Thomas v. Kimpton Hotel & Restaurant Group, LLC

Background

Jake Thomas, Salvatore Galati, and Jonathan Martin alleged that they booked rooms at Kimpton hotels and provided personal identifying information through Sabre Corporation’s online reservation system. The information allegedly included names, payment-card numbers, expiration dates, card-verification codes, email addresses, telephone numbers, and physical addresses. According to the Third Amended Complaint, hackers obtained credentials for Sabre’s Central Reservations system and used them to access customer data. Plaintiffs alleged the breach would not have occurred if Sabre had used multiple levels of authentication rather than single-factor authorization.

Plaintiffs asserted nine claims under various state laws. Kimpton moved under Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not state a legally sufficient claim. Kimpton argued that the Third Amended Complaint still did not adequately allege that Kimpton could be held responsible for Sabre’s conduct and raised additional challenges to seven claims.

Agency relationship

The court rejected Kimpton’s argument that the complaint lacked facts supporting an agency relationship. An agency relationship can exist when one entity has authority to act for another and the other entity has the right to control the agent’s actions. Plaintiffs alleged that Sabre operated Kimpton’s online reservation system under an agreement, accepted reservations for Kimpton, and was subject to Kimpton’s control over room prices, room availability, Sabre’s presentation on Kimpton’s website, and the way customer information would be safeguarded. The court held that these allegations were sufficient to plead an agency relationship between Kimpton and Sabre.

Claims dismissed

The court dismissed the Second Claim for Relief, alleging breach of the agreement between Sabre and Kimpton. The claim had not been included in the First Amended Complaint, and the court concluded that plaintiffs had improperly added it. The court also found the claim futile because the complaint did not allege facts showing that Kimpton’s customers were intended third-party beneficiaries of the Sabre-Kimpton contract or that the contract required Kimpton to require multi-factor authentication or comply with the asserted payment-card security standards.

The court dismissed the Fourth Claim for Relief under California’s Unfair Competition Law. Plaintiffs sought injunctive relief and restitution. The court held that plaintiffs did not allege facts showing a real or immediate threat of another breach, so they had not shown standing for an injunction. It also held that plaintiffs did not allege that the hotel rooms were inadequate, that part of the room price was attributable to data security, or another basis for recovering the value they allegedly paid.

The court dismissed the Fifth Claim for Relief under the Colorado Consumer Protection Act. Thomas was alleged to be an Arizona resident, and the complaint did not allege that he made a reservation while in Colorado, that Kimpton or Sabre was a Colorado resident or acted in Colorado to induce the reservation, or that Sabre’s reservation system was located there. The court found that the allegation that Thomas stayed at a Kimpton hotel in Colorado did not establish a legally sufficient connection between Colorado and the alleged harm.

The court dismissed the Sixth Claim for Relief under Pennsylvania’s Unfair Trade Practices and Consumer Protection Law for similar reasons. The complaint did not allege that Thomas made a reservation while in Pennsylvania, that Kimpton or Sabre was a Pennsylvania resident or acted there to induce the reservation, or that Sabre’s reservation system was located there. Thomas’s stay at a Kimpton hotel in Pennsylvania did not, by itself, establish the required connection.

The court dismissed the Seventh Claim for Relief under New York General Business Law § 349. Under either of the territorial approaches discussed by the court, plaintiffs had not alleged that Thomas was deceived in New York or that the alleged deceptive acts occurred there. The location of a hotel where Thomas stayed did not establish a legally sufficient relationship between New York and the alleged harm.

The court dismissed the Ninth Claim for Relief under the Maryland Consumer Protection Act. The complaint did not allege that Martin made a reservation while in Maryland, that Kimpton or Sabre was a Maryland resident or acted in Maryland to induce the reservation, or that Sabre’s reservation system was located there. The court also found no legally sufficient connection between Martin’s stay at a Kimpton hotel in Maryland and the alleged harm.

Texas claim and remaining claims

The Eighth Claim for Relief under the Texas Deceptive Trade Practices–Consumer Protection Act was dismissed to the extent it was asserted on behalf of Thomas. The complaint did not allege that Thomas made a reservation while in Texas, that Kimpton or Sabre was a Texas resident or acted in Texas to induce the reservation, or that Sabre’s reservation system was located in Texas.

The court also dismissed the Eighth Claim to the extent it was asserted on behalf of Martin and based on Kimpton’s allegedly false statements about information security. The complaint identified statements such as “Your card is safe” and representations that customer information was protected, but it did not allege sufficient facts showing that Kimpton knew the statements were false, or recklessly made them, when they were made.

Disposition

The court ordered that the motion to dismiss was granted in part and denied in part. The Second, Fourth, Fifth, Sixth, Seventh, and Ninth Claims for Relief were dismissed. The Eighth Claim was dismissed to the extent it was brought on behalf of Thomas and to the extent it was brought on behalf of Martin and based on Kimpton’s false statements. In all other respects, the motion was denied.

The court allowed plaintiffs to file a Fourth Amended Complaint to address the identified deficiencies by July 17, 2020. If they did not amend, the case would proceed on the First Claim, the Third Claim, and the remaining portion of the Eighth Claim. Judge Maxine M. Chesney also continued the case-management conference to August 21, 2020.