CDK Global LLC v. Brnovich

• Decision Date: 25 October 2021
• Docket Number: No. 20-16469,20-16469
• Citation: 16 F.4th 1266
• Parties: CDK GLOBAL LLC, a limited liability company; Reynolds and Reynolds Company, a corporation, Plaintiffs-Appellants, v. Mark BRNOVICH, Attorney General, Defendant-Appellee, Arizona Automobile Dealers Association, Intervenor-Defendant-Appellee.
• Court: U.S. Court of Appeals — Ninth Circuit

16 F.4th 1266

CDK GLOBAL LLC, a limited liability company; Reynolds and Reynolds Company, a corporation, Plaintiffs-Appellants,

v. Mark BRNOVICH, Attorney General, Defendant-Appellee,Arizona Automobile Dealers Association, Intervenor-Defendant-Appellee.

No. 20-16469

United States Court of Appeals, Ninth Circuit.

Argued and Submitted February 5, 2021 Phoenix, Arizona

Filed October 25, 2021

Michael A. Scodro (argued), Britt M. Miller, and Brett E. Legner, Bayer Brown LLP, Chicago, Illinois; Thomas J. Dillickrath (argued) and Jonathan R. DeFosse, Sheppard Mullin Richter & Hampton LLP, Washington, D.C.; Brian A. Howie and Lauren E. Stine, Quarles & Brady LLP, Phoenix, Arizona; Molly C. Lorenzi, San Francisco, California; Mark W. Ryan, Washington, D.C.; Aundrea K. Gulley, Brice A. Wilkinson, and Denise Drake, Gibbs & Bruns LLP, Houston, Texas; for Plaintiffs-Appellants.

Brunn (Beau) W. Roysden III (argued) and Rusty D. Crandell, Office of the Attorney General, Phoenix, Arizona; Mary O'Grady and William D. Furnish, Osborn Maledon P.A., Phoenix, Arizona; for Defendants-Appellees.

Derek T. Ho (argued), Aaron M. Panner, Brendan J. Crimmins, Daniel V. Dorris, Joshua Hafenbrack, Bethan R. Jones, and Jayme L. Weber, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C.; John C. Norling, John J. Egbert, Jeffrey D. Gardner, and Jimmie W. Pursell Jr., Jennings Strouss & Salmon P.L.C., Phoenix, Arizona; for Intervenor-Defendants-Appellees.

R.J. "Jim" Sewell Jr, Smith Law Firm P.C., Helena, Montana, for Amicus Curiae Montana Automobile Dealers Association.

Timothy C. Fox, Attorney General; Matthew T. Cochenour, Acting Solicitor General; Jon Bennion, Chief Deputy Attorney General; Office of the Attorney General, Helena, Montana; for Amicus Curiae State of Montana.

Craig Nichols, Nichols Law Group LLP, Portland, Oregon; Aaron H. Jacoby, Victor P. Danhi, Karen Van Essen, and Franjo M. Dolenac, Arent Fox LLP, Los Angeles, California; for Amici Curiae California New Care Dealers Association and Oregon Auto Dealers Association.

Before: William A. Fletcher, Eric D. Miller, and Danielle J. Forrest,^* Circuit Judges.

MILLER, Circuit Judge:

In 2019, the Arizona Legislature enacted a statute aimed at strengthening privacy protections for consumers whose data is collected by car dealers and restricting anticompetitive business practices by technology companies that provide database services for dealers. The statute's key provisions prevent database providers from limiting access to dealer data by dealer-authorized third parties and require providers to create a standardized framework to facilitate such access. Two database providers subject to the statute filed suit and sought a preliminary injunction against its enforcement on the grounds that it is unconstitutional and that it is preempted by numerous federal statutes. After concluding that the plaintiffs were unlikely to succeed on the merits of their claims, the district court denied a preliminary injunction. We affirm.

I

To manage their operations, car dealers use specialized software known as a dealer management system (DMS). The core of a DMS is a database containing information about a dealer's customers, vehicles, accounting, parts, and services. Some of that data, such as customers’ social-security numbers and credit history, is highly sensitive. DMSs use the data to perform a variety of tasks, from sales and accounting to financing and inventory management.

In addition, dealers often rely on separate software applications for aspects of their business, such as managing online marketing and customer relations. In order to function, those third-party applications must be able to access the data stored in a dealer's DMS.

Plaintiffs CDK Global LLC and Reynolds and Reynolds Co. are technology companies that license widely used DMSs to dealers. Between them, they control a substantial majority of the DMS market. They have litigated this case together, and their business practices do not vary in any way that matters to the case, so for simplicity we will refer to them collectively as CDK.

In the past, CDK allowed dealers to share access to the DMS with third-party data-integration companies that would extract a dealer's data from the DMS and reformat it for use in the dealer's other software applications. But a few years ago, CDK began to prohibit that practice. It justified the change as necessary to protect its intellectual property rights and ensure robust system performance and security. CDK now offers its own data-integration services to dealers, albeit at significantly higher prices than independent data integrators do.

Some competing DMS providers continue to permit dealers to grant DMS access to third parties. But switching to a new DMS provider can be costly, and many dealers are locked into long-term contracts with CDK.

In 2019, the Arizona Legislature unanimously enacted a statute—which we will refer to as the "Dealer Law"—to ensure that dealers retain control over their data. See Ariz. Rev. Stat. Ann. §§ 28-4651 to -4655. Two of its provisions are central to this appeal.

First, the Dealer Law prohibits DMS providers from "tak[ing] any action by contract, technical means or otherwise to prohibit or limit a dealer's ability to protect, store, copy, share or use" data the dealer has stored in its DMS. Ariz. Rev. Stat. Ann. §§ 28-4651(7), 28-4653(A)(3). More specifically, DMS providers may not impose charges "beyond any direct costs incurred" for database access. See id. §§ 28-4651(5), 28-4653(A)(3)(a). And as long as a dealer-authorized third-party integrator complies with industry security standards, DMS providers may not prohibit the third party "from integrating into the dealer's data system," nor may they otherwise "plac[e] an unreasonable restriction on integration." Id. §§ 28-4651(1), (9), 28-4653(A)(3)(b).

Second, the Dealer Law requires DMS providers to "[a]dopt and make available a standardized framework for the exchange, integration and sharing of data" with authorized integrators. Ariz. Rev. Stat. Ann. § 28-4654(A)(1). The law specifies that this framework must comply with industry security standards and that it should be implemented using an "open application programming interface[ ]," or "API," unless an API is "not the reasonable commercial or technical standard for secure data integration," in which case a DMS provider may instead "provide a similar open access integration method." Id. § 28-4654(A)(2). APIs are commonly used tools in software development that provide for standardized communications between computer systems. They allow developers to access information and other resources on a remote computer without having to understand the internal operations of the system with which they are interacting. See generally Google LLC v. Oracle Am., Inc. , ––– U.S. ––––, 141 S. Ct. 1183, 1191–93, 209 L.Ed.2d 311 (2021).

CDK sued the Attorney General of Arizona for declaratory and injunctive relief, asserting a wide range of claims. As relevant here, it argued that the Dealer Law is preempted by the Copyright Act, 17 U.S.C. § 101 et seq. , and the Computer Fraud and Abuse Act (CFAA), Pub. L. No. 99-474, 100 Stat. 1213 (1986) (codified at 18 U.S.C. § 1030 ); that it violates the Contracts Clause and the Takings Clause; and that it is void for vagueness. CDK moved for a preliminary injunction.

The Arizona Automobile Dealers Association intervened in defense of the law and, together with the Attorney General, moved to dismiss the complaint. The district court dismissed most of the claims but allowed the copyright preemption, Contracts Clause, and Takings Clause claims to proceed. Following a hearing, the district court denied a preliminary injunction.

II

CDK appeals the denial of a preliminary injunction, and the first issue we must resolve is the scope of its appeal. Specifically, the parties disagree about whether we have jurisdiction over CDK's CFAA and vagueness claims, which the district court dismissed before ruling on the preliminary injunction and therefore did not address in its order denying an injunction. Although 28 U.S.C. § 1292(a)(1) gives us jurisdiction to review an interlocutory order denying injunctive relief, we generally lack jurisdiction to review a non-final order dismissing claims under Federal Rule of Civil Procedure 12(b)(6). Arc of Cal. v. Douglas , 757 F.3d 975, 992 (9th Cir. 2014).

CDK invokes the doctrine of pendent appellate jurisdiction, under which we may review an "otherwise non-appealable ruling" in certain limited situations when it "is inextricably intertwined with or necessary to ensure meaningful review of the order properly before us on interlocutory appeal." Arc of Cal. , 757 F.3d at 992–93 (quoting Melendres v. Arpaio , 695 F.3d 990, 996 (9th Cir. 2012) ). This is not such a situation, however. The CFAA and vagueness claims addressed in the district court's dismissal order are entirely separate from the claims addressed in the preliminary-injunction order. Review of one order does not require review of the other.

The separateness of the issues in the dismissal order and the preliminary-injunction order is underscored by the sequence of the filings in this case. After the district court dismissed the CFAA and vagueness claims, but before it ruled on the preliminary-injunction motion, CDK filed an amended complaint omitting those claims. An amended complaint "supersedes the original complaint," so the amended complaint was the operative pleading at the time the district court ruled on the preliminary-injunction motion. Pacific Bell Tel. Co. v. linkLine Commc'ns, Inc. , 555 U.S. 438, 456 n.4, 129 S.Ct. 1109, 172 L.Ed.2d 836 (2009). The district court could not possibly have abused its discretion by denying an injunction on claims that were not included in that complaint. See LA Alliance for Hum. Rts. v. County of Los Angeles , No. 21-55395, 14 F.4th 947, 957 (9th Cir. Sept. 23, 2021) (A district court "does not have the authority to issue...