Plaintiff Hine's Opposition To Scottrade's Demurrer

1 BLOOD HURST & OREARDON, LLP
TIMOTHY G. BLOOD (149343)

2 THOMAS J. OREARDON II (247952)
PAULA R. BROWN (254142)
3 701 B Street, Suite 1700
San Diego, CA 92101
4 Tel: 619/338-1100
619/338-1101 (fax)
5 tblood@bholaw.com
toreardon@bholaw.com
6 pbrown@bholaw.com
7 SIPRUT PC
JOSEPH J. SIPRUT (pro hac vice to be filed)
8 RICHARD S. WILSON (6321743 IL)
RICHARD L. MILLER II (6243507 IL)
9 17 North State Street, Suite 1600
Chicago, IL 60602
10 Tel: 312/236-0000
312/878-1342 (fax)
BLOOD HURST & OREARDON, LLP
11 jsiprut@siprut.com
rwilson@siprut.com
12 rmiller@siprut.com
13 Attorneys for Plaintiff
14 [Additional counsel appear on signature page]
15 SUPERIOR COURT OF THE STATE OF CALIFORNIA

16 COUNTY OF SAN DIEGO, HALL OF JUSTICE
17 STEPHEN HINE, Individually and on Case No. 37-2016-00035493-CU-MC-CTL
Behalf of All Others Similarly Situated,
18 CLASS ACTION
Plaintiff,
19 PLAINTIFFS OPPOSITION TO
v. SCOTTRADE INC.S DEMURRER TO
20 CLASS ACTION COMPLAINT
SCOTTRADE, INC., a Missouri
21 Corporation,
Mandatory eFile Case
22 Defendant.
Date: April 28, 2017
23 Time: 9:00 a.m.
Judge: Richard E.L. Strauss
24 Dept: C-75
25 DEMAND FOR JURY TRIAL
26 Complaint Filed: October 7, 2016

Trial Date: Not Set
27
28
Case No. 37-2016-00035493-CU-MC-CTL

00119179 PLAINTIFFS OPPOSITION TO DEMURRER
1 TABLE OF CONTENTS
2 Page
I. INTRODUCTION ........................................................................................................... 6
3
II. STATEMENT OF FACTS .............................................................................................. 7
4
A. Scottrade Collects and Maintains Its Customers Sensitive Personal and
5 Financial Information ........................................................................................... 7
6 B. Scottrades Deficient Safeguards Resulted in a Massive Data Breach ................ 8
7 C. Scottrades Notice of the Data Breach and Remedy Are Inadequate ............... 9
8 D. Procedural Background ...................................................................................... 10
9 III. LEGAL STANDARDS ON DEMURRER .................................................................... 11
10 IV. THE DEMURRER SHOULD BE OVERRULED ........................................................ 11
11 A. Plaintiff States Claims for Breach of Express and Implied Contract ................. 11
12 1. Plaintiff Alleges Damage Resulting from Scottrades Breach ............... 11
13 2. Plaintiff Alleges a Breach of an Express Contract ................................. 13
14 3. Plaintiff Pleads Breach of Implied Contract in the Alternative ............. 14
15 4. Plaintiff Alleges the Existence of an Implied Contract .......................... 14
16 B. Plaintiff States a Claim for Unjust Enrichment/Assumpsit................................ 15
17 C. Plaintiff States a Claim for Declaratory Relief .................................................. 16
18 D. Plaintiff States a Claim for Violation of the CCRA........................................... 18
19 1. Plaintiff Has Statutory Standing............................................................. 18
20 2. Plaintiff Alleges the Elements of a Claim Under Section 1798.82 ........ 19
21 3. Plaintiff Alleges Injunctive Relief ......................................................... 19
22 E. Plaintiff States a Claim for Violation of the UCL ............................................. 20
23 1. Plaintiff Has Standing Under the UCL .................................................. 20
24 2. Plaintiff Alleges a Basis for Restitution and Injunctive Relief
Under the UCL ....................................................................................... 21
25
F. Plaintiffs Claims Are Not Barred by the Eastern District of Missouris
26 Findings Regarding Federal Article III Standing ............................................... 22
27 V. CONCLUSION .............................................................................................................. 25
28
2 Case No. 37-2016-00035493-CU-MC-CTL

1 TABLE OF AUTHORITIES
2 Page(s)
Cases
3
In re Adobe Sys. Privacy Litig.,
4
66 F. Supp. 3d 1197 (N.D. Cal. 2014) ..................................................................... 17, 18, 19
5
Ajaxo Inc. v. E*Trade Grp. Inc.,
6 135 Cal. App. 4th 21 (2005)................................................................................................. 12
7 In re Anthem, Inc. Data Breach Litig.,

No. 15-MD-02617, 2016 U.S. Dist. LEXIS 70594
8 (N.D. Cal. May 27, 2016) ........................................................................................ 13, 20, 21
9 In re Barnes & Noble Pin Pad Litig.,
10 No. 12-cv-08617, 2916 U.S. Dist. LEXIS 137078
(N.D. Ill. Oct. 3, 2016) ......................................................................................................... 12
11
Binder v. Aetna Life Ins. Co.,
12 75 Cal. App. 4th 832 (1999)................................................................................................. 14
13 Boorstein v. CBS Interactive, Inc.,
222 Cal. App. 4th 456 (2013)............................................................................................... 19
14
15 Brandon & Tibbs v. George Kevorkian Accountancy Corp.,

226 Cal. App. 3d 442 (1990)................................................................................................ 11
16
Bugg v. Rutter,
17 330 S.W.3d 148 (Mo. Ct. App. 2010) ............................................................................ 23, 24
18 Charron v. State,
257 S.W.3d 147 (Mo. Ct. App. 2008) .................................................................................. 24
19
City. of Solano v. Vallejo Redevelopment Agency,
20
75 Cal. App. 4th 1262 (1999)............................................................................................... 16
21
First Nationwide Savings v. Perry,
22 11 Cal. App. 4th 1657 (1992)......................................................................................... 11, 14
23 Foley v. Interactive Data Corp.,

47 Cal. 3d 654 (1988) .......................................................................................................... 14
24
Grant v. Long,
25 33 Cal. App. 2d 725 (1939).................................................................................................. 14
26
Heller v. Aldi, Inc.,
27 851 S.W.2d 82 (Mo. Ct. App. 1993) .................................................................................... 23
28 Hendricks v. DSW Shoe Warehouse, Inc.,

444 F. Supp. 2d 775 (W.D. Mich. 2006) ............................................................................. 12
3 Case No. 37-2016-00035493-CU-MC-CTL
1 Holmes v. Countrywide Fin. Corp.,
No. 5:08-CV-00205, 2012 U.S. Dist. LEXIS 96587
2 (W.D. Ky. July 12, 2012) ..................................................................................................... 12
3 Klein v. Chevron U.S.A, Inc.,
4 202 Cal. App. 4th 1342 (2012)............................................................................................. 15
5 Kwikset Corp. v. Super. Ct.

51 Cal. 4th 310 (2011) ................................................................................................... 20, 21
6
Leach v. City of San Marcos,
7 213 Cal. App. 3d 648 (1989) ................................................................................................ 20
8 Levi v. Aerotek, Inc.,
374 F. Appx 679 (8th Cir. 2010) ........................................................................................ 24
9
10 Lewis Ave. Parent Teachers Assn v. Hussey,

250 Cal. App. 2d 232 (1967) ................................................................................................ 14
11
Louie v. BFS Retail & Commercial Operations, LLC,
12 178 Cal. App. 4th 1544 (2009)............................................................................................. 23
13 McKell v. Washington Mut., Inc.,
142 Cal. App. 4th 1457 (2006)............................................................................................. 11
14
15 Morey v. Vannucci,
64 Cal. App. 4th 904 (1998)........................................................................................... 13, 14
16
Moyer v. Michaels Stores, Inc.,
17 No. 14 C 561, 2014 U.S. Dist. LEXIS 96588 (N.D. Ill. July 14, 2014) .............................. 12
18 Mycogen Corp. v. Monsanto Co.,

28 Cal. 4th 888 (2002) ......................................................................................................... 22
19
Osseous Techs. of Am., Inc. v. DiscoveryOrtho Partners LLC,
20
191 Cal. App. 4th 357 (2010)............................................................................................... 18
21
Ponder v. Pfizer, Inc.,
22 522 F. Supp. 2d 793 (M.D. La. 2007) .................................................................................. 12
23 Ruiz v. Snohomish Cnty. Pub. Util. Dist. No. 1,

824 F.3d 1161 (9th Cir. 2016).............................................................................................. 23
24
Seldomnridge v. Gen. Mills Operations, Inc.,
25 140 S.W.3d 58 (Mo. Ct. App. 2004) .................................................................................... 24
26
Shaw v. Regents of Univ. of Cal.,
27 58 Cal. App. 4th 44 (1997)................................................................................................... 13
28 Small v. Fritz Cos., Inc.,

30 Cal. 4th 167 (2003) ......................................................................................................... 12
4 Case No. 37-2016-00035493-CU-MC-CTL
1 In re Sony Gaming Networks & Customer Data Sec. Breach Litig.,
903 F. Supp. 2d 942 (S.D. Cal. 2012) .................................................................................. 21
2
Steinberg v. Chiang,
3 223 Cal. App. 4th 338 (2014)............................................................................................... 18
4
Steiner v. Rowley,
5 35 Cal. 2d 713 (1950) .......................................................................................................... 14
6 Teitelbaum Furs, Inc. v. Dominion Ins. Co.,

58 Cal. 2d 601 (1962) .......................................................................................................... 22
7
Williams v. Rape,
8 990 S.W.2d 55 (Mo. Ct. App. 1999) .................................................................................... 24
9 Wilson & Wilson v. City Council of Redwood City,
10 191 Cal. App. 4th 1559 (2011)....................................................................................... 16, 17
11 WMX Techs. v. Miller,

104 F.3d 1133 (9th Cir. 1997).............................................................................................. 23
12
Wofford v. Apple, Inc.,
13 11-CV-0034, 2011 U.S. Dist. LEXIS 129852 (S.D. Cal. Nov. 8, 2011) ............................. 21
14 Yari v. Producers Guild of Am., Inc.,
15 161 Cal. App. 4th 172 (2008)............................................................................................... 11
16 Constitutional Provisions
U.S. Const., art. III ..............................................................................................................passim
17
Statutes and Rules
18
Cal. Bus. & Prof. Code 17200 ....................................................................................... 6, 20, 21
19
Cal. Civ. Code
20 1060 .................................................................................................................................... 16
21 1621 .................................................................................................................................... 14
1798.80 ............................................................................................................... 6, 18, 19, 20
22 1798.82 ......................................................................................................................... 18, 19
1798.84 ......................................................................................................................... 18, 19
23 1798.94 ......................................................................................................................... 19, 20
24 Mo. Sup. Ct. R. 67.01 .......................................................................................................... 23, 24
25
Fed. R. Civ. P.
26 12(b)(1) .......................................................................................................................... 10, 23
12(b)(6) ................................................................................................................................ 10
27
Secondary Sources
28
Restatement (Second) of Judgments 20(1) (1982) ................................................................... 22
5 Case No. 37-2016-00035493-CU-MC-CTL

1 Plaintiff Stephen Hine respectfully submits this memorandum in opposition to
2 Defendant Scottrade, Inc.s (Scottrade) Demurrer to Class Action Complaint (Dem.).
3 I. INTRODUCTION
4 Scottrade is a highly sophisticated, high-tech brokerage firm that provides brokerage,
5 banking, and other financial related services to millions of customers. Because it solicits and
6 maintains its customers highly sensitive personal and financial information, Scottrade
7 reassures its customers that it protects the information by using industry leading security
8 technologies and maintains strict electronic safeguards. It is also required by law to do so.
9 In its contracts with customers, Scottrade further agrees to safeguard the information by using
10 secured files.
11 Scottrade failed to fulfill its obligations. Plaintiff and the other Class members
12 provided their highly sensitive personal and financial information to Scottrade and paid
13 Scottrade fees for its services under the contract. Rather than use Plaintiffs and the Class
14 members payments to maintain industry leading security technologies as promised, Scottrade
15 used outdated and deficient technology. This resulted in a massive breach of Scottrades
16 internal networks, whereby cyber criminals readily accessed and took Plaintiffs and Class
17 members highly sensitive personal and financial information.
18 Plaintiff originally filed his action in the Southern District of California and agreed to
19 transfer and consolidation in the Eastern District of Missouri. On Scottrades motion, that
20 federal action was dismissed for lack of Article III standing. Accordingly, Plaintiff filed his
21 action in this court where Article III does not apply. Contrary to Scottrades strained argument
22 otherwise, the Eastern District of Missouris dismissal on jurisdictional grounds does not bar
23 Plaintiff from bringing his claims in this Court.
24 As demonstrated below, Plaintiff sufficiently pleads claims for breach of express and
25 implied contract, unjust enrichment, violations of the California Consumer Records Act
26 (CCRA), and violations of the Unfair Competition Law (the UCL). Scottrades demurrer
27 should be overruled.
28 ///
6 Case No. 37-2016-00035493-CU-MC-CTL

1 II. STATEMENT OF FACTS
2 A. Scottrade Collects and Maintains Its Customers Sensitive Personal and
3 Financial Information
4 Scottrade is a retail brokerage firm that provides, among other things, brokerage
5 services, banking services, and retirement planning services for individuals and businesses.
6 34, 35.1 When a customer opens an account with Scottrade, he or she must provide certain
7 personal information and complete the Brokerage Agreement, which by its terms, incorporates
8 Scottrades Privacy Policy. 37. Among other things, Scottrade collects names, addresses,
9 telephone numbers, social security numbers, tax identification numbers, employer contact
10 information, personal email addresses, and other sensitive data (PII). 1, 37.
11 Scottrades customers reasonably believe that by collecting this PII, Scottrade, as a
12 retail brokerage firm, will take reasonable precautions to securely maintain and protect it. 1,
13 47. Scottrade also contractually obligates itself to protect this information. Scottrade
14 represents, including in its Privacy Statement, that it employs adequate safeguards to protect
15 the PII customers must provide to open an account. 39. Scottrade specifically states that [t]o
16 protect your personal information from unauthorized access and use, we use security measures
17 that comply with federal law. These measures include computer safeguards and secured files
18 and buildings. 40. Scottrades Online Privacy Policy repeats and reinforces these
19 representations that it uses industry leading security technologies, including layered security
20 and access controls over personal information to safeguard its customers PII. 42. Scottrade
21 makes similar representations in other documents. 42-43. That is because Scottrade
22 recognizes that [a]ccount numbers, Social Security numbers and other pieces of personal
23 information can all be used to commit fraud. 44.
24 Plaintiff is a Scottrade customer who provided his PII to Scottrade in connection with
25 opening brokerage accounts and paid fees to Scottrade, a portion of which was intended for
26 data management and security pursuant to Scottrades contractual and other obligations. 10.
27 Plaintiff and Class members bargained for, and expected to receive, reasonable data security to
28
1
All references are to the Class Action Complaint, filed October 7, 2016.
7 Case No. 37-2016-00035493-CU-MC-CTL
1 safeguard and protect the privacy of their PII and relied on Scottrades representations
2 regarding data security. 45. Plaintiff would not have opened an account with Scottrade or
3 would not have paid as much with respect to his account, had he known that Scottrade did not
4 take reasonable precautions to secure his PII. 46.
5 B. Scottrades Deficient Safeguards Resulted in a Massive Data Breach

6 As a result of Scottrades deficient security protections, its databases were an easy
7 target. After obtaining the login credentials for one Scottrade account, from about September
8 2013 to about February 2014, hackers were able to readily access Scottrades internal networks
9 and export the PII of more than 4.6 million Scottrade customers (the Data Breach). 59-65.
10 The hackers took the PII for the purpose of building their own competing customer database
11 for marketing and brokering stock transactions, among other reasons. 60-62.
12 Further investigation by the Federal Bureau of Investigation (FBI) revealed that even
13 the hackers were shocked at Scottrades lack of security. On September 5, 2013, hacker John
14 Doe told hacker Shalon in an online chat that he found passwords to scottrade.com on VPN
15 and Shalon replied, wowSeriously? 68. Again, on November 19, 2013, hacker John Doe
16 stated, I am working on scottrade, I am trying to get in there. Seems to be working, to which
17 hacker Shalon replied, [y]es it will be a simply hit for us. 70.
18 Less than one hour after obtaining login credentials for one Scottrade account, the
19 hackers were able to locate Scottrades customer database containing 6 million customers. 72.
20 The next day, the hackers accessed the customer information on the database and by
21 November 23, 2013, uploaded four files of customer PII. 73-74. On November 25 and 27,
22 2013, the hackers took additional customer PII from Scottrade including from Scottrades bank
23 database. 75-76. The hackers used the information to operate a stock price manipulation
24 scheme that amassed millions of dollars, operated illegal Internet gambling websites, and a
25 Bitcoin exchange that generated millions more. 78.
26 On October 2, 2015, renowned security reporter Bryan Krebs of Krebs on Security

27 published an article alerting readers to the Data Breach. 48. Mr. Krebs reported that Scottrade
28 had sent customers a notice informing them of the Data Breach. 49. Mr. Krebs also reported
8 Case No. 37-2016-00035493-CU-MC-CTL

1 that Scottrade informed him that they learned about the date of theft from the FBI, and the
2 company is working with agents from FBI field offices in Atlanta and New York. 51. Mr.
3 Krebs and other online sources reported on the similarities between this Data Breach and a
4 2014 J.P Morgan Chase breach to facilitate stock scams. 52-53. The FBI later confirmed
5 these reports. 53.
6 Scottrade was aware of its inadequate security measures and had been fined and
7 publically reprimanded on several occasions for failing to comply with industry standards
8 regarding network security, as well as failing to maintain proper supervisory mechanisms
9 involved wire transfers. 56. Scottrade suffered another data breach in May 2014 where
10 brokerage accounts were hacked to make unauthorized trades. 57.

11 As a result of the Data Breach, one or more data thieves transferred, sold, opened, read,
12 mined and otherwise used Plaintiffs PII to their financial benefit and to Plaintiffs financial
13 detriment. 10.
14 C. Scottrades Notice of the Data Breach and Remedy Are Inadequate

15 Scottrade knew of the Data Breach by at least August 2015. 80. Nevertheless, when
16 the FBI informed Scottrade on September 25, 2015 that it could inform its customers of the
17 Data Breach, Scottrade waited another week before it began to provide notice. 81.
18 On October 2, 2015, Scottrade began sending notices via email and mail, confirming
19 the Data Breach of Plaintiffs and Class members PII, including names, addresses, Social
20 Security numbers, employers names, and tax identification numbers. 82. However, many
21 affected customers never received notice because many of the emails and addresses were
22 outdated. 83. Scottrade could have sent notice to its customers phone numbers via text
23 message but never did. Id.
24 Additionally, the notice is materially misleading and fails to adequately disclose the
25 scope of the ongoing threat. 84. For example, while Scottrade advised that personal
26 information may have been compromised and that it was not aware which specific
27 information was actually taken, it stated that it appears contact information was the focus of
28 the incident. 85. However, the database accessed contains Social Security numbers, email
9 Case No. 37-2016-00035493-CU-MC-CTL

1 addresses and other sensitive data. Id. The notice also failed to disclose the number of
2 affected customers, how the breach occurred, or why the PII was not safeguarded. 86.
3 Moreover, Scottrade placed the burden squarely on Plaintiff and the Class to protect
4 themselves from identity theft and fraud and mitigate their damages. 87. While the notice
5 provides for a year of credit monitoring and identity theft insurances, the credit monitoring
6 requires customers to fill out forms and make phone calls to obtain coverage and does not
7 provide comprehensive protection. 88-90. Additionally, while the notice advises customers
8 to obtain a fraud alert it fails to disclose that because the Data Breach occurred three years
9 ago a fraud alert is not likely effective, or that a fraud alert may not prevent the misuse of
10 existing accounts. 91. Scottrade also fails to advise customers to change their passwords and
11 instead represents that the passwords were encrypted, which provides a false sense of security.
12 95. Scottrade continues to misrepresent that clients PII was safe and secure. 96.
13 D. Procedural Background
14 Plaintiff originally filed his action on October 3, 2015, in the Southern District of
15 California. Around the same time, other plaintiffs filed related actions including in the Eastern
16 District of Missouri where Scottrade is headquartered. In an effort to move things along,
17 Plaintiff agreed to voluntarily transfer his action to the Eastern District of Missouri. The
18 related actions subsequently were consolidated in Duqum v. Scottrade, Inc. and a consolidated
19 complaint was filed.
20 On Scottrades motion to dismiss Duqum under Federal Rules of Civil Procedure
21 12(b)(1) for lack of federal subject matter jurisdiction, the court in the Eastern District of
22 Missouri granted the motion. Request for Judicial Notice ISO Scottrade Inc.s Demurrer
23 (Scottrades RJN), Ex. F (Order) at 18. In ruling on the Rule 12(b)(1) motion, the Duqum
24 court found Plaintiffs have failed to plead facts demonstrating that they have suffered any
25 injury in fact under Article III and dismissed the actions without prejudice. Id. at 18. The
26 Duqum court expressly declined to rule on the merits of Scottrades Rule 12(b)(6) motion. Id.
27 at 19. Given the courts ruling, Plaintiff opted not to amend his pleadings, and instead re-filed
28 in this Court where Article III does not apply.
10 Case No. 37-2016-00035493-CU-MC-CTL

1 After filing in California state court, Scottrade then reversed course and decided it
2 wanted to be back in federal court, removing Plaintiffs action. Because the Eastern District of
3 Missouri had previously found that federal subject matter jurisdiction did not exist, the action
4 was remanded back to this Court on January 13, 2017.
5 III. LEGAL STANDARDS ON DEMURRER

6 In examining the sufficiency of the complaint on demurrer, all material facts are treated
7 as admitted. First Nationwide Savings v. Perry, 11 Cal. App. 4th 1657, 1662 (1992). The
8 complaint is to be given a reasonable interpretation, reading it as a whole and its parts in their
9 context. Id. If there is a reasonable possibility that a defect in the complaint can be cured by
10 amendment, then leave to amend should be granted. Id.

11 IV. THE DEMURRER SHOULD BE OVERRULED

12 A. Plaintiff States Claims for Breach of Express and Implied Contract
13 1. Plaintiff Alleges Damage Resulting from Scottrades Breach
14 Scottrade argues that Plaintiff does not allege damage to sustain a claim for breach of
15 express or implied contract because he does not allege that he suffered any actual identity
16 theft or fraud as a result of the cyberattack or that he incurred any actual costs, expenses,
17 loss of money, loss of property, or other damages or ascertainable loss as a result of the
18 cyberattack. Dem. at 6-7, 9. Scottrade misunderstands the claims. Plaintiff suffered damage
19 because he paid money to Scottrade in exchange for adequate safeguards of his PII that
20 Scottrade did not provide.
21 Breach of contract requires pleading damage to plaintiff resulting from the breach of
22 contract. McKell v. Washington Mut., Inc., 142 Cal. App. 4th 1457, 1489 (2006). The same is
23 required for a breach of implied contract claim. Yari v. Producers Guild of Am., Inc., 161 Cal.
24 App. 4th 172, 182 (2008). The basic object of damages is compensation, and in the law of
25 contracts the theory is that the party injured by a breach should receive as nearly as possible
26 the equivalent of the benefits of performance. Brandon & Tibbs v. George Kevorkian
27 Accountancy Corp., 226 Cal. App. 3d 442, 455 (1990). Restitution i.e., the return of money
28 received by the wrongdoer under the contract is an appropriate remedy for breach of the
11 Case No. 37-2016-00035493-CU-MC-CTL

1 contract. Ajaxo Inc. v. E*Trade Grp. Inc., 135 Cal. App. 4th 21, 56-57 (2005).
2 Here, Plaintiff alleges he was charged and paid Scottrade fees in connection with his
3 Scottrade account, a portion of which were used for data management and security pursuant to
4 the contractual and other obligations of Scottrade. 10. Plaintiff alleges he was damaged by
5 Scottrades failure to adequately safeguard and protect Plaintiffs PII in breach of the contract
6 in the amount of those monetary fees . . . paid to Scottrade. 109, 113. Accordingly,
7 Plaintiff seeks return of that money. See Ajaxo, 135 Cal. App. 4th at 56.
8 The Eastern District of Missouris finding that Plaintiff does not have Article III
9 standing based on other allegations of injury has no bearing on Plaintiffs ability to plead a
10 breach of contract claim in this Court. Indeed, the Eastern District of Missouri expressly
11 declined to make such determination. Order at 18.
12 The district court cases Scottrade cites have nothing to do with the type of out-of-
13 pocket injury alleged here i.e., payment for services never rendered. In In re Barnes & Noble
14 Pin Pad Litig., No. 12-cv-08617, 2916 U.S. Dist. LEXIS 137078 (N.D. Ill. Oct. 3, 2016),
15 plaintiffs alleged that defendant retailer impliedly agreed to protect consumers personal
16 information when it accepted credit cards as a form of payment for in-store purchases. Id. at
17 *13. Plaintiffs alleged damages in the amount they paid for in-store purchases using a credit
18 card. Id. The court found such damages were too attenuated. Id. at *14.2
19 Scottrades citation to the dissenting opinion in Small v. Fritz Cos., Inc., 30 Cal. 4th
20 167, 202 (2003) is no more helpful to Scottrade as that case concerned claims for fraud and
21 negligent misrepresentation, not breach of contract. Id. at 185.
22 Plaintiffs alleged payment of money under the contract for services he did not receive
23 is sufficient damage to sustain a breach of contract claim.
24
2
See also cases cited by Scottrade at Dem. 8 n.7 (Moyer v. Michaels Stores, Inc., No. 14
25 C 561, 2014 U.S. Dist. LEXIS 96588, at *22 (N.D. Ill. July 14, 2014) (alleged loss for
purchase of credit monitoring under Illinois law); Holmes v. Countrywide Fin. Corp., No.
26 5:08-CV-00205, 2012 U.S. Dist. LEXIS 96587, at *37 (W.D. Ky. July 12, 2012) (financial
27 impact to Plaintiffs is relegated to voluntary expenditures to reduce a future risk); Ponder v.
Pfizer, Inc., 522 F. Supp. 2d 793, 796 (M.D. La. 2007) (alleged damages related to credit
28 monitoring); Hendricks v. DSW Shoe Warehouse, Inc., 444 F. Supp. 2d 775, 780-82 (W.D.
Mich. 2006) (alleged loss for purchase of credit monitoring under Michigan law).
12 Case No. 37-2016-00035493-CU-MC-CTL
1 2. Plaintiff Alleges a Breach of an Express Contract
2 Scottrade also argues Plaintiff does not allege a breach of express contract because he
3 does not cite to any provision of the Brokerage Agreements that was breached. Dem. at 8.
4 Plaintiffs breach of contract claim is based on Scottrades promises in its Privacy Statement
5 which Scottrade admits is incorporated by reference into the Brokerage Agreement. 37-41.
6 A contract may validly include the provisions of a document not physically a part of
7 the basic contract . . . . Shaw v. Regents of Univ. of Cal., 58 Cal. App. 4th 44, 54 (1997)
8 (citation omitted); In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617, 2016 U.S. Dist.
9 LEXIS 70594, at *112-13 (N.D. Cal. May 27, 2016) (sustaining breach of contract claim under
10 California law in data breach case based on defendants incorporation by reference of privacy
11 provisions in contract).
12 Scottrade admits that its Privacy Statement is incorporated into the Brokerage
13 Agreements. Dem. at 8. Scottrades Privacy Statement promises that [t]o protect your
14 personal information from unauthorized access and use, we use security measures that comply
15 with federal law including computer safeguards and secured files and buildings. 40; Dem.
16 at 9 (citing Privacy Statement). Plaintiff alleges Scottrade breached this contractual obligation
17 by failing to adequately safeguard or protect Plaintiffs and the proposed Class members
18 personal data from being accessed and taken and failing to maintain sufficient security
19 measures and procedures to prevent unauthorized access. 111. Specifically, Plaintiff alleges
20 Scottrades databases were an easy target because the hackers were able to use credentials
21 from one account to gain access to Scottrades internal enterprise networks. 64. Even the
22 hackers were surprised how deficient Scottrades safeguards were. 68. Had Scottrade used
23 computer safeguards and secured files to adequately protect [Plaintiffs and the other Class
24 members] information from unauthorized access and use as promised, the Data Breach
25 would not have happened. 40.
26 Additionally, extrinsic evidence can be used to demonstrate the meaning of express

27 contractual terms. Morey v. Vannucci, 64 Cal. App. 4th 904, 912 (1998). Scottrade explained
28 in its Online Privacy Policy what it meant in the express contract by security measures that
13 Case No. 37-2016-00035493-CU-MC-CTL

1 comply with federal law and computer safeguards. 42. In the Online Privacy Policy,
2 Scottrade promised it compl[ies] with applicable laws and regulations regarding the
3 protection of personal information by using industry leading security technologies. Id.
4 Plaintiff alleges Scottrades practices fell far below industry standards.
5 Whether Plaintiff can prove a breach of contract is a question of fact not at issue on
6 demurrer. Plaintiffs allegations, accepted as true, are sufficient to constitute a breach of
7 contract. First Nationwide, 11 Cal. App. 4th at 1662.
8 3. Plaintiff Pleads Breach of Implied Contract in the Alternative

9 Scottrade argues Plaintiffs breach of implied contract claim fails because the parties
10 relationship is governed by the terms of an express contract. Dem. at 9. However, breach of an

11 implied contract may be pled as an alternative to breach of an express contract. Lewis Ave.
12 Parent Teachers Assn v. Hussey, 250 Cal. App. 2d 232, 235 (1967).
13 Plaintiff expressly alleges that his breach of implied contract claim is brought in the
14 alternative to his breach of express contract claim. 116. Plaintiff may plead alternative
15 grounds for relief. See Steiner v. Rowley, 35 Cal. 2d 713, 720 (1950).
16 4. Plaintiff Alleges the Existence of an Implied Contract

17 Finally, Scottrade argues Plaintiff does not allege a breach of implied contract claim
18 because he does not allege a mutual understanding that Scottrade would use adequate
19 safeguards to protect Plaintiffs personal information it collected. Dem. at 10.
20 An implied contract is one, the existence and terms of which are manifested by
21 conduct. Cal. Civ. Code 1621. Like with an express contract, mutual assent is necessary to
22 form an implied contract. Binder v. Aetna Life Ins. Co., 75 Cal. App. 4th 832, 850 (1999).
23 Mutual assent can be implied by circumstances such as course of dealing, industry custom, or
24 course of performance. Id. The making of an agreement may be inferred by proof of conduct
25 as well as by proof of the use of words. Grant v. Long, 33 Cal. App. 2d 725, 736 (1939)
26 (citation omitted). Whether the parties conduct demonstrates an implied contract, is a question
27 of fact. Foley v. Interactive Data Corp., 47 Cal. 3d 654, 677 (1988).
28
14 Case No. 37-2016-00035493-CU-MC-CTL

1 Plaintiff alleges that by Scottrade soliciting and collecting personal and financial
2 information from Plaintiff and the other Class members in exchange for Scottrades services,
3 Scottrade impliedly agreed to safeguard and protect such information from being
4 compromised. 117. Plaintiff alleges he and other Class members would not have provided
5 their PII in the absence of such promise. 119.
6 This was much more than a unilateral expectation of Plaintiff. See Dem. at 10.
7 Scottrades intent was manifested in its own words in the Secure Online Investing & Identity
8 Theft Protection portion of its website, which represents that Scottrade will keep all
9 customer information confidential and maintain strict physical, electronic and procedural
10 safeguards to protect against unauthorized access to your information. 43. Scottrade further
11 states that it use[s] industry leading security technologies. 42.
12 The parties conduct and Scottrades own words indicate the parties mutual assent that
13 Scottrade would use adequate safeguards amounting at least to industry standards.
14 Accordingly, Plaintiff sufficiently pleads breach of an implied contract.
15 B. Plaintiff States a Claim for Unjust Enrichment/Assumpsit

16 Scottrade argues Plaintiff cannot state a claim for unjust enrichment because: (1) an
17 express contract governs; (2) Plaintiff did not confer a benefit to Scottrade; and (3) the unjust
18 enrichment claim is dependent on the breach of contract claim that also fails. Dem. at 10-11.
19 Scottrade is wrong on all points.
20 First, Plaintiff can allege an unjust enrichment claim in the alternative. Klein v.
21 Chevron U.S.A, Inc., 202 Cal. App. 4th 1342, 1389 (2012), cited by Scottrade, holds that a
22 plaintiff may plead inconsistent claims that allege both the existence of an enforceable
23 agreement and the absence of an enforceable agreement. It is only when the unjust
24 enrichment claim concedes the existence of an applicable express contract that the unjust
25 enrichment claim cannot be pled in the alternative. Id.
26 Here, Plaintiffs unjust enrichment claim assumes an express contract does not apply
27 and is based, not on Scottrades contractual obligation to protect Plaintiffs and Class
28 members PII, but on Scottrades receipt of funds that it should have spent to safeguard and
15 Case No. 37-2016-00035493-CU-MC-CTL

1 protect Plaintiffs and Class members PII. 145.
2 Second, Plaintiff alleges he conferred a benefit to Scottrade by paying a brokerage fee.
3 A person is enriched for purposes of unjust enrichment if he receives a benefit at anothers
4 expense. The term benefit denotes any form of advantage. City. of Solano v. Vallejo
5 Redevelopment Agency, 75 Cal. App. 4th 1262, 1278 (1999) (internal marks and citations
6 omitted). Plaintiff alleges that a portion of the brokerage fee should have been spent to
7 safeguard and protect Plaintiffs and Class Members PII and by not doing that, Scottrade was
8 able to save money. 146. Accordingly, Plaintiff sufficiently alleges Scottrade received a
9 benefit.
10 Third, Plaintiffs unjust enrichment claim is not based on the existence of an express
11 contract but is appropriately pled in the alternative.
12 C. Plaintiff States a Claim for Declaratory Relief

13 Scottrade argues that Plaintiffs declaratory relief claim fails because he does not allege
14 a ripe controversy because he does not allege his or any other Class members PII has been
15 misused. Dem. at 12. Scottrade ignores the allegations.
16 An actual controversy for purposes of Civil Code Section 1060 is one which
17 admits of definitive and conclusive relief by judgment within the field of judicial
18 administration, as distinguished from an advisory opinion upon a particular or hypothetical
19 state of facts. Wilson & Wilson v. City Council of Redwood City, 191 Cal. App. 4th 1559,
20 1573 (2011) (citation omitted). Plaintiffs declaratory relief claim is based on Scottrades
21 continued maintenance of Plaintiffs and class members PII with ongoing inadequate security
22 measures. 149. Plaintiff asks this Court to determine whether Scottrade owes a duty to
23 safeguard the information, whether Scottrades security practices are sufficient, and whether
24 Scottrade must notify Plaintiff should a breach occur. 151. Whether Scottrades security
25 practices are sufficient and whether Scottrade must notify Plaintiff of a breach are live
26 controversies subject to declaratory relief.

27 For the same reasons, Plaintiff does not seek a declaration regarding past conduct.
28 Dem. at 13. He expressly alleges that Scottrade owed (and continues to owe) a legal duty to
16 Case No. 37-2016-00035493-CU-MC-CTL

1 safeguard and protect Plaintiffs and Class members confidential and sensitive PII and
2 Scottrade breached (and continues to breach) such legal duties. 151. A declaratory relief
3 claim becomes moot only when it is deprived of life by subsequent events. Wilson, 191 Cal.
4 App. 4th at 1574. Here, Scottrades inadequate protection of Plaintiffs and Class members
5 PII is ongoing and thus, Plaintiffs declaratory relief claim remains ripe.
6 In In re Adobe Sys. Privacy Litig., 66 F. Supp. 3d 1197 (N.D. Cal. 2014), the plaintiffs
7 sought a declaration regarding their rights under a contract wherein the defendant had agreed
8 to provide reasonable security measures. Id. Like Scottrade, the defendant argued that the
9 claim was an unripe request for an impermissible advisory opinion that impermissibly
10 sought an advantage for future litigation by obtaining an advance ruling. Id. at 1220-21
11 (citation omitted). The court rejected the argument, explaining that the plaintiffs properly
12 sought a declaration that Adobes current practices violated the parties agreement. Id. at
13 1222. The court explained:
14 Plaintiffs have plausibly alleged the existence of a definite and concrete

dispute over the meaning and the scope of Adobes contractual obligation to
15 provide reasonable security measures. According to the Complaint, although
Adobe maintains that its security measures were adequate and remain
16 adequate, there were in fact a number of standard industry practices that
Adobe failed to follow. . . .
17
The remaining jurisdictional prerequisites for a declaratory relief claim are met
18 here as well. The dispute over the reasonableness of Adobes security controls
touches on the parties legal relations, and the parties legal interests are
19 adverse. Plaintiffs plausibly allege that they face a substantial risk of future
harm if Adobes security shortcomings are not redressed, making this dispute
20 sufficiently real and immediate, and the dispute underlying Plaintiffs'
declaratory relief claim concerns Adobes current security practices, rather than
21 a hypothetical set of acts or omissions.
22 Id. at 1221 (citation omitted).
23 The defendant in Adobe also argued like Scottrade here that the plaintiffs
24 impermissibly sought a declaration that Adobe has breached its contractual obligations. Id.
25 at 1222 (citation omitted). The court again rejected the defendants argument because the
26 plaintiffs sought a declaration clarifying Adobes ongoing contractual obligations to provide

27 reasonable security. Id. Declaratory relief under California law is similarly appropriate where
28 an ongoing contractual relationship exists and declaratory relief is necessary to guide future
17 Case No. 37-2016-00035493-CU-MC-CTL

1 conduct. See Osseous Techs. of Am., Inc. v. DiscoveryOrtho Partners LLC, 191 Cal. App. 4th
2 357, 365 (2010); Steinberg v. Chiang, 223 Cal. App. 4th 338, 343-44 (2014).
3 Like the plaintiffs in Adobe, Plaintiff here seeks an adjudication of the parties present
4 and continuing rights regarding data security. 149-51.3
5 D. Plaintiff States a Claim for Violation of the CCRA

6 1. Plaintiff Has Statutory Standing
7 California Civil Code Section 1798.84(b) of the CCRA provides that [a]ny customer
8 injured by a violation of this title may institute a civil action to recover damages. Plaintiff
9 sufficiently pleads damages resulting from Scottrades failure to provide timely and adequate
10 notice pursuant to Section 1798.82.

11 Plaintiff alleges that as a result of Scottrades untimely and insufficient notice he and
12 the Class members have suffered (and will continue to suffer) economic damages
13 [including] (iv) deprivation of the value of their PII, for which there is a well-established
14 national and international market, (v) failure to receive the full benefit of their bargain as a
15 result of receiving brokerage and financial services that were less valuable than what they paid
16 for, and/or (vi) the financial and/or temporal cost of monitoring their credit, monitoring their
17 financial accounts, and mitigating their damages. 164. Additionally, Plaintiff specifically
18 alleges after Scottrades unauthorized release of his PII, one or more data thieves, and their
19 subsequent customersdisclosed PII, transferred, sold, opened, read, mined and otherwise
20 used Mr. Hines PIIto their financial benefit and his financial detriment. 10. Moreover,
21 Plaintiff alleges he paid Scottrade fees in connection with his Scottrade account, a portion of
22 which were used for data management and security. Id.
23 Additionally, Plaintiff does not just allege that the notice was delayed but also that the
24 notice was inadequate, materially misleading, and did not fully disclose the breadth of the Data
25 Breach. 80-82. Section 1798.82(d)(2)(B) requires the notice to accurately disclose [a] list of
26 the types of personal information that were or are reasonably believed to have been the subject
27
3
28 Scottrade also argues the declaratory relief claim is duplicative of his negligence claim.
However, Plaintiff no longer asserts a claim for negligence. Dem. at 1 n.2.
18 Case No. 37-2016-00035493-CU-MC-CTL
1 of the breach.
2 In Adobe, relied on by Scottrade, defendant only knew of the breach for a matter of
3 days before providing notice. 66 F. Supp. 3d at 1210, 1217. Here, even though Scottrade was
4 aware of the Data Breach since at least August 2015 (76-77), it waited an additional week to
5 inform consumers after the FBI said it could do so (78). Additionally, the notice here was not
6 designed to promptly reach all affected Scottrade customers and provided misleading
7 information regarding the breach. 80-82.
8 The Eastern District of Missouris ruling on Article III grounds has no bearing on
9 whether Plaintiff satisfies the statutory requirements of the CCRA. See Order at 19 (declining
10 to rule on the merits of the claims). Although some injuries sufficient to support Article III
11 standing may also support injury under the CCRA, it does not follow that simply because a
12 plaintiff does not have Article III standing, he also does not have standing under CCRA. See
13 Adobe, 66 F. Supp. 3d at 1218. Plaintiff sufficiently alleges injuries to satisfy Section
14 1798.84(b).
15 2. Plaintiff Alleges the Elements of a Claim Under Section 1798.82

16 Scottrade also argues that Plaintiff fails to allege his injuries resulted from Scottrades
17 violation of Section 1798.82. Dem. at 15. However, in Boorstein v. CBS Interactive, Inc.,
18 222 Cal. App. 4th 456, 473 (2013), the court indicated that a failure to receive information
19 required to be disclosed under the CCRA can be sufficient injury resulting from a violation.
20 The Boorstein court held that although under the facts alleged, injury did not occur where the
21 defendant only failed to disclose its own contact information, a failure to disclose information
22 could result in sufficient injury under other circumstances. Id.
23 Here, Plaintiff alleges Scottrade failed to provide timely and sufficient notification,
24 including by accurately disclosing the PII that was the subject of the Data Breach, in violation
25 of the CCRA. 86, 160. As a result, Plaintiff suffered the injuries described above. 10, 164.
26 3. Plaintiff Alleges Injunctive Relief

27 Scottrade argues that in order to obtain injunctive relief under Section 1798.94(e) of
28 the CCRA, Plaintiff must allege irreparable harm, which according to Scottrade Plaintiff has
19 Case No. 37-2016-00035493-CU-MC-CTL

1 not done. Dem. at 16. That is not the law.
2 Section 1798.94(e) clearly states that [a]ny business that violates, proposes to violate,
3 or has violated this title may be enjoined. Accordingly, if Plaintiff proves Scottrade violated
4 the CCRA, he is entitled to injunctive relief.
5 The cases cited by Scottrade concern preliminary injunctions. Leach v. City of San
6 Marcos, 213 Cal. App. 3d 648 (1989), merely holds that a plaintiff seeking an injunction must
7 demonstrate harm. Id. at 661. As discussed above, Plaintiff alleges injury and so can seek
8 injunctive relief.
9 E. Plaintiff States a Claim for Violation of the UCL

10 1. Plaintiff Has Standing Under the UCL
11 Scottrade again ignores Plaintiffs allegations and argues that Plaintiff has not suffered
12 a loss of money or property under the UCL because according to Scottrade, the risk of identity
13 theft, invasion of privacy, breach of confidentiality, deprivation of value, failure to receive the
14 benefit of the bargain, and costs for credit monitoring are insufficient. Dem. at 17.
15 However, Plaintiff alleges he paid Scottrade fees, a portion of which of was intended
16 for adequate (or industry standard) safeguards of his PII that he was required to give to obtain
17 Scottrades services. 10. Plaintiff further alleges that had he known Scottrade failed to take
18 reasonable precautions to secure his [PII] he would not have opened an account with
19 Scottrade, or would not have paid as much with respect to that account. 46.
20 To bring a claim under the UCL, a plaintiff must show that he has personally
21 suffered harm in the form of economic injury. Kwikset Corp. v. Super. Ct. 51 Cal. 4th 310,
22 323 (2011). Proof of a personal, individualized loss of money or property in any nontrivial
23 amount satisfies the UCL statutory standing requirements. Id. at 325. This includes a plaintiff
24 paying more in a transaction than he otherwise would have, depriving the plaintiff of money to
25 which he has a cognizable claim, or requiring plaintiff to enter into a transaction, costing
26 money, that otherwise would have been unnecessary. Id. at 323.

27 In Anthem, the court found that plaintiffs payment of premiums to defendants was
28 sufficient to confer UCL standing where, as part of defendants services, they were required
20 Case No. 37-2016-00035493-CU-MC-CTL

1 to comply with certain privacy laws, which defendants allegedly did not do. 2016 U.S. Dist.
2 LEXIS 70594, at *185. The court held that plaintiffs established economic injury because
3 they have surrender[ed] in a transaction more, or acquir[ed] in a transaction less, than he or
4 she otherwise would have. Id.
5 Similarly, here, Plaintiff paid Scottrade for the adequate safeguard of his PII, which he
6 did not receive. Accordingly, Plaintiffs payment of money to Scottrade for reasonable
7 safeguards of his PII that he did not receive is sufficient for standing under the UCL.
8 2. Plaintiff Alleges a Basis for Restitution and Injunctive Relief Under

9 the UCL
10 Plaintiff is entitled to restitution because he alleges Scottrade received money from him
11 for brokerage and financial services that included data management and security and did not
12 provide those services. 10, 199. Recovery of this money is permitted under the UCL. See
13 Anthem, 2016 U.S. Dist. LEXIS 18135, at *145 (Because plaintiffs seek to recover profits
14 unfairly obtained, Plaintiffs have sufficiently established that they may seek restitution in the
15 instant action.).
16 Scottrades reliance on In re Sony Gaming Networks & Customer Data Sec. Breach
17 Litig., 903 F. Supp. 2d 942 (S.D. Cal. 2012) is again misplaced. In Sony, plaintiffs did not pay
18 any money to defendant for the services and thus, were not entitled to restitution. Id. at 966.
19 Similarly, in Wofford v. Apple, Inc., 11-CV-0034, 2011 U.S. Dist. LEXIS 129852, at *8
20 (S.D. Cal. Nov. 8, 2011), plaintiffs only alleged they lost the use of their phones and did not
21 allege that defendant gained anything. Here, by contrast, Plaintiff alleges he paid fees to
22 Scottrade, which were supposed to in part be used to provide adequate safeguards for his PII,
23 and did not receive those protections. 10.
24 Plaintiff is also entitled to injunctive relief. Injunctive relief is the primary form of
25 relief under the UCL. Kwikset, 51 Cal. 4th at 337. Plaintiff alleges much more than just a
26 conclusory allegation that more data breaches will occur if Scottrade is not enjoined. See Dem.
27 at 18. Plaintiff specifically seeks an injunction requiring Scottrade to design, adopt,
28 implement, control, direct, oversee, manage, monitor and audit appropriate data security
21 Case No. 37-2016-00035493-CU-MC-CTL

1 processes, controls, policies, procedures, protocols, and software and hardware systems to
2 safeguard and protect the PII entrusted to it. 173. Plaintiff further alleges that Scottrade has a
3 history of inadequate data protections, including a subsequent breach. 56-57.
4 Finally, the mere fact that Plaintiff has not been informed of a more recent data breach
5 does not negate a need for the requested injunctive relief and does not necessarily demonstrate
6 that Scottrades current data safeguards are sufficient. Scottrade continues to maintain
7 Plaintiffs and other Class members PII and thus, injunctive relief to sufficiently protect that
8 information is appropriate.
9 F. Plaintiffs Claims Are Not Barred by the Eastern District of Missouris

10 Findings Regarding Federal Article III Standing
11 Scottrade argues the dismissal of Plaintiffs claims in the Eastern District of Missouri
12 for lack of Article III standing bars the filing of his complaint in California state court. Dem. at
13 19. Scottrade is wrong.
14 Res judicata only prevents the same parties from pursuing a matter that was previously
15 adjudicated on the merits. Mycogen Corp. v. Monsanto Co., 28 Cal. 4th 888, 896 (2002). A
16 dismissal for lack of jurisdiction is not a judgment on the merits and thus, has no preclusive
17 effect. See Teitelbaum Furs, Inc. v. Dominion Ins. Co., 58 Cal. 2d 601, 604 (1962) (a judgment
18 will have res judicata effect only if the court has appropriate jurisdiction); Restatement
19 (Second) of Judgments 20(1) (1982) (A personal judgment for the defendant, although valid
20 and final, does not bar another action by the plaintiff on the same claim: (a) When the
21 judgment is one of dismissal for lack of jurisdiction . . . .).
22 The court in Duqum dismissed the action solely for lack of federal jurisdiction and
23 expressly declined to make any rulings on the merits. Order at 18-19. That ruling on
24 jurisdictional grounds does not prevent Plaintiff from bringing his case in a court with
25 appropriate jurisdiction as he had done here.
26 Scottrade attempts to attach importance to the fact that Duqum was dismissed with
27 prejudice. Dem. at 19. However, the law is clear: [T]he with prejudice label is not always
28 conclusive for the purpose of res judicata and, indeed, does not equate to an adjudication on
22 Case No. 37-2016-00035493-CU-MC-CTL

1 the merits when the dismissal is for lack of jurisdiction. Ruiz v. Snohomish Cnty. Pub. Util.
2 Dist. No. 1, 824 F.3d 1161, 1168 (9th Cir. 2016). The fact that Judge Mensah dismissed
3 Duqum with prejudice does not change her dismissal for lack of jurisdiction to one on the
4 merits. Res judicata does not apply.
5 Scottrade contends that under Missouri law dismissal need not be on the merits for res
6 judicata to apply. Dem. at 19. Scottrade is wrong again.
7 First, Missouri law does not apply because there was never federal jurisdiction to begin
8 with. Louie v. BFS Retail & Commercial Operations, LLC, 178 Cal. App. 4th 1544 (2009),
9 relied on by Scottrade, holds that whether state or federal res judicata law applies, depends on
10 the type of jurisdiction of the federal court. Id. at 1553. If the federal court had federal
11 jurisdiction, then federal law applies, and if the federal court had diversity jurisdiction, then
12 the state law in which the federal court sits applies. Id. at 1553-54.
13 However, here there was never any federal jurisdiction. Nonetheless, whether federal,
14 California, or Missouri law are applied, the result is the same there is no res judicata effect.
15 Under Missouri law, res judicata only applies if the prior judgment was entered by a
16 court of competent jurisdiction and constituted a final judgment on the merits. Bugg v.
17 Rutter, 330 S.W.3d 148, 153 (Mo. Ct. App. 2010). Just as in California, dismissal for lack of
18 subject matter jurisdiction is a preliminary determination of the courts power to act which is
19 not a decision on the merits with res judicata affect. Heller v. Aldi, Inc., 851 S.W.2d 82, 84
20 (Mo. Ct. App. 1993).
21 Nonetheless, Scottrade argues that Mo. Sup. Ct. R. 67.01, which provides that [a]
22 dismissal with prejudice bars the assertion of the same cause of action or claim against the
23 party, applies to this case because Duqum was dismissed with prejudice, even though it was
24 not adjudicated on the merits. Dem. at 19. Scottrade is wrong again.
25 First, Missouri Rule 67.01 does not apply. The Eastern District of Missouri dismissed
26 Duqum pursuant to Fed. R. Civ. P. 12(b)(1), not Missouri rules. Dismissal with prejudice was
27 only required under federal rules to trigger the opportunity to appeal the Duqum Order. See
28 WMX Techs. v. Miller, 104 F.3d 1133, 1135 (9th Cir. 1997). It was not intended to block
23 Case No. 37-2016-00035493-CU-MC-CTL

1 Plaintiff from bringing his suit in a court with appropriate jurisdiction.
2 Second, if Duqum was dismissed pursuant to Missouri rules for lack of subject matter
3 jurisdiction, the dismissal would have been without prejudice and Missouri Rule 67.01 would
4 not apply. In Seldomnridge v. Gen. Mills Operations, Inc., 140 S.W.3d 58 (Mo. Ct. App.
5 2004), the court held that [a] dismissal for lack of subject matter jurisdiction must be without
6 prejudice because the court has no authority to decide the case on the merits. Id. at 63-64; see
7 also Charron v. State, 257 S.W.3d 147, 155 (Mo. Ct. App. 2008) (reversing trial court and
8 modifying dismissal for lack of subject matter jurisdiction to one without prejudice). Thus, not
9 surprisingly, Missouri rules treat a dismissal for lack of subject matter jurisdiction as one
10 without prejudice.
11 That is because, like in California and federal courts, Missouri requires that a court
12 have proper jurisdiction before res judicata can take effect either because the case was
13 dismissed on the merits or under Missouri Rule 67.01. Bugg, 330 S.W.3d at 153 (requiring
14 judgment by court of competent jurisdiction).
15 Indeed, in all cases cited by Scottrade, the court to originally dismiss the claims had
16 appropriate jurisdiction. Dem. at 19-20. In Levi v. Aerotek, Inc., 374 F. Appx 679 (8th Cir.
17 2010), the court affirmed dismissal based on res judicata and held that res judicata principles
18 are satisfied, because the prior dismissal was based on proper jurisdiction with respect to the
19 state law claims raised in the present case. Id. at 680. In Williams v. Rape, 990 S.W.2d 55
20 (Mo. Ct. App. 1999), the court affirmed dismissal of plaintiffs fifth lawsuit, finding that a
21 prior courts dismissal with prejudice of the fourth lawsuit under Missouri Rule 67.01 based on
22 the grant of defendants motion for summary judgment of the third lawsuit precluded
23 subsequent suits. Id. at 56, 62.
24 Here, however, Scottrade successfully contested federal jurisdiction. Thus, the Order in
25 Duqum, holding that there is no federal jurisdiction, cannot have preclusive effect on the
26 merits of Plaintiffs claims here because the Eastern District of Missouri was not a court of
27 appropriate jurisdiction to decide the case on the merits and thus, did not decide the case on the
28 merits. Order at 19.
24 Case No. 37-2016-00035493-CU-MC-CTL

1 V. CONCLUSION
2 For the foregoing reasons, Scottrade's demurrer should be overruled.
3 Respectfully submitted,
4 Dated: April 6, 2017 BLOOD HURST & O'REARDON, LLP

TIMOTHY G. BLOOD (149343)
5 THOMAS J. O'REARDON II (247952)
PAULA R. BROWN (254142)
6
8
701 B Street, Suite 1700
9 San Diego, CA 92101
Tel: 619/338-1100
10 619/338-1101 (fax)
p., tblood@bholaw.com
~ 11 toreardon@bholaw.com
~
5~ pbrown@bholaw.com
12
~ SIPRUTPC
~ 13 JOSEPH J. SIPRUT (pro hac vice to be filed)
gj RICHARDS. WILSON (6321743 IL)
0 14 RICHARD L. MILLER II (6243507 IL)
o'<l 17 North State Street, Suite 1600
E-<
r:/1 15 Chicago, IL 60602
~
:::i Tel: 312/236-0000
p:: 16 312/878-1342 (fax)
Ci
0 jsiprnt@siprnt.com
0 17 rwilson@siprnt.com
....:I
o:l rmiller@siprnt.com
18
LITE DEPALMA GREENBERG
19 KATRINA CARROLL (6291405 IL)
KYLE A. SHAMBERG (6300832 IL)
20 211 W. Wacker Drive, Suite 500
Chicago, IL 60606
21 Tel: 312/750-1265
312/212-5919 (fax)
22 kcarroll@litedepalma.com
kshamberg@litedepalma.com
23
COHELAN KHOURY & SINGER
24 TIMOTHY D. COHELAN (60827)
J. JASON. HILL (179630)
25 605 C Street, Suite 200
San Diego, CA 92101
26 Tel: 619/595-3001
619/595-3000 (fax)
27 tcohelan@ckslawfirm.com
jhill@ckslaw.com
28
SPRETER LAW FIRM, APC
25 Case No. 37-2016-00035493-CU-MC-CTL
00119179 PLAINTIFF'S OPPOSITION TO DEMURRER
1 GEOFF SPRETER (257707)
JEFFREY BENNION (275946)
2 601 3rd Street
Coronado, CA 92118
3 Tel: 619/865-7986
geoff@spreterlaw.com
4
ADLER LAW GROUP, APLC
5 E. ELLIOT ADLER (229030CA)
402 W. Broadway, Suite 860
6 San Diego, CA 2101
Tel: 619/531-8700
7 619/342-9600 (fax
elliotadler@gmail.com
8
DOGALI LAW GROUP, P.A.
9 ANTHONY A.B. DOGALI (615862 FL)
GEOFFREY E. PARMER (989258 FL)
10 101 E. Kennedy Blvd., Suite 1100
Tampa, FL 33602-5146
11 Tel: 813/289-0700
813/289-9435 (fax)
12 adogali@dogalilaw.com
gparmer@dogalilaw.com
13
LOCKRIDGE AND GRINDAL
14 KATE M. BAXTER-KAUF (0392037 MN)
KAREN HANSON RIEBEL (0219770 MN)
15 100 S. Washington Ave., Suite 2200
Minneapolis, MN 55401
16 Tel: 612/339-6900
612/339-0981 (fax)
17 kmbaxter-kauf@locklaw.com
kriebekh@locklaw.com
18
Attorneys for Plaintiff
19
20
21
22
23
24
25
26
27
28
26 Case No. 37-2016-00035493-CU-MC-CTL

1 CERTIFICATE OF SERVICE
2 Stephen Hine v. Scottrade, Inc.

Case No. 37-2016-00035493-CU-MC-CTL
3
I hereby certify that on April 6, 2017, I electronically filed the foregoing with the Clerk
4
of the Court using One Legal Online Court Services, and electronically served the foregoing
5
upon the attorney of record for each party in this case at the e-mail address( es) registered for
6
such service through One Legal Online Court Services. Parties may access this filing through
7
the Court's website.
8
I certify under penalty of perjury that the foregoing is true and correct. Executed on
9
April 6, 2017.
10
~
H 11
H
$~ 12 Janet Kohnenberger
~ BLOOD HURST & O'REARDON, LLP
~
13 701 B Street, Suite 1700
San Diego, CA 92101
0 14 Tel: 619/338-1100
c/d 619/338-1101 (fax)
E-< jkohnenberger@bholaw.com
ell 15
~
::r: 16
Q
0
0 17
....:i
0'.'.1
18
19
20
21
22
23
24
25
26
27
28
27 Case No. 37-2016-00035493-CU-MC-CTL

00119179 PLAINTIFF'S OPPOSITION TO DEMURRER

Plaintiff Hine's Opposition To Scottrade's Demurrer

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Plaintiff Hine's Opposition To Scottrade's Demurrer

Uploaded by

Copyright:

Available Formats

1 BLOOD HURST & OREARDON, LLP

TIMOTHY G. BLOOD (149343)

13 Attorneys for Plaintiff

14 [Additional counsel appear on signature page]

15 SUPERIOR COURT OF THE STATE OF CALIFORNIA

25 DEMAND FOR JURY TRIAL

26 Complaint Filed: October 7, 2016

Case No. 37-2016-00035493-CU-MC-CTL

2 Case No. 37-2016-00035493-CU-MC-CTL

7 In re Anthem, Inc. Data Breach Litig.,

15 Brandon & Tibbs v. George Kevorkian Accountancy Corp.,

23 Foley v. Interactive Data Corp.,

28 Hendricks v. DSW Shoe Warehouse, Inc.,

5 Kwikset Corp. v. Super. Ct.

10 Lewis Ave. Parent Teachers Assn v. Hussey,

18 Mycogen Corp. v. Monsanto Co.,

23 Ruiz v. Snohomish Cnty. Pub. Util. Dist. No. 1,

28 Small v. Fritz Cos., Inc.,

6 Teitelbaum Furs, Inc. v. Dominion Ins. Co.,

11 WMX Techs. v. Miller,

5 Case No. 37-2016-00035493-CU-MC-CTL

2 Defendant Scottrade, Inc.s (Scottrade) Demurrer to Class Action Complaint (Dem.).

14 members payments to maintain industry leading security technologies as promised, Scottrade

17 members highly sensitive personal and financial information.

23 Plaintiff from bringing his claims in this Court.

6 Case No. 37-2016-00035493-CU-MC-CTL

11 Scottrades customers reasonably believe that by collecting this PII, Scottrade, as a

21 makes similar representations in other documents. 42-43. That is because Scottrade

23 information can all be used to commit fraud. 44.

4 take reasonable precautions to secure his PII. 46.

5 B. Scottrades Deficient Safeguards Resulted in a Massive Data Breach

16 stated, I am working on scottrade, I am trying to get in there. Seems to be working, to which

25 Bitcoin exchange that generated millions more. 78.

26 On October 2, 2015, renowned security reporter Bryan Krebs of Krebs on Security

8 Case No. 37-2016-00035493-CU-MC-CTL

5 these reports. 53.

8 regarding network security, as well as failing to maintain proper supervisory mechanisms

10 brokerage accounts were hacked to make unauthorized trades. 57.

14 C. Scottrades Notice of the Data Breach and Remedy Are Inadequate

23 message but never did. Id.

9 Case No. 37-2016-00035493-CU-MC-CTL

16 District of Missouri where Scottrade is headquartered. In an effort to move things along,

19 complaint was filed.

20 On Scottrades motion to dismiss Duqum under Federal Rules of Civil Procedure

28 in this Court where Article III does not apply.

10 Case No. 37-2016-00035493-CU-MC-CTL

4 was remanded back to this Court on January 13, 2017.

5 III. LEGAL STANDARDS ON DEMURRER

10 amendment, then leave to amend should be granted. Id.

11 IV. THE DEMURRER SHOULD BE OVERRULED

20 Scottrade did not provide.

11 Case No. 37-2016-00035493-CU-MC-CTL

11 declined to make such determination. Order at 18.

21 negligent misrepresentation, not breach of contract. Id. at 185.

23 is sufficient damage to sustain a breach of contract claim.

25 would not have happened. 40.

26 Additionally, extrinsic evidence can be used to demonstrate the meaning of express

13 Case No. 37-2016-00035493-CU-MC-CTL

3 protection of personal information by using industry leading security technologies. Id.

4 Plaintiff alleges Scottrades practices fell far below industry standards.

6 demurrer. Plaintiffs allegations, accepted as true, are sufficient to constitute a breach of

7 contract. First Nationwide, 11 Cal. App. 4th at 1662.

8 3. Plaintiff Pleads Breach of Implied Contract in the Alternative