United States District Court, N.D. California
ORDER GRANTING DEFENDANT'S MOTION TO DISMISS
FIRST AMENDED COMPLAINT; AFFORDING PLAINTIFFS LEAVE TO AMEND
RE: DKT. NO. 38
M. CHESNEY, UNITED STATES DISTRICT JUDGE
the Court is defendant Kimpton Hotel & Restaurant Group,
LLC's ("Kimpton") Motion, filed September 27,
2019, "to Dismiss Plaintiffs' First Amended
Complaint." Plaintiffs Jake Thomas, Salvatore Galati,
and Jonathan Martin have filed opposition, to which Kimpton
has replied. Having read and considered the papers filed in
support of and in opposition to the motion, the Court deems
the matter suitable for decision on the parties'
respective written submissions, VACATES the hearing scheduled
for November 8, 2019, and rules as follows.
their First Amended Complaint ("FAC"), plaintiffs
allege Kimpton, an entity that "own[s] or
manage[s]" hotels, "contracted with Sabre
Corporation ('Sabre') to provide a reservation
service." (See FAC ¶¶ 1, 3.)
Plaintiffs allege that, through Sabre, they made reservations
at Kimpton hotels and, in so doing, provided Sabre with
"private identifiable information"
("PII"), specifically, their "full name[s],
credit and debit card account numbers, card expiration dates,
card verification codes, emails, phone numbers, [and] full
addresses." (See FAC ¶ 7, 8.) According to
plaintiffs. their PII was "collected by an unauthorized
third party," i.e., a "hacker" who
"obtained credentials for [Sabre] and used those
credentials to access customer data" (see FAC
¶¶ 1, 5), and that their PII subsequently was
"misuse[d]" (see FAC ¶¶ 10, 13,
15.) Based on said allegations, plaintiffs assert eight
causes of action arising under the laws of various states.
order filed August 8, 2019, the Court dismissed
plaintiffs' claims as alleged in their initial complaint.
As the Court explained in said order, although plaintiffs had
alleged Kimpton did not "'establish and implement
appropriate administrative, technical, and physical
safeguards to ensure the security and confidentiality of
[plaintiffs'] PII'" (see Order, filed
August 8, 2019, at 6:13-15 (quoting Complaint)), plaintiffs
did not allege any facts to support that allegation or
similar conclusory allegations. The Court afforded plaintiffs
leave to amend to add factual allegations to cure such
their FAC, plaintiffs have added allegations generally
identifying the nature of the safeguards not taken. In that
regard, plaintiffs now allege "Sabre enable[d] access to
its system with only a single username and static password,
which is also known as single factor authorization,"
instead of implementing "multi-factor authorization
solutions" (see FAC ¶ 3), i.e.,
"multiple levels of authentication" (see
FAC ¶ 5); additionally, plaintiffs allege, Sabre
should have employed "a multi-layered security platform
including advanced behavioral analytics able to identify
anomalies" such as "unusual patterns of file
access, network traffic or user behavior" (see
FAC ¶ 6).
argues that the claims as presently alleged remain subject to
dismissal, for the reason that the FAC includes no facts to
show Kimpton can be held responsible for Sabre's alleged
acts or omissions. As set forth below, the Court agrees.
responding to Kimpton's argument, plaintiffs assert that
Sabre was acting as Kimpton's agent. The Court
acknowledges that a "principal who personally engages in
no misconduct may be vicariously liable for [a] tortious act
committed by an agent within the course and scope of the
agency." See Peredia v. HR Mobile Services,
Inc., 25 Cal.App. 5th 680');">25 Cal.App. 5th 680, 691 (2018). For an
"agency relationship to exist," however, "the
person represented must have a right to control the actions
of the agent." See Mavrix Photographs, LLC v.
Livejournal, Inc., 873 F.3d 1045, 1054 (9th Cir. 2017)
(internal quotation, alteration, and citation omitted). Here,
the FAC includes no facts to support a finding that Kimpton
had "a right to control the actions" of Sabre,
see id., let alone that Sabre's selection or
non-selection of safeguards to protect PII was an act
committed within the course and scope of any such agency,
see Peredia, 25 Cal.App. 5th at 691.
the above-described omission, the FAC is subject to dismissal
in its entirety. The Court will, however, afford plaintiffs
leave to amend to add factual allegations sufficient to
support a finding that Sabre was acting as Kimpton's
agent at the relevant time(s) and that Sabre, in engaging in
the acts on which plaintiffs base their claims, was acting in
the course and scope of any such agency.
are also afforded leave to cure two other deficiencies that
Kimpton has pointed out. Specifically, to the extent the FAC
includes claims based on Kimpton's having allegedly made
fraudulent statements (see FAC ¶¶ 26, 28,
31, 33, 96, 97.vi-ix, 99, 108.vi-ix, 110, 116.vi-viii,
128.vi-ix, 129, 142.iv, 143iv-vii, 145), the claims are
subject to dismissal, as the FAC fails to include
"evidentiary facts" to support a finding that
Kimpton knew the statements challenged by plaintiffs were
"false when made," see Fecht v. Price Co.,
70 F.3d 1078, 1083 (9th Cir. 1995) (setting forth
requirements to plead fraud claim). Further, to the extent
such claims are based on the statement identified in
paragraph 26 of the FAC, the claims are subject to dismissal
for the additional reason that plaintiffs have failed to
allege facts showing any plaintiff was aware of such
statement at the time he made hotel reservations and relied
to his detriment thereon.
the motion to dismiss is hereby GRANTED, and the First
Amended Complaint is hereby DISMISSED with leave to amend to
cure the deficiencies identified above. If plaintiffs wish to
file a Second Amended Complaint for the purpose of curing the
above-referenced deficiencies, plaintiff shall file such
amended pleading no later than forty-five days after the date
of this order. Kimpton shall file its response to any such
pleading no later than thirty days after it is filed.
IS SO ORDERED.
In the same order, the Court also
dismissed various claims on additional grounds. Specifically,
a claim under an Arizona statute was dismissed as
time-barred, a claim under a California statute was dismissed
to the extent brought on behalf of a plaintiff who did not
reside in California, and claims based on ...