ISP providers and a California-based company developed an internet activity inception device that monitored ISP subscriber’s internet usage.
The device collected websites visited and search term history.
The data was then transmitted to the Defendant in Redwood City, California for analysis to develop targeted marketing to the ISP subscribers. Valentine v. Nebuad, Inc., 2009 U.S. Dist. LEXIS 93454 (N.D. Cal. Oct. 6, 2009).
The ISP subscribers were not pleased when they learned their internet usage was being monitored and sold for targeted marketing. They sued in the Northern District of California, claiming the Defendants violated the Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2510 et seq.; California’s Computer Crime Law, Cal. Pen. Code § 502; the Federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030; and California’s Invasion of Privacy Act, Cal. Pen. Code § 630 et seq. Valentine, at *6.
None of the Plaintiffs were from California. Other than the Defendant who developed the collection device (who went into liquidation by the time of the litigation), none of the other ISP Defendants were based in California. In short, no one in California had their data collected.
The Defendants moved to dismiss the case based on a lack of personal jurisdiction.
Personal Jurisdiction Analysis
The Plaintiffs needed to show there was specific jurisdiction over the Defendants in order for the case to be heard in California. The three-part test in the Ninth Circuit for specific jurisdiction is as follows:
(1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privileges of conducting activities in the forum, thereby invoking the benefits and protections of its laws;
(2) The claim must be one which arises out of or relates to the defendant’s forum-related activities; and
(3) The exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.
Valentine., at *10-11.
The plaintiff must prove the first two prongs of the test; if the plaintiff is successful, the burden shifts to the defendant to “present a compelling case’ that the exercise of jurisdiction would not be reasonable.” Valentine, at *11.
“Purposeful availment” and “Purposeful direction”
As for the first prong, the Court applied both the “purposeful availment” and “purposeful direction” tests to determine if there were sufficient minimum contacts with California.
While the “purposeful direction” analysis did find the Defendants engaged in an intentional act, there were significant problems finding the conduct was “expressly aimed” at California due to the lack of any Californian Plaintiffs. Valentine, at *18-21.
As the Court explained:
Plaintiffs have provided no facts demonstrating harm suffered in California, and offer no meaningful “foreseeable effects” that occurred in California. Speculating that some Californians must have had their data intercepted while communicating with Plaintiffs is an inadequate basis for asserting personal jurisdiction.
Valentine, at *20-21.
“Purposeful availment” requires that a “defendant ‘have performed some type of affirmative conduct which allows or promotes the transaction of business within the forum state.'” Valentine, at *22.
The Court found that the ISP Defendants had “purposefully availed” themselves to the laws of California. Valentine, at *24.
The Court took the “highly realistic” approach and noted that the ISP Defendants provided the data to the Defendant in California, which was used in the targeted advertising to the out-of-state Plaintiffs. The profits from the advertising were split between the Defendants.
As the Court explained, the “economic reality,” was that “much of this activity occurred in California, under the protection of California’s laws, to the benefit of both NebuAd and the ISP Defendants.” Valentine, at *24, citations omitted.
Forum-Related Activities
The issue of whether the action arose out of forum-related activities was easily answered “yes.” The data was collected and then used in California, which the Plaintiffs claimed violated California law. Valentine, at *25.
Reasonableness
The Ninth Circuit has a seven factor test on whether or not exercising jurisdiction would be “reasonable”:
1) The extent of the defendant’s purposeful interjection into the forum state’s affairs; 2) The burden on the defendant;
3) Conflicts of law between the forum and defendant’s home jurisdiction;
4) The forum’s interest in adjudicating the dispute;
5) The most efficient judicial resolution of the dispute;
6) The plaintiff’s interest in convenient and effective relief; and
7) The existence of an alternative forum.
Valentine, at *25-26.
The Court held that exercising personal jurisdiction over the out-of-state Defendants was not reasonable. Valentine, at *30.
As the Court explained:
Even if NebuAd were not in the process of liquidation, it would be difficult to imagine how forcing the six out-of-state ISP Defendants to come to California to defend a lawsuit brought by out-of-state Plaintiffs could be reasonable. California and Plaintiffs both have little interest in having this dispute heard in this forum, especially given that Plaintiffs can file suit in the states where they — and the ISP Defendants — reside. Forcing the ISP Defendants to appear in California imposes a moderate burden on them, which is barely justified by whatever benefit they reaped from California law. Although hearing Plaintiffs’ claims against NebuAd and the ISP Defendants in one place may ultimately be more efficient, even that apparent advantage fades away in light of NebuAd’s dissolution, and similar economies of scale could be achieved in separate fora through multidistrict litigation. Valentine, at *29-30.
Bow Tie Thoughts
When cloud-computing services turn into lightning storms because of disputes over interstate data breaches, Courts will find themselves in a perfect storm of personal jurisdiction analysis. Cases will surface, with data hosted in one state, parties based in one and a service provider in another. The analysis will be similar to the above case. I would not be surprised if we see a case to rival Asahi Metal Industry Co. v. Superior Court, 480 U.S. 102 (1987) over “cloudy” personal jurisdiction questions in the future.
3 comments
Comments are closed.