, LLP, Justin B. Farar, Kaplan Fox and Kilsheimer LLP, Robert R. Ahdoot, Theodore Walter Maya, Tina Wolfson, Ahdoot & Wolfson APC, David E. Azar, Milberg LLP, Jeff S. Westerman, Westerman Law Corp., David E. Bower, Faruqi & Faruqi, LLP, Andrew Joseph Sokolowski, Raul Perez, Matthew T. Theriault, Initiative Legal Group APC, David Lishian Cheng, Miriam L. Schimmel, Rebecca Maria Labat, Capstone Law APC, Los Angeles, CA, Robert R. Henssler, Jr., Douglas R. Britton, Rachel L. Jensen, Robbins Geller Rudman & Dowd LLP, Timothy Gordon Blood, Thomas Joseph O'Reardon, II, Blood Hurst & O'Reardon LLP, John Miller Turner, III, Mark A. Maasch, Turner and Maasch, Gayle M. Blatt, Casey, Gerry, Schenk, Francavilla, Blatt & Penfield LLP, Mark Alan Milstein, Lincoln Gustafson and Cercos, Betsy Carol Manifold, Francis Michael Gregorek, Francis Michael Gregorek, Patrick Hugh Moran, Rachele R. Rickert, Wolf, Haldenstein, Adler, Freeman & Herz, LLP, William James Doyle, II, Doyle Lowther LLP, Daniel Roman Tamez, Gnau & Tamez Law Group, LLP, San Diego, CA, Lance A. Harke, Harke Clasby & Bushman LLP, Miami, FL, Seth R. Gassman, Labaton Sucharow LLP, Brian Philip Murray, Gregory Bradley Linkh, Murray Frank LLP, Joe R. Whatley, Jr., Whatley Drake & Kallas LLC, Patrick J. Sheehan, Whatley Kallas, LLC, Shujah Ahmad Awan, Shujah Awan, Lester L. Levy, Wolf Popper, Curtis V. Trinko, Jennifer Elizabeth Traystman, Law Offices of Curtis V. Trinko, Scott A. Bursor, Bursor & Fisher, PA, Bruce E. Gerstein, Garwin Gerstein & Fisher LLP, Scott W. Fisher, Garwin Bronzaft Gerstein & Fisher LLP, Ted Trief, Trief & Olk, New York, NY, James D. Hoey, III, The Hoey Law Firm, La Jolla, CA, Thomas Gourrier Bousquet, Bousquet Law, P.C., Muhammad Suleiman Aziz, Abraham WatkinsNichols Sorrels and Friend, Cory S. Fein, Cynthia B. Chapman, Michael A. Caddell, Caddell & Chapman, Houston, TX, Caleb L.H. Marker, Christopher Paul Ridout, Devon M. Lyon, Ridout & Lyon, LLP, Long Beach, CA, Gillian L. Wade, Sara Dawn Avila, Milstein Adelman LLP, Santa Monica, CA, Mark Schlachet, Law Offices of Mark Schlachet, Cleveland, OH, Paul C. Whalen, Paul C. Whalen, Esq., Manhasset, NY, Christopher D. Jennings, John G. Emerson, Jr., Scott E. Poynter,
William T. Crowder, Emerson Poynter LLP, Little Rock, AR, David I. Pankin, Brooklyn, NY, Daniel E. Becnel, Jr., Jennifer L. Crose, Becnel Law Firm, LLC, Reserve, LA, Matthew B. Moreland, Matthew B. Moreland, Attorney at Law, Allan Kanner, Kanner & Whiteley, LLC, New Orleans, LA, Thomas D. Mauriello, Mauriello Law Firm APC, San Clemente, CA, Laurence D. King, Linda M. Fong, Kaplan, Fox & Kilsheimer, LLP, Jonas Palmer Mann, Joshua Caleb Ezrin, Kevin Lee Thomason, William M. Audet, Audet & Partners LLP, J. Kirk Boyd, Public Interest Lawyers Group, Michael F. Ram, Ram, Olson, Cereghino & Kopczynski LLP, Mark E. Burton, Jr., Hersh and Hersh, Shawn A. Williams, Robbins Geller Rudman & Dowd LLP, Jennie Lee Anderson, Andrus Anderson LLP, Stuart George Gross, Gross Law, Aaron Hillel Darsky, Schubert and Reed, Josef D. Cooper, Cooper & Kirkham, PC, Mark F. Anderson Anderson, Ogilvie & Brewer LLP, San Francisco, CA, Sean Patrick Reis, Edelson McGuire LLP, Rancho Santa Margarita, CA, Todd Goldberg, Goldfarb Branham LLP, Jeremy Reade Wilson, Wilson Trosclair & Lovins, Kenneth P. Trosclair, Nabil Majed Nachawati, II, Fears Nachawati Law Firm, Dallas, TX, Robert K. Shelquist, Lockridge Grindal Nauen P.L.L.P., Executive Committee Member, Daniel C. Hedlund, Gustafson Gluek PLLC, Minneapolis, MN, Curtis Brooks Cutter, John R. Parker, Jr., Stuart C. Talley, William Alter Kershaw, Kershaw, Cutter & Ratinoff, LLP, Sacramento, CA, Ira Perry Rothken, Jared Robinson Smith, Rothken Law Firm, Novato, CA, Lawrence Timothy Fisher, Sarah N. Westcot, Bursor & Fisher, PA, Walnut Creek, CA, Cullin Avram O'Brien, Mark Jeffrey Dearman, Paul J. Geller, Stuart A. Davidson, Robbins Geller Rudman & Dowd LLP, Boca Raton, FL, Mark S. Reich, Coughlin Stoia Geller Rudman & Robbins LLP, Samuel H. Rudman, Lerach CoughlinStoia Geller Rudman and Robbins, Melville, NY, Brian W. Smith, Smith Vanture & Rivera LLP, West Palm Beach, FL, Gerald H. Clark, Clark Law Firm, West Long Branch, NJ, Brian Scott Cohen, Cohen Law Group, P.C., Greenwich, CT, Kenneth G. Gilman, Gilman and Pastor, LLP, Wareham, MA, Michele Monique Desoer, Wites & Kapetan P.A., Reginald Terrell, The Terrell Law Group, Oakland, CA, Richard Alan Proaps, Law Offices of Richard A. Proaps, Fair Oaks, CA, David Pastor, Pastor Law Office, LLP, Gary Klein, Shennan Kavanagh, Klein Kavanagh Costello, LLP, Boston, MA, Seth Michael Lehrman, Farmer, Jaffe, Weissing, Edwards, Fistos & Lehrman, P.L., Fort Lauderdale, FL, Mark A. Chavez, Nance Felice Becker, Chavez and Gertler LLP, Mill Valley, CA, Peter S. Pearlman, Cohn Lifland Pearlman Hermann & Knopf LLP, Saddle Brook, NJ, Donald Chidi Amamgbo, Esq., Amamgbo & Associates, Culver City, CA, David M. Honigman, Mantese Honigman Rossman & Williamson, PC, Troy, MI, Jeffrey A. Hank, East Lansing, MI, Nancy L. Fineman, Carr McClellan Ingersoll Thompson and Horn, Steven Noel Williams, Victor Santiago Elias, Cotchett, Pitre & McCarthy LLP, Burlingame, CA, Irwin Levin, Lynn A. Toops, Richard E. Shevitz, Cohen and Malad LLP, Richard P. Batesky, Batesky Law Office, Indianapolis, IN, Craig Frank Holthaus, John W. DeGravelles, DeGravelles, Palmintier, Holthaus & Fruge, Gerald J. Asay, Scott E. Frazier, Kracht & Frazier, LLP, Baton Rouge, LA, for Plaintiffs.
Amanda Catherine Fitzsimmons, William S. Boggs, DLA Piper LLP, San Diego, CA, David Alan Walton, Beirne Maynard et al., Houston, TX, Douglas H. Meal, Harvey J. Wolkoff, Robert B. Gordon, Mark P. Szpak, Ropes & Gray, LLP, Boston, MA, Karin Pagnanelli, Mitchell, Silberberg & Knupp LLP, Los Angeles, CA, Morris Weinberg, Jr., Zuckerman Spaeder,
Tampa, FL, Rocky C. Tsai, Ropes & Gray LLP, Thad A. Davis, Gibson Dunn & Crutcher LLP, San Francisco, CA, for Defendants.
ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS' MOTION TO DISMISS PLAINTIFFS' CONSOLIDATED CLASS ACTION COMPLAINT
ANTHONY J. BATTAGLIA, District Judge.
Presently before the Court are (1) Defendants' Motion to Dismiss Plaintiffs' Consolidated Class Action Complaint; and (2) Defendants' Supplemental Request for Judicial Notice. [Doc. 94.] Plaintiffs filed an opposition, [Doc. No. 107], and Defendants filed a reply, [Doc. No. 114]. The Court held a hearing on the motion on Thursday, September 27, 2012. For the reasons set forth below, the Court (1) GRANTS in part and DENIES in part Defendants' motion to dismiss Plaintiffs' Consolidated Class Action Complaint; and (2) GRANTS in part and DENIES in part Defendants' Supplemental Request for Judicial Notice.
I. Factual Background
This action arises out of a criminal intrusion into the computer network system used to provide PlayStation Network (" PSN" ) services. Plaintiffs, a putative consumer class, allege that Sony Computer Entertainment America, LLC (" SCEA" ), Sony Network Entertainment International, LLC and Sony Network Entertainment America, Inc. (collectively, " SNE" ), Sony Online Entertainment, LLC (" SOE" ), and Sony Corporation of America (" SCA" ) (collectively, " Sony" or " Defendants" ) failed to follow basic industry-standard protocols to safeguard its customers personal and financial information, thereby creating foreseeable harm and injury to the Plaintiff class.
Sony develops and markets the PlayStation Portable (" PSP" ) hand-held device and the PlayStation 3 (" PSP" ) console (collectively, " consoles" ). [Compl. ¶¶ 24, 25.] Among their key features are their ability to let users play games, connect to the Internet, access the PlayStation Network (" PSN" ), Qriocity, and Sony Online Entertainment (" SOE" ) (collectively, " Sony Online Services" or " SOS" ), [ Id. ¶¶ 26, 27-29]. For additional fees, the PSN also allows access to various third party services such as Netflix, MLB.TV, and NHL Gamecenter LIVE (" Third Party Services" ). [ Id. ¶ 31.] These additional fees are paid to the source of the service rather than to Sony. Many who subscribe to these Third Party Services can only access them through their PSN account. [ Id. ¶¶ 9-11, 14, 38.] As of January 25, 2011, PSN had over 69 million users worldwide, [ Id ], and SOE had over 24.6 million users worldwide, [ Id. ¶ 29].
When establishing accounts with PSN, Qriocity, and SOE, Plaintiffs and other Class members were required to provide personally identifying information to Sony, including their names, mailing addresses, email addresses, birth dates, credit and debit card information (card numbers, expiration dates and security codes) and login credentials (" Personal Information" ),
which Sony stores and maintains on its Network. [ Id. at 35.] Sony continually monitors and records users' PSN activities, purchases and usage, and maintains this usage data on its Network. [ Id. ¶ 36.]
Plaintiffs allege that on April 16 or 17, 2011, hackers accessed Sony's Network, stealing the Personal Information of millions of Sony customers, including Plaintiffs and the other Class members (the " Data Breach" ). [ Id. ¶ 46.] On April 17, 2011, Sony discovered that PSN and Qriocity user data had been stolen. [ Id. ¶ 51.] Three days later, Sony took the PSN and Qriocity offline, stating that " [w]e're aware certain functions of PlayStation Network are down. We will report back here as soon as we can with more information." [ Id. ¶ 52.] As a result of the Data Breach, Sony was forced to shut down the PSN and Qriocity for almost a month while it conducted a systems audit to determine the cause of the data breach. [ Id. ¶ 97.] Meanwhile, SOE remained offline for more than two weeks. During this prolonged downtime, Plaintiffs and the other Class members were unable to access PSN, Qriocity, and SOE, unable to play multi-player online games with others, and unable to use online services available through the PSN, Qriocity or SOE. Plaintiffs and the other Class members were also unable to access and use prepaid Third Party Services. [ See Id. ¶¶ 9-11, 14, 98.]
Between April 21 and April 25, 2011, while the PSN and Qriocity remained off-line, Plaintiffs claim Sony continued to misrepresent the circumstances of the breach. [ Id. ¶¶ 54-55, 58.] It was not until April 26, 2011, that Sony finally told the public that the personal information had been taken. [ Id. ¶ 59.] Shortly thereafter, Sony admitted that its failures " may have had a financial impact on our loyal customers. We are currently reviewing options and will update you when the service is restored." [ Id. ¶ 60.] Sony also conceded that " [s]ome games may require access to PSN for trophy sync, security checks or other network functionality and therefore cannot be played offline." [ Id. ] On May 12, 2011, Sony announced that it would compensate SOE users in the United States by offering free identity theft protection services, certain free downloads and online services, and " will consider" helping customers who have been issued new credit cards. [ Id. ¶ 66.]
Plaintiffs further allege that Sony knew, or should have known, that its security measures were inadequate and that its network was vulnerable to attack because its network had been previously compromised. In 2011, after a PS3 user successfully " jailbroke" his PS3 console and posted instructions for doing it, Sony sued him to chill others from doing the same. [ Id. ¶ 69.] However, according to Plaintiffs, Sony did nothing to update its inadequate protocols or otherwise implement adequate safeguards. [ Id. ¶ 75.] Moreover, in a May 1, 2011 admission, Sony Corporation Chief Information Officer Shinji Hasejima conceded that Sony's Network was not secure at the time of the data breach and that the attack was a " known vulnerability." [ Id. ¶ 76.] According to Plaintiffs, this is further evidenced by Sony's decision to not install and maintain appropriate
firewalls on its networks, including the Payment Card Industry Data Security Standard (" PCI DSS" ), which requires anyone collecting payment card information to install and maintain a firewall and is standard in the industry. [ Id. ¶ 83.]
II. Procedural History
This case is before the Court pursuant to 28 U.S.C. § 1407. On August 16, 2011, the Judicial Panel on Multi-District Litigation transferred certain civil actions from multiple district courts across the country into one consolidated action. [Doc. No. 1.] On November 11, 2011, this Court appointed a Liaison Counsel and a Plaintiffs' Steering Committee (" PSC" ) to streamline the process. [Doc. No. 61.] Thereafter, Plaintiffs were informed that the PSC should file a Consolidated Complaint on behalf of all Plaintiffs, and the Defense could respond to the Consolidated Complaint. [Doc. No. 63.] Plaintiffs filed their Consolidated Class Action Complaint on January 31, 2012, [Doc. No. 78], and Defendants filed the instant motion to dismiss, [Doc. No. 94].
I. Motion to Dismiss Under Rule 12(b)(1)
A Rule 12(b)(1) motion to dismiss tests whether a complaint alleges grounds for federal subject matter jurisdiction. If the plaintiff lacks standing under Article III of the U.S. Constitution, then the court lacks subject matter jurisdiction, and the case must be dismissed. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 101-02, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998).
A jurisdictional challenge may be facial or factual. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir.2004). Where the attack is facial, the court determines whether the allegations contained in the complaint are sufficient on their face to invoke federal jurisdiction, accepting all material allegations in the complaint as true and construing them in favor of the party asserting jurisdiction. See Warth v. Seldin, 422 U.S. 490, 501, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). Where the attack is factual, however, " the court need not presume the truthfulness of the plaintiff's allegations." Safe Air for Everyone, 373 F.3d at 1039. In resolving a factual dispute as to the existence of subject matter jurisdiction, a court may review extrinsic evidence beyond the complaint without converting a motion to dismiss into one for summary judgment. See id.; McCarthy v. United States, 850 F.2d 558, 560 (9th Cir.1988) (holding that a court " may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction" ). Once a party has moved to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1), the opposing party bears the burden of establishing the Court's jurisdiction. See Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377, 114 S.Ct. 1673, 128 L.Ed.2d 391 (1994); Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1122 (9th Cir.2010).
II. Motion to Dismiss Under Rule 12(b)(6) and Rule 9(b)
A complaint must contain " a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a) (2009). A motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure tests the legal sufficiency of the claims asserted in the complaint. Fed.R.Civ.P. 12(b)(6);
Navarro v. Block, 250 F.3d 729, 731 (9th Cir.2001). The court must accept all factual allegations pleaded in the complaint as true, and must construe them and draw all reasonable inferences from them in favor of the nonmoving party. Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336, 337-38 (9th Cir.1996). The Court is not bound, however, to accept " legal conclusions" as true. Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 1949-50, 173 L.Ed.2d 868 (2009).
To avoid a Rule 12(b)(6) dismissal, a complaint need not contain detailed factual allegations; rather, it must plead " enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). However, " a plaintiff's obligation to provide the ‘ grounds' of his ‘ entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Id. at 555, 127 S.Ct. 1955 (citation omitted). " Factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations in the complaint are true (even if doubtful in fact)." Id. (citation omitted). In spite of the deference the court is bound to pay to the plaintiff's allegations, it is not proper for the court to assume that " the [plaintiff] can prove facts that [he or she] has not alleged or that defendants have violated the ... laws in ways that have not been alleged." Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters, 459 U.S. 519, 526, 103 S.Ct. 897, 74 L.Ed.2d 723 (1983).
But " [w]hen there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement to relief." Id. at 1950. A claim has " facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 1949 (citing Twombly, 550 U.S. at 556, 127 S.Ct. 1955). " The plausibility standard is not akin to a ‘ probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully." Id. " Where a complaint pleads facts that are ‘ merely consistent with’ a defendant's liability, it ‘ stops short of the line between possibility and plausibility of entitlement to relief.’ " Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct. 1955).
Complaints alleging fraud must satisfy the heightened pleading requirements of Federal Rule of Civil Procedure 9(b). Rule 9(b) requires that in all averments of fraud or mistake, the circumstances constituting fraud or mistake shall be stated with particularity. Malice, intent, knowledge, and other conditions of a person's mind may be alleged generally. A pleading is sufficient under Rule 9(b) if it " state[s] the time, place and specific content of the false representations as well as the identities of the parties to the misrepresentation." Misc. Serv. Workers, Drivers & Helpers v. Philco-Ford Corp., 661 F.2d 776, 782 (9th Cir.1981) (citations omitted); see also Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir.2003) (quoting Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir.1997)) (" Averments of fraud must be accompanied by ‘ the who, what, when, where, and how’ of the misconduct charged." ). Additionally, " the plaintiff must plead facts explaining why the statement was false when it was made." Smith v. Allstate Ins. Co., 160 F.Supp.2d 1150, 1152 (S.D.Cal.2001) (citation omitted); see In re GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1549 (9th Cir.1994) (en banc) (superseded by statute on other grounds).
Regardless of the title given to a particular claim, allegations grounded in fraud are subject to Rule 9(b)'s pleading
requirements. See Vess, 317 F.3d at 1103-04. Even where fraud is not an essential element of a consumer protection claim, Rule 9(b) applies where a complaint " rel[ies] entirely on [a fraudulent course of conduct] as the bases of that claim ... the claim is said to be ‘ grounded in fraud’ or to ‘ sound in fraud,’ and the pleading ... as a whole must satisfy the particularity requirement of Rule 9(b)." Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir.2009) (quoting Vess, 317 F.3d at 1103-04); Bros. v. Hewlett-Packard Co., No. C-06-02254 RMW, 2006 WL 3093685, at *7 (N.D.Cal. Oct. 31, 2006).
III. Leave to Amend
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend " shall be freely given when justice so requires," bearing in mind " the underlying purpose of Rule 15 to facilitate decision on the merits, rather than on the pleadings or technicalities." Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir.2000) (en banc) (internal quotation marks and alterations omitted). When dismissing a complaint for the failure to state a claim, " ‘ a district court should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.’ " Id. at 1130 (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir.1995)). Generally, leave to amend shall be denied only if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the moving party has acted in bad faith. Leadsinger, Inc. v. BMG Music Publ'g, 512 F.3d 522, 532 (9th Cir.2008).
SUPPLEMENTAL REQUEST FOR JUDICIAL NOTICE
the documents in the Consolidated Complaint, and do not question their authenticity.
Although the Privacy Protections Guidelines are also subject to judicial notice because they can be downloaded from a public agency's website, the document cannot be used as proof of the matters asserted therein. See Cachil Dehe Band of Wintun Indians of the Colusa Indian Comm'ty v. Cal., 547 F.3d 962, 968-69 n. 4 (9th Cir.2008) (taking judicial notice of gaming compacts located on official California Gambling Control Commission website); Santa Monica Food Not Bombs v. City of Santa Monica, 450 F.3d 1022, 1025 n. 2 (9th Cir.2006) (taking judicial notice of " public records" that " can be accessed at Santa Monica's official website" ). " This means that factual information asserted in the document cannot be used to create or resolve disputed issues of material fact." Coalition for a Sustainable Delta v. McCamman, 725 F.Supp.2d 1162, 1183-84 (E.D.Cal.2010) ...