Archey v. Osmose Utilities Services, Inc.

• Court: District Court, N.D. Illinois
• Decided: August 3, 2021
• Docket: 1:20-cv-05247
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

BENNIE ARCHEY,

Plaintiff,

v. No. 20-cv-05247 Judge Franklin U. Valderrama OSMOSE UTILITIES SERVICES, INC.,

Defendant.

MEMORANDUM OPINION AND ORDER Plaintiff Bennie Archey (Archey), a foreman for Defendant Osmose Utilities Services, Inc. (Osmose), was terminated by Osmose. After Archey’s termination, Osmose suffered a cyberattack that allegedly compromised Archey’s personal information stored in Osmose’s computer systems. Archey filed suit against Osmose asserting a retaliatory discharge claim under the Illinois Workers’ Compensation Act, 820 ILCS 305/1, et seq. (the IWCA) (Count I); a claim for breach of an implied contract under Illinois common law (Count II); and a claim for a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505/1, et seq. (the ICFA) (Count III). R. 17, FAC.1 Osmose moves to dismiss Counts II and III of the First Amended Complaint (the FAC) pursuant to Federal Rule of Civil Procedure 12(b)(6). R. 24, Mot. Dismiss. For the reasons that follow, the Court grants Osmose’s motion.

1Citations to the docket are indicated by “R.” followed by the docket number or filing name, and where necessary, a page or paragraph citation. Background Osmose hired Archey in July 2016 as a full-time foreman trainee, and promoted him to Foreman in October 2016. FAC ¶¶ 9–10.2 As a condition of

employment, Osmose required Archey to provide his personal information, including but not limited to his name, social security number, and banking information. Id. ¶¶ 8, 38. In March 2017, Archey sustained an injury to his right elbow while on the job. Id. ¶ 12. Osmose subsequently fired him in April 2017. Id. ¶ 25. In July 2020, Osmose suffered a cyberattack against its computer systems containing the personal information of current and former employees. Id. ¶¶ 30–31; R. 25, Mot. Dismiss

Memo. at 1. Osmose launched an investigation into the cyberattack and on August 21, 2020, determined that the cyberattack had exposed Archey’s personal information to at least one unauthorized third party. FAC ¶ 31. Osmose could not confirm whether any third party had viewed or copied this information. Mot. Dismiss Memo. at 3. On September 2, 2020, Osmose mailed Archey a letter to notify him of the cyberattack and investigation, and offered free credit monitoring and identity-theft protection. FAC ¶ 32; Mot. Dismiss Memo. at 1.

Archey then initiated this lawsuit by filing a multi-count complaint against Osmose alleging, among other things, that Osmose violated the IWCA. R. 1, Compl. Archey has since amended his original complaint and now alleges: violation of the IWCA (Count I), breach of an implied contract (Count II), and violation of the ICFA

2The Court accepts as true all of the well-pleaded facts in the complaint and draws all reasonable inferences in favor of the plaintiff. Platt v. Brown, 872 F.3d 848, 851 (7th Cir. 2017). (Count III). Osmose moves to dismiss Counts II and III of the FAC pursuant to Rule 12(b)(6). Standard of Review

A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint. Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). Under Rule 8(a)(2), a complaint must include only “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). To survive a motion to dismiss, a complaint need only contain factual allegations, accepted as true, sufficient to “state a claim to relief that is plausible on

its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. The allegations “must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. The allegations that are entitled to the assumption of truth are those that are factual, rather than mere legal conclusions. Iqbal, 556 U.S. at 678–79.

Analysis I. Implied Contract (Count II) In Count II, Archey alleges that Osmose breached the implied contract between the parties by failing to protect his personal information and failing to timely notify Archey of the breach and that his information had been compromised. FAC ¶ 40. Osmose moves to dismiss this count on the basis that Archey has failed to adequately plead the elements of an implied contract, namely, mutual assent, breach, and actual damages. Mot. Dismiss Memo. at 5–14. As to the actual damages element, Osmose contends that Archey is required to plead some cognizable loss or injury caused by

Osmose’s conduct. Id. at 5 (citing Moyer v. Michaels Stores, Inc., 2014 WL 3511500, at *7 (N.D. Ill. July 14, 2014)). Instead, Archey, according to Osmose, “[a]t most, . . . alleges that his personal information was stored on systems that were ‘accessed’ by an unauthorized third party . . . but does not allege any facts indicating that he was harmed by this system access.” Id. at 6. The Court agrees that Archey has failed to adequately plead actual damages.

To plead a breach of contract claim under Illinois law, a plaintiff must allege: “(1) the existence of a valid and enforceable contract; (2) performance by the plaintiff; (3) breach of contract by the defendant; and (4) resultant injury to the plaintiff.” Am. Ctr. for Excellence in Surgical Assisting Inc. v. Cmty. Coll. Dist. 502, 190 F. Supp. 3d 812, 818 (N.D. Ill. 2016) (quoting Hess v. Bresney, 784 F.3d 1154, 1158–59 (7th Cir. 2015)). Archey does not allege the existence of an express contract, but rather an implied contract between the parties. No matter, because under Illinois law, an

implied contract “must contain all of the elements of an express contract, along with a mutual intent to contract.” Siegel v. Shell Oil Co., 656 F. Supp. 2d 825, 835 (N.D. Ill. 2009) (internal citations omitted). It is created as a result of the parties’ conduct. Marcatante v. City of Chi., 657 F.3d 433, 440 (7th Cir. 2011); see also A.E.I. Music Network, Inc. v. Bus. Computs., Inc., 290 F.3d 952, 956 (7th Cir. 2002) (“[A]n implied- in-fact contract is a true contract, containing all necessary elements of a binding agreement; it differs from other contracts only in that it has not been committed to writing or stated orally in express terms, but rather is inferred from the conduct of the parties in the milieu in which they dealt.”) (internal citations omitted).

A review of the complaint reveals that Archey fails to plead any actual loss or injury from the cyberattack. Notably, in his Response, Archey does not point to any allegation in the complaint of any actual loss or injury from the cyberattack. See generally Response. Instead, Archey argues that he need not plead damages because his injury is that he was denied the benefit of his bargain. Resp. at 5 (citing Springer v. Cleveland Clinic Emp. Health Plan Total Care, 900 F.3d 284, 287 (6th Cir. 2018);

Kuhns v. Scottrade, Inc., 868 F.3d 711, 716 (8th Cir. 2017); and In re Facebook Internet Tracking Litig., 263 F. Supp. 3d 836, 844 (N.D. Cal. 2017)). Those cases, however, are all distinguishable as the issue the courts addressed in each case was one of standing and not one of actual damages. As Osmose correctly points out, Archey fails to cite a single case supporting the proposition that a plaintiff in a data breach case need not allege a cognizable loss or injury. R. 36, Reply at 4–6. The Court finds that the FAC, when read in the light most favorable to Archey,

accepting all well-pleaded facts alleged, and drawing all possible inferences in Archey’s favor, fails to allege any actual loss or injury from Osmose’s data breach. Because Archey does not sufficiently plead damages, the Court need not address the parties’ arguments on mutual assent and breach. Accordingly, the Court grants Osmose’s motion with respect to Count II. II. ICFA (Count III) In Count III, Archey alleges that Osmose violated the ICFA based on a violation of the Illinois Personal Information Protection Act’s (the PIPA)

requirements for reasonable data security and reasonable notice of breach. FAC ¶¶ 45–47. Osmose argues that the ICFA claim fails because the FAC fails to allege “actual damages” or a “nexus” between the alleged ICFA violation and Illinois. Mot. Dismiss Memo. at 5–10; 14–15. The ICFA declares that “[u]nfair methods of competition and unfair or deceptive acts or practices . . . are hereby declared unlawful.” 815 ILCS 505/2. And

“[a]ny person who suffers actual damage as a result of a violation of this Act committed by any other person may bring an action against such person.” 815 ILCS 505/10(a). To state a claim under the ICFA, Archey must plead: (1) a deceptive act or practice by Osmose; (2) that the act or practice occurred in the course of conduct involving trade or commerce; (3) that Osmose intended Archey to rely on the deception; and (4) that actual damages were proximately caused by the deception. See Oshana v. Coca-Cola, 472 F.3d 506, 513 (7th Cir. 2006) (citing Avery v. State Farm

Mut. Auto. Ins. Co., 835 N.E.2d 801, 850 (Ill. 2005)). A violation of the PIPA constitutes an unlawful practice under the ICFA. 815 ILCS 505/2Z; 815 ILCS 530/20; see In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 527 (N.D. Ill. 2011). The PIPA requires data collectors who own, license, maintain, or store records containing personal information about an Illinois resident to “implement and maintain reasonable security measures to protect those records from unauthorized access . . . or disclosure.” 815 ILCS 530/45(a). It also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay. . . .” 815 ILCS 530/10(a).

It is undisputed that a plaintiff must allege “actual damages” to bring suit under the ICFA. Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 969 (7th Cir. 2016) (citing People ex rel. Madigan v. United Constr. of Am., Inc., 981 N.E.2d 404, 410–11 (Ill. App. Ct. 2012)). “Money out of pocket is a standard understanding of actual damages . . . .” Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826, 830 (7th Cir. 2018). However, “in federal court it is the federal rules that determine what must be

in a complaint . . . and the federal rules do not require plaintiffs to identify items of loss . . . .” Id. at 828. “Rule 54(c) provides that the prevailing party receives the relief to which it is entitled, whether or not the pleadings have mentioned that relief.” Id. “Rule 8(a)(3) requires the plaintiff to identify the remedy sought, but it does not require detail about the nature of the plaintiff’s injury.” Id. Archey alleges generally that he “suffered damages” as a result of Osmose’s ICFA violation. FAC ¶ 48. Osmose argues that “suffer[ing] damages” falls short of

pleading requirements and that Archey fails to allege a specific monetary loss or that his personal information was misused. Mot. Dismiss Memo. at 6.3 Archey responds that his allegations of damages are sufficient to allege a concrete injury both because of the risk of misuse of his personal data by hackers and the fact that Osmose offered free credit-monitoring and identity-protection services after the breach. Resp. at 8–

3In its Reply, Osmose confirms that it is not challenging whether Archey has sufficiently pled an injury-in-fact for the purposes of Article III standing. Reply at 3. 10. Further, he contends that the value of his time needed to set things straight after the cyberattack is a loss that justifies actual damages. Id. at 10–13. Before discussing the merits, the Court addresses a preliminary matter.

Osmose suggests that Archey cannot support his allegation of damages with the value of his lost time because he first raised it in his Response and outside of the FAC. Reply at 6. However, “[a] plaintiff need not put all of the essential facts in the complaint; he may add them by affidavit or brief in order to defeat a motion to dismiss if the facts are consistent with the allegations of the complaint.” Help At Home Inc. v. Med. Cap., L.L.C., 260 F.3d 748, 752–53 (7th Cir. 2001) (internal quotation marks

and citation omitted). The Court finds Archey’s allegation for the lost value of his time consistent with the facts set forth in the FAC. Therefore, the Court can consider this allegation. Turning to the merits, Osmose invites the Court to follow several decisions that ostensibly support the proposition that “actual monetary damages” is an indispensable element of an ICFA claim and where a plaintiff fails to allege such damages, the complaint must be dismissed. See Mot. Dismiss Memo. at 5–7 (citing

Lewert, 819 F.3d at 969; Kim v. Carter’s Inc., 598 F.3d 362, 365 (7th Cir. 2010); Moyer v. Michaels Stores, Inc., 2014 WL 3511500, at *7 (N.D. Ill. July 14, 2014); Worix v. MedAssets, Inc., 857 F. Supp. 2d 699, 706 (N.D. Ill. 2012); Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 639 (7th Cir. 2007)). Archey, on the other hand, contends that Lewert, Moyer, Worix and Pisciotta are all distinguishable from this case and invites the Court to instead follow Remijas v. Neiman Marcus Grp., 794 F.3d 688 (7th Cir. 2015) and Dieffenbach, 887 F.3d at 826. Resp. at 8––13. The Court agrees with Osmose that Archey confuses pleading an injury-in-fact in the context of Article III standing with pleading damages as an

element of an ICFA claim, and finds Archey’s cited cases to be inapposite. See Reply at 3–4. In Remijas, the plaintiffs-customers brought suit against a department store after their credit card numbers were stolen during a cyberattack. 794 F.3d at 689. Contrary to Archey’s suggestion, the case did not involve an alleged failure to plead damages. Rather, the issue was whether the plaintiffs had alleged an injury-in-fact

to satisfy Article III standing, and the Seventh Circuit found that the plaintiffs done so. Id. at 696. Even though the defendant attempted to argue that the plaintiffs failed to state a claim under Rule 12(b)(6), the Seventh Circuit found that because the district court did not reach this issue, the question was not before it either. Id. at 697. Dieffenbach also does not help Archey. In Dieffenbach, again, the plaintiffs-customers sued a bookstore to recover damages because of a data breach that resulted in theft of their credit card and debit card information. 887 F.3d at 827. One of the plaintiffs

invoked two California state statutes, and the Seventh Circuit noted that under one of those statutes, the value of one’s own time “needed to set things straight” constituted economic loss and therefore qualified as money damages. Id. at 828–29. Turning to the Illinois plaintiff, the Seventh Circuit confirmed that the ICFA, which that plaintiff had invoked, required that plaintiff to suffer “actual damages.” Id. at 829. The plaintiff had renewed a credit-monitoring service for $16.99 a month as a result of the security breach, and the court found this constituted “actual damage” under the ICFA. Id. (“A monthly $17 out of pocket is a form of ‘actual damage.”’). Yet, this is readily distinguishable from this case because Archey does not allege any out- of-pocket expenses of any kind. The Court finds that Archey fails to allege “actual damages” and that his IFCA claim fails on this basis alone. Accordingly, the Court need not address Osmose’s argument regarding the lack of damages related to the timing of the notice nor its additional argument that the ICFA claim fails because Archey does not plead circumstances that occurred “primarily and substantially” in Ilinois—the “nexus” requirement. Mot. Dismiss Memo. at 14—15. Conclusion For the foregoing reasons, the Court grants Osmose’s Motion to Dismiss and dismisses Counts II and III without prejudice. The Court grants leave to Archey file a second amended complaint by August 24, 2021. However, the Court notes that this will be Archey’s last opportunity to amend his complaint to address any pleading deficiencies. If his second amended complaint fails to state a claim under Rule 12(b)(6), any subsequent dismissal will be with prejudice. See Bank of Am., N.A. v. Knight, 725 F.3d 815, 818-19 (7th Cir. 2013) (affirming dismissal with prejudice of third pleading attempt because “in court, as in baseball, three strikes and you're out”).

Dated: August 3, 2021 Cobley 7 ob United States District Judge Franklin U. Valderrama