Richard Olderman (left) and Edward Barnidge of Williams & Connolly. (Courtesy photos)

This is the second part of a two-part series on defenses for defeating COVID-19 class action lawsuits in California at the motion to dismiss stage. Our first installment focused on general defenses. This article will hone in on statutory defenses to raise at the pleadings stage in these cases.

A. Statutory Defenses

1. Statutory Standing, Unfairness and "Borrowing" Under the UCL.

On Nov. 2, 2004, the California electorate passed Proposition 64 which amended the standing requirements of the UCL. Prior to the changes, any party could bring a representative action without regard to whether or not they had suffered an injury. The UCL, as amended (and the FAL, as well), now limits its cause of action to individuals who have "suffered injury in fact and has lost money or property as a result of the unfair competition." Cal. Bus. & Prof. Code § 17204.  In Kwikset Corp. v. Superior Court, 246 P.3d 877, 885 (Cal. 2011), the court adopted a two-part test for interpreting the "lost money or property" standing requirement. Under Kwikset, a party "must now (1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact (i.e., economic injury) and (2) show that the economic injury was the result of (i.e., caused by) the unfair business practice or false advertising that is the gravamen of the claim."  Accordingly, a plaintiff must plead that he or she actually relied on the misrepresentation or omission to bring a UCL claim. "This showing of actual reliance under the UCL requires a plaintiff to allege that 'the defendant's misrepresentation or nondisclosure was an immediate cause of the plaintiff's injury-producing conduct.'" In re Solara Med. Supplies LLC, Customer Sec. Data Breach Litig., 2020 WL 2214152, at *9 (S.D. Cal. May 7, 2020). Courts have been generous in interpreting economic harm.  See Cappello v. Walmart, Inc., 394 F. Supp. 3d 1015, 1023 (N.D. Cal. 2019) (allegation that retailer shared customer's video purchase information with Facebook, in alleged violation of store's privacy policy, stated a claim of economic loss under the UCL).

As to the "unfair" prong of the statute, the courts are divided as to what practices are "unfair." See Hodsdon v. Mars, Inc., 891 F.3d 857, 866 (9th Cir. 2018) ("The UCL does not define the term 'unfair.' In fact, the proper definition of 'unfair' conduct against consumers is currently in flux among California courts"). Definitions have ranged from "offends public policy and is immoral," to violations of the antitrust laws. See In re Google Assistant Privacy Litigation, supra, No. 19-cv-04286-BCF, 2020 WL 2219022 (discussing contradictory case law). This may afford an opportunity to argue that the allegations of wrongdoing are not actionable under this prong of the statute.

While the UCL permits the "borrowing" of other statutory violations, even if those statutes do not provide for private rights of actions, plaintiffs must prove a violation of the underlying statute to establish a UCL claim. The borrowed statutes themselves often have unique defenses. And as discussed below, the CCPA is a statute that by its terms cannot be borrowed to allege a UCL cause of action.

2.  Limits on Causes of Action Brought Pursuant to the CCPA

The CCPA does not allow consumers to sue over a violation of the law's notice requirement. Rather, consumers may only file suit where their personal information is "subject to unauthorized access and exfiltration, theft, or disclosure" as a result of the business's violation of "the duty to implement and maintain reasonable security procedures and practices."  Cal. Civ. Code § 1798.150(a)(1). Further, a consumer can bring suit under the CCPA only if the following information—a narrow subset of the "personal information" regulated by the statute—is accessed or obtained without authorization: (1) an individual's name along with his or her social security, driver's license, or California identification card number; (2) account, credit card, or debit card number, in combination with a code or password that would permit access to a financial account; or (3) medical or health insurance information. Id. § 1798.81.5(d)(1)(A).

Recently, a putative class action was filed asserting a claim for violation of the UCL, and "borrowing" the CCPA as the predicate cause of action. Sean Burke et al. v. Clearview AI, Inc., et al., 20-CV-0370-BAS-MSB (S.D. Cal., filed Feb. 27, 2020).  Two lawsuits brought against Zoom also "borrow" the CCPA.

However, the language of the data breach private right of action in the CCPA expressly states: "Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law." Cal. Civ. Code § 1798.150(c). Further, the CCPA provides the California Attorney General with enforcement authority for violations of other provisions of the Act, which some courts have found demonstrates that the legislature did not intend to permit a private right of action under another law. Until the courts rule definitely on this issue, the CCPA-UCL theory of recovery will be invoked by plaintiffs, and defendants should urge that there is no private cause of action. To the extent legislative history is credited, a California Senate Judiciary Committee report specifically expressed the legislature's understanding that this provision barred using the CCPA statute to afford a borrowed claim: "It appears that this provision would eliminate the ability of consumers to bring claims for violations of the Act under statutes such as the Unfair Competition Law, Business and Professions Code Section 17200 et seq." Senate Judiciary Committee Report, AB-375, 2017-2018 Sess. (Cal. 2018).

Finally, as already discussed, the FAL and UCL require that plaintiffs prove they suffered injury in fact and lost money or property as a result of defendant's alleged wrongful conduct. And the CLRA requires plaintiffs to prove they suffered damages. This may be a defense in cases where plaintiffs seek to represent a class of consumers who used a free product during the COVID-19 pandemic, such as Zoom.

B. The Take-Away

The current COVID-19 litigation has its antecedents in earlier class action litigation that has taken advantage of the consumer-friendly statutes of California. To the extent defendants are looking to dispose of the litigation prior to class certification and prior to costly and time-consuming litigation, several key defenses may be asserted in a timely motion to dismiss, depending on the facts of the case. While some defenses will achieve only a partial dismissal, others can result in a complete dismissal of the case.

The wild card in breach of privacy cases, such as those lodged against Zoom, is the spanking new CCPA. Creative plaintiffs' lawyers will try to expand the scope of its private right of action, while lawyers for the defense will attempt to cabin the reach of the statute. Courts will be writing on a clean slate.

Richard Olderman is counsel at Williams & Connolly LLP, where he has primarily focused on appellate litigation. 

Edward Barnidge is a litigation partner at Williams & Connolly LLP, focusing on commercial litigation and heading the firm's class action practice.  

Read more: 

An Early Cure for COVID-19 Class Actions in California: Navigating New Laws in Unprecedented Times to Win the Motion to Dismiss