2023 IL App (1st) 230140
Ill. App. Ct.2023Background
- Aon discovered in Feb 2022 that an unauthorized third party had accessed some of its systems from Dec 2020–Feb 2022; notices went to potentially affected individuals in June 2022.
- Plaintiffs (employees or former employees of Aon or its clients) allege Aon held names, SSNs, dates of birth, driver’s license numbers and “benefit-enrollment information.”
- Plaintiffs alleged present harms (attempted fraudulent charges for two plaintiffs, increased spam/targeted marketing for others), lost time, anxiety, diminution in value of personal data, and risk of future identity theft.
- Plaintiffs filed a putative class action asserting negligence, negligence per se (FTC Act), breach of implied contract, unjust enrichment, Illinois Consumer Fraud Act, Florida Deceptive and Unfair Trade Practices Act, and intrusion upon seclusion.
- The circuit court dismissed for lack of standing and for failure to state several claims; the appellate court affirmed in part, reversed in part, and remanded.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing | Plaintiffs alleged concrete injuries (fraud attempts, increased spam, lost time, anxiety, imminent identity-theft risk). | Alleged harms are speculative; attempted charges not shown to be traceable to Aon. | Reversed: Plaintiffs have standing—alleged present harms and imminent risk suffice. |
| Common‑law negligence (duty/proximate cause) | Aon owed a duty to safeguard personal data and breach proximately caused plaintiffs’ harms. | No common‑law duty; injuries not proximately caused by Aon. | Reversed: duty exists (plus statutory duty under IPP Act); proximate‑cause allegations survive pleading stage. |
| Negligence per se (FTC Act) | FTC Act violation supports negligence per se. | FTC Act doesn’t impose strict liability. | Affirmed: FTC Act violations may be prima facie negligence but do not create negligence per se here. |
| Breach of implied contract | Plaintiffs impliedly contracted that Aon would secure their data. | No actionable implied contract or reliance; no monetary loss alleged. | Affirmed (but without prejudice): pleadings insufficient because plaintiffs failed to allege actual monetary damages. |
| Unjust enrichment | Plaintiffs conferred benefits (employment, premiums, data) that Aon unjustly retained. | No benefit retained to plaintiffs’ detriment. | Affirmed: plaintiffs failed to allege an unjustly retained benefit. |
| Illinois Consumer Fraud Act | Violation of the Information Protection Act is an unlawful practice causing harm. | No specific, calculable economic injury alleged. | Affirmed: Flores failed to plead the required specific economic damages. |
| Florida Deceptive & Unfair Trade Practices Act | Williams alleges misrepresentations/omissions directed to Florida residents. | FDUTPA applies only to acts in Florida; plaintiffs lack actual damages. | Reversed as to claim viability, but limited to injunctive relief—no recoverable actual damages pleaded. |
| Intrusion upon seclusion (invasion of privacy) | Access to benefit‑enrollment info could include private facts; intrusion alleged. | Alleged data (names, SSNs, DL numbers) are non‑private; claim fails. | Reversed: plaintiff alleged “benefit‑enrollment information” (party‑pleaded term) which could contain private facts—pleading survives. |
| Moorman (economic‑loss doctrine) | Moorman does not bar tort claims because duties arose outside any express contract. | Economic losses are contractual and barred by Moorman. | Reversed: Moorman inapplicable where duty to safeguard data arises independent of an express contract. |
Key Cases Cited
- Maglio v. Advocate Health & Hospitals Corp., 2015 IL App (2d) 140782 (data‑breach standing requires more than speculative risk; imminent risk necessary)
- Cooney v. Chicago Pub. Schs., 407 Ill. App. 3d 358 (declined to recognize new common‑law duty to safeguard data pre‑statutory amendment)
- Moorman Mfg. Co. v. Nat’l Tank Co., 91 Ill. 2d 69 (economic‑loss doctrine bars tort recovery for purely economic losses)
- Congregation of the Passion, Holy Cross Province v. Touche Ross & Co., 159 Ill. 2d 137 (Moorman does not bar tort claims when duty arises outside an express contract)
- Wexler v. Wirtz Corp., 211 Ill. 2d 18 (standing requires distinct, palpable injury fairly traceable to defendant and redressable)
- Avery v. State Farm Mut. Auto. Ins. Co., 216 Ill. 2d 100 (contract damages require actual monetary loss)
- HPI Health Care Servs., Inc. v. Mt. Vernon Hosp., Inc., 131 Ill. 2d 145 (elements of unjust enrichment)
- Craftwood II, Inc. v. Generac Power Sys., Inc., 920 F.3d 479 (time spent addressing unwanted communications can be a concrete injury for standing)