983 N.W.2d 669
Wis. Ct. App.2022Background
- Aurora experienced a January 2020 phishing-related data breach of its HR system exposing current and former employees’ PII (SSNs, birthdates, addresses, bank direct-deposit data); Aurora locked out the intruder and notified impacted employees.
- Sixty‑three employees had their direct‑deposit rerouted to the attacker’s account(s); Aurora offered one‑year identity‑protection services to affected employees.
- Reetz, a former Aurora employee whose PII was in the breached system (but whose direct deposit was not among the 63 changed accounts), alleged fraudulent bank charges of $2,700 and $600 in overdraft/insufficient‑fund fees and sued as a putative class in March 2020.
- The circuit court dismissed Reetz’s amended complaint with prejudice; Reetz appealed challenging dismissal of negligence, invasion of privacy (publicity of private facts), breach of contract (express and implied), breach of the covenant of good faith and fair dealing, and requests for declaratory and injunctive relief.
- The Court of Appeals held Reetz had standing and adequately pleaded a negligence claim (reversing dismissal as to negligence and remanding) but affirmed dismissal of the invasion‑of‑privacy, contract (express and implied and covenant) and declaratory/injunctive relief claims.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing / damages | Reetz alleged actual monetary losses (fraudulent charges and overdraft fees) and time/mitigation costs from the breach, establishing injury in fact. | Aurora argued damages were not adequately pleaded and causation to the breach was speculative. | Court: Reetz had standing; allegations of fraud charges, fees, and mitigation time suffice at pleading stage. |
| Negligence | Aurora, as employer, owed duty to safeguard PII; breach caused monetary loss and increased future identity‑theft risk. | Aurora argued no actual damages and economic‑loss rule bars tort recovery arising from employment relationship. | Court: Negligence pleadings sufficient (duty, breach, causation, damages); economic‑loss doctrine inapplicable to services/employment here. Claim revived and remanded. |
| Invasion of privacy (publicity of private facts) | Reetz alleged Aurora publicized/exposed her PII to criminals and acted recklessly with respect to publicity. | Aurora argued no intentional disclosure by Aurora—the disclosure was the act of third‑party hackers. | Court: Publicity of private facts requires intentional/publicizing conduct by defendant; Reetz alleged only failure to prevent breach (conclusory) so claim dismissed. |
| Breach of contract / implied contract / covenant of good faith | Reetz argued employment contract (and Code of Conduct) imposed an obligation to safeguard PII; breach and bad faith performance followed the breach. | Aurora argued no express contract term or mutual assent to a term to protect PII; implied‑contract/unjust‑enrichment theory unsupported. | Court: No pleaded express or enforceable term requiring PII protection; implied contract/unjust enrichment not shown; covenant claim fails absent enforceable term—claims dismissed. |
| Declaratory and injunctive relief | Reetz sought court‑ordered oversight (ombudsman, audits, training) to prevent ongoing harm from the breach. | Aurora argued relief was premised on past conduct and speculative future harm; no justiciable controversy supporting declaratory/injunctive relief. | Court: Reetz failed to show declaratory/injunctive relief appropriate or narrowly tailored to an ongoing harm—dismissed. |
Key Cases Cited
- Data Key Partners v. Permira Advisers LLC, 356 Wis. 2d 665 (2014) (motion to dismiss tests complaint sufficiency)
- Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018) (standing requires allegation of injury in fact; damages available if injury shown)
- Fox v. Iowa Health Sys., 399 F. Supp. 3d 780 (W.D. Wis. 2019) (time spent, mitigation expenses, and risk of future identity theft can establish standing in data‑breach cases)
- Tietsworth v. Harley‑Davidson, Inc., 270 Wis. 2d 146 (2004) (tort damages require harm already occurred or reasonably certain to occur)
- Insurance Co. of N. Am. v. Cease Elec. Inc., 276 Wis. 2d 361 (2004) (economic‑loss doctrine preserves contract/tort distinction and does not apply to negligent provision of services)
- Mackenzie v. Miller Brewing Co., 241 Wis. 2d 700 (2001) (distinguishing tort and contract remedies in employment contexts)
- Pachowitz v. LeDoux, 265 Wis. 2d 631 (2003) (elements and publicity requirement for the private‑facts invasion‑of‑privacy cause of action)
- Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015) (data‑breach defendants face risk of identity‑theft harms because hackers exploit stolen PII)