Searching over 5,500,000 cases.


searching
Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Anderson v. Kimpton Hotel & Restaurant Group, LLC

United States District Court, N.D. California

November 1, 2019

JAKE THOMAS, et al., Plaintiffs,
v.
KIMPTON HOTEL & RESTAURANT GROUP, LLC, Defendant.

          ORDER GRANTING DEFENDANT'S MOTION TO DISMISS FIRST AMENDED COMPLAINT; AFFORDING PLAINTIFFS LEAVE TO AMEND RE: DKT. NO. 38

          MAXINE M. CHESNEY, UNITED STATES DISTRICT JUDGE

         Before the Court is defendant Kimpton Hotel & Restaurant Group, LLC's ("Kimpton") Motion, filed September 27, 2019, "to Dismiss Plaintiffs' First Amended Complaint." Plaintiffs Jake Thomas, Salvatore Galati, and Jonathan Martin have filed opposition, to which Kimpton has replied. Having read and considered the papers filed in support of and in opposition to the motion, the Court deems the matter suitable for decision on the parties' respective written submissions, VACATES the hearing scheduled for November 8, 2019, and rules as follows.

         In their First Amended Complaint ("FAC"), plaintiffs allege Kimpton, an entity that "own[s] or manage[s]" hotels, "contracted with Sabre Corporation ('Sabre') to provide a reservation service." (See FAC ¶¶ 1, 3.) Plaintiffs allege that, through Sabre, they made reservations at Kimpton hotels and, in so doing, provided Sabre with "private identifiable information" ("PII"), specifically, their "full name[s], credit and debit card account numbers, card expiration dates, card verification codes, emails, phone numbers, [and] full addresses." (See FAC ¶ 7, 8.) According to plaintiffs. their PII was "collected by an unauthorized third party," i.e., a "hacker" who "obtained credentials for [Sabre] and used those credentials to access customer data" (see FAC ¶¶ 1, 5), and that their PII subsequently was "misuse[d]" (see FAC ¶¶ 10, 13, 15.) Based on said allegations, plaintiffs assert eight causes of action arising under the laws of various states.

         By order filed August 8, 2019, the Court dismissed plaintiffs' claims as alleged in their initial complaint. As the Court explained in said order, although plaintiffs had alleged Kimpton did not "'establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of [plaintiffs'] PII'" (see Order, filed August 8, 2019, at 6:13-15 (quoting Complaint)), plaintiffs did not allege any facts to support that allegation or similar conclusory allegations. The Court afforded plaintiffs leave to amend to add factual allegations to cure such deficiency.[1]

         In their FAC, plaintiffs have added allegations generally identifying the nature of the safeguards not taken. In that regard, plaintiffs now allege "Sabre enable[d] access to its system with only a single username and static password, which is also known as single factor authorization," instead of implementing "multi-factor authorization solutions" (see FAC ¶ 3), i.e., "multiple levels of authentication" (see FAC ¶ 5);[2] additionally, plaintiffs allege, Sabre should have employed "a multi-layered security platform including advanced behavioral analytics able to identify anomalies" such as "unusual patterns of file access, network traffic or user behavior" (see FAC ¶ 6).

         Kimpton argues that the claims as presently alleged remain subject to dismissal, for the reason that the FAC includes no facts to show Kimpton can be held responsible for Sabre's alleged acts or omissions. As set forth below, the Court agrees.

         In responding to Kimpton's argument, plaintiffs assert that Sabre was acting as Kimpton's agent. The Court acknowledges that a "principal who personally engages in no misconduct may be vicariously liable for [a] tortious act committed by an agent within the course and scope of the agency." See Peredia v. HR Mobile Services, Inc., 25 Cal.App. 5th 680');">25 Cal.App. 5th 680, 691 (2018). For an "agency relationship to exist," however, "the person represented must have a right to control the actions of the agent." See Mavrix Photographs, LLC v. Livejournal, Inc., 873 F.3d 1045, 1054 (9th Cir. 2017) (internal quotation, alteration, and citation omitted). Here, the FAC includes no facts to support a finding that Kimpton had "a right to control the actions" of Sabre, see id., let alone that Sabre's selection or non-selection of safeguards to protect PII was an act committed within the course and scope of any such agency, see Peredia, 25 Cal.App. 5th at 691.[3]

         Given the above-described omission, the FAC is subject to dismissal in its entirety. The Court will, however, afford plaintiffs leave to amend to add factual allegations sufficient to support a finding that Sabre was acting as Kimpton's agent at the relevant time(s) and that Sabre, in engaging in the acts on which plaintiffs base their claims, was acting in the course and scope of any such agency.

         Plaintiffs are also afforded leave to cure two other deficiencies that Kimpton has pointed out. Specifically, to the extent the FAC includes claims based on Kimpton's having allegedly made fraudulent statements (see FAC ¶¶ 26, 28, 31, 33, 96, 97.vi-ix, 99, 108.vi-ix, 110, 116.vi-viii, 128.vi-ix, 129, 142.iv, 143iv-vii, 145), the claims are subject to dismissal, as the FAC fails to include "evidentiary facts" to support a finding that Kimpton knew the statements challenged by plaintiffs were "false when made," see Fecht v. Price Co., 70 F.3d 1078, 1083 (9th Cir. 1995) (setting forth requirements to plead fraud claim). Further, to the extent such claims are based on the statement identified in paragraph 26 of the FAC, the claims are subject to dismissal for the additional reason that plaintiffs have failed to allege facts showing any plaintiff was aware of such statement at the time he made hotel reservations and relied to his detriment thereon.

         Accordingly, the motion to dismiss is hereby GRANTED, and the First Amended Complaint is hereby DISMISSED with leave to amend to cure the deficiencies identified above. If plaintiffs wish to file a Second Amended Complaint for the purpose of curing the above-referenced deficiencies, plaintiff shall file such amended pleading no later than forty-five days after the date of this order. Kimpton shall file its response to any such pleading no later than thirty days after it is filed.

         IT IS SO ORDERED.

---------

Notes:

[1]In the same order, the Court also dismissed various claims on additional grounds. Specifically, a claim under an Arizona statute was dismissed as time-barred, a claim under a California statute was dismissed to the extent brought on behalf of a plaintiff who did not reside in California, and claims based on ...


Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.