In re Facebook, Inc.

367 F.Supp.3d 1108

IN RE FACEBOOK, INC. SHAREHOLDER DERIVATIVE PRIVACY LITIGATION

This Document Relates to: All Actions

Case No. 18-cv-01792-HSG

United States District Court, N.D. California.

Signed March 22, 2019

ORDER ON MOTIONS TO DISMISS, MOTION TO STAY, AND MOTION TO INTERVENE

Re: Dkt. Nos. 69, 70, 71, 72, 84

HAYWOOD S. GILLIAM, JR., United States District JudgePlaintiffs Jeremiah F. Hallisey, Ronald Martin, Natalie Ocegueda, James Karon, and the Gloria Stricklin Trust (collectively, "Plaintiffs") bring this shareholder derivative action against nominal Defendant Facebook, Inc. ("Facebook") and individual Defendants Mark Zuckerberg, Sheryl Sandberg, Marc Andreesen, Peter Thiel, Reed Hastings, Erskine B. Bowles, Dr. Susan D. Desmond-Hellmann, and Jan Koum (collectively, "Individual Defendants," and with Facebook, "Defendants"). Christopher Leagre ("State Plaintiff"), plaintiff in a separate derivative litigation in Delaware state court, also filed a motion to intervene in this action. Dkt. No. 84.

Pending before the Court are Facebook's motion to dismiss under Federal Rule of Civil Procedure ("FRCP") 23.1, Dkt. No. 69; the Individual Defendants' motion to dismiss under FRCP 12(b), Dkt. No. 70; Facebook's motion to dismiss based on forum non conveniens , Dkt. No. 71; Facebook's motion to stay, Dkt. No. 72; and State Plaintiff's motion to intervene, Dkt. No. 84. For the reasons articulated below, the Court GRANTS IN PART Facebook's motion to dismiss on forum non conveniens grounds as to the derivative state claims and dismisses those claims without leave to amend, GRANTS Facebook's motion to dismiss under FRCP 23.1 as to the remaining derivative federal claims and dismisses those claims with leave to amend, DENIES AS MOOT Individual Defendants' motion to dismiss under FRCP 12(b) and Facebook's motion to stay, and DENIES State Plaintiff's motion to intervene.

I. BACKGROUND

Plaintiffs filed a consolidated shareholder derivative complaint on July 2, 2018 against Defendants, Dkt. No. 56 ("Complaint" or "Compl."), for claims related to Facebook's data privacy protection policies and practices in the wake of the revelation that Cambridge Analytica was misappropriating millions of Facebook users' information for use in political campaigns. See Compl. ¶¶ 1–15. For the purpose of deciding the motions to dismiss, the following allegations are taken as true.

Facebook is a Delaware corporation with its headquarters in Menlo Park, California. Id. ¶ 26. It was founded in 2004, and as of March 2018, it was one of the biggest social networking services with approximately 1.45 billion daily active users and 2.2 billion monthly active users. Id. ¶ 42. Users can interact with each other through their social profiles by messaging, joining groups, and posting status updates; users also can interact with a wide range of other applications that are integrated with Facebook. Id. ¶ 44. The "Facebook Platform" allows third-party developers to integrate their own apps with Facebook, and through the use of Facebook "features" implemented on their apps (such as the "Like" and "Share" buttons), these third-party developers have access to user information. Id. ¶¶ 46–48. In return, Facebook also obtains more information about users' activities, such as purchasing behavior. Id. at ¶ 48. Facebook's core revenue is based on advertising, which is carefully targeted based on the information that Facebook gathers about its users. Id. ¶ 52.

At the time this action was filed, Facebook's Board of Directors (the "Board") had nine members. Id. ¶ 380. Defendants are former and current Facebook directors and officers and are named as follows: Mark Zuckerberg (Director, Founder, Chairman, and CEO), Sheryl Sandberg (Director and Chief Operating Officer), Marc Andreessen (Director), Peter Thiel (Director), Reed Hastings (Director), Erskine B. Bowles (Director), Dr. Susan D. Desmond-Hellman (Director), and Jan Koum (former Director). Id. ¶¶ 28–34.

In 2011, in an effort to protect user and consumer privacy, the Federal Trade Commission ("FTC") entered into a consent decree with Facebook and required Facebook to establish and maintain a comprehensive privacy program to address privacy risks and protect user data. Id. ¶¶ 2, 40. One of Facebook's obligations was to obtain third-party audits every two years certifying it had a privacy program in place that met or exceeded the requirements of the FTC order. Id. ¶ 40. The Board is responsible for overseeing Facebook's compliance with the FTC consent decree. Id. ¶ 197.

A. Cambridge Analytica Scandal and Plaintiffs' Allegations

Cambridge Analytica is a political consulting firm that impermissibly gathered and analyzed data from millions of Facebook users in order to influence U.S. elections. Id. ¶ 3. This was first reported in 2015, and Defendants were aware then that Cambridge Analytica was engaging in the unauthorized use of Facebook's user data. Id. ¶¶ 3, 121. After this discovery, Facebook stated that it had obtained written certifications from the third parties responsible "declaring that all such data they had obtained was accounted for and destroyed." Id. ¶ 126. However, in March 2018, it was reported that Cambridge Analytica may not actually have deleted the data and was still misappropriating information to "target political advertising and manipulate voters."Id. ¶¶ 7–8. Facebook hired a forensic auditor to uncover whether that information indeed had been destroyed. Id. ¶ 126.

In the wake of the Cambridge Analytica scandal, multiple lawsuits against Facebook and its Board were filed in courts around the U.S., including this derivative action brought by Plaintiffs on March 22, 2018. See Dkt. No. 1. While Plaintiffs' Complaint contains a host of allegations, the main crux of their claims is as follows:

• Facebook's 2016, 2017, and 2018 proxy statements failed to disclose the Cambridge Analytica incident, or the "seriously deficient internal controls and privacy policies" Facebook maintained, which "allowed and perpetuated Facebook's violations of user privacy and other laws" in violation of Section 14(a) of the Securities and Exchange Act ("Exchange Act"). Id. ¶¶ 336–338, 342–347.

• Facebook's 2018 proxy statement contained a misrepresentation concerning the Board's role in risk oversight and misled shareholders to "vote against ‘Stockholder Proposals’ meant to improve the Board's governance," in violation of Section 14(a) of the Exchange Act. Id. ¶¶ 339–341.

• Defendants "knowingly or recklessly" made materially false or misleading statements and/or omissions regarding Facebook's privacy practices and internal controls, including misleading statements in the risk disclosures section of Facebook's 2015, 2016, and 2017 annual reports, in breach of their fiduciary duties and in violation of Section 10(b) of the Exchange Act. Id. ¶¶ 348–355. Defendants' alleged misrepresentations boosted the stock price, "causing the Company to repurchase shares at artificially inflated prices." Id. ¶ 348.

• Facebook repurchased 13 million Class A common shares for approximately $ 2.07 billion in 2017. Id. ¶¶ 348, 350. The Board approved these securities repurchases. Id. ¶ 351. However, when Defendants' "prior misrepresentations and fraudulent conduct were disclosed," the stock price fell. Id. ¶ 367. Were it not for the material misstatements, Facebook "would not have repurchased Facebook stock at artificially inflated prices" and would not have suffered damages when the stock price fell. Id. ¶¶ 362, 367.

• During the time when Facebook's stock price was artificially inflated, Individual Defendants Zuckerberg, Sandberg, and Koum collectively sold $ 1.5 billion worth of their personally-held Facebook shares, while in possession of material, non-public information, in violation of their fiduciary duties of loyalty and good faith and California Corporations Code § 25402. Id. ¶¶ 368, 473–477.

• Because Defendants were "aware of" the insider trading and had the ability and knowledge "to control and influence" the selling Defendants, all Defendants are liable under California Corporations Code § 25403. Id. ¶¶ 485–487.

• Defendants failed to ensure Facebook maintained adequate internal controls in compliance with the FTC consent decree and other applicable privacy laws, thereby breaching their fiduciary duties of candor, good faith, loyalty, and reasonable inquiry. Id. ¶ 491.

• Defendants implemented and oversaw "Facebook's illegal business strategy of pursuing profits and revenue growth through violation of various laws" in order to achieve an improper result that was not in Facebook's best interest, in breach of the Individual Defendants' fiduciary duties. Id. ¶ 493.

Plaintiffs bring this derivative action alleging the following eight causes of action: (1) violation of Section 14(a) of the Exchange Act and SEC Rule 14a-9, against the Individual Defendants; (2) violation of Section 10(b) of the Exchange Act and SEC Rule 10b-5, against Defendants; (3) misappropriation of information and breach of fiduciary duty for insider sales, against Individual Defendants Zuckerberg, Sandberg, and Koum; (4) violation of California Corporations Code § 25402, against Individual Defendants Zuckerberg, Sandberg, and Koum; (5) violation of California Corporations Code § 25403, against Defendants; (6) breach of fiduciary duty, against Defendants; (7) contribution and indemnification, against Defendants; and (8) aiding and abetting breaches of fiduciary duty, against Defendants. Id. ¶¶ 464-517.

II. REQUEST FOR JUDICIAL NOTICE

In support of Defendants' motions to dismiss and motion to stay, Defendants have requested that the Court take judicial notice of, or consider under the incorporation by reference doctrine, the following documents: published articles, Exs. 2–4;¹ a blog post and white paper from the Facebook Newsroom, Exs. 5, 7; excerpts from Facebook's June 29, 2018 Congressional Hearing, Ex. 6; and Facebook's publicly-filed Securities and Exchange Commission ("SEC") ...