Thomas v. Kimpton Hotel & Restaurant Group, LLC

Background

Plaintiffs Jake Thomas, Salvatore Galati, and Jonathan Martin sued Kimpton Hotel & Restaurant Group, LLC. They alleged that Kimpton owns or manages hotels and contracted with Sabre Corporation to provide a reservation service. Through Sabre, plaintiffs made reservations at Kimpton hotels and provided personal identifying information, including names, payment-card numbers, expiration dates, verification codes, email addresses, phone numbers, and addresses.

Plaintiffs alleged that an unauthorized third party obtained Sabre credentials, accessed their information, and misused it. Their First Amended Complaint asserted eight causes of action under various state laws.

Earlier Proceedings

The court had previously dismissed the claims in the initial complaint and allowed plaintiffs to amend. That earlier order identified unsupported allegations concerning the failure to use appropriate safeguards to protect plaintiffs’ information. It also dismissed certain claims on additional grounds, including a claim under an Arizona statute as time-barred, a California statutory claim to the extent it was brought for a plaintiff who did not reside in California, and fraud claims for failing to plead fraud with sufficient specificity.

Issues in the Motion

In the First Amended Complaint, plaintiffs added allegations that Sabre used only a single username and static password rather than multiple levels of authentication. They also alleged that Sabre should have used a multilayered security system capable of identifying unusual patterns of file access, network traffic, or user behavior.

Kimpton argued that the amended allegations still did not show that Kimpton could be held responsible for Sabre’s acts or omissions. Plaintiffs responded that Sabre was acting as Kimpton’s agent.

Court’s Analysis

The court explained that a principal may be held vicariously liable for an agent’s tortious act when the principal personally engaged in no misconduct, but an agency relationship requires facts showing that the alleged principal had the right to control the alleged agent’s actions. The court found that the First Amended Complaint did not allege facts showing that Kimpton had the right to control Sabre. It also did not allege facts showing that Sabre’s decisions about safeguards occurred within the course and scope of an agency relationship with Kimpton.

The court rejected plaintiffs’ reliance on an older decision stating that agency or vicarious-liability allegations were not required. The court explained that the older decision predated the later pleading standard requiring factual content supporting a reasonable inference of liability.

The court separately addressed allegations that Kimpton made fraudulent statements. It found that those claims lacked evidentiary facts supporting an inference that Kimpton knew the challenged statements were false when made. For the statement identified in paragraph 26 of the First Amended Complaint, the court also found that plaintiffs had not alleged facts showing that any plaintiff knew of the statement when making a hotel reservation and relied on it to that plaintiff’s detriment.

Disposition

The court granted Kimpton’s motion to dismiss. It dismissed the First Amended Complaint with leave to amend to address the identified deficiencies, including the agency allegations and the fraud allegations. Plaintiffs could file a Second Amended Complaint within 45 days after the date of the order, and Kimpton’s response would be due within 30 days after that filing. The court also vacated the hearing scheduled for November 8, 2019.