Janet Reetz v. Advocate Aurora Health, Inc.Janet Reetz v. Advocate Aurora Health, Inc.
Appellant ATTORNEYS: On behalf of the plaintiff-appellant, the cause was submitted on the brief of Mary C. Turke, Samuel J. Strauss, and Nathan DeLadurantey of Turke & Strauss LLP.
Respondent ATTORNEYS: On behalf of the defendant-respondent, the cause was submitted on the brief of Daniel E. Conley, Brandon M. Krajewski, and James E. Goldschmidt of Quarles & Brady LLP; Edward McNicholas and Fran Faircloth, pro hac vice, of Ropes & Gray, LLP.
NOTICE
This opinion is subject to further editing. If published, the official version will appear in the bound volume of the Official Reports.
A party may file with the Supreme Court a petition to review an adverse decision by the Court of Appeals. See
APPEAL from an order of the circuit court for Milwaukee County: TIMOTHY M. WITKOWIAK, Judge. Affirmed in part; reversed in part and cause remanded for further proceedings.
Before Brash, C.J., Dugan and White, JJ.
¶2 Upon review, we conclude that Reetz had standing to pursue her claims, adequately pleaded sufficient damages, and adequately pleaded a cause of action for negligence. Therefore, we reverse that part of the order dismissing the negligence claim and remand the same to the circuit court for further proceedings consistent with this decision. However, Reetz failed to state a claim upon which relief may be granted for her other four claims: invasion of privacy, breach of contract, breach of implied covenant of good faith and fair dealing, and declaratory relief. Therefore, we affirm the parts of the circuit court order dismissing those claims.
¶3 We recite the facts of this case as drawn from the factual allegations in the pleadings. This case arises out of a data breach of Aurora‘s information technology systems. On February 20, 2020, Aurora sent a notice of a security incident that occurred in January 2020 during which an unauthorized person gained temporary access through a phishing scheme to an Aurora human resources system that housed personal information for current and former Aurora employees. When Aurora became aware of the issue on January 9, 2020, it locked out the intruder. Aurora‘s internal investigation showed that the personal information of current and former Aurora employees at Wisconsin locations was at risk, including employees’ Social Security numbers, bank accounts used for direct deposit, birth dates, and home addresses. Aurora discovered that sixty-three employees had their direct deposit information changed to deposit paychecks into the intruder‘s account(s). Aurora offered complimentary one-year memberships in an identity theft protection service to all former and current employees whose information was contained in the affected system. Reetz, a former Aurora employee, had her personal information contained in the affected HR system; however, her account‘s direct deposit instructions were not among the sixty-three accounts discovered as compromised.
¶4 Reetz first filed a class action suit against Aurora in March 2020, pursuing claims against Aurora for herself and as a representative of other similarly situated individuals. Aurora moved to dismiss Reetz‘s action in June 2020. In response, Reetz amended her complaint in July 2020. Aurora again moved to dismiss in September 2020. After argument before the circuit court in December 2020, the circuit court dismissed Reetz‘s action with prejudice in a written decision on February 18, 2021.
¶5 Reetz appeals.
DISCUSSION
¶6 Reetz argues that the circuit court erred when it dismissed her complaint with prejudice. A motion to dismiss tests the sufficiency of the complaint. Data Key Partners v. Permira Advisers LLC, 2014 WI 86, ¶19, 356 Wis. 2d 665, 849 N.W.2d 693. When we review a motion to dismiss, “[a]ll facts pleaded and all reasonable inferences from those facts are admitted as true,” for the purpose of our review. Scott v. Savers Prop. & Cas. Ins. Co., 2003 WI 60, ¶5, 262 Wis. 2d 127, 663 N.W.2d 715. “The pleadings are to be liberally construed and a claim will only be dismissed if the plaintiff cannot recover under any circumstances.” Heinritz v. Lawrence Univ., 194 Wis. 2d 606, 610-11, 535 N.W.2d 81 (Ct. App. 1995). “We independently review as a question of law whether a complaint states a cognizable claim.” DeBruin v. St. Patrick Congregation, 2012 WI 94, ¶10, 343 Wis. 2d 83, 816 N.W.2d 878.
I. Standing
¶7 We begin with the issue of standing. The circuit court concluded Reetz had standing, but had not sufficiently alleged damages to state a claim upon which relief may be granted. Reetz argues that she has standing to bring her claims and that she sufficiently alleged damages. Aurora argues she neither has standing nor sufficiently alleged damages. “Whether a party has standing is a question of law that we review independently.” Friends of Black River Forest v. Kohler Co., 2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342 (citation omitted). Under Wisconsin law, the standing of a party whose interest is challenged is determined by: (1) personal interest in the controversy; (2) injury or
¶8 As noted, on appeal, Aurora challenges the circuit court‘s finding that Reetz had standing to bring this action. “To say that the plaintiffs have standing is to say that they have alleged injury in fact, and if they have suffered an injury then damages are available[.]” Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826, 828 (7th Cir. 2018).1 Her operative complaint alleged an injury in fact from cybercriminals unlawfully accessing Aurora‘s HR systems, which allowed them to access current and former employees’ personally identifiable information (PII) including Social Security numbers, birth dates, home addresses, and bank accounts used for direct deposit. Reetz alleged that she suffered $2,700 in fraudulent charges against her bank account and a resulting $600 in insufficient funds and overdraft fees. To establish standing in a data breach identity theft case, allegations of “time spent dealing with fraud attempts, the threat of future identity theft, and money spent mitigating that threat ... [are] sufficient to establish standing[.]” Fox v. Iowa Health Sys., 399 F. Supp. 3d 780, 790 (W.D. Wis. 2019). We agree that Reetz has established an injury in fact and standing to pursue this action.
¶9 Nevertheless, Aurora asserts that Reetz does not have standing and the circuit court should not have exercised jurisdiction over her claims. “Being damaged, however, without more, does not automatically confer standing.” Krier, 317 Wis. 2d 288, ¶20. Aurora contends that Reetz has failed to adequately plead damages to establish standing, because she has not shown the causal link between her damages and Aurora‘s conduct. Aurora argues that the timing of the theft from Reetz‘s bank accounts does not prove that the theft occurred as a result of the data breach. “[W]hen a defendant does not submit evidence that contradicts a specific allegation, the court accepts that allegation as true[.]” Fox, 399 F. Supp. 3d at 792. Aurora has not offered any evidence that Reetz‘s data was stolen in a different way. Ultimately, Aurora may be correct that Reetz‘s information was exposed in another way that caused the alleged monetary losses, but that is an issue of causation to be resolved at trial or summary judgment. See id. Therefore, Reetz‘s allegations are sufficient to establish standing.
¶10 Having concluded that Reetz‘s allegations are sufficient to establish standing, we next address whether she has sufficiently plead damages to support each of her claims. Further, we address Aurora‘s arguments that Reetz‘s damages are speculative and do not support her claims.
II. Negligence
¶11 Reetz argues she successfully stated a claim for common-law negligence;
¶12 Aurora argues that the negligence claim fails to state a claim because Reetz has failed to allege actual damages and because the economic loss doctrine bars the claim. Both of these arguments fail. We begin with actual damages. Damages in tort claims accrue only when actual damages occur, which is “harm that has already occurred or is ‘reasonably certain’ to occur in the future.” Tietsworth v. Harley-Davidson, Inc., 2004 WI 32, ¶17, 270 Wis. 2d 146, 677 N.W.2d 233 (citation omitted). Reetz alleged damages from fraudulent transactions and overdraft fees. Money damages may arise from a data breach because “unauthorized withdrawals from [victims‘] accounts cause a loss (the time value of money) even when banks later restore the principal, and because the value of one‘s own time needed to set things straight is a loss from an opportunity-cost perspective.” Dieffenbach, 887 F.3d at 828. Further, a data breach of PII creates a risk of future identity theft.2 Cf. Lewert v. P.F. Chang‘s China Bistro, Inc., 819 F.3d 963, 966 (7th Cir. 2016) (concluding that the increased risk of identity theft was a sufficiently imminent injury after a data breach). We note that Aurora allegedly acknowledged this risk when it offered credit monitoring to employees and former employees whose PII was contained in the breached system. Cf. Fox, 399 F. Supp. 3d at 791.
¶13 Reetz‘s complaint is based on a data breach, which allowed unauthorized access of her PII, including fraudulent transactions and resulting overdraft fees in her bank account.3 Reetz argues that the circuit court improperly concluded that she did not plead actual damages because she did not allege that she requested a return of the overdraft fees or that the overdraft
¶14 Next, Aurora argues that the economic loss doctrine bars tort recovery for contractual claims, and therefore, Reetz‘s claim is barred. “The economic loss doctrine is a judicially created doctrine that seeks to preserve the distinction between contract and tort.” Insurance Co. of N. Am. v. Cease Elec. Inc., 2004 WI 139, ¶15, 276 Wis. 2d 361, 688 N.W.2d 462. “Recovery for economic loss is intended to protect purchasers from losses suffered because a product failed in its intended use.” Northridge Co. v. W.R. Grace & Co., 162 Wis. 2d 918, 933, 471 N.W.2d 179 (1991). Economic loss for this purpose includes both direct economic loss, which “is loss in value of the product itself,” and consequential economic loss, which is “all other economic losses attributable to the product defect.” Daanen & Janssen, Inc. v. Cedarapids, Inc., 216 Wis. 2d 395, 401, 573 N.W.2d 842 (1998). “Economic damages do not include losses due to personal injury or damage to other property.” Linden v. Cascade Stone Co., 2005 WI 113, ¶6, 283 Wis. 2d 606, 699 N.W.2d 189. Moreover, the doctrine “is inapplicable to claims for the negligent provision of services.” Cease Elec. Inc., 276 Wis. 2d 361, ¶52. We independently review as a question of law whether the economic loss doctrine applies to a given set of facts. Linden, 283 Wis. 2d 606, ¶5.
¶15 The relationship between Reetz and Aurora is, in essence, contractual, arising out of Reetz‘s at-will employment contract with Aurora for her employment services. There are no products or goods exchanged under this contract; therefore, her claims of economic loss do not derive from a loss in value of any product or a loss attributable to a product defect. Daanen & Janssen, Inc., 216 Wis. 2d at 401. Aurora relies on multiple cases from other jurisdictions holding that the economic loss doctrine bars negligence claims in data breach cases.4 We do not find these cases persuasive. We conclude there is no application of the economic loss doctrine to Reetz‘s claims that Aurora did not exercise reasonable care to safeguard her PII. Further, Aurora failed to refute Reetz‘s argument
¶16 Aurora argues that because Reetz‘s claims arise out of her employment contract, this court should not allow her negligence claim to proceed. The circuit court concluded that tort law is not applicable in employment law under Mackenzie v. Miller Brewing Co., 2001 WI 23, ¶¶27-28, 241 Wis. 2d 700, 623 N.W.2d 739. In Mackenzie, our supreme court explained that tort law protects society as a whole and “rests on obligations imposed by law,” Daanen & Janssen, Inc., 216 Wis. 2d at 405; in contrast, employment law is based on contract principles and obligations imposed by bargaining, Mackenzie, 241 Wis. 2d 700, ¶28. There, our supreme court declined to recognize a new fraudulent representation tort—intentional misrepresentation to induce continued employment—within an at-will employment context. Id., ¶30. Although the Mackenzie court discussed the difference between tort and contract law, it did not apply the economic loss doctrine as a basis of its decision. Without a clear directive that the economic loss doctrine applies to employment law and given our supreme court‘s clear directive that it is not applicable to service contracts, we decline to extend a blanket application of the economic loss doctrine in the employment law context. See Cook v. Cook, 208 Wis. 2d 166, 188-89, 560 N.W.2d 246 (1997) (explaining that the Wisconsin Court of Appeals is primarily an error correcting court and the Wisconsin Supreme Court‘s function is law declaration and development).
¶17 We conclude that Reetz has successfully stated a claim for negligence and pleaded damages in support of her claim. We reverse that part of the circuit court‘s order dismissing this claim. We remand for further proceedings on the negligence claim and its class action ramifications.
III. Invasion of Privacy
¶18 Reetz argues that the circuit court erred when it dismissed her invasion of privacy claim. She argues that she successfully stated a claim under
Publicity given to a matter concerning the private life of another, of a kind highly offensive to a reasonable person, if the defendant has acted either unreasonably or recklessly as to whether there was a legitimate public interest in the matter involved, or with actual knowledge that none existed. It is
not an invasion of privacy to communicate any information available to the public as a matter of public record.
(1) a public disclosure of facts regarding the plaintiff; (2) the facts disclosed are private facts; (3) the private matter made public is one which would be highly offensive to a reasonable person of ordinary sensibilities; and (4) the defendant acted either unreasonably or recklessly as to whether there was a legitimate
public interest in the matter, or with actual knowledge that none existed.
Pachowitz v. LeDoux, 2003 WI App 120, ¶18, 265 Wis. 2d 631, 666 N.W.2d 88.6
¶19 Reetz pleaded that Aurora publicized and exposed her PII, which contained private details and facts generally not known to the public, facts not publicly available, and not of legitimate public concern. Aurora argues that Reetz‘s claim fails because she has not alleged intentional conduct by Aurora in the data breach. Reetz argues that intentional conduct is not required and that invasion of privacy is not an intentional tort.7 Neither the language of
¶21 As support for the idea that intentionality is inherent to invasion of privacy-publicity of private facts, we note that invasion of privacy is classified as an intentional tort for the statute of limitations under
¶22 Having established our legal standard, our question is whether Reetz has alleged facts to support that conduct by Aurora intentionally gave publicity to her PII. In the complaint, Reetz alleged that Aurora “has disclosed and given access to the PII ... for criminals to use in the conduct of criminal activity” and that her “PII was publicly disclosed by Aurora in the Data Breach with reckless disregard for the reasonable offensiveness of the disclosure.” She alleged that Aurora “opened up, disclosed, and exposed the PII ... to persons engaged in disruptive and unlawful business practices and tactics.” She alleged that Aurora‘s outdated and insecure
IV. Breach of contract claims
¶23 Reetz argues the circuit court erred when it dismissed her claims for breach of her employment contract with Aurora—express or implied and breach of the covenant of good faith and fair dealing within every contract. “A valid contract requires an offer, acceptance and consideration.” Piaskoski & Assocs. v. Ricciardi, 2004 WI App 152, ¶7, 275 Wis. 2d 650, 686 N.W.2d 675. “Offer and acceptance exist when the parties mutually express assent, and consideration exists if the parties manifest an intent to be bound to the contract.” Id. “A contract must be definite and certain as to its basic terms and requirements to be enforceable.” Metropolitan Ventures, LLC v. GEA Assocs., 2006 WI 71, ¶22, 291 Wis. 2d 393, 717 N.W.2d 58, op. clarified on denial of reconsideration, 2007 WI 23, 299 Wis. 2d 174, 727 N.W.2d 502. Both the existence of a contract and whether the provisions of a contract are definite are questions of law we interpret independently. Id.; Piaskoski & Assocs., 275 Wis. 2d 650, ¶7.
¶24 Reetz argues that in her contract for employment with Aurora, she was obligated to provide PII and that Aurora breached its duty to safeguard the PII. Employment is “essentially contractual.” Atkinson v. Everbrite, Inc., 224 Wis. 2d 724, 729, 592 N.W.2d 299 (Ct. App. 1999). An employer‘s obligations to an employee “stem from their agreement that [the employee] would work for [the employer], and that [the employer] would compensate [the employee] for his [or her] services.” Id.
¶25 Aurora argues that Reetz has not identified an express term in the employment contract that required it to safeguard the PII. Our examination of the pleadings supports that, even accepting all facts and reasonable inferences as true, Reetz has failed to identify a contract provision to support her claims. Reetz alleged that she and other class members “were required to provide their PII ... to Defendant as a condition of employment.” She further alleged that Aurora “therefore offered a unilateral contract of employment, which [she] accepted by providing the necessary PII and showing up for work.” Reetz‘s allegations do not point to an express contract term; but instead, she alleges that Aurora‘s obligation to safeguard the PII was “[i]mplicit in the agreement” and that Aurora “implicitly promised to retain PII only under conditions that kept such information secure and confidential.” We conclude that Reetz failed to allege an express contract provision that obligated Aurora to safeguard the PII.
¶26 Reetz also alleged that “Aurora‘s Code of Conduct contained additional covenants restricting its disclosure of PII.” Aurora argues that Reetz did not plead that she saw the Code of Conduct and agreed to it prior to accepting the employment offer. It is true that “as a matter of law, an employment contract can be modified by the use of an employees’ handbook.” Ferraro v. Koelsch, 124 Wis. 2d 154, 169, 368 N.W.2d 666 (1985). However, there must be “evidence indicating that [the employee and employer] agreed to be bound by the terms of the policy,” or else it would “not rise to the level of a contract, either implied or otherwise.” Vorwald v. School Dist. of River Falls, 167 Wis. 2d 549, 558, 482 N.W.2d 93 (1992). This is where Reetz‘s allegations are insufficient to state a claim upon which relief may be granted. Her conclusory phrase in the complaint about covenants in the Code of Conduct does not support that the employment contract was modified by mutual assent to the term to safeguard the PII. We conclude that Reetz‘s breach of express contract claim failed to state a claim upon which relief may be granted.
¶27 Alternatively, Reetz argues that she had an implied contract with Aurora based on her providing her PII and Aurora agreeing to safeguard that information. Aurora argues that Reetz providing legally required PII and working at Aurora is not separate consideration to establish that an implied contract existed with provisions requiring Aurora to safeguard her PII. Aurora also contends that an implied contract to safeguard personal information from a data breach requires assent from both parties, an assent not alleged in the pleadings.
¶28 Reetz did not separately plead a breach of implied contract in the complaint, instead folding her allegations into the breach of express contract claim. An implied contract in law is a theory of unjust enrichment. There are three elements, as described in the Wisconsin jury instructions on implied contracts: “(1) a benefit conferred upon the defendant by the plaintiff; (2) knowledge or appreciation of the benefit by the defendant; and (3) acceptance and retention by the defendant of such benefit under such circumstances that it would be unfair ... to retain it without paying the value thereof.” WIS JI—CIVIL 3028.
¶29 Construing all facts and reasonable inferences of those facts in the pleadings as true, an implied contract is an awkward application to the facts of this case and we conclude that she has not stated a claim for breach of implied contract. See Scott, 262 Wis. 2d 127, ¶5. To find that a benefit was conferred upon Aurora by Reetz would mean that it was to Aurora‘s benefit for Reetz to provide her PII—rather, at best we could reasonably infer that Aurora needed Reetz‘s PII to comply with federal and state regulations of employers. Further, that benefit to Aurora and Aurora‘s knowledge of that benefit is not alleged in the complaint and is unclear from our review of the facts. Ultimately, there are no facts that an implied contract, if it existed, had a contractual term that obligated Aurora to safeguard the PII. Unjust enrichment generally refers to a monetary benefit conferred upon a defendant and here, the facts alleged fail to show that there was a monetary benefit to Aurora such that it would have unjust enrichment if it did not protect Reetz‘s PII. See W.H. Fuller Co. v. Seater, 226 Wis. 2d 381, 387, 595 N.W.2d 96 (Ct. App. 1999) (“Depending upon the circumstances, the value of the benefit received by the defendant may include services rendered for the defendant, goods or merchandise received by the defendant, or improvements made to the defendant‘s real estate.“). We conclude that Reetz‘s claim based on a breach of implied contract failed to state a claim upon which relief may be granted.
¶30 Next, Reetz alleged that Aurora breached the covenant of good faith and fair dealing implicit in every
fulfilled.‘” Kreckel v. Walbridge Aldinger Co., 2006 WI App 168, ¶20, 295 Wis. 2d 649, 721 N.W.2d 508 (citation omitted).
¶31 Therefore, to state a claim for a breach of this covenant, the plaintiff must plead that a valid contract with express, definite, enforceable terms exists, and that the breaching party acted without good faith in its performance of that contract. See Beidel, 348 Wis. 2d 360, ¶29. Although there is no dispute that Reetz and Aurora had an employment contract, we have concluded that there was no provision within that contract that required Aurora to safeguard the PII. Without a contract provision establishing that safeguarding the PII was Aurora‘s contractual obligation, Aurora did not breach its duty of good faith by failing to safeguard the PII. The good faith and fair dealing obligations must relate to the performance of the contract. See Gerruth Realty Co. v. Pire, 17 Wis. 2d 89, 94, 115 N.W.2d 557 (1962) (concluding good faith issues arises only after the determination of the enforceable terms of the contract). Accordingly, we conclude that Reetz failed to state a claim for breach of the covenant of good faith and fair dealing, and we affirm the circuit court order dismissing this claim.
¶32 Additionally, we note that Reetz failed to refute Aurora‘s arguments relating to her contract claims. Aurora contended that there was no contract provision requiring Aurora to safeguard PII, that there was no implied contract, and without an underlying operative contract, there was no breach of the covenant of good faith and fair dealing. We consider Reetz to have conceded these arguments. See United Coop., 304 Wis. 2d 750, ¶39.
¶33 We conclude that Reetz has failed to state a claim for breach of contract, express or implied or through the covenant of good faith and fair dealing. Accordingly, we affirm the circuit court‘s order dismissing Reetz‘s contract claims.
V. Injunctive relief and declaratory judgment
¶34 Reetz‘s final argument is that the circuit court erred in dismissing her request for declaratory judgment and injunctive relief. Under the Uniform Declaratory
¶35 Reetz contends she faces an ongoing injury from the data breach and requests a court order appointing a third-party ombudsman to conduct, test, and audit Aurora‘s data procedures, and to oversee training and education for employees on PII data issues and privacy practices. Reetz alleges that her damages arising from the data breach and identify theft are ongoing. However, she has failed to allege how declaratory judgment would remedy those future harms. A plaintiff may seek declaratory judgment prior to the suffering an injury as long as “the facts are sufficiently developed to allow a conclusive adjudication.” Putnam v. Time Warner Cable of Se. Wis., Ltd. P‘ship, 2002 WI 108, ¶44, 255 Wis. 2d 447, 649 N.W.2d 626. Reetz has failed to show that declaratory judgment is an appropriate remedy to resolve her claims.
¶36 Aurora contends that Reetz‘s request was properly denied by the circuit court because declaratory relief must be narrowly tailored toward remedying an ongoing harm, not premised on past conduct. Aurora asserts that Reetz only alleged past conduct from the data breach and speculative future harms. Aurora argues that Reetz has failed to allege what “impermissible conduct” by Aurora is ongoing and continuing to harm Reetz. Further, Aurora asserts that Reetz has failed to plead any statutory or common law basis for injunctive relief or declaratory judgment. Reetz failed to refute Aurora‘s argument and we consider her to have conceded the issue. See United Coop., 304 Wis. 2d 750, ¶39. Therefore, we conclude that the circuit court properly dismissed Reetz‘s request for declaratory judgment and injunctive relief.
CONCLUSION
¶37 We conclude that Reetz has adequately pleaded standing and a negligence claim. We reverse this part of the circuit court order and remand for further proceedings on this claim. Conversely, we conclude that Reetz has failed to state a claim for invasion of privacy-publicity of public facts; breach of contract-either express or implied or the covenant of good faith and fair dealing; or declaratory judgment and injunctive relief. Therefore, we affirm the circuit court order dismissing these claims.
By the Court.—Order affirmed in part; order reversed in part and cause remanded for further proceedings.