Page 1
Court of Appeal:
Discovery Rule Can Apply in Civil Enforcement Actions
Opinion Says City Attorney Is Not Barred From Invoking Doctrine to Delay Accrual of Claim in Case Against Experian Over Alleged Failure to Notify Consumers of Data Breach, Even in Absence of Fraud
By Kimber Cooley, associate editor
Div. Three of the Fourth District Court of Appeal held Friday, in what it noted is a “case of first impression,” that a governmental authority may invoke the discovery rule to delay the accrual of a non-fraud cause of action in a civil enforcement action under a consumer protection statute.
The justices found inapplicable the 2013 U.S. Supreme Court opinion in Gabelli v. Securities and Exchange Commission which held that the discovery rule cannot be applied “where the plaintiff is…the government bringing an enforcement action for civil penalties.” Div. Three said the U.S. high court decision involved the application of federal rather than California law which applies the rule more liberally.
The dispute arose after the San Diego City Attorney’s Office filed a complaint, on March 6, 2018, against the Costa Mesa-based credit bureau Experian Data Corp., asserting a single cause of action for a violation of the Unfair Competition Law (“UCL”), codified at Business and Professions Code §17200 et seq.
Prompt-Notice Requirement
Specifically, the complaint alleges that Experian failed to promptly provide notice of a data breach as required by Civil Code §1798(a), which provides that a business that manages data that includes certain personal encrypted information must disclose a breach “in the most expedient time possible” while taking into account the “legitimate needs of law enforcement” relating to ongoing criminal investigations.
Seeking civil penalties and an order requiring Experian to give notice to the victims, the complaint alleges:
“By at least November 2012, Defendants discovered or were informed that over the course of 18 months, Defendants had wrongfully given identity thieves and fraudsters ongoing unlawful access to their consumer [personal identifying information] (the “Security Lapse”). This includes the [personal information] of millions of California residents, hundreds of thousands of whom live in the City of San Diego. Despite the express command of California statute, Defendants have never notified these victims of the Security Lapse that the Security Lapse occurred.”
Experian did not detect the breach until it was notified by federal investigators that 19-year-old Vietnamese hacker Heiu Minh Ngo had been posing as a private investigator based in the U.S. and obtaining consumer data through permitted inquiries. Ngo then sold the personal information online.
Pre-Trial Motions
The defendant filed a motion for summary judgment based on the statute of limitations, pointing out that the governing limitations period is four years and asserting that there is no dispute that the breach of its obligations under §1798.82 occurred in September 2013—more than four years before the March 6, 2014 complaint was filed.
Retired Kern Superior Court Judge Richard Oberholzer, sitting on assignment, rejected Experian’s argument that Gabelli governs and preclude application of the discovery rule.
Oberholzer was unpersuaded that all parties were on inquiry notice in 2013 based on news articles and congressional hearings that followed the unsealing of the indictment against Ngo in October 2013, reasoning that the question was not when the city attorney had reason to know of the breach but when it was on inquiry notice that the bureau had not promptly notified the victims.
He noted that an Experian representative testified, during a late 2013 Congressional hearing, that the company knew the identity of those who had their data stolen and would “make sure they are protected;” however, the testimony was corrected on March 18, 2024, when the company admitted it did not know the identity of the affected parties. Oberholzer concluded that March 18, 2024 was the date of discovery.
Experian’s Contention
Before trial, Experian moved to exclude evidence relating to civil penalties, arguing again that the claim was “time-barred and not subject to the discovery rule.”
The defendant asserted that the same reasons given by the high court in Gabelli for rejecting the application of the discovery rule applied in the present case—that governmental agencies have investigatory duties and tools unavailable to the ordinary plaintiff, that civil penalty actions seek remedies that go beyond compensation, and that it is inherently difficult to determine when a claim was first discovered when a state actor is involved.
Orange Superior Court Judge Donald F. Gaffney agreed with the defendant and granted the motion, saying that no case has applied the discovery rule to delay the accrual of a non-fraud UCL claim or to civil enforcement actions by governmental agencies. The parties stipulated to the entry of judgment in favor of Experian on March 14, 2023.
Justice Thomas A. Delaney authored the opinion reversing the judgment and finding Gabelli and its progeny inapplicable, saying:
“The holding in those cases that the discovery rule should not apply to governmental actions seeking civil penalties was reached under [federal] legal precedent….In contrast, under California law, where the statute is silent on accrual, it is presumed that the discovery rule will apply absent adverse equitable factors.”
Acting Presiding Justice Thomas M. Goethals and Justice Maurice Sanchez joined in the opinion.
Government Actor
Delaney said that “the fact that the instant matter is an enforcement action seeking civil penalties does not preclude application of the discovery rule.” He noted that “[a]s for enforcement actions brought by governmental entities, the Legislature has codified the discovery rule for numerous enforcement actions.”
Saying that the statute of limitations applicable to the False Advertising Law (“FAL”), contained Government Code §17500 et seq., “is particularly illustrative.” It provides that an action commenced under the section “shall not be deemed to have accrued until the discovery by the aggrieved party, the Attorney General, the district attorney, the county counsel, the city prosecutor, or the city attorney of the facts constituting grounds for commencing the action.”
He reasoned that “[i]n light of the similarities between the UCL and FAL, the common law discovery rule should apply to enforcement action seeking civil penalties under the UCL.”
Turning to Gaffney’s concerns over “when the [city attorney], as opposed to an individual, knew or reasonably” should have known of the wrongdoing and “who is the relevant actor” for the purpose of discovery, the jurist wrote:
“No legal authority supports the proposition that the difficulty in determining actual knowledge or constructive notice precludes invocation of the discovery rule. The People have the burden of proof concerning the discovery rule, and any difficulty in proof is accounted for under that burden.”
He continued:
“We need not decide the issue [of who the relevant actor is] because the trial court made no finding on whether a relevant actor was on notice of circumstances sufficient ‘to put a reasonable person on inquiry.’….It is not impossible to make a finding on inquiry notice, and the record does not conclusively establish the discovery rule would not save the UCL claim. The trial court thus erred in concluding the City Attorney could not invoke the discovery rule.”
Non-Fraud Claim
The justice acknowledged that the discovery rule most commonly applies when a defendant intentionally hides misconduct by means of fraud or misrepresentation but said “[a]lthough the discovery rule has been applied to causes of action involving fraud, professional negligence or breach of a fiduciary duty, the discovery rule is not limited only to those claims.”
Looking to the facts of the present case, he opined:
“Here, the predicate violation was Experian’s alleged failure to notify individuals affected by the data breach in a timely manner. Whether Experian breached this disclosure obligation depends on the ‘legitimate needs’ of the criminal investigation and the reasonableness of any delay….The record indicates the data breach was not publicly known until the criminal indictment was unsealed in October 2013. Even after the…breach was revealed, Experian made public statements in March 2014 that it was working to investigate the data breach and protect affected individuals. Thus, it would be particularly difficult to ascertain if or when Experian breached its disclosure duties. These circumstances support application of the discovery rule to delay accrual of the instant UCL claim notwithstanding the lack of fraud or misrepresentation.”
Delaney declared:
“In light of our conclusion that the City Attorney can invoke the discovery rule, the trial court’s orders granting Experian’s motion in limine and denying reconsideration are vacated. The matter is remanded for the trial court to reconsider how the discovery rule will apply in this case, e.g., determine when the UCL claim accrued based on the actual or constructive knowledge of the relevant actors.”
The case is People v. Experian Data Corp., 2024 S.O.S. 3602.
In October 2015, Experian announced another breach of its computer systems which exposed approximately 15 million Social Security numbers and other personal information of individuals who applied for financing from T-Mobile USA Inc. In the announcement, the company said it would be notifying affected consumers by mail.
Copyright 2024, Metropolitan News Company