Antitrust Law Daily Wrap Up, PRIVACY—D. Nev.: Customers can proceed with claims against Zappos.com over data breach, (Sep 10, 2013)

By Tobias J. Gillett, J.D., LL.M.

Customers of online retailer Zappos.com, Inc. may proceed with claims under California, New York, Texas, and Washington laws against deceptive practices and failures to notify consumers of data breaches over an alleged security breach of Zappos’ customer data, the federal district court in Reno has ruled (In re Zappos.com, Inc., Customer Data Security Breach Litigation, September 9, 2013, Jones, R.). Claims under Florida, Nevada, and Virginia statutes were dismissed without prejudice, while claims under Alabama and Massachusetts statutes were dismissed with prejudice. All other claims, except for a claim for negligent misrepresentation, were dismissed.

Zappos.com is an online retailer owned by Amazon.com, Inc. Plaintiffs in ten cases brought claims against Zappos and Amazon over an alleged security breach of Zappos’ customer data. The cases were transferred to the District of Nevada, and the plaintiffs in three Kentucky cases filed a Consolidated Amended Class Action Complaint (CACAC), asserting claims for willful and negligent violations of the Fair Credit Reporting Act (FCRA); public disclosure of private facts; negligence; breach of contract; violation of various state deceptive trade practices or consumer protection acts; violation of the California Unfair Competition Law; violation of California consumer records security law; violation of the California Consumers Legal Remedies Act; violation of the Texas Deceptive Trade Practices-Consumer Protection Act; unjust enrichment; and declaratory relief.

The plaintiffs in the remaining seven cases then filed an Amended Consolidated Complaint (ACC), asserting claims for negligence; public disclosure of private facts; breach of contract; unfair competition under California law; misleading advertising under California law; improper disclosure and notification of security breach under California and Washington law; violation of various state deceptive trade practices or consumer protection acts; violation of the California Consumers Legal Remedies Act; and violation of the Nevada Deceptive Trade Practices Act. Amazon moved to dismiss both complaints.

Standing. The court concluded that both sets of plaintiffs generally had standing based on the money they had to expend to monitor their credit scores and secure their financial information. However, the Texas, Florida, and Alabama plaintiffs who filed the CACAC lacked standing to assert claims for violation of the California statutes, because a putative California plaintiff was not properly joined.

Statutory Claims

Alabama. The court dismissed the CACAC plaintiffs’ claim under the Alabama Deceptive Trade Practice Act with prejudice, noting that “private actions are not permitted for violations” of that statute.

California. The court declined to dismiss the ACC plaintiffs’ claim under the California Unfair Competition Law, noting that the statute “prohibits false and misleading statements in a way similar to the common law misrepresentation torts,” and concluding that the plaintiffs had sufficiently alleged such a violation. The court also found that the plaintiffs had sufficiently alleged a violation of California’s False Advertising Law, observing that “[i]ssues of puffery, reasonableness of reliance, causation, etc. are for the fact-finder.” Finally, the court determined that the plaintiffs sufficiently alleged a violation of California Civil Code Section 1798.80 et seq., which provides a civil action for failure to comply with its data breach reporting requirements, by alleging that “Zappos failed to notify customers of the breach who had cancelled their accounts and opted not to receive future e-mails.”

Florida. The court dismissed the CACAC plaintiffs’ claim under the Florida Deceptive and Unfair Trade Practices Act, because they had to “make a more definite statement as to violations of this statute” than their citation to Section 501.201 of the Florida Statutes.

Massachusetts. The court dismissed with prejudice the ACC plaintiffs’ claim under the Massachusetts law against unfair methods of competition and unfair and deceptive trade practices because the statute had a separate chapter regarding security breaches under which only the Massachusetts Attorney General could bring a civil action.

Nevada. The court dismissed the CACAC and ACC plaintiffs’ claims under the Nevada Deceptive Trade Practices Act because they failed to identify specific kinds of violations alleged to have been committed.

New York. The court concluded that the ACC plaintiffs sufficiently alleged a claim under the New York Deceptive Trade Practices Act.

Texas. The court concluded that the CACAC plaintiffs sufficiently alleged that Zappos violated Section 17.50(a)(3) of the Texas Deceptive Trade Practices-Consumer Protection Act by making allegedly false, misleading, or deceptive claims on its website about the security of its customers’ data. However, the court dismissed with prejudice a separately-pled claim under Section 17.41 of the Texas Deceptive Trade Practices-Consumer Protection Act because it would be duplicative with the other claim.

Virginia. The court dismissed the ACC plaintiffs’ claim under the Virginia Consumer Protection Act, because they had to “make a more definite statement as to violations of this statute” than their citation to Section 59.1-196 of the Virginia Code.

Washington. The court concluded that the ACC plaintiffs sufficiently alleged claims under Section 19.255.020 of the Washington Statutes, which provides for civil liability for a failure to notify customers of data security breaches, and Section 19.86 et seq., which prohibits “unfair methods of competition and unfair or deceptive acts or practices.”

Although the economic loss doctrine barred recovery for simple negligence, the court found the plaintiffs could proceed with a claim for negligent misrepresentation.

However, the court dismissed claims for public disclosure of private facts and violation of the FCRA, because Zappos was not alleged to have intentionally disclosed the customers’ information, the personal information was not properly alleged to be “private facts” for purposes of the tort, and Zappos was not alleged to be a “consumer reporting agency” for purposes of the FCRA. The court also dismissed claims for breach of contract because the relevant contracts were contracts for the sale of goods that were not alleged to have been breached, and Zappos’ unilateral statements about data security did not create any contractual obligations. The court dismissed claims for unjust enrichment because the plaintiffs did not allege that they had conferred any unrecompensed benefit on Zappos outside of the contracts to purchase goods. Finally, the court dismissed the CACAC plaintiffs’ claim for declaratory relief because it was duplicative of other claims.

The case is No. 3:12-cv-00325-RCJ-VPC.

Attorneys: Robert R. McCoy (Morris Law Group) for Robert Ree. Alisa M. Taormina (Stroock & Stroock & Lavan, LLP) for Amazon.com, Inc.

Companies: Zappos.com, Inc.; Amazon.com, Inc.

Cases: Privacy StateUnfairTradePractices NevadaNews