People v. Experian Data Corp.

Filed 11/15/24

CERTIFIED FOR PUBLICATION

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

FOURTH APPELLATE DISTRICT

DIVISION THREE

THE PEOPLE,

Plaintiff and Appellant, G062674

v. (Super. Ct. No. 30-2019- 01047183) EXPERIAN DATA CORP., OPINION Defendants and Respondents.

Appeal from a judgment of the Superior Court of Orange County, Donald F. Gaffney, Judge. Reversed and remanded with directions. Mara W. Elliott, City Attorney, Mark Ankcorn and Kevin King, Deputy City Attorneys, and Blood Hurst & O’Reardon, Timothy G. Blood, Leslie E. Hurst and Paula R. Brown for Plaintiff and Appellant. Jones Day, Nathaniel P. Garrett, Richard J. Grabowski, John A. Vogt and Ryan D. Ball, for Defendant and Respondent.

In this case of first impression, we are asked to determine whether the discovery rule can apply to delay the accrual of a non-fraud civil enforcement action brought by the San Diego City Attorney (City Attorney), pursuant to the unfair competition law (UCL), as set forth in Business and 1 Professions Code section 17200 et seq. We conclude the City Attorney can invoke the discovery rule. Accordingly, we reverse and remand for further proceedings. I PROCEDURAL HISTORY A. Complaint, Demurrer, and Summary Judgment Motions On March 6, 2018, the City Attorney, on behalf of the People of the State of California, filed a complaint for civil penalties, alleging a single cause of action for violation of the UCL against Experian. The predicate violation was the failure of Experian to promptly provide notice to consumers following discovery of a data breach as required by Civil Code section 2 1798.82(a). The original complaint sought only civil penalties, but in the Second Amended Complaint, the operative complaint in this matter, the City Attorney also sought injunctive relief, specifically, an order requiring Experian to give notice to California victims. The UCL claim is subject to a four-year limitation period, and Experian demurred to the complaint on statute of limitations ground. The

1 All further statutory references are to the Business & Professions Code unless otherwise stated. 2 We deny the City Attorney’s request for judicial notice of certain documents, including the legislative history of Civil Code section 1798.82, the San Diego City Charter, and various websites, because the submitted materials are not relevant to our disposition.

trial court (Judge Nathan Scott) overruled the demurrer, concluding the complaint does not show “on its face the UCL claim accrued before 3/6/14.” The parties subsequently filed summary judgment motions, and the trial court (Judge Richard Oberholzer) denied the motions. Experian’s summary judgment motion was based on the statute of limitations. As noted by the trial court, “[t]he parties are in agreement that [Experian] first breached its obligations under Civil Code [section] 1798.82 (the predicate act supporting the UCL claim) on September 6, 2013, which is more than 4-years [sic] prior to the initiation of this action.” Thus, the action is untimely unless an equitable exception applies to delay accrual. In denying Experian’s summary judgment motion, the trial court first distinguished Gabelli v. S.E.C. (2013) 568 U.S. 442 (Gabelli), in which the U.S. Supreme Court held the discovery rule cannot be applied to delay accrual of an action “where the plaintiff is not a defrauded victim seeking recompense, but is instead the government bringing an enforcement action for civil penalties.” (Id. at p. 449.) The trial court noted that under federal law, the application of common-law discovery rule to delay accrual of actions is “‘very limited’” and must be used with ‘’great caution.”’ (Id. at p. 454.) In contrast under California common law, the delayed discovery rule should be applied to actions unless expressly precluded. Moreover, Gabelli is factually distinguishable because the instant action sought injunctive relief in addition to civil penalties. The trial court further concluded the undisputed facts did not preclude application of the delayed discovery rule. The court rejected Experian’s argument that the City Attorney was on inquiry notice throughout 2013 and early 2014 based on: news articles from the period discussing the data breach; congressional hearings in late 2013 concerning

this topic; the criminal indictment of the perpetrator of the data breach, which was unsealed on October 17, 2013; and 2013 litigation between Experian and the former owner of the consumer data which was stolen. The court found the new articles contained no reference to Experian or its alleged failure to provide notice to affected individuals. Likewise, the publicly available court documents did not put the City Attorney on inquiry notice of Experian’s failure to provide notice to affected individuals. Finally, the court found the record supported a discovery date of March 18, 2014, which is “within 4 years of the filing on this action on March 6, 2018.” The record showed that in congressional hearings, an Experian representative stated Experian knew the individuals who had their data stolen and “‘we are going to make sure they are protected.’” However, on March 18, 2014, this testimony was corrected to state that Experian did not know the affected individuals. Thus, it can be inferred that on this date, the City Attorney was on inquiry notice that Experian would not provide notice to affect individuals pursuant to Civil Code section 1798.82. B. Experian’s Motion In Limine Before trial, Experian moved to exclude evidence relating to civil penalties, arguing the “claim for civil penalties is time-barred and not subject to the discovery rule.” In its motion in limine, Experian argued the same reasons for rejecting the discovery rule in Gabelli, supra, 568 U.S. 442, apply with equal force to the instant action. Those reasons include: (1) governmental agencies are in a state of constant investigation and have enforcement tools not available to the ordinary plaintiff; (2) civil penalty actions seek remedies beyond compensation; and (3) the inherent difficulty in determining when the claim is first discovered and by whom when governmental entities are involved.

Over the City Attorney’s opposition, the trial court granted Experian’s motion. The court first found that the UCL claim accrued on September 6, 2013, based on the City Attorney’s responses to interrogatories. It rejected the City Attorney’s argument that Experian’s public statements in late 2013 and early 2014 that it was working to identify affected individuals altered this accrual date or created an additional accrual date. The court then “conclude[d] that the delayed discovery rule may or may not apply to a 3 UCL action depending on the nature of the claim asserted.” However, “[t]he court, for two reasons, [found] that the . . . discovery rule does not apply in the instant case.” First, no case has applied the discovery rule to delay accrual of a non-fraud UCL claim. Second, no case has applied the discovery rule to enforcement actions seeking civil penalties. The court thus declined “to extend the . . . discovery rule to governmental actions seeking the imposition of civil penalties.” On December 12, 2022, the City Attorney moved for reconsideration of the court’s order granting Experian’s motion in limine. The City Attorney asserted that five days after the court’s order, she learned for the first time that Experian had entered into a tolling agreement with the California Attorney General, which would toll the limitations period of the

3 Although the trial court used the term “delayed discovery rule,” we will use the term “discovery rule” in accordance with the practice of our Supreme Court. Both terms refer to the common-law rule delaying accrual of a claim until the plaintiff discovers, or should have discovered, the claim. (See, e.g., Jolly v. Eli Lilly & Co. (1988) 44 Cal.3d 1103, 1109, fn. omitted (Jolly) [“The discovery rule provides that the accrual date of a cause of action is delayed until the plaintiff is aware of her injury and its negligent cause”].)

instant UCL claim. The trial court denied the motion, concluding the City Attorney failed to produce admissible evidence such a tolling agreement existed. The City Attorney also moved for leave to file a Third Amended Complaint to allege, among other things, the UCL claim under the unlawful and unfair prongs of the UCL for Experian’s misrepresentations that it would locate and protect individuals affected by the data breach. The trial court denied the motion on the ground that the proposed amendments would not affect the court’s order. Thereafter, on March 14, 2023, the parties stipulated to the dismissal of the entire complaint, including the claim for injunctive relief, and requested the court enter judgment in favor of Experian. The stipulation noted: “the People and [Experian] agree that if presented with a proper motion concerning the People’s UCL claim for injunctive relief, the Court would apply the same reasoning from its . . . order, with the same result.” Following entry of judgment, the City Attorney appealed. II DISCUSSION A. Applicable Law The City Attorney argues the trial court erred in granting Experian’s motion to preclude evidence of civil penalties based on the statute of limitations. Generally, a superior court’s ruling on a motion in limine is reviewed for an abuse of discretion. (Tudor Ranches, Inc. v. State Comp. Ins. Fund (1998) 65 Cal.App.4th 1422, 1431.) However, where the court’s ruling “precludes an entire cause of action, the ruling is subject to independent review on appeal as though the court had granted a motion for nonsuit.” (Kinda v. Carpenter (2016) 247 Cal.App.4th 1268, 1279.) Experian argues we

should apply an abuse of discretion standard because the court’s in limine ruling only excluded evidence of civil penalties, and did not touch the injunctive relief portion of the UCL claim. However, the trial court’s conclusion that the claim for civil penalties is time-barred would apply with equal force to the claim for injunctive relief. Thus, “[w]e will independently review the granting of defendant’s motion in limine, viewing the record in the light most favorable to plaintiff[ ] and determining whether the evidence and inferences were sufficient to support a judgment in defendant’s favor.” (Id., at p. 1282) Moreover, the ruling concerns “[t]he application of the statute of limitations on undisputed facts[, which] is a purely legal question.” (Aryeh v. Canon Business Solutions, Inc. (2013) 55 Cal.4th 1185, 1191 (Aryeh).) Accordingly, we review de novo whether the discovery rule applies to delay accrual of the UCL claim. “An affirmative defense, the statute of limitations exists to promote the diligent assertion of claims, ensure defendants the opportunity to collect evidence while still fresh, and provide repose and protection from dilatory suits once excess time has passed. [Citations.] The duration of the limitations period marks the legislatively selected point at which, for a given claim, these considerations surmount the otherwise compelling interest in adjudicating on their merits valid claims. [Citations.]” (Aryeh, supra, 55 Cal.4th at p. 1191.) The UCL has a four-year limitations period. (Id. at p. 1192.) “The limitations period, the period in which a plaintiff must bring suit or be barred, runs from the moment a claim accrues. [Citations.] Traditionally at common law, a ‘cause of action accrues “when [it] is complete with all of its elements”—those elements being wrongdoing, harm, and causation.’ [Citations.] This is the ‘last element’ accrual rule: ordinarily, the

statute of limitations runs from ‘the occurrence of the last element essential to the cause of action.’ [Citations.]” (Aryeh, supra, 55 Cal.4th at pp. 1191- 1192.) Here, the City Attorney does not challenge the trial court’s finding that under the last element rule, the UCL claim accrued on September 6, 2013. “To align the actual application of the limitations defense more closely with the policy goals animating it, the courts and the Legislature have over time developed a handful of equitable exceptions to and modifications of the usual rules governing limitations periods. These doctrines may alter the rules governing either the initial accrual of a claim, the subsequent running of the limitations period, or both. The “‘most important’” of these doctrines, the discovery rule, where applicable, ‘postpones accrual of a cause of action until the plaintiff discovers, or has reason to discover, the cause of action.’ [Citations].” (Aryeh, supra, 55 Cal.4th at p. 1192.) “The discovery rule provides that the accrual date of a cause of action is delayed until the plaintiff is aware of her injury and its negligent cause. [Citation.] A plaintiff is held to her actual knowledge as well as knowledge that could reasonably be discovered through investigation of sources open to her. [Citation.]” (Jolly, supra, 44 Cal.3d at p. 1109, fn. omitted.) The latter is referred to as inquiry notice. A plaintiff is on inquiry notice “when the plaintiff suspects or should suspect that her injury was caused by wrongdoing, that someone has done something wrong to her.” (Id. at p. 1110, fn. omitted.) “A plaintiff need not be aware of the specific ‘facts’ necessary to establish the claim; that is a process contemplated by pretrial discovery. Once the plaintiff has a suspicion of wrongdoing, and therefore an incentive to sue, she must decide whether to file suit or sit on her rights. So

long as a suspicion exists, it is clear that the plaintiff must go find the facts; she cannot wait for the facts to find her.” (Id. at p. 1111.) Where a statute is silent on the applicability of common law accrual rules, we presume “the Legislature intended the well-settled body of law that has built up around accrual, including the traditional last element rule and its equitable exceptions, to apply fully . . . .” (Aryeh, supra, 55 Cal.4th at p. 1193.) Because the UCL is silent on accrual, it “is governed by common law accrual rules to the same extent as any other statute. That a cause of action is labeled a UCL claim is not dispositive; instead, ‘the nature of the right sued upon’ [citation] and the circumstances attending its invocation control the point of accrual. The common law last element accrual rule is the default [citation], while exceptions to that rule apply precisely to the extent the preconditions for their application are met, as would be true under any other statute.” (Id. at p. 1196.) B. Application of Discovery Rule to the Instant UCL Claim Here, the trial court concluded the discovery rule should not apply to delay the accrual of the UCL claim based on: (1) the nature of the claim – a UCL claim not involving fraud or misrepresentation; (2) the nature of the action – an enforcement action seeking civil penalties; and (3) the nature of the plaintiff – a governmental entity. We address each reason seriatim. 1. Non-Fraud UCL Claim “[T]he discovery rule most frequently applies when it is particularly difficult for the plaintiff to observe or understand the breach of duty, or when the injury itself (or its cause) is hidden or beyond what the ordinary person could be expected to understand.” (Shively v. Bozanich (2003) 31 Cal.4th 1230, 1248.) Thus, where a defendant intentionally hides the

breach of duty or injury by means of fraud or misrepresentation, the discovery rule would apply. (Cf. Code Civ. Proc., § 338, subd. (d) [“An action for relief on the ground of fraud or mistake. The cause of action in that case is not deemed to have accrued until the discovery, by the aggrieved party, of the facts constituting the fraud or mistake”].) Likewise, where a fiduciary hides a breach of duty, the discovery rule applies because it “vindicates the fiduciary duty of full disclosure; it prevents the fiduciary from obtaining immunity for an initial breach of duty by a subsequent breach of the obligation of disclosure.” (Neel v. Magana, Olney, Levy, Cathcart & Gelfand (1971) 6 Cal.3d 176, 189.) Finally, “[i]n professional malpractice cases, . . . delayed accrual is justified on the basis that the expertise expected of professionals is beyond the ability of laypersons to evaluate, and on the further basis that it may be impossible for a layperson even to observe the professional’s application of this expertise.” (Shively, at p. 1248.) Although the discovery rule has been applied to causes of action involving fraud, professional negligence or breach of a fiduciary duty, the discovery rule is not limited only to those claims. (Gryczman v. 4550 Pico Partners, Ltd. (2003) 107 Cal.App.4th 1, 5.) For example, in Shively, supra, 31 Cal.4th 1230, the Supreme Court noted that for defamation claims, the discovery rule “has been applied when the defamatory statement is hidden from view as, for example, in a personnel file that generally cannot be inspected by the plaintiff.” (Id. at p. 1249.) In Gryczman, the appellate court applied the discovery rule to delay accrual of a breach of contract claim that did not involve fraud or fiduciaries or professional negligence. (See Gryczman, supra, 107 at pp. 3-4 [applying discovery rule to breach of contract claim based on failure to provide contractual notice].) As the court explained, “application of the discovery rule [i]s not governed by the presence of

deliberate concealment or a heightened level of duty to the plaintiff but by two overarching principles: ‘[p]laintiffs should not suffer where circumstances prevent them from knowing they have been harmed’ and ‘defendants should not be allowed to knowingly profit from their injuree’s ignorance.’” (Id. at pp. 5-6, fn. omitted, quoting April Enterprises, Inc. v. KTTV (1983) 147 Cal.App.3d 805, 831.) Here, the predicate violation was Experian’s alleged failure to notify individuals affected by the data breach in a timely manner. Whether Experian breached this disclosure obligation depends on the “legitimate needs” of the criminal investigation and the reasonableness of any delay. (See Civ. Code, § 1798.82, subd. (a) [“A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California . . . . The disclosure shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement . . .”].) The record indicates the data breach was not publicly known until the criminal indictment was unsealed in October 2013. Even after the date breach was revealed, Experian made public statements in March 2014 that it was working to investigate the data breach and protect affected individuals. Thus, it would be particularly difficult to ascertain if or when Experian breached its disclosure duties. These circumstances support application of the discovery rule to delay accrual of the instant UCL claim notwithstanding the lack of fraud or misrepresentation. 2. Enforcement Action Seeking Civil Penalty Similarly, the fact that the instant matter is an enforcement action seeking civil penalties does not preclude application of the discovery

rule. For example, in Montalti v. Catanzariti (1987) 191 Cal.App.3d 96, the appellate court held that the discovery rule applies to an action seeking civil penalties under the Invasion of Privacy Act (Pen. Code, § 630 et seq.), for a defendant’s eavesdropping by means of an extension telephone. (Id. at pp. 98- 100.) The court found the applying the discovery rule was appropriate because “secret monitoring of private conversations is conduct not subject to contemporary reasonable discovery.” (Id. at p. 99.) As for enforcement actions brought by governmental entities, the Legislature has codified the discovery rule for numerous enforcement actions. For example, “[a]n action commenced under the Porter-Cologne Water Quality Control Act (Division 7 (commencing with Section 13000) of the Water Code . . . shall not be deemed to have accrued until the discovery by the State Water Resources Control Board or a regional water quality control board of the facts constituting grounds for commencing actions under their jurisdiction.” (Code Civ. Proc., § 338, subd. (i).) “An action commenced under Division 26 (commencing with Section 39000) of the Health and Safety Code . . . shall not be deemed to have accrued until the discovery by the State Air Resources Board or by a district, as defined in Section 39025 of the Health and Safety Code, of the facts constituting grounds for commencing the action under its jurisdiction.” (Code Civ. Proc., § 338, subd. (k).) “An action commenced under Section 1602, 1615, or 5650.1 of the Fish and Game Code . . . shall not be deemed to have accrued until discovery by the agency bringing the action of the facts constituting the grounds for commencing the action.” (Code Civ. Proc., § 338, subd. (l).) “An action commenced under Section 4601.1 of the Public Resources Code, if the underlying violation is of Section 4571, 4581, or 4621 of the Public Resources Code, or of Section 1103.1 of Title 14 of the California Code of Regulations, and the underlying violation is

related to the conversion of timberland to nonforestry-related agricultural uses . . . shall not be deemed to have accrued until discovery by the Department of Forestry and Fire Protection.” (Code Civ. Proc., § 338, subd. (o).) The statute of limitations for the false advertising law (FAL), sections 17500 et seq., is particularly illustrative. “An action commenced under Section 17536 of the Business and Professions Code . . . shall not be deemed to have accrued until the discovery by the aggrieved party, the Attorney General, the district attorney, the county counsel, the city prosecutor, or the city attorney of the facts constituting grounds for commencing the action.” (Code Civ. Proc., § 338, subd. (h).) Section 17536, subdivision (a) provides: “Any person who violates any provision of this chapter shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General or by any district attorney, county counsel, or city attorney in any court of competent jurisdiction.” “The provisions of the UCL and FAL that govern the determination of civil penalties are identical.” (People v. Ashford University, LLC (2024) 100 Cal.App.5th 485, 498.) In light of the similarities between the UCL and FAL, the common law discovery rule should apply to enforcement action seeking civil penalties under the UCL. Experian’s reliance on Eisenberg Village etc. v. Suffolk Construction Co., Inc. (2020) 53 Cal.App.5th 1201 is misplaced. In Eisenberg, the appellate court declined to apply the discovery rule to a claim under section 7031, subdivision (b), which allows “any person who utilizes the services of an unlicensed contractor to bring an action for disgorgement of all

compensation paid for the performance of any act or contract, regardless of whether there was any fault in the contractor’s work.” (Id. at p. 1203.) The court concluded there was no equitable basis for the discovery rule because “[a] section 7031(b) claim does not require that the plaintiff suffer any injury, or at least an injury in the sense used by the courts to justify an equitable exception to the ordinary rules of accrual.” (Id. at p. 1213.) The Eisenberg court noted that under section 7031, a plaintiff can seek disgorgement from an unlicensed contractor for a building construction project even if “there are no problems with the construction or the building.” (Id. at p. 1214.) In contrast, although proof of an injury is not required to recover on the instant UCL claim, the complaint does allege individuals affected by the data breach and the subsequent failure to receive timely notice suffered harm. Specifically, the complaint alleges the “ongoing failure to inform victims of the [data breach] so they could take steps to protect their identities and credit is substantially injurious to [the] victims.” These allegations justify application of the discovery rule in this case. Similarly, Experian’s reliance on Gabelli, supra, 568 U.S. 442, and its progeny is misplaced. The holding in those cases that the discovery rule should not apply to governmental actions seeking civil penalties was reached under legal precedent that “the cases in which ‘a statute of limitation may be suspended by causes not mentioned in the statute itself . . . are very limited in character, and are to be admitted with great caution; otherwise the court would make the law instead of administering it.’ [Citation.]” (Id., at p. 454.) In contrast, under California law, where the statute is silent on accrual, it is presumed that the discovery rule will apply absent adverse equitable factors. (Aryeh, supra, 55 Cal.4th at p. 1193.)

3. The People of the State of California as Plaintiff Finally, the trial court determined that the difficulty in applying the discovery rule in cases where the People is the plaintiff weighs against application of the discovery rule. The difficult issues include: “[W]hen the [People], as opposed to an individual, knew or reasonably” knew of the wrongdoing and “[w]ho is the relevant actor?” No legal authority supports the proposition that the difficulty in determining actual knowledge or constructive notice precludes invocation of the discovery rule. The People have the burden of proof concerning the discovery rule, and any difficulty in proof is accounted for under that burden. As to who is the relevant actor for the purposes of the discovery rule, the relevant actor depends on the nature of the action. (See Aryeh, supra, 55 Cal.4th at p. 1196 [application of the discovery rule depends on “‘the nature of the right sued upon’ [citation] and the circumstances attending its invocation”].) For example, in criminal prosecutions brought by the People for insurance fraud where the limitations period begins from the discovery of the crime, “[t]he crucial determination is whether law enforcement authorities or the victim had actual notice of circumstances sufficient to make them suspicious of fraud thereby leading them to make inquiries which might have revealed the fraud.” (People v. Zamora (1976) 18 Cal.3d 538, 571-572.) As noted above, in FAL actions brought on behalf of the People by a city attorney, the relevant actors for the purposes of the discovery rule include “the aggrieved party, . . . , [and] the city attorney . . . .” (Code Civ. Proc., § 338, subd. (h).) Here, the City Attorney is a relevant actor because the City Attorney brought suit on behalf of the People. If the instant action was brought to vindicate the rights of individuals affected by the data breach, those individuals also would be relevant actors. Given that the

Attorney General might have a tolling agreement with Experian concerning claims arising from the data breach, the Attorney General also might be a relevant actor. We need not decide the issue because the trial court made no finding on whether a relevant actor was on notice of circumstances sufficient “‘to put a reasonable person on inquiry.’” (Sanchez v. South Hoover Hospital (1976) 18 Cal.3d 93, 101.) It is not impossible to make a finding on inquiry notice, and the record does not conclusively establish the discovery rule would not save the UCL claim. The trial court thus erred in concluding the City Attorney could not invoke the discovery rule. In light of our conclusion that the City Attorney can invoke the discovery rule, the trial court’s orders granting Experian’s motion in limine and denying reconsideration are vacated. The matter is remanded for the trial court to reconsider how the discovery rule will apply in this case, e.g., determine when the UCL claim accrued based on the actual or constructive knowledge of the relevant actors. Because the court’s order denying the City Attorney’s request to file a third amended complaint was based on the ground that the proposed amendments to the complaint would not revive the time- barred claims, that order also is vacated. The trial court shall reconsider the request after its reconsideration of Experian’s motion in limine, if the City Attorney still desires to file the proposed third amended complaint.

III DISPOSITION The judgment is reversed and the matter remanded for further proceedings in light of this opinion. The City Attorney is entitled to costs on appeal.

DELANEY, J.

WE CONCUR:

GOETHALS, ACTING P.J.

SANCHEZ, J.