Reetz v. Advocate Aurora Health, Inc.
| Decision Date | 22 November 2022 |
| Docket Number | Appeal No. 2021AP520 |
| Citation | 405 Wis.2d 298,983 N.W.2d 669,2022 WI App 59 |
| Parties | Janet REETZ, Plaintiff-Appellant, v. ADVOCATE AURORA HEALTH, INC., Defendant-Respondent. |
| Court | Wisconsin Court of Appeals |
On behalf of the plaintiff-appellant, the cause was submitted on the brief of Mary C. Turke, Samuel J. Strauss, and Nathan DeLadurantey of Turke & Strauss LLP.
On behalf of the defendant-respondent, the cause was submitted on the brief of Daniel E. Conley, Brandon M. Krajewski, and James E. Goldschmidt of Quarles & Brady LLP; Edward McNicholas and Fran Faircloth, pro hac vice, of Ropes & Gray, LLP.
Before Brash, C.J., Dugan and White, JJ.
¶1 Janet Reetz appeals the order dismissing her class action against Advocate Aurora Healthcare, Inc. (Aurora). Reetz alleged negligence, invasion of privacy, breach of contract, breach of implied covenant of good faith and fair dealing, and declaratory relief for Aurora's actions related to a data breach of personal information from Aurora's systems.
¶2 Upon review, we conclude that Reetz had standing to pursue her claims, adequately pleaded sufficient damages, and adequately pleaded a cause of action for negligence. Therefore, we reverse that part of the order dismissing the negligence claim and remand the same to the circuit court for further proceedings consistent with this decision. However, Reetz failed to state a claim upon which relief may be granted for her other four claims: invasion of privacy, breach of contract, breach of implied covenant of good faith and fair dealing, and declaratory relief. Therefore, we affirm the parts of the circuit court order dismissing those claims.
¶3 We recite the facts of this case as drawn from the factual allegations in the pleadings. This case arises out of a data breach of Aurora's information technology systems. On February 20, 2020, Aurora sent a notice of a security incident that occurred in January 2020 during which an unauthorized person gained temporary access through a phishing scheme to an Aurora human resources system that housed personal information for current and former Aurora employees. When Aurora became aware of the issue on January 9, 2020, it locked out the intruder. Aurora's internal investigation showed that the personal information of current and former Aurora employees at Wisconsin locations was at risk, including employees’ Social Security numbers, bank accounts used for direct deposit, birth dates, and home addresses. Aurora discovered that sixty-three employees had their direct deposit information changed to deposit paychecks into the intruder's account(s). Aurora offered complimentary one-year memberships in an identity theft protection service to all former and current employees whose information was contained in the affected system. Reetz, a former Aurora employee, had her personal information contained in the affected HR system; however, her account's direct deposit instructions were not among the sixty-three accounts discovered as compromised.
¶4 Reetz first filed a class action suit against Aurora in March 2020, pursuing claims against Aurora for herself and as a representative of other similarly situated individuals. Aurora moved to dismiss Reetz's action in June 2020. In response, Reetz amended her complaint in July 2020. Aurora again moved to dismiss in September 2020. After argument before the circuit court in December 2020, the circuit court dismissed Reetz's action with prejudice in a written decision on February 18, 2021.
¶5 Reetz appeals.
¶6 Reetz argues that the circuit court erred when it dismissed her complaint with prejudice. A motion to dismiss tests the sufficiency of the complaint. Data Key Partners v. Permira Advisers LLC , 2014 WI 86, ¶19, 356 Wis. 2d 665, 849 N.W.2d 693. When we review a motion to dismiss, "[a]ll facts pleaded and all reasonable inferences from those facts are admitted as true," for the purpose of our review.
Scott v. Savers Prop. & Cas. Ins. Co. , 2003 WI 60, ¶5, 262 Wis. 2d 127, 663 N.W.2d 715. "The pleadings are to be liberally construed and a claim will only be dismissed if the plaintiff cannot recover under any circumstances." Heinritz v. Lawrence Univ. , 194 Wis. 2d 606, 610-11, 535 N.W.2d 81 (Ct. App. 1995). "We independently review as a question of law whether a complaint states a cognizable claim." DeBruin v. St. Patrick Congregation , 2012 WI 94, ¶10, 343 Wis. 2d 83, 816 N.W.2d 878.
¶7 We begin with the issue of standing. The circuit court concluded Reetz had standing, but had not sufficiently alleged damages to state a claim upon which relief may be granted. Reetz argues that she has standing to bring her claims and that she sufficiently alleged damages. Aurora argues she neither has standing nor sufficiently alleged damages. "Whether a party has standing is a question of law that we review independently." Friends of Black River Forest v. Kohler Co. , 2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342 (citation omitted). Under Wisconsin law, the standing of a party whose interest is challenged is determined by: (1) personal interest in the controversy; (2) injury or adverse effect; and (3) judicial policy that "calls for protecting the interest of the party whose standing has been challenged." Foley-Ciccantelli v. Bishop's Grove Condo. Ass'n, Inc. , 2011 WI 36, ¶5, 333 Wis. 2d 402, 797 N.W.2d 789. The law of standing is liberally construed. Krier v. Vilione , 2009 WI 45, ¶20, 317 Wis. 2d 288, 766 N.W.2d 517.
¶8 As noted, on appeal, Aurora challenges the circuit court's finding that Reetz had standing to bring this action. "To say that the plaintiffs have standing is to say that they have alleged injury in fact, and if they have suffered an injury then damages are available[.]" Dieffenbach v. Barnes & Noble, Inc. , 887 F.3d 826, 828 (7th Cir. 2018).1 Her operative complaint alleged an injury in fact from cybercriminals unlawfully accessing Aurora's HR systems, which allowed them to access current and former employees’ personally identifiable information (PII) including Social Security numbers, birth dates, home addresses, and bank accounts used for direct deposit. Reetz alleged that she suffered $2,700 in fraudulent charges against her bank account and a resulting $600 in insufficient funds and overdraft fees. To establish standing in a data breach identity theft case, allegations of "time spent dealing with fraud attempts, the threat of future identity theft, and money spent mitigating that threat ... [are] sufficient to establish standing[.]" Fox v. Iowa Health Sys. , 399 F. Supp. 3d 780, 790 (W.D. Wis. 2019). We agree that Reetz has established an injury in fact and standing to pursue this action.
¶9 Nevertheless, Aurora asserts that Reetz does not have standing and the circuit court should not have exercised jurisdiction over her claims. "Being damaged, however, without more, does not automatically confer standing." Krier , 317 Wis. 2d 288, ¶20, 766 N.W.2d 517. Aurora contends that Reetz has failed to adequately plead damages to establish standing, because she has not shown the causal link between her damages and Aurora's conduct. Aurora argues that the timing of the theft from Reetz's bank accounts does not prove that the theft occurred as a result of the data breach. "[W]hen a defendant does not submit evidence that contradicts a specific allegation, the court accepts that allegation as true[.]" Fox , 399 F. Supp. 3d at 792. Aurora has not offered any evidence that Reetz's data was stolen in a different way. Ultimately, Aurora may be correct that Reetz's information was exposed in another way that caused the alleged monetary losses, but that is an issue of causation to be resolved at trial or summary judgment. See id. Therefore, Reetz's allegations are sufficient to establish standing.
¶10 Having concluded that Reetz's allegations are sufficient to establish standing, we next address whether she has sufficiently plead damages to support each of her claims. Further, we address Aurora's arguments that Reetz's damages are speculative and do not support her claims.
¶11 Reetz argues she successfully stated a claim for common-law negligence; therefore, the circuit court erred in dismissing this claim. For a negligence claim to survive a motion to dismiss, a plaintiff must have "sufficiently pled facts, which if proven true, would establish all four required elements of an actionable negligence claim." Nichols v. Progressive N. Ins. Co. , 2008 WI 20, ¶11, 308 Wis. 2d 17, 746 N.W.2d 220. The four elements of a negligence claim are: "(1) the existence of a duty of care on the part of the defendant, (2) a breach of that duty of care, (3) a causal connection between the defendant's breach of the duty of care and the plaintiff's injury, and (4) actual loss or damage resulting from the injury." Hornback v. Archdiocese of Milwaukee , 2008 WI 98, ¶16, 313 Wis. 2d 294, 752 N.W.2d 862 (citation omitted). Reetz alleged that, as her former employer, Aurora had a duty of care to safeguard the PII within its control because it was foreseeable that cybercriminals would attempt to access the PII. Reetz alleged that Aurora breached that duty by failing to exercise reasonable care in safeguarding the PII. Reetz then alleged that as a result of Aurora's negligence, she suffered damages including monetary damages and increased risk of future harm from identity theft.
¶12 Aurora argues that the negligence claim fails to state a claim because Reetz has failed to allege actual damages and because the economic loss doctrine bars the claim. Both of these arguments fail. We begin with actual damages. Damages in tort claims accrue only when actual damages occur, which is "harm that has already occurred or is ‘reasonably certain’ to occur in the future." Tietsworth v. Harley-Davidson, Inc. , 2004 WI 32, ¶17, 270 Wis. 2d 146, 677 N.W.2d 233 (citation omitted). Reetz alleged damages...
To continue reading
Request your trial