Edward Baton; v. Ledger Sas;

NOT FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
EDWARD BATON; et al.,
Plaintiffs-Appellants,
v.
LEDGER SAS; et al.,
Defendants-Appellees.
No. 21-17036
D.C. No. 3:21-cv-02470-EMC
MEMORANDUM*
Appeal from the United States District Court
for the Northern District of California
Edward M. Chen, District Judge, Presiding
Argued and Submitted November 14, 2022
San Jose, California
Before: GRABER, TALLMAN, and FRIEDLAND, Circuit Judges.
Plaintiffs bought “hardware wallets” in which to store cryptocurrency assets.
They allege that a data breach exposed personal information that they had provided
in connection with their purchases. Plaintiffs, on behalf of a putative class, sued
Ledger SAS, the French company that manufactured and sold the wallets; Shopify
Inc., the Canadian company that provided e-commerce services for Ledger’s online
* This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.
FILED
DEC 1 2022
MOLLY C. DWYER, CLERK
U.S. COURT OF APPEALS

-- 1 of 6 --

2
store; and Shopify (USA) Inc., a subsidiary of Shopify Inc. based in Delaware.
The district court dismissed the action for lack of personal jurisdiction over
Defendants, denied Plaintiffs’ request for jurisdictional discovery, and denied
Plaintiffs’ request for leave to amend. Plaintiffs timely appeal. We review de
novo the dismissal for lack of personal jurisdiction, Picot v. Weston, 780 F.3d
1206, 1211 (9th Cir. 2015); for abuse of discretion the denial of jurisdictional
discovery, LNS Enters. LLC v. Cont’l Motors, Inc., 22 F.4th 852, 858 (9th Cir.
2022); and for abuse of discretion the denial of leave to amend, Curry v. Yelp Inc.,
875 F.3d 1219, 1228 (9th Cir. 2017). We affirm in part and reverse and remand in
part.
1. The district court had specific personal jurisdiction over Ledger. The
“purposeful availment” framework applies because Plaintiffs’ claims are for
negligence. Holland Am. Line Inc. v. Wärtsilä N. Am., Inc., 485 F.3d 450, 460
(9th Cir. 2007). Ledger has sold about 70,000 wallets directly to Californians,
generating millions of dollars in revenue; its website is designed to collect the
applicable California sales tax for buyers whose IP addresses are in California; and
it ships the wallets directly to California addresses. Taken together, those facts
suffice to establish purposeful availment because Ledger’s contacts with the forum
cannot be characterized as “random, isolated, or fortuitous.” See Keeton v. Hustler
Mag., Inc., 465 U.S. 770, 774 (1984) (holding that the defendant’s regular monthly

-- 2 of 6 --

3
sales of thousands of magazines to New Hampshire residents created the necessary
minimum contacts to support personal jurisdiction).
In addition, Plaintiffs’ claims “arise out of” those sales. Ford Motor Co. v.
Mont. Eighth Jud. Dist. Ct., 141 S. Ct. 1017, 1025 (2021) (quoting Bristol-Myers
Squibb Co. v. Superior Ct., 137 S. Ct. 1773, 1780 (2017)). Buyers are required to
disclose personal information in order to buy the wallets, Ledger retains those data
for e-commerce and marketing purposes, the wallets are advertised as part of a
larger security “ecosystem,” and Plaintiffs allege that they would not have bought
wallets had they known of Ledger’s poor data security practices. See Learjet, Inc.
v. Oneok, Inc. (In re W. States Wholesale Nat. Gas Antitrust Litig.), 715 F.3d 716,
742 (9th Cir. 2013) (“[A] lawsuit arises out of a defendant’s contacts with the
forum state if a direct nexus exists between those contacts and the cause of action.”
(quoting Fireman’s Fund Ins. Co. v. Nat’l Bank of Coops., 103 F.3d 888, 894 (9th
Cir. 1996))).
2. As noted, Plaintiffs’ claims arise out of their purchase of Ledger wallets.
To buy a wallet, a purchaser must agree to the Sales Terms and Conditions, which
acknowledge that Ledger may collect personal data and which refer in turn to the
Privacy Policy for details regarding Ledger’s use of those data. In addition, users
must agree to the Ledger Live Terms of Use when they begin to use the Ledger
Live software. All three documents contain extremely broad forum selection

-- 3 of 6 --

4
clauses providing that covered disputes will be subject to the exclusive jurisdiction
of the French courts.1 The forum-selection clause in the Ledger Live Terms of
Use, for example, covers “[a]ny dispute, controversy, difference or claim arising
out of or relating to” the agreement.2 The broad scope of that clause encompasses
this lawsuit. See Yei A. Sun v. Advanced China Healthcare, Inc., 901 F.3d 1081,
1086–87 (9th Cir. 2018) (concluding that a forum-selection clause encompassing
disputes “arising out of or related to” the agreement covered the suit because the
dispute had a logical or causal connection to the agreement).
These forum-selection clauses are enforceable except with respect to
Plaintiffs who are “California resident plaintiffs bringing class action claims under
California consumer law.” Doe 1 v. AOL LLC, 552 F.3d 1077, 1084 (9th Cir.
2009) (per curiam) (holding that a forum-selection clause was unenforceable
because it violated California public policy against waiver of consumer rights
under California’s Consumer Legal Remedies Act). Accordingly, we reverse the
dismissal of Plaintiffs’ California consumer law claims but otherwise affirm the
dismissal of Plaintiffs’ claims against Ledger.
1 All three documents also contain choice-of-law provisions that apply French law.
2 Plaintiffs do not argue that their claims stand in a different causal relationship to
the Ledger Live Terms of Use than to the Privacy Policy or Sales Terms and
Conditions.

-- 4 of 6 --

5
3. With respect to the Shopify Defendants, the district court correctly ruled
that the present record does not support personal jurisdiction, but abused its
discretion by disallowing any jurisdictional discovery and an opportunity to amend
the complaint following jurisdictional discovery. Shopify USA employs more than
200 people who work remotely from California. One of those employees has the
title of “Data Protection Officer” (DPO). It is reasonable to infer that this
employee may have played a role related to the data breach because he appears to
have overseen the relevant privacy policies and Shopify’s response. The DPO’s
LinkedIn profile displays his title as “Vice President, Legal; Data Protection
Officer.” His job duties include “[s]trategically advis[ing the] executive team,
senior leaders, and Board of Directors,” as well as “[s]erv[ing] as [the] company’s
Data Protection Officer, advising senior management, Board of Directors, and key
teams within the company on issues relating to privacy, data protection, data usage,
and cybersecurity.” These responsibilities plausibly relate to how Shopify would
prevent and respond to a data breach. Because more facts are needed to determine
whether those activities support the exercise of jurisdiction, we reverse the district
court’s denial of jurisdictional discovery with respect to the DPO’s role and
responsibilities and his relationship to Shopify, Inc., which processed and stored
the data. See Laub v. U.S. Dep’t of Interior, 342 F.3d 1080, 1093 (9th Cir. 2003)
(holding that the refusal to grant jurisdictional discovery was prejudicial where

-- 5 of 6 --

6
there was a reasonable probability that the outcome of the motion would be
different).
However, the district court permissibly denied as speculative discovery on
other matters. See Boschetto v. Hansing, 539 F.3d 1011, 1020 (9th Cir. 2008)
(upholding denial of request for jurisdictional discovery that was “based on little
more than a hunch”). Following jurisdictional discovery, amendment of Plaintiffs’
claims against the Shopify defendants would not necessarily be futile and so
should be allowed. See Polich v. Burlington N., Inc., 942 F.2d 1467, 1472 (9th
Cir. 1991) (“Dismissal without leave to amend is improper unless it is clear, upon
de novo review, that the complaint could not be saved by any amendment.”).
AFFIRMED IN PART; REVERSED AND REMANDED IN PART.
Each party shall bear its own costs on appeal.

-- 6 of 6 --