BACKGROUND

Plaintiff worked for Sunset Tan from May 2003 through early 2006. In December 2005, plaintiff learned that Sunset Tan management had installed a computer program, Ultra VNC, that allowed a user to remotely monitor computer terminal screens being used by employees at any of the Sunset Tan store locations. When the program was activated, a user could see what appeared on another employee’s computer screen, including work-related actions (entering customer data, selling products or services) and non-work related actions (reading and responding to personal emails). Plaintiff retained defendant to pursue a lawsuit against Sunset Tan and its managers. The contemplated lawsuit would allege a variety of claims, including a claim that Sunset Tan violated the Privacy Act (codified at Penal Code, sections1 630-637.22) by surreptitiously installing the Ultra VNC monitoring program, which allowed Sunset Tan management to view personal emails that plaintiff read or sent while using Sunset Tan computers. Defendant, however, never filed the contemplated lawsuit despite plaintiff’s attempts to ensure that he did so. Plaintiff did not learn that the lawsuit had not

1 Undesignated statutory citations that follow are to the Penal Code. 2 been filed until after the statute of limitations on her various claims, including the Privacy Act claim, had already run. Plaintiff sued defendant for legal malpractice, concealment, and intentional and negligent misrepresentation based on his failure to file the contemplated complaint against Sunset Tan and individual defendants. The operative third amended complaint against defendant (the Complaint) alleged plaintiff suffered damages in the amount of the value of her then-expired causes of action. Plaintiff alleged general and special damages, including statutory damages under section 637.2. The Complaint alleged the section 637.2 statutory damages should be calculated as follows: “$5,000 per violation of Plaintiff’s privacy rights in her personal communications. Plaintiff estimates that Sunset Tan violated her privacy rights on 400 or more separate occasions and as such, Plaintiff is entitled to collect at least $2,000,000 ($5,000 [x] 400). . . . ” Plaintiff also alleged that she was entitled to punitive damages for defendant’s concealment and misrepresentation of material facts relating to the status of claims. Plaintiff served defendant with the Complaint. Defendant did not answer or otherwise respond.2 Plaintiff therefore filed a statement of the case in support of her request for a default judgment against defendant. Plaintiff’s statement of the case elected to seek damages predicated only on the contemplated causes of action against Sunset Tan for violating the Privacy Act (sections 631, 632, and 637.2) and not the eleven other contemplated causes of action identified in the Complaint. Plaintiff’s statement of the case was supported by declarations from plaintiff, a Sunset Tan corporate consultant, and an attorney expert regarding defendant’s professional negligence. Plaintiff’s declaration stated the following facts. Plaintiff’s communications with management occurred primarily through email. A Sunset Tan regional manager instructed plaintiff and other employees to use their personal email accounts to conduct work business and posted their personal email addresses in each store. Plaintiff complied

2 Defendant has not appeared in the proceedings in this court. 3 and used her personal email account to communicate with Sunset Tan management. In addition, during “down times, or when customers were busy tanning, or the store was slow,” plaintiff accessed her personal email account at work to read and write family members, to communicate with people she was dating or that wanted to date her, and to communicate with her acting agent and business managers. Plaintiff also used the Sunset Tan computers for web searches; she researched “personal medical issues” and located and signed up for cooking school and other classes. Plaintiff never saw any company policy concerning the use of the company’s computers, did not share the passwords for her personal email accounts with anyone, intended her personal email accounts to be confidential and private, and accessed her personal emails and searched websites for personal purposes when she was alone and no one could look at the emails or websites. Plaintiff’s declaration also described the basis for her belief that Sunset Tan personnel may have used the Ultra VNC program to monitor her computer workstation. Plaintiff averred: Beginning in September 2005, I began to get strange comments from Lisa [a Sunset Tan regional manager] and from some of the other staff at the West LA salon. Among other things, Lisa and others would comment on a book that they wanted to read, or pretend to make fun of another friend’s nickname, or ask if I was feeling okay or needed to see a doctor. Sometimes, Lisa and others would ask how my cooking classes were going, when the class they asked about had not started yet. I found these comments strange, because they usually occurred within a day or so of a private conversation or email that I had about the same book, or an email I had received or written about the same nickname, or after I had read or researched a medical condition or made an appointment, or after I had signed up for cooking school classes. All of these matters were private and confidential to me, and I did not disclose them to Lisa or others at Sunset Tan. . . .

Plaintiff also asserted that she was subjected to increasingly poor treatment by Sunset Tan management, particularly the regional manager Lisa, after sending personal emails that were critical of Sunset Tan management.

4 Plaintiff lodged with her declaration copies of emails that could have been seen by a user who was monitoring her computer screen via the Ultra VNC program. Plaintiff stated she searched for and printed the emails from September 1, 2005, through December 28, 2005, that remained in her personal email account inbox and outbox. She explained that “[n]early all of these emails were read, drafted, sent or reviewed during my work hours at Sunset Tan.” She stated that there were 400 emails sent or received during that period and that “298 emails were personal and confidential, to family or friends, or to other co-workers about management and meant to be private from management.” She sought statutory damages under section 637.2 for each of the 298 emails, totaling $1,490,000. The declaration from Michael Burke (the Sunset Tan corporate consultant) submitted with plaintiff’s statement of the case stated that on December 27, 2005, he signed on to a computer in Sunset Tan’s corporate management offices. He discovered that a spyware and monitoring program, Ultra VNC, had been installed on the management computer. Burke described the functionality of the program: By opening [the Ultra VNC] program, I was able to view the computer terminal screen of any of the store locations. I immediately observed that the program duplicated the display of the remote computer, which it was able to do through the internet connection. . . . [¶] I was able to watch in real time as employees entered customer data, sold products and services, and also opened their own personal email accounts. I was able to observe various employees reading their personal and confidential emails, and writing responses to those emails as well as new emails to their friends, family, associates and contacts. . . . Print and screen capture functions were available on the program.

Burke was able to determine that the Ultra VNC program had been installed on August 24, 2005, but neither Burke nor any other declarant provided any further description of the Ultra VNC program’s capabilities. There was therefore no evidence that the program had the capability to record (or did record) the actions shown on a remote computer screen. Nor was there any indication as to whether the program monitored all Sunset Tan

5 computers when launched by a user, or whether it was only possible to monitor them one at a time because a user must select a particular terminal to monitor. After plaintiff filed her prove-up papers in support of a default judgment against defendant, the trial court set an order to show cause (OSC) hearing. The trial court’s order setting the hearing raised questions concerning the $1,490,000 sum plaintiff claimed she was owed as damages for multiple violations of the Privacy Act—or, more precisely, defendant’s failure to file a lawsuit asserting violations of the Privacy Act. The court stated it required greater precision as to whether any Privacy Act statute applies to emails passed over an employer-owned internet system and whether, if so, the interception of individual emails should be counted as separate violations entitling plaintiff to $5,000 in damages for each under the statutory scheme. Plaintiff filed a brief in response to the OSC, claiming that Sunset Tan “monitored and accessed over 400 emails” but seeking damages pursuant to section 631, 632, and 637.2 for just the 298 emails that she believed were personal and private communications. Plaintiff’s brief cited authority for her claim that she had a reasonable expectation of privacy in personal emails sent over an employer’s computer system. Plaintiff did not submit any additional declarations or evidence in response to the trial court’s OSC. The record on appeal does not include a transcript of the order to show cause hearing. The trial court, however, issued a “Notice of Entry of Judgment on Default Prove-Up,” and that written ruling is part of the record. The court’s ruling states that the purpose of the hearing was to discern the factual basis for plaintiff’s claim of $1,490,000 in damages, and that the issue was how statutory damages under section 637.2 should be calculated. The trial court found that plaintiff was entitled to statutory damages of $5,000 for only one statutory violation, the installation of the spyware. The court distinguished cases cited by plaintiff where the defendants had installed recording devices to secretly capture communications and the plaintiffs thereafter recovered damages based on multiple violations of the Privacy Act. The trial court found that in this case, unlike those

6 cases, there was “no evidence that plaintiff’s former employer installed the spyware to target plaintiff nor that the employer reviewed any of plaintiff’s emails in which she had a reasonable expectation of privacy.” The trial court entered a default judgment against defendant in the amount of $5,000. Plaintiff filed a timely notice of appeal.

DISCUSSION

I. Standard of Review

The trial court determined plaintiff was entitled to only $5,000 in statutory damages under section 637.2, finding she had not sufficiently shown Sunset Tan personnel reviewed any of the emails in which she had a reasonable expectation of privacy (nor that Sunset Tan installed the Ultra VNC program to target her). In making this determination, the trial court acted in its established role as a “gatekeeper” that tests the propriety of damages claims before entering a default judgment. (Heidary v. Yadollahi (2002) 99 Cal.App.4th 857, 868 [“It is not in plaintiffs’ interest to be conservative in their demands, and without any opposing party to point out the excesses, it is the duty of the court to act as gatekeeper, ensuring that only the appropriate claims get through”].) A plaintiff dissatisfied with default judgment damages awarded by a trial court may appeal the ruling. (Johnson v. Stanhiser (1999) 72 Cal.App.4th 357, 361-362 (Johnson).) We will reverse the trial court’s damages finding where it is “totally unconscionable and without justification.” (Johnson, supra, at pp. 361; accord, Scognamillo v. Herrick (2003) 106 Cal.App.4th 1139, 1150 (Scognamillo); see Barragan v. Banco BCH (1986) 188 Cal.App.3d 283, 302 (Barragan) [reversing default judgment where evidence suggested the damages awarded were unconscionable and excessive as a matter of law].) A ruling awarding damages that is not supported by substantial evidence satisfies that standard. (Scognamillo, supra, at p. 1150.)

7

II. Analysis

A. Default Judgments, and a Plaintiff’s Burden to Prove-up Damages Under Code of Civil Procedure, section 585, where the relief sought in a complaint is more complicated than a ministerial award of compensatory damages, a plaintiff who seeks a default judgment must request entry of the judgment by the court. (Code Civ. Proc., § 585, subds. (a)-(b); Kim v. Westmoore Partners, Inc. (2011) 201 Cal.App.4th 267, 287 (Kim).) The plaintiff must affirmatively establish that he or she is entitled to the specific judgment requested. (Code Civ. Proc., § 585, subd. (b) [“The plaintiff . . . may apply to the court for the relief demanded in the complaint. The court shall hear the evidence offered by the plaintiff, and shall render judgment in the plaintiff’s favor for that relief, not exceeding the amount stated in the complaint, . . . as appears by the evidence to be just”]; Kim, supra, at p. 287.) A defendant’s default operates as an admission of the matters well-pleaded in a complaint. (Kim, supra, 201 Cal.App.4th at p. 281; Morehouse v. Wanzo (1968) 266 Cal.App.2d 846, 853.) “The ‘well-pleaded allegations’ of a complaint refer to ‘“‘all material facts properly pleaded, but not contentions, deductions or conclusions of fact or law.’”’” (Kim, supra, at p. 281, citations omitted.) Thus, at a prove-up hearing under Code of Civil Procedure, section 585 to seek entry of a default judgment, a plaintiff need not introduce evidence in support of the complaint’s allegations of liability. (Carlsen v. Koivumaki (2014) 227 Cal.App.4th 879, 900.) The issue of damages, however, is different. “‘Plaintiffs in a default judgment proceeding must prove they are entitled to the damages claimed.’ [Citations.]” (Kim, supra, 201 Cal.App.4th at p. 288; accord, Taliaferro v. Hoogs (1963) 219 Cal.App.2d 559, 560 [default judgment can be entered only on proof to court of damage sustained, citing Code Civ. Proc., § 585]; Barragan, supra, 188 Cal.App.3d at p. 302.) A plaintiff is not required to prove damages in support of a default judgment by a preponderance of the evidence; rather, the evidence submitted by a plaintiff is sufficient if it establishes a prima facie case for the damages sought. (Harbour Vista, LLC v. HSBC Mortg. Services

8 Inc. (2011) 201 Cal.App.4th 1496, 1503, fn. 6 (Harbour Vista, LLC); Johnson, supra, 72 Cal.App.4th at p. 361.) “[B]ut a prima facie case is not equivalent to ‘a matter of course.’ Prima facie evidence is still evidence and subject to some standards.” (Harbour Vista, LLC, supra, at p. 1503, fn. 6.) Code of Civil Procedure, section 585, gives trial courts discretion to allow a plaintiff to make the requisite showing by affidavit in lieu of personal testimony, but it requires facts stated in such an affidavit to be “set forth with particularity.” (Code Civ. Proc., § 585, subd. (d); Kim, supra, at p. 287.)

B. Plaintiff’s Default Prove-up Papers Did Not Establish a Prima Facie Case That Sunset Tan Recorded or Read Her Emails “An attorney’s liability [for professional negligence], ‘“as in other negligence cases, is for all damages directly and proximately caused by his negligence.”’ [Citations.]” (DiPalma v. Seldman (1994) 27 Cal.App.4th 1499, 1507.) Plaintiff’s damages therefore depended on the probable value of the lawsuit that she lost. (Hinshaw, Winkler, Draa, Marsh & Still v. Superior Court (1996) 51 Cal.App.4th 233, 239; see also Mattco Forge, Inc. v. Arthur Young & Co. (1997) 52 Cal.App.4th 820, 832-833 (Mattco Forge, Inc.) [legal malpractice action takes on a “case-within-a-case” character and requires plaintiffs to prove both malpractice and the merit of the underlying lawsuit].) Plaintiff sought to demonstrate the probable value of the lawsuit she lost solely on the basis of the Privacy Act causes of action against Sunset Tan that defendant did not pursue.3 We assume for purposes of our decision that if plaintiff could establish a prima

3 Plaintiff also asserts that the trial court erred because it failed to award her “damages for common law invasion of privacy, the violation of her constitutional right of privacy, or on any of the other causes of action that were properly pleaded and for which [plaintiff] established a prima facie case.” Because plaintiff elected not to seek or submit evidence of damages for the other contemplated causes of action identified in her complaint in the trial court, she is foreclosed from seeking such damages on appeal. Furthermore, plaintiff’s contention is forfeited because her brief in this court does not develop the legal argument or cite to the record in support of the claim. (Magic Kitchen LLC v. Good Things Internat. Ltd. (2007) 153 Cal.App.4th 1144, 1161-1162; Moulton 9 facie case that Sunset Tan had (a) read her private emails or (b) recorded her computer terminal when she sent or viewed such emails, she would be entitled to damages under section 631 or section 632 for each such email reviewed or recorded. (Ribas v. Clark (1985) 38 Cal.3d 355, 360 (Ribas) [section 631 prohibits “(1) intentional wiretapping, (2) willful attempts to learn the contents of a communication in transit, and (3) attempts to use or publicize information obtained in either manner”]; Kight v. CashCall, Inc. (2011) 200 Cal.App.4th 1377, 1390 [section 632 prohibits surreptitious recording or eavesdropping upon confidential communications]; see also Lieberman v. KCOP Television, Inc. (2003) 110 Cal.App.4th 156, 167 [statutory damages of $5,000 available for each violation of the act, citing Ribas].) The trial court found, however, that the declarations plaintiff submitted did not establish that Sunset Tan personnel reviewed any of her private emails nor establish any other violation of the Privacy Act beyond the installation of the Ultra VNC spyware program itself. We see no basis to disturb the trial court’s conclusion under the applicable standard of review. Neither plaintiff’s declaration nor the declaration from Burke stated any facts to indicate the Ultra VNC program was capable of recording the actions taken on a remote computer terminal. Burke stated that the program did have screen print functionality, but that of course is not the same as recording. Without any evidence that the Ultra VNC program was recording her computer activity, plaintiff can only show she is entitled to damages for multiple violations of the privacy act on a sufficient showing that Sunset Tan personnel eavesdropped upon, or read, her private emails.4

Niguel Water Dist. v. Colombo (2003) 111 Cal.App.4th 1210, 1215 [“Contentions are waived when a party fails to support them with reasoned argument and citations to authority”); Badie v. Bank of America (1998) 67 Cal.App.4th 779, 784-785 [“When an appellant fails to raise a point, or asserts it but fails to support it with reasoned argument and citations to authority, we treat the point as waived”).) 4 Plaintiff also points to the language in section 631, but not section 632, that punishes attempts to violate that section. Had plaintiff introduced facts to suggest that Sunset Tan personnel installed the software to target her computer, as opposed to any of 10 Code of Civil Procedure section 585 required plaintiff to set forth the facts she relied on to make such a showing “with particularity.” (Code Civ. Proc., § 585, subd. (d).) Plaintiff’s declaration falls short of this mark. Plaintiff asserts she is entitled to $5,000 in statutory damages for each of 298 personal emails she sent between September 1, 2005, and December 27, 2005. But her declaration does not establish that she sent, received, or read all of these emails while working on a Sunset Tan computer. Rather, the most plaintiff was able to muster was a statement that “nearly all of these emails were read, drafted, sent or reviewed during my work hours at Sunset Tan.” Plaintiff cannot make out a prima facie case for $5,000 in statutory damages for personal emails she did not access while using Sunset Tan computers, and she made no effort to specify those emails among the group of 298 that she did not access while at work. Instead, plaintiff requested damages for all (not nearly all) of the 298 emails. This was impermissible. Further, accepting plaintiff’s representation that she did access most of these emails at work, she was still required to allege particular facts to raise a prima facie inference that Sunset Tan personnel read or “eavesdropped upon” those emails. We cannot conclude that the trial court erred when it found plaintiff’s declaration was inadequate for that purpose. The facts plaintiff alleged to suggest Sunset Tan personnel read her emails were the facts in paragraph 13 of her declaration, quoted in relevant part ante, at page 5.5

the other computers on the network, her argument for damages based on an attempt would have greater force. The trial court, however, found there was no such evidence and we see none either. 5 Plaintiff’s declaration might also be read to imply that the poor treatment she claims to have received from Lisa, the Sunset Tan regional manager, could have been attributable to eavesdropping on personal emails that she asserts were critical of Lisa. Plaintiff’s declaration, however, reveals a separate and equally plausible reason for the treatment she claims to have received from Lisa, namely, plaintiff’s efforts to seek a managerial position that would have reduced the bonus payments Lisa received. In any event, any implied assertion that Lisa’s treatment of plaintiff was sufficient to carry her 11 Plaintiff stated she got “strange comments” that, to her, suggested Lisa and other Sunset Tan personnel were reading her emails. Plaintiff, however, did not make any effort to connect these comments to particular emails among the roughly 400 emails she lodged with the court. Moreover, in some instances, the facts set forth by plaintiff in her declaration were insufficient even on their own terms to raise an inference that the comments she described were attributable to email eavesdropping.6 The trial court was entitled to find that plaintiff’s declaration lacked sufficient particularity and relied on suspicion of eavesdropping that was too nebulous to constitute sufficient evidence of the damages claimed. Indeed, the lack of particularity in the evidentiary submission offered by plaintiff here is not much different than the lack of particularity that the Court of Appeal found dispositive in Kim, supra, 201 Cal.App.4th 267. The plaintiff in Kim sought default judgment damages for breach of certain promissory notes. As evidence to prove damages, Kim provided the trial court with the six statements of damages he served on the defaulting defendants and requested a judgment of $5 million against each defendant. (Id. at p. 279.) Kim, however, “made no effort to correlate that amount to any particular claim or promissory note . . . [and] simply stated that ‘[c]onsistent with the statement of damages, each defendant owes me at least $5 million.” (Ibid.) Kim also submitted a

burden to show Sunset Tan personnel read her emails fails for the same reasons that the statements in paragraph 13 of her declaration fail. 6 For example, plaintiff states that that “Lisa and others would comment on a book that they wanted to read,” and she states she found the comment strange because it “occurred within a day or so of a private conversation or email that I had about the same book. . . . ” (Emphasis added.) The concession that the comment may have been attributable to a conversation undermines the inference that Sunset Tan personnel read any such email. Plaintiff also asserts “Lisa and others” would ask about cooking classes that had not started yet. Plaintiff’s declaration does not state that she sent any emails regarding cooking classes; rather, it states she “used the computer at work to research personal medical issues, and to locate and sign up for cooking school and other classes.” Plaintiff, however, sought damages based on evidence of emails she sent, not internet searches that she ran. 12 declaration from his attorney that attached an exhibit described as “documentation regarding the damages,” which consisted of several pages of accounts that did not seem to correlate to any of the promissory notes and were not explained in any declaration. (Ibid.) The Court of Appeal held the “sheaf of documents” submitted by Kim were unintelligible, unsupported by any foundation, useless as evidence, and insufficient to comply with Code of Civil Procedure, section 585’s mandate that any facts be set forth with particularity. (Id. at pp. 287-288.) Here, plaintiff does more than assert she is entitled to over $1 million in damages, but not much more. She provides little foundation in her declaration about the claimed comments made by “Lisa and others,”7 and she makes no effort to correlate the asserted comments with the sheaf of emails she lodged with the trial court. The trial court believed this was insufficient to carry her burden to establish multiple violations of the Privacy Act and we hold the record supports that determination.8 We are mindful of the procedural posture in which we find this case. A plaintiff seeking to recover damages on a default judgment for legal malpractice, which carries

7 Other than a reference to “[b]eginning in September 2005,” plaintiff’s declaration does not provide approximate dates when such comments were made nor does she identify people who were present other than Lisa. She also does not provide any specifics about the comments by “Lisa and others” that would enable a court to conduct a comparison of the emails she sent with the comments that she claims were made, for instance, the friend’s nickname or the name of the book that Lisa and others discussed in her presence. 8 The trial court’s notice of entry of judgment states plaintiff submitted “no evidence that plaintiff’s former employer installed the spyware to target plaintiff nor that the employer reviewed any of plaintiff’s emails in which she had a reasonable expectation of privacy.” Without a reporter’s transcript in the record that would reveal what transpired at the hearing, we decline to read the court’s reference to “no evidence” as an indication that the court was unfamiliar with the portion of plaintiff’s declaration that served as the basis for her assertion that Sunset Tan may have reviewed her emails. Indeed, the trial court’s notice of entry of judgment states that it received plaintiff’s default prove-up papers, and the court was necessarily familiar with those papers, having issued an order to show cause after plaintiff submitted them. 13 with it the case-within-a-case dynamic we have described, can at times find him or herself at a disadvantage. (See Mattco Forge, Inc., supra, 52 Cal.App.4th at pp. 833-834 [noting criticism that plaintiffs may “face formidable problems of proof” because of the case-within-a-case aspect of a malpractice claim].) A plaintiff should not be expected to have evidence that conclusively proves he or she is entitled to a certain amount of damages, nor even that he or she is entitled to such damages based on a preponderance of the evidence; rather, a plaintiff must establish only a prima facie case. But a plaintiff is still required to state those facts he or she can muster in support of such a showing with particularity. Plaintiff did not do so here. We hold the trial court correctly limited damages to $5,000, for installation of the Ultra VNC spyware, based on the evidence plaintiff submitted.

DISPOSITION

The judgment is affirmed. Plaintiff is not awarded costs on appeal.

NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS

BAKER, J.

I concur:

KRIEGLER, J.

14 15 Mosk, J., Dissenting

I respectfully dissent because the trial court erred in holding that there was no evidence that plaintiff’s former employer reviewed plaintiff’s e-mails. There was evidence that plaintiff’s confidential emails were reviewed by her employer and its employees. Penal Code section 631, subdivision (a) states it is violated when, “Any person . . . willfully and without the consent of all parties to the communication, or in any unauthorized manner, reads, or attempts to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable . . . .” Plaintiff’s request for a default judgment against defendant was supported by her declaration that in September 2005, Sunset Tan’s regional manager and other staff members made comments to plaintiff about several matters, including a book they wanted to read and a friend’s nickname, approximately one day after plaintiff discussed these matters using her personal e-mail accounts. Plaintiff had not disclosed these matters to anyone at the Sunset Tan stores. This is evidence that at least some of plaintiff’s personal and confidential e-mails were read by supervisors and other employees at Sunset Tan. In awarding plaintiff only $5,000 in statutory damages based on one statutory violation of Penal Code sections 630-637.2 for the installation of the spyware, the trial court nevertheless held that there was “no evidence” that the employer reviewed any of plaintiff’s e-mails in which she had a reasonable expectation of privacy. Based on the alleged comments made by Sunset Tan’s employees, I would remand the matter to the trial court to determine, which, if any, of plaintiff’s confidential e-mails were reviewed by Sunset Tan.

MOSK, Acting P.J.