Rahman v. Marriott International, Inc. et al.

California Consumer Privacy Act Class Action

Central District

U.S. District Judge David O. Carter

Defense Attorneys: Jenner & Block Llp, Lindsay C. Harrison, Todd C. Toral, Laura E.B. Hulce, Paul B. Rietema, Zachary C. Schauf, Brenna J. Field, Claire M. Lally

Plaintiffs Attorneys: Ai Law, Plc, Ahmed I. Ibrahim

Lindsay C. Harrison

What began as an apparent data breach originating in Russia that might have exposed personal information of 5.2 million Marriott International hotel guests ended quietly last January in a small park studded with lemon trees beside the federal courthouse in Santa Ana.

Marriott disclosed in March 2020 that information about members of its and partner airlines' loyalty programs may have been compromised. Later investigation revealed that an employee of a franchisee hotel in Russia had used his credentials improperly to access loyalty program data.

Marriott posted information about the intrusion on its website on a Tuesday. Plaintiffs filed a putative class action on Friday. Rahman v. Marriott International Inc., 8:20-cv-00654 (C.D. Cal., filed April 3, 2020)

"What happened here was [Marriott] was being incredibly responsible, and the plaintiffs were kind of trying to punish them for that," said Lindsay C. Harrison, who led the defense team from Jenner & Block LLP.

Plaintiffs' attorney Ahmad I. Ibrahim of AI Law PLC in Newport Beach declined by email to comment on the case.

Harrison and her team responded to the suit with a motion to dismiss, in which they "took advantage of what wasn't in the complaint as much as what was."

They argued that the intrusion was not truly a data breach because the only information potentially disclosed were customers' names, birthdays, email addresses and other material readily available on social media.

What was not disclosed were credit card numbers, Social Security numbers, passwords or other sensitive information. "There was no evidence that anyone's information had been misused in any way," she said.

The plaintiffs argued that the intrusion violated the new California Consumer Privacy Act. But the defense responded that, irrespective of the act, potential class members lacked standing to sue under the U.S. Constitution because none of them had actually been harmed.

"Our team did a nice job of telling the story of why this case wasn't like other [cybersecurity] cases," Harrison said.

Harrison, based in San Francisco, turned over arguing the dismissal motion to her Los Angeles partner Todd C. Toral.

He was told that the hearing would not be over Zoom or in Judge David O. Carter's courtroom, but outside. Upon arriving, he found a line of attorneys waiting to argue before Carter, who was sitting at one of the park benches on the lawn adjacent to the courthouse. When he and Ibrahim came up to argue, they sat at other benches, Toral said. And several times, Carter sent them off to separate lemon trees to discuss their cases further with their clients.

"It was fantastic," he said. "It was one of the more memorable moments I've had in a long time."

Carter dismissed all six causes of action with prejudice. The plaintiffs appealed but then reached a settlement.

To Harrison, the case is "important as a message to the plaintiffs' bar about going after companies that are being particularly diligent and really working hard to protect their customers."

- Don DeBenedictis

Todd C. Toral

Zachary C. Schauf