Baton v. Ledger SAS

Background

Plaintiffs are customers who bought Ledger SAS hardware wallets for cryptocurrency assets. Ledger’s wallets store private keys that can authorize transfers of cryptocurrency. In 2020, hackers accessed personal identifying information in Ledger’s customer database. The complaint alleges that two TaskUs employees conspired with a California man who accessed and distributed the information.

Plaintiffs sued Ledger, Shopify, and TaskUs in a proposed class action. Shopify was Ledger’s subcontractor for website purchases, and TaskUs was Shopify’s subcontractor for customer-service operations. Shopify had previously been dismissed based on forum-selection clauses in Ledger’s customer contracts. In an earlier appeal, the Ninth Circuit held that those clauses were enforceable for most claims but did not apply to California-resident plaintiffs’ class claims under California consumer-protection law.

The third amended complaint asserted negligence, declaratory and injunctive relief, and a claim under New York’s Deceptive Trade Practices Act against TaskUs. It asserted claims under California’s Unfair Competition Law (UCL) and Consumers Legal Remedies Act (CLRA) against Ledger, including claims under the UCL’s “unfair,” “unlawful,” and “fraudulent” parts. The proposed California subclass included California residents who bought certain Ledger wallets before December 21, 2020, including people who bought from an authorized reseller.

TaskUs’s Motion

TaskUs sought dismissal based on forum non conveniens, a doctrine allowing a court to dismiss a case in favor of a more appropriate foreign forum. TaskUs argued that, although it did not sign Ledger’s contracts, it was closely connected to Ledger, Shopify, the contracts, and the alleged conduct, and therefore could enforce the contracts’ French forum-selection clauses.

The court agreed. It found that TaskUs allegedly provided an essential part of Shopify’s work for Ledger, had access to customers’ personal information, and was involved in conduct central to the alleged injury. The court concluded that TaskUs could use Ledger’s forum-selection clause as an agent, sub-agent, or third-party vendor closely connected to the contract. The court also rejected Plaintiffs’ waiver argument because TaskUs had participated in only one round of motion-to-dismiss briefing, no discovery had occurred, and the case remained at the pleading stage.

The court further found that the public-interest factors favored France. It reasoned that Ledger was a French company, the contracts selected France, Shopify had already been dismissed under the clause, and trying related claims against Shopify and TaskUs in different forums would be inefficient. The court granted TaskUs’s motion and dismissed TaskUs from the case.

Ledger’s Motion

Injunctive relief and standing

Ledger challenged Seirafi’s standing to seek prospective injunctive relief. Seirafi alleged that he would buy Ledger products again if Ledger’s products, online sales system, and support services maintained the promised level of security, including security by vendors.

The court held that this allegation was not specific enough to show a real and imminent possibility that Seirafi would buy another Ledger cryptocurrency wallet. The court emphasized that the wallet is a durable product and that the alleged problem concerned the security of customers’ personal information, not a defect in the wallet itself. The court therefore granted Ledger’s motion to dismiss the claim for injunctive relief.

CLRA and fraudulent-UCL claims

The court held that Plaintiffs adequately identified the statements and omissions in Ledger’s 2018 privacy policy for purposes of the heightened pleading standard that applies to fraud-based claims. But Plaintiffs did not allege that Seirafi actually saw or relied on that privacy policy. Because reliance was required for this misrepresentation-based theory, the court held that the CLRA claim and the UCL claim under the “fraudulent” prong failed. The court granted Ledger’s motion as to those claims.

Unfair and unlawful UCL claims

Plaintiffs also alleged that Ledger failed to implement and maintain reasonable security measures for personal information involved in the TaskUs incident. For the UCL’s “unlawful” prong, the court found that Plaintiffs adequately alleged a violation of California’s Consumer Records Act, which requires reasonable security procedures and practices for personal information.

For the “unfair” prong, the court found that Plaintiffs adequately alleged an unfair business practice under a balancing test that considers the harm to consumers and any countervailing benefits. The court therefore denied Ledger’s motion as to the “unfair” and “unlawful” UCL claims. The court also denied Ledger’s motion as to Plaintiffs’ remaining UCL claims concerning the lack of an adequate legal remedy.

Proposed California subclass

The court found that the proposed subclass remained too broad because it included people who bought Ledger wallets indirectly and might never have provided their personal information to Ledger. The alleged injury concerned personal information obtained in connection with the purchase, rather than a defect in the wallet itself. The court required Plaintiffs to redefine the class to include only people who purchased Ledger’s wallet directly from Ledger.

Disposition

The court granted TaskUs’s motion and granted in part and denied in part Ledger’s motion. The court stated that Plaintiffs’ third cause of action under the UCL’s “unfair” and “unlawful” prongs was the only claim remaining against Ledger. Plaintiffs received leave solely to modify the class definition and had 30 days from the order’s date to file an amended complaint. The order further states that inadequately pleaded claims are dismissed with prejudice.