Antitrust Law Daily Wrap Up, PRIVACY—NDCal: LinkedIn Website Customers Lacked Standing to Sue for Data Breach Under a Theory of Economic Harm, (Mar 7, 2013)

By Peter Reap, J.D., LLM

Two members of the professional networking website LinkedIn.com, Katie Szpyrka and Khalilah Wright (the “plaintiffs”), lacked standing to sue website operator LinkedIn Corporation under a theory of economic harm in connection with a hacking incident in which users’ passwords were stolen, the federal district court in San Jose has determined (In Re LinkedIn User Privacy Litigation, March 6, 2013, Davila, E.). Thus, LinkedIn’s motion to dismiss the plaintiffs’ First Amended Consolidated Class Action Complaint (“FAC”) was granted, with leave to amend.

Background. When members register for a LinkedIn account, they are required to confirm that they agree to LinkedIn’s User Agreement and Privacy Policy, which details the security measures LinkedIn takes to safeguard member information. The Privacy Policy notes that LinkedIn cannot ensure or warrant the security of any information a member transmits to LinkedIn. For a monthly fee, members can upgrade to a paid “premium” account which grants them increased networking tools and capabilities.

The plaintiffs allege that sometime in 2012 hackers infiltrated LinkedIn’s computer systems and services. On June 6, 2012, the hackers posted approximately 6.5 million stolen LinkedIn users’ passwords on the Internet. The plaintiffs also allege that the stolen information also included the users’ email addresses.

Both of the plaintiffs registered for a premium LinkedIn account in 2010. Plaintiff Wright alleges that her password was one of the ones retrieved by the hackers and posted on the Internet on June 6, 2012. The FAC contains no allegation that Szpyrka’s password or any other personal information was stolen or posted on the Internet as a result of the 2012 hacking incident.

The plaintiffs bring the action on behalf of themselves and a “Premium Account Class” which is defined in the FAC as “All individuals and entities in the United States who paid a monthly fee to LinkedIn for a premium account prior to June 7, 2012.” Additionally, Plaintiff Wright brings the action on behalf of a “Data Breach Subclass.”

The FAC contains a total of nine Causes of Action. The claims include violation of California’s Unfair Competition Law, breach of contract, and unjust enrichment.

Article III standing. An Article III federal court must ask whether a plaintiff has suffered sufficient injury to satisfy the “case or controversy” requirement of Article III of the U.S. Constitution, the court noted. To satisfy Article III standing, plaintiff must allege: (1) an injury in fact that is concrete and particularized, as well as actual and imminent; (2) that the injury is fairly traceable to the challenged action of the defendant; and (3) that it is likely (not merely speculative) that injury will be redressed by a favorable decision.

The plaintiffs argued that they have standing to sue under a theory of economic harm. In support of this theory, they contended that they did not receive the full benefit of their bargain for the paid premium memberships. The 2012 hacking incident, they argued, showed that they did not receive the promised security for which they paid—thus amounting to economic harm.

Economic harm based on the “benefit of the bargain” theory Plaintiff proffers has been recognized as a viable basis for standing, according to the court. In such cases, plaintiffs had standing to sue where they alleged that they would not have purchased a food product had they known that the product was not as advertised on the product’s labeling. However, those cases were distinguishable from the present case for several reasons, the court held.

First, the FAC failed to sufficiently allege that the plaintiffs actually provided consideration for the security services which they claim were not provided. The plaintiffs contended that in exchange for the fees they paid for the premium membership account, LinkedIn promised, among other things, to provide them with a particular level of security to protect their data. However, the User Agreement and Privacy Policy were the same for the premium membership as they are for the non-paying basic membership.

Thus, the FAC did not sufficiently demonstrate that included in the Plaintiffs’ bargain for premium membership was the promise of a particular (or greater) level of security that was not part of the free membership.

Second, unlike in the food-labeling misrepresentation cases, the Plaintiffs did not even allege that they actually read the alleged misrepresentation—the Privacy Policy—which would be necessary to support a claim of misrepresentation. Because a causal connection between a defendant’s actions and plaintiff’s alleged harm was required for standing, the Plaintiffs failed to establish standing based on an alleged misrepresentation, the court ruled.

Third, as the Plaintiffs’ counsel asserted in oral arguments, the Plaintiffs’ suit was primarily based on an alleged breach of contract. The economic loss the Plaintiff alleged—not receiving the full benefit of the bargain—could not be the “resulting damages” of this alleged breach, the court reasoned. Rather, this injury could only have occurred at some point before the breach, at the time the parties entered into the contract. As such, the economic damages proffered could not form the basis of standing for their breach of contract–related claims.

Fourth, in cases where the alleged wrong stems from allegations about insufficient performance or how a product functions, courts have required plaintiffs to allege “something more” than overpaying for a defective product. Because the Plaintiffs take issue with the way in which LinkedIn performed the security services, they must alleged “something more” than pure economic harm, the court held.

This “something more” could be a harm that occurred as a result of the deficient security services and security breach, such as, for example, theft of their personally identifiable information.

Finally, Plaintiff Wright offered an additional theory of injury-in-fact to support her claim of standing. She contended that, as a result of the 2012 hacking incident and the posting of her password on the Internet, there was now an increased risk of future harm.

Standing on this ground was not been met because these allegations were not alleged in the FAC, according to the court. In the FAC, Plaintiff Wright merely alleged that her LinkedIn password was “publically posted on the Internet on June 6, 2012.” In doing so, Plaintiff Wright failed to show how this amounted to a legally cognizable injury, such as, for example, identify theft or theft of her personally identifiable information.

The case is No. 5:12-CV-03088 EJD.

Attorneys: Jay Edelson (Edelson McGuire, LLC) for Katie Szpyrka. Michael Graham Rhodes (Cooley LLP) for LinkedIn Corporation.

Companies: LinkedIn Corporation.

Cases: Privacy CaliforniaNews