Judge Randolph M. Hammock, Case Number: 23STCV22629, Date: 2024-01-16 Tentative Ruling

Judge: Randolph M. Hammock, Case: 23STCV22629, Date: 2024-01-16 Tentative Ruling

Plaintiff Jose Gutierrez brings this action against Defendant Bokf, NA, for violations of the California Unauthorized Access to Computer Data Act (“CUCA”). Defendant is an Oklahoma company that provides consumers access to online personal and commercial banking services. Plaintiff alleges that Defendant used spyware on its website to “dox” website visitors like Plaintiff, allowing Defendant to unlawfully obtain Plaintiff’s personal data.

“A defendant . . . may serve and file a notice of motion for one or more of the following purposes: (1) [t]o quash service of summons on the ground of lack of jurisdiction of the court over him or her . . . .” (Code Civ. Proc., § 418.10, subd. (a).) “[C]ompliance with the statutory procedures for service of process is essential to establish personal jurisdiction. [Citation.]” (Dill v. Berquist Construction Co. (1994) 24 Cal.App.4th 1426, 1444.) “[T]he filing of a proof of service creates a rebuttable presumption that the service was proper” but only if it “complies with the statutory requirements regarding such proofs.” (Id. at pp. 1441-1442.) When a defendant moves to quash service of the summons and complaint, the plaintiff has “the burden of proving the facts that did give the court jurisdiction, that is the facts requisite to an effective service.” (Coulston v. Cooper (1966) 245 Cal.App.2d 866, 868.) “A court lacks jurisdiction over a party if there has not been proper service of process.” (Ruttenberg v. Ruttenberg (1997) 53 Cal.App.4th 801, 808.)

Plaintiff Jose Gutierrez, a resident of California, is a “consumer privacy advocate” and “tester” who works “to ensure that companies abide by the privacy obligations imposed by federal law.” (FAC ¶ 4.) Defendant Bokf, NA, is an Oklahoma company that provides consumers access to online personal and commercial banking.” (Id. ¶ 5.)

Plaintiff alleges that Defendant’s website utilizes “de-anonymization” spyware from LeadFeeder to reveal the identity of visitors to the site. (Id. ¶¶ 9, 12, 14, 16.) Plaintiff alleges that by using the spyware to obtain his “name, face, location, e-mail, and browsing history,” Defendant has violated CUCA. (Id. ¶ 22.)

For a corporation, general jurisdiction exists only in the defendant’s state of incorporation or principal place of business. (Goodyear Dunlop Tires Operations, S.A. v. Brown¿(2011) 131 S.Ct. 2846, 2856-2857; Daimler AG v. Bauman¿(2014) 134 S.Ct. 746, 749-750; BNSF Ry. Co. v. Tyrrell¿(2017) 137 S.Ct. 1549, 1558.) “[C]ontacts that are random, fortuitous, or attenuated do not rise to the minimum level, and general jurisdiction cannot be exercised under these circumstances.” (F. Hoffman-La Roche, Ltd. v. Superior Ct. (2005) 130 Cal. App. 4th 782, 795.) “[I]n an ‘exceptional case,’ a corporate defendant's operations in another forum ‘may be so substantial and of such a nature as to render the corporation at home in that State.’” (BNSF Ry. Co. v. Tyrrell, supra, 137 S.Ct. at p. 1558 (citing Daimler AG v. Bauman, supra, 134 S.Ct. at p. 761 (footnote 19).)

Defendant argues the court lacks general jurisdiction over it because it does not maintain minimum contacts in California. Defendant asserts it (i) maintains its principal place of business in Oklahoma, (ii) has no branches in California, (iii) has authorized no individual or corporation to accept service or otherwise act as its corporate agent in California, (iv) maintains no offices, mailing addresses or telephone listings in California, (v) does not target California or its residents with advertising, and (vi) does not open depository accounts online for California residents. Defendant submits declarations from its “Senior Vice President and Director of Consumer Digital Originations Strategy” and “Senior Vice President and Director of Marketing Operations and Innovation” attesting to these facts. (Kent Decl.; Michuda Decl.)

Defendant has a website accessible from several domain names. (Michuda Decl. ¶ 5.) The website used the Leadfeeder spyware for a period in 2023. (Id. ¶¶ 15-19.) The Website does not allow prospective customers to purchase BOKF’s products or services; it has no chat feature (Id. ¶ 6, 7.) The Website enables prospective customers to submit applications for checking accounts other products. (Id. ¶ 8.) However, the bank does not operate in California. A prospective customer who attempts may submit applications for checking or other deposit accounts through BOKF’s website will receive the following message: “Unfortunately Bank of Oklahoma is unable to proceed with this online application. We are only able to service client deposit needs in our operating footprint of AR, AZ, CO, KS, MO, NM, OK and TX.” (Id. ¶ 9.)

The court now addresses specific jurisdiction. Defendant argues it has not “purposely availed” itself to California, that the litigation does not “arise out of” its California contacts, and that exercising jurisdiction does not comply with “traditional notions of fair play and substantial justice.”

“A nonresident defendant may be subject to the court’s specific jurisdiction if three requirements are met: (1) the defendant has purposefully availed itself of forum benefits with respect to the matter in controversy; (2) the controversy is related to or arises out of the defendant’s contact with the forum; and (3) the exercise of jurisdiction would be reasonable and comports with fair play and substantial justice.” (ViaView, Inc. v. Retzlaff (2016) 1 Cal.App.5th 198, 216 (citing Pavlovich v. Superior Court (2002) 29 Cal.4th 262, 269).) “‘The inquiry whether a forum State may assert specific jurisdiction over a nonresident defendant ‘focuses on the relationship among the defendant, the forum, and the litigation.’” (Id. (citing Walden v. Fiore (2014) 571 U.S. 277, 282-85).) “For a State to exercise jurisdiction consistent with due process, the defendant’s suit-related conduct must create a substantial connection with the forum State.” (Id.) The “’minimum contacts’ analysis looks to the defendant's contacts with the forum State itself, not the defendant's contacts with persons who reside there.” (Walden v. Fiore (2014) 571 U.S. 277, 285.)

This court notes first that Plaintiff has not presented any evidence in support of its opposition. Plaintiff carries the initial burden of establishing sufficient facts to give rise to personal jurisdiction over Defendant. The plaintiff's burden “to demonstrate by a preponderance of the evidence that all necessary jurisdictional criteria are met [citation] ... must be met by competent evidence in affidavits and authenticated documentary evidence.” (Rivelli v. Hemm (2021) 67 Cal. App. 5th 380, 402 [emphasis added].) An unverified pleading, such as the one here, has no evidentiary value in determining personal jurisdiction. (Mihlon, supra, 169 Cal. App. 3rd at 710.) This alone is sufficient reason to grant the motion. Be that as it may, the court continues with the analysis for purposes of discussion.

In support of jurisdiction, Plaintiff relies on the federal district court case of Stomp, Inc. v. NeatO, LLC, 61 F. Supp. 2d 1074, 1078 (C.D. Cal. 1999.) There, the moving defendant operated a “highly commercial” website, “a substantial portion” of which was “dedicated to allowing the consumer to purchase” the company’s products on-line. (Id. at 1078.) In finding the court could exercise personal jurisdiction over the company under the California “long arm” statute, the Court reasoned that “[b]y maintaining a commercial website through which it markets and sells its goods, [the defendant] has reached out beyond its home state of Connecticut to avail itself of the benefits of the California forum.” (Id.) The court also reasoned that the case “arose out of” the defendant’s contacts with California because the dispute was over a patent, the “technology for which is included in the products sold by NeatO over the Internet.” (Id. at 1079.) Finally, the Court found that it would not be “unreasonable” to exercise jurisdiction on these facts. (Id.)

First, the case here is distinguishable from Stomp. Unlike in Stomp, [FN 1] where the defendant had used a “highly commercial” website allowing Californians to purchase the company’s products, Bokf’s website does not sell products directly to consumers. Moreover, except in very rare cases, a person residing in California could not purchase services from Defendant even if they wanted to. Plaintiff does not dispute this point with evidence.

Despite this, the court recognizes that the alleged collection of Californian consumer data could somewhat change the analysis, especially if Defendant was to use that information for business purposes. Notably, a very recent Ninth Circuit case addressed precisely this scenario.

In Briskin v. Shopify, Inc., 87 F.4th 404, 409 (9th Cir. 2023), [FN 2] the Ninth Circuit addressed whether the California long-arm statute applied to defendants offering web-based payment processing platforms. After the plaintiff purchased an online product in California, the processers extracted and retained his consumer data. (Id.) The plaintiff then filed suit, and defendants moved to quash service for lack of personal jurisdiction. The Court held that the defendants were not subject to specific jurisdiction in California “because they did not expressly aim their suit-related conduct at the forum state.” (Id. at 409.) “When a company operates a nationally available e-commerce payment platform and is indifferent to the location of end-users,” the Court reasoned, “the extraction and retention of consumer data, without more, does not subject the defendant to specific jurisdiction in the forum where the online purchase was made.” (Id.)

Here, Defendant’s contacts to California are even sparser than those in Briskin. Plaintiff did not purchase anything from Defendant—and could not do so—because Defendant does not service customers in California. Defendant cannot be deemed to have expressly aimed its suit related conduct at California merely by having its website accessible in the state.

Thus, Defendant is not “targeting” California. Moreover, Defendant’s use of consumer data depends on the actions of third-party merchants like LeadFeeder, “who are engaged in independent transactions that themselves do not depend on consumers being present in California.” (Briskin, supra, 87 F.4th at 423.) Therefore, Plaintiff cannot establish that Defendant expressly aimed its suit-related conduct at California. This defeats specific jurisdiction over Defendant.

This court notes that Briskin was published on November 28, 2023, after Defendant filed its motion to quash. As a result, Defendant raised the case for the first time in its December 22, 2023, reply. As a general rule, courts will not consider new evidence or argument in a reply. However, a trial court may properly consider new evidence “so long as the party opposing…has notice and an opportunity to respond to the new material.” (Wall St. Network, Ltd. v. New York Times Co. (2008) 164 Cal. App. 4th 1171, 1183.) Given the applicability of the case to the instant facts, the court exercises its discretion to consider it. To the extent Plaintiff wishes to address this case, he will be afforded the opportunity to do so at the hearing.

Judge of the Superior Court

FN 1 - It should also be noted that the decision in Stomp is “over 20 years old,” and there are “more recent Ninth Circuit cases noting that ‘a plaintiff must also show that the website directly” targets the forum. (MGA Ent., Inc. v. Cabo Concepts Ltd., No. CV2010170FMOJPRX, 2021 WL 4733784, at *5 (C.D. Cal. June 7, 2021), citing Spy Optic, 843 F.Appx. at 68 (internal quotation marks omitted).)

FN 2 - The case is persuasive, but as federal authority, is not binding on this court. (People v. Bradford (1997) 15 Cal.4th 1229, 1292 [cases from federal courts of appeals are persuasive rather than binding authority on the courts of this state].)