Rhode Island v. Alphabet, Inc., No. 20-15638 (9th Cir. 2021)Annotate this Case
After Cambridge Analytica improperly harvested user data from Facebook's social network, Google discovered that a security glitch in its Google+ social network had left the private data of some hundreds of thousands of users exposed to third-party developers. Google and its holding company, Alphabet, chose to conceal this discovery, made generic statements about how cybersecurity risks could affect their business, and stated that there had been no material changes to Alphabet's risk factors since 2017.
Rhode Island, in a consolidated amended complaint, filed suit against Alphabet, Google, and others, alleging violations of Section 10(b) of the Securities Exchange Act of 1934 and SEC Rule 10b-5 for securities fraud, as well as violations of Section 20(a) of the Exchange Act. The district court granted Alphabet's motion to dismiss on the grounds that Rhode Island failed to adequately allege a materially misleading misrepresentation or omission and that Rhode Island failed to adequately allege scienter.
The Ninth Circuit concluded that the complaint adequately alleged that Google, Alphabet, and individual defendants made materially misleading statements by omitting to disclose these security problems and that defendants did so with sufficient scienter, meaning with an intent to deceive, manipulate, or defraud. Applying an objective materiality standard, the panel concluded that Rhode Island's complaint plausibly alleges the materiality of the costs and consequences associated with the Privacy Bug, and its public disclosure, and how Alphabet's decision to omit information about the Privacy Bug in its 10-Qs significantly altered the total mix of information available for decisionmaking by a reasonable investor. Furthermore, the complaint adequately alleges scienter for the materially misleading omissions from the 10-Q statements. The panel also concluded that Rhode Island adequately alleged falsity, materiality, and scienter for the April 2018 and July 2018 10-Q statements. Accordingly, the panel reversed the district court's holdings to the contrary and reversed the dismissal of the section 20(a) control-person claims based on the 10-Q statements.
Because the complaint does not plausibly allege that the remaining statements at issue are misleading material misrepresentations or omissions, the panel affirmed the district court's dismissal of the Section 10(b) and Rule 10b-5(b) statement liability claims based on these statements. The panel also affirmed the district court's dismissal of the Section 20(a) controlling-person claims for these statements. Finally, because the district court erred in sua sponte dismissing Rhode Island's claims under Rule 10b-5(a) and (c) when Alphabet had not targeted those claims in its motion to dismiss, the panel reversed the dismissal of the claims under Section 10(b) and Rule 10b-5(a) and (c) against all defendants and remanded to the district court. The panel also reversed the dismissal of Rhode Island's claims under Section 20(a) to the extent those claims depend on claims alleging violations of Rule 10b-5(a) and (c).