Krottner v. Starbucks
Krottner v. Starbucks
Krottner v. Starbucks
09-35823
(and Consolidated Case No. 09-35824)
v.
STARBUCKS CORPORATION,
Defendant - Appellee.
__________________________________________________
Ben Barnow
BARNOW AND ASSOCIATES, P.C.
One North LaSalle, Suite 4600
Chicago, IL 60602
Telephone: (312) 621-2000
Page
I. JURISDICTION.................................................................................................1
i
2. Injury, Harm and Damages are Discrete Legal Concepts, The
Understanding Of Which Are Critical To The Proper Adjudication
Of The Plaintiffs’ Negligence Claim...................................................... 32
ii
VIII. CONCLUSION ............................................................................................. 59
iii
TABLE OF AUTHORITIES
Cases Page(s)
Alejandre v. Bull,
153 P.3d 864 (Wash. 2007) ........................................................................47, 48
Ashcroft v. Al-Kidd,
No. 06-36059, 2009 WL 2836448 (9th Cir. Sept. 4, 2009)..............................14
Ashcroft v. Iqbal,
129 S. Ct. 1937 (2009)......................................................................................14
Boucher v. Shaw,
483 F.3d 613 (9th Cir. 2007) ............................................................................57
iv
Brotherson v. Prof'l Basketball Club,
604 F. Supp.2d 1276 (W.D. Wash. 2009) ..................................................18, 21
Brust v. Newton,
852 P.2d 1092 (Wash. Ct. App. 1993)..............................................................25
v
Donovan v. Philip Morris,
455 Mass. 215, 225, 914 N.E.2d 891 (2009)..............................................52, 57
Heaton v. Imus,
608 P.2d 631 (Wash. 1980) (en banc) ..............................................................19
Huff v. Roach,
106 P.3d 268 (Wash. Ct. App. 2005)................................................................32
vi
Hutchins v. 1001 Fourth Ave. Assocs.,
802 P.2d 1360 (Wash. 1991) ............................................................................30
In re TJX ,
524 F. Supp. 2d 83 (D. Mass. 2007).................................................................49
Jackowski v. Borchelt,
209 P.3d 514 (Wash. Ct. App. 2009)................................................................46
vii
Kilthau v. Covelli,
563 P.2d 1305 (Wash. Ct. App. 1977)..............................................................19
King v. Rice,
191 P.3d 946 (Wash. Ct. App. 2008)................................................................46
Mayer v. Huesner,
107 P.3d 152 (Wash. Ct. App. 2005)................................................................30
viii
Moore v. The Sally J.,
27 F.Supp.2d 1255 (W.D. Wash. 1998) .....................................................33, 39
Navarro v. Block,
250 F.3d 729 (9th Cir. 2001) ............................................................................14
People v. Dolbeer,
29 Cal.Rptr. 573, 214 Cal. App. 2d 619 (1963) ...............................................41
People v. Kozlowski,
117 Cal.Rptr.2d 504, 96 Cal. App. 4th 853 (Cal. Ct. App. 2002) ....................40
Reese v. Malone,
No. C08-1008MJP, 2009 WL 506820 (W.D. Wash. 2009) .............................42
ix
Rettkowski v. Department of Ecology,
910 P.2d 462 (Wash. 1996) ..............................................................................36
Ross v. Harding,
391 P.2d 526 (Wash. 1964) ..............................................................................22
State v. Mayze,
622 S.E.2d 836 (Ga. 2005) ...............................................................................40
State v. Robinson,
145 Wash. App. 1022, 2008 WL 2505445 (Wash. Ct. App. 2009) .................31
x
Steele v. Organon, Inc.,
716 P.2d 920, 106 Wash.2d 1008 (1986) .........................................................40
xi
Veith v. Xterra Wetsuits, LLC,
183 P.3d 334 (Wash. Ct. App. 2008)................................................................19
Wells v. State,
846 P.2d 589 (Wyo. 1992)................................................................................39
Statutes
28 U.S.C. § 1291......................................................................................................1
28 U.S.C. § 1332......................................................................................................1
Rules
Other Authorities
xii
I. JURISDICTION
Fairness Act of 2005, 28 U.S.C. § 1332(d). The district court’s final judgment is
The district court entered final judgment on August 14, 2009. ER 1.1
Plaintiffs Laura Krottner, Ishaya Shamasa, and Joseph Lalli (“Plaintiffs”) filed
19.
contract law in Washington, whether or not Plaintiffs can prove at the pleading
Washington, whether or not Plaintiffs can prove at the pleading stage that their PII
was misused?
1
The abbreviation “ER” refers to Plaintiffs-Appellants’ Excerpts of Record
concurrently filed herewith.
1
3. Under Washington state law, does credit monitoring constitute an
This appeal arises from two almost-identical putative class action complaints
employees2 of Starbucks, and brought two claims against Starbucks for breaches of
contract and negligence. ER 103, 267. The complaints relate to the October 2008
103, 268.
The stolen PII included the employees’ names, addresses, and social security
numbers. ER 103, 268. To date, the laptop has never been recovered. Plaintiffs’
injuries included the loss of confidentiality of their PII and a heightened risk of
future identity theft. ER 115. The corresponding damages include time and
2
The term “employee” refers to both current and former employees, as both were
affected by the breach.
3
“PII” generally refers to information that can be used uniquely to identify a single
individual, such as social security numbers or birthdates.
2
and breach of its contract with Plaintiffs. ER 118, 123. Additionally, at least one
named Plaintiff had already experienced an instance of identity theft within months
of this laptop theft—a crime that the lower court recognized as inferentially
By offering them one year of credit monitoring after the theft, Starbucks
acknowledged that the theft had in fact injured and damaged employees. ER 129.
information stolen and have requested injunctive relief, additional remedies and
damages, including but not limited to further credit monitoring, identity theft
12(b)(6). ER 71. Starbucks alleged that Plaintiffs: (a) lacked standing for failure
to plead injury; (b) failed to allege damages; (c) failed to state a breach of implied
contract claim; and (d) were barred by the economic loss rule from asserting
3
On August 14, 2009, the district court issued orders granting Starbucks’
motions to dismiss. ER 2, 18. The district court ruled that Plaintiffs had suffered
injury under Article III and, therefore, had standing to bring their claims. ER 8,
Washington, the district court nonetheless dismissed Plaintiffs’ complaints for lack
Given the current state of evolving technology and the advent of electronic,
this data, this case raises cutting-edge issues related to the duties and rights
inevitably evolves along with applicable technology, Plaintiffs also believe that
their causes of action are redressable by this Court under current legal precedent.
The primary issue before this Court is whether Plaintiffs’ complaints meet
the pleading standards of Fed. R. Civ. P. 8. Plaintiffs contend that the district court
erred when it granted the motions to dismiss for three reasons. First, Plaintiffs
have plausibly pled the injury element of their breach of contract claim. Second,
Plaintiffs have plausibly pled the injury element of their negligence claim. Third,
4
monitoring would be an available remedy for negligence and/or contract claims
103, 268. Starbucks owes its success and preeminence in the coffee industry to
many factors, one of which is doubtless the protection of the confidentiality of its
protecting its employees’ private information, such as social security numbers and
names and social security numbers, of roughly 60,000 employees. ER 100, 265. A
few years ago, Starbucks was also the subject of an identity theft ring that included
one or more of Starbucks’ own employees who accessed a computer system with
5
employees. ER 100, 265. The theft of a company’s laptop containing any personal
information is always cause for concern. But in this case, not only did Starbucks
encrypt the PII—a violation of standard industry procedures in this electronic age.
269. More than twenty days after the theft, Starbucks mailed a letter to some of its
employees (“Notice Letter”) that the PII of 97,000 Starbucks employees had been
stolen while the PII was in Starbucks’ possession and control. ER 104, 268-269.
In the Notice Letter, Starbucks stated that it had “no indication that the private
information has been misused,” even though Starbucks has not, and cannot, verify
this statement, because the employees’ PII was in one or more criminals’ control.
ER 129, 293. Starbucks has provided no basis for this perfunctory conclusion, nor
any guarantees that the information would not be misused in the future. ER 118,
281-282.
employment, Starbucks gathers and uses social security numbers to aid it in hiring,
6
Staffing Services Brochure, Starbucks sets forth various, specific terms of the
Company may inquire into the individual’s background. This background inquiry
may include, but is not limited to obtaining a consumer credit report and/or an
Contract, Plaintiffs provided their social security numbers to Starbucks with the
know basis,” and that access to the information is limited. ER 112, 237, 276, 398.
Implied in this bargain is that Starbucks will protect its employees’ PII from
Business Conduct.” ER 113, 276. In this document, Starbucks lays out the “legal
and ethical standards that we all must follow on a day-to-day basis.” ER 113, 245,
ACTIVITIES,” Starbucks states that “[t]reating each other with respect and dignity
7
includes respecting one another’s privacy.” ER 113, 246, 276-277, 407. Starbucks
also states that it “strives to provide a safe work environment for all partners.” ER
113, 247, 277, 408. On its website, Starbucks promises to secure the information
that it collects. ER 114, 227-278. Thus, Starbucks values encryption for its
After the theft, Starbucks recognized that its employees had been injured.
requested that employees monitor their “financial accounts carefully for suspicious
activity and take appropriate steps”4 to protect themselves from potential identity
theft. ER 129, 293. “To assist” their employees in that “effort,” Starbucks offered
its victims a remedy of one year of low-level credit monitoring from Equifax
293-294. Employees bore the burden of taking the affirmative step to apply for its
limited protection. ER 105, 269-270. Further, there is nothing to stop any identity
thief from using the information as soon as all 97,000 employees’ one year of
4
These measures included enrolling in the Equifax Package, placing a fraud alert
on their credit report, and purchasing credit monitoring after Starbucks’ year of
free credit monitoring expired. ER 130.
8
Complaint, thieves now typically use the information more than one year from the
date of the theft. ER 117, 281. Although the offer of credit monitoring was a step
to protect against the theft of Plaintiffs’ PII have put Plaintiffs and the proposed
addition to having their PII compromised, Plaintiffs and the proposed Class have
damages as a result of monitoring their credit card accounts, credit reports, and
other financial information to protect their PII from misuse now and in the future.
ER 101, 266.
Plaintiffs Lalli, Shamasa, and Krottner have spent time, exerted effort, and
106, 269-270. For example, Plaintiff Lalli signed up and paid out-of-pocket
expenses for Experian TripleAlert, a service which costs $16 per month for daily
monitoring of his credit with the three credit reporting agencies: Experian,
TransUnion, and Equifax. ER 270. Plaintiff Lalli also placed fraud alerts on his
credit cards. ER 269. Plaintiff Lalli spent and continues to spend substantial
9
amounts of time checking his 401(k) and bank accounts. ER 269-270. Ultimately,
Plaintiff Lalli experienced general anxiety and stress regarding the situation caused
by Starbucks. ER 270.
Upon receiving the Notice Letter from Starbucks, Plaintiff Krottner signed
up for the one year the Equifax Purchase. ER 105. Approximately one week after
receiving the letter, Plaintiff Krottner called her bank and asked them to monitor
her accounts for suspicious activity. Id. Since receiving the notice letter, Plaintiff
Krottner has been extra-vigilant about monitoring her bank and 401(k) accounts,
checking these accounts nearly every day and spending a substantial amount of
time doing so. Id. Furthermore, upon the expiration of the credit monitoring
offered by Starbucks, Plaintiff Krottner will have to pay out-of-pocket for credit
monitoring she did not otherwise need or use prior to Starbucks losing her PII. Id.
Like Plaintiff Krottner, Plaintiff Shamasa signed up for the Equifax Package
Bank contacted Plaintiff Shamasa to inquire whether he had received checks for
his new checking account. ER 106. Plaintiff Shamasa informed Chase Bank that
he did not open this new checking account. Id. Chase Bank then explained that
there had been an attempt to open up a new checking account with his social
10
security number and worked with Plaintiff Shamasa to close the unauthorized
account. Id.
Starbucks’ loss of his PII, and the district court agreed that this inference was
the Equifax Purchase, Plaintiff Shamasa was not informed by Equifax when his PII
was apparently misused to set up a new, unauthorized bank account, illustrating the
feeble efforts to remedy the loss of its employees’ PII, Plaintiffs and the proposed
Class have spent and will continue to spend considerable time and money
attempting to prevent identity theft and monitoring their financial accounts for
Plaintiffs and members of the proposed Class have had their PII compromised,
invaded, and taken from their exclusive control. ER 101, 266. Moreover, they
have incurred – and will incur – attempted identity and/or out-of-pocket costs, lost
time, and other damages relating to the vigilant monitoring of their credit card
11
V. SUMMARY OF ARGUMENT
Despite “lacking controlling precedent on which to rely” and the fact that
“[n]o Washington court has considered whether a plaintiff has either a contract or
negligence cause of action arising from an increased risk of identity theft,” the
district court dismissed Plaintiffs’ negligence and breach of contract claims based
appeal as to why this ruling was in error. First, Starbucks’ breach of its implied
contract with Plaintiffs resulted in the loss of the privacy of their PII and an
increased risk of identity theft, which provide grounds for the award of breach of
Second, Starbucks’ breach of its common law duty to Plaintiffs injured Plaintiffs
and entitles them to damages for negligence. Starbucks does not deny the facts
giving rise to the breach of its duties to Plaintiffs, and implicitly recognized their
injury when it offered them a year of credit monitoring. Plaintiffs have plausibly
pled duty, breach of duty, causation, injury and damages. Hence, the negligence
claim likewise has been sufficiently pled for purposes of overcoming a motion to
12
remedy and its preference for upholding complaints related to developing areas of
contract claims, and (2) whether loss of time and money for credit monitoring
This Court reviews a district court’s dismissal order de novo. Everest &
Jennings, Inc. v. American Motorists Ins. Co., 23 F.3d 226, 228 (9th Cir. 1994)
(citing Gobel v. Maricopa County, 867 F.2d 1201, 1203 (9th Cir. 1989)); Oscar v.
University Students Coop. Ass’n, 965 F.2d 783, 785 (9th Cir.) (en banc), cert.
denied, 506 U.S. 1020 (1992) (citing Kruso v. Int’l Tel. & Tel. Corp., 872 F.2d
1416, 1421 (9th Cir. 1989), cert. denied, 496 U.S. 937 (1990)). All allegations of
material fact are taken as true and construed in the light most favorable to the non-
moving party. Love v. United States, 915 F.2d 1242, 1245 (9th Cir. 1990).
13
The standard of review on a Fed. R. Civ. P. 12(b)(6) motion to dismiss
requires a court to assess the legal sufficiency of the plaintiff’s claims. Navarro v.
Block, 250 F.3d 729, 732 (9th Cir. 2001). Dismissal is appropriate only where a
complaint fails to allege “enough facts to state a claim to relief that is plausible on
its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A complaint
withstands the plausibility test “when the plaintiff pleads factual content that
allows the court to draw the reasonable inference that the defendant is liable for the
conduct alleged.” Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009) (citing Twombly,
550 U.S. at 556 (noting that plausibility lies somewhere between allegations that
are “merely consistent” with liability and a “probability requirement”)); see also
Moss v. U.S. Secret Serv., 572 F.3d 962, 969 (9th Cir. 2009) (citing Iqbal, 129 S.
Ct. at 1949) (“In sum, for a complaint to survive a motion to dismiss, the non-
conclusory ‘factual content,’ and reasonable inferences from that content, must be
Kidd, No. 06-36059, 2009 WL 2836448, at *24 (9th Cir. Sept. 4, 2009) (“Twombly
and Iqbal do not require that the complaint include all facts necessary to carry the
plaintiff’s burden”). Plaintiffs’ claims for relief are plausible and sufficiently pled.
14
VII. ARGUMENT
Plaintiffs have more than plausibly shown that: (1) Starbucks had a
contractual duty; and (3) Plaintiffs suffered damage as a result. See Lehrer v.
State, Dept. of Social and Health Serv., 5 P.3d 722, 727 (Wash. Ct. App. 2000)
(citing Northwest Indep. Forest Mfrs. v. Department of Labor & Indus., 899 P.2d 6
(Wash. Ct. App. 1995); Restatement (Second) of Contracts § 235(2) (1981)) (“Any
failure to perform a contractual duty constitutes a breach…, and the injured party is
generally entitled to damages which put the party in the same position in which it
would have been had the breach not occurred.”). The Amended Complaints
adequately pled the breach of an implied contract, and seek relief in the form of
contract damages and injunctive relief that are available in Washington. ER 123-
125, 286-288. Plaintiffs identify three specific documents that give rise to an
123-124, 287. The Contract Documents, coupled with the parties’ course of
dealing, show that Starbucks had both an implied contractual duty to maintain the
Plaintiffs.
15
The first of the Contract Documents can be seen in Starbucks’ solicitation of
397. Starbucks does not deny that this document is Starbucks’ corporate
others,” and that Starbucks and its employees should not “accept or use anyone
Conduct “to restate Starbucks [sic] longstanding commitment to follow the law and
to act ethically in all situations.” Starbucks asserted that “the Starbucks Board of
Directors, senior management team and I [Chairman Howard Schultz], are all
bound by the Standards and the Standards have our full support.” ER 243, 404.
Starbucks does not deny that the Standards of Business Conduct pertain to
workplace conduct and the need of employees to “respect one another’s privacy.”
ER 92.
16
Third, Starbucks’ online Privacy Statement explicitly governs Starbucks’ use
278. The policy states: “The provision of personal information to Starbucks means
that you agree and consent that we may collect, use and share your personal
information in accordance with this privacy policy.” The policy defines the
personal information collected on the site to “communicate with you about specific
jobs.” The policy describes how employees’ personal information is secured (as
that “[b]y using our services and viewing this Site, you are consenting to the
17
Starbucks did not provide Plaintiffs with the opportunity to negotiate or
employment with Starbucks and accept all the conditions imposed by the Contract
Starbucks’ Contract Documents clearly required Plaintiffs to share their PII with
Starbucks in order to be considered for hire and retention, and indicated that
Basketball Club, 604 F. Supp. 2d 1276, 1283 (W.D. Wash. 2009) (citing Keystone
Land & Dev. Co. v. Xerox Corp., 94 P.3d 945, 949 (Wash. 2004) (en banc);
Trendwest Resorts, Inc. v. Ford, 12 P.3d 613, 616 (Wash. Ct. App. 2000), rev'd on
other grounds, 43 P.3d 1223 (Wash. 2002) (en banc); Multicare Med. Ctr. v.
Department of Soc. & Health Servs., 790 P.2d 124, 132-33 (Wash. 1990) (en
18
banc)). The parties’ assent does not need to be perfect; their assent to a “core of
interpreted to discern the parties’ intent, based on, among other considerations, the
language of the agreement, “all the circumstances surrounding the making of the
contract, the subsequent acts and conduct of the parties to the contract, and the
Elec. Coop. v. Puget Sound Power & Light Co., 911 P.2d 1301, 1310 (Wash. 1996)
(en banc) (citing Scott Galvanizing, Inc. v. Northwest EnviroServices, Inc., 844
their conduct rather than their expressions of assent.” Heaton v. Imus, 608 P.2d
631, 632 (Wash. 1980) (en banc). A contract consists of offer, acceptance, and
consideration. See Veith v. Xterra Wetsuits, LLC, 183 P.3d 334, 337 (Wash. Ct.
App. 2008) (citing Christiano v. Spokane County Health Dist., 969 P.2d 1078
(Wash. Ct. App. 1998)). The existence of an implied contract is a question for the
trier of fact. Kilthau v. Covelli, 563 P.2d 1305, 1306 (Wash. Ct. App. 1977). The
19
Starbucks offered to assess Plaintiffs for employment, and later for retention
and promotion, if Plaintiffs would provide Starbucks access to their PII. ER 236,
397. The Contract Documents also indicate that in return for the benefit of
protect the confidentiality of his or her social security number, Plaintiffs would not
have provided their PII to Starbucks without being required to do so to obtain the
Starbucks possessed all of the bargaining power, and presented the Contract
Contract Documents’ terms, and there was “no true equality of bargaining power
between the parties.” Mendez v. Palm Harbor Homes, Inc., 45 P.3d 594, 602
(Wash. Ct. App. 2002) (citing Yakima County (W.Valley) Fire Prot. Dist. No. 12 v.
City of Yakima, 858 P.2d 245 (Wash. 1993) (en banc)) (internal quotations
20
omitted). Ambiguities in adhesion contracts such as the present implied contract
should be construed against the drafter—in this case, Starbucks. See id. (citing
Rouse v. Glascam Builders, Inc., 677 P.2d 125 (en banc) (1984); Guy Stickney, Inc.
contracts that bind the employer. See, e.g., Thompson v. St. Regis Paper Co., 685
P.2d 1081, 1087 (Wash. 1984) (en banc) (collecting cases). Additionally, whether
or not the elements of a contract exist, the Washington Supreme Court has held
in handbooks issued to their employees.” Id. The Thompson court recognized that
“employers expect, if not demand, that their employees abide by the policies
their employers will abide by the policies as well. Id. at 1088. Whether or not
Plaintiffs have read the Contract Documents has no bearing on the existence of a
contract. Brotherson, 604 F. Supp. 2d at 1285 (citing Yakima County, 858 P.2d at
255). If failure to read a contract is relevant at all, only the person who failed to
read the contract can raise the failure as a defense to contract formation.
Brotherson, 604 F. Supp. 2d at 1285 (citing Yakima County, 858 P.2d at 255).
21
Based on the previously referenced Contract Documents and the course of
dealing between the Plaintiffs and Starbucks, this court should find that Plaintiffs
constitutes a breach of its contract with Plaintiffs. When a party to a contract fails
to perform a promise or contract, it has breached the contract, and the injured party
is entitled to damages. Colorado Structures, Inc. v. Ins. Co. of the West, 167 P.3d
1125, 1131 (Wash. 2007) (en banc) (citing Cartozian & Sons, Inc., v. Ostruske-
Murphy, Inc., 390 P.2d 548 (Wash. 1964); Ross v. Harding, 391 P.2d 526 (Wash.
1964); Tacoma Northpark LLC. v. NW LLC, 96 P.3d 454 (Wash. Ct. App. 2004);
Starbucks does not dispute the fact of the breach. Starbucks has never
denied that Plaintiffs’ PII was saved in unsecured form on the laptop of a
Starbucks employee, or that the laptop was stolen and has never been recovered.
ER 73. Nor does it dispute the content of the Contract Documents, which assured
22
256, 243, 417, 404. Further, Starbucks has never contended that it lacks the
is essential to its business. ER 255, 416. Thus, the fact of Starbucks’ contractual
Every breach of contract gives rise to a cause of action, “even when the
aggrieved party has not suffered any actual damage.” Jacob’s Meadow Owners
Ass’n v. Plateau 44 II, LLC, 162 P.3d 1153, 1160 (Wash. Ct. App. 2007) (citing
Ford, 43 P.3d 1223). Thus, even if the damages were not clear, a breach would
suffice to give rise to a contract cause of action under Washington law. Here,
however, the resulting harm and damages stemming from Starbucks’ breach of
contract are clear. Plaintiff Shamasa’s harm is his loss of his ability to control
access to his PII and his damages are that following the theft, Plaintiff Shamasa is
106. Likewise, Plaintiffs Lalli and Krottner have also suffered the same harm and
damages, as they will now be required to expend time and money monitoring their
financial accounts on a regular, ongoing basis. ER 105, 270. They will also have
to pay out-of-pocket for credit monitoring once the single year of credit monitoring
23
services supplied by Starbucks expires. ER 105, 269-270. Indeed, Plaintiff Lalli
However, the district court’s opinion discussed injury.5 Whether the district court
conflated injury and damages is unclear. What is clear is that at crucial points
throughout the district court’s opinion, concepts of injury, harm, and damages were
used interchangeably. This led the district court to inconsistent and incorrect
Starbucks’ offer to pay for one year of credit monitoring reinforces the
contract. Plaintiffs have suffered the injuries of increased risk of identity theft,
5
The concept of injury is actually subsumed in the breach of contract. While
plaintiffs in this case were injured by the breach of the contract, plaintiffs do not
need to show injury in order to recover damages as a result of the breach. See
Colorado Structures, 167 P.3d at 1131 (citing Cartozian & Sons, 390 P.2d 548;
Ross, 391 P.2d 526; Tacoma Northpark, 96 P.3d 454; Restatement (Second) of
Contracts §346 cmt. a) (explaining that plaintiffs can recover damages even for
nominal or partial breaches of contract). Moreover, the district court erred in
ruling that injury for standing did not support injury for the common law claims.
Cf. ER 8-10 with §VII. B.2.b.i., infra.
24
emotional distress, and the loss of privacy as their PII is now in the ether or worse.
The injury here is similar to the exposure of a trade secret, regardless of the
subsequent uses to which the disclosed trade secret is put. See WASH. REV. CODE
observed, “If Plaintiffs have suffered no present injury, then why is Starbucks
they would have suffered had their PII been displayed on a billboard: loss of the
aggrieved party in the same economic position it would have attained had the
contract been performed.6 Crest Inc. v. Costco Wholesale Corp., 115 P.3d 349,
351 (Wash. Ct. App. 2005). Damages available for breach of contract under
6
The issue of contract damages is a question of fact to be determined by the jury.
Sofie v. Fibreboard Corp., 771 P.2d 711, 716 (Wash. 1989) (en banc) (stating
jury’s damage-finding function is constitutional in nature and must be respected);
Brust v. Newton, 852 P.2d 1092, 1095 (Wash. Ct. App. 1993) (citing Sofie, 771
P.2d 711) (“The question of damages [is] similarly factual in nature. Damage
determinations are a classic example of the type of questions which are
traditionally decided by a jury.”).
25
Washington law include consequential damages, which are damages that “flow
naturally and inevitably from the breach, and are so related to it as to have been
within the contemplation of the parties when they entered into the contract.”
Wash. Contract Law and Practice, 25 David K. DeWolf & Keller W. Allen, Wash.
Practice § 14.7 (2d ed. 2007); see also Microsoft Corp. v. Immersion Corp., No.
and money spent in addressing and mitigating the impact of the breach is a
(citing Federal Signal v. Safety Factors, 886 P.2d 172, 185 (Wash. 1994)(efforts to
repair, though unsuccessful, were reasonable); Bernsen v. Big Bend Elec. Co-op.,
Inc., 842 P.2d 1047, 1052 (Wash. Ct. App. 1993) (mitigation decision was
*3 (E.D. Mo. Mar. 8, 2006) (recognizing damages to plaintiff for time spent as a
result of a defendant’s breach of contract but dismisses the case on other grounds).
If an aggrieved party makes reasonable efforts to make itself whole after the other
party’s breach, the injured party may recover the cost of those efforts whether or
26
not they are successful. See Restatement (Second) Contracts § 350 (2); see also
The remedies appropriate for Starbucks’ breach of contract include all those
specified in the Amended Complaints: damages for all costs for, and time spent,
on bank and credit monitoring to prevent identity theft and related fraud. ER 124,
287. These damages flow naturally and inevitably from Starbucks’ breach of its
potential identity theft.” ER 129, 293. It advised them to take credit monitoring
steps “to ensure that your information is protected and secure,” evincing that their
information is not fully protected and secure without monitoring. Id. The letter
also offered one year of credit watch services to employees, indicating that such
damages arise “naturally and inevitably” from Starbucks’ breach of its contractual
In light of the above duty to mitigate, the district court erred when it opined
that Plaintiffs could wait to file suit until documented identity theft occurs. ER 84.
A contract cause of action accrues when the wrongful act is committed—when the
contract is breached. See, e.g., Schwindt v. Commonwealth Ins. Co., 997 P.2d 353,
27
356 (Wash. 2000) (en banc) (citing Safeco Ins. Co. v. Barcom, 773 P.2d 56 (Wash.
1989) (en banc); Denny's Rest., Inc. v. Security Union Title Ins. Co., 859 P.2d 619
(Wash. Ct. App. 1993); Bush v. Safeco Ins. Co. of Am., 596 P.2d 1357 (Wash. Ct.
App. 1979)). Here the breach was Starbucks’ failure to safeguard Plaintiffs’ PII.
taking the reasonable and foreseeable steps of monitoring their credit and bank
contract, steps that require both money and time. ER 105, 269-270. Plaintiffs also
seek injunctive relief in the form of identity theft insurance and periodic
ER 125. The district court erred when it granted a motion to dismiss Plaintiffs’
Plaintiffs seek to hold Starbucks accountable for its negligent conduct and to
deter future negligence, which could result in further exposure of employee PII.7
7
As reflected in the Plaintiffs’ complaints, Starbucks has a demonstrated history of
allowing the PII of its employees to be compromised. ER 106, 270. In 2006
Starbucks failed to safeguard the PII of 60,000 of its employees stored on two
unencrypted laptops which were either misplaced or stolen from Starbucks. ER
28
As explained in the following section, Plaintiffs have pled a plausible prima facie
explain that the lower court confused and conflated the concepts of injury, harm,
and damages. Courts have parsed out the concepts injury, harm, and damage and
found that each word has a distinct legal meaning. While plaintiffs only need to
plead injury in a prima facie case of negligence, plaintiffs can and do explain that
they have also plead harm and damage - elements which support the other non-
injury elements of a prima facie negligence claim. Finally, Plaintiffs establish that
the economic loss rule does not bar their negligence claims because the Plaintiffs’
negligence claims focus on the common law duty placed on Starbucks, on the loss
of their personal property and is thus wholly distinct from their contract claims.
29
the plaintiff must allege: (1) duty, (2) breach, (3) causation, and (4) injury. 8 See
Hutchins v. 1001 Fourth Ave. Assocs., 802 P.2d 1360, 1362 (Wash. 1991) (citing
Christen v. Lee, 780 P.2d 1307 (Wash. 1989)). Before the district court, Starbucks
did not dispute that Plaintiffs had plausibly pled Starbucks’ common law duty9 to
safeguard its employees’ PII or the fact that it was breached10 as a result 11of its
8
Despite the standard for negligence in Washington, Starbucks focused its
argument below on “damages.” ER 85, 88. The error has its roots in the
conflation of injury, harm, and damage—an error perpetuated by the lower court.
See, e.g., ER 53 (discussing damages in context of injury); ER 55 (mixing harm
and damage); ER 56 (analyzing injury in terms of cost).
9
Although Starbucks has failed to raise any defect in the other prima facie
elements, Plaintiffs addressed them briefly before the district court. First,
Plaintiffs allege that Starbucks owed a duty to safeguard Plaintiffs’ PII in a manner
consistent not only with certain guidelines from the Federal Trade Commission and
the Washington State Office of the Attorney General. ER 107, 109-112, 271-275.
Moreover, in Katz v. United States, 389 U.S. 347, 351(1967), the Supreme Court
established the principle that the right of privacy protects persons. Katz developed
the test of “reasonable expectations of privacy” as the test to be applied to
determine whether an individual's right of privacy has been breached. Id. It is
uncontested that Plaintiffs have a reasonable expectation to the privacy of their PII.
Washington recognizes a common law right to privacy, Reid v. Pierce County, 961
P.2d 333 (Wash. 1998), and has adopted the Restatement (Second) of Torts § 652D
(1977) for such a claim. Mayer v. Huesner, 107 P.3d 152, 155 (Wash. Ct. App.
2005). Common law breach of privacy claims can apply to employer-employee
relationships when the employee’s personal information is publically disclosed by
the employer. See id. at 156. Thus, employers have a common law duty to keep
private employee data confidential.
10
Plaintiffs allege that Starbucks breached its common law duty by storing the
information on a laptop that was unsecured, and failing to encrypt the data on that
laptop. ER 111-112, 275.
30
own conduct. ER 13, 92. As such, challenges to the elements of duty, breach, and
causation are waived. See Silvas v. E*Trade Mortg. Corp., 514 F.3d 1001 (9th Cir.
2008) (quoting Doi v. Halekulani Corp., 276 F.3d 1131, 1140 (9th Cir. 2002))
(stating “[I]t is well established that an appellate court,” will not consider issues
that were not properly raised before the district court and noting that failure to raise
an objection prior to judgment waives the right to challenge the issue on appeal);
see generally State v. Robinson, 145 Wash. App. 1022, 2008 WL 2505445, at *13
(Wash. Ct. App. 2009) (citing WASH. R. APP. P. 2.5 (West. 2009) (failure to raise
an argument results in its waiver); Hui v. Sunnyside Sch. Dist. No. 201, 132 Wash.
App. 1015, 2006 WL 775164, at *11 (Wash. Ct. App. 2006) (citing defense
counsel’s lack of objection is a tactical decision and a waiver); see also Whited v.
Parking Violations Bureau, 111 Fed. Appx. 953 (9th Cir. 2004). Instead,
Starbucks’ main dispute below was with Plaintiffs’ damages theory: Whether it
was recognized under Washington law and, if so, whether it was sufficiently stated.
This argument misses the point as damages are different from the injury needed to
11
Plaintiffs alleged that, but for Starbucks’ breach of duty, Plaintiffs would not
have suffered injury. And, as discussed below, Plaintiffs have alleged injuries that
were caused by Starbucks’ negligent acts. ER 115, 279.
31
2. Injury, Harm and Damages are Discrete Legal Concepts, The
Understanding Of Which Are Critical To The Proper
Adjudication Of The Plaintiffs’ Negligence Claim
concepts and, as result, found that they did not exist for Plaintiffs. While Plaintiffs
only need to plead injury in a prima facie case of negligence, Plaintiffs have also
shown that they have suffered harm and damages as a result of Starbucks’
negligence.
between the legal concepts of injury, harm, and damage must be recognized and
observed. See Huff v. Roach, 106 P.3d 268, 270 (Wash. Ct. App. 2005) (citing
Lavigne v. Chase, Haskell, Hayes & Kalamon, P.S., 112 Wash. App. 677, 682, 50
P.3d 306 (Wash. Ct. App. 2002)) (“Although ‘injury’ and ‘damages’ are often used
v. Brobeck, Phleger & Harrison, 56 Cal.Rptr.2d 661, 663, 667 (Cal. App. 2 Dist.
1996) (Jordache), rev’d on other grounds, 18 Cal.4th 739 (1998) (Jordache II);
32
detriment in fact of any kind to a person resulting from any cause.” Restatement
Commercial Boiler Works, 116 P.2d 288, 292 (Wash. 1941)(citing Restatement of
1935)(quoting Palsgraf v. Long Island R.R. Co., 248 N.Y. 339 (N.Y. 1928))
interest, the violation of a right”); Moore v. The Sally J., 27 F.Supp.2d 1255, 1263
(citing State ex rel. Macri v. City of Bremerton, 111 P.2d 612, 616 (Wash. 1941)
(en banc)).12 “The rules for determining the measure of damages in tort are based
upon the purposes for which actions of tort are maintainable.” Restatement
(Second) of Torts § 901 (1979); see also Ford, 43 P.3d at 1227 (citing Restatement
(Second) of Torts § 901). Such purposes include giving compensation for harms,
33
of Torts § 901 at (a), (c). As damages flow from an injury they do not constitute
the injury itself. See Restatement (Second) of Torts §§ 12A , 902; see also ex rel
Macri, 111 P.2d at 616 (“…it should be borne in mind that the term ‘damages' is in
its legal sen[s]e defined as meaning the compensation which the law will award for
an injury done.”). If injury and damages are conflated, the results reached can be
Here, the injury was the loss of privacy and, as determined by the district
court, the increased risk of identity theft, as well as emotional distress and anxiety.
ER 48-50. The harm is the loss of the actual PII and the ability to control access to
toothpaste is out of the tube. The damages are time and out of pocket expenses
unauthorized charges. ER 101, 106, 117, 119, 124, 266, 269-70, 281, 283, 287.
Plaintiffs were injured by Starbucks as they have lost the privacy of their
PII; it is not under lock and key at Starbucks as it was supposed to be. Plaintiffs
have also suffered emotional distress and an increased risk of identity theft.
See Kuhn v. Capital One Financial Corp., 855 N.E.2d 790, 2006 WL 3007931, at
34
*3-4 (Mass. Ct. App. Oct. 23, 2006) (Table) (finding that despite the plaintiff not
having to pay the fraudulent charges on her account, Plaintiff’s actions to have the
account closed and to protect her credit constituted injury); Daly v. Metropolitan
Life Ins. Co., 2 N.Y.S.2d 530, 4 Misc. 3d at 891-93 (N.Y. 2004); Jones v.
Commerce Bancorp, Inc., 2006 WL 1409492, *2 (S.D.N.Y. May 23, 2006); Ruiz v.
Under an Article III analysis, the district court found that Plaintiffs had
suffered an injury in fact. ER 48-50. Specifically, the district court held that
although Plaintiffs had not yet suffered (what the court defined as) actual identity
theft, it was irrelevant for purposes of standing that they “might suffer additional
injuries in the future” because they had actual present injury, in the form of
the district court found it incredible for Starbucks to argue no injury or risk of
future harm in the face of “having already offered these Plaintiffs free credit
monitoring.” ER 49. Moreover, the district court cited numerous decisions from
this and other circuits that had found risk of future injury as sufficient for the
present injury analyses. ER 48-50. In closing, the district court specifically held
35
threat of identity theft in the wake of the loss of the laptop . . . constitute[s] an
Despite recognizing injury for standing purposes, the district court erred in
holding that a finding of injury for standing did not support a finding of injury on
which is (a) concrete and particularized . . . and (b) “‘actual or imminent, not
protected interest”. See Rettkowski v. Department of Ecology, 910 P.2d 462, 467
(Wash. 1996) (en banc) (citing Black's Law Dictionary 785 (6th ed. 1990)) (“The
starts with simple injury and additionally requires the invasion to be concrete,
actual or imminent, and not hypothetical. Compare Lujan, 504 U.S. at 560 with
Rettkowski, 910 P.2d at 467. Thus, the lower court erred when it found that
Plaintiffs had met the higher threshold and yet somehow had failed to meet the
lower threshold.
36
(ii) Plaintiffs Are Seeking Remedies Well Established
Causes Of Action
The district court also erred when it incorrectly framed the analysis as
whether the Washington Supreme Court would “recognize a common law cause of
action to recover for an increased risk of identity theft.” ER 13; see also ER 12
(“No Washington court has considered whether a plaintiff has either a contract or
negligence and contract causes of action pled in the Complaints. ER 122-124, 285-
287. Plaintiffs are not seeking to fashion a new cause of action for “increased risk
of identity theft.” Rather, Plaintiffs have pled existing and recognized causes of
13
Although noting its responsibility to look to other jurisdictions in the absence of
Washington authority, ER 12, it ignored numerous cases from within this Circuit,
and others, where claims have been upheld where plaintiffs expended time and
out-of-pocket costs to address wrongs caused by a defendant’s conduct. Gap, 540
F.Supp.2d at 1126; Witriol v. LexisNexis Group, No. C05-02392 MJJ, 2006 WL
4725713 at *6 (N.D. Cal. Feb. 10, 2006)(costs associated with monitoring and
repairing credit impaired by unauthorized release of private information upheld
claim); Stollenwerk v. Tri-West Healthcare Alliance, No. 03-0185, 2005 WL
2465906 (D. Ariz. Sept. 8, 2005) (Stollenwerk I), aff’d in part, rev’d in part,
Stollenwerk v. Tri-West Health Care Alliance, 254 Fed. Appx. 664, 668 (9th Cir.
2007)(Stollenwerk II)(claims of actual identity theft or fraudulent account activity
upheld claim); Kuhn v. Capital One Fin. Corp., 855 N.E.2d 790, 2006 WL
3007931, at *3 (Mass. App. 2006) (time and money spent to repair identity theft
and prevent future fraudulent activity upheld claim); Jones v. Commerce
37
(iii) Washington Would Not Be The First Jurisdiction To
Find Increased Risk of Identity Theft As Cognizable
Claim Under State Law
In its opinion, the district court stated “if the Washington Supreme Court
were to recognize a common law cause of action to recover for an increased risk of
identity theft, it would apparently be the only court to do so.” ER 13. The Court
continued “…as the court is aware, every court that has considered a similar claim
has found that it is not cognizable under applicable state law. ER 13. However,
applicable state law” under similar claims. Gap, 540 F.Supp.2d at 1126;
earlier proceeding).
Bancorp, Inc., No. 06 Civ. 835, 2006 WL 1409492, *2 (S.D.N.Y. May 23,
2006)(time spent in response to identity theft compensable); EMC Mortgage
Corp. v. Jones, 252 S.W.3d at 857, 872 (Tex. App. 2008)(time spent to repair
credit and loan problems compensable); Daly v. Metropolitan Life Ins. Co., 782
N.Y.S.2d 530 (N.Y. Sup. Ct. 2004)(negligence survives summary judgment when
plaintiff pled time expended to rectify identity theft); Shames-Yeakel v. Citizens
Fin. Bank, No. 07-c-5387, 2009 U.S. Dist. LEXIS 75093 (N.D. Ill. Aug. 21,
2009)(actual identity theft and fraudulent activity supported negligence claim);
see also Shqeirat v. U.S. Airways, Inc., 515 F. Supp. 2d 984 (D. Minn.
2007)(release of social security numbers sufficient injury under constitutional
right to privacy claim).
38
As this area of jurisprudence evolves, it is important to consider both the
legal issues raised in other jurisdictions as well as the application of the law of the
F.Supp.2d at 1263. The term “harm” implies no particular causal relation. Id. at
cmt c. Moreover, a person may suffer harm before he sustains all, or even the
Leasecorp v. Rothstein, 864 P.2d 17, 21 (Wash. Ct. App. 1993) (citing Gazija v.
Nicholas Jerns Co., 543 P.2d 338 (Wash. 1975) (en banc)); Steele v. Organon,
14
The issues of injury and damage are addressed separately for each claim in §§
VII.A, VII.B.
39
Inc., 716 P.2d 920, review denied, 106 Wash.2d 1008 (1986)); Johnson,
Christenson, Viger Constructors, Inc. v. Perry, Shelton, Walker & Assoc., PLLC,
133 Wash. App. 1008, 2006 WL 1462743, at *10 (Wash. Ct. App. 2006) (citing
Goodfellow Chrysler-Plymouth, Inc., 492 P.2d 258, 261 (Wash. Ct. App. 1971)
(quoting Hoff v. Lester, 168 P.2d 409 (Wash. 1946)) (“plaintiff cannot be
and expenditures.”).
legally recognized right to privacy in the state of Washington and elsewhere. See
O'Hartigan v. Department of Personnel, 821 P.2d 44, 47 (Wash. 1991) (en banc)
(citing Thorne v. El Segundo, 726 F.2d 459 (9th Cir.1983), cert. denied, 469 U.S.
15
See also State v. Mayze, 622 S.E.2d 836, 841 (Ga. 2005) (citing GA. CODE. ANN.
§ 16-9-125 (“identity fraud is an offense against the victim’s possessory interest
in his or her personal information,” and personal information is an intangible
commodity); see, e.g., People v. Kozlowski, 117 Cal.Rptr.2d 504, 96 Cal. App.
4th 853, 869 (Cal. Ct. App. 2002) (finding that personal identification numbers,
or PIN codes, constitute property because they are a means of access to bank
accounts); People v. Dolbeer, 29 Cal.Rptr. 573, 214 Cal. App. 2d 619, 622-23
40
Plaintiffs alleged that they suffered appreciable harm when their PII was
physically lost and they were no longer able to control the access to their PII. ER
105-106; see also §VII.B.3., infra. This constitutes appreciable harm as defined
above. See, e.g., Panag v. Farmers Ins. Co. of Washington, 204 P.3d 885, 903
represent a completed harm” under the Consumer Protection Act); see also
Tallmadge v. Aurora Chrysler Plymouth, Inc., 605 P.2d 1275, 1278 (Wash. Ct.
compensable); McKeown v. First Interstate Bank, 194 Cal. App. 3d, 1225 at 1228-
29 (Cal. Ct. App. 1987) (overturned other grounds, Laird v. Blacker, 279 Cal.
Additionally, Plaintiff Shamasa also alleges harm from the actual misuse of
his PII. ER 106. Actual misuse of PII constitutes appreciable harm. See, e.g.,
Moreover, the fact that Washington has criminalized identity theft shows that one
has a possessory interest in his or her personal information. See WASH. REV.
CODE ANN.§§ 9.35.020 (identify theft statute) 9.35.001 (statement of legislative
intent for identity theft statute).
41
(i) “Proof” Is Not Required At This Stage of The
Litigation
The district court erred in concluding that harm could only be realized if
“either proof of actual loss from identity theft or proof that a loss is highly likely to
inference that the stolen laptop has resulted in actual misuse. ER 16. Plaintiffs
have adequately alleged harm. ER 115-120, 279-283. At this stage, nothing more,
especially evidentiary proof, is required. See, e.g., Reese v. Malone, No. 08-1008,
2009 WL 506820, *10 (W.D. Wash. 2009) (explaining party survives motion to
plaintiff need only to plead facts such that reasonable expectation discovery would
here.16
16
Despite this backdrop, the district court erred in finding that Washington would
not recognize remedies for “harms not yet realized,” and seeking to place a
monetary minimum on harm. ER 15-16. That Stollenwerk II faced damages of
$7,000 is irrelevant to whether Plaintiffs suffered harm here. Harm, as defined
above, is not based on minimum out-of-pocket losses, but on a detrimental change
in condition to tangible or intangible rights. Restatement (Second) of Torts, § 7
cmt. b. Plaintiffs have met this requirement.
42
3. Plaintiffs Have Alleged Sufficient Damages Under Washington
Law
The damages sought by Plaintiffs are of the classic type properly sought
under negligence claims: A plaintiff “whose legally protected interests have been
endangered by the tortious conduct of another” and/or “who has already suffered
injury by the tort of another” “is entitled to recover for expenditures reasonably
of Torts § 919 (1979); see also C.2, infra. Plaintiffs and members of the putative
Class have incurred damages by spending significant amounts of time and money
theft. ER 101, 266. For example, Plaintiff Krottner has spent time and effort
monitoring her credit and upon expiration of her one year of credit monitoring will
Lalli signed up and paid out-of-pocket for Experian Triple Alert, a service which
costs $16 a month for daily monitoring of his credit. ER 270. Plaintiff Shamasa
alleged that he was a victim of identity theft when he discovered that an individual
attempted to open a checking account in his name, and he will need to continue
spending time to monitor his accounts in the future. ER 105-106. These are
examples of time and expenditures of money that Plaintiffs would not need to
protect their identities, but for Starbucks’ negligence. As discussed above, the
43
district court erred when it took the issue of damages from the jury. See §VII.A.3,
supra.
Courts have routinely held that time and money spent in monitoring bank
Omni Ins. Co., 159 P.3d 10, 25 (Wash. Ct. App. 2007) (holding that “time and
Inc., 825 P.2d 714, 720 (Wash. Ct. App. 1992) (holding that lost time, outside of
protection act violation); Kuhn, 2006 WL 3007931 at *3 (holding that time spent
compensable and that “one ‘whose legally protected interests have been
Jones, supra; EMC Mortgage, supra; Daly, supra; Federal Trade Comm'n v.
Neovi, Inc., 598 F. Supp. 2d 1104 (S.D. Cal. 2008), supra. Indeed, Starbucks
specifically advised Plaintiffs and members of the putative Class to take such
44
actions in order to protect themselves from identity theft. ER 129, 293.
Accordingly, Plaintiffs have incurred and will continue to incur expenses related to
105-106, 269-270. In every instance of actual identity theft, damage has been
found or at least assumed without discussion. See, e.g., Stollenwerk II, 254 Fed.
Appx. at 667-68; Kuhn, 2006 WL 3007931, at *3; Daly, 4 Misc. 3d at 893; Jones,
2006 WL 1409492, at *2; Shames-Yeakel, 2009 U.S. Dist. LEXIS 75093, *39-41.
contract. Alejandre v. Bull, 153 P.3d 864 (Wash. 2007) (en banc). “The rule
entitlement flows only from contract because tort law is not intended to
only by agreement.” Id. at 682 (quotation omitted) (emphasis added). The rule
“ensures that a party to a contract cannot recover in tort the risk the parties had
already allocated through contract.” Townsend v. Quadrant Corp., --- P.3d ----,
2009 WL 3337228, *7 (Wash. Ct. App. Oct. 19, 2009) (emphasis added).
45
Examples of economic losses include deterioration, disappointed economic
expectations, or the loss of the benefit of the bargain. See id.; Alejandre, 153 P.3d
at 870 n.3. Tort principles, in turn, concern legal obligations rather than bargained-
for obligations. Jackowski v. Borchelt, 209 P.3d 514, 519 (Wash. Ct. App. 2009).
In other words, if common law provides a duty, the economic loss rule does not bar
a claim based on the breach of that duty simply because a contract exists governing
other matters. See id. at 520-21 (suit against realtor survives based on statutory
Moreover, “the rule does not bar recovery for personal injury or damage to
property other than a defect in the property.” King v. Rice, 191 P.3d 946 (Wash.
concurrence in Alejandre, “‘[t]he insight behind the [economic loss rule] doctrine
commercial law rather than according to tort principles designed for accidents that
cause personal injury or property damage.’” 153 P.3d at 874 (Chambers, J.,
concurring) (quoting Miller v. U.S. Steel Corp., 902 F.2d 573, 575 (7th Cir. 1990)
17
For example, a claim for negligence would be barred by the economic loss
doctrine if the purchaser of tires contracted to purchase a large quantity of tires
with an advertised tread pattern that was not as the seller/manufacturer advertised.
46
injury to the plaintiff's person or property (property other than the product itself),
the type of injury on which a products liability suit usually is founded.” Miller, 902
F.2d at 574.
relied in its Motion to Dismiss. In Alejandre, the plaintiffs sought damages arising
system that was not disclosed at the time of the sale of the home. Alejandre, 153
P.3d at 870. The court held that this was essentially a claim for a defective
product, which was purely economic in nature; the rule barred the plaintiffs’
desired recovery. Alejandre, 153 P.3d at 870. Here, however, Plaintiffs and the
claim involves the negligent handling of PII over which Starbucks exercised
control. Thus, Plaintiffs and the proposed Class properly complain of injury which
In summary, for the economic loss rule to bar the negligence claim, the duty
would have to be purely contractual, the parties to the contracts would have had to
The losses flow purely from the contractual term that the tires would have a
certain tread pattern, not from some injury to the property. Rather, this is solely a
product defect. This is distinct from the loss of PII in the instant case, where
losses flow from Defendant’s breach of a duty to safeguard the PII of Plaintiffs.
47
have negotiated and allocated the risk of loss of PII in the contracts at issue, and
courts. Here, Plaintiffs have alleged that Starbucks has a common law duty to
safeguard the PII with which they were entrusted. See ER 122, 285; see also n.10,
supra. Starbucks cannot in good faith argue that risk of identity has been allocated
in the contracts at issue here (cf. VII.A., Contract Documents, supra (failing to
provide for risk or allocation thereof)) or that Plaintiffs are seeking economic
losses as defined by the applicable law. As such, the economic loss rule is simply
inapplicable.
Nor do the out-of-circuit cases cited by Starbucks below that rely on other
states’ law, support application of the economic loss rule in the case at bar. The
Banknorth N.A. v. B.J.'s Wholesale court applied Maine law to a service contract
between a debit card issuer and a merchant, where a third party had hacked into the
merchant's system and taken the debit card numbers of customers. See 442 F.
Supp. 2d 206, 207-10 (M.D. Pa. 2006). The court found that, although Maine's
highest court had only applied the economic loss rule in the product-liability
context, lower Maine courts and Maine's federal district court had applied it to
certain cases involving service contracts. Id. at 211-12. The court ruled that the
48
comprehensively by the terms of their contract, just as are the terms of a
relationship between a product buyer and seller. Id. at 212. That case does not
The In re TJX decision also does not pertain to the employment context; it
involved a suit by banks that had issued credit and debit cards against a retailer,
arising from a data breach of the retailer's computer system that compromised the
security of millions of consumers. 524 F. Supp. 2d 83, 85-87 (D. Mass. 2007).
The plaintiffs argued that they were third-party beneficiaries of contracts between
the retailer and its own bank, and between the retailer's bank and credit-card
companies. Id. at 88. The only non-economic loss they claimed was that the
compromised cards of their customers could no longer be used. Id. at 90. The
court ruled that the Massachusetts economic loss doctrine barred recovery there.
Id. at 90. The Pennsylvania State Employees Credit Union case likewise involves
Fifth Third Bank, 398 F. Supp. 2d 317 (M.D. Pa. 2005). Again, the case does not
address data breaches in the employment context. There, a credit union sued a
retailer and its bank for the theft of the bank-card information of some of the credit
union's customers arising from the inadequate security of the retailer. Id. at 319.
49
The court found that Pennsylvania courts apply the economic loss doctrine
broadly, and ruled that the need to replace bank cards that could no longer be used
does not constitute damage to person or property. Id. at 330. In contrast, in the
case at bar, Plaintiffs have suffered a loss that cannot be remedied solely with
money: the privacy of their PII has been compromised, and can never be restored.
Airlines, Inc., 203 F.R.D. 601, 608-09 (W.D. Wash. 2001) (allowing plaintiff
negligence). In Duncan, a second-hand smoking case, the court held that although
there was no “independent tort” for medical monitoring under Washington law,
50
1. Washington Courts Traditionally Protect Plaintiffs in Areas of
Developing Case Law.
issues. As the Washington State Supreme Court has recognized, “[w]hen an area
of the law involved is in the process of development, courts are reluctant to dismiss
Dolsen Cos., 888 P.2d 147, 150-51 (Wash. 1995) (en banc) (quoting Haberman v.
Wash. Pub. Power Supply Sys., 744 P.2d 1032, 1046 (Wash. 1987) (en banc)). The
law surrounding identity theft is clearly evolving. In fact, the recent advent of the
widespread use of laptop computers, and the storage of sensitive data on those
under Rule 12(b)(6) motions involving novel issues—has been cited specifically in
Ctrs., Inc., No. 04-2-05608-0, 2004 WL 1530885, at *2 (Wash. Super. June 14,
emphasize that courts should allow plaintiffs’ monitoring claims to proceed, the
51
Crowson court specifically upheld the negligence claim seeking medical
Philip Morris, 455 Mass. 215, 225, 914 N.E.2d 891 (2009), the court observed:
Our tort law developed in the late Nineteeth and early Twentieth
centuries, when the vast majority of tortious injuries were caused by
blunt trauma and mechanical forces. We must adapt to the growing
recognition that exposure to [dangers] may cause substantial injuries
which should be compensable, even if the full effects are not
immediately apparent.
Id. (citing Hansen v. Mountain Fuel Supply Co., 858 P.2d 970, 977 (Utah 1993)).
The Donovan court recognized that smokers with an increased risk of lung cancer,
but who have not manifested any smoking-related disease, should be entitled to the
remedy of medical monitoring, the sole remedy that plaintiffs sought. Id. Like
injured parties assess the medical ramifications of a danger to which they have
identity theft and further injury caused by a defendant’s culpable conduct and to
18
In Stollenwerk I the court, applying the standard for medical monitoring,
fashioned a credit monitoring remedy to a claim which had: (1) a significant
52
Accordingly, Plaintiffs have alleged that they have been damaged under negligence
and contract theories, and they have selected, at Starbucks’ suggestion, the remedy
of credit monitoring to protect their PII from further harm. It is obviously too early
dismiss stage. See 5 Charles Alan Wright and A. Miller, Federal Practice and
statement of the claim for relief and the demand for judgment is not considered
53
part of the claim for that purpose”); Doss v. Southern Cent. Bell Tel. Co., 834 F.2d
421, 424 n. 3 (5th Cir. 1987) (vacating order to dismiss where district court based
complaint); Migliori v. Boeing N. Am., Inc., 97 F. Supp. 2d 1001, 1004 (C.D. Cal.
2000) (citing William W Schwarzer, et al., Civil Procedure Before Trial § 9:230)
(noting that “a Rule 12(b)(6) motion ‘will not be granted merely because [a]
Plaintiffs have a duty to mitigate their damages in both contracts and torts.
See, e.g., Burchfiel v. Boeing Corp., 205 P.3d 145, 153-54 (Wash. Ct. App. 2009);
Young v. Whidbey Island Bd. of Realtors, 638 P.2d 1235, 1237 (Wash. 1982)
Contracts § 350(2) (1981) (citing Federal Signal, 886 P.2d at 185; Bernsen, 842
accounts carefully for suspicious activity and take appropriate steps to protect
yourself,” ER 129, 293, and offered just one year of credit watch services.
Plaintiffs Krotter and Lalli believed that one year of the monitoring Starbucks
offered was not enough to protect their identities. Accordingly, to “monitor” and
54
“take appropriate steps,” Plaintiffs Krottner and Shamasa signed up for the free
Krottner avers that she will pay for credit monitoring service upon the expiration of
the one-year service for which Starbucks paid. ER 105. Plaintiffs Krottner and
Lalli have expended time personally monitoring various financial accounts more
frequently than they had previously, and intend to continue to do so. ER 105, 269-
270. Plaintiff Lalli paid for his own credit monitoring service.19 ER 270.
The district court erred in finding that Washington requires that all losses be
realized before monitoring damages are available for a negligence claim. Compare
ER 15-16 with ER 16 (“Indeed, it may be that the relatively modest cost of credit
whose purpose is to prevent all further injury from being realized – hence why
such patients are monitored in the first instance. See Duncan, 203 F.R.D. at 604
(stating plaintiff had suffered injury from second hand smoke but wanted medical
19
It was within Plaintiff Lalli’s rights to choose a credit monitoring service
rather than sign up for a service through Starbucks. Jaeger v. Cleaver Constr.,
Inc., 201 P.3d 1028, 1037 (Wash. Ct. App. 2009) (“Courts allow a wide latitude of
discretion to the person who, by another's wrong, has been forced into a
predicament where he is faced with a probability of injury or loss. If a choice of
two reasonable courses presents itself, the person whose wrong forced the choice
cannot complain that the injured party chose one over the other”) (citations
omitted).
55
observation and testing to determine whether more serious illnesses would develop
in the future). In light of Washington’s precedent, this Court should find that the
lower court erred in requiring all losses be realized before awarding monitoring
damages.
able to seek the remedy of credit monitoring to protect their PII from further harm.
As stated above, this Court should reverse the district court’s orders
dismissing the cases and remand them for further proceedings. Alternatively, this
Court should certify two issues to the Washington Supreme Court: (1) whether
injury for purposes of negligence and/or breach of contract claims, and (2) whether
loss of time and money for credit monitoring constitute cognizable damages for
negligence and/or breach of contract claims under Washington law. See WASH. R.
APP. P. 16.16 (“Certificate procedure is the means by which a federal court submits
a question of Washington law to the Supreme Court”). The Ninth Circuit has
certified issues to the Washington Supreme Court when “important and undecided
issue[s]” are presented, and there is “no controlling precedent in the decisions of
56
energy, and resources and helps build a cooperative judicial federalism.” Broad v.
Mannesmann Anlagenbau AG, 196 F.3d 1075, 1076 (9th Cir. 1999).20
privacy case were certified to the Supreme Court of Maine, the issues presented
Bros. Co. Customer Data Sec. Breach Litig., No. 2:08-MD-1954 , 2009 WL
3193158 (D. Me. Oct. 5, 2009), see also Donovan, 914 N.E.2d at 215 (certifying
similar issues regarding damages and injury to the Supreme Judicial Court of
the law in this area. See generally Arizonans for Official English v. Ariz., 520 U.S.
43, 76-80 (1997) (suggesting certification to give the state the first opportunity to
construe a newly enacted state statute); Boucher v. Shaw, 483 F.3d 613, 616 (9th
implications for Nevada's wage protection law”); Trustees of Constr. Indus. &
20
As the Broad court noted, it is not necessary to raise certification to the district
court to preserve the issue here. 196 F.3d at 1076 n.3. This Court may consider
certification if not raised in the district court if the issue is an issue of law not
dependent on a factual record developed by the parties. Id. Here, whether
Washington law recognizes these claims in the data breach context is not a matter
that is dependent on the factual record. As such, certification would be appropriate
here. ER 4.
57
Laborers Health & Welfare Trust v. Hartford Fire Ins. Co., 482 F.3d 1064, 1066
and federal trial court opinions on the related issue of medical monitoring, there
have been no definitive Washington Supreme Court opinions dealing with the
Washington Supreme Court decide the issues, instead of asking this Court to divine
determine their rights to bring negligence and contract claims based on the
rights is an appropriate use of the certification vehicle. See Affiliated FM Ins. Co.
v. LTK Consulting Serv. Inc., 556 F.3d 920, 921 (9th Cir. 2009) (right to operate
commercially and extensively on another's property may bring a suit in tort against
a third party for damage to that property); Keystone Land & Dev’t Co. v. Xerox
Corp., 353 F.3d 1093, 1098 (9th Cir. 2003) (whether Washington law would
recognize a particular implied contract and if so, what is the appropriate measure
of damage for its breach). Any delay in obtaining such a determination would
58
cause significant detriment to Washington consumers, employees, and/or to the
VIII. CONCLUSION
Plaintiffs respectfully request that this Court reverse the district court’s
ruling that granted dismissal of Plaintiffs’ claims for breach of contract and
negligence.
respectfully requests that oral argument be permitted. This appeal involves novel
legal issues and oral argument will give the Court the opportunity to further
59
STATEMENT OF RELATED CASES
Pursuant to Ninth Circuit Rule 28-2.6, Plaintiffs are not aware of any related
60
CERTIFICATE OF COMPLIANCE WITH FED. R. APP. P. 32(A)(7)(C)
AND CIRCUIT RULE 32-1
I certify that pursuant to Fed. R. App. P. 32(a)(7)(C) and Ninth Circuit Rule
61
CERTIFICATE OF SERVICE
I, Mila F. Bartos, hereby certify that I electronically filed the foregoing with
the Clerk of the Court for the United States Court of Appeals for the Ninth Circuit
I certify that all participants in the case are registered CM/ECF users and
62