Caces-Tiamson v. Equifax

Background

Maria Asela Caces-Tiamson, representing herself, sued Equifax in connection with the data breach that Equifax announced in September 2017. In November 2019, she sent Equifax a letter asking it to provide proof on several issues, including whether it had announced the breach, intentionally covered it up, protected her personal data, and was liable for damages. She stated that Equifax’s failure to respond would constitute agreement with her terms. After Equifax apparently did not respond, she filed suit in January 2020.

The complaint stated that Caces-Tiamson had given Equifax an opportunity to provide proof of claim and had sent a notice of fault and opportunity to cure. It characterized Equifax’s silence as an admission of the facts in her notice of default and asserted that she therefore had a superior claim for relief. The opinion described the complaint as unclear.

Personal Jurisdiction

Equifax moved to dismiss under Federal Rule of Civil Procedure 12(b)(2) for lack of personal jurisdiction, meaning that the court lacked authority to exercise power over Equifax in this case. The court explained that Caces-Tiamson had to make at least a preliminary showing that jurisdiction was proper. Because the case was in California, the court applied California’s jurisdictional law, which the opinion said reaches the same result as federal due-process principles.

The court considered general jurisdiction first. General jurisdiction allows a defendant to be sued in the forum for any claim and ordinarily requires a corporation to be essentially at home there. The court found that Caces-Tiamson had not made that showing. Equifax is a Georgia corporation with its principal place of business in Georgia. Evidence about two alleged California offices did not establish the continuous and systematic California affiliations required for general jurisdiction. Equifax also submitted evidence that it had never maintained a site in Escalon and that its Concord operations site had closed in the second quarter of 2018.

The court then considered specific jurisdiction, which requires a connection between the defendant’s forum-related conduct and the claim. The court explained that the analysis depends on the nature of the claim. If Caces-Tiamson was asserting a tort claim based on Equifax’s failure to prevent the breach, the relevant security actions or omissions would presumably have occurred in Georgia. Her injury in California, where she resides, was not enough by itself. Nor was Equifax’s provision of services to customers nationwide, including in California, enough without additional conduct purposefully directed toward California.

Caces-Tiamson also argued that the breach was connected to California because Equifax allegedly had two California offices whose computer systems were networked with the company’s Georgia headquarters. The court found that she had not shown that the breach or the failure to prevent it was specifically tied to those offices. The court likewise found no indication that Equifax’s failure to respond to her notice occurred in California rather than Georgia. It concluded that she had not made a sufficient showing of specific jurisdiction.

Disposition

The court granted Equifax’s motion to dismiss based on lack of personal jurisdiction. Because it granted the motion on that ground, it did not address Equifax’s separate argument that the complaint failed to state a claim for relief. The Clerk was directed to close the file, and the order disposed of Docket No. 7.