ORDER GRANTING DEFENDANT'S MOTION TO DISMISS

MARSHA J. PECHMAN, District Judge.

THIS MATTER comes before the Court on Defendant's Motion to Dismiss, (Dkt. No. 24). Having reviewed the Motion, Plaintiffs' response, (Dkt. No. 35), Defendant's reply, (Dkt. No. 36), and the related record, the Court hereby GRANTS the Motion. For reasons stated in this Order, the dismissal is without prejudice.

Background

The following facts are alleged in Plaintiffs' Amended Complaint. (Dkt. No. 13.) Defendant PNI Digital Media, Inc. provides a proprietary transactional software platform that is used by retailers such as Costco, CVS Pharmacy, and Rite Aid to sell personalized photo services and products to consumers. (Id. at 5.)

Between approximately June 2014 and July 2015, Defendant was subject to a data breach during which hackers stole the personal financial information of numerous individuals whose information was included in Defendant's electronic records. (Id. at 1.) The personal and financial information obtained by the hackers included names, telephone numbers, mailing addresses, email addresses, usernames, hashed passwords, and credit card information (including card numbers, expiration dates, and verification codes). (Id.)

Plaintiffs B.J.F. and T.A.N. utilized Defendant's software platform and provided sensitive personal and/or financial information to Defendant. (Id. at 5-7.) Their sensitive personal and/or financial information was compromised in the data breach. (Id. at 11.) In September 2015, Plaintiffs received notice of the data breach from the retailers through whom they utilized Defendant's software platform. (Id. at 9-10.)

Plaintiffs commenced this suit against Defendant on October 14, 2015, and assert claims for negligence, breach of implied contract, breach of contract, bailment, violations of the Georgia, Hawaii and Washington data breach statutes, and unjust enrichment arising out of the data breach. (Dkt. Nos. 1, 13.) Plaintiffs seek to represent a class of all United States citizens whose personal information was compromised by the data breach. (Dkt. No. 13 at 13.)

Defendant now moves to dismiss Plaintiffs' Amended Complaint under Fed. R. Civ. P. 12(b)(1), (2), (3), and (6), arguing Plaintiffs lack standing, Plaintiff T.A.N. cannot establish proper venue or personal jurisdiction over Defendant, and that Plaintiffs do not state a claim upon which relief can be granted. (Dkt. No. 24.) Plaintiffs oppose the motion. (Dkt. No. 35.)

Discussion

I. Legal Standards

A. Article III Standing

To have standing, a plaintiff must plead and prove she has suffered sufficient injury to satisfy the "case or controversy" requirement of Article III of the United States Constitution. See Clapper v. Amnesty Int'l USA, 133 S.Ct. 1138, 1147 (2013). Specifically, a plaintiff must allege an "injury-in-fact" that is (1) "concrete, particularized, and actual or imminent," (2) "fairly traceable to the defendant's challenged action," and (3) "redressable by a favorable ruling." Id. Mere "allegations of possible future injury are not sufficient." Id. Thus when a plaintiff seeks to establish standing based on a potential future injury, it "must be certainly impending to constitute injury in fact." Id.

B. Personal Jurisdiction and Venue

Under Rules 12(b)(2) and 12(b)(3), Plaintiffs bear the burden of showing that venue and personal jurisdiction are proper. Design Res., Inc. v. Leather Indus. of Am., Inc., 2010 WL 342181, at *1-2 (W.D. Wash. Jan. 21, 2010) (venue) (citations omitted); Ranza v. Nike, Inc., 793 F.3d 1059, 1068 (9th Cir. 2015) (personal jurisdiction).

General jurisdiction requires "affiliations so continuous and systematic as to render the foreign corporation essentially at home in the forum State." Ranza v. Nike, Inc., 793 F.3d 1059, 1069 (9th Cir. 2015). "Specific jurisdiction exists when a case arises out of or relates to the defendant's contacts with the forum." Id. at 1068.

Venue is proper in the district where "a substantial part of the events or omissions giving rise to [plaintiff's] claim occurred," or in which defendant resides. 28 U.S.C. §1391(b)(1) & (2). For purposes of venue, a corporation's residence turns on whether it "is subject to the court's personal jurisdiction with respect to the civil action in question . . ." 28 U.S.C. §1391(c)(2).

II. Standing Plaintiff B.J.F.

Defendant argues the Court should dismiss Plaintiff B.J.F.'s claims because Plaintiff B.J.F. lacks standing. (Dkt. No. 24 at 10-12.) Specifically, Defendant contends Plaintiff B.J.F. fails to allege injury, because she did not disclose any sensitive personal or financial information on the Costco photo website hosted by Defendant. (Id. at 11.) Defendant points to the fact that Plaintiff B.J.F. is an attorney, and has publicly listed her name, work email address, and phone number on her firm's Internet website. (Id.) Defendant offers evidence that this is the same information Plaintiff B.J.F. provided on the Costco photo website. (Dkt. No. 25 at 3.) Defendant argues that although Plaintiff B.J.F. did provide her password on the website, she does not allege that she failed to reset her password after receiving notice of the data breach from Costco, nor does she allege any misuse of the password before she reset it. (Dkt. No. 24 at 11.)

Plaintiffs do not dispute that Plaintiff B.J.F. did not disclose payment card information on the Costco photo website, or that Plaintiff B.J.F. publicly listed her name, work email address, and phone number on her firm's Internet website. (Dkt. No. 35 at 14-15.) Instead, they argue while Plaintiff B.J.F. may not have disclosed payment card information on the retailer's website, disclosure of her password is sufficient to confer standing. (Id.) In a declaration offered in support of Plaintiffs' response brief, Plaintiff B.J.F. states that the password she used on the Costco photo website "was substantially the same, and in some cases exactly the same, as passwords that [she] used for other accounts . . ." (Dkt. No. 35-1 at 3.) Plaintiffs contend "by the time [Plaintiff B.J.F] received notice from Costco regarding the breach on September 29, 2015, hackers had access to [her] password for over 15 months." (Dkt. No. 35 at 14.)

The Court finds Plaintiff B.J.F fails to allege injury sufficient to confer standing. Plaintiff B.J.F.'s testimony that the password she disclosed on the Costco photo website hosted by Defendant was the same password she used for other accounts is insufficient to confer standing because: (1) Plaintiff B.J.F. does not describe the nature of the other accounts that she used the same password for; and (2) Plaintiff B.J.F. does not explain how she would be harmed if those other accounts were accessed by hackers. On this record, the Court cannot conclude any potential future injury to Plaintiff B.J.F. is "certainly impending." Clapper, 133 S. Ct. at 1147. Therefore, the Court GRANTS Defendant's Motion to Dismiss as to all claims asserted by Plaintiff B.J.F. on the grounds that Plaintiff B.J.F. lacks standing. However, the dismissal is without prejudice.

III. Personal Jurisdiction and Venue

In the Amended Complaint, Plaintiffs allege that "Defendant PNI is a corporation organized and existing under the laws of the Canadian province of British Columbia, with its principal place of business and headquarters in Vancouver, British Columbia." (Dkt. No. 13 at 4.)

Defendant argues the Court should dismiss Plaintiff T.A.N.'s claims because she cannot establish personal jurisdiction and venue. (Dkt. No. 24 at 15-17.) Specifically, Defendant contends: (1) the Court lacks general jurisdiction over Defendant; (2) the Court lacks specific jurisdiction over Defendant; and (3) no part of the events giving rise to Plaintiff T.A.N.'s claims took place in this district. (Id.)

Plaintiffs argue the Court has specific jurisdiction over Defendant because: (1) Defendant regularly conducts business in Washington, and has sufficient minimum contacts in Washington; and (2) one of Defendant's largest sources of customers is the retail chain Costco, which has numerous stores and operational facilities, including its headquarters, in Washington State. (Dkt. No. 35 at 15-17.) Plaintiffs contend that because the Court has personal jurisdiction over Defendant, venue is proper in this district. (Id. at 15.)

Plaintiffs' arguments are unavailing. Plaintiff T.A.N. is a Georgia resident, who purchased her photos from CVS, a Rhode Island company. (Dkt. No. 13 at 3-4.) The Amended Complaint is silent as to how CVS came to use Defendant's software platform. (Id.) There are also no facts in the Amended Complaint that show that Plaintiff T.A.N.'s use of Defendant's software platform is connected to the state of Washington. (Id.) Although Plaintiffs offer evidence that there are CVS locations in this District, (Dkt. No. 35 at 17), this is insufficient to show that Plaintiff T.A.N.'s claims arise out of or are related to any activities in Washington. Therefore, the Court concludes it lacks specific jurisdiction over Defendant with respect to Plaintiff T.A.N.'s claims. And, because it lacks personal jurisdiction over Defendant, the Court also finds venue is improper in this district. 28 U.S.C. §1391(b)(1) & (2).

Based on the foregoing, the Court GRANTS Defendant's Motion to Dismiss as to Plaintiff T.A.N.'s claims on the grounds that Plaintiff T.A.N. cannot establish personal jurisdiction and venue. The dismissal is without prejudice.

Conclusion

The Court GRANTS Defendant's Motion to Dismiss, (Dkt. No. 24), and DISMISSES the claims asserted by Plaintiffs in this action. For reasons stated in this Order, the dismissal is without prejudice.

The clerk is ordered to provide copies of this order to all counsel.