1 mark c. mao, bar no. 236165 troutman sanders llp · [email protected] troutman sanders llp...

TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4

36624570 - 1 -DEFENDANT COMPLYRIGHT, INC.’S NOTICE OF REMOVAL TO FEDERAL COURT

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

MARK C. MAO, Bar No. [email protected] TROUTMAN SANDERS LLP 580 California Street, Suite 1100 San Francisco, CA 94104 Telephone: 415.477.5700 Facsimile: 415.477.5710

Attorneys for Defendant ComplyRight, Inc.

UNITED STATES DISTRICT COURT

CENTRAL DISTRICT OF CALIFORNIA

SOUTHERN DIVISION

PAUL CHRISTIANSEN, individually and on behalf of all others similarly situated,

Plaintiff,

v.

ComplyRight, Inc., a Minnesota corporation; and DOES 1-10,

Defendant.

Case No. 8:18-cv-1920

DEFENDANT COMPLYRIGHT, INC.’S NOTICE OF REMOVAL OF CIVIL ACTION UNDER 28 U.S.C. § 1332 AND 28 U.S.C. 1441(b) (DIVERSITY)

TO THE CLERK OF THE ABOVE ENTITLED COURT:

PLEASE TAKE NOTICE THAT defendant ComplyRight, Inc.

(“ComplyRight”) hereby removes to this Court the state court action described

below.

1. Plaintiff Paul Christiansen (“Plaintiff”) brought suit against

ComplyRight in the Superior Court of the State of California, County of Orange, in

Case 8:18-cv-01920 Document 1 Filed 10/25/18 of 5 Page ID #:1

TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

the matter entitled Christiansen v. ComplyRight, Inc., Case Number 30-2018-

01010711-CU-BT-CXC (the “Underlying Action”).

2. A true and correct copy of the (“Complaint”) filed in Orange County

Superior Court in the Underlying Action is attached as Exhibit A to the

concurrently-filed Declaration of Mark C. Mao (“Mao Decl.”). A true and correct

copy of the Summons issued with that Complaint is attached to the Mao Decl. as

Exhibit B.

3. The Complaint was filed on August 7, 2018. ComplyRight was served

with the Complaint and the accompanying Summons on August 17, 2018. A true

and correct copy of the Proof of Service of the Complaint and Summons is attached

to the Mao Decl. as Exhibit C.

4. On September 25, 2018, ComplyRight filed a Notice of Related Case

in the Underlying Action. A true and correct copy of the Notice of Related Case is

attached to the Mao Decl. as Exhibit D.

5. Plaintiff granted ComplyRight a 15-day extension of time to respond

to the Complaint, pursuant to California Rule of Court 3.110, making

ComplyRight’s responsive pleading deadline October 2, 2018. The parties,

however, stipulated and agreed to further extend ComplyRight’s deadline to file an

answer or otherwise respond to the Complaint up to and including November 1,

2018. A true and correct copy of the Stipulation and Order Extending Time for

Defendant ComplyRight, Inc. to Respond to Complaint is attached to the Mao Decl.

as Exhibit E.

6. ComplyRight has not filed a response to the Complaint in the

Underlying Action.

7. The Underlying Action is a civil action of which this Court has

original jurisdiction under 28 U.S.C. § 1332 and is one which may be removed to

this Court by ComplyRight pursuant to the provisions of 28 U.S.C. § 1441(b) in

that it is a civil action between citizens of different states and the matter in


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

controversy exceeds the sum of $75,000, exclusive of interest and costs.

I. DIVERSITY OF CITIZENSHIP

8. This civil action is between citizens of different states.

9. Plaintiff is a citizen of the State of California. (See Mao Decl. ¶ 7.)

10. ComplyRight is a Minnesota corporation. (See Mao Decl. ¶ 8.)

ComplyRight is a citizen of the State of Minnesota within the meaning of 28 U.S.C.

1332(c)(1). ComplyRight is not a citizen of the forum state. Additionally,

ComplyRight is the only defendant named in this action other than unknown DOE

defendants.

II. AMOUNT IN CONTROVERSY

11. The Complaint does not specify an amount in controversy.

12. On September 25, 2018, ComplyRight sent a letter to Plaintiff noting

that Plaintiff failed to allege an amount in controversy in the complaint. (See Mao

Decl. ¶ 9.) A true and correct copy of ComplyRight’s September 25, 2018 letter is

attached to the Mao Decl. as Exhibit G.

13. On September 26, 2018, Plaintiff replied to ComplyRight’s letter but

did not expressly state whether the amount in controversy exceeds $75,000 or not.

(See Mao Decl. ¶ 10.) However, Plaintiff’s response letter confirmed that damages

will be sought on behalf of “a [whole] class of California residents under California

law.” Id. A true and correct copy of Plaintiff’s September 26, 2018 letter

(“Plaintiff’s Letter”) is attached to the Mao Decl. as Exhibit H.

14. On October 25, 2018, counsel for ComplyRight met and conferred

with counsel for Plaintiff and confirmed that Plaintiff is seeking damages on behalf

of an entire California class. Counsel for Plaintiff was not willing to stipulate to

seeking less than $75,000 on behalf of his client and the putative class.1 (Mao Decl.

1 ComplyRight expressly denies Plaintiffs’ allegations, including that it is entitled to any damages whatsoever.


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

¶ 11.)

15. This Notice of Removal of Civil Action to the United States District

Court, Southern Division (“Notice of Removal”) is timely pursuant to 28 U.S.C. §

1446(b)(3) because this action is being removed within thirty (30) days of the date

when ComplyRight received Plaintiff’s Letter, dated September 26, 2018, or

immediately upon Plaintiff’s confirmation that he was seeking more than $75,000

by way of damages on behalf of a California class. Huffman v. Saul Holdings Ltd.

Partnership, 194 F.3d 1072, 1077 (10th Cir. 1999) (finding that plaintiff’s

deposition testimony started removal clock).

III. WRITTEN NOTICE OF REMOVAL

16. Written notice of the filing of this Notice of Removal is being served

on counsel for Plaintiff on October 25, 2018, pursuant to 28 U.S.C. § 1446(d).

Also, pursuant to that section, a copy of this Notice of Removal, as well as the

notice being provided to counsel for Plaintiff, will be promptly filed with the Clerk

of the Orange County Superior Court.

IV. JOINDER OF ALL DEFENDANTS

17. Although fictitious “DOE” defendants are listed on the Complaint, no

defendants (other than ComplyRight) have been properly named or served with the

Complaint.

18. This Notice of Removal is being filed without prejudice to the objects

and defenses of ComplyRight.

19. ComplyRight reserves the right to amend or supplement this Notice of

Removal. In this regard, if any questions arise as to the propriety of the removal of

the Underlying Action, ComplyRight expressly requests the opportunity to present

a brief, oral argument, and any further evidence necessary in support of its position

that this action is removable.


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Dated: October 25, 2018 TROUTMAN SANDERS LLP

By: /s/ Mark C. Mao Mark C. Mao Attorneys for Defendant ComplyRight, Inc.


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4

36625515

DECLARATION OF MARK MAO IN SUPPORT OF NOTICE OF REMOVAL

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Mark C. Mao, Bar No. [email protected] TROUTMAN SANDERS LLP 580 California Street, Suite 1100 San Francisco, CA 94104 Telephone: 415.477.5700 Facsimile: 415.477.5710




SOUTHERN DIVISION

PAUL CHRISTIANSEN, individually and on behalf of all others similarly situated,

Plaintiff,

v.

ComplyRight, Inc., a Minnesota corporation; and DOES 1-10,

Defendant.

Case No. 8:18-cv-1920

DECLARATION OF MARK C. MAO IN SUPPORT OF DEFENDANT COMPLYRIGHT, INC.’S NOTICE OF REMOVAL ACTION UNDER 28 U.S.C. § 1441(b) - DIVERSITY

Case 8:18-cv-01920 Document 1-1 Filed 10/25/18 Page 1 of 4 Page ID #:6

TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4

36625515 - 1 -DECLARATION OF MARK MAO IN SUPPORT OF NOTICE OF REMOVAL

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I, Mark C. Mao, declare as follows:

1. I am an attorney at law duly licensed to practice law in the State of

California and am a partner with the law firm of Troutman Sanders LLP, counsel

for Defendant ComplyRight, Inc. (“ComplyRight”). I submit this Declaration in

support of Defendant ComplyRight, Inc.’s Notice of Removal of Civil Action

Under 28 U.S.C. 1332 and 28 U.S.C. § 1441(b) (Diversity). I have personal

knowledge of the facts set forth in this Declaration, or they are based on my

information and belief, and if called to testify as to the same could competently do

so.

2. On August 7, 2018, Plaintiff Paul Christiansen (“Plaintiff”) filed a

Complaint (“Complaint”) in the Superior Court of California, County of Orange,

Case. No. 30-2018-01010711-CU-BT-CXC, naming ComplyRight as Defendant

(the “Underlying Action”). Attached hereto as Exhibit A is the true and correct

copy of the Complaint, which does not state any specific demand for damages, or

explain the amount in controversy. Attached hereto as Exhibit B is a true and

correct copy of the Summons issued with the Complaint.

3. The Complaint and Summons were served on ComplyRight on August

17, 2018. Attached hereto as Exhibit C is a true and correct copy of the Proof of

Service of the Complaint and Summons.

4. On September 25, 2018, ComplyRight filed a Notice of Related Case

in the Underlying Action. A true and correct copy of the Notice of Related Case is

attached hereto as Exhibit D.

5. ComplyRight immediately sought clarification on the issue of the

amount in controversy. Plaintiff granted ComplyRight a 15-day extension of time

to respond to the Complaint, pursuant to California Rule of Court 3.110, making

ComplyRight’s responsive pleading deadline October 2, 2018. The parties,

however, stipulated and agreed to extend ComplyRight’s deadline to file an answer

or otherwise respond to the Complaint up to and including November 1, 2018. A


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

true and correct copy of the Stipulation and Order Extending Time for Defendant

ComplyRight, Inc. to Respond to Complaint is attached to the Mao Decl. as

Exhibit E.

6. ComplyRight has not filed a response to the Complaint in the

Underlying Action.

7. Plaintiff alleges in Paragraph 9 of the Complaint that he is a resident of

Laguna Beach, California and a citizen of California.

8. ComplyRight is a Minnesota corporation. Attached hereto as Exhibit

F is a true and correct copy of the Minnesota Secretary of State’s website

containing the entity details for ComplyRight, as found on October 19, 2018.

9. On September 25, 2018, I sent a letter to Plaintiff’s counsel, stating

that Plaintiff failed to allege an amount in controversy in the Complaint. A true and

correct copy of ComplyRight’s letter is attached as Exhibit G.

10. On September 26, 2018, Plaintiff, by and through counsel, simply

responded to ComplyRight’s letter by indicating that they are seeking damages. A

true and correct copy of Plaintiff’s letter is attached as Exhibit H.

11. We are removing out of an abundance of caution, after having met and

conferred with Plaintiff and counsel in good faith. If Plaintiff and counsel will

concede that they are not seeking damages or will stipulate to seeking an amount

less than $75,000, we would be willing to remand. We communicated this to

counsel by telephone, as part of a meet and confer, on October 25, 2018. Counsel

for Plaintiff confirmed that Plaintiff is seeking damages on behalf of an entire

California class. And counsel was not willing to stipulate to seeking less than

$75,000 on behalf of his client and the putative class.


TR

OU

TM

AN

SA

ND

ER

S L

LP

58

0C

AL

IFO

RN

IA S

TR

EE

T,

SU

ITE

11

00

SA

N F

RA

NC

ISC

O,

CA

94

10

4


1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I declare under penalty of perjury under the laws of the State of California

that the foregoing is true and correct. Executed this 25th day, of October 2018, at

San Francisco, California.

/s/ Mark C. Mao Mark C. Mao


EXHIBIT A


2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

ELECTRONICALLY FILED Superior Court of California.

County of Orange

FINKELSTEIN & KRINSK LLP 08107/2018 at 04:06:48 PM Jeffrey R. Krinsk, Esq. (SBN 109234) Clerk of the Superior Court [email protected] By Sarah Loos e Deputy Clerk Trenton R. Kashima, Esq. (SBN 291405) [email protected] 550 West C St., Suite 1760 San Diego, California 92101 Telephone: (619) 238-1333 Facsimile: (619) 238-5425

Attorneys for Plaintiff and the Putative Class

SUPERIOR COURT OF THE STATE OF CALIFORNIA

COUNTY OF ORANGE

PAUL CHRISTIANSEN, individually and on Case No: 30-2018-0101071 1-CU-BT-CXC behalf of all others similarly situated,

CLASS ACTION COMPLAINT FOR: Plaintiff,

V. VIOLATION OF CAL. CIVIL CODE §§ 1798.80, erseq.;

COMPLYRIGHT, INC., a Minnesota corporation; and DOES 1-10, VIOLATION OF CAL BUS. &

PROF. CODE §§ 17200, et seq.

Defendants. NEGLIGENCE

JURY TRIAL DEMANDED

Assigned: Judge Glenda Sanders

Dept: CX].0].

I CLASS ACTION COMPLAINT


I Plaintiff Paul Christiansen ("Plaintiff') individually and on behalf of all others similarly

2 situated, based on the investigation of counsel and his own individual knowledge as to Plaintiff's

3 own circumstances, hereby complain against defendant ComplyRight, Incorporated

4 ("ComplyRight") as follows:

5 I. INTRODUCTION

6 1. ComplyRight is a subsidiary is Taylor Corporation and is headquartered in Pompano

7 Beach, Florida. ComplyRight offers cloud-based human resources for other business. Their

8 services include preparing payroll, handling employee related taxes, and ensuring labor law

9 compliance for third-parties.

10 2. On May 22, 2018, thousands of individuals were the victims of a massive data breach

II that resulted in the unauthorized disclosure of tax-related personal information records. Among

12 other things, the data breach resulted in the individuals' names, home and email addresses,

13 telephone numbers, Social Security numbers, salary/income information, 1099 Forms, W-2 Forms,

14 and other tax related information being released and viewed by unauthorized persons.

15 3. This breach occurred because ComplyRight failed to maintain reasonable and

16 adequate security measures to protect the individuals' information from access and disclosure.

17 ComplyRight has a statutory duty. to protect the tax and personal information of third-parties from

18 unauthorized access, yet failed at numerous opportunities to prevent, detect, end, or limit the scope

19 the breach.

20 4. Since the breach, ComplyRight has left affected individuals in the dark about the

21 scope of the breach, how their personal and tax-related information was acquired by ComplyRight,

22 what personal information was disclosed, who had access to the personal information, and what

23 steps ComplyRight is taking to remedy or mitigate the breach. Due to ComplyRight's lack of

24 transparency, individuals have had purchased identity protection services, and take other steps to

25 prevent identity theft, medical identity theft, tax fraud, and financial theft because their Social

26 Security numbers and tax information has yet to be recovered.

27 5. Plaintiff brings this proposed class action lawsuit on behalf of himself and other

28 individuals whose personal information has been compromised as a result of ComplyRight's data

CLASS AcTIoN COMPLAINT


I breach. Plaintiff seeks injunctive relief requiring ComplyRight to implement and maintain security

2 practices to comply with regulations designed to prevent and remedy these types of data breaches,

3 as well as restitution, damages, and other relief.

4 H. JURISDICTION AND VENUE

5 6. This Court has jurisdiction over this action pursuant to Article 6, § 10 of the

6 California Constitution, Code of Civil Procedure §§ 382 and 410.10.

7 7. This Court has jurisdiction over Defendant because it is registered to conduct, and do

8 conduct, substantial business within California, providing Human Resources services to several

9 California business from its California office.

10 8. Venue is proper in this Court pursuant to Code of Civil Procedure § 395 because

II Plaintiff's information was provided to Defendant in this County, and a substantial or significant

12 portion of the conduct complained of herein occurred and continues to occur within this County.

13 III. PARTIES

14 9. Plaintiff Paul Christiansen, and at all times relevant hereto was, a resident of Laguna

15 Beach, California and a citizen of California. In a letter dated July 13, 2018, Plaintiffs received

16 notice from ComplyRight that his tax information had been "accessed and/or viewed, and may have

17 been download or otherwise acquired, by an unauthorized user."

18 10. Defendant ComplyRight is a Minnesota corporation with offices in California and

19 Florida. ComplyRight provides Human Resources services for business, including payroll and legal

20 compliance services.

21 IV. SUBSTANTIVE ALLEGATIONS

22 11. In a form letter dated July 13, 2018 to Plaintiff and other Class members,

23 ComplyRight admitted that a data breach occurred between April 20, 2018 and May 22, 2018 in

24 which Class members' "personal information that was accessed and/or viewed, and may have been

25 downloaded or otherwise acquired, by an unauthorized user included your name, address, telephone

26 number, email address, and Social Security number." This letter was extremely vague about the

27 scope and the cause of the breach, leaving Class members in the dark regarding what exact

28 information was taken or how ComplyRight came to possess it.

-2- CLAss AcTIoN COMPLAINT


3

- -4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

But even based on the limited information available, the scope of the compromised

data is troubling. ComplyRight breach included nearly all the personally identifiable information

necessary to steal a person's identity, including name, address, and Social Security numbers.

Identity thieves can use the W-2 and 1099 Form information stolen in ComplyRight's data breach

to perpetrate a wide variety of crimes, including financial and tax fraud. Additionally,

ComplyRight's website also states that they file Affordable Care Act and Health Insurance

Portability and Accountability Act paperwork on behalf of employers. Accordingly, if the medical

information within these documents were also compromised, the breach could be much worse than

what is currently disclosed.

Stolen tax information (such as the information retained by ComplyRight) permits

identity thieves to commit a host of fraudulent active, including obtaining fraudulent credit cards

and loan accounts, as well as various types of government fraud such as acquiring a driver's license

or identification card in the victim's name but with another's picture, using the victim's information

to obtain government benefits, obtaining a job, procuring housing, or even giving false information

to police during an arrest. Even worse, there are already indications that Plaintiff may have been

victim of identity theft. Shortly after ComplyRight's reported breach, Plaintiff notice unauthorized

charges on his credit card.

Additionally, access to W-2 information permits identity thieves to quickly and easily

file fraudulent tax returns using the victim's information to obtain a fraudulent refund. The Internal

Revenue Service ("IRS") will direct-deposit the refund to the bank account or prepaid debit card

(which are virtually untraceable) provided by the fraudster. According to the IRS, tax-refund fraud

is expected to account for $21 billion in 2016. And if a criminal was to obtain a fraudulent tax

return, the victim may be blocked from obtaining the same tax return (as it has already been

claimed).

But, if the Class's medical information was also compromised then it presents

additional risks. Medical information is highly valuable and is reportedly "worth 10 times more

than [a person's] credit card number on the black market." According to the Office of Inspector

General of the U.S. Department of Health & Human Services, "[m]edical identity theft can disrupt

-3- CLASS AcrioN COMPLAINT


I [a person's] life, damage [] credit rating, and waste taxpayer dollars. The damage can be life-

2 threatening [] if wrong information ends up in [the victim's] personal medical records." However,

3 even without the medical information, Defendant's breach disclosed all the personal information

4 (i.e. name1 address, email address, telephone number, date of birth, and Social Security number)

5 that is necessary to allow even the most unsophisticated criminal to steal a person's identity.

6 16. While ComplyRight's breach is troubling on its own, it also raises additional

7 questions regarding how ComplyRight collects the personal information at issue. As noted by well-

8 known computer security journalist, Brian Krebs, many Class members had no idea that

9 ComplyRight maintained such sensitive personal information:

10 Indeed, many readers who received these letters wrote to KrebsOnSecurity asking for more information, as the company hadn't yet published any details about the breach

11 on its Web site. Also, most of those folks said they'd never heard of Co1nplyRight and could not remember ever doing business with a company by that name.

12 ComplyRight explains that it received individuals personal information from employers for

13

14 preparation of tax reporting forms (such as 1099s or W-2s).2 Nevertheless, many individuals report

that they never worked for an employer with a contract with ComplyRight. 15

17. Indeed, Plaintiff had also never heard of ComplyRight. Accordingly, when he 16

received the date breach notification, he repeatedly contacted the telephone number included in the 17

letter to inquire what information was compromised and how ComplyRight had his personal 18

information. ComplyRight's agents could not answer Plaintiff's basic questions. Additionally, 19

Plaintiff found ComplyRight's public explanation suspicious because Plaintiff has not had an 20

employer for some time and cannot remember any third-parties preparing either a Form W-2 or 21

1099 in his name. Thus, it is not clear if ComplyRight obtained each of the Class members' 22

information in a legitimate manner. 23

18. While ComplyRight hasn't said exactly how its breach happened, it appears that 24

ComplyRight does not offer the level of security that is required for a company that maintains 25

26 See https://krebsonsecurity.com/20 I 8/07/human-resources-firm-complyright-breached/ (last

27 accssed on July 23, 2018). See https://www.complyright.comldata-security-notice#Why-did-ComplyRight-have-my-

28 information (last accessed on July 23, 2018).

-4- CLASS ACTION COMPLAINT


sensitive financial information. When Mr. Krebs reviewed ComplyRight's business, he was

surprised to see the apparent lack of emphasis on data security:

Also, it's far from clear that data security is in fact a primary concern of ComplyRight. Let me explain: Very often when I'm having difficulty getting answers or responses from a company that I- suspect or know has had a breach, I'll start identifying and pestering the company's executives via their profiles on Linkedln.

As I did so in this case, I was surprised to discover that I couldn't identify a single ComplyRight employee on Linkedin whose job is listed as related to security. Nor does it appear that ComplyRight is currently hiring anyone in these positions. I did, however, find plenty of network managers and software engineers, Web developers and designers, data specialists, and even several "poster guard specialists" (ComplyRight also produces workplace safety posters of the kind typically hung in corporate breakrooms).

Based on Mr. Krebs' review of ComplyRight's website, he states "the most likely

explanation is that intruders managed to install malicious code on [ComplyRight's website]

efile4biz.com Web site - malware that recorded passwords entered into the site by employers

using the service to prepare tax forms."4 His position seems to be supported by other security

analysts who report that ComplyRight's website uses "outdated protocols such as TLS 1.0 for sign

in" and ComplyRight's failure to update known deficiencies "indicates that there may be other

legacy vulnerabilities still in place in the site application code."5 Indeed, ComplyRight's website

does not support common security features such as forward secrecy or AEAD cipher suites.6

Accordingly, it was ComplyRight's failure to employ sufficient security personal and up-to-date

security protocols that was the cause of the data breach.

As a result of ComplyRight's negligent security practices, Class members are subject

to an increased and concrete risk of identity theft based on ComplyRight's exposure of their

personal and tax information and have and will have to spend time and money securing their

personal information, accounts and protecting their identities. ComplyRight has also not disclosed

the exact number of individuals whose information was involved in this breach, but it has been

See https://krebsonsecurity.com/20 18/07/human-resources-firm-complyright-breached/ (last accessed on July 23, 2018).

Id. See https://www.darkreading.com/application-security/hr-services-firm-complyright-suffers-

majr-data-breach/d/d-id/1332345 (last accessed on July 23, 2018). Id.


1

2

3

—4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28


I reported that the employees of over 7,500 businesses were affected. Accordingly, the exact number

2 of people affected is, as yet, unknown, but reports indicate that the potentially-affected pool of

3 individuals could be in the tens or hundreds of thousands of individuals.

4 21. As ComplyRight itself recommended, former and current Plaintiff and the putative

Class will need to monitor their accounts and credit, and will also have to engage credit monitoring

or credit reports in the wake of the data breach to make sure that their credit and identity is not

harmed by anyone who may have stolen their information. However, credit monitoring will not

prevent the majority of identity thief. As noted by Mr. Krebs, additional action should be taken:

["ComplyRight"] is offering 12 months of free credit monitoring to those affected by the breach. As I've noted several times here, credit monitoring can be useful for helping people recover from identity theft, but it is virtually useless in stopping identity thieves from opening new accounts in your name.

A more comprehensive approach to combating ID theft involves adopting the assumption that all of this static data about you as a consumer - including your name, date of birth, address, previous address, phone number, credit card number, Social Security number and possibly a great deal more sensitive information - is already breached, stolen and/or actively for sale In the cybercrime underground.

One response to this increasingly obvious reality involves enacting a security freeze on one's credit files with the major consumer credit reporting bureaus....

In addition, people who received a letter from ComplyRight may also file a Form 14039 with the U.S. Internal Revenue Service (IRS) to help reduce the likelihood of becoming victims of tax refund fraud, an increasingly common scam in which fraudsters file a tax refund request with the IRS in your name and then pocket the refund money

But even these steps are extremely time consuming, inconvenient, and do not protect against all

identity thief. If their information has been misused, individuals may also lose access to their funds

and time and money by spending hours on the phone or in person with banks and credit agencies

trying to reverse unauthorized charges, clear up credit issues, and order new cards.

22. Plaintiff and the putative Class whose Social Security numbers have been

compromised will also have to sufficient spent time contacting various agencies, such as the IRS

and the Social Security Administration ("SSA"). For example, should an individual wish to get a

new social security number issued, it is often a complex process. Under SSA policy, individuals

cannot obtain a new Social Security Number until there is evidence of ongoing problems due to

misuse of the Social Security Number. Even then, the SSA recognizes that "a new number probably

-6-

CLASS ACrION COMPLAINT

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28


2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

will not solve all your problems. This is because other governmental agencies (such as the IRS and

state motor vehicle agencies) and private businesses (such as banks and credit reporting companies)

will have records under your old number. Along with other personal information, credit reporting

companies use the number to identify your credit record. So using a new number will not guarantee

you a fresh start."

The time associated with the process of dealing with the repercussions of identity are

not insufficient. The Bureau of Justice Statistics found that "among victims who had personal

information used for fraudulent purposes, 29% spent a month or more resolving problems."7

Members of the Class face a real and immediate risk of identity theft and other

problems associated with the disclosure of their Social Security number, and may be also faced with

fraudulent debt, or incur costs for, among other things, paying monthly or annual fees for identity

theft and credit monitoring services, obtaining credit reports, credit freezes, and other protective

measures to deter, detect, and mitigate the risk of identity theft and fraud. Consequently, Plaintiff

seeks damages, including statutory damages, restitution, and injunctive relief on behalf of himself

and the Class for Defendant's negligent handling and disclosure of their personal information.

V. CLASS ALLEGATIONS

Plaintiff brings this action as a class action pursuant to California Code of Civil § 382

for the following Class of persons:

All individuals in California whose personal information was compromised as a result of ComplyRight's data breach that occurred between April 20, 2018 and May 22, 2018.

Excluded from the Class are all legal entities, Defendant herein and any person, firm, trust,

corporation, or other entity related to or affiliated with Defendant, as well as any judge, justice or

judicial officer presiding over this matter and members of their immediate families and judicial staff.

Plaintiff reserves the right to amend the Class definition if further investigation and

discovery indicates that the Class definition should be narrowed, expanded, or otherwise modified.

While the exact number of Class members is unknown to Plaintiff at this time, and

Erika Harrell and Lynn Langton, Victims of Identity Theft, 2012, (Bureau of Justice Statistics Dec. 2013), http://www.bjs.gov/content/pub/pdf/vitl2.pdf (last visited June).

.7- CLASS ACTION COMPLAINT


I will be ascertained through appropriate discovery, there are thousands of members in the proposed

2 Class. The number of individuals who comprise the Class are so numerous that joinder of all such

3 persons is impracticable and the disposition of their claims in a class action, rather than in

4 individual actions, will benefit both the parties and the courts.

5 28. Plaintiff's claims are typical of the claims of the other members of the Class. All

6 members of the Class have been and/or continue to be similarly affected by Defendant's wrongful

7 conduct as complained of herein, in violation of federal and state law. Plaintiff is unaware of any

8 interests that conflict with or are antagonistic to the interests of the Class.

9 29. Plaintiff will fairly and adequately protect the Class members' interests and have

10 retained counsel competent and experienced in consumer class action lawsuits and complex

11 litigation. Plaintiff and their counsel have the necessary financial resources to adequately and

12 vigorously litigate this class action, and Plaintiff is aware of their duties and responsibilities to the

13 Class.

14 30. Defendant has acted with respect to the Class in a manner generally applicable to

15 each Class member. Common questions of law and fact exist as to all Class members and

16 predominate over any questions wholly affecting individual Class members. There is a well-defined

17 community of interest in the questions of law and fact involved in the action, which affect all Class

18 members. Among the questions of law and fact common to the Class are, inter alia:

19 a) Whether Defendant had a legal duty to use reasonable security measures to protect

20 the Class's personal and medical information;

21 b) Whether Defendant negligently secured and maintained the Class's personal

22 information;

23 c) Whether the Class's personal information was improperly accessed by a third-party;

24 d) Whether Defendant violated California Civil Code sections 1798.81.5 by failing to

25 implement reasonable security procedures and practices;

26 e) Whether class members may obtain damages, restitution, declaratory, and injunctive

27 relief against Defendant under Civil Code sections 1798.84 or under the UCL; and

28 0 Whether Plaintiff and class members are entitled to damages, restitution and

-8- CLASS ACrION COMPLAINT


I injunctive relief.

2 31. A class action is superior to all other available methods for the fair and efficient

3 adjudication of this controversy since joinder of all members is impracticable. Furthermore, as the

4 - damages suffered by individual Class members-may be relatively small,-the expense-and burden of

5 individual litigation make it virtually impossible for Class members to individually redress the

6 wrongs done to them. There will be no difficulty in managing this action as a class action.

7 32. Defendant has acted on grounds generally applicable to the entire Class with respect

8 to the matters complained of herein, thereby making appropriate the relief sought herein with

9 respect to the Class as a whole.

10 FIRST COUNT For Violation of the California Customer Records Act,

11 California Civil Code Section 1798.80, etseq.

12 33. Plaintiff hereby incorporates by reference the allegations contained in the preceding

13 paragraphs of this Complaint. -

14 34. Plaintiff brings this cause of action on behalf of himself and the Class whose personal

15 information was maintained by Defendant and/or that was compromised in the data breach.

16 35. "[T]o ensure that personal information about California residents is protected," the

17 California Legislature enacted Civil Code section 1798.81.5, which requires that any business that

18 "owns or licenses personal information about a California resident shall implement and maintain

19 reasonable security procedures and practices appropriate to the nature of the information, to protect

20 the personal information from unauthorized access, destruction, use, modification, or disclosure."

21 36. Defendant is a "business" within the meaning of Civil Code section 1798.80(a).

22 37. Plaintiff and members of the Class are "individual[s]" and consumers within the

23 meaning of the Civil Code section 1798.80(c) and (d).

24 38. Pursuant to Civil Code sections 1798.80(e) and 1798.81.5(d)(1)(C), "personal

25 information" includes an individual's name, Social Security number, driver's license or state

26 identification card number, debit card and credit card information, medical information, or health

27 insurance information. "Personal information" under Civil Code section 1798.80(e) also includes

28 address, telephone number, passport number, education, employment, employment history, or

-9.- CLASS ACTION COMPLAINT


health insurance information.

2 39. The breach of the personal data of thousands of individuals constituted a "breach of

3 the security system" of Defendant, pursuant to Civil Code section 1798.82(g).

-4 40. By failing to implement reasonable measures to protect individuals' personal data,

5 Defendant violated Civil Code section 1798.81.5.

6 41. By violating Civil Code sections 1798.81.5 and 1798.82, Defendant "may be

7 enjoined" under Civil Code section 1798.84(e).

8 42. Accordingly, Plaintiff requests that the Court enter an injunction requiring Defendant

9 to implement and maintain reasonable security procedures to protect customers' data in compliance

10 with the California Customer Records Act, including, but not limited to: (1) ordering that

11 Defendant, consistent with industry standard practices, implement systems required to ensure only

12 authorized individuals have access to any programs and applications used to input or access

13 personal information; (2) ordering that Defendant secure all computers, networks, and servers with

14 the necessary and up-to-date security protocols necessary to protect any personal information; (3)

15 ordering that Defendant engage third party security auditors and internal personnel, consistent with

16 industry standard practices, to run automated security monitoring; (4) ordering that Defendant hire,

17 - • audit, test, and train its security personnel regarding any new or modified procedures; (5) ordering

18 that Defendant purge, delete, destroy in a reasonable secure manner personal data not necessary for

19 its business operations; (6) ordering that Defendant, consistent with industry standard practices,

20 conduct regular database scanning and securing checks; (7) ordering that Defendant, consistent with

21 industry standard practices, periodically conduct internal training and education to inform internal

22 security personnel how to identify and contain a breach when it occurs and what to do in response

23 to a breach; and (8) ordering Defendant to meaningfully educate its former and current employees

24 about the threats they face as a result of the loss of their personal information to third parties, as

25 well as the steps they must take to protect themselves.

26 43. As result of Defendant's violation of Civil Code sections 1798.81.5, and 1798.82,

27 Plaintiff and members of the class have and will incur economic damages relating to time and

28 money spent remedying the breach, including but not limited to, expenses for bank fees associated



I with the breach, any unauthorized charges made on financial accounts, Jack of access to funds while

2 banks issue new cards, tax fraud, as well as the costs of credit monitoring and purchasing credit

3 reports.

4 44 Plaintiff, individually and on behalf of the members of the Class, seeks all remedies

5 available under Civil Code section 1798.84, including, but not limited to: (a) damages suffered by

6 members of the class; and (b) equitable relief. Plaintiff, individually and on behalf of the members

7 of the Class, also seek reasonable attorneys' fees and costs under applicable law.

8 SECOND COUNT For Unlawful and Unfair Business Practices Under

9 California Business and Professions Code § 17200, el seq.


11 paragraphs of this Complaint.

12 46. Defendant's acts and practices, as alleged in this complaint, constitute unlawful and

13 unfair business practices, in violation of the Unfair Competition Law ("UCL"), Cal. Bus. & Prof.

14 Code § 17200, el seq.

15 47. Defendant's acts and practices, as alleged in this complaint, constitute unlawful and

16 unfair practices in that they violate California Civil Code section 1798.80, et seq.

17 48. The acts, omissions, and conduct of Defendant constitute a violation of the unfair

18 prong of the UCL because it failed to comport with a reasonable standard of care and public policy

19 as reflected in statutes such as the California Customer Records Act, Cal. Civ. Code § 1798.80, el

20 seq., which seeks to protect individuals' data and ensure that entities who solicit or are entrusted

21 with personal data utilize reasonable security measures.

22 49. In unduly delaying informing customers of the data breach, Defendant engaged in

23 unfair business practices by engaging in conduct that undermines or violates the stated policies

24 underlying the California Customer Records Act and other privacy statutes. In enacting the

25 California Customer Records Act, the Legislature stated that: "[i]dentity theft is costly to the

26 marketplace and to consumers" and that "victims of identity theft must act quickly to minimize the

27 damage; therefore expeditious notification of possible misuse of a person's personal information is

28 imperative." 2002 Cal. Legis. Serv. Ch. 1054 (A.B. 700). Defendant's conduct also undermines

-11- ClAss AcTIoN COMPLAINT


California public policy as reflected in other statutes such as the Information Practices Act of 1977,

2 Cal. Civ. Code § 1798, el seq., which seeks to protect individuals' data and ensure that entities who

3 solicit or are entrusted with personal data utilize reasonable security measures.

4 50. As a direct and proximate result of Defendant's unlawful business practices as alleged

5 herein, Plaintiff and members of the class have suffered injury in fact. Plaintiff and the class have

6 been injured in that their personal, financial, and medical information has been compromised and

7 are at risk for future identity theft and fraudulent activity on their financial accounts. Class

8 members have also lost money and property by purchasing credit monitoring services they would

9 not otherwise had to but for Defendant's unlawful and unfair conduct.

10 51. There is no countervailing benefit to competition in allowing Defendant to

11 improperly disclose and negligently maintain protect personal information.

12 52. As a result of Defendant's violations, Plaintiff and members of the class are entitled

13 to injunctive relief, including, but not limited to: (1) ordering that Defendant, consistent with

14 industry standard practices, implement systems required to ensure only authorized individuals have

15 access to any programs and applications used to input or access personal information; (2) ordering

16 that Defendant secure all computers, networks, and servers with the necessary and up-to-date

17 security protocols necessary to protect any personal information; (3) ordering that Defendant

18 engage third. party security auditors and internal personnel, consistent with industry standard

19 practices, to run automated security monitoring; (4) ordering that Defendant hire, audit, test, and

20 train its security personnel regarding any new or modified procedures; (5) ordering that Defendant

21 purge, delete, destroy in a reasonable secure manner personal data not necessary for its business

22 operations; (6) ordering that Defendant, consistent with industry standard practices, conduct regular

23 database scanning and securing checks; (7) ordering that Defendant, consistent with industry

24 standard practices, periodically conduct internal training and education to inform internal security

25 personnel how to identify and contain a breach when it occurs and what to do in response to a

26 breach; and (8) ordering Defendant to meaningfully educate its former and current employees about

27 the threats they face as a result of the loss of their personal information to third parties, as well as

28 the steps they must take to protect themselves.

CLASS ACTION COMPLAINT


I THIRD COUNT Negligence


3 paragraphs of this Complaint.

4 54. In collecting the personal and financial information, Defendant owed Plaintiff and

5 members of the class a duty to exercise reasonable care in safeguarding and protecting that

6 information. This duty included, among other things, maintaining Defendant's security systems

7 and taking other reasonable security measures to protect and adequately secure the personal data of

8 Plaintiff and the class from unauthorized access.

9 55. The duty Defendant owed to Plaintiff and members of the Class to protect their

10 personal information is also underscored by the California Customer Records Act, which recognize

11 the importance of maintaining the confidentiality of personal information and were established to

12 protect individuals from improper disclosure of their personal information.

13 56. Defendant breached its duty to exercise reasonable care in protecting the personal

14 information of Plaintiffs and the class by failing to implement and maintain adequate security

15 measures to safeguard access to personal information, failing to monitor its systems to identify

16 suspicious activity, and allowing unauthorized access to the personal information of Plaintiffs and

17 the Class.

18 57. It was foreseeable that if Defendant did not take reasonable security measures, the

19 data of Plaintiff and members of the Class would be improperly disclosed. Corporations like

20 Defendant face a higher threat of security breaches than other companies due in part to the sensitive

21 and valuable nature of sensitive personal tax data they possess. Defendant should have known to

22 take precaution to secure individual's data.

23 58. As a direct and proximate result of Defendant's failure to exercise reasonable care

24 and use commercially reasonable security measures, personal information was accessed by an

25 unauthorized individual, who could use the information to commit identity fraud. Plaintiffs and the

26 class face a heightened risk of identity theft in the future.

27 59. Plaintiff and the Class seek compensatory damages and punitive damages with

28

I CLASS ACTION COMPLAINT


2

3

-4

5

6

7

8

9

10

II

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

interest, the costs of suit and attorneys' fees, and other and further relief as this Court deems just

and proper.

VI. PRAYER FOR RELIEF

WHEREFORE, Plaintiff-and the Class pray for relief and judgment as follows: -

For an order declaring that this action is properly maintained as a class action and

appointing Plaintiff as a representative for the Class, and appointing Plaintiff's counsel as Class

counsel;

That Defendant bear the costs of any notice sent to the Class;

For an order awarding Plaintiff and the members of the Class actual damages,

restitution, and/or disgorgement;

For an order enjoining Defendant from continuing to engage in the unlawful and

unfair business acts and practices as alleged herein;

For an order awarding Plaintiff and the members of the Class pre- and post-judgment

interest;

For an order awarding attorneys' fees and costs of suit, including expert's witnesses

fees as permitted by law; and

Such other and further relief as this Court may deem just and proper.

VIL JURY TRIAL DEMAND

Plaintiff demand a trial by jury for all of the claims asserted in this Complaint so triable.

DATED: August 7, 2018 Respect 11 submitted,

FINKEtS*EIN 8ç RINSK LLP J'1/L I.

Jeffrey R. Krinsk, Esq. Trenton R. Kashima, Esq. 550 West C St., Suite 1760 San Diego, CA 92101 Telephone: (619) 238-1333 Facsimile: (619) 238-5425

Attorneys for Plaintiff and the Putative Classes

- 14 - I CLASS ACTION COMPLAINT


EXHIBIT B


q17 SUMMONS fOR cor

($01.0 PARA USOOE.A CORTE)

'CITACION JUDICIAL) ELECTRONICALLY FILED

NOTICE TO DEFENDANT: Superior Court of California. (AV/SO AL DEMANOADO): County of Orange

COMPLYRIGHT, INC., a Minnesota corporation; and DOES 1-10, 08f07/2018 at 04:06:48 PM

Clerk of the Superior Court

YOU ARE BEING SUED BY PLAINTIFF: Cy Sarah Loose.Deputy Clerk

(LO ESTA DEMANDANDO EL DEMANDANTE):

PAUL CHRISTIANSEN, individually and on behalf of-all others similarly situated,

NOTICE! You have been sued. The court may decide against you without your being heard unless you respond within 30 days. Read the information below.

You have 30 CALENDAR DAYS after this summons and legal papers are served on you to file a written response at this court and have a copy served on the plaintiff. A letter or phone call will not protect you. Your written response must be in proper legal form if you want the court to hear your case. There may be a court form that you can use for your response. You can find these court forms and more information at the California Courts Online Self-Help Center (www.cowtinfo.ca.gov/selThelp), your county law library, or the courthouse nearest you. It you cannot pay the filing fee, ask the court clerk for a fee waiver form. If you do not file your response on time, you may lose the case by default, and your wages, money, and property may be taken without further warning from the court.

There are other legal requirements. You may want to call an attorney right away. if you do not know an attorney, you may want to call an attorney referral service. U you cannot afford an attorney, you may be eligible for free legal services from a nonprofit legal services program. You can locate these nonprofit groups at the California Legal Services Web site (wwwiawhe!pcahforrtia.Org), the California Courts Online Self-Help Center (wiirw.courtinfo.ca.govfseimelp), or by contacting your local court or county bar association. NOTE: The court has a statutory lien for waived fees and costs on any settlement or arbitration award of $10,000 or more in a civil case. The court's lien must be paid before the court will dismiss the case. ,AVlSOl Lo han demandado. Si no responde dentro de 30 dlas, Is carte puede decidir an su contra sin escuchar su version. Lea /a informaciOn a contir,uacidn.

none 30 0/AS DE CALENDAR!O despuOs de que le ontroguen esta cilaciOn y pope/es le gales pars presontar una respuesta POT escrito an esta cotta y hacer quo so entregue una coplo at demandante. Una carts o una Ilamada tele(Onica no /0 protogen. Su respuesta par eciilo hone quo estar an formato legal correcto Si desea quo proceseo so caso an la carte. Es posible que hays un (orrnulario que usted pueda usarpara su respuesta. Puede encontrar estos form iilanos do Is carte ymás intonnaciOn an ci Centre do Ayuda do las Cafes de California (www.sucorte.ca.gov). an Ia biblioleca do byes do so condado o an Is carte que 10 querle más cerca. Si no puede pager Is cuota do preserrtachn, pido al socretario do Is carte quo le did un forrnulano do exencibn do pago de cuotas. Si no presents so respuesta a tiempo, puecia perder of caso par incumplirniento y /a carte be podrá quitar su sueldo, dlnero y bienos sin rnâs advertencia.

Hay altos requisilos legates. Es tecomendable quo flame a on abogado inmedialarnente. Sine carioca a on abogado, puede Ilamar a on sarvicio de rernisibrr a abogodos. Si no puede pager a uri abogado, as posibie que cumplo con los requisites para oblenor sorvicios legales gratuiios do un programs do setvicios legates sin fines de lucro. Puede encontrar estos grupos sin fines de lucre an el silio web do California Legal Services, ftvww.IawheIpcaIifomIa.or9), an el Centro doAyuda de las CarIes de California, (www.sucorte.Ca.gov) 0 poniOndose an contacto con /a cone a at coleglo de abogados locales. A VISO: Pot fey, 10 carte tiene derecho a reclamar las cuotas y los cosles exentos par imponer on gravamen sabre cualguior recuperacibn de $10,000 0 ms de valor recibida modiante un acuerdo a una concesiOn de arbitrate an un case de derecho civil. Tierle quo pagarel gravamen de Is cone antes do que Is cone pueda desechar at caso.

The name and address of the court is: CASE NUMBER:

(El , 4' 'A .4 . >. 751W. Santa Ana Blvd (Nomcei.1l'i nom roy irecci r, e aco ees,.

Santa Ana, Ca 92701 30-2018-01010711-CU-BT-CXC

Civil Complex Centerl Judge Glenda Sanders The name, address, and telephone number of plaintiffs attorney, or plaintiff without an attorney, is: (El nombro, Is dire cciOn yolnUmero do teféfono del abogado del domandante, o del demandartle que no hone abogado, es):

Finkelstein & Krinsk LLP, 550 West C Street, Ste. 1760, San Diego, CA 92101 (619) 238-1333

DAVID H. Y,A!1.ASiXt, Clerk of the Court DATE: Clerk. by ,....pUty

(Fecha) (Secre far/a) (Adjunto)

(For proof of service of this summons, use Proof of Service of Summons (form POS-010).) (Pare prueba do entrega de esta citation use ci formularbo Proof of Service of Summons, (POS-010)). Sarah Loose

NOTICE TO THE PERSON SERVED: You are served 1. as an individual defendant, 2, [J as the person sued under the fictitious nam of (specify):

fl9U.-fl\1/1+, o ULrL1Sf 3 (specify).

fl2O4L11Ofl ~tP

P 416.10 (corporatior$) CCP 416.60 (minor)

416.20 (defunct corporation) c: CCP 416.70 (conservatee)

CCP 416.40 (association or partnership) = CCP 416.90 (authorized person)

E1 other (specify): by nersnnal delivery on (date):

(SEAL3

JN

r% Wit

pad* 1aTi

Form Adopted for Mandatory we SUMMONS code of CeO procedure 9S 412.20, 469 JUddOI Councl w.w.coVn(ocego>'

SUM-100 lRev. July 1. 20091


EXHIBIT C


ATTORNEY OR PARW WTHOUT ATTORNEY (wane $,a/re A€t nunbal ond eddrerss)

- Jeftey R. Krinsk, Esq. I SBN: 10923F.FINKELSTEIN & KRINSK550 West C Street Suite 1760 San Diego, CA 92101

TEIEPHONE NO.: (61s) 23er$3 | FA( NO. (610) 238^5425 lE-lrAlt ADDRESS loptinan:ATTORNEY FOR(/Vem); :

Orange County Superlor CourtSTREETAoDRESS:751 WeSt Santa Ana tsOUleVard

cnY AND zrP cooE: Santa Ana, CA 92701

ERANCHMME:

FOR COUR| USE ONLY

PLAINTIFF/PETITIONER: Paul Christiansen, et al.DEFENDANT/RESPONDENT: Complyright, lnc., et al CASE NUMBER:

30-201 8-01 01 071 1 -CUCT-CXC

PROOF OF SERVICE OF SUMMONSRel. No. ot Frlo No.:

7657.01

(Sepante proof of sevice is raquircd for each patA seved.)

1. At the time of service I was at least 18 years of age and not a party to this aclion.2. I served copies of:

summons

complaint

Altemative Dispute Resolution (ADR) package

Civil Case Cover Sheet

cross-complaint

olher (specrfr documents) :3. a. Parg served (speclff name of party as shown on documents seved):

Complyrlght, lnc., a Minnesota Gorporation

b. Ef person (other than the party in item 3a) served on behalf of an entity or as an authorized agent (and not a person underitem 5b on whom substituted service was made)(specify name and rclationship to the pafty named in item 3a):

CT Corporation as Agent for Servlce - By leaving with Garlos Paz, process speciallst4. Address where lhe party was served: 818 West Seventh Street, Suite 930

Los Angeles, CA 90017

5, I served the party (check prcper box)a' M Oy perconal servlce. I personally delivered the documents listed in item 2 to the party or person authorized to

receive service of process for the parg (11 on (date): 811712018 (2) al (lime): 2:40 PM

b. n by substituted service. Qn (date): al (time): I left the documents llsted in item 2 with orin the presence of (name and title or relationship to person indicated in item 3b):

(t) E (business) a person at least 18 years of age apparently in charge at the office or usual place of business of lheperson to be served. I informed him of her of the general nature of the papers.

(Z) E (home) a competenl member of the household (at least 18 years of age) at the dwelling house or usual place ofabode of the party. I informed him or her of the general nature of the papers.

(S) ! (physical address unknown) a person at least 18 years of age apparenlly in charge at the usual mailingaddress of the person to be served, olher than a United Slates Postal Service posl oflice box. I informed him ofher ofthe general nature ofthe papers.

(4) n I thereafler mailed (by first-class, poslage prepaid) copies of the documents to the person to be served at lheplace where the copies were left (Code Civ. Proc., 9415.20). I mailed the documents on(date): ftom (city): or f] a declaration of mailing is attached.

(5) n I attach a declaration of dlligence stating ac'tions laken first to attempt personal service.

q,

b.

c.

d.

e.

t.

Vgggntr

Form Approved lq Mandalory UsJudicial Comcil ot CalifdnhPOS{10 lRov. January l, 20071

totCode ol Civil Procstirre, S.117 10

POS0t0.trsor7022PROOF OF SERVICE OF SUMMONS


PETITIONER: Paut chdsttanBon, et at.

RESPONDENT: Complyrlght, lnc., ot at

CASE NUMBER:

30-201 8.01 0t 071 1 4u-cT.cxc

by mall and acknowledgment of ruceipt of sowic€. I mailed the documents listed in item 2 to the party, to the addressshown in item 4, by first-class mail, postage prepaid,

(1) on (date): (2) trcn (city):

(3)fl with two copies of lhe Notice and Acknowtedgment of Receiptand a postage-paid retum envelope addressed to me.(Attach completedNotice and Acknowledgemenl of Receipt.) (Code Civ. Proc., g 415.30.)

(a)E O an address outside Califomia with return receipt requested. (Gode Civ. Proc., g 415.40.)

O. ! Uy other means (specify means of servrbe and authortzing code section):

! Additional page desoibing service is attached.6. The "Notice lo the Person Served" (on the summons) was completed as follows:

". fJ ., an individual defendant.

U. as the person sued under the ficlitious name of (specify):c. lJ

"" occuoant.

d.El' on uetratrot gpecil: Gomplyrlght,lnc., a Minnesota Corporation

Dtrtrtrn!

(1)E r.

Ql lJ and Professions Code sec{ion 22350(b).

igi E(i d indePendentcontractor'(i

(i

under lhe following Code of Civil Procedure section:

il oru.ro(coryorailon)

u!!u

4'1620 (defu nct corporation)416.30 (ioint stock company/association)41 6.40 (association or parlnership)416.50 (public entity)

415.95 (business organization, form unknown)416.60 (minor)416.70 (ward or conservalee)416.90 (authorized person)415.46 (occupant)

other:

7. Person who served papensa. Name: Dion Jones - Natlonwlde Legal, LLC REG: 12-234648b. Address: 110 West G. St, Suite 1211 San Diego, CA 92101c. Telephone numben (6191 232-7500d. The fee for service was: $ 125.00e. lam:

S.d ldeclare under penalty of perjury under the laws of the State of California that the foregoing is lrue and correct.

g. E t am a Callfomla sheriff or marshat and I certiff that the foregoing is true and conect.

Date: 811712018

Dion Jones(MME OF PERSON WHO SERVED PAPERS/SHERIFF OR MARSHAL}

POS{IO lRsv January l, 20071PROOF OF SERVICE OF SUMMONS ?agoZol2

POS.010rSD17022


EXHIBIT D


MC-025CASE NUMBER:SHORT TITLE:

ofPage

ATTACHMENT (Number):

(This Attachment may be used with any Judicial Council form.)

(Add pages as required)

(If the item that this Attachment concerns is made under penalty of perjury, all statements in this

Attachment are made under penalty of perjury.)

Form Approved for Optional Use Judicial Council of California MC-025 [Rev. July 1, 2009]

ATTACHMENT www.courtinfo.ca.gov

to Judicial Council Form

Christiansen v. ComplyRight, Inc. 30-2018-01010711-CU-BT-CXC

1H

On September 10, 2018, the plaintiffs in Winstead v. ComplyRight filed a consolidated amended complaint inthe Northern District Court of Illinois asserting the same causes of action on behalf of a putative Californiaclass, which Plaintiff Paul Christiansen also asserts in this action: negligence, violation of the CaliforniaConsumer Records Act, and violation of California's Unfair Competition Law.

On September 24, 2018, Defendant ComplyRight Inc. sent a letter to Plaintiff's counsel indicating that thisaction may have been filed in an improper venue, and requested additional information concerning thejurisdiction of this Court. It is unclear if Plaintiff filed in state court because he is claiming less than $75,000is in controversy on behalf of himself and the alleged class.

Regardless, a transfer or stay of this action, pending the resolution of the case in Illinois, may be appropriate.

1 1


231

-STOLO+STOLOSTOLOSTOLO

FOR COURT USE ONLYSUPERIOR COURT OF CALIFORNIA, COUNTY OF

STREET ADDRESS:

MAILING ADDRESS:

CITY AND ZIP CODE:

BRANCH NAME:

P.O. Box 22028

Santa Ana CA 92702

ORANGE751 W. Santa Ana Blvd

Civil Complex Center

SHORT TITLE: Christiansen vs. ComplyRight, Inc.

NOTICE OF CONFIRMATION OF ELECTRONIC FILING CASE NUMBER:

30-2018-01010711-CU-BT-CXC

Electronic Filing Summary Data

STOLOThe Electronic Filing described by the below summary data was reviewed andaccepted by the Superior Court of California, County of Orange. In order toprocess the filing, the fee shown was assessed.

Electronically Submitted By: ComplyRight, Inc.On Behalf of: ComplyRight, Inc.; CCMS ID: 77557093Transaction Number:Court Received Date:Court Received Time:

Case Number:Fee Amount Assessed:

Filed Date: Filed Time:

154408609/25/201812:39:49 PM

09/25/201812:39 PM$1,435.0030-2018-01010711-CU-BT-CXC

Case Title: Christiansen vs. ComplyRight, Inc.Location:Case Type:Case Category:

Jurisdictional Amount:


Civil - UnlimitedBusiness Tort

> 25000

NOTICE OF CONFIRMATION OF FILING

Page 1

10/01/2018


Case Title: Christiansen vs. ComplyRight, Inc. CASE NUMBER: 30-2018-01010711-CU-BT-CXC

Documents Electronically Filed/Received Status STOLONotice of Related Case Accepted

Court Generated DocumentsPayment Receipt

CommentsSubmitter's Comments:

Clerk's Comments:

Electronic Filing Service Provider Information

Service Provider OneLegalEmail: [email protected] Person: Customer SupportPhone: 8009388815

NOTICE OF CONFIRMATION OF FILINGSTOLO

Page 2

10/01/2018


SUPERIOR COURT OF CALIFORNIA

Receipt #:

Clerk ID:

PAYMENT RECEIPT

Transaction No: Transaction Date: Transaction Time:12427332

12251022

sloose

COUNTY OF ORANGE

Superior Court of California, County of Orange


Receipt #:

Clerk ID:

PAYMENT RECEIPT

Transaction No: Transaction Date: Transaction Time:12427332 10/01/2018 08:42:00 AM

751 W. Santa Ana BlvdSanta Ana, CA 92701

E-Filing Transaction #: 1544086

COUNTY OF ORANGE


751 W. Santa Ana BlvdSanta AnaCA92701

-

RemainingBalanceCase Number Fee

Amount$Fee Type QtyAmount

PaidBalance

Due

30-2018-01010711-CU-BT-CXC 1195 - Answer or other 1st paper $435.00 $0.00$435.00 $435.00 0.00435.00435.00435.00 0.00

30-2018-01010711-CU-BT-CXC 135 - Complex Case Fee - Response $1,000.00 $0.00$1,000.00 $1,000.00 0.001000.001000.001000.00 0.00

Sales Tax:

Total:Total Rem. Bal:

$1,435.00 $0.00

$0.00

E-Filing: $1,435.00 EF

Change Due:

Balance:

Total Amount Tendered:

$0.00

$0.00

$1,435.00

A $45 fee may be charged for each returned check, electronic funds transfer or credit card payment.

ORIGINAL

Page: 1


EXHIBIT E


231

-STOLO+STOLOSTOLOSTOLO

FOR COURT USE ONLYSUPERIOR COURT OF CALIFORNIA, COUNTY OF

STREET ADDRESS:

MAILING ADDRESS:

CITY AND ZIP CODE:

BRANCH NAME:

P.O. Box 22028

Santa Ana CA 92702

ORANGE751 W. Santa Ana Blvd


SHORT TITLE: Christiansen vs. ComplyRight, Inc.

NOTICE OF CONFIRMATION OF ELECTRONIC FILING CASE NUMBER:

30-2018-01010711-CU-BT-CXC

Electronic Filing Summary Data

STOLOThe Electronic Filing described by the below summary data was reviewed andaccepted by the Superior Court of California, County of Orange. In order toprocess the filing, the fee shown was assessed.

Electronically Submitted By: ComplyRight, Inc.On Behalf of: ComplyRight, Inc.; CCMS ID: 77557093Transaction Number:Court Received Date:Court Received Time:

Case Number:Fee Amount Assessed:

Filed Date: Filed Time:

154556409/28/201801:03:24 PM

10/01/201801:03 PM$20.0030-2018-01010711-CU-BT-CXC

Case Title: Christiansen vs. ComplyRight, Inc.Location:Case Type:Case Category:

Jurisdictional Amount:


Civil - UnlimitedBusiness Tort

> 25000

NOTICE OF CONFIRMATION OF FILING

Page 1

10/01/2018


Case Title: Christiansen vs. ComplyRight, Inc. CASE NUMBER: 30-2018-01010711-CU-BT-CXC

Documents Electronically Filed/Received Status STOLOStipulation and Order(order extending time for defendantto respond to complaint)

Accepted

Court Generated DocumentsPayment Receipt

CommentsSubmitter's Comments:

Clerk's Comments:

Electronic Filing Service Provider Information

Service Provider OneLegalEmail: [email protected] Person: Customer SupportPhone: 8009388815

NOTICE OF CONFIRMATION OF FILINGSTOLO

Page 2

10/01/2018



Receipt #:

Clerk ID:

PAYMENT RECEIPT

Transaction No: Transaction Date: Transaction Time:12427679

12251358

olopez

COUNTY OF ORANGE



Receipt #:

Clerk ID:

PAYMENT RECEIPT

Transaction No: Transaction Date: Transaction Time:12427679 10/01/2018 12:32:34 PM

751 W. Santa Ana BlvdSanta Ana, CA 92701

E-Filing Transaction #: 1545564

COUNTY OF ORANGE


751 W. Santa Ana BlvdSanta AnaCA92701

-

RemainingBalanceCase Number Fee

Amount$Fee Type QtyAmount

PaidBalance

Due

30-2018-01010711-CU-BT-CXC 137 - Stipulation and order $20.00 $0.00$20.00 $20.00 0.0020.0020.0020.00 0.00

Sales Tax:

Total:Total Rem. Bal:

$20.00 $0.00

$0.00

E-Filing: $20.00 EF

Change Due:

Balance:

Total Amount Tendered:

$0.00

$0.00

$20.00

A $45 fee may be charged for each returned check, electronic funds transfer or credit card payment.

ORIGINAL

Page: 1


EXHIBIT F


EXHIBIT G


EXHIBIT H


FINKELSTEIN & KRINSK LLP ATTORNEYS AT LAW

550 WEST C STREET SUITE 1760

TELEPHONE (619) 238-1333 SAN DIEGO, CALIFORNIA 92101 FACSIMILE (619) 238-5425

September 26, 2018

Via email

Mark. C. Mao, Esq.

Troutman Sanders LLP

580 California Street, Suit 1100

San Francisco, CA 94104

[email protected]

Re: Christiansen v. ComplyRight (Orange Cty. Sup. Ct.) Case No. 30-2018-1010711

Dear Mr. Mao:

This is a response to your letter dated September 25, 2018 regarding the Christiansen

matter.

I understand that there is a lawsuit pending in the District Court for the Northern District

of Illinois (Winstead v. ComplyRight, Inc.) which was recently amended to add claims similar to

those asserted in this case. But, I struggle to see why Mr. Christiansen should defer his action in

favor of the Winstead case. First, Plaintiff is hesitant that the Northern District of Illinois has

jurisdiction to hear his claims. From what I understand, ComplyRight is a Minnesota

corporation with offices in California and Florida. And Christiansen seeks to represent a class of

California residents under California law. The Northern District of Illinois has been critical of

out-of-state plaintiffs who attempt to bring cases in the District for violations of foreign law

arising from defendant’s out-of-state activities. See Demaria v. Nissan N. Am., Inc., No. 15 C

3321, 2016 WL 374145, at *8 (N.D. Ill. Feb. 1, 2016). Second, Christiansen was the first filed

case to allege California statutory claims for a California class.

Additionally, I am also unclear on your claim that Mr. Christiansen brought his case

before the wrong court based on some choice-of-venue clause. I am aware of no contract

between your client and my client. However, if I am mistaken, please provide me an executed

copy of the relevant agreement.

Finally, the Orange County Superior Court undoubtedly has jurisdiction to hear Mr.

Christiansen’s claims, and I see no reason why Plaintiff should have brought this case in federal

court, regardless of the amount in controversy.

Nevertheless, I understand Defendants seek an extension to answer, or demurrer,

Plaintiff’s Complaint. Of course, we are willing to provide you a thirty (30) day extension as a


Mr. Mao

September 26, 2018

Page 2

professional courtesy. But, Plaintiff does not agree to a longer extension at this time or a stay in

favor of the Winstead case.

If you would like to discuss these matters further, feel free to contact my office.

Sincerely,

FINKELSTEIN & KRINSK LLP

Trenton R. Kashima, Esq.

TRK/rag

CC:

Sadia Mirza

[email protected]


TR

OU

TM

AN

SA

ND

ER

S L

LP

5P

AR

K P

LA

ZA

SU

ITE

14

00

IRV

INE

,C

A9

26

14

-25

45

36765832

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Mark C. Mao, Bar No. [email protected] TROUTMAN SANDERS LLP 580 California Street, Suite 1100 San Francisco, CA 94104 Telephone: 415.477.5700 Facsimile: 415.477.5710




SOUTHERN DIVISION

PAUL CHRISTIANSEN, individually and on behalf of all those similarly situated,

Plaintiff,

v.

COMPLYRIGHT. INC., a Minnesota corporation and DOES 1-10,

Defendant.

Case No. 8:18-cv-1920

PROOF OF SERVICE


TR

OU

TM

AN

SA

ND

ER

S L

LP

5P

AR

K P

LA

ZA

SU

ITE

14

00

IRV

INE

,C

A9

26

14

-25

45

36765832

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PROOF OF SERVICE

STATE OF CA, COUNTY OF ORANGE

I am a citizen of the United States and employed in Orange County, CA. I

am over the age of 18 and not a party to the within action; my business address is 5

Park Plaza, Suite 1400, Irvine, CA 92614-2545.

On October 25, 2018, I served the following document(s) described as:

1. DEFENDANT COMPLYRIGHT, INC.’S NOTICE OF REMOVAL

2. CIVIL COVER SHEET; 3. CERTIFICATION AND NOTICE OF INTERESTED PARTIES

(Local Rule 7.1-1)

BY MAIL: I am readily familiar with the firm’s practice of collection and processing correspondence for mailing. Under that practice it would be deposited with U.S. postal service on that same day with postage thereon fully prepaid at Irvine, CA, in the ordinary course of business. I am aware that on motion of the party served, service is presumed invalid if postage cancellation date or postage meter date is more than one day after date of deposit for mailing in affidavit.

On the following party:

Jeffrey R. Krinsk, Esq. Trenton R. Kashima, Esq. Finkelstein & Krinsk 550 West C St., Suite 1760 San Diego, California 92101

I declare that I am employed in the office of a member of the bar of this court

at whose direction the service was made. Executed on October 25, 2018, at Irvine,

CA.

Julie Valenzuela


ClassAction.orgThis complaint is part of ClassAction.org's searchable class action lawsuit database

https://www.classaction.org/database