Joel Ruiz v. Gap, Inc. , 380 F. App'x 689 ( 2010 )

FILED
NOT FOR PUBLICATION MAY 28 2010
MOLLY C. DWYER, CLERK
UNITED STATES COURT OF APPEALS U .S. C O U R T OF APPE ALS
FOR THE NINTH CIRCUIT
JOEL RUIZ, on behalf of himself and all No. 09-15971
others similarly situated,
D.C. No. 3:07-cv-05739-SC
Plaintiff - Appellant,
v. MEMORANDUM *
GAP, INC. and VANGENT, INC.,
Defendants - Appellees.
Appeal from the United States District Court
for the Northern District of California
Samuel Conti, District Judge, Presiding
Argued and Submitted April 12, 2010
San Francisco, California
Before: KLEINFELD, TASHIMA and THOMAS, Circuit Judges.
Joel Ruiz appeals the district court’s grant of summary judgment in favor of
Gap, Inc. and Vangent, Inc. in Ruiz’s diversity putative class action lawsuit,
seeking damages and injunctive relief based on the theft of a laptop computer that
*
This disposition is not appropriate for publication and is not precedent
except as provided by 9th Cir. R. 36-3.
contained Ruiz’s social security number. We affirm. Because the parties are
familiar with the facts and procedural history, we need not recount it here.
I
The district court correctly held that Ruiz has standing to pursue his claims.
To satisfy the standing requirement of Article III of the Constitution, there must be
the “irreducible constitutional minimum” of an injury-in-fact. Lujan v. Defenders
of Wildlife, 504 U.S. 555, 560 (1992). An injury-in-fact is “an invasion of a legally
protected interest which is (a) concrete and particularized . . . and (b) actual or
imminent, not conjectural or hypothetical.” Id. (internal citations and quotation
marks omitted). “[T]he possibility of future injury may be sufficient to confer
standing.” Cent. Delta Water Agency v. United States, 306 F.3d 938, 947 (9th Cir.
2002); see also Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528
U.S. 167, 180-81 (2000). “[A] credible threat of harm is sufficient to constitute
actual injury for standing purposes.” Cent. Delta Agency, 306 F.3d at 950. Ruiz
alleged, with support from an expert affidavit, that he was at greater risk of identity
theft. As the district court properly concluded, this alleged prospective injury
presents enough of a risk that the concerns of plaintiffs are real, and not merely
speculative. Ruiz has sufficient Article III standing to pursue his claims.
2
II
The district court did not err in granting summary judgment on Ruiz’s state
law negligence claim. The elements of a negligence cause of action under
California law are (1) the existence of a duty to exercise due care, (2) breach of that
duty, (3) causation, and (4) damages. Paz v. California, 994 P.2d 975, 980-81
(Cal. 2001).
The district court concluded that Ruiz had failed to establish sufficient
appreciable, nonspeculative, present harm to sustain a negligence cause of action
under California law. California has long held that “[i]t is fundamental that a
negligent act is not actionable unless it results in injury to another.” Fields v. Napa
Milling Co., 330 P.2d 459, 462 (Cal. Ct. App. 1958). California also holds that
“[n]ominal damages, to vindicate a technical right, cannot be recovered in a
negligence action, where no actual loss has occurred.” Id. In addition, in different
contexts, the California courts have indicated that the mere threat of future harm is
insufficient. See Jordache Enters., Inc. v. Brobeck, Phleger & Harrison et al., 958
P.2d 1062, 1065 (Cal. 1998) (“[N]ominal damages, speculative harm, and the mere
threat of future harm are not actual injury.”); Adams v. Paul, 904 P.2d 1205, 1209
(Cal. 1995) (same).
3
California courts have not considered whether time and money spent on
credit monitoring as the result of the theft of personal information are damages
sufficient to support a negligence claim. We do not need to reach that question
here. Even assuming, without deciding, that such damages are cognizable under
California law, Ruiz failed to establish a genuine issue of material fact on whether
he suffered damages because he offered no evidence on the amount of time and
money he spent on the credit monitoring, or that Gap’s offer would not fully
recompense him.1
III
The district court did not err in granting summary judgment on Ruiz’s
breach of contract claim against Vangent. The district court concluded that Ruiz
had failed to adduce any evidence of the appreciable and actual damage necessary
to sustain a contract claim under California law. See St. Paul Fire & Marine Ins.
1
California has recognized monitoring costs as sufficient to state a
negligence claim in the context of exposure to toxic chemicals. Potter v. Firestone
Tire & Rubber Co., 863 P.2d 795, 824-25 (Cal. 1993). Under Potter, the specific
factors for determining the reasonableness and necessity of medical monitoring
are: (1) the significance and extent of the plaintiff’s exposure to chemicals; (2) the
toxicity of the chemicals; (3) the relative increase in the chance of onset of disease
in the exposed plaintiff as a result of the exposure, when compared to (a) the
plaintiff’s chances of developing the disease had he or she not been exposed, and
(b) the chances of the members of the public at large of developing the disease; (4)
the seriousness of the disease for which the plaintiff is at risk; and (5) the clinical
value of early detection and diagnosis. Potter, 863 P.2d at 824-25.
4
Co. v. Am. Dynasty Surplus Lines Ins. Co., 124 Cal. Rptr. 2d 818, 834 (Cal. Ct.
App. 2002) (“An essential element of a claim for breach of contract are damages
resulting from the breach.”) (emphasis omitted).
On appeal, Ruiz contends that the district court erred because nominal
damages are available in contract actions in California. This argument has support
in California law. See, e.g., Sweet v. Johnson, 337 P.2d 499, 500 (Cal. Ct. App.
1959) (holding nominal damages are presumed as a matter of law to stem merely
from the breach of a contract).
However, our circuit has already examined that question, and concluded that
“under California law, a breach of contract claim requires a showing of appreciable
and actual damage.” Aguilera v. Pirelli Armstrong Tire Corp., 223 F.3d 1010,
1015 (9th Cir. 2000) (citing Patent Scaffolding Co. v. William Simpson Const. Co.,
64 Cal. Rptr. 187, 191 (Cal. Ct. App. 1967) (“A breach of contract without damage
is not actionable.”)).
Aguilera binds us, as it did the district court. Thus, the district court
correctly applied Aguilera in granting summary judgment on the breach of contract
claim.
IV
5
The district court did not err in granting summary judgment on Ruiz’s
statutory unfair competition claim. “California’s unfair competition statute
prohibits any unfair competition, which means ‘any unlawful, unfair or fraudulent
business act or practice.’” In re Pomona Valley Med. Group, Inc., 476 F.3d 665,
674 (9th Cir. 2007) (citing C AL. B US. & P ROF. C ODE §§ 17200 et seq. (UCL)).
The district court concluded that Ruiz lacked standing to pursue this claim
because he did not suffer actual injury that was cognizable under the statute. “[T]o
pursue either an individual or a representative claim under the California unfair
competition law,” a plaintiff “must have suffered an ‘injury in fact’ and have ‘lost
money or property as a result of such unfair competition.’” Hall v. Time Inc., 70
Cal. Rptr. 3d 466, 467 (Cal. Ct. App. 2008).
Consistent with that requirement, we have held that standing under the UCL
is limited to individuals who suffer actual losses of money or property, and thus are
eligible for restitution. Walker v. Geico Gen. Ins. Co., 558 F.3d 1025, 1027 (9th
Cir. 2009). Under California law, to claim a loss of money or property for
restitution purposes, a plaintiff must have either prior possession or a vested legal
interest in the money or property lost. Korea Supply Co. v. Lockheed Martin
Corp., 63 P.3d 937, 947 (Cal. 2003).
6
Thus, given the allegations of the complaint and the tendered evidence of
damage, the district court did not err in concluding that Ruiz lacked standing to
pursue a statutory UCL claim.
V
The district court did not err in granting summary judgment on Ruiz’s claim
under the California Constitution for invasion of privacy. A “plaintiff alleging an
invasion of privacy in violation of the state constitutional right to privacy must
establish each of the following: (1) a legally protected privacy interest; (2) a
reasonable expectation of privacy in the circumstances; and (3) conduct by
defendant constituting a serious invasion of privacy.” Hill v. Nat’l Collegiate
Athletic Ass’n, 865 P.2d 633, 657 (Cal. 1994). “Actionable invasions of privacy
must be sufficiently serious in their nature, scope, and actual or potential impact to
constitute an egregious breach of the social norms underlying the privacy right.”
Id. at 655.
Although Ruiz is correct that California has not explicitly required a finding
of intentional conduct as a prerequisite for the cause of action to be asserted,
California courts have yet to extend the cause of action to include accidental or
negligent conduct. In addition, as the district court noted, California courts have
not extended as yet the concept of an “egregious breach” to include an increased
7
risk of privacy invasion, rather than an actual privacy invasion. Therefore, the
district court did not err in granting summary judgment on this claim.
VI
The district court did not err in granting summary judgment on Ruiz’s
claims under California Civil Code § 1798.85. That section provides that a person
or entity may not “[r]equire an individual to use his or her social security number
to access an Internet Web site, unless a password or unique personal identification
number or other authentication device is also required to access the Internet Web
site.” C AL. C IV. C ODE § 1798.85(a)(4). Ruiz alleges that Gap and Vangent
violated this provision by requiring him to use his social security number in
conjunction with filling out the online job application.
The plain language of § 1798.85(a)(4) is directed to the initial act of logging
onto a website, rather than as information that is subsequently requested after the
user enters the website. Indeed, the statute permits the use of a social security
number if “a password or unique personal identification number or other
authentication device is also required to access the Internet Web site.” Id. The
purpose of the section was “to reduce the incidence of identity theft by ending the
practice of using social security numbers as identification or account numbers.”
Cal. Bill Analysis, A.B. 3016 Sen., June 8, 2004.
8
Thus, the district court correctly concluded that requesting social security
information from applicants after the password-protected website was accessed
through other means did not violate the statute.
VII
No one can doubt that those individuals whose private information was
potentially exposed by the theft of the laptop have reason to be aggrieved and
concerned. However, the sole question for us is whether the district court properly
analyzed the legal claims raised by Ruiz. We conclude that it did.
AFFIRMED.
9