Antitrust Law Daily Wrap Up, STATE UNFAIR TRADE PRACTICES—N.D. Cal.: More claims trimmed in consumer data breach suit against Ledger SAS, (Feb 7, 2025)

By Donielle Tigay Stutland, J.D.

TaskUs gets dismissed from consumer data breach suit against Ledger SAS due to forum non conveniens.

The federal district court in the Northern District of California granted in part and denied in part motions to dismiss of TaskUs and Ledger SAS in a consumer class action brought over a data breach with Shopify Inc. that compromised the cryptocurrency portfolios of Ledger’s customers. The court dismissed defendant TaskUs for forum non conveniens. The court also trimmed some claims brought by California consumers under the California Unfair Competition Law (“UCL”) and the California Consumers Legal Remedies Act (“CLRA”). While the court dismissed claims brought under the fraudulent prong of the consumer statutes, it determined that claims brought under the “unfair and unlawful” prong could proceed against Ledger. The court also dismissed claims for injunctive relief and stressed that plaintiffs need redefine the California class of consumers (Baton v. Ledger SAS, No. 3:21-cv-02470-EMC (N.D. Cal. Feb. 6 2025)).

Background. The class action plaintiffs are customers who purchased a Ledger SAS hardware wallet to protect their cryptocurrency assets. Ledger’s hardware wallets store customer’s “private keys” for their crypto assets. In 2020, Ledger’s customer database was hacked, and Plaintiffs’ personal identifying information (“PII”) was accessed by hackers. The data breach occurred when two of TaskUs’s “rogue” employees conspired with a “California man” who accessed and distributed Ledger users’ PII. The consumers brought a putative class action seeking redress for harms they allegedly suffered stemming from the data breach.

The lawsuit was filed against Ledger, Shopify, and TaskUs. Shopify is Ledger’s subcontractor who helps Ledger with purchases over its website. Shopify was dismissed from the case for forum non conveniens in July 2024, and some claims were dismissed against Ledger, leaving only the UCL and CLRA claims against Ledger. Ledger and TaskUs now moved to dismiss the suit.

TaskUs’s Motion to Dismiss for Forum Non Conveniens. The court began by looking at TaskUs’s motion to dismiss the claims pursuant to forum selection clauses contained in the contracts between the company and its customers. The court pointed out that in earlier litigation in this case, the Ninth Circuit confirmed that Ledger’s three agreements with its consumers “contain extremely broad forum selection clauses providing that covered disputes will be subject to the exclusive jurisdiction of the French courts” which covered the claims in this case with respect to Ledger.

The consumers argued that TaskUs was not a signatory to the contract, so this argument should fail. TaskUs responded by arguing that it was contracted to provide an essential component of Shopify’s work for Ledger and its conduct constituted the core of the alleged wrong injurious to Ledger’s customers, TaskUs’ “conduct at issue is ‘closely related’ to the signatories of the contract with the forum selection clause, and to the contract’s terms and enforcement. The court noted that vertical privity exists, and TaskUs may avail itself of Ledger’s forum selection clause as an agent (or sub-agent) or third-party vendor to the Ledger contract.

The court also found that public interest factors favored dismissal, as the case arises from plaintiffs who “purchased a crypto wallet from a French company pursuant to a contract with a French forum selection clause. France has the greater interest in this case.”

The court granted TaskUs’s motion to dismiss for forum non conveniens.

Ledger SAS’ Motion to Dismiss the Request for Injunctive Relief. The court next turned to Ledger SAS’ motion to dismiss. First, Ledger sought to dismiss the renewed request for the consumers requests for two forms of injunctive relief: (i) an order prohibiting Ledger from making misrepresentations and omissions; and (ii) an order compelling Ledger to “implement and maintain reasonable security measures.” The request for injunctive relief was previously dismissed as the consumers did not plead any sort of actual imminent harm. Although the complaint was amended, the court still found the consumer lacked standing to request injunctive relief, as he could not show imminent harm.

UCL and CLRA. The court next turned to Ledger’s motion to dismiss the claims alleging violations of the California Unfair Competition Law (“UCL”) and the California Consumers Legal Remedies Act (“CLRA”). The court first addressed the claims related to fraud, in which the consumers argue that Ledger misrepresented its level of supervision over its contractors and omitted Ledger’s failure to supervise its subcontractors from this privacy policy. However, the court indicated that the consumers failed to plead any allegations that they actually saw or relied on the July 31, 2018 privacy policy, a predicate to their claim of fraud – the alleged omissions is tied to the statements made therein. Thus, absent reliance, their claim for misrepresentation under the CLRA and the “fraudulent” prong under the UCL both fail. The court granted Ledger’s motion to dismiss this prong.

The court also analyzed the same allegations in the consumer’s claim that Ledger erred by “fail[ing] to implement and maintain reasonable security measures to protect” his personal information from disclosure under the UCL “unfair” and “unlawful” prong. The court determined that the consumers adequately alleged unfair conduct under the “balancing test” where the complaint alleged that defendant failed to adequately protect customer data, which was allegedly in violation of several statutes that reflected California's public policy of protecting customer data). The court denied the motion to dismiss claims brought by under the UCL “unfair” and “unlawful” prong.

California class. The court also addressed Leader’s contention that the current class definition is still too broad because it includes individuals who never purchased their wallet from Ledger, and thus there is “no nexus with Seirafi’s claims and Seirafi, who seeks to represent them, is atypical.” The court cautioned that plaintiffs “that must redefine the class definition to include only purchases of Ledger’s wallet who purchased directly from Ledger.”

The Case is No. 3:21-cv-02470-EMC.

Judge: Chen, E.

Attorneys: Kyle William Roche (Freedman Normand Friedland LLP) for John Chu Edward Baton. Purvi Govindlal Patel (Morrison & Foerster LLP) for Ledger SAS. Douglas Harlan Meal (Orrick Herrington and Sutcliffe LLP) for Shopify [USA] Inc. Spencer Stephen Persson (Davis Wright Tremaine LLP) for TaskUS, Inc.

Companies: Ledger SAS; Shopify (USA) Inc.; TaskUS, Inc.

Cases: StateUnfairTradePractices CaliforniaNews