“mere untargeted negligence” does not support personal 7 jurisdiction
How later courts described this case
- “mere untargeted negligence” does not support personal 7 jurisdiction
Written by the judges who cited it.
The opinion
1
2
3
4
5
6
7
8 UNITED STATES DISTRICT COURT
9 SOUTHERN DISTRICT OF CALIFORNIA
10
11 GERALD S. LEE, individually and on Case No.: 21cv1144-LL-MSB
behalf of all others similarly situated
12
and on behalf of the general public, ORDER GRANTING DEFENDANT’S
13 MOTION TO DISMISS FOR LACK
Plaintiff,
OF PERSONAL JURISDICTION
14
v.
15 [ECF No. 12]
NETGAIN TECHNOLOGY, LLC,
16
Defendant.
17
18 Defendant Netgain Technology, LLC (“Netgain”) moves to dismiss this putative
19 class action for lack of personal jurisdiction under Federal Rule of Civil Procedure
20 12(b)(2). ECF No. 12. Plaintiff filed a response in opposition, [ECF No. 14], and Netgain
21 filed a reply, [ECF No. 16]. The motion has been fully briefed and is suitable for
22 submission without the need for oral argument. For the below reasons, the motion is
23 GRANTED.1
24
25
26 1 A different plaintiff and putative class representative filed a nearly identical complaint in
27 Clark v. Netgain Technology, LLC, No. 21-cv-1432-LL-MSB (S.D. Cal. Aug. 10, 2021) in
which Netgain also has a pending motion to dismiss for lack of personal jurisdiction. Both
28
1 I. BACKGROUND
2 Plaintiff alleges that Netgain is a cloud hosting and information technology services
3 company that provides services to several organizations in the healthcare and accounting
4 industries nationwide. Complaint (“Compl.”) ¶ 3. CareSouth Carolina, Inc. (“CareSouth”)
5 is one of Netgain’s clients and is a community health center providing a comprehensive set
6 of services to its patients, from pediatrics to pharmacy to community outreach.2 Id. ¶ 6.
7 Plaintiff is a citizen and resident of South Carolina. Id. ¶ 14. As a patient of CareSouth, he
8 was required to provide Netgain and CareSouth with his personal medical information
9 (“PMI”) with the assurance that such information would be kept safe from unauthorized
10 access. Id. at 7.
11 On or around December 3, 2020, cyber criminals infiltrated network servers
12 belonging to Netgain and CareSouth where sensitive personal and medical information was
13 being kept unprotected (the “data breach”). Id. ¶ 1. The cybercriminals gained access to
14 certain network servers, and Netgain paid a significant amount of money in exchange for
15 a promise from the attackers that they would delete the copies of the data that was in their
16 possession and would not publish, sell or otherwise share the data. Id. ¶ 2. On May 17,
17 2021, Plaintiff received a letter from CareSouth informing him of “an incident that
18 involved personal information maintained by our vendor Netgain” in which “some of [the]
19 servers that it maintained for CareSouth Carolina were affected as part of a ransomware
20 attack.” ECF No. 1-2.
21 Plaintiff brings a putative nationwide class action on behalf of all persons residing
22 in the United States whose PMI was compromised as a result of the data breach. Id. ¶ 119.
23 Plaintiff also brings a putative subclass action on behalf of all patients of CareSouth. Id.
24 Plaintiff’s claims include: (1) negligence; (2) invasion of privacy; (3) breach of third-party
25 beneficiary contract; (4) breach of implied contract; (5) breach of confidence; (6) breach
26
27
2 CareSouth was voluntarily dismissed as a defendant just prior to the filing of Negtain’s
28
1 of implied covenant of good faith and fair dealing; (7) violations of South Carolina Code
2 of Laws, S.C. Stat. Tit. 389, Ch. 5 §§ 10, et seq.; (8) violations of South Carolina Code of
3 Laws, S.C. Stat. Tit. 39, Ch. 1 § 90; and (9) for declaratory relief.
4 II. LEGAL STANDARDS
5 Under Federal Rule of Civil Procedure 12(b)(2), a district court may dismiss an
6 action for lack of personal jurisdiction. Any judgment rendered by a court that lacks
7 personal jurisdiction over a defendant is void. Ruiz v. Snohomish Cnty. Pub. Util. Dist. No.
8 1, 824 F.3d 1161, 1164 (9th Cir. 2016). A federal court has personal jurisdiction over an
9 out of state defendant if the defendant had certain minimum contacts with the state such
10 that the maintenance of the suit does not offend traditional notions of fair play and
11 substantial justice. Goodyear Dunlop Tires Ops., S.A. v. Brown, 564 U.S. 915, 923 (2011)
12 (citing Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). This minimum contact
13 jurisdiction may be either “general or all-purpose jurisdiction,” or “specific or case-linked
14 jurisdiction.” Id. at 919 (citing Helicopteros Nacionales de Colom. a S.A. v. Hall, 466 U.S.
15 408, 414 (1984)).
16 “Where defendants move to dismiss a complaint for lack of personal jurisdiction,
17 plaintiffs bear the burden of demonstrating that jurisdiction is appropriate.” Dole Food Co.
18 Inc. v Watts, 303 F.3d 1104, 1108 (9th Cir. 2002). Factual disputes are resolved in the
19 plaintiff’s favor. Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154 (9th Cir. 2006) (citation
20 omitted). Where the court decides a motion to dismiss for lack of personal jurisdiction
21 without an evidentiary hearing, the plaintiff need only make a prima facie showing of
22 jurisdictional facts to withstand the motion to dismiss. Ballard v. Savage, 65 F.3d 1495,
23 1498 (9th Cir. 1995).
24 The plaintiff cannot, however, simply rest on the bare allegations of his or her
25 complaint. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011)
26 (citation omitted). Only uncontroverted allegations in the complaint must be taken as true.
27 Id. The court may consider evidence presented in affidavits and declarations in determining
28 personal jurisdiction. Doe v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2011); see also In
1 re Cathode Ray Tube (CRT) Antitr. Litig., 27 F. Supp. 3d 1002, 1008 (N.D. Cal. 2014)
2 (“The Court may not assume the truth of allegations that are contradicted by affidavit.”).
3 III. DISCUSSION
4 The parties dispute whether the Court has specific jurisdiction over Netgain.3
5 Specific jurisdiction exists where “the defendant's suit-related conduct . . . . create[s] a
6 substantial connection with the forum State.” Walden v. Fiore, 571 U.S. 277, 284 (2014).
7 In order for a federal court to exercise specific jurisdiction over a non-resident defendant:
8 (1) The non-resident defendant must purposefully direct his activities or
consummate some transaction with the forum or resident thereof; or perform
9
some act by which he purposefully avails himself of the privilege of
10 conducting activities in the forum, thereby invoking the benefits and
protections of its laws; (2) the claim must be one which arises out of or relates
11
to the defendant’s forum-related activities; and (3) the exercise of jurisdiction
12 must comport with fair play and substantial justice, i.e. it must be reasonable.
13 See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 801–02 (9th Cir. 2004).
14 (citing Lake v. Lake, 817 F.2d 1416, 1421 (9th Cir. 1987)). “If any of the three requirements
15 is not satisfied, jurisdiction in the forum would deprive the defendant of due process of
16 law.” Caddy, 453 F.3d at 1155. The plaintiff bears the burden of satisfying the first two
17 prongs of the test. Id. (citing Sher v. Johnson, 911 F.2d 1357, 1361 (9th Cir. 1990)). If the
18 plaintiff satisfies the first two prongs, the burden shifts to the defendant to present a
19 “compelling case” that the exercise of jurisdiction would not be reasonable. Burger King
20 Corp. v. Rudzewicz, 471 U.S. 462, 476–78 (1985).
21 A. Purposeful Availment and Direction
22 A purposeful availment analysis is most often used in suits sounding in contract
23 while a purposeful direction analysis is most often used in suits sounding in tort.
24 Schwarzenegger, 374 F.3d at 802 (citations omitted). “[B]oth purposeful availment and
25 purposeful direction ask whether defendants have voluntarily derived some benefit from
26
27
3 The parties do not dispute (1) that Netgain does not reside in California, and (2) the Court
28
1 their interstate activities such that they will not be haled into a jurisdiction solely as a result
2 of ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts.” Global Commodities Trading Grp., Inc.
3 v. Beneficio de Arroz Choloma, 972 F.3d 1101, 1107 (9th Cir. 2020) (quoting Burger King,
4 471 U.S. at 474–75).
5 1. Purposeful Direction
6 Purposeful direction requires that that the defendant: “‘(1) committed an intentional
7 act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is
8 likely to be suffered in the forum state.’” Axiom Foods, Inc. v. Acerchem Int’l, Inc., 874
9 F.3d 1064, 1069 (9th Cir. 2017) (quoting Wash. Shoe Co. v. A-Z Sporting Goods Inc., 704
10 F.3d 668, 673 (9th Cir. 2012)). A defendant acts intentionally when he acts with “an intent
11 to perform an actual, physical act in the real world, rather than an intent to accomplish a
12 result or consequence of that act.” AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1209
13 (9th Cir. 2020) (quoting Schwarzenegger, 374 F.3d at 806). Showing the defendant
14 “engaged in wrongful conduct targeted at a plaintiff whom the defendant knows to be a
15 resident of the forum state” is relevant to the “expressly aimed” inquiry. Axiom Foods, 874
16 F.3d at 1069–70.
17 In his Complaint, Plaintiff claims “[t]his Court has personal jurisdiction over
18 Defendants because Defendant Netgain conducts much of its business in and has sufficient
19 minimum contacts with California.” Compl. ¶ 28. Plaintiff further claims that “[v]enue is
20 likewise proper . . . . in this District . . . . because Defendant Netgain conducts business
21 through this District (including promoting, selling, marketing, and distributing the Netgain
22 brand and services at issue).” Id. ¶ 29. Plaintiff argues he has made a prima facie showing
23 of both purposeful availment and direction because “the uncontroverted allegations are that
24 Netgain (1) advertises serving the San Diego market via its website; (2) has a physical
25 office in California; (3) employs personnel working in California; and (4) has California
26 employees providing IT services to its customers, which includes California residents,
27 contracting with California residents, and maintaining business relationships with
28 California residents.” ECF No. 14 at 5. In support of this argument, Plaintiff cites a link to
1 a page on Netgain’s website noting that “[t]he company has grown to include offices and
2 data centers in Chicago, Minneapolis, San Diego and Phoenix.”4 Id. at n.1.
3 In opposition, Netgain argues that Plaintiff has not shown purposeful direction5
4 because “Netgain only has one satellite office in California that is staffed by only a few
5 employees, none of whom provided services to CareSouth” and “Netgain does not store
6 any data at its California office, including any data associated with Mr. Lee or CareSouth.”
7 ECF No. 12 at 10. In support of this argument, Netgain attaches a declaration by its Vice
8 President of Finance stating: (1) “Netgain has a satellite office in San Diego;” (2) “Netgain
9 does not store any customers’ personal information data at its California office, including
10 any data associated with Plaintiff . . . . or . . . . CareSouth;” and (3) “Netgain’s California
11 office is staffed by only a few employees who are responsible for IT services for customers
12 not including CareSouth.” ECF No. 12-1 at 4–6.
13 By opening an office and data center in San Diego, Netgain performed an actual,
14 physical act in the real world that was aimed at California. In operating the San Diego
15 office day-to-day, Netgain also presumably performs acts aimed at California. However,
16
17
4 Plaintiff states “[t]he legal standard governing a motion to dismiss for lack of personal
18
jurisdiction permits the Court to consider relevant materials outside the pleadings without
19 taking judicial notice of those materials.” ECF No. 14 at 5 n.1 (citing Diaimler AG v.
Bauman, 134 S. Ct. 746, 752 (2014). Although Netgain does not dispute the information
20
on its website, to the extent Plaintiff requests the Court take judicial notice of Netgain’s
21 website, the request is GRANTED. See Allphin v. Peter K. Fitness, LLC, No. 13-cv-01338-
BLF, 2014 WL 6997653, at *3 (N.D. Cal. Dec. 11, 2014) (“Courts have taken judicial
22
notice of the websites of parties to the litigation when determining personal jurisdiction.”).
23
5 Netgain argues the correct test is purposeful direction “because [Plaintiff’s] claims sound
24
in tort, not contract.” ECF No. 15 at 3. As noted above, however, in addition to claims for
25 negligence, invasion of privacy, and South Carolina state statutory claims, Plaintiff brings
claims for breach of contract under a third party beneficiary theory, breach of implied
26
contract, and bad faith. Netgain does not explain, nor is it apparent, why these claims sound
27 in tort but not contract. See Baton v. Ledger SAS, No. 21-cv-02470-EMC, 2021 WL
5226315, at *5 (N.D. Cal. Nov. 9, 2021) (applying purposeful direction test data breach
28
1 Plaintiff does not identify an actual, physical act in the real world that Netgain did that
2 caused the data breach. The gravamen of Plaintiff’s claims is that Netgain failed, by taking
3 no action or insufficient action, to secure CareSouth patients’ PMI. The act of opening and
4 operating a San Diego office does not, without more, constitute wrongful conduct, or
5 conduct targeted at a plaintiff whom Netgain knew was a California resident.6 See Calder
6 v. Jones, 465 U.S. 789 (1984) (“mere untargeted negligence” does not support personal
7 jurisdiction).
8 Plaintiff also does not allege or show, that by operating the San Diego office, Netgain
9 caused the data breach, or that Netgain knew that by operating the San Diego office the
10 data breach would likely occur. While Plaintiff alleges that after the data breach CareSouth
11 “began filing” sample data security incident letters with various state Attorneys General,
12 including California’s, that mirrored the language of the notice sent to Plaintiff, see Compl.
13 ¶ 31, Plaintiff does not allege, or provide any evidence supporting, that any such notices
14 were actually sent to a person in California. In data breach cases, courts have found that
15 decisions by out-of-state companies regarding data breach notifications in California
16 presumably occur at the company’s headquarters. In Baton, for example, the court found
17 “[t]here are no facts alleged that [defendant] made its decision regarding notification in
18 California or that it specifically targeted California in its decision not to provide
19 communications about the breach, nor do any facts presented by Plaintiffs suggest that
20 California-residents were uniquely harmed or entitled to a warning about the breach more
21 than anyone else affected by the breach residing in any other jurisdiction.” 2021 WL
22 5226315, at *7; see also Caces-Tiamson v. Equifax, No. 20-cv-00387-EMC, 2020 WL
23 1322889, at *3 (N.D. Cal. Mar. 20, 2020) (declining to find specific jurisdiction because
24
25
6 Even if Plaintiff was a resident of California and suffered harm in California, that fact
26
alone would not be enough for specific jurisdiction. See Patao v. Equifax, Inc., No. CV 19-
27 00677 JMS-WRP, 2020 WL 5033561, at *4 (D. Haw. Aug. 25, 2020) (alleging that data
breach caused plaintiff to suffer harm in forum state is “insufficient to establish specific
28
1 actions defendant did or did not take with respect to its data security systems would
2 presumably have occurred where it had its principal place of business, even where the
3 plaintiff resided in California); Tiamson v. Equifax, Inc., No. 19-CV-08430-LHK, 2020
4 WL 3972582, at *6 (N.D. Cal. July 14, 2020) (applying Caces-Tiamson’s reasoning that
5 specific jurisdiction does not exist where the plaintiff did not show that the data breach, or
6 the failure to prevent the data breach, was “tied to” California).
7 Moreover, as discussed below, Plaintiff essentially admits in his request for
8 jurisdictional discovery that he does not know whether the data breach originated in
9 California due to the acts or omissions of the San Diego office, or whether the San Diego
10 office had any control of Plaintiff’s or CareSouth’s data. See Baton, 2021 WL 5226315, at
11 *6–7 (finding lack of specific jurisdiction where there was no evidence by declaration or
12 elsewhere that the defendant “reposited” the plaintiff’s data in California, and where the
13 plaintiff did not allege that the defendant permitted customer data to be accessible to, and
14 accessed by, anyone in California). As is the case for decisions regarding breach
15 notifications, it is not reasonable to infer that decisions regarding data security, especially
16 CareSouth’s data security, were made in California. Accordingly, Plaintiff has not made a
17 prima facie showing of purposeful direction.
18 2. Purposeful Availment
19 “A showing that a defendant purposefully availed himself of the privilege of doing
20 business in a forum state typically consists of evidence of the defendant’s actions in the
21 forum, such as executing or performing a contract there.” Schwarzenegger, 374 F.3d at
22 802. Instructive factors include: (1) prior negotiations; (2) contemplated future
23 consequences; (3) the terms of the contract at issue; and (4) the parties’ actual course of
24 dealing. Burger King, 471 U.S. at 479. The analysis involves a “qualitative evaluation of
25 the defendant’s contact with the forum state.” Harris Rutsky & Co. Ins. Servs., Inc. v. Bell
26 & Clements Ltd., 328 F.3d 1122, 1130 (9th Cir. 2003). Direct solicitation of business in
27 the forum state, and conducting negotiations in the forum state, are “particularly
28 persuasive” under the purposeful availment test. Decker Coal Co. v. Commonwealth
1 Edison Co., 805 F.2d 834, 840 (9th Cir. 1986). The substantiality of the effect in the forum
2 state may be considered. See, e.g., Haisten v. Grass Valley Med. Reimburs. Fund, Ltd., 784
3 F.2d 1392, 1398 (9th Cir. 1986).
4 By operating an office in San Diego, Netgain has purposefully availed itself of the
5 privilege of doing business in California. See Jeong v. Nexo Fin. LLC, No. 21-cv-02392-
6 BLF, 2022 WL 174236, at *10 (N.D. Cal. Jan. 19, 2022) (uncontradicted allegation that
7 defendant operated a branch of its business in California is sufficient to find purposeful
8 availment). In his opposition, however, Plaintiff does not recognize: (1) the distinction
9 between purposeful direction and availment; (2) that each test typically applies to different
10 types of claims; or (3) that Plaintiff’s claims appear to sound in both tort and contract.
11 Moreover, Plaintiff does not allege that he directly contracted with Netgain. See Toretto v.
12 Mediant Commc’ns, Inc., No. 19-cv-05208-EMC, 2020 WL 1288478, at *4 (N.D. Cal.
13 Mar. 18, 2020) (finding lack of purposeful availment in data breach case where the
14 defendant did not have a “direct contractual relationship with any of the . . . . businesses
15 involved in the breach” and “no direct contractual relationship with any of the . . . . breach-
16 affected companies located in California”). Nonetheless, to the extent Plaintiff argues that
17 Netgain has purposefully availed itself, Plaintiff has made a prima facie showing of
18 purposeful availment, but only with respect to his contract-based claims.
19 3. Relatedness
20 To demonstrate that its claims “arise out” of forum-related activities, Plaintiff must
21 show that he would not have suffered an injury “but for” Netgain’s “forum related
22 conduct.” Myers v. Bennett L. Offs., 238 F.3d 1068, 1075 (9th Cir. 2001). Plaintiff argues
23 he has made his prima facie case for relatedness because (1) “Netgain staffs its California
24 office with IT personnel providing IT services for multiple customers, including California
25 healthcare providers impacted by the same Data Breach that impacted Lee and the
26 Nationwide Class Members,” and (2) Plaintiff “alleges that it was due to these very IT
27 services, including Defendant’s negligence and data security failures provided to its
28 customers nationwide (including out of its California office), that the Data Breach
1 occurred.” ECF No. 14 at 6.
2 As noted above, however, Plaintiff acknowledges that he does not know whether the
3 data breach occurred but for the acts or omissions of Netgain in, or directed at, California.
4 Moreover, Plaintiff’s argument does not match his allegations. In support of his argument,
5 Plaintiff cites paragraph 11 of his Complaint, in which he alleges “[d]ue to Defendants’
6 negligence and data security failures, cyber criminals obtained and now possess everything
7 they need to commit personal and medical identity theft and wreak havoc on the financial
8 and personal lives of hundreds of thousands of individuals for decades to come.” Plaintiff
9 also cites paragraph 74, in which he alleges that Netgain owed various duties of care
10 regarding the safekeeping of Plaintiff’s PMI. Neither of these paragraphs suggests the data
11 breach would not have occurred but for the acts or omission of Netgain vis-à-vis its
12 activities in, or directed at, California. See Toretto, 2020 WL 1288478, at *5 (finding lack
13 of specific jurisdiction in data breach case because “it is not at all evident that, absent
14 [defendant’s] contractual agreements to provide services to California entities, Plaintiffs’
15 claims would not have arisen”). Accordingly, Plaintiff has not made a prima facie showing
16 of relatedness.
17 4. Reasonableness
18 Because Plaintiff cannot satisfy the first two elements of the specific jurisdiction
19 test, the burden does not shift to Netgain to show that jurisdiction would be unreasonable.
20 See, e.g., Willis v. Princess Cruise Lines, No. 2:19-cv-06278-SVW-FFM, 2020 WL
21 5353984, at *6 (C.D. Cal. May 29, 2020). Assuming Plaintiff had shown purposeful
22 direction and relatedness, most of the reasonableness factors would likely weigh in favor
23 of declining specific jurisdiction over Netgain. The Ninth Circuit applies a seven-part
24 balancing test to determine whether a case satisfies the “fair play and substantial justice”
25 element:
26 (1) the extent of the defendants’ purposeful injection into the forum state’s
affairs; (2) the burden on the defendant of defending in the forum; (3) the
27
extent of conflict with the sovereignty of the defendant’s state; (4) the forum
28 state’s interest in adjudicating the dispute; (5) the most efficient judicial
1 resolution of the controversy; (6) the importance of the forum to the plaintiff’s
interest in convenient and effective relief; and (7) the existence of an
2
alternative forum.
3
4 Dole, 303 F.3d at 1114.
5 By allegedly failing to protect CareSouth’s patients’ PMI, the extent of Netgain’s
6 purposeful injection into California’s affairs is minimal. There is no allegation or evidence,
7 for example, that Netgain had reason to believe CareSouth’s patients, or former patients,
8 were in California. It also seems burdensome that Netgain would have to defend against
9 claims related to a data breach in any state where it had employees, regardless of whether
10 the data breach was in any way linked to that state. Furthermore, California’s interest in
11 adjudicating this dispute is not strong given that Plaintiff is from South Carolina, his claims
12 arise mostly, if not entirely,7 under South Carolina law, and arise from a data breach of a
13 Minnesota company that possessed South Carolina patients’ PMI. South Carolina or
14 Minnesota would clearly be more efficient and important alternative forums for resolving
15 this controversy.8
16 B. Jurisdictional Discovery
17 Finally, Plaintiff argues that “[i]f the Court requires a further factual showing that
18 the Data Breach would not have occurred but for Netgain’s conduct in the forum state, then
19 it should permit limited discovery on these narrow issues prior to a preliminary hearing.”
20 ECF No. 14 at 9. “[W]here pertinent facts bearing on the question of jurisdiction are in
21 dispute, discovery should be allowed.” Am. W. Airlines, Inc. v. GPA Grp., Ltd., 877 F.2d
22 793, 801 (9th Cir. 1989). A district court has the discretion to permit or deny jurisdictional
23 discovery. Boschetto v. Hansing, 539 F.3d 1011, 1020 (9th Cir. 2008). A court may deny
24
25
7 Plaintiff does not specify which state’s law applies to his common law claims.
26
27 8 Netgain states that it is the defendant “in a consolidated action in Minnesota alleging
putative classes that if certified would include his claims and the classes he purports to
28
1 a request to conduct jurisdictional discovery if “a plaintiff’s claim of personal jurisdiction
2 appears to be both attenuated and based on bare allegations in the face of specific denials
3 made by the defendants,” Caddy, 453 F.3d at 1160, or “it is clear that further discovery
4 would not demonstrate facts sufficient to constitute a basis for jurisdiction,” Laub v. U.S.
5 Dep’t of Interior, 342 F.3d 1080, 1093 (9th Cir. 2003) (quotation marks omitted). Plaintiff
6 is required to establish a “colorable basis” for personal jurisdiction before a court grants
7 jurisdictional discovery. See Mitan v. Feeney, 497 F. Supp. 2d 1113, 1119 (C.D. Cal. 2007).
8 “This ‘colorable’ showing should be understood as something less than a prima facie
9 showing, and could be equated as requiring the plaintiff to come forward with ‘some
10 evidence’ tending to establish personal jurisdiction over the defendant.” Id. (citations
11 omitted).
12 In support of his request for jurisdictional discovery, Plaintiff essentially argues that
13 jurisdictional discovery might reveal that: (1) the data breach originated in California due
14 to acts and omissions in the San Diego office; (2) the system’s “weak point” was in the San
15 Diego office; (3) Netgain’s negligence and data security failures were “nationwide;” 9 (4)
16 the San Diego office possessed or controlled the compromised PMI; and (5) the San Diego
17 office was responsible for Plaintiff’s or other class members’ PMI. ECF No. 14 at 8–9.
18 “Such an approach smacks of a fishing expedition – in other words, it appears that Plaintiff
19 is seeking jurisdictional discovery based on a mere ‘hunch,’ which courts have found to be
20 insufficient.” Jeong, 2022 WL 174236, at *16 (citing Boschetto, 539 F.3d at 1020). As
21 noted above, Plaintiff provides no actual evidence that the data breach occurred in
22 California or affected persons in California. As also noted above, Plaintiff does not argue
23 or allege that any breach notification letters were sent to anyone in California. Plaintiff’s
24 only allegation specifically related to personal jurisdiction is that Netgain “conducts much
25
26
27 9 It is not clear that a “nationwide” security failure would confer specific jurisdiction. See
Caces-Tiamson, 2020 WL 1322889, at *3 (“Nor can specific jurisdiction be based on the
28
1 || of its business in” California. Compl. ¥ 28.
2 Overall, Plaintiff's request for jurisdictional discovery is not based on evidence that
3 ||the evidence presented by Netgain is false or inaccurate. Accordingly, Plaintiffs request
4 || for jurisdictional discovery is based on speculation, and Plaintiff has therefore not met his
5 || burden of showing some evidence of personal jurisdiction. See Baton, 2021 WL 5226315,
6 *14. Additionally, because jurisdictional discovery is unwarranted, it would be futile for
7 || Plaintiff to attempt to amend his Complaint to assert specific jurisdiction. See id.
8 IV. CONCLUSION
9 For the foregoing reasons, Netgain’s motion to dismiss for lack of personal
10 jurisdiction [ECF No. 12] is GRANTED. Plaintiff's Complaint is DISMISSED with
11 || prejudice and without leave to amend. Plaintiff’s request for jurisdictional discovery 1s
12 DENIED. This order is not intended to preclude Plaintiff from pursuing his claim in
13 || another state or joining a pending claim in another state.
14 IT IS SO ORDERED.
15 || Dated: April 1, 2022 NO
16 Qe |
17 Honorable Linda Lopez
ig United States District Judge
19
20
21
22
23
24
25
26
27
28
12