Case Information
IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NORTH DAKOTA EASTERN DIVISION
Jason Quaife, John Hoffer, Amanda )
Koffler, and Alec R. Kiesow, on behalf of )
themselves individually and all others )
similarly situated, ) ORDER
)
Plaintiffs, )
) Case No. 3:23-cv-176 vs. )
)
Brady, Martz & Associates, P.C., )
)
Defendant. )
Defendant Brady Martz & Associates, P.C. (“Brady Martz”) moves to dismiss the consolidated class action complaint for lack of jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and failure to state a claim upon which relief may be granted under Federal Rule of Civil Procedure 12(b)(6). Doc. 20. The class Plaintiffs oppose the motion. Doc. 21. For the reasons below, the motion is granted in part and denied in part.
I. FACTUAL BACKGROUND
The factual background, which is accepted as true for the purposes of this motion, is taken from the Plaintiffs’ first amended complaint. Doc. 15. This is a class action case brought by several individuals against Brady Martz that alleges various tort and statutory claims arising from a data breach in November 2022. Id.
Brady Martz is an “accounting, tax, and audit services firm . . . based in Grand Forks, North Dakota, and operating throughout North Dakota and in northwestern Minnesota.” Doc. 15 at 1. Its clients include individuals, companies, and businesses, that provide Brady Martz personal information of individuals (including employees and owners) so Brady Martz can provide tax and accounting services. Id. at 7. Some examples of the personal information include full names, social security numbers, driver’s license numbers, and dates of birth, as well as financial account information and medical records. Id. The class Plaintiffs were not clients of Brady Matz; their personal information was provided to Brady Martz from their employers or other organizations that were clients of Brady Martz. Id. at 5-6.
As alleged, in November 2022, Brady Martz noticed some unusual activity on its networks.
Id. at 2. It retained cybersecurity specialists and discovered that cybercriminals accessed its information systems and databases and allegedly “stole vast quantities of [personal information] belonging to Plaintiffs[.]” Id. at 3.
The Plaintiffs’ claims arise from the data breach—they seek relief from, among other things, “the consequences of [Brady Martz’s] failure to reasonably safeguard” their personal information. Id. at 5. They allege six claims: negligence, negligence per se, unjust enrichment, declaratory judgment, violation of the Massachusetts Consumer Protection Act, and violation of North Dakota Century Code section 51-22-02.
II. LAW AND ANALYSIS
Brady Martz moves to dismiss the amended complaint for failure to state a claim upon which relief can be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). Federal Rule of Civil Procedure 8(a) requires a pleading to contain only “a short and plain statement of the claim showing that the pleader is entitled to relief.” But a complaint may be dismissed for “failure to state a claim upon which relief can be granted,” and a party may raise that defense by motion. Fed. R. Civ. P. 12(b)(6). In reviewing a motion to dismiss for failure to state a claim under Rule 12(b)(6), the court accepts as true the factual allegations in the complaint and draws all reasonable inferences in the plaintiff’s favor. Gorog v. Best Buy Co., 760 F.3d 787, 792 (8th Cir. 2014)
(citation omitted). Although the factual allegations need not be detailed, they must be sufficient to
“raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly,
Because this is a class action case, with class Plaintiffs in many states, “an individualized
choice-of-law analysis must be applied to each plaintiff's claim in a class action.” In re St. Jude
Med., Inc.,
A. Negligence
Brady Martz argues the amended complaint fails to state a negligence claim because the
Plaintiffs failed to plausibly allege a duty. Doc. 19 at 9. The elements of a negligence claim are
“(1) duty; (2) breach of that duty; (3) causation; and (4) damages.” Barbie v. Minko Constr., Inc.,
The amended complaint generally alleges Brady Martz owed the Plaintiffs a duty to exercise reasonable care in obtaining and safeguarding their personal information. Doc. 15 at 35- 36. The Plaintiffs also allege that Brady Martz’s failure to comply with Section 5 of the Federal Trade Commission Act (“FTC Act”) is evidence of a duty that was breached. Id. at 36. When determining if a duty exists in North Dakota:
The court must balance the following factors when determining the existence of duty in each particular case: (1) foreseeability of harm to plaintiff; (2) degree of certainty that plaintiff suffered injury; (3) closeness of connection between defendant’s conduct and injury suffered; (4) moral blame attached to defendant’s conduct; (5) policy of preventing future harm; (6) extent of burden to defendant and the consequences to the community of imposing a duty to exercise care with resulting liability for breach; and (7) availability, cost, and prevalence of insurance for the risk involved.
Hurt v. Freeland,
That is not the end of the analysis though. In North Dakota, Minnesota, and Massachusetts,
there is no duty to control the conduct of a third person as to prevent him from causing harm to
another unless a “special relationship” exists that imposes a duty to control the third person’s
conduct, or a special relationship exists requiring the actor to protect the other. Saltsman v. Sharp,
But the allegation in the complaint is not that Brady Martz should have controlled the cyber criminals. Instead, the accusation is that Brady Martz should have had better data security measures in place because a data breach was foreseeable. It is Brady Martz’s security practices which constitute potential negligence, not the conduct of the cyber criminals. See In re Netgain Tech., LLC, at *11. And, in any event, “[a] defendant who assumes custody or assumes responsibility of something may be held to have a special relationship with the plaintiff. Jay P. Kesan & Carol M. Hayes, Liability for Data Injuries, 2019 U. Ill. L. Rev. 295, 321 (2019). At this early stage, the Plaintiffs have pleaded sufficient facts to support a plausible negligence claim.
B. Negligence Per Se
Brady Martz next argues the amended complaint fails to state a claim for negligence per
se. Doc. 15 at 39. North Dakota and Massachusetts do not recognize negligence per se. See Larson
v. Kubisiak,
“Negligence per se is a form of ordinary negligence that results from violation of a statute.”
Seim v. Garavalia
,
The Plaintiffs claim Brady Martz violated Section 5 of the FTC Act and that that violation
constitutes negligence per se under Minnesota law. Doc. 15 at 40. Section 5 of the FTC Act gives
the FTC the authority to enforce against “unfair . . . practices in or affecting commerce.” 15 U.S.C.
§ 45(a). The FTC Act does not create a private right of action. FTC v. Johnson,
C. Unjust Enrichment
Brady Martz next alleges the Plaintiffs have failed to state a claim for unjust enrichment.
In North Dakota:
Unjust enrichment is a broad, equitable doctrine which rests upon quasi or constructive contracts implied by law to prevent a person from unjustly enriching himself at the expense of another. To recover under a theory of unjust enrichment, the plaintiff must prove: (1) an enrichment, (2) an impoverishment, (3) a connection between the enrichment and the impoverishment, (4) the absence of a justification for the enrichment and impoverishment, and (5) the absence of a remedy provided by law. The theory may be invoked when a person has and retains money or benefits which in justice and equity belong to another. For a complainant to recover, it is sufficient if another has, without justification, obtained a benefit at the direct expense of the complainant, who then has no legal means of retrieving it. The essential element in recovering under the theory is the receipt of a benefit by the defendant from the plaintiff which would be inequitable to retain without paying for its value.
McDougall v. AgCountry Farm Credit Servs., PCA,
Here, there is no allegation of a direct relationship between the Plaintiffs and Brady Martz. Nor could there be. There was no benefit conferred to Brady Martz by the Plaintiffs because Brady Martz did not contract with the Plaintiffs for accounting services—it contracted with the Plaintiffs’ employers. There are no allegations that the employers did not receive the benefit of their bargain with Brady Martz. See Flesner v. Bayer AG, 596 F.3d 884, 892 (8th Cir. 2010) (no unjust enrichment where party “received the benefit of his bargain”). So, the amended complaint does not plausibly allege unjust enrichment, and the claim is dismissed.
D. Massachusetts Consumer Protection Act
Brady Martz also asserts the sole Massachusetts Plaintiff failed to state a claim under the Massachusetts Consumer Protection Act (“MCPA”). It claims that the alleged acts did not occur primarily and substantially within Massachusetts, as required by the statute.
The MCPA requires the actions and transactions constituting the unfair or deceptive act or
practice to occur “primarily and substantially” within Massachusetts. Kuwaiti Danish Computer
Co. v. Digital Equip. Corp., 438 Mass. 459, 781 N.E.2d 787, 798 (Mass. 2003).Whether the
misconduct “occurred primarily and substantially within [Massachusetts] is not a determination
that can be reduced to any precise formula.” Id. The key question is “whether the center of gravity
of the circumstances that give rise to the claim is primarily and substantially within the
Commonwealth.” Id. at 799. A defendant bears the burden to show the conduct did not occur
primarily and substantially in Massachusetts. Pine Polly, Inc. v. Integrated Packaging Films IPF,
Inc.,
The amended complaint is silent regarding any action of Brady Matz in Massachusetts.
The Plaintiffs concede “[t]he conduct in question likely took place in North Dakota, as Defendant’s
employees and decision-makers are (as far as Plaintiffs know) all in North Dakota.” Doc. 21 at 14.
In Pine Polly, a federal district court, interpreting Massachusetts law, found that the center of
gravity inquiry requires deceptive conduct take place in Massachusetts.
E. Illegal Disclosure Under North Dakota Century Code § 51-22-02 Brady Martz next argues that the Plaintiffs have not adequately plead a claim for violation of North Dakota Century Code section 51-22-02. That statute states: No business entity which charges a fee for data processing services performed may disclose in whole or in part the contents of any record . . . without the express written consent of such individual or business entity.
N.D. Cent. Code § 51-22-02(1). Brady Martz argues that disclosure requires an intentional or willful disclosure of information and does not apply to a data breach where a third-party steals information. The Plaintiffs argue that an intentional or willful disclosure is not required.
The statute does not define “disclose.” Under North Dakota law, when a word is undefined as part of a particular statute, the definition from a separate statute can be used to determine the word’s meaning, unless a “contrary intention plainly appears.” N.D. Cent. Code § 1-01-09. Here, the Plaintiffs encourage the Court to use the definition of “disclose” or “disclosure” from North Dakota Century Code section 32-49-01(3), which is the Uniform Civil Remedies for Unauthorized Disclosure of Intimate Images Act. No contrary intention plainly appears, and per that statute, “disclose” means to transfer, publish, or distribute to another person.
While these acts do not require intent or willfulness, they do require some type of action.
But what has been alleged is inaction:
Defendant disclosed Plaintiffs and Class Members’ PI to third parties without their consent by failing to take appropriate measures to safeguard and protect that PI amidst a foreseeable risk of a cybersecurity attack, resulting in the Data Breach. Doc. 15 at 47. There is no accusation that Brady Martz transferred, published, or distributed the personal information to a third party. The allegations are that cyber criminals accessed Brady Martz’s computer systems and stole the information. And the primary complaint is about Brady Martz’s alleged inaction in preventing the breach. That supports a claim for negligence, but it is not enough to plausibly allege a claim under North Dakota Century Code section 51-22-02.
F. Declaratory Judgment
Brady Martz argues that Plaintiffs’ claims for declaratory judgment and injunctive relief
should be dismissed because the Plaintiffs due not have standing. To establish Article III standing,
a plaintiff, among other elements, “must show . . . an injury in fact.” Becker v. N. Dakota Univ.
Sys.,
1994).
The Declaratory Judgment Act permits the judiciary to “declare the rights and other legal
relations of any interested party seeking such declaration, whether or not further relief is or could
be sought.” 28 U.S.C. § 2201(a). The Plaintiffs allege they are “at risk of harm due to the exposure
of their PI and Defendant’s failure to address the security failings that lead to such exposure.” Doc.
15 at 23. At this early stage, there is an alleged risk of harm and injury in fact as to the stole
personal information that is sufficient to have standing and to survive a motion to dismiss. See In
re Netgain Tech., LLC, at *17 (D. Minn. June 2, 2022) (denying motion to dismiss claim for
declaratory judgment in data breach case); In re The Home Depot, Inc., Customer Data Sec. Breach
Litig.,
G. Additional Plaintiff
Finally, Brady Martz raises a procedural concern with the addition of class Plaintiff
Samantha Stock. When the Plaintiffs filed the amended complaint, they added Stock as a Plaintiff
without leave of court. “Under [Federal Rule of Civil Procedure] Rule 42, courts have substantial
discretion in questions of consolidation.” Greiner v. Delorme, No. 3:18-cv-247, 2020 WL
12957751, at *2 (D.N.D. Apr. 23, 2020). Claims and issues sharing common aspects of law or fact
may be consolidated to avoid unnecessary cost or delay. E.E.O.C. v. HBE Corp.,
III. CONCLUSION
For the reasons discussed above, Brady Martz’s motion to dismiss the amended complaint (Doc. 20) is GRANTED IN PART AND DENIED IN PART .
IT IS SO ORDERED .
Dated this 22nd day of May, 2024.
/s/ Peter D. Welte Peter D. Welte, Chief Judge United States District Court
Notes
[1] The elements are the same in Minnesota and Massachusetts. Schmanski v. Church of St. Casimir
of Wells,