{"id":1124,"date":"2024-01-23T08:37:39","date_gmt":"2024-01-23T12:37:39","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=1124"},"modified":"2026-02-06T10:59:40","modified_gmt":"2026-02-06T14:59:40","slug":"illinois-federal-court-dismisses-five-of-six-causes-of-action-in-data-breach-class-action-against-chicagoland-nonprofit","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2024\/01\/23\/illinois-federal-court-dismisses-five-of-six-causes-of-action-in-data-breach-class-action-against-chicagoland-nonprofit\/","title":{"rendered":"Illinois Federal Court Dismisses Five Of Six Causes of Action In Data Breach Class Action Against Chicagoland Nonprofit"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther<\/strong><\/p>\n

Duane Morris Takeaways<\/em>: <\/strong>In Wittmeyer v. Heartland Alliance for Human Needs & Rights, No. 23-CV-1108, 2024 WL 182211 (N.D. Ill. Jan. 17, 2024), U.S. District Judge Jeremy C. Daniel granted in part and denied in part<\/a>\u00a0Defendant Heartland\u2019s motion to dismiss under Rule 12(b)(6). The Court found that the Plaintiffs only pled facts sufficient to support their negligence claim, and dismissed their negligence per se, breach of express and implied contract, breach of the Illinois Consumer Fraud Act and Deceptive Business Practices Act claims, and declaratory judgment and injunction claims.\u00a0 The ruling is exceedingly favorable for companies. Data breach class action defendants should utilize this decision as a roadmap when preparing motions to dismiss. <\/em><\/p>\n

Case Background<\/strong><\/p>\n

Heartland Alliance for Human Needs & Rights (\u201cHeartland\u201d) is a non-profit, anti-poverty organization that provides healthcare and other services to individuals.\u00a0 Id<\/em>. at *1.\u00a0 To receive services, individuals provide Heartland with personally identifiable information (\u201cPII\u201d) such as names and social security numbers.\u00a0 Id<\/em>.\u00a0 For those individuals who receive medical services, Heartland also collects and stores personal health information (\u201cPHI\u201d) including medical diagnoses and medication records.\u00a0 Id<\/em>.<\/p>\n

In January 2022, unauthorized individuals obtained access to the PII and PHI of Heartland\u2019s clients, employees, and independent contractors.\u00a0 Id<\/em>.\u00a0 <\/em>In December 2022, Plaintiffs received notice that their PII and PHI were compromised in the data breach.\u00a0 Id<\/em>.\u00a0 Plaintiffs alleged that they experienced various damages such as increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with the data breach, and that someone fraudulently obtained car insurance in her name.\u00a0 Id<\/em>.<\/p>\n

Plaintiffs filed a class action against Heartland for various claims, including: (i) negligence, (ii) negligence per se<\/em>, (iii) breach of express contract, (iv) breach of implied contract, (v) violation of the Illinois Consumer Fraud and Deceptive Business Practices Act (\u201cICFA\u201d), and (vi) a declaratory judgment and injunction.\u00a0 Id<\/em>.\u00a0 Subsequently, Heartland moved to dismiss the lawsuit under Rule 12(b)(6).\u00a0 Id<\/em>.<\/p>\n

The Court\u2019s Decision<\/strong><\/p>\n

U.S. District Judge Jeremy C. Daniel granted Heartland\u2019s motion to dismiss as to Plaintiffs\u2019 negligence per se<\/em>, express and implied breach of contract, violation of the ICFA, and declaratory judgment and injunction claims.\u00a0 Id<\/em>.\u00a0 at * 7.<\/p>\n

The Court, however, denied Heartland\u2019s motion to dismiss Plaintiffs\u2019 negligence claim.\u00a0 Id<\/em>. at *3.\u00a0 Heartland asserted that it did not owe Plaintiffs a duty to safeguard their personal information.\u00a0 Id<\/em>.\u00a0 The Court disagreed. It \u201cdecline[d] to find, as a matter of law, that Heartland owed no duty to the plaintiff to safeguard their personal information.\u201d\u00a0 Id<\/em>.\u00a0 (citing an amendment to the Illinois Personal Information Protection Act and the Illinois Appellate Court\u2019s holding in Flores v. Aon Corp.<\/em>, 2023 IL App (1st) 230140, \u00a0at \u00b6 23.).<\/p>\n

The Court granted Heartland\u2019s motion to dismiss Plaintiffs\u2019 negligence per se <\/em>claim.\u00a0 Id<\/em>.\u00a0 Plaintiffs alleged that because Heartland failed to comply \u201cwith the FTCA and its corresponding obligations under HIPAA,\u201d Plaintiffs were injured.\u00a0 Id<\/em>. at *4.\u00a0 However, the Court reasoned that a violation of a statute only constitutes negligence per se<\/em> \u201cwhen it is clear that the legislature intended for the act to impose strict liability.\u201d\u00a0 Id<\/em>. at *3.\u00a0 Since Plaintiffs did not allege that either the FTCA or HIPAA imposed strict liability, the Court granted Heartland\u2019s motion to dismiss.\u00a0 Id<\/em>. at *4.<\/p>\n

The Court also granted Heartland\u2019s motion to dismiss Plaintiffs\u2019 breach of express and implied contract claims.\u00a0 Id<\/em>. at *4-6.\u00a0 The Court dismissed Plaintiffs\u2019 breach of express contract claim because they failed to allege facts in the complaint to demonstrate that the parties entered into an express contract regarding security measures for Plaintiffs\u2019 PII and PHI.\u00a0 Id.<\/em> at *4.\u00a0 While the Court observed that an implied contract could exist between the parties, because Plaintiffs\u2019 complaint did not contain any allegations that the Plaintiffs suffered monetary damages as a result of the data breach, the Court dismissed its breach of implied contract claim.\u00a0 Id.<\/em> at *5-6.<\/p>\n

Finally, the Court dismissed Plaintiffs\u2019 ICFA and declaratory judgment and injunction claims. Id<\/em>. at *6-7.\u00a0 Under the ICFA, the Court opined that Plaintiffs were required to plead facts sufficient to demonstrate the existence of a \u201creal and measurable\u201d loss.\u00a0 Id<\/em>. at *6.\u00a0 The Court dismissed Plaintiffs\u2019 ICFA claim because it found that Plaintiffs failed to plausibly plead that they suffered an economic loss.\u00a0 Id<\/em>.\u00a0 In addition, the Court dismissed Plaintiffs\u2019 declaratory judgment and injunction causes of action, noting that while they are forms of relief, they are not cognizable, independent causes of action.\u00a0 Id<\/em>. at *7.<\/p>\n

Implications For Data Breach Defendants<\/strong><\/p>\n

The decision in Wittmeyer v. Heartland Alliance for Human Needs & Rights<\/em> serves as a roadmap for data breach class action defendants to utilize when preparing motions to dismiss.<\/p>\n

Early in the litigation, data breach class action defendants typically move to dismiss a plaintiff\u2019s complaint under Rule 12(b)(1) for lack of subject matter jurisdiction and\/or, as Heartland did here, under Rule 12(b)(6) for failure to state a claim upon which relief can be granted. Importantly, various jurisdictions across the United States have different approaches to the issue of whether various claimed damages (i.e<\/em>., increased risk of fraud and identity theft, expenditure of time and effort in mitigating harms associated with a data breach, loss of value in PII and PHI, and emotional harms like anxiety and stress) can confer standing upon a plaintiff. Class action defendants should conduct a thorough review of their relevant jurisdiction\u2019s holdings concerning the plaintiff\u2019s claimed damages in support of any motion to dismiss.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther Duane Morris Takeaways: In Wittmeyer v. Heartland Alliance for Human Needs & Rights, No. 23-CV-1108, 2024 WL 182211 (N.D. Ill. Jan. 17, 2024), U.S. District Judge Jeremy C. Daniel granted in part and denied in part\u00a0Defendant Heartland\u2019s motion to dismiss under Rule 12(b)(6). … <\/p>\n

Continue reading “Illinois Federal Court Dismisses Five Of Six Causes of Action In Data Breach Class Action Against Chicagoland Nonprofit”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91],"tags":[],"ppma_author":[7,9],"class_list":["post-1124","post","type-post","status-publish","format-standard","hentry","category-data-breach-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","author_category":"","last_name":"Maatman Jr.","first_name":"Gerald L.","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/geraldmaatman.html","description":"Read Gerald's bio.<\/a>"},{"term_id":9,"user_id":576,"is_guest":0,"slug":"jariley","display_name":"Jennifer A. Riley","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2023\/08\/rileyjennifer-100x100.jpg","author_category":"","last_name":"Riley","first_name":"Jennifer A.","job_title":"","user_url":"https:\/\/www.duanemorris.com\/attorneys\/jenniferriley.html","description":"Read Jennifer's bio.<\/a>"}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=1124"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1124\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=1124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=1124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=1124"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=1124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}