In re San Francisco 49ers Data Breach Litigation

Background

Plaintiffs in the consolidated action alleged that hackers obtained their personally identifiable information from the San Francisco 49ers’ computer systems in a February 2022 data breach. They alleged that the 49ers failed to use reasonable security measures, including encryption or redaction, and that plaintiffs incurred costs related to addressing the breach and monitoring for identity theft and other misuse.

The complaint asserted claims for negligence, breach of implied contract, and violations of the California Consumer Records Act, California Unfair Competition Law, California Consumer Privacy Act, and Georgia Uniform Deceptive Trade Practices Act. The 49ers moved to dismiss under Federal Rules of Civil Procedure 12(b)(1), which concerns subject-matter jurisdiction, and 12(b)(6), which concerns whether a complaint states a legally sufficient claim.

Standing

The court rejected the 49ers’ challenge to standing. Standing is the requirement that a plaintiff show a concrete injury, a connection between that injury and the defendant’s conduct, and a likelihood that a court decision can remedy the injury. The court held that plaintiffs sufficiently alleged that hackers obtained their Social Security numbers and that they faced costs related to preventing, detecting, and recovering from identity theft, tax fraud, or unauthorized use of their information. Plaintiffs also adequately alleged that their injuries were connected to the 49ers’ alleged failure to protect their information.

Negligence

The court held that plaintiffs alleged enough facts to proceed with a negligence claim. Plaintiffs alleged that the 49ers had a duty to use reasonable care in protecting the information, failed to use reasonable safeguards, and caused plaintiffs to incur costs.

The court deferred the 49ers’ argument that the economic-loss rule bars the negligence claim. That rule can restrict recovery in tort for purely economic losses when the alleged losses are not connected to personal injury or a special relationship. The court concluded that the issue was better addressed on a fully developed record because the complaint also referred to noneconomic injuries.

With plaintiffs’ agreement, the court dismissed negligence per se as a freestanding claim with prejudice.

Unfair Competition Law

The court declined to dismiss the Unfair Competition Law claim on the record presented. It said the parties’ arguments were cursory and that the 49ers had raised an additional argument about one plaintiff’s ability to bring the claim for the first time in a reply brief. The court stated that the 49ers could challenge the claim on summary judgment, a later stage at which the court evaluates the evidence rather than only the complaint’s allegations.

Implied Contract

The court held that plaintiffs plausibly alleged an implied contract. An implied contract is an agreement shown by the parties’ conduct rather than by an express written or spoken agreement. Plaintiffs alleged that they were required to disclose their information to the 49ers, that disclosure benefited the 49ers, and that the parties understood the 49ers would reasonably protect the information.

California Consumer Records Act

The court allowed the California Consumer Records Act claim to proceed. The complaint alleged that the 49ers knew of the breach in February 2022 but waited approximately six months to disclose it. It also alleged that the 49ers knew the breach involved plaintiffs’ unencrypted personal information and waited approximately three months to notify them, which plaintiffs said was unreasonable and prevented them from taking protective measures.

California Consumer Privacy Act

The court declined to dismiss the California Consumer Privacy Act claim. It found that the complaint contained specific allegations about the 49ers’ security practices, including the alleged failure to encrypt or redact sensitive information.

The court did not decide whether plaintiffs could recover statutory damages. The California Consumer Privacy Act requires a plaintiff to provide notice and an opportunity to cure before filing an action. Materials outside the complaint suggested that plaintiffs mailed the required notice after filing the lawsuit, but the court declined to resolve those factual issues at the pleading stage. The court directed the parties to discuss the mailing date and whether it affects statutory damages.

Georgia Uniform Deceptive Trade Practices Act

The court dismissed the Georgia Uniform Deceptive Trade Practices Act claim with leave to amend. The complaint did not identify which representations by the 49ers were allegedly deceptive. Plaintiffs could file a second amended complaint addressing that claim by August 30, 2024. The court stated that no new claims or parties could be added without prior permission. Failure to comply with the order or deadline would result in dismissal of the Georgia claim with prejudice under Federal Rule of Civil Procedure 41(b).

Disposition and Classification

The court allowed most claims to proceed at the pleading stage, dismissed negligence per se as a freestanding claim with prejudice, and dismissed the Georgia Uniform Deceptive Trade Practices Act claim with leave to amend. Because this was a partial ruling on a motion to dismiss that addressed whether claims were adequately pleaded, rather than a final decision on the underlying liability questions, this opinion is classified as a procedural order.