By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther
Duane Morris Takeaways: In Wittmeyer v. Heartland Alliance for Human Needs & Rights, No. 23-CV-1108, 2024 WL 182211 (N.D. Ill. Jan. 17, 2024), U.S. District Judge Jeremy C. Daniel granted in part and denied in part Defendant Heartland’s motion to dismiss under Rule 12(b)(6). The Court found that the Plaintiffs only pled facts sufficient to support their negligence claim, and dismissed their negligence per se, breach of express and implied contract, breach of the Illinois Consumer Fraud Act and Deceptive Business Practices Act claims, and declaratory judgment and injunction claims. The ruling is exceedingly favorable for companies. Data breach class action defendants should utilize this decision as a roadmap when preparing motions to dismiss.
Case Background
Heartland Alliance for Human Needs & Rights (“Heartland”) is a non-profit, anti-poverty organization that provides healthcare and other services to individuals. Id. at *1. To receive services, individuals provide Heartland with personally identifiable information (“PII”) such as names and social security numbers. Id. For those individuals who receive medical services, Heartland also collects and stores personal health information (“PHI”) including medical diagnoses and medication records. Id.
In January 2022, unauthorized individuals obtained access to the PII and PHI of Heartland’s clients, employees, and independent contractors. Id. In December 2022, Plaintiffs Tracy Wittmeyer and Audrey Appiakorang received notice that their PII and PHI were compromised in the data breach. Id. Plaintiffs alleged that they experienced various damages such as increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with the data breach, and, in particular as to Plaintiff Appiakorang, that someone fraudulently obtained car insurance in her name. Id.
Plaintiffs filed a class action against Heartland for various claims, including: (i) negligence, (ii) negligence per se, (iii) breach of express contract, (iv) breach of implied contract, (v) violation of the Illinois Consumer Fraud and Deceptive Business Practices Act (“ICFA”), and (vi) a declaratory judgment and injunction. Id. Subsequently, Heartland moved to dismiss the lawsuit under Rule 12(b)(6). Id.
The Court’s Decision
U.S. District Judge Jeremy C. Daniel granted Heartland’s motion to dismiss as to Plaintiffs’ negligence per se, express and implied breach of contract, violation of the ICFA, and declaratory judgment and injunction claims. Id. at * 7.
The Court, however, denied Heartland’s motion to dismiss Plaintiffs’ negligence claim. Id. at *3. Heartland asserted that it did not owe Plaintiffs a duty to safeguard their personal information. Id. The Court disagreed. It “decline[d] to find, as a matter of law, that Heartland owed no duty to the plaintiff to safeguard their personal information.” Id. (citing an amendment to the Illinois Personal Information Protection Act and the Illinois Appellate Court’s holding in Flores v. Aon Corp., 2023 IL App (1st) 230140, at ¶ 23.).
The Court granted Heartland’s motion to dismiss Plaintiffs’ negligence per se claim. Id. Plaintiffs alleged that because Heartland failed to comply “with the FTCA and its corresponding obligations under HIPAA,” Plaintiffs were injured. Id. at *4. However, the Court reasoned that a violation of a statute only constitutes negligence per se “when it is clear that the legislature intended for the act to impose strict liability.” Id. at *3. Since Plaintiffs did not allege that either the FTCA or HIPAA imposed strict liability, the Court granted Heartland’s motion to dismiss. Id. at *4.
The Court also granted Heartland’s motion to dismiss Plaintiffs’ breach of express and implied contract claims. Id. at *4-6. The Court dismissed Plaintiffs’ breach of express contract claim because they failed to allege facts in the complaint to demonstrate that the parties entered into an express contract regarding security measures for Plaintiffs’ PII and PHI. Id. at *4. While the Court observed that an implied contract could exist between the parties, because Plaintiffs’ complaint did not contain any allegations that the Plaintiffs suffered monetary damages as a result of the data breach, the Court dismissed its breach of implied contract claim. Id. at *5-6.
Finally, the Court dismissed Plaintiffs’ ICFA and declaratory judgment and injunction claims. Id. at *6-7. Under the ICFA, the Court opined that Plaintiffs were required to plead facts sufficient to demonstrate the existence of a “real and measurable” loss. Id. at *6. The Court dismissed Plaintiffs’ ICFA claim because it found that Plaintiffs failed to plausibly plead that they suffered an economic loss. Id. In addition, the Court dismissed Plaintiffs’ declaratory judgment and injunction causes of action, noting that while they are forms of relief, they are not cognizable, independent causes of action. Id. at *7.
Implications For Data Breach Defendants
The decision in Wittmeyer v. Heartland Alliance for Human Needs & Rights serves as a roadmap for data breach class action defendants to utilize when preparing motions to dismiss.
Early in the litigation, data breach class action defendants typically move to dismiss a plaintiff’s complaint under Rule 12(b)(1) for lack of subject matter jurisdiction and/or, as Heartland did here, under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. Importantly, various jurisdictions across the United States have different approaches to the issue of whether various claimed damages (i.e., increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with a data breach, loss of value in PII and PHI, and emotional harms like anxiety and stress) can confer standing upon a plaintiff. Class action defendants should conduct a thorough review of their relevant jurisdiction’s holdings concerning the plaintiff’s claimed damages in support of any motion to dismiss.