Category: Data Breach Class Actions

By Gerald L. Maatman, Jr. and Jennifer A. Riley

Duane Morris Takeaways: Data breaches are becoming increasingly common and detrimental to companies. The scale of data breach class actions “exploded” in 2023, as companies faced copycat and follow-on lawsuits across multiple jurisdictions. The combined value of the top 10 settlements across all areas of class-action litigation hit near-record highs. To that end, the class action team at Duane Morris is pleased to present the inaugural edition of the Data Breach Class Action Review – 2024. This new publication analyzes the key data breach related rulings and developments in 2023 and the significant legal decisions and trends impacting data breach litigation for 2024. We hope that companies and employers will benefit from this resource and assist them with their compliance with these evolving laws and standards.

Click here to download a copy of the Duane Morris Data Breach Class Action Review – 2024 eBook.

Stay tuned for more data breach action analysis coming soon on our weekly podcast, the Class Action Weekly Wire.

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther

Duane Morris Takeaways: In Wittmeyer v. Heartland Alliance for Human Needs & Rights, No. 23-CV-1108, 2024 WL 182211 (N.D. Ill. Jan. 17, 2024), U.S. District Judge Jeremy C. Daniel granted in part and denied in part Defendant Heartland’s motion to dismiss under Rule 12(b)(6). The Court found that the Plaintiffs only pled facts sufficient to support their negligence claim, and dismissed their negligence per se, breach of express and implied contract, breach of the Illinois Consumer Fraud Act and Deceptive Business Practices Act claims, and declaratory judgment and injunction claims.  The ruling is exceedingly favorable for companies. Data breach class action defendants should utilize this decision as a roadmap when preparing motions to dismiss.

Case Background

Heartland Alliance for Human Needs & Rights (“Heartland”) is a non-profit, anti-poverty organization that provides healthcare and other services to individuals.  Id. at *1.  To receive services, individuals provide Heartland with personally identifiable information (“PII”) such as names and social security numbers.  Id.  For those individuals who receive medical services, Heartland also collects and stores personal health information (“PHI”) including medical diagnoses and medication records.  Id.

In January 2022, unauthorized individuals obtained access to the PII and PHI of Heartland’s clients, employees, and independent contractors.  Id.  In December 2022, Plaintiffs Tracy Wittmeyer and Audrey Appiakorang received notice that their PII and PHI were compromised in the data breach.  Id.  Plaintiffs alleged that they experienced various damages such as increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with the data breach, and, in particular as to Plaintiff Appiakorang, that someone fraudulently obtained car insurance in her name.  Id.

Plaintiffs filed a class action against Heartland for various claims, including: (i) negligence, (ii) negligence per se, (iii) breach of express contract, (iv) breach of implied contract, (v) violation of the Illinois Consumer Fraud and Deceptive Business Practices Act (“ICFA”), and (vi) a declaratory judgment and injunction.  Id.  Subsequently, Heartland moved to dismiss the lawsuit under Rule 12(b)(6).  Id.

The Court’s Decision

U.S. District Judge Jeremy C. Daniel granted Heartland’s motion to dismiss as to Plaintiffs’ negligence per se, express and implied breach of contract, violation of the ICFA, and declaratory judgment and injunction claims.  Id.  at * 7.

The Court, however, denied Heartland’s motion to dismiss Plaintiffs’ negligence claim.  Id. at *3.  Heartland asserted that it did not owe Plaintiffs a duty to safeguard their personal information.  Id.  The Court disagreed. It “decline[d] to find, as a matter of law, that Heartland owed no duty to the plaintiff to safeguard their personal information.”  Id.  (citing an amendment to the Illinois Personal Information Protection Act and the Illinois Appellate Court’s holding in Flores v. Aon Corp., 2023 IL App (1st) 230140,  at ¶ 23.).

The Court granted Heartland’s motion to dismiss Plaintiffs’ negligence per se claim.  Id.  Plaintiffs alleged that because Heartland failed to comply “with the FTCA and its corresponding obligations under HIPAA,” Plaintiffs were injured.  Id. at *4.  However, the Court reasoned that a violation of a statute only constitutes negligence per se “when it is clear that the legislature intended for the act to impose strict liability.”  Id. at *3.  Since Plaintiffs did not allege that either the FTCA or HIPAA imposed strict liability, the Court granted Heartland’s motion to dismiss.  Id. at *4.

The Court also granted Heartland’s motion to dismiss Plaintiffs’ breach of express and implied contract claims.  Id. at *4-6.  The Court dismissed Plaintiffs’ breach of express contract claim because they failed to allege facts in the complaint to demonstrate that the parties entered into an express contract regarding security measures for Plaintiffs’ PII and PHI.  Id. at *4.  While the Court observed that an implied contract could exist between the parties, because Plaintiffs’ complaint did not contain any allegations that the Plaintiffs suffered monetary damages as a result of the data breach, the Court dismissed its breach of implied contract claim.  Id. at *5-6.

Finally, the Court dismissed Plaintiffs’ ICFA and declaratory judgment and injunction claims. Id. at *6-7.  Under the ICFA, the Court opined that Plaintiffs were required to plead facts sufficient to demonstrate the existence of a “real and measurable” loss.  Id. at *6.  The Court dismissed Plaintiffs’ ICFA claim because it found that Plaintiffs failed to plausibly plead that they suffered an economic loss.  Id.  In addition, the Court dismissed Plaintiffs’ declaratory judgment and injunction causes of action, noting that while they are forms of relief, they are not cognizable, independent causes of action.  Id. at *7.

Implications For Data Breach Defendants

The decision in Wittmeyer v. Heartland Alliance for Human Needs & Rights serves as a roadmap for data breach class action defendants to utilize when preparing motions to dismiss.

Early in the litigation, data breach class action defendants typically move to dismiss a plaintiff’s complaint under Rule 12(b)(1) for lack of subject matter jurisdiction and/or, as Heartland did here, under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. Importantly, various jurisdictions across the United States have different approaches to the issue of whether various claimed damages (i.e., increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with a data breach, loss of value in PII and PHI, and emotional harms like anxiety and stress) can confer standing upon a plaintiff. Class action defendants should conduct a thorough review of their relevant jurisdiction’s holdings concerning the plaintiff’s claimed damages in support of any motion to dismiss.

By Gerald L. Maatman, Jr., Jennifer A. Riley, and George J. Schaller

Duane Morris Takeaways: In Gannon v. Truly Nolen of America Inc., No. 22-CV-428 (D. Ariz. Aug. 31, 2023), Judge James Soto of the U.S. District Court for the District of Arizona granted Defendant’s motion to dismiss with prejudice on negligence, breach of contract, and consumer fraud claims related to a data breach class action. For companies facing data breach claims in class actions, this decision is instructive in terms of how courts consider cognizable damages, especially when damages allegations are inadequately plead.

Case Background

Defendant Truly Nolen of America Inc. (“Defendant” or the “Company”), is an Arizona corporation that provides pest control services across the United States and in 30 countries around the world.  Id. at 2.  The Company experienced a data breach between April 29, 2022 and May 11, 2022.  On May 11, 2022, the Company learned the breach occurred and identified personally identifiable information (“PII”) and personal health information (“PHI”) that was compromised.  Id.  In August of 2022, Defendant sent notice letters to individuals whose data may have been compromised.  Id.  

The Named Plaintiff, Crystal Gannon (“Plaintiff”), alleged that she received her notice letter regarding the data breach in August of 2022.  Id. at 3.  In her First Amended Complaint (“FAC”), Plaintiff sought to represent two proposed classes of plaintiffs, including one for a Nationwide Class and one for an Arizona Sub-class, related to the data breach.  Id.

Plaintiff alleged numerous claims such as negligence, invasion of privacy, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and violation of the Arizona Consumer Fraud Act (“Fraud Act”).  Id.  In response, Defendant filed a motion to dismiss on the grounds that Plaintiff’s case was without basis and the entire case was subject to dismissal.  Id.

The Court’s Decision

The Court held that there was no valid basis for Plaintiff’s negligence claim.  Id. at 4.  Plaintiff argued that the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Trade Commission Act (“FTCA”) created a duty in Arizona from which relief could be sought.  Id.  The Court disagreed. It found that neither the HIPAA nor the FTCA provided a private right of action.  Id.  The Court reasoned that “[p]ermitting HIPAA to define the ‘duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded.’”  Id.  The Court applied the same logic to the FTCA.  Id.

On negligence damages, the Court held that Plaintiff’s FAC failed “to show identity theft or loss in continuity of healthcare of any class members – only the possibility of each.”  Id.  Under Arizona law, negligence damages require more than merely a threat of future harm, and on their own, threats of future harm are not cognizable negligence injuries.  Id. 4-5.  Similarly, as to out-of-pocket expenses, the Court opined that Plaintiff failed to demonstrate that her expenses were necessary because she did not properly show that Defendant’s identity monitoring services were inadequate.  Id. at 5.  Finally, the Court recognized that merely alleging a diminution in value to somebody’s PII or PHI was insufficient.  Id.  Therefore, the Court dismissed Plaintiff’s negligence claims.

Turning to Plaintiff’s breach of contract claims, the Court determined that Plaintiff did not show cognizable damages, a reasonable construction for the terms of the contract, or consideration for the existence of an implied contract.  Id. at 6. The Court held that Plaintiff’s FAC allegations only reflected speculative damages and did not allege proof of real damages.  Id. at 5.  The Court opined that Plaintiff’s “vaguely pleaded” contract terms failed to show any language that would inform the terms of the agreement and Plaintiff did not point to any conduct or circumstances from which the terms could be determined.  Id. at 5-6.  Finally, the Court determined that even if Defendant had an obligation to protect the data at issue, such pre-existing obligations did not serve as consideration for a contract.  Id.  Therefore, the Court dismissed all breach of implied contract claims.  Id.

On the claim for breach of the implied covenant of good faith and fair dealing, Plaintiff argued that Defendant breached by failing to maintain adequate computer systems and data security practices, failed to timely and adequately disclose the data breach, and inadequately stored PII and PHI.  Because Plaintiff failed to show an enforceable promise, the Court held there could be no breach, and all claims for breach of the implied covenant of good faith and fair dealing were dismissed.  Id. at 6.

The Court also dismissed Plaintiff’s Fraud Act claims because Plaintiff failed to show cognizable damages.  Id. at 7.  The Court reasoned “[p]laintiff cannot simply argue that the system is inadequate because a negative result occurred.”  Id.  The Court also reasoned that Plaintiff failed to demonstrate that Defendant’s security was inadequate when compared to other companies or any set of industry standards. Id.  As to Plaintiff’s privacy claims, the Court held that there were no cognizable claims for invasion of privacy or breach of privacy, and Plaintiff did not dispute these claims in her response.  Id.

Accordingly, the Court granted Defendant’s motion to dismiss as to all claims, denied Plaintiff leave to amend her complaint, and dismissed the case with prejudice. Id.

Implications For Companies

Companies confronted with data breach lawsuits should take note that the Arizona federal court in Gannon relied heavily on inadequately pleaded allegations in considering cognizable damages for purposes of granting Defendant’s motion to dismiss. Further, from a practical standpoint, companies should carefully evaluate pleadings for insufficient or speculative assertions on damages.

By Gerald L. Maatman, Jr., Alex W. Karasik, and George J. Schaller

Duane Morris Takeaways: In Steinmetz et al. v. Brinker International, Inc., No. 21-13146, 2023 U.S. App. LEXIS 17539 (11th Cir. July 11, 2023), the Eleventh Circuit vacated the district court’s order certifying a nationwide class and California-only class in a data breach case. In so doing, it remanded the case with instructions to the district court to define the phrase “who had their data accessed by cybercriminals” and to analyze the viability of the California class.

For employers facing data breach claims in class actions, this decision is instructive in terms of what reviewing courts consider in certifying a class, especially when class definition terms or phrases are broad.

Case Background

Defendant Brinker International, Inc, owner of Chili’s restaurants, faced a cyber-attack between March and April 2018, in which customers’ credit and debit cards were compromised.  Id. at 2.  Hackers targeted Chili’s restaurant systems and stole both customer data and personally identifiable information, and posted that information on an online market place for stolen payment data.  Id. at 2-3.  Plaintiffs alleged that 4.5 million cards were accessed by hackers.  Id. at 3.

The three named plaintiffs – Shenika Theus, a Texas resident, Michael Franklin, a California resident, and Eric Steinmetz, a Nevada resident – alleged they used their cards at Chili’s restaurants between March and April in their respective states.  Id. at 3-4.  After their visits, Theus and Franklin had unauthorized charges on their cards requiring them to cancel their cards, Steinmetz did not experience fraudulent charges.  Id. at 3-4.

Plaintiffs moved to certify two classes, including a nationwide class and California statewide class, seeking both injunctive and monetary relief.  Id. at 4.  The district court certified the nationwide class for negligence claims and a separate California class under the state’s unfair competition laws.  Id. at 5.  Brinker appealed the district court’s class certification orders.  Id.

The Eleventh Circuit’s Decision

The Eleventh Circuit held that Plaintiffs alleged a concrete injury that was sufficient to establish Article III standing.  Id. at 10.  Plaintiffs showed both a present injury – by alleging their personal information was taken by hackers and put on the dark web – and a substantial risk of future misuse through future misuse of information associated with the hacked credit card.  Id. at 9-10.

The Eleventh Circuit, however, vacated the district court’s order and found Franklin and Steinmetz could not meet the traceability requirement for standing.  Id. at 11.  Franklin alleged two visits outside the “at-risk timeframe” when Chili’s was compromised in the data breach and therefore his injury was not fairly traceable.  Id.  Steinmetz similarly stated in responses to interrogatories and his deposition that he visited Chili’s on a date outside the affected period and could not “fairly trace” any alleged injury to Brinker’s action.  Id. at 12-13.  For these reasons, the Eleventh Circuit opined that Theus did meet traceability for standing purposes.  Id. at 13.

As to the class definitions at issue in the litigation, the Eleventh Circuit ruled that the district court’s phrase “data accessed by cybercriminals” in both class definitions was too broad and limited the class to “cases of fraudulent charges or posting of credit information on the dark web.”  Id. at 15.  The Eleventh Circuit determined that the district could need to refine the class definition to include those two categories only and then conduct a new predominance analysis to include uninjured individuals who simply had their data accessed. As a result of the problems with the class definition, the Eleventh Circuit remanded the case.  Id. at 15-16.  The Eleventh Circuit also remanded the case in light of Franklin’s lack of standing to determine the viability of the California-based class.  Id. at 16.

Implications For Employers

Employers confronted with class certification motions in data breach lawsuits should take note that the Eleventh Circuit relied on the broad phrase “data accessed by cybercriminals” in remanding the district court’s order.

Further, from a practical standpoint, employers should carefully evaluate district court’s class definitions for overbroad terms or phrases when preparing an appeal.