Judge Bruce G. Iwasaki, Case Number: 23STCV19689, Date: 2024-04-17 Tentative Ruling

Tentative Ruling: The Demurrer to the Cross-Complaint is sustained. The Motion to strike is moot.

This case arises from an employment discrimination suit. Plaintiff Kate Richardson (Plaintiffs) filed suit against her employer, Defendant Wear it to Heart, Inc. for (1.) Wrongful Termination in Violation of Public Policy, (2.) Sexual Harassment in Violation of FEHA – Hostile Work Environment (Cal. Govt. Code § 12940(j)), (3.) Failure to Prevent Discrimination, Retaliation, and/or Harassment in Violation of FEHA (Cal. Govt. Code § 12940(k)), (4.) Labor Code Section 98.6, (5.) Retaliation in Violation of the FEHA (Cal. Govt. Code § 12940(h)), and (6.) Failure To Pay Timely Wages During Employment (Cal. Lab. Code § 204).

On December 14, 2023, Defendant/Cross-Complainant Wear it to Heart, Inc. filed a Cross-Complaint against Cross-Defendant Kate Richardson, alleging a single cause of action for a violation of Penal Code section 502.

Cross-Defendant Kate Richardson demurred to the Cross-Complaint. Cross-Defendant also moved to strike allegations in the Cross-Complaint. Cross-Complainant opposes the demurrer and the motion to strike.

The demurrer to the Cross-Complaint is sustained with leave to amend. The Motion to strike is moot.

A demurrer is an objection to a pleading, the grounds for which are apparent from either the face of the complaint or a matter of which the court may take judicial notice. (Code Civ. Proc., § 430.30, subd. (a); see also Blank v. Kirwan (1985) 39 Cal.3d 311, 318.) The purpose of a demurrer is to challenge the sufficiency of a pleading “by raising questions of law.” (Postley v. Harvey (1984) 153 Cal.App.3d 280, 286.) “In the construction of a pleading, for the purpose of determining its effect, its allegations must be liberally construed, with a view to substantial justice between the parties.” (Code Civ. Proc., § 452.) The court “ ‘ “treat[s] the demurrer as admitting all material facts properly pleaded, but not contentions, deductions or conclusions of fact or law . . ..” ’ ” (Berkley v. Dowds (2007) 152 Cal.App.4th 518, 525.)

Cross-Defendant argues that the first cause of action for a violation of Comprehensive Computer Data Access and Fraud Act (CDAFA) fails to state a claim because no individualized harm, and no unauthorized conduct, were alleged.

To bring a private civil cause of action under section 502, which is otherwise a criminal statute, CDAFA creates a private cause of action against any person who “[k]nowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or take or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.” (Pen. Code, § 502(c)(2) & (e)(1).) The CDAFA defines “access” to mean “cause output from” the “logical, arithmetical, or memory function resources of a computer.” (Pen. Code, § 502(b)(1).) Furthermore, the statute requires that such access be “without permission.” (Pen. Code, § 502(c)(1)–(2).)

Further, the plaintiff must plead that the plaintiff “suffer[ed] damage or loss” due to the criminal violation. (Pen. Code, § 502(e).)

In Heiting v. Taro Pharmaceuticals USA, Inc. (C.D. Cal., Dec. 26, 2023, No. 2:23-CV-08002-SPG-E) 2023 WL 9319049, the court considered whether the loss of some of data qualifies as a “damage or loss” under the statute. The Heiting Court explained that the “majority of courts” have found that “alleged privacy invasions do not qualify under the statute.” (Id. at *7; Cottle v. Plaid Inc. (N.D. Cal. 2021) 536 F. Supp. 3d 461, 488 [finding damage or loss under CDAFA did not include “loss of the right to control [Plaintiffs'] own data, the loss of the value of their data, and the loss of the right to protection of the data”].)[1]

Here, the Cross-Complaint alleges that, on October 25, 2022, Cross-Defendant Richardson knowingly accessed and without permission took or copied data from a computer, computer system and computer network belonging to Cross-Complainant; this data included Cross- Complainant’s valuable customers and potential customers contact information. (XC ¶ 15.)

The Cross-Complaint alleges only the misappropriation of certain information. Thus, the Cross-Complaint does not allege an adequate economic injury to support a violation of Penal Code section 502.

Cross-Defendant also argues that the Cross-Complaint fails to allege any “unauthorized” access.

While the term “without permission” is not defined within the language of the statute, courts have found that “[a] party acts ‘without permission’ under the CDAFA when it ‘circumvents technical or code-based barriers in place to restrict or bar a user's access.’” (Williams v. Facebook, Inc. (N.D. Cal. 2018) 384 F.Supp.3d 1043, 1053; Facebook, Inc. v. Power Ventures, Inc. (N.D. Cal., July 20, 2010, No. C 08-05780 JW) 2010 WL 3291750, at *11; In re iPhone Application Litig. (N.D. Cal., Sept. 20, 2011, No. 11-MD-02250-LHK) 2011 WL 4403963, at *12.)

Here, the pleadings indicate that Cross-Defendant Richardson was employed by Cross-Complainant at the time she “took or copied” the data. (XC ¶ 15.) There is no allegation that Cross-Defendant Richardson “circumvent[ed] technical or code-based barriers” to access this information. Thus, the claim fails for this additional reason, as well.

The demurrer papers also request “that Paragraphs 7-11 of the Cross Complaint be stricken.” (Dem., 7:2-3.)

In opposition, Cross-Complainant argues that Cross-Defendant Richardson failed to comply with California Rules of Court, Rule 3.1322, subdivision (b).

California Rules of Court, Rule 3.1322, subdivision (b) only requires that, if a defendant attacks a complaint with a demurrer and motion to strike, both matters must be heard at the same time. (Cal. Rules of Court, rule 3.1322, subd. (b).) Although it is better practice to file a demurrer and a motion to strike separately (Weil & Brown, Motions to Strike, Cal. Prac. Guide Civ. Pro. Before Trial Ch. 7(I)-B [7:162:1]), there is no express rule prohibiting a defendant from combining a demurrer and motion to strike in one document, as was done here.

In any case, the motion to strike portions of the Cross-Complaint has been rendered moot by the ruling on the demurrer.

The demurrer to the Cross-Complaint is sustained. The motion to strike is moot. Cross-Complainant shall have leave to amend. The amended Cross-Complaint shall be filed and served on or before May 17, 2024.

[1] “One court has rejected this view and found that plaintiffs may allege damage or loss under the CDAFA by alleging a loss in value of misappropriated data.” See Brown, 2023 WL 5029899, at *19–20 (finding economic injury could be sustained by loss in control over data).” (Heiting v. Taro Pharmaceuticals USA, Inc. (C.D. Cal., Dec. 26, 2023, No. 2:23-CV-08002-SPG-E) 2023 WL 9319049, at *7.)