Judge Keri G. Katz, Case 37-2022-00051960-CL-NP-CTL 2023-12-15 Tentative Ruling

Judge: Keri G. Katz, Case: 37-2022-00051960-CL-NP-CTL, Date: 2023-12-15 Tentative Ruling

SUPERIOR COURT OF CALIFORNIA,

DEPT.:

EVENT DATE:

EVENT TIME:

HALL OF JUSTICE

TENTATIVE RULINGS - December 07, 2023

12/08/2023 08:30:00 AM C-74 COUNTY OF SAN DIEGO

JUDICIAL OFFICER:Keri Katz

CASE NO.:

CASE CATEGORY:

EVENT TYPE:

CASE TITLE: CASE TYPE:

Civil - Limited Non-PI/PD/WD tort - Other Demurrer / Motion to Strike 37-2022-00051960-CL-NP-CTL ELLIOTT VS STATE OF CALIFORNIA [IMAGED] CAUSAL DOCUMENT/DATE FILED:

Defendant State of California/California Department of Corrections' demurrer to Plaintiff's first amended complaint is SUSTAINED WITHOUT LEAVE TO AMEND as to all causes of action demurred to by the State.

Violation of Customer Records Act Violation of Consumer Privacy Act The State's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND.

CC § 1798.81.5 sets forth the purpose of the Customer Records Act.

(a)(1) It is the intent of the Legislature to ensure that personal information about California residents is protected. To that end, the purpose of this section is to encourage businesses that own, license, or maintain personal information about Californians to provide reasonable security for that information.

. . . .

(b) A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

(c) A business that discloses personal information about a California resident pursuant to a contract with a nonaffiliated third party that is not subject to subdivision (b) shall require by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.

. . . .

Under CC § 1798.80 (a) 'Business' means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, including a financial institution Calendar No.: Event ID: TENTATIVE RULINGS

2990260 7 CASE NUMBER: CASE TITLE: ELLIOTT VS STATE OF CALIFORNIA [IMAGED] 37-2022-00051960-CL-NP-CTL organized, chartered, or holding a license or authorization certificate under the law of this state, any other state, the United States, or of any other country, or the parent or the subsidiary of a financial institution. The term includes an entity that disposes of records.

. . . .

(c) 'Customer' means an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.

The first amended complaint alleges: 3. Defendant STATE OF CALIFORNIA ('Defendant') at all times relevant was a entity doing business as a provider of health care in California, operating from an address at 1515 S Street, Sacramento, CA 95811. Defendant is a 'provider of health care' as defined by the CMIA, California Civil Code §56.05(m). Defendant is a 'business' as defined by CRA, California Civil Code §1798.80(a) and CPA, California Civil Code §1798.140(c).

However, pursuant to Government Code § 811.2 the State is a 'public entity.' A public entity is not included in the definition of a 'business' in the CRA. The Consumer Privacy Act also only applies to businesses. As with the definition of business under the CRA, the definition of business under the CPA [§ 1798.140(d)] does not include public entities. Plaintiff fails to provide any authority applying the CRA or the CPA to a public entity. Absent such authority, the court declines to extend liability under the CRA and CPA to public entities. The court finds the first amended complaint fails to allege facts sufficient to support a finding that the State is a 'business' as defined in the CRA and CPA.

Also, and specific to the CRA, as pled, the first amended complaint fails to allege facts sufficient to support a finding that Plaintiff provided personal information to the State 'for the purpose of purchasing or leasing a product or obtaining a service' from the State. Absent such allegations the court finds the first amended complaint fails to allege facts sufficient to support a finding that Plaintiff is a 'consumer' as defined in the CRA.

Although Plaintiff seeks leave to amend, Plaintiff fails to proffer any facts to cure these pleading deficiencies. Therefore, the court finds Plaintiff fails to demonstrate a reasonable probability the first amended complaint can be amended to plead a basis for liability against the State under these causes of action. Accordingly, Defendant State of California's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND. Doe v. United States Youth Soccer Assn., Inc. (2017) 8 Cal.App.5th 1118, 1143 citing Titus v. Canyon Lake Property Owners Assn. (2004) 118 Cal.App.4th 906, 917. See also, Goodman v. Kennedy (1976) 18 Cal.3d 335, 349; Ruinello v. Murray (1951) 36 Cal.2d 687, 690.

Violation of Confidentiality of Medical Information Act The State's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND.

The court finds the analysis in Eastburn v. Regional Fire Protection Authority (2003) 31 Cal.4th 1175 applicable.

We think that Ma erred in concluding that Civil Code section 1714, and the common law principles it codified, were alone sufficient bases for imposing direct tort liability on a public entity. As previously noted, '[a] public entity is not liable for an injury,' '[e]xcept as otherwise provided by statute.' (Gov.Code, § 815.) In other words, direct tort liability of public entities must be based on a specific statute declaring them to be liable, or at least creating some specific duty of care, and not on the general tort provisions of Civil Code section 1714. Otherwise, the general rule of immunity for public entities would be largely eroded by the routine application of general tort principles. (See, e.g., Zelig, supra, 27 Cal.4th at pp.

1131–1132, 119 Cal.Rptr.2d 709, 45 P.3d 1171; Hoff v. Vacaville Unified School Dist. (1998) 19 Cal.4th Calendar No.: Event ID: TENTATIVE RULINGS

2990260 7 CASE NUMBER: CASE TITLE: ELLIOTT VS STATE OF CALIFORNIA [IMAGED] 37-2022-00051960-CL-NP-CTL 925, 932, 80 Cal.Rptr.2d 811, 968 P.2d 522, and cases cited.) As Zelig observed, quoting from an earlier case, ' ' 'the intent of the [Tort Claims Act] is not to expand the rights of plaintiffs in suits against governmental entities, but to confine potential governmental liability to rigidly delineated circumstances....' ' ' (Zelig, supra, at p. 1127, 119 Cal.Rptr.2d 709, 45 P.3d 1171.) Eastburn, 31 Cal.4th at 1183.

In opposition Plaintiff fails to set forth any provision of the Confidentiality of Medical Information Act specifically declaring the State to be liable under the CMIA or imposing a specific duty on State under the CMIA. The court is not persuaded by the arguments Plaintiff raises in opposition. Allegations that the State is 'a provider of health care' or that the State 'maintains medical information' or that the State 'negligently released confidential information' are insufficient under the analysis of Eastburn. Plaintiff's argument that the CMIA does not exclude public entities ignores the principles of sovereign immunity as stated in Eastburn – ' '[a] public entity is not liable for an injury,' '[e]xcept as otherwise provided by statute.' ' Eastburn, 31 Cal.4th at 1179 citing Government Code § 815(a).

Although Plaintiff seeks leave to amend, Plaintiff fails to proffer any facts to cure this pleading deficiency.

Therefore, the court finds Plaintiff fails to demonstrate a reasonable probability the first amended complaint can be amended to plead a basis for liability against the State under this cause of action.

Accordingly, Defendant State of California's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND.

Doe v. United States Youth Soccer Assn., Inc. (2017) 8 Cal.App.5th 1118, 1143 citing Titus v. Canyon Lake Property Owners Assn. (2004) 118 Cal.App.4th 906, 917. See also, Goodman v. Kennedy (1976) 18 Cal.3d 335, 349; Ruinello v. Murray (1951) 36 Cal.2d 687, 690.

Negligence The State's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND.

Under the Government Claims Act (Gov.Code, § 810 et seq.), there is no common law tort liability for public entities in California; instead, such liability must be based on statute. (Gov.Code, § 815, subd. (a) ['Except as otherwise provided by statute: [¶] A public entity is not liable for an injury, whether such injury arises out of an act or omission of the public entity....']; Miklosy v. Regents of University of California (2008) 44 Cal.4th 876, 899, 80 Cal.Rptr.3d 690, 188 P.3d 629; see Williams v. Horvath (1976) 16 Cal.3d 834, 838, 129 Cal.Rptr. 453, 548 P.2d 1125 ['intent of the act is not to expand the rights of plaintiffs in suits against governmental entities, but to confine potential governmental liability to rigidly delineated circumstances'].) Guzman v. County of Monterey (2009) 46 Cal.4th 887, 897.

Thus, to the extent Plaintiff seeks to pursue a common law negligence claim, such claim is barred by sovereign immunity.

To the extent Plaintiff seeks to pursue a statutory theory of liability, such claim is barred by the economic loss rule. The first amended complaint alleges: 8. As a result of Defendant's negligence, Plaintiff's personal and medical identifying information is exposed to criminals for the remainder of Plaintiff's life. This information may possibly be used to open accounts, take out loans, and/or obtain other goods and services in Plaintiff's name. It can also possibly be used to access Plaintiff's accounts and/or other sensitive data. Plaintiff has had unauthorized access on some of his personal accounts after the Data Breach occurred. In addition, Plaintiff has received excessive spam phone calls and phishing emails after the Data Breach occurred.

9. Plaintiff suffered emotional distress as a result of Defendant's exposure of his personal and medical information and faces the prospect of identity thieves wrongfully using his personal information in the Calendar No.: Event ID: TENTATIVE RULINGS

2990260 7 CASE NUMBER: CASE TITLE: ELLIOTT VS STATE OF CALIFORNIA [IMAGED] 37-2022-00051960-CL-NP-CTL future.

10. As a result of Defendant's actions, Plaintiff further suffered emotional distress, embarrassment, and anxiety. Plaintiff has suffered (and will continue to suffer) economic damages and other injury and actual harm in the form of, inter alia, an imminent, immediate and continuing increased risk of identity theft, identify fraud, and medical fraud - risks justifying expenditures for protective and remedial services, breach of the confidentiality of their personal, medical, and financial information, deprivation of the value of their personal, medical, and financial information, for which there is a well-established national and international market, and the financial and temporal cost of monitoring his credit, monitoring his financial accounts and mitigating his damages.

As in Moore v. Centrelake Medical Group, Inc. (2022) 83 Cal.App.5th 515, also a data breach case, the court finds such allegations insufficient to establish non-economic damages. Faced with allegations similar to those above, Moore explains, [w]e reject appellants' contention that their asserted lost-time damages are non-economic losses and therefore exempt from the economic loss rule. Appellants' complaint alleged they suffered '[a]scertainable losses in the form of ... the value of their time,' implicitly referring to their time's financial value. Appellants do not claim these financial losses were accompanied by any personal injury or property damage. Accordingly, appellants fail to show the trial court erred in concluding these losses were economic. (See Sheen, supra, 12 Cal.5th at 915, 922, 290 Cal.Rptr.3d 834, 505 P.3d 625; Castillo v. Seagate Technology, LLC, supra, 2016 WL 9280242, *2, *–––– – *––––, 2016 U.S. Dist. LEXIS 187428, *5, *17-*20 [concluding plaintiffs' expenditures of 'considerable time and effort' were economic losses]; Dugas, supra, 2016 WL 6523428, at *–––– – *––––, 2016 U.S. Dist. LEXIS 152838, at *36-*37 [concluding plaintiff's 'time spent and loss of productivity' were economic losses].) Moore, 83 Cal.App.5th at 536.

As Moore is a California case, the court is not persuaded by the federal authorities Plaintiff relies on holding to the contrary in other data breach cases. Nor is the court persuaded by Plaintiff's reliance on Memphis Community School Dist. v. Stachura (1986) 477 U.S. 299 and Walnut Creek Manor v. Fair Employment & Housing Com. (1991) 54 Cal.3d 245 as neither discusses the economic loss rule.

Plaintiff also raises the special relationship exception to the economic loss rule. 'The primary exception to the general rule of no-recovery for negligently inflicted purely economic losses is where the plaintiff and the defendant have a 'special relationship.' (J'Aire, supra, 24 Cal.3d at p. 804, 157 Cal.Rptr. 407, 598 P.2d 60.)' Southern California Gas Leak Cases (2019) 7 Cal.5th 391, 400. The court considers the analysis in both J'Aire and Southern California Gas Leak Cases, and in particular, that '[d]eciding whether to impose a duty of care turns on a careful consideration of the 'the sum total' of the policy considerations at play, not a mere tallying of some finite, one-size-fits-all set of factors' and that '[i]n requiring more than mere foreseeability for imposing a duty of care in Bily, we appreciated the need to safeguard the efficacy of tort law by setting meaningful limits on liability.' Southern California Gas Leak Cases, 7 Cal.5th at 401 citing Bily, 3 Cal.4th at 397, quoting Dillon v. Legg (1968) 68 Cal.2d 728, 734 and Bily, 3 Cal.4th at 398-399. Considering that the policies underlying sovereign immunity are intended to limit suits against governmental entities, and also considering the Biakanja/Bily factors, [Biakanja v. Irving (1958) 49 Cal.2d 647] the court finds the first amended complaint fails to allege facts sufficient to establish duty owing from the State to Plaintiff so as to establish a special relationship between Plaintiff and the State. Absent a special relationship, Plaintiff's statutory-based negligence claims are barred by the economic loss rule.

Although Plaintiff seeks leave to amend, Plaintiff fails to proffer any facts to cure this pleading deficiency.

Accordingly, Defendant State of California's demurrer is SUSTAINED WITHOUT LEAVE TO AMEND.

Doe v. United States Youth Soccer Assn., Inc. (2017) 8 Cal.App.5th 1118, 1143 citing Titus v. Canyon Calendar No.: Event ID: TENTATIVE RULINGS

2990260 7 CASE NUMBER: CASE TITLE: ELLIOTT VS STATE OF CALIFORNIA [IMAGED] 37-2022-00051960-CL-NP-CTL Lake Property Owners Assn. (2004) 118 Cal.App.4th 906, 917. See also, Goodman v. Kennedy (1976) 18 Cal.3d 335, 349; Ruinello v. Murray (1951) 36 Cal.2d 687, 690.

If this tentative ruling is confirmed the Minute Order will be the final order of the court and the parties shall not submit any further order on this motion.

Calendar No.: Event ID: TENTATIVE RULINGS

2990260 7