650 F.Supp.3d 743
D. Minn.2023Background
- Bay & Bay, a nationwide trucking/logistics company, collected and stored sensitive personal information (e.g., name, address, SSN, DOB, driver’s license, direct deposit) from job applicants, employees, and customers; Perry applied and provided PI.
- In or around November 2021, Bay & Bay’s network suffered a ransomware attack; the company discovered suspicious activity in January 2022 and notified affected individuals (including Perry) by letter in February 2022; approximately 7,500 people were affected and data was reportedly posted to the dark web.
- Perry alleges misuse of his data: he spent time monitoring accounts, enrolled in Bay & Bay’s offered credit-monitoring, and suffered a $500 bank scam attributable to the breach.
- Perry sued (Mar. 17, 2022) asserting negligence, negligence per se under the FTC Act §5, and breach of implied contract, and seeking damages and injunctive relief to force improved security.
- Bay & Bay moved to dismiss for lack of Article III standing (arguing offered remediation eliminated any injury) and for failure to state claims (asserting inadequate pleading of damages/causation and no implied contract).
- The court denied the motion in full, holding Perry adequately pled standing (for both injunctive and monetary relief) and stated plausible claims for negligence, negligence per se, and breach of implied contract at the pleading stage.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing for injunctive relief | Substantial, imminent risk from exposed PI; misuse already occurred | Offered remediation means no imminent injury; speculative risk | Denied dismissal — alleged misuse and publication support imminent risk and standing |
| Standing for monetary relief | Concrete harms: time, mitigation, and $500 bank scam traceable to breach | Remediation (credit monitoring) fully redresses harm; allegations speculative | Denied dismissal — alleged monetary loss and misuse are concrete and traceable; monitoring did not fully redress |
| Negligence per se under FTC Act §5 | §5 supplies a standard: failing to secure PI is an unfair/deceptive practice | §5 is too vague, lacks private right, cannot supply negligence per se duty | Denied dismissal — under Minnesota law §5 can supply a standard; plaintiff plausibly alleges the statute protects his interests |
| Negligence (damages & causation) | Bay & Bay’s inadequate security caused disclosure and resulting harms | Allegations of causation/damages are conclusory and speculative | Denied dismissal — plaintiff plausibly alleged injury and proximate causation at pleading stage; causation to be tested in discovery |
| Implied contract (privacy/security promise) | Exchange of PI for employment consideration created an implied promise to safeguard data | No mutual assent or consideration; privacy policy not applicable or too vague | Denied dismissal — facts plausibly allege formation, breach, and damages for an implied contract |
Key Cases Cited
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing requirements)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (concrete and particularized injury requirement)
- TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (standing must be shown for each form of relief sought)
- In re SuperValu, Inc., 870 F.3d 763 (8th Cir.) (data-type matters in standing analysis)
- In re SuperValu, Inc., 925 F.3d 955 (8th Cir.) (state-law duty analysis re: FTC Act)
- Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir.) (unauthorized access and misuse supports standing)
- In re Horizon Healthcare Servs., 846 F.3d 625 (3d Cir.) (data-access plus misuse increases standing plausibility)
- FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir.) (FTC enforcement of data-security practices)
- Schubert v. Auto Owners Ins. Co., 649 F.3d 817 (8th Cir.) (burden on party invoking jurisdiction)
- Osborn v. United States, 918 F.2d 724 (8th Cir.) (distinguishing facial and factual 12(b)(1) attacks)
- Carlsen v. GameStop, Inc., 833 F.3d 903 (8th Cir.) (documents embraced by the pleadings)
- Braden v. Wal-Mart Stores, Inc., 588 F.3d 585 (8th Cir.) (plausibility standard at pleading)
- Ashcroft v. Iqbal, 556 U.S. 662 (pleading standards)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (plausibility pleading line)
- Neitzke v. Williams, 490 U.S. 319 (dismissal where dispositive legal issue exists)
- Anderson v. State, Dep't of Nat. Res., 693 N.W.2d 181 (Minn.) (negligence per se test under Minnesota law)
- Alderman's Inc. v. Shanks, 536 N.W.2d 4 (Minn.) (statute violation can establish negligence per se)