Smith v. Sequoia Benefits and Insurance Services LLC

Background

Justice Smith moved for reconsideration of the court’s earlier order dismissing her complaint with leave to amend. The order addressed Smith’s theories under 42 U.S.C. § 1983, the federal civil-rights statute, and the Fair Credit Reporting Act (FCRA), a federal law governing consumer-reporting agencies and consumer information.

Smith argued that Sequoia and the individual defendants could be sued under § 1983 because they had obtained licenses or professional authorization from the State. She submitted documents showing that Sequoia and Golub were licensed by the California Department of Insurance and that Persson was admitted to the California Bar Association.

Court’s reasoning

The court held that state licensing, without more, was insufficient to establish state action. State action is required for a § 1983 claim against private parties. The court explained that Smith’s alleged injuries involved a data breach affecting Sequoia, Sequoia’s handling of the breach, and Persson’s communications with Smith. It characterized Sequoia as a private company, Golub as Sequoia’s chief executive officer, and Persson as Sequoia’s attorney, and found that the challenged conduct was purely private. The court stated that there was no authority supporting liability under the Constitution or § 1983 under these circumstances.

Smith also relied on a Third Circuit decision involving a data breach and the FCRA. The court explained that the cited decision addressed standing, not whether the defendant was covered by the FCRA. It agreed with the reasoning of the decisions discussed in the opinion that an insurance company was not a consumer reporting agency based on allegations that it collected information to provide insurance coverage and administer benefits. The court further stated that Smith alleged Sequoia disclosed or furnished her information when its cloud was hacked, and concluded that the FCRA did not apply here.

Ruling

Judge Susan Illston denied Smith’s motion for reconsideration. The court did not change its earlier dismissal order, which had allowed Smith to amend her complaint. It stated that Smith could file an amended complaint by April 19, 2024. The opinion also noted that Smith’s statement that no other data-protection law was available appeared incorrect because she alleged that Persson told her she might be a class member in a pending data-breach class action involving Sequoia.