Theft of Data on Servers Located in New York Insufficient Basis for Personal Jurisdiction

On April 25, 2016, Justice Ash of the Kings County Commercial Division issued a decision in Delfasco, LLC v. Powell, 2016 NY Slip Op. 26132, holding that the theft of data from servers located in New York was insufficient, without more, to justify the assertion of jurisdiction over a defendant in New York, explaining:

[T]he Court turns to CPLR §302[a][2] to determine whether [the defendant] can be deemed to have committed a tortious act within the state by accessing information stored in [the plaintiff's] New York server using his laptop in Tennessee. Federal Courts and Court of Appeals decisions construing CPLR §302[a][2] have uniformly held that a defendant's physical presence in New York is a prerequisite to jurisdiction. However, currently, the rule in New York is unsettled as some courts have deviated from the traditional view of requiring physical presence under CPLR §302[a][2]. In such cases, courts have focused on the locus of the tort and whether defendant, by use of modern technology, directed activities to New York despite being physically outside of New York.

Upon review of the parties' arguments and the cases cited thereto, here, the locus of the tort is in Tennessee, not New York. [The plaintiff's] allegations against [the defendant] solely concern his conduct as [the plaintiff's] employee in Tennessee and the information he was privy to as a high-level manager at [its] manufacturing plant. Even [] the alleged recipient of [the plaintiff's] confidential information, is connected to [the defendant] by having been a previous employee of [the plaintiff] in Tennessee. Under these circumstances, [the defendant's] alleged misappropriation of information, technically stored on [the plaintiff's] New York servers, is insufficient to submit him to New York's jurisdiction. [The defendant's] only connection to New York is through his employment with [the plaintiff]. This does not satisfy the minimum contacts analysis set forth in International Shoe Co. v Washington, 326 US 310 [1945]. A plaintiff cannot be the only link between the defendant and the forum. Rather, it is the defendant's conduct that must form the necessary connection with the forum State that is the basis for its jurisdiction over him.

(Internal quotations and citations omitted).