Veridian Credit Union v. Eddie Bauer, LLC, CASE NO. C17–0356JLR

• Decision Date: 09 November 2017
• Docket Number: CASE NO. C17–0356JLR
• Citation: 295 F.Supp.3d 1140
• Parties: VERIDIAN CREDIT UNION, Plaintiff, v. EDDIE BAUER, LLC, Defendant.
• Court: U.S. District Court — Western District of Washington

295 F.Supp.3d 1140

VERIDIAN CREDIT UNION, Plaintiff,

v.EDDIE BAUER, LLC, Defendant.

CASE NO. C17–0356JLR

United States District Court, W.D. Washington, at Seattle.

Signed November 9, 2017

Brian C. Gudmundson, Pro Hac Vice, Zimmerman Reed LLP, Bryan L. Bleichner, Pro Hac Vice, Chestnut Cambronne PA, Karen H. Riebel, Pro Hac Vice, Kate M. Baxter–Kauf, Pro Hac Vice, Lockridge Grindal Nauen, Minneapolis, MN, Chase Christian Alvord, Kim D. Stephens, Tousley Brain Stephens, Seattle, WA, Erin Green Comite, Pro Hac Vice, Stephen J. Teti, Pro Hac Vice, Scott + Scott LLP, Colchester, CT, Gary F. Lynch, Pro Hac Vice, Kevin W. Tucker, Pro Hac Vice, Carlson Lynch Sweet Kilpela & Carpenter LLP, Pittsburgh, PA, Joseph P. Guglielmo, Pro Hac Vice, Scott + Scott, Attorneys at Law, LLP, New York, NY, for Plaintiff.

Dyanne Cho, Pro Hac Vice, Jon P. Kardassakis, Pro Hac Vice, Lewis Brisbois Bigaard & Smith LLP, Los Angeles, CA, Gordon Calhoun, Pro Hac Vice, Lewis Brisbois Bisgaard & Smith LLP, San Francisco, CA, Kathleen A. Nelson, Sarah E. Demaree, Lewis Brisbois Bisgaard & Smith LLP, Seattle, WA, for Defendant.

ORDER ON DEFENDANT'S MOTION TO DISMISS

JAMES L. ROBART, United States District Judge

INTRODUCTION

Before the court is Defendant Eddie Bauer, LLC's ("Eddie Bauer") motion to dismiss (2d MTD (Dkt. # 40) ) Plaintiff Veridian Credit Union's ("Veridian") first amended putative class action complaint (FAC (Dkt. # 36) ).¹ The court has considered Eddie Bauer's motion, Veridian's response (Resp. (Dkt. # 53) ), Eddie Bauer's reply (Reply (Dkt. # 57) ), the relevant portions of the record, and the applicable law. Being fully advised,² the court GRANTS in part and DENIES in part Eddie Bauer's motion.

BACKGROUND

Veridian alleges the following pertinent facts in its first amended complaint:³

Eddie Bauer is headquartered in Washington but operates approximately 370 stores throughout the United States. (FAC ¶ 12.) Eddie Bauer accepts credit and debit cards for payment from customers at it point-of-sale ("POS") registers. (Id. ¶ 17.) In January 2016, hackers accessed Eddie Bauer's POS systems and installed malicious software (or "malware") that infected every Eddie Bauer store in the United States and Canada ("the Data Breach"). (Id. ¶ 29.) Through this malware, hackers stole credit and debit card data from Eddie Bauer's systems and sold it to other individuals who made fraudulent transactions on those payment cards. (Id. ¶¶ 7, 25, 29, 32, 35–36, 96–97.)

Veridian is an Iowa-chartered credit union with its principal place of business in Iowa. (FAC ¶ 11.) Veridian issued payment cards compromised in the Data Breach and alleges that it suffered significant property damage to the unique data included on the payment cards (including the ruination of the payment card itself) and financial losses in connection with covering its customers' losses due to the Data Breach and in reissuing credit and debit cards to its customers. (Id. ¶¶ 8, 22, 96–98, 135.) Veridian alleges that the Data Breach and Veridian's injury were the foreseeable results of Eddie Bauer's inadequate data security measures, which Eddie Bauer knew were insufficient to protect against recognized threats, and Eddie Bauer's refusal to implement industry-standard security measures due to the cost of such measures. (Id. ¶¶ 39–92.)

Veridian filed a putative class action complaint against Eddie Bauer on March 7, 2017. (Compl. (Dkt. # 1).) Eddie Bauer filed a motion to dismiss on April 21, 2017. (MTD (Dkt. # 28).) On June 5, 2017, instead of responding to Eddie Bauer's motion directly, Veridian filed a first amended putative class action complaint. (See FAC.) On June 15, 2017, Eddie Bauer filed a motion to dismiss Veridian's first amended complaint. (See 2d MTD.)

In its first amended complaint, Veridian alleges claims against Eddie Bauer for (1) negligence (FAC ¶¶ 119–28), (2) negligence per se (id. ¶¶ 129–35), (3) declaratory and injunctive relief (id. ¶¶ 136–43), (4) violation of RCW 19.255.020 (FAC ¶¶ 144–51), and (5) violation of Washington's Consumer Protection Act ("CPA"), RCW ch. 19.86 (FAC ¶¶ 152–65). Veridian alleges that Washington law applies to its claims. (Id. ¶¶ 112–18.) Eddie Bauer, however, asserts that Iowa law applies. (2d MTD at 3–9.)

Veridian also brings its first amended complaint as a putative class action. (Id. ¶¶ 99–111.) Specifically, Veridian brings its action "individually and on behalf of all other financial institutions similarly situated" under Federal Rule of Civil Procedure 23. (Id. ¶ 99.) Veridian defines its putative class as:

All Financial Institutions—including, but not limited to, banks and credit unions—in the United States (including its Territories and the District of Columbia) that issue payment cards, including credit and debit cards, or perform, facilitate, or support card issuing services, whose customers made purchases from Eddie Bauer stores from January 1, 2016 to the present (the "Class").

(Id. )

The court now considers Eddie Bauer's motion to dismiss.

ANALYSIS

A. Legal Standard

Federal Rule of Civil Procedure 12(b)(6) provides for dismissal of a complaint for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). Although "detailed factual allegations" are not required, a complaint must include "more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). In other words, a complaint must have sufficient factual allegations to "state a claim to relief that is plausible on its face." Id. (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). A claim is facially plausible "when the pleaded factual content allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. Under Rule 12(b)(6), dismissal can be based on "the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory." Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1990).

When considering a motion to dismiss under Rule 12(b)(6), the court construes the complaint in the light most favorable to the nonmoving party. Livid Holdings Ltd. v. Salomon Smith Barney, Inc. , 416 F.3d 940, 946 (9th Cir. 2005). The court must therefore accept all well-pleaded facts as true and draw all reasonable inferences in the plaintiff's favor. Wyler Summit P'ship v. Turner Broad. Sys., Inc. , 135 F.3d 658, 661 (9th Cir. 1998).

B. Choice of Law

The court first addresses which jurisdiction's law applies to Veridian's claims. Veridian asserts that Washington law governs its claims (FAC ¶¶ 112–18; Resp. at 6–8), while Eddie Bauer argues for the application of Iowa law (2d MTD at 5–9).

A "federal court sitting in diversity ordinarily must follow the choice-of-law rules of the State in which it sits." Atl. Marine Constr. Co. v. U.S. Dist. Court for W. Dist. of Tex. , 571 U.S. 49, 134 S.Ct. 568, 582, 187 L.Ed.2d 487 (2013) (citing Klaxon Co. v. Stentor Elec. Mfg. Co. , 313 U.S. 487, 494–96, 61 S.Ct. 1020, 85 L.Ed. 1477 (1941) ). "This applies to actions brought under the Class Action Fairness Act [ ("CAFA"), 28 U.S.C. § 1332(d)(2),] as well, since CAFA is based upon diversity jurisdiction." In re Facebook Biometric Info. Privacy Litig. , 185 F.Supp.3d 1155, 1167–68 (N.D. Cal. 2016) (quoting In re NVIDIA GPU Litig. , No. C 08–04312, 2009 WL 4020104, at *5 (N.D. Cal. Nov. 19, 2009) ). Here, Veridian asserts that the court has original jurisdiction based on CAFA. (FAC ¶ 13.) Accordingly, the court follows the choice-of-law rules of Washington.

Washington employs a two-step approach to choice of law questions. Under Washington's choice-of-law rules, the court first determines whether an actual conflict exists between Washington and other applicable state law. See Burnside v. Simpson Paper Co. , 123 Wash.2d 93, 864 P.2d 937, 941 (1994). In the absence of a conflict, Washington law applies. See id. ; DP Aviation v. Smiths Indus. Aerospace & Def. Sys. Ltd. , 268 F.3d 829, 845 (9th Cir. 2001) (applying Washington law where no conflict was shown). If an actual conflict exists, the court then determines the forum that has the "most significant relationship" to the action to determine the applicable law. See Johnson v. Spider Staging Corp. , 87 Wash.2d 577, 555 P.2d 997, 1000–01 (1976).

1. An Actual Conflict

"An ‘actual conflict’ exists ‘between the laws or interests of Washington and the laws or interests of another state’ when the ... states' laws could produce different outcomes on the same legal issue." Kelley v. Microsoft Corp. , 251 F.R.D. 544, 550 (W.D. Wash. 2008) (quoting Erwin v. Cotter Health Ctrs. , 161 Wash.2d 676, 167 P.3d 1112, 1120 (2007) ). Veridian asserts in a summary fashion that only a false conflict exists between the laws or interests of Washington and those of Iowa. (See Resp. at 7.) However, as discussed below, the court is persuaded by Eddie Bauer's detailed analysis that an actual conflict exists. (See 2d MTD at 4–5.) The court discusses each of Veridian's claims in turn.

a. Negligence

The court first considers Veridian's negligence claim. (FAC ¶¶ 119–28.) In Iowa, "[a]s a general proposition, the economic loss rule bars recovery in negligence when the plaintiff has suffered only economic loss." Annett Holdings, Inc. v. Kum & Go, L.C. , 801 N.W.2d 499, 503 (Iowa 2011) (citing Neb. Innkeepers, Inc. v. Pittsburgh–Des Moines Corp. , 345 N.W.2d 124, 126 (Iowa 1984) ). Indeed, in Iowa, "[t]he well-established general rule is that a plaintiff who has suffered only economic loss due to another's negligence has not been injured in a manner which is legally cognizable or compensable." Id. Further, in Iowa, the economic loss rule "is by no means limited to the situation where the plaintiff and the defendant are in direct contractual privity." Id. at 504.

The Washington Supreme Court, however, no longer applies the economic loss rule but rather...