369 F. Supp. 3d 810
E.D. Ky.2019Background
- Allconnect employees' 2017 W-2 data (names, addresses, SSNs, wages) was sent to cybercriminals after an employee responded to a phishing email; breach discovered March 28, 2018; notifications and two years' identity protection were provided.
- Plaintiffs McKenzie and Combs (former Allconnect employees) sued on behalf of similarly situated employees asserting negligence, invasion of privacy (intrusion and publicity theories), breach of implied contract, and breach of fiduciary duty.
- Allconnect removed the case under CAFA and moved to dismiss for lack of Article III standing, failure to state claims under Rule 12(b)(6), and alternatively to strike the class allegations.
- Plaintiffs allege mitigation costs (time and money), emotional distress, and lost time/wages from protective measures (credit freezes, monitoring, account changes) as concrete injuries.
- The court treated pleaded facts as true, allowed limited discovery on class issues, denied dismissal of several claims, and dismissed two claims for failure to state a claim.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing | Mitigation costs and resulting time/emotional harm from the breach are a concrete injury and suffice at pleading stage | Apprehension of future harm and mitigation expenses are speculative; no actual injury | Standing exists: substantial risk of harm plus mitigation costs suffice at pleading stage (denied dismissal) |
| Negligence (duty & injury) | Employer impliedly owed duty to safeguard employee PII provided as condition of employment; alleged mitigation damages | No duty to protect against unknown third-party criminals; damages speculative | Claim survives: duty to take reasonable measures to safeguard employee PII and pleaded damages sufficient at pleading stage |
| Invasion of privacy — intrusion upon seclusion | Defendant recklessly or intentionally exposed private employee data (failure to train/policies) | Employee acted unwittingly; no intentional intrusion by company | Intrusion claim survives: pleaded facts can support intentional/reckless intrusion at pleading stage |
| Invasion of privacy — unreasonable publicity | Disclosure to scammers constitutes publicity that made the information public | No allegation Allconnect published data to public at large; dissemination (if any) would be by scammers | Dismissed: plaintiffs failed to plead publication to public at large |
| Breach of implied contract | Employment relationship included implied promise to keep employee PII confidential and secure; alleged damages | No meeting of minds for an implied obligation; damages speculative | Survives: pleaded facts support an implied-in-fact contract to protect PII at pleading stage |
| Breach of fiduciary duty | Employer owed fiduciary duty to employees to safeguard PII | No fiduciary relationship alleged; employment alone insufficient | Dismissed: plaintiffs failed to plead facts establishing fiduciary relationship |
| Class allegations | Class-wide injury and commonality plausible; seek certification after discovery | Class cannot meet Rule 23 requirements; move to strike early | Motion to strike denied as premature; court permits limited discovery and deferred certification motion |
Key Cases Cited
- Susan B. Anthony List v. Driehaus, 573 U.S. 149 (standing framework and injury-in-fact requirements)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (Article III standing principles)
- Clapper v. Amnesty Int'l USA, 568 U.S. 398 (limits on speculative future injuries for standing)
- Galaria v. Nationwide Mut. Ins. Co., [citation="663 F. App'x 384"] (6th Cir.) (data-breach standing: substantial risk plus mitigation costs constitute injury at pleading stage)
- Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (pleading standard requiring plausibility)
- Ashcroft v. Iqbal, 556 U.S. 662 (pleading standard and inference of liability)
- Granny Goose Foods, Inc. v. Brotherhood of Teamsters, 415 U.S. 423 (federal pleading rules apply in removed actions)
- Klaxon Co. v. Stentor Elec. Mfg. Co., 313 U.S. 487 (choice-of-law rule in diversity cases)