Bohnak v. Marsh & McLennan Companies, Inc.

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

eee nn SHANTEL JONES, ; On behalf of herself and all others similarly ‘ situated, and : OPINION AND ORDER GRANTING, IN PART, AND NANCY BOHNAK, : DENYING, IN PART, individually, : DEFENDANTS’ MOTION TO : DISMISS Plaintiffs, : -against- : 21 Civ, 6096 (AKH) MARSH & MCLENNAN COS., INC and : MARSH & MCLENNAN AGENCY LLC, Defendants. nner □□□ ernec □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ = X ALVIN K. HELLERSTEIN, U.S.D.J.: Defendants move to dismiss Plaintiffs’ Amended Complaint under Fed. R. Civ, P. 12(b)(1) and 12(b)(6). Specifically, Defendants argue that Plaintiff Shantel Jones’ putative class action claims are legally insufficient, and that Plaintiff Nancy Bohnak’s individual claims lack subject matter jurisdiction, For the reasons explained below, as to Jones’ claims, I grant Defendants’ motion to dismiss Count I! of the Amended Complaint, but I decline to dismiss Count IV. And as to Bohnak’s claims, I grant Defendants’ motion to dismiss both Counts I and

BACKGROUND This case stems from a 202] data breach suffered by Defendants, two New York- based corporate entities, which allegedly exposed the personally identifiable information (“PII”) of at least 7,000 individuals.

On July 15, 2021, Bohnak and Janet Lea Smith,' former employees of Defendants, filed a putative class action against Defendants, alleging negligence, breach of implied contract, and breach of confidence. ECF No. 1. On January 17, 2022, I granted Defendants’ motion to dismiss pursuant to Fed. R, Civ. P, 12(b)(6), holding that the complaint failed plausibly to allege cognizable damages proximately caused by Defendants. ECF No. 32. The Second Circuit reversed, holding that since Bohnak pleaded a sufficient Article JIT injury in fact, she also plausibly alleged a cognizable claim for damages. ECF Nos. 39-40. Defendants then answered the complaint, pleading the defense of waiver, and some discovery followed. See ECF Nos. 52, 71. Defendants moved to strike Bohnak’s class allegations on the basis of a waiver she signed in exchange for an enhanced severance package, which precluded her from “participat[ing] in any class or collection action against” Defendants. ECF No. 61, I granted the motion to strike the class allegations, ECF No. 71, and the Second Circuit denied Bohnak leave to appeal, ECF No. 77. Defendants filed a motion to dismiss Bohnak’s individual claims, averring that they did not meet the amount in suit requirement. ECF No. 79, In response, Bohnak filed an unopposed motion to add Jones, another former employee of Defendants, as class representative, and to continue Bohnak’s individual claims, ECF No. 82, which I granted, ECF No. 87. On March 17, 2025, Plaintiffs filed their Amended Complaint, alleging negligence and breach of implied contract claims by both Jones, on behalf of herself and a putative class, and Bohnak individually. ECF No. 88. Specifically, the Amended Complaint is comprised of four counts: Bohnak’s claims for negligence (Count I) and breach of implied

Smith was dropped as a named plaintiff in this action on January 3, 2024. ECF No. 51.

contract (Count III), and Jones’ putative class action claims for negligence (Count II) and breach of implied contract (Count IV). The Amended Complaint avers that Defendants failed properly to safeguard Plaintiffs’ PI, which may be sold on the dark web and pose a risk of identity theft to Plaintiffs for the rest of their lives. fd. Accordingly, Plaintiffs allege that the value of their PII has been diminished, that they have had to bear out-of-pocket expenses and opportunity costs to prevent, detect, and recover from identity theft, and that their PIT continues to be in jeopardy. This motion to dismiss followed. LEGAL STANDARD To survive a motion to dismiss for failure to state a claim under Fed, R. Civ. P, 12(b)(6), “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell AH. Corp. v. Twombly, 550 U.S, 544, 570 (2007)). In evaluating the complaint, | must “accept all well-pleaded factual allegations in the complaint as true” and “construe all reasonable inferences in the light most favorable to the plaintiff.” Lynch v. City of New York, 952 F.3d 67, 74-75 (2d Cir, 2020) (citation omitted). Under Fed. R. Civ. P. 12(b)(1), a party may also move to dismiss a case on the basis of the court’s lack of subject matter jurisdiction. “A plaintiff asserting subject matter jurisdiction has the burden of proving by a preponderance of the evidence that it exists.” Makarova v. United States, 201 F.3d 110, 113 (2d Cir. 2000), “In resolving a motion to dismiss under Rule 12(b)(1), the district court must take all uncontroverted facts in the complaint (or petition) as true, and draw all! reasonable inferences in favor of the party asserting jurisdiction.” Tandon v, Captain’s Cove Marina of Bridgeport, Inc., 752 F.3d 239, 243 (2d Cir. 2014),

DISCUSSION Defendants contend that I must dismiss the Amended Complaint since Iowa law governs and bars Jones’ putative class action claims for damages for negligence and for breach of implied contract, and bars Bohnak’s individual claims since she cannot meet the amount-in- suit requirement and is not entitled to supplemental jurisdiction. I discuss each of these issues in turn. L Jones’ claims Since Defendants’ argument as to Jones’ claims is predicated on Iowa law, as a threshold matter, 1 must determine whether New York or lowa law governs here. As the forum state, I must apply New York’s choice of law rules. Kinsey v. New York Times Co,, 991 F.3d 171, 176 (2d Cir. 2021); Klaxon Co. v. Stentor Elec. Mef Co., 313 US. 487, 496 (1941), “Under these rules, the first step in any choice of law inquiry is to determine whether there is an ‘actual conflict’ between the laws invoked by the parties.” Booking vy. General Star Memt. Co., 254 F.3d 414, 419 (2d Cir, 2001) (citing Alf/state Ins. Co. v. Stolarz, 81 N.Y.2d 219, 223 (N.Y. 1993)), “An actual conflict arises where the law of each jurisdiction provides different substantive rules, and the differences are relevant and have a significant possible effect on the outcome of the trial, although they need not lead to different outcomes,” Hau Yin To v. HSBC Holdings, PLC, 700 F. App’x 66, 68 (2d Cir. 2017). A. Negligence (Count ID) An actual conflict exists as to Jones’ negligence claim (Count IJ). As to negligence, New York law does not require an economic loss in data breach cases, but lowa law does. Compare, e.g., Sackin v. Transperfect Global, Inc., 278 F. Supp. 3d 739, 749-750 (S.D.N.Y, 2017); Toretto v. Donnelley Fin. Sols., Inc., 583 F. Supp. 3d 570, 590 (S.D.NLY.

2022); Miller v. Syracuse Univ., 662 F. Supp. 3d 338, 362 (N.D.N.Y, 2023) with Harris v. Mercy Health Network, Inc,, 23 Civ. 195, 2024 U.S. Dist, LEXIS 224618, at *57 (S.D. Iowa June 26, 2024); Annett Holdings, Inc. v. Kum & Go, 1.C., 801 N.W.2d 499, 503, n.1 (lowa 2011); Mohsen v. Veridian Credit Union, 733 F. Supp. 3d 754, 765 (N.D, lowa 2024). Since there is an actual conflict of laws here as to Count II, I proceed to the next step in conflicts analysis. In tort cases, New York utilizes the “interest analysis to determine which of two competing jurisdictions has the greater interest in having its law applied in the litigation.” Padula vy. Lilarn Properties Corp., 84 N.Y.2d 519, 521 (N.Y. 1994). Courts must consider (1) what “the significant contacts” are “and in which jurisdiction are they located,” and (2) “whether the purpose of the law is to regulate conduct or allocate loss.” fd, Where the conflict in tort law concerns the application of the economic loss rule, whose purpose is grounded in loss allocation, see Bodea v, Trans Nat Express, Inc., 286 A.D.2d 5,9 (N.Y. App. Div. 4th Dep’t 2001), 1 must apply the principles set forth by the New York Court of Appeals in Neumeier v, Kuehner, 31 N.Y.2d 121 (N.Y. 1972) to determine which state’s substantive law governs. Stichting Ter Behartiging Van De Belangen v. Schreiber, 407 F.3d 34, 50 (2d Cir. 2005). Where, as here, the parties are domiciled in different states, and “the laws of relevant domiciles do not favor the respective domiciliaries, the third Newmeier rule applies.” Id. “Pursuant to that rule, the law of the place of the tort will apply, unless displacing it ‘wiil advance the relevant substantive law purposes without impairing the smooth working of the multi-state system or producing great uncertainty for litigants.’” Jd. (quoting Newmeier, 31 N.Y.2d at 128). “[T]he place of the wrong is considered to be the place where the last event

necessary to make the actor liable occurred,” or, in other words, “where the plaintiffs’ injuries occurred,” Schultz v. Boy Scouts of Am.,, 65 N.Y.2d 189, 195 (N.Y. 1985). Here, Jones’ injuries occurred in Iowa, the state of her domicile.” Thus, lowa law governs as to Count II. Under Iowa law, “[a]s a general proposition, the economic loss rule bars recovery in negligence when the plaintiff has suffered only economic loss,” St, Malachy Roman Catholic Congregation of Geneseo v,. Ingram, 841 N.W.2d 338, 351 (lowa 2013) (quoting Annett Holdings, Inc. v. Kum & Go, L.C., 801 N.W.2d 499, 503 (lowa 2011)). And, as explained above, lowa law does not permit a negligence claim in a data breach suit where only economic loss is suffered. See, ¢.g., Annett Holdings, 801 N.W.2d at 503, n.1; Mohsen, 733 F. Supp. 3d at 765, see also Nicolas N. LaBranche, The Economic Loss Doctrine & Data Breach Litigation: Applying the “Venerable Chestnut of Tort Law” in the Age of the internet, 62 B.C. L. Rev. 1665, 1688-89 (2021) (noting how plaintiffs’ success in data breach suits hinges on choice of law issues with respect to the economic loss rule), With respect to Count II, the claim for negligence, the Amended Complaint alleges damages as to Jones and the putative class in the forms of: (i) actual identity theft; (ii) the loss of the opportunity of how their PII is used; (iii) the compromise, publication, and/or theft of their PU; (iv) out-of-pocket expenses associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of their PII; (v) lost opportunity costs associated with effort expended and the loss of productivity addressing and attempting to mitigate the actual and future consequences of the Data Breach, including but not limited to efforts spent researching how to prevent, detect, contest, and recover from tax fraud and identity theft; (vi) costs associated with placing freezes on credit reports; (vii) the continued risk to their PH, which remain in ? The Amended Complaint alleges that the putative class consists of “thousands of individuals” and that “Defendants advised the lowa Attorney General that the Data Breach affected 7,208 residents.” See ECF No. 88, 82.

Defendants’ possession and is subject to further unauthorized disclosures so long as Defendants fail to undertake appropriate and adequate measures to protect the PII of Plaintiff Jones and the Nationwide Class; and (viii) future costs in terms of time, effort, and money that will be expended to prevent, detect, contest, and repair the impact of the PH compromised as a result of the Data Breach for the remainder of the lives of Plaintiff Jones and the Nationwide Class .. . [and (ix)} anxiety, emotional distress, loss of privacy, and other economic and non-economic losses, ECF No. 88, {[ 157-58. But lowa’s economic loss rule plainly precludes recovery for these damages, which are purely economic in nature, and which do not fall under the limited, narrow exemptions provided for under Iowa law, such as professional negligence claims against attorneys and accountants, claims of negligent misrepresentation, and negligence torts arising from an agency relationship. See Van Sickle Constr. Co. v. Wachovia Commer. Mortg., Inc., 783 N.W.2d 684, 692 n.5 (lowa 2010); Annett Holdings, 801 N.W.2d at 504. And Jones, in her opposition brief, does not argue to the contrary. Jones’ non-economic emotional distress damages subsumed within Count II, predicated on the data breach, fare no better. A data breach plaintiff “cannot escape the economic loss rule by pleading emotional distress” since “allowing plaintiffs to simply plead emotional harms based on purely economic injuries would swallow the economic loss rule.” Mohsen, 733 F. Supp. 3d at 767. Accordingly, Count II fails to state a claim for which relief may be granted as to negligence, and thus, I dismiss it from the Amended Complaint. B. Breach of Implied Contract (Count IV) An actual conflict of laws also exists as to Jones’ breach of implied contract claim (Count IV), Defendants aver—and Jones does not dispute—that lowa law imposes more stringent elements for breach of implied contract claims that stem from data breaches than New York law does. Specifically, “the plaintiffs must allege that the defendant promised to protect

the specific piece of data the plaintiffs assert was accessed.” Harris, 2024 U.S. Dist. LEXIS 224618, at *35 (emphasis in original),* In contrast, there is no such requirement under New York law. See, ¢.g., Sackin, 278 F. Supp. 3d at 750-51 (denying motion to dismiss breach of implied contract claim since defendant “required and obtained the PII as part of the employment relationship, evincing an implicit promise by TransPerfect to act reasonably to keep its employees’ PII safe”); fn re Unite Here Data Sec. Incident Litig., 740 F. Supp. 3d 364, 384 ($.D.N.Y, 2024) (existence of an implied contract is generally a question of fact, thereby precluding dismissal under Fed. R. Civ. P. 12(b)(6)). In contract cases, New York’s choice of law rules generaily consider (1) “the contacts that obtain significance in the particular contract dispute,” (2) “traditional choice of law factors,” and (3) “the policies underlying conflicting laws in a contract dispute” when they “are readily identifiable and reflect strong governmental interests.” Alfstafe, 81 N.Y.2d at 226. Accordingly, courts should consider, infer alia, the place of contracting, negotiation and performance; the location of the subject matter of the contract; and the domicile of the contracting parties, /d, at 227, In essence, courts must determine “which State has the most significant relationship to the transaction and the parties.” Zurich Ins. Co. v. Shearson Lehman Hutton, Ine., 84 N.Y.2d 309, 317 (N.Y, 1994).

3 Defendants also aver that Iowa law uniquely requires a data breach plaintiff to “identify the actions (e.g., security measures or procedures) the defendant could have employed to prevent the breach.” Harris, 2024 U.S. Dist. LEXIS 224618, at *35. But two federal district court opinions have imputed this same requirement under New York law. See In re Waste Mgmt. Data Breach Litig., 21 Civ. 6147 (DLC), 2022 U.S, Dist. LEXIS 32798, at *15 (S.D.NLY. Feb, 24, 2022); Troy v. A.B.A., 23 Civ. 3053 (NGG), 2024 U.S. Dist. LEXIS 78206, at *12-13 (E.D.N.Y. Apr. 30, 2024). And, in any event, the Amended Complaint conforms te these strictures, and identifies measures that Defendants could have taken to prevent this data breach, such as encrypting the stolen data, or deleting old data of former employees. ECF No. 88, { 82.

Here, I hold that New York substantive law governs Count IV. As the site of Defendants’ principal place of business, New York bears the most significant relationship to this action, since that is likely where the breakdown of its security protocols and its failure to safeguard the information took place. See In re Mednax Servs., 603 F. Supp. 3d 1183, 1199 (S.D. Fla. 2022). Moreover, New York maintains a significant interest in safeguarding data privacy and preventing breaches, especially in relation to global professional services firms headquartered therein, and has passed legislation strengthening such protections in recent years, See, e.g., Senate Bill 5575B & Assembly Bill 5635B, 242d Leg., Gen. Sess. Under New York law, the “elements of a breach of implied contract claim are the same as those of a traditional breach of contract claim: ‘(1) the existence of a contract, (2) performance by the party seeking recovery, (3) breach by the other party, and (4) damages suffered as a result of the breach.’” Jn re Unite Here Data Sec. Incident Litig., 740 F. Supp. 3d at 383 (quoting Zam & Zam Super Mkt, LLC v, Ignite Payments, LLC, 736 F. App’x 274, 276 (2d Cir. 2018)). An implied contract “may result as an inference from the facts and circumstances of the case, although not formally stated in words, and is derived from the presumed intention of the parties as indicated by their conduct.” Beth Isr. Med. Ctr. v. Horizon Blue Cross & Blue Shield of NJ, Inc., 448 F.3d 573, 582 (2d Cir, 2006) (quoting Jemzura v. Jemzura, 36 N.Y.2d 496, 503- 04 (NY. 1975)). Here, these elements are properly pleaded. Specifically, the Amended

4 Though I hold that lowa law governs Jones’ negligence claim, New York’s choice of law rules permit the doctrine of depecage, under which, different substantive issues in a case may be resolved under the laws of different states when it is appropriate to do so, See Babcock v, Johnson, 12 N.Y.2d 473, 484 (N.Y. 1963) (‘{T]here is no reason why all issues arising out of a tort claim must be resolved by reference to the law of the same jurisdiction.”); Simon y. Phillip Morris, 124 F. Supp. 2d 46, 75-76 (E.D.N.Y. 2000).

Complaint alleges that Defendants required Plaintiffs to provide their PII as a condition of employment, which they did, and which Defendants breached in failing to safeguard their PII, and in further failing to provide timely notice of the data breach, thereby causing Plaintiffs to suffer damages. ECF No. 88, {ff 168-73, Accordingly, I decline to dismiss Count [V of the Amended Complaint. IL. Bohnak’s claims (Counts I and III) I do not have original jurisdiction over this case since Bohnak’s individual claims do not meet the amount in suit requirement, and I decline to exercise supplemental jurisdiction over her individual claims for negligence (Count I) and breach of implied contract (Count IID) since I find that these claims substantially predominate over Jones’ remaining claim, which serves as the sole basis for this Court’s original jurisdiction.° Supplemental jurisdiction provides federal courts with the power to adjudicate “ail other claims that are so related to claims in the action within such origina] jurisdiction that they form part of the same case or controversy,” including “claims that involve the joinder or intervention of additional parties.” 28 U.S.C. § 1367(a). This statute, “by its plain text... authorized supplemental jurisdiction over all claims by diverse parties arising out of the same

> Though the Amended Complaint states that this Court has origina! jurisdiction over Bohnak’s claims under diversity jurisdiction, see ECF No. 88, § 24, Plaintiffs’ opposition brief instead argues that I should exercise my discretion to invoke supplemental jurisdiction over Bohnak’s claims, see ECF No. 100, at 18-19, in essence conceding that she does not meet the strictures of diversity jurisdiction. See, e.g., Jn re Appharvest Sec. Litig., 684 F, Supp. 3d 201, 255 (S.D.NLY. 2023) (collecting cases for the proposition that an argument not opposed in briefing is conceded). Moreover, as Defendants’ prior, now-mooted motion to dismiss Bohnak’s individual claims for lack of subject matter jurisdiction argues, and Bohnak’s responses to Defendants’ first set of interrogatories show, the damages that Bohnak sustained are relegated to $24.99 a month in credit monitoring services, see ECF No. 81-1, which, even if continued for 100 years, would not meet the amount-in-suit requirement of 28 U.S.C. § 1332(a). See ECF No. 80. 10

Article III case or controversy.” Exxon Mobil Corp. v. Allapattah Servs., 545 U.S. 546, 566-67 (2005); see also Hamilton Rsrv. Bank Ltd. v. Democratic Socialist Republic of Sri Lanka, 134 F.4th 73, 79 (2d Cir. 2025) (disputes are part of the same “case or controversy” under Section 1367 when they arise from a “common nucleus of operative fact’). The supplemental jurisdiction statute provides several exceptions, permitting district courts, at their discretion, to “decline to exercise supplemental jurisdiction over a claim,” including where “the claim substantially predominates over the claim or claims over which the district court has original jurisdiction.” 28 U.S.C. § 1367(c)(2), The Supreme Court has held that supplemental jurisdiction “need not be exercised in every case in which it is found to exist” since it “is a doctrine of discretion, not of plaintiff's right.” United Mine Workers v. Gibbs, 383 US. 715, 726 (1966). Supplemental claims can be said to predominate “in terms of proof, of the scope of the issues raised, or of the comprehensiveness of the remedy sought.” /d.; see also OccuNomix Int'l LLC y, North Ocean Ventures, Inc., 03 Civ, 6047 (GEL), 2003 U.S. Dist. LEXIS 17085, at *3-4 (S.D.N.Y. Sept. 26, 2003) (declining to exercise jurisdiction over supplemental claims when they constituted the bulk of the causes of action in the suit), In addition, “where at least one of the subsection 1367(c) factors is applicable, a district court should not decline to exercise supplemental jurisdiction unless it also determines that doing so would not promote the values [of]... economy, convenience, fairness, and comity.” Jones v. Ford Motor Credit Co., 358 F.3d 205, 214 (2d Cir, 2004). Here, I find that Bohnak’s claims in the Amended Complaint substantially predominate over Jones’ sole remaining cause of action. In light of my rulings above, Bohnak’s claims would be more expansive in scope than that of Jones’ and the putative class she seeks to represent. And Bohnak’s claims also would be subject to a separate choice of law analysis, since

1]

Bohnak is not a resident of Iowa, Whereas Jones’ claim, as class representative, would proceed in tandem with the rest of the putative class (if certified), Bohnak’s claims would need to be treated individually, and would substantially predominate this litigation. Moreover, exercising supplemental jurisdiction over Bohnak’s claims would not promote the values of judicial economy, convenience, fairness and comity. Instead, doing so would force this action to proceed on two tracks, require a separate analysis of choice of law considerations, and deprive Defendants of the benefit of the bargain of the enhanced severance package they afforded Bohnak in exchange for the waiver of her right to participate in a class action suit against them, Accordingly, I decline, within my discretion, to exercise supplemental jurisdiction over Bohnak’s claims. CONCLUSION Based on the foregoing, I dismiss Counts I, II, and II of the Amended Complaint, and I dismiss Bohnak as an individual plaintiff from this action, but | deny Defendants’ motion to dismiss Count IV of the complaint.® Within five (5) days from the entry of this Opinion and Order, Jones shall file a Second Amended Complaint (“SAC”) consistent with this Opinion and Order. Within fourteen (14) days from the filing of Jones’ SAC, Defendants shall file their answer to the SAC, See Fed. R. Civ. P. 12(a)(4)(A). The parties shall appear for a telephonic status conference on Friday, July 11, 2025, at 10:00 a.m. A scheduling order will issue providing dial-in information and further details.

6 To be sure, my dismissal of Bohnak’s individual claims (Counts I and IIT) is “without prejudice and left for resolution to state tribunals.” Gibbs, 383 U.S. at 726-27, 12

The Clerk of Court shall terminate ECF No. 94.

SO ORDERED. . Dated: , 2025 LL ow oir nro New York, New York (/ ALVIN K, HELLERSTEIN United States District Judge