1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 SAFFRON REWARDS, INC., Case No. 22-cv-02695-DMR

8 Plaintiff,

ORDER ON MOTION TO DISMISS

9 v. Re: Dkt. No. 14 10 ALEX ROSSIE, 11 Defendant.

12 13 Plaintiff Saffron Rewards (“Saffron”) alleges that its co-founder Defendant Alex Rossie 14 breached his contractual and legal obligations to Saffron after Rossie left the company. [Docket 15 No. 1 (“Compl.”).] Now pending is Saffron’s motion to dismiss. [Docket No. 14 (“Mot.”); 18 16 (“Reply”).] Rossie opposes the motion. [Docket No. 17 (“Opp’n”).] This matter is suitable for 17 resolution without a hearing. Civ. L.R. 7-1(b). For the following reasons, the motion is granted in 18 part and denied in part. 19 I. BACKGROUND 20 The following facts are in the complaint.1 Saffron was co-founded on November 10, 2021 21 by Rossie and non-party Saumil Nanavati to democratize co-branded reward cards for businesses 22 of every size. Compl. ¶¶ 4, 23. Saffron is a Delaware corporation with its principal place of 23 business in San Francisco, California. Id. ¶ 1. Rossie was a member of Saffron’s board of 24 directors who resides in Washington and who was responsible for various technical aspects of the 25 26

27 1 When reviewing a motion to dismiss for failure to state a claim, the court must “accept as true all of the factual allegations contained in the complaint.” Erickson v. Pardus, 551 U.S. 89, 94 (2007) 1 company. Id. ¶¶ 2, 4, 24.2 2 On November 10, 2021, Saffron and Rossie entered into a Technology Assignment 3 Agreement (the “Agreement”) in which Rossie assigned all “Intellectual Property” rights to 4 Saffron. Compl. ¶¶ 5, 28.3 Rossie agreed not to “use or disclose anything assigned to [Saffron] 5 hereunder or any other technical or business information or plans of [Saffron].” Id. ¶ 27. 6 Thereafter until February 23, 2022, Rossie created numerous online business accounts through 7 third-party vendors that Saffron requires to conduct its business, including software development, 8 communications, website development, and finance (the “Company Accounts”). Id. ¶¶ 7, 25. The 9 Company Accounts included Saffron’s website domain, Google Workplace (email, storage, etc.), 10 software development platform, banking accounts, and Amazon Web Services, among others. Id. 11 ¶¶ 7, 26. The Company Accounts contain Saffron’s confidential technical and business 12 information including software code, product design and schematics, strategy materials, investor 13 and customer lists, legal documents, and debit card accounts with company funds. Id. ¶¶ 7, 25. 14

15 2 The complaint alleges that there is sufficient personal jurisdiction over Rossie because Rossie entered into the contract with a California-based entity and accessed Saffron’s accounts in 16 California, and that Rossie has “systematic and continuous contacts” here. Compl. ¶¶ 19-20. As 17 Rossie did not raise lack of personal jurisdiction in his motion, any challenge to personal jurisdiction has been waived. See Fed. R. Civ. P. 12(h)(1). 18 3 The Agreements defines “Intellectual Property” as encompassing: 19 (a) all technology, know-how, information, intellectual property and other materials for or relevant to [Saffron’s] business as currently 20 conducted and presently proposed to be conduct, including without 21 limitation, all business plans, technical plans, specifications, templates, demonstration versions, equipment, software, devices, 22 methods, apparatus, and product designs (collectively, “Technology”), (b) all precursors, portions and work in progress with 23 respect thereto and all inventions, works of authorship, mask works, technology, information, know-how, materials and tools relating 24 thereto or to the development, production, use, support or 25 maintenance thereof and (c) all copyrights, patent rights, trade secret rights, trademark rights, mask works rights, sui generis data base 26 rights and other intellectual property rights and all business, contract rights and goodwill in, incorporated or embodied in, used to develop 27 or produce or use, or related to any of the foregoing. 1 When Rossie created the Company Accounts, he assigned himself sole ownership and 2 administrator access. Id. ¶ 25. 3 On February 23, 2022, Rossie stopped providing services to Saffron and terminated his 4 engagement with the company, although he remained on the board of directors until April 29, 5 2022. Compl. ¶¶ 6, 29. Over the following weeks, Rossie refused to comply with Saffron’s 6 requests made on February 23, 2022 and March 30, 2022 to return company property to Nanavati, 7 including by withholding access to Saffron’s Company Accounts. Id. ¶¶ 7, 30-31. Saffron alleges 8 that Rossie’s refusal to return all administrator rights to the Company Accounts violated his legal 9 obligations, including under the Agreement. Id. ¶¶ 8, 30-31. On March 30, 2022, Rossie logged 10 into Saffron’s Google Workspaces and accessed information on the account without Saffron’s 11 permission or authorization. Id. ¶¶ 9, 32. 12 On April 7, 2022, Saffron’s counsel sent a letter to Rossie demanding that he return all 13 Saffron property, provide complete access to Company Accounts, and confirm that he had 14 complied with his obligation under the Agreement that if he had removed any of Saffron’s 15 property, he restored it immediately with appropriate permissions and access, and that he deleted 16 or destroyed any other Saffron documents. Compl. ¶¶ 10, 33. That same day, Rossie responded 17 by falsely claiming that he had already returned access rights to the Company Accounts and that 18 he no longer had access. Id. ¶¶ 11, 34. 19 Saffron subsequently filed this lawsuit on May 4, 2022, claiming that Rossie breached his 20 legal obligations under the Agreement and his fiduciary duties as a member of Saffron’s board by 21 intentionally withholding from Saffron the administrator rights to the Company Accounts, which 22 is Saffron’s property and contain confidential information. Compl. ¶¶ 35-36. Saffron also claims 23 that Rossie acted in bad faith for the purpose of harming Saffron and to obtain leverage to 24 negotiate his exit package. Id. ¶ 37. Saffron claims that Rossie’s conduct jeopardized its business 25 by causing a direct loss of customers, disrupting funding discussions with investors, and impeding 26 Saffron’s ability to hire employees. Id. ¶ 38. Saffron alleges (1) breach of the Agreement; (2) 27 breach of the fiduciary duty of loyalty; (3) breach of the implied covenant of good faith and fair 1 1030, and (5) conversion. Saffron seeks injunctive relief, damages including punitive damages, an 2 accounting and order requiring restitution and/or disgorgement of funds, interest, and reasonable 3 fees and costs. 4 II. LEGAL STANDARD 5 A motion to dismiss under Rule 12(b)(6) tests the legal sufficiency of the claims alleged in 6 the complaint. See Parks Sch. of Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). 7 When reviewing a motion to dismiss for failure to state a claim, the court must “accept as true all 8 of the factual allegations contained in the complaint,” Erickson, 551 U.S. at 94, and may dismiss a 9 claim “only where there is no cognizable legal theory” or there is an absence of “sufficient factual 10 matter to state a facially plausible claim to relief,” Shroyer v. New Cingular Wireless Servs., Inc., 11 622 F.3d 1035, 1041 (9th Cir. 2010) (citing Ashcroft v. Iqbal, 556 U.S. 662, 677-78 (2009); 12 Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001)) (quotation marks omitted). A claim has 13 facial plausibility when a plaintiff “pleads factual content that allows the court to draw the 14 reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 15 678 (citation omitted). In other words, the facts alleged must demonstrate “more than labels and 16 conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. 17 Corp. v. Twombly, 550 U.S. 554, 555 (2007). 18 Under Federal Rule of Civil Procedure 15(a), leave to amend should be granted as a matter 19 of course, at least until the defendant files a responsive pleading. Fed. R. Civ. P. 15(a)(1). After 20 that point, Rule 15(a) provides generally that leave to amend the pleadings before trial should be 21 given “freely . . . when justice so requires.” Fed. R. Civ. P. 15(a)(2). “This policy is to be applied 22 with extreme liberality.” Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1051 (9th Cir. 23 2003) (quotation omitted). However, leave to amend may be denied “where the amendment 24 would be futile.” Gardner v. Martino, 563 F.3d 981, 990 (9th Cir. 2009). 25 III. DISCUSSION4 26 The parties agree that Delaware law governs the breach of contract, breach of duty of 27 1 loyalty, and breach of the implied covenant claims pursuant to the Agreement. See Ex. A. ¶ 6 2 (“This Agreement shall be deemed to have been made in, and shall be construed pursuant to the 3 laws of the State of Delaware and the United States); Rennick v. O.P.T.I.O.N. Care, Inc., 77 F.3d 4 309, 313 (9th Cir. 1996) (“Under California conflict of law rules, the parties may agree to what 5 law controls, unless the choice is contrary to a fundamental interest of a state with a materially 6 greater interest.”). The parties agree that California law applies to the conversion claim. See 7 Allstate Ins. Co. v. Smith, 929 F.2d 447, 449 (9th Cir. 1991) (California law applies to federal 8 diversity cases arising in California). 9 A. Breach of Contract 10 Under Delaware law, to state a claim for breach of contract the plaintiff must show “[1] the 11 existence of the contract, whether express or implied; [2] the breach of an obligation imposed by 12 that contract; and [3] the resultant damage to the plaintiff.” VLIW Tech., LLC v. Hewlett-Packard 13 Co., 840 A.2d 606, 612 (Del. 2003). 14 The complaint alleges the parties entered into the Agreement, which was a binding and 15 enforceable contract that assigned Intellectual Property rights to Saffron and prohibited Rossie 16

17 generally may not consider any material beyond the pleadings in ruling on a Rule 12(b)(6) motion. 18 Lee v. City of Los Angeles, 250 F.3d 668, 688 (9th Cir. 2001). “A court may, however, consider certain materials—documents attached to the complaint, documents incorporated by reference in 19 the complaint, or matters of judicial notice—without converting the motion to dismiss into a motion for summary judgment.” United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003). The 20 incorporation by reference doctrine is “a judicially-created doctrine that treats certain documents 21 as though they are part of the complaint itself.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). Incorporation by reference is appropriate “if the plaintiff refers 22 extensively to the document or the document forms the basis of the plaintiff’s claim.” Id. at 1002 (quoting Ritchie, 342 F.3d at 907); see also Knievel v. ESPN, 393 F.3d 1068, 1076 (9th Cir. 2005) 23 (the doctrine applies in “situations in which the plaintiff’s claim depends on the contents of a document, the defendant attaches the document to its motion to dismiss, and the parties do not 24 dispute the authenticity of the document, even though the plaintiff does not explicitly allege the 25 contents of that document in the complaint”). Saffron’s breach of contract and implied covenant claims are based on the written 26 Agreement, and Saffron quotes from or refers extensively to the Agreement. See, e.g., Compl. ¶¶ 27 5, 10, 27, 28, 31, 43, 66. Saffron does not object to incorporation by reference of the Agreement. See generally Opp’n. The court finds that incorporation by reference of the Agreement is 1 from withholding access to the Company Accounts. Compl. ¶¶ 27-28, 31, 40-41, 43; see also Ex. 2 A ¶ 1 (“[Rossie] hereby assigns to [Saffron] exclusively throughout the world all right, title and 3 interest” to Intellectual Property). While Saffron performed its obligations under the Agreement, 4 Rossie breached his obligations by failing to return all company property to Saffron including by 5 not providing Saffron with the administrator rights to the Company Accounts. Id. ¶¶ 35, 42, 44. 6 Specifically, Rossie violated the assignment provision by withholding company property, 7 including confidential information he obtained from Saffron. Id. ¶ 44; see also Ex. A. ¶ 4 8 (“[Rossie] will not use or disclose anything assigned to the company.”). In sum, Saffron 9 apparently asserts that Rossie breached the Agreement’s assignment provision by withholding 10 access to Saffron’s Intellectual Property, the rights to which Rossie assigned to Saffron. Saffron 11 suffered damage as a result. Id. ¶¶ 38, 45.5 12 Rossie acknowledges that Saffron has pleaded the existence of a valid contract. See Mot. 13 at 1, 6 & n.1; Opp’n at 8; Reply at 4 n.4.6 As to breach, Rossie contends—albeit confusingly— 14 that he did not breach the Agreement because “it is not clear from the Complaint at what point Mr. 15 Rossie’s contractual obligations arose.” Mot. at 6. Rossie challenges the relevance of Saffron’s 16 claims that he logged into the account the week of March 28, 2022 without permission, in light of 17 his allegedly false April 7, 2022 representation that he had already returned access to the Company 18 Accounts. See Compl. ¶¶ 31, 36. He argues that the court should ignore Saffron’s allegations of 19 falsity because what happened on March 28 “has no bearing on the state of things on April 7.” 20 Mot. at 6. This raises a factual dispute, which is not appropriate for resolution through a motion to 21 dismiss in which the court must presume the truth of the allegations. Saffron’s allegations are 22 sufficient to plausibly plead the element of breach. 23 Rossie also argues that Saffron’s damages are too speculative. “It is axiomatic that a 24

25 5 The complaint does not clearly spell out how Rossie’s refusal to turn over access to the Company Accounts violated the assignment clause of the Agreement. The court does not examine this 26 because Rossie did not argue a lack of clarity on this point. 27 6 Rossie apparently disputes certain factual allegations but does not indicate the nature of those disputes. See Mot. at 1 n.1. As Rossie himself recognizes, the court must accept allegations as 1 plaintiff, in order to recover damages from a defendant for breach of contract, must demonstrate 2 with reasonable certainty that defendant’s breach caused the loss.” Tanner v. Exxon Corp., No. 3 79C-JA-5, 1981 WL 191389 (Del. Super. Ct. July 23, 1981); see also 24 Williston on Contracts § 4 64:12 (4th ed.) (“Williston”) (“[D]amages which are considered to be too remote and speculative 5 are not recoverable.”). “Reasonable certainty is not equivalent to absolute certainty; rather, the 6 requirement that plaintiff show defendant’s breach to be the cause of his injury with ‘reasonable 7 certainty’ merely means that the fact of damages must be taken out of the area of speculation.” 8 Tanner, 1981 WL 191389, at *1; see also Williston, supra, § 64:12 (“The amount of damages 9 must be established with reasonable, not absolute, certainty.”). 10 The plaintiff “need not allege an exact monetary figure in order to sufficiently plead that it 11 suffered damages from the breach of contract.” Weyerhaeuser Co. v. Domtar Corp., 61 F. Supp. 12 3d 445, 453 (D. Del. 2014) ((“Weyerhaeuser sufficiently pled damages by alleging that it has 13 incurred significant expenses in administering workers compensation claims made by Transferred 14 Employees, and that Domtar has refused to reimburse Weyerhaeuser for these incurred 15 expenses.”); see also VLIW Tech., 840 A.2d at 613 (allegations that “H–P has breached its 16 obligations under the 1990 Agreement by sharing trade secrets and know-how related to the Trace 17 compiler with STM” sufficient to withstand motion to dismiss). However, “[u]nder Delaware law, 18 consequential damages in the form of good will, lost future profits, and lost customers are not 19 awarded in breach of contract actions. The Delaware courts have consistently found these 20 damages to be speculative in nature, and, therefore, have barred recovery for them.” Crowell 21 Corp. v. Himont USA, Inc., No. CIV. A. 86C-11-125, 1994 WL 762663, at *3 (Del. Super. Ct. 22 Dec. 8, 1994) (unpublished) (citations omitted); see also Luxul Tech. Inc. v. Nectarlux, LLC, 78 F. 23 Supp. 3d 1156, 1175-76 (N.D. Cal. 2015) (under California law, “[t]o establish contractual 24 damages, a plaintiff must establish ‘appreciable and actual damage. . . . Nominal damages, 25 speculative harm, or threat of future harm do not suffice to show legally cognizable injury” 26 (internal citations and quotations omitted).). 27 Saffron alleges that “Mr. Rossie’s illegal conduct to date has not only caused and continues 1 Mr. Rossie’s illegal conduct has harmed Saffron by causing a direct loss of customers, disrupting 2 funding discussions with investors, and impeding Saffron’s ability to hire employees.” Compl. 3 ¶ 38. Saffron further pleads that it “has been deprived of rights and benefits due under the 4 Agreement, and has suffered, and will continue to suffer, compensatory and consequential 5 damages in the amount to be proven at trial.” Id. ¶ 45. Although not a paragon of clarity, these 6 allegations of harm are sufficient to plead damage under Delaware law at this stage. See, e.g., 7 Luxul, 78 F. Supp. 3d at 1176 (finding plaintiff sufficiently pled breach where “aver[ring] that that 8 Plaintiff lost potential sales and customers and damage to the value of its brand”). If Rossie 9 contends that certain categories of the requested contract damages are not cognizable, he can 10 challenge those damages at a later stage of the case. 11 Accordingly, the motion to dismiss the breach of contract claim is denied. 12 B. Duty of Loyalty 13 It is a “fundamental principle of Delaware law that the business and affairs of a corporation 14 are managed by or under the direction of its board of directors.” Cede & Co. v. Technicolor, Inc., 15 634 A.2d 345, 360 (Del. 1993) (citing Del. Code tit. 8, § 141). “In exercising these powers, 16 directors are charged with an unyielding fiduciary duty to protect the interests of the corporation 17 and to act in the best interests of its shareholders.” Id. Directors are charged with a “duty of 18 loyalty, which “mandates that the best interest of the corporation and its shareholders takes 19 precedence over any interest possessed by a director, officer or controlling shareholder and not 20 shared by the stockholders generally.” Id. at 361; see also Pro. Hockey Corp. v. World Hockey 21 Ass’n, 143 Cal. App. 3d 410, 414 (1983) (“Under both California and Delaware law the duty of 22 loyalty requires the directors/trustees not to act in their own self interest when the interest of their 23 corporation will be damaged thereby.”). 24 Courts “presume[] that in making a business decision the directors of a corporation acted 25 on an informed basis, in good faith, and in the honest belief that the action taken was in the best 26 interests of the company.” In re Walt Disney Co. Derivative Litig., 906 A.2d 27, 52 (Del. 2006). 27 “Those presumptions can be rebutted if the plaintiff shows that the directors breached their 1 in liability because the requirement to act in good faith ‘is a subsidiary element[,]’ i.e., a condition, 2 ‘of the fundamental duty of loyalty.’” Stone ex rel. AmSouth Bancorporation v. Ritter, 911 A.2d 3 362, 369–70 (Del. 2006). “Under Delaware law, the duty of good faith is breached where a 4 fiduciary acts with a purpose other than that of advancing the best interests of the corporation, 5 with the intent to violate the law, or where the fiduciary fails to act in the face of a known duty to 6 act.” In re Brocade Commc’ns Sys., Inc. Derivative Litig., 615 F. Supp. 2d 1018, 1047 (N.D. Cal. 7 2009) (citing Stone v. Ritter, 911 A.2d 362, 370 (Del. 2006), and Disney, 906 A.2d at 67). 8 Saffron alleges that Rossie was a member of its board of directors and was charged with 9 technological support and operations, including creating and maintaining the Company Accounts. 10 Compl. ¶¶ 4, 24-25, 47. After he ended his relationship with Saffron, he remained a director until 11 April 29, 2022. Id. ¶¶ 29, 48. Saffron claims that as a director, Rossie “had a fiduciary duty to the 12 company to return all company property to Saffron, including access and ownership rights to the 13 Company Accounts.” Id. ¶ 48. He breached this duty “by refusing to provide Saffron with 14 administrator rights to the Company Accounts and restoring ownership of the Company Accounts 15 to Saffron,” which “prevented . . . Saffron from engaging in its normal business activities.” Id. ¶ 16 49; see also id. ¶ 36. Saffron also claims that Rossie acted “in bad faith for the purpose of 17 harming Saffron and to keep Saffron’s property” and that he acted with the knowledge that 18 Saffron “relied on his services and role as a company director.” Id. ¶¶ 37-38. 19 Rossie argues that Saffron cannot claim a breach of the duty of loyalty because, per his 20 response to Saffron’s demand letter, he had already returned his accounts to Saffron by April 7, 21 2022. Mot. at 7. This contradicts the complaint, which alleges that Rossie “falsely claim[ed]” and 22 “misrepresented” that he had returned account access rights by that date. see Compl. ¶¶ 11, 34. 23 As discussed above, Rossie raises a factual dispute that is irrelevant at the pleadings stage.7 24

25 7 Rossie contends that unlike in Brocade, the complaint in this case fails to “contain[] extensive, 26 particularized allegations of overt acts evidencing a lack of good faith.” Brocade, 615 F. Supp. 2d at 1048. To the contrary, Saffron pleads that Rossie “repeatedly refused to comply with Saffron’s 27 requests” on two occasions to return company property, and that he logged into one account after 1 Next, Rossie contends that a board member has a right to access company information. 2 Consequently, he argues Saffron cannot ground its duty of loyalty claim in the allegation that 3 Rossie improperly logged into the Google Workspace because he was still a director at the time. 4 Mot. at 8.8 Rossie’s argument hinges on the scope of his roles and responsibilities as a director 5 after he separated from Saffron, and whether he was still entitled to unfettered access to the 6 Company Accounts at least during that time period. As previously stated, factual disputes cannot 7 be considered in the present posture. 8 Accordingly, the motion to dismiss the breach of fiduciary duty claim is denied. 9 C. Implied Covenant 10 In order to plead a breach of an implied covenant of good faith and fair dealing, the 11 plaintiff must allege the existence of “a specific implied contractual obligation, a breach of that 12 obligation by the defendant, and resulting damage to the plaintiff.” Anderson v. Wachovia Mortg. 13 Corp., 497 F. Supp. 2d 572, 581-82 (D. Del. 2007) (quoting Fitzgerald v. Cantor, Civ. A. No. 14 16297-NC, 1998 WL 842316, at *1 (Del. Ch. Nov. 10, 1998)). “The implied covenant requires a 15 party in a contractual relationship to refrain from arbitrary or unreasonable conduct which has the 16 effect of preventing the other party to the contract from receiving the fruits of the bargain.” 17 Dunlap v. State Farm Fire & Cas. Co., 878 A.2d 434, 442 (Del. 2005) (internal quotations and 18 footnotes omitted). “Thus, parties are liable for breaching the covenant when their conduct 19 frustrates the ‘overarching purpose’ of the contract by taking advantage of their position to control 20 implementation of the agreement’s terms.” Id. 21 “[T]he implied covenant does not apply when the contract addresses the conduct at issue, 22 but only when the contract is truly silent concerning the matter at hand.” Oxbow Carbon & Mins. 23

24 fiduciary duties.” Brocade, 615 F. Supp. 2d at 1048. 25 8 Rossi points to In re Aerojet Rocketdyne Holdings, Inc., No. CV 2022-0127-LWW, 2022 WL 1446782 (Del. Ch. May 5, 2022) (unpublished), in which the court explained that “a director’s 26 right to information is essentially unfettered in nature and includes equal access to board 27 information,” id. at *3 (quotations omitted). That case is inapposite, as it was decided on a motion to compel and involved the assertion of privilege to withhold information provided by a 1 Holdings, Inc. v. Crestview-Oxbow Acquisition, LLC, 202 A.3d 482, 507 (Del. 2019) (internal 2 quotations and footnotes omitted); see also Reklam v. Bellator Sport Worldwide LLC, 2017 WL 3 5172397, at *5 (D. Del. Nov. 8, 2017) (in evaluating an implied covenant claim, the court decides 4 “whether the language of the contract expressly covers a particular issue, in which case the 5 implied covenant will not apply, or whether the contract is silent on the subject, revealing a gap 6 that the implied covenant might fill.”). The court must “assess the parties’ reasonable expectations 7 at the time of contracting and not rewrite the contract to appease a party who later wishes to 8 rewrite a contract he now believes to have been a bad deal.” Nemec v. Shrader, 991 A.2d 1120, 9 1126 (Del. 2010). 10 Saffron alleges that the Agreement “contains an implied covenant of good faith and fair 11 dealing under which Mr. Rossie agreed not to take any action that would deprive Saffron of its 12 rights and benefits under the Agreement, and under which Mr. Rossie agreed to perform the 13 conditions of the Agreement fairly, in good faith.” Compl. ¶ 52. Rossie “repeatedly unreasonably 14 breached the covenant . . . and unfairly interfered with Saffron’s rights to receive the benefits of 15 the Agreement by refusing to provide Saffron with ownership and administrator rights to the 16 Company Accounts, which are not only Saffron’s property but contain Saffron’s confidential 17 information.” Id. ¶ 53; see also id. ¶¶ 31-32. As a result, Saffron suffered harm in the form of 18 “compensatory and consequential damages.” Id. ¶ 54. 19 Rossie argues that the implied covenant claim fails because it is premised on the same 20 conduct as alleged in the breach of contract claim. Neither party disputes that Rossie’s alleged 21 misconduct involved withholding access to the same accounts. See Compl. ¶¶ 30-31. As 22 discussed above, the Agreement provides for an assignment of all Intellectual Property rights to 23 Saffron. The Agreement does not, however, contain any express provision governing access to the 24 Company Accounts, requiring the return of those accounts to Saffron after Rossie’s separation 25 from the company, or barring Rossie from generally depriving Saffron of its right and benefits 26 under the Agreement. In other words, it is plausible that the Agreement contained an implied 27 covenant obligating Rossie to forbear from conduct that effectively “prevent[ed Saffron] from 1 reasonably expected that Rossie would not interfere with the Saffron’s rights to receive the 2 benefits of the assignment of his Intellectual Property interests. Accordingly, Saffron adequately 3 pleads a claim for breach of the implied covenant. 4 Accordingly, the motion to dismiss the implied covenant claim is denied. 5 D. Computer Fraud and Abuse Act 6 The CFAA imposes liability for anyone who “intentionally accesses a computer without 7 authorization or exceeds authorized access, and thereby obtains . . . information from any 8 protected computer.” 18 U.S.C. § 1030(a)(2)(C).9 Section 1030(a)(5)(C) also establishes liability 9 for anyone who “intentionally accesses a protected computer without authorization, and as a result 10 of such conduct, causes damage and loss.” The CFAA “provides two ways of committing the 11 crime of improperly accessing a protected computer: (1) obtaining access without authorization; 12 and (2) obtaining access with authorization but then using that access improperly.” Facebook, Inc. 13 v. Power Ventures, Inc., 844 F.3d 1058, 1066 (9th Cir. 2016) (quoting Musacchio v. United States, 14 577 U.S. 237, 240 (2016)). “An individual ‘exceeds authorized access’ when he accesses a 15 computer with authorization but then obtains information located in particular areas of the 16 computer—such as files, folders, or databases—that are off limits to him.” Van Buren v. United 17 States, 141 S. Ct. 1648, 1662 (2021); see 18 U.S.C. § 1030(e)(6) (defining “exceeds authorized 18 access as “to access a computer with authorization and to use such access to obtain or alter 19 information in the computer that the accesser is not entitled so to obtain or alter”). 20 “‘Authorization’ is an affirmative notion indicating that access is restricted to those specially 21 recognized or admitted.” hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195-96 (9th Cir. 22

23 9 A protected computer is defined as “‘an electronic. . . or other high speed data processing device performing logical, arithmetic, or storage functions’ that ‘is used in or affecting interstate or 24 foreign commerce or communication.’” In re Apple Inc. Device Performance Litig., 347 F. Supp. 25 3d 434, 451 (N.D. Cal. 2018) (quoting 18 U.S.C. § 1030(e)(1)-(2)) (holding cellular phones are protected). “This definition captures any device that makes use of a[n] electronic data processor, 26 examples of which are legion.” United States v. Kramer, 631 F.3d 900, 902 (8th Cir. 2011) 27 Saffron’s complaint does not specify the specific sub-sections of 18 U.S.C. § 1030 at issue; however, based on its representations in its opposition brief, the court infers they are sub-sections 1 2022). 2 Plaintiffs may file a civil action for damages and equitable relief violations of the CFAA 3 pursuant to 18 U.S.C. § 1030(g). Van Buren, 141 S. Ct. at 1652; Facebook, 844 F.3d at 1066. 4 Section 1030(g) section provides:

5 Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain 6 compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the 7 conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). 8 “Thus, a private plaintiff must prove that the defendant violated one of the provisions of § 9 1030(a)(1)-(7), and that the violation involved one of the factors listed in § 1030[(c)(4)(A)(i)].” 10 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Those factors are: 11 (I) loss to 1 or more persons during any 1-year period (and, for 12 purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course 13 of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; 14 (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care 15 of 1 or more individuals; (III) physical injury to any person; 16 (IV) a threat to public health or safety; or (V) damage affecting a computer system used by or for an entity of 17 the United States Government in furtherance of the administration of justice, national defense, or national security[.] 18 18 U.S.C. § 1030(c)(4)(A)(i). 19 The CFAA defines “damage” as “any impairment to the integrity or availability of data, a 20 program, a system, or information.” 18 U.S.C. § 1030(e)(8). A “loss” is defined as “any 21 reasonable cost to any victim, including the cost of responding to an offense, conducting a damage 22 assessment, and restoring the data, program, system, or information to its condition prior to the 23 offense, and any revenue lost, cost incurred, or other consequential damages incurred because of 24 interruption of service.” Id. § 1030(e)(11). “The statutory definitions of ‘damage’ and ‘loss’ thus 25 focus on technological harms—such as the corruption of files—of the type unauthorized users 26 cause to computer systems and data. Limiting ‘damage” and ‘loss’ in this way makes sense in a 27 scheme aimed at preventing the typical consequences of hacking. The term’s definitions are ill 1 fitted, however, to remediating ‘misuse’ of sensitive information that employees may permissibly 2 access using their computers.” Van Buren, 141 S. Ct. at 1660 (internal citations and quotations 3 omitted). The Ninth Circuit has also explained that the CFAA maintains a “narrow conception of 4 ‘loss,’” and that its definition, “with its references to damage assessments, data restoration, and 5 interruption of service—clearly limits its focus to harms caused by computer intrusions, not 6 general injuries unrelated to the hacking itself.” Andrews v. Sirius XM Radio Inc., 932 F.3d 1253, 7 1262-63 (9th Cir. 2019). “[A]ny theory of loss must conform to the limited parameters of the 8 CFAA’s definition.” Id. at 1263. 9 Saffron alleges that Rossie “intentionally and without authorization[] accessed Saffron’s 10 computer systems” after the termination of his engagement with Saffron, including logging into 11 the Google Workspaces account, despite “knowing that he was prohibited from accessing 12 Saffron’s computer systems.” Compl. ¶¶ 9, 32, 57-58. Rossie “obtained valuable information” 13 that was “valued at over $5,000” “intentionally and without authorization,” causing a loss 14 exceeding $5,000. Id. ¶¶ 57, 60.10 15 Saffron fails to adequately claim a cognizable “damage” or “loss” that conforms with the 16 “limited parameters” of the CFAA. See Andrews, 932 F.3d at 1262-63. The complaint does not 17 articulate any technological harm or interruption to Saffron’s computer-related services, nor that 18 Saffron conducted any damages assessments or data restorations in response to Rossie’s 19 withholding of the Company Accounts. 20 Saffron points to NovelPoster v. Javitch Canfield Grp., 140 F. Supp. 3d 954 (N.D. Cal. 21 2014), and Ross v. AT&T Mobility, LLC, No. 19-cv-06669-JST, 2020 WL 9848766 (N.D. Cal. 22 May 14, 2020), but these cases are distinguishable. In NovelPoster, the complaint adequately 23 pleaded a loss where the founders of an online retail company “spent substantial time and energy” 24 to restore lost data and conduct a damage assessment after defendants changed the passwords to 25 NovelPoster’s accounts and took control of its business. 140 F. Supp. 3d at 956-58, 962. Ross 26

27 10 The complaint does not explain what information “valued at over $5,000” was “obtained” by 1 applied NovelPoster and found that an allegation that the plaintiff “spent in excess of $5,000 2 investigating who accessed his mobile device and damaged information on it” was sufficiently 3 plead. 2020 WL 9848766, at *17. To the contrary, Saffron’s efforts as pled only involve making 4 two requests to Rossie to return company property and sending him a demand letter through 5 counsel. See Compl. ¶¶ 10, 30, 33. These activities do not state a claim of loss under the CFAA. 6 See NovelPoster, 140 F. Supp. 3d at 963 (“[U]nder the CFAA, the plaintiff’s costs are only 7 cognizable where they arise from the investigation or repair of a damaged computer system or 8 data, or from an ‘interruption of service.’”).11 9 Accordingly, the motion to dismiss the CFAA claim is granted with leave to amend. 10 E. Conversion 11 “A conversion claim arises where there is an ‘act of dominion wrongfully exerted over 12 another’s personal property in denial of or inconsistent with his rights therein.”” Florey Inst. of 13 Neuroscience & Mental Health v. Kleiner Perkins Caufield & Byers, 31 F. Supp. 3d 1034, 1041 14 (N.D. Cal. 2014) (quoting Weiss v. Marcus, 51 Cal. App. 3d 590, 599 (1975)); see also Gonzales 15 v. Pers. Storage, Inc., 56 Cal. App. 4th 464, 476 (1997) (conversion “rests upon the unwarranted 16 interference by defendant with the dominion over the property of the plaintiff from which the 17 injury to the latter results.”). 18 “The elements of a conversion claim are: (1) the plaintiff’s ownership or right to 19 possession of the property; (2) the defendant’s conversion by a wrongful act or disposition of 20

21 11 Rossie’s other arguments for dismissal of the CFAA claim are unpersuasive. Rossie first argues that because he was still a director on March 28, 2022, he retained authorization to access the 22 accounts when he allegedly logged into the Google Workspaces account. This poses an 23 inappropriate factual dispute about the scope of Rossie’s authorization to access the accounts at different points in time. Next, Rossie argues that the CFAA forbids obtaining information without 24 authorization, but the complaint is devoid of any allegations that he “obtained” information, rather than simply being “exposed” to it, Mot. at 10. Facebook, 844 F.3d at 1065-66; see 18 U.S.C. § 25 1030(a)(2)(C). Saffron adequately alleges that Rossie affirmatively obtained information when he logged into Saffron’s Google Workspaces without permission. Compl. ¶¶ 31-32. Finally, 26 Rossie’s contention that Saffron “conflates its activity directed to retrieving its account access and 27 negotiating Mr. Rossie’s exit package,” Reply at 10, is a factual assertion that is contradicted by the allegations about the communications between Rossie and Saffron and its counsel. See 1 property rights; and (3) damages.” Nguyen v. Stephens Inst., 529 F. Supp. 3d 1047, 1057-58 (N.D. 2 Cal. 2021) (quoting Lee v. Hanley, 61 Cal. 4th 1225, 1240 (2015)). “Neither legal title nor 3 absolute ownership of the property in question is necessary for a conversion claim—‘a party need 4 only allege it is entitled to immediate possession at the time of conversion.’” Florey, 31 F. Supp. 5 3d at 1041 (quoting Plummer v. Day/Eisenberg, LLP, 184 Cal. App. 4th 38, 45 (2010)). “Money 6 may be the subject of conversion if the claim involves a specific, identifiable sum.” Welco Elecs., 7 Inc. v. Mora, 223 Cal. App. 4th 202, 209 (2014). However, “[a] plaintiff may not ordinarily 8 recover for the tort of conversion ‘for the breach of duties that merely restate contractual 9 obligations.’” Nguyen, 529 F. Supp. 3d at 1057-58 (citations omitted). 10 The complaint alleges that the Company Accounts contained “confidential technical and 11 business information belonging to Saffron” and that through the Agreement Rossie assigned all 12 rights to Intellectual Property to Saffron, thereby conferring ownership rights. Compl. ¶¶ 25-26, 13 63. After Rossie’s separation, he continued to withhold administrator access to the Company 14 Accounts despite repeated requests to return access to Saffron’s confidential information. Id. ¶¶ 7, 15 30-34, 64, 66. Saffron claimed compensatory and consequential damages, in addition to punitive 16 damages related to Rossie’s specific intent to harm it. Id. ¶¶ 67-69. 17 Rossie’s arguments are similar to those asserted against the other claims and are thus easily 18 dispatched. See Mot. at 11-12. First, his contention that Saffron’s claim is based entirely on his 19 March 2022 logging onto the Google Workspaces Account is belied by allegations throughout the 20 complaint that Rossie wrongfully withheld access to the Company Accounts after his separation. 21 His next argument, that accessing the accounts was not wrongful because he was still a director, is 22 an inappropriate factual dispute. Contrary to Rossie’s assertion, the conversion claim does not 23 restate any contractual obligations because the Agreement does not contain any express language 24 governing access to the Company Accounts, as discussed above with respect to the implied 25 covenant claim. Finally, Saffron’s claim is not based on an alleged conversion of a specific sum 26 of money but rather Rossi’s unlawful retention of access to the Company Accounts. While some 27 of the Company Accounts are bank accounts, Saffron’s claim does not deal with any attempt by 1 Accordingly, the motion to dismiss the conversion claim is denied. 2 || IV. CONCLUSION 3 For the foregoing reasons, Rossie’s motion to dismiss the complaint is granted in part and 4 || denied in part. Rossie shall file an amended complaint to address the deficiencies in this order by 5 August 8, 2022. 6 The initial case management conference set for August 3, 2022 is vacated and continued to 7 September 7, 2022. The parties’ joint case management statement is due by August 31, 2022.

9 IT IS SO ORDERED. SS CS » A) 10 || Dated: July 25, 2022 A} S sO ORDEREP □ ul (Nyx 18 D ~ M. Ryu bh □□□ eT. □□ | tu ge DORE □□ = ay a □□

LOY KS

DISTRICS

Q 16

= 17

Z 18

19 20 21 22 23 24 25 26 27 28