In re StockX Customer Data Sec. Breach Litig.

In re StockX Customer Data Security Breach Litigation

Case No. 19-12441

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION

December 23, 2020

Honorable Victoria A. Roberts

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS AND COMPEL ARBITRATION [ECF No. 30]

I. INTRODUCTION

Eight individuals bring this putative class action against StockX seeking to represent a nationwide class and several subclasses of individuals who allegedly have been harmed by StockX's failure to protect their confidential and personal information from a data breach.

StockX moves the Court to dismiss the complaint for improper venue and to compel arbitration under the Federal Arbitration Act, 9 U.S.C. § 1, et seq. Alternatively, it says the Court should dismiss the complaint for lack of subject matter jurisdiction pursuant to Fed. R. Civ. P. 12(b)(1), because the named Plaintiffs lack standing, or for failure to state a claim upon which relief can be granted, pursuant to Fed. R. Civ. P. 12(b)(6)

For the reasons below, the Court GRANTS StockX's motion to dismiss and compel arbitration. [ECF No. 30].

II. BACKGROUND

StockX is an e-commerce platform where users can purchase and sell luxury goods, fashion clothing, rare sneakers, and accessories.

The eight named Plaintiffs are registered users of StockX: (1) Kansas resident I.C. - a minor by and through his natural parent, Nasim Chaudhri; (2) New Jersey resident M.S. - a minor by and through his natural parent, Shuli Shakarchi; (3) Kansas resident Adam Foote; (4) New York resident Anthony Giampetro; (5) Georgia resident Kwadwo Kissi; (6) New York resident Richard Harrington; (7) Florida resident Johnny Sacasas; and (8) California resident Chad Bolling ("Plaintiffs").

A. Creating a StockX Account and StockX's Terms of Service

To create a StockX account, each Plaintiff had to complete the registration process, which involved manually and affirmatively checking a box indicating that he agreed to the then-current version of the Terms of Service ("Terms") and Privacy Policy. When registering for a StockX account through a web browser or StockX's mobile app, Plaintiffs were first shown a "Sign Up" screen containing an unchecked, clickable box next to a message that states to the new user: "By signing up, you agree to the Terms of Service and Privacy Policy":

Image materials not available for display.

The phrase "Terms of Service" is an active hyperlink and appears in blue or green - different colors from the other text in that sentence, clearly indicating that they are active hyperlinks that can be clicked on. By clicking on the "Terms of Service" hyperlink, another window immediately opens within the web browser containing the text of the then-current Terms.

No Plaintiff could have advanced to the next step to complete his StockX account registration unless and until he affirmatively clicked on the box next to the message that expressly states: "By signing up, you agree to the Terms of Service and Privacy Policy." As such, all Plaintiffsencountered the Terms when they signed up to create their StockX account, and each Plaintiff had the opportunity to review the Terms prior to clicking on the box and consenting to the Terms. Considering each Plaintiff is a registered StockX user, each Plaintiff manually clicked on - or "checked" - the box and affirmatively agreed to the Terms to sign up for and create his StockX user account.

Furthermore, each time Plaintiffs logged in and continued to use their StockX account, they would have been shown a screen informing them that "[b]y logging in, you agree to the Terms of Service and Privacy Policy." To log in to their StockX accounts, each Plaintiff was then required to affirmatively click the button in the screenshot labeled "Log In" and again consent to the then-current Terms. Like the Sign Up screen, the words "Terms of Service" are in green - a different color from the other text in that sentence, clearly indicating that it is an active hyperlink that can be clicked on. When a consumer clicked on the "Terms of Service" hyperlink, another window would open within the web browser containing the entire text of StockX's then-current Terms. Thus, whenever Plaintiffs logged into their StockX account, they agreed to StockX's then-current version of the Terms.

All Plaintiffs created their StockX account in 2016 or later. Since November 10, 2015, StockX has revised its Terms twice - on October 17,2017 and October 9, 2018. The October 9, 2018 Terms are StockX's current terms.

Four Plaintiffs created their StockX account after October 9, 2018; thus, by creating their account, those Plaintiffs agreed to the October 9, 2018 version of the Terms ("Current Terms"). While the other four Plaintiffs created their StockX account before StockX implemented the Current Terms, StockX establishes by an uncontested affidavit that each of those Plaintiffs agreed to the Current Terms; specifically, it establishes that each of those Plaintiffs logged into and used their StockX account after October 9, 2018 - when the Current Terms went into effect. Thus, by logging into and using their StockX account after October 9, 2018, those Plaintiffs also agreed to the Current Terms. See supra; see also Section 1 of StockX's November 2015 Terms, October 2017 Terms and Current Terms (allowing StockX to change the Terms and stating that continued use of their StockX account after the Terms change constitutes acceptance of the new Terms).

Because all eight Plaintiffs agreed to the Current Terms, they are the relevant version of the Terms governing this dispute.

StockX's Current Terms - like earlier versions of its Terms - contain a mandatory arbitration provision which provides that any and all disputes or claims that arise between StockX users and StockX must be resolvedexclusively through final and binding arbitration. Unlike earlier versions of StockX's Terms, the Current Terms also contain a delegation provision that delegates the issue of arbitrability to the arbitrator:

Other than issues related to the CLASS ACTION WAIVER, the arbitrator, and not any federal, state, or local court or agency, shall have exclusive authority to resolve any dispute arising out of or relating to the interpretation, applicability, enforceability or formation of this Agreement to Arbitrate, any part of it, or of the Terms including, but not limited to, any claim that all or any part of this Agreement to Arbitrate or the Terms is void or voidable.

The arbitration will be conducted by the American Arbitration Association ("AAA") under its rules and procedures . . . .

[ECF No. 30-8, PageID.1294].

B. This Action

This action arises from a data breach to StockX's system which occurred sometime in May 2019.

Plaintiffs filed this and three other similar actions in 2019 and early 2020. In March 2020, the Court entered a stipulated order consolidating the cases. Plaintiffs filed a consolidated class action complaint in May 2020.

Plaintiffs say StockX sent an email to its users on August 1, 2019 requiring a password reset because it had completed "system updates." Plaintiff allege that in reality, StockX suffered a data breach with more than 6.8 million user accounts stolen by a cyber thief, who listed the data for sale on the "Dark Web," where the data was then sold multiple times andlater re-listed on other underground hacker forums. Plaintiffs claim that after StockX's deception was reported by technology media outlets, StockX sent a follow-up email to its users, acknowledging that its system had been breached and that an unknown criminal had stolen confidential customer data such as names, email addresses, shipping addresses, usernames, passwords, and purchase history. They allege that some Plaintiffs began to suffer identity theft and other fraudulent activities shortly after the breach.

Plaintiffs bring their claims on behalf of a nationwide class and several subclasses of individuals who allegedly have been harmed by StockX's failure to protect their confidential and personal information and by StockX's deceptive statements relating to the data breach.

StockX moves to compel arbitration and dismiss the complaint. StockX's motion is fully briefed.

III. ANALYSIS

Because the Court grants StockX's motion to compel arbitration, it is unnecessary to discuss StockX's other grounds for dismissal. The Court deems those arguments MOOT.

A. The Federal Arbitration Act

The Federal Arbitration Act ("FAA"), 9 U.S.C. § 1 et seq., provides that a written agreement to arbitrate disputes arising out of a transaction ininterstate commerce "shall be valid, irrevocable, and enforceable, save upon such grounds as exist at law or in equity for the revocation of any contract." 9 U.S.C. § 2. The FAA "places arbitration agreements on an equal footing with other contracts, and requires courts to enforce them according to their terms." Rent-A-Center, West, Inc. v. Jackson, 561 U.S. 63, 67 (2010). "To enforce this dictate, the [FAA] provides for a stay of proceedings when an issue is referable to arbitration and for orders compelling arbitration when one party has failed or refused to comply with an arbitration agreement." Javitch v. First Union Sec., Inc., 315 F.3d 619, 624 (6th Cir. 2003) (citing 9 U.S.C. §§ 3 and 4).

Section 4 of the FAA provides the procedure the Court follows when presented with a petition to compel arbitration:

A party aggrieved by the . . . refusal of another to arbitrate under a written agreement for arbitration may petition any United States district court . . . for an order [compelling arbitration]. . . The court shall hear the parties, and upon being satisfied that the making of the agreement for arbitration or the failure to comply therewith is not in issue, the court shall . . . order . . . the parties to proceed to arbitration in accordance with the terms of the agreement. . . If the making of the arbitration agreement [is] in issue, the court shall proceed [to trial].

9 U.S.C. § 4. While the FAA...