On April 11, 2011, the United States District Court for the Northern District of California declined to dismiss four of the nine claims in a class action lawsuit filed against RockYou, Inc. (“RockYou”), a publisher and developer of applications used on popular social media sites. The suit stems from a December 2009 security breach caused by an SQL injection flaw that resulted in the exposure of unencrypted user names and passwords of approximately 32 million RockYou users. RockYou subsequently fixed the error and acknowledged in a public statement that “one or more individuals had illegally breached its databases” and that “at the time of the breach, the hacked database had not been up to date with industry standard security protocols.” After receiving notification of the security breach from RockYou in mid-December, on December 28, 2009, a RockYou user who had signed up for a photo-sharing application filed a complaint seeking injunctive relief and damages for himself and on behalf of all other similarly-situated individuals.
- The court ruled that the plaintiff’s allegations of harm were sufficient at that stage of the proceedings “to allege a generalized injury in fact” despite RockYou’s argument that the plaintiff had failed to sufficiently allege “any actionable harm or concrete, tangible, non-speculative harm or loss.”
- The court held that “[n]ot only is there a paucity of controlling authority regarding the legal sufficiency of plaintiff’s damages theory, but the court also takes note that the context in which plaintiff’s theory arises — i.e., the unauthorized disclosure of personal information via the Internet — is itself relatively new, and therefore more likely to raise issues of law not yet settled in the courts.” The court noted, however, that it has “doubts about plaintiff’s ultimate ability to prove his damages theory in this case.”
- The court refused to dismiss the plaintiff’s claims for breach of contract and breach of implied contract, but dismissed the claim for breach of the implied covenant of good faith and fair dealing because the plaintiff did not provide any “supporting or factual allegations that adequately allege the type of conscious and deliberate acts” required to prevail on this count.
- The court’s order allows the plaintiff to amend two of its claims, including the breach of implied contract claim, to re-allege any additional facts sufficient to state a proper claim. The plaintiff has until May 11, 2011 to amend its complaint. As the court noted, however, “[i]f it becomes apparent, through discovery, that no basis exists upon which plaintiff could legally demonstrate tangible harm via the unauthorized disclosure of personal information, the court will dismiss plaintiff’s claims for lack of standing at the dispositive motion stage.”
Update: As reported in BNA’s Privacy Law Watch, on November 14, 2011, the parties filed a proposed settlement in which RockYou agreed to pay the plaintiff $2,000, and the plaintiff’s counsel $290,000 for fees and expenses. In addition, RockYou will submit to two third party information security audits over the next three years and correct any issues identified by the audits.