Perlaki v. J.B. Poindexter & Co, Inc.

Opinion

UNITED STATES DISTRICT COURT March 10, 2025 SOUTHERN DISTRICT OF TEXAS Nathan Ochsner, Clerk HOUSTON DIVISION THOMAS PERLAKI, § § Plaintiff. § § V. § CIVIL ACTION NO. 4:24-cv-01649 § J.B. POINDEXTER & CO., INC., § § Defendant. §

MEMORANDUM AND RECOMMENDATION This case arises out of a criminal cyberattack that targeted employees’ personal data stored by their employer Defendant J.B. Poindexter & Co. Plaintiff Thomas Perlaki, a former employee of J.B. Poindexter, is one of many employees whose information was exposed in the data breach. Perlaki claims to have suffered damages caused by the theft of his personal identifiable information (“PII”). Pending before me is J.B. Poindexter’s Motion to Dismiss. See Dkt. 21. J.B. Poindexter argues that Perlaki lacks standing to bring his claims and that, even if he has standing, Perlaki fails to properly state a claim upon which relief can be granted. Having reviewed the briefing, the record, and the applicable law, I recommend the motion be denied as to Perlaki’s standing, but granted in all other respects and this case dismissed. BACKGROUND On April 4, 2024, J.B. Poindexter learned that cybercriminals had attacked and accessed information stored on its computer network. Four days later, J.B. Poindexter notified all potentially affected individuals of the data breach. The perpetrators of the data breach allegedly accessed and stole the PII of current and former employees, and their dependents. The PII stored by J.B. Poindexter and potentially accessed by cybercriminals includes contact information, social security numbers, dates of birth, and driver’s license numbers. Perlaki filed a Class Action Complaint against J.B. Poindexter on May 1, 2024. The operative pleading is the Amended Class Action Complaint. See Dkt. 20. Perlaki alleges that damages caused by the data breach include “a spike in spam and scam text messages and emails containing suspicious links”; fraudulent attempts to use his credit card; lost time spent monitoring his financial accounts; anxiety, sleep disruption, stress, fear, and frustration; a loss in the value of his PII; the anticipation of future expenses spent to mitigate his injuries; and an “increased risk of fraud, misuse, and identity theft.” Id. at 9, 11. Perlaki alleges the data breach is J.B. Poindexter’s second data breach in several years and could have been avoided if J.B. Poindexter had taken adequate measures to protect its employees’ PII. Perlaki asserts claims against J.B. Poindexter for (1) negligence, (2) breach of implied contract, (3) invasion of privacy, (4) unjust enrichment, and (5) breach of fiduciary duty.1 J.B. Poindexter has filed a motion to dismiss, arguing that (1) this case should be dismissed pursuant to Federal Rule of Civil Procedure 12(b)(1) because Perlaki lacks Article III standing; and (2) even if Perlaki has standing, his causes of action should all be dismissed pursuant to Rule 12(b)(6) for failure to state a claim. I begin by addressing the jurisdictional issues. RULE 12(b)(1) MOTION TO DISMISS A. LEGAL STANDARD Rule 12(b)(1) allows a party to challenge the subject matter jurisdiction of the district court to hear a case. See FED. R. CIV. P. 12(b)(1). A claim is properly dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when “the court lacks the statutory or constitutional power to adjudicate the claim.” In re FEMA Trailer Formaldehyde Prods. Liab. Litig. (Miss. Plaintiffs), 668 F.3d 281,

1 Perlaki also purports to assert a claim for negligence per se. “Negligence per se is not a separate cause of action that exists independently of a common-law negligence cause of action. . . . Rather, negligence per se is merely one method of proving a breach of duty, a requisite element of any negligence cause of action.” Thomas v. Uzoka, 290 S.W.3d 437, 445 (Tex. App.—Houston [14th Dist.] 2009, pet. denied). 286 (5th Cir. 2012) (cleaned up). In evaluating a Rule 12(b)(1) motion, I accept all well-pleaded factual allegations in the complaint as true, viewing them in the light most favorable to the plaintiff. See Daniel v. Univ. of Tex. Sw. Med. Ctr., 960 F.3d 253, 256 (5th Cir. 2020). “Ultimately, a motion to dismiss for lack of subject matter jurisdiction should be granted only if it appears certain that the plaintiff cannot prove any set of facts in support of his claim that would entitle plaintiff to relief.” Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001). District courts may dismiss a claim for lack of subject matter jurisdiction upon consideration of: “(1) the complaint alone; (2) the complaint supplemented by undisputed facts evidenced in the record; or (3) the complaint supplemented by undisputed facts plus the court’s resolution of disputed facts.” Spotts v. United States, 613 F.3d 559, 566 (5th Cir. 2010) (quotation omitted). Where, as here, “a Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the court should consider the Rule 12(b)(1) jurisdictional attack before addressing any attack on the merits.” Ramming, 281 F.3d at 161. Standing is a jurisdictional question that concerns “the power of the court to entertain the suit.” Warth v. Seldin, 422 U.S. 490, 498 (1975). Article III of the United States Constitution limits the power of federal courts to the resolution of “Cases” or “Controversies.” U.S. CONST. art. III, § 2. The requirement that a plaintiff establish standing to bring suit “is an essential and unchanging part of the case-or-controversy requirement of Article III.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Every plaintiff in federal court must meet the “irreducible constitutional minimum” of Article III standing, which requires that the plaintiff’s injury be: (1) concrete, particularized, and actual or imminent; (2) fairly traceable to the defendant’s challenged action; and (3) likely redressable by a favorable ruling. Id. at 560–61; see also Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149 (2010). The party asserting federal jurisdiction bears the burden of demonstrating that standing exists. See TransUnion LLC v. Ramirez, 594 U.S. 413, 430–31 (2021). In TransUnion, a recent case regarding the dissemination of misleading credit reports, the United States Supreme Court addressed the requirement that a “plaintiff’s injury in fact be concrete—that is real, and not abstract.” Id. at 424. A class of 8,185 individuals sued TransUnion, a credit reporting agency, for failure to use reasonable procedures to ensure the accuracy of their credit files. See id. at 417. For 1,853 of the class members, TransUnion provided misleading credit reports to third parties, labeling the individuals as “potential terrorists, drug traffickers, or serious criminals.” Id. at 432. The Supreme Court explained that to satisfy the concrete harm requirement “the asserted harm [must bear] a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as physical harm, monetary harm, or various intangible harms.” Id. at 417. Because the 1,853 class members misleadingly labeled terrorists and criminals “suffered a harm with a ‘close relationship’ to the harm associated with the tort of defamation,” the high court held that they “suffered a concrete harm that qualifies as an injury in fact.” Id. at 432. The remaining 6,332 class members, however, did not demonstrate a concrete harm. Although their credit files contained misleading information, their credit files were not provided to third parties and they were not denied lines of credit. See id. at 437. Instead, the remaining class members asserted that they suffered a concrete injury because they faced “a material risk that the information would be disseminated in the future to third parties and thereby cause them harm.” Id. at 435. The Supreme Court held that such risk of future harm does not represent a concrete harm and is “too speculative” to support standing. Id. at 438. Neither the Supreme Court nor the Fifth Circuit has had the opportunity to explore standing issues in the context of a data breach. The Fifth Circuit has reiterated, however, that “[a] plaintiff always must be able to point to a concrete injury to bring suit. And if a risk hasn’t materialized, the plaintiff hasn’t yet been injured.’” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 824 (5th Cir. 2022). Furthermore, a plaintiff “must demonstrate standing for each claim that they press and for each form of relief that the seek.” Id. at 821 (quoting TransUnion, 594 U.S. at 431). Although Perez is not a data breach case, its standing analysis is relevant to this matter. Additionally, there are several district court cases within the Fifth Circuit that have explored standing issues in data breach cases after TransUnion. I will address relevant portions of those cases in my analysis below. B. ANALYSIS Perlaki claims he has standing to sue J.B. Poindexter for a variety of reasons: (1) he faces an increased risk of identity theft and fraud; (2) he spent time and efforts to mitigate the risk of harm; (3) he suffered a diminution in value of his PII; and (4) he has a genuine concern about his personal financial security. I will examine these allegations one-by-one. 1. Heightened Risk of Identity Theft and Fraud Is Not a Concrete Injury Perlaki alleges that he suffers “imminent and impending injury arising from the substantially increased risk of fraud, misuse, and identity theft . . . because Defendant’s Data Breach placed Plaintiff’s PII right in the hands of criminals.” Dkt. 20 at 11. Yet, Perlaki provides no factual allegations to suggest that his information is actually in criminal hands. Perlaki does not allege that his PII has been sold on the dark web or to a criminal enterprise; nor does Perlaki allege that any of his PII has actually been misused. Instead, he alleges that his PII may be misused in the future. “Unless and until these conjectures come true, [Perlaki’s] alleged future injuries are speculative—even hypothetical—but certainly not imminent.” Peters v. St. Joseph Servs. Corp., 74 F. Supp. 3d 847, 854 (S.D. Tex. 2015). As the Fifth Circuit held, “if a risk hasn’t materialized, the plaintiff hasn’t yet been injured.” Perez, 45 F.4th at 824; see also Williams v. Bienville Orthopaedic Specialists, LLC, No. 1:23CV232-LG-MTP, 2024 WL 3387169, at *5 (S.D. Miss. June 18, 2024) (“[Plaintiffs] have not alleged an injury-in-fact because they have not alleged misuse or actual access of their private information.”); Logan v. Marke[r] Group, Inc., No. 4:22-CV-174, 2024 WL 3489208, at *4 (S.D. Tex. July 18, 2024) (noting that the theory of heightened risk []has been rejected by courts in the Fifth Circuit on several occasions). Here, absent any evidence of actual or imminent misuse, the risk to [Perlaki] has not materialized. Under Fifth Circuit precedent, the heightened risk of identity theft and fraud does not suffice for an Article III injury. In re ESO Sols., Inc. Breach Litig., No. 1:23-cv-1557, 2024 WL 4456703, at *5 (W.D. Tex. July 30, 2024). Because “a risk of injury does not qualify as concrete harm for purposes of a damages claim,” Perlaki lacks standing to pursue a claim for damages arising from the hypothetical heightened future risk of identity theft or fraud. Perez, 45 F.4th at 827. In addition to his claim of an increased risk of identity theft or fraud, Perlaki alleges he “suffered from a spike in spam and scam text messages and emails containing suspicious links” after the data breach. Dkt. 20 at 9. “Spam calls, texts, and e-mails have become very common in this digitized world, and a number of courts have declined to confer standing when considering an increase in spam communications.” McCombs v. Delta Grp. Elecs., Inc., 676 F. Supp. 3d 1064, 1074 (D.N.M. 2023) (collecting cases). Accordingly, spam is not a concrete harm. Perlaki further alleges that he had been “notified of fraudulent attempts to make purchases at a Walmart store using [his] Capital One credit card.” Dkt. 20 at 10. Notably, however, Perlaki does not allege that J.B. Poindexter stored his credit card information. Even considering Perlaki’s receipt of spam and a fraudulent credit card attempt as a concrete harm, Perlaki does not allege that the spam and fraud are fairly traceable to J.B. Poindexter’s data breach. Traceability means the injury was caused by the “challenged action of the defendant” as opposed to an “independent action of” a third party. Lujan, 504 U.S. at 560 (quotation omitted). Most people have experienced attempted fraudulent credit card usage, and even more people receive spam calls, texts, and emails daily. Because Perlaki’s phone number and email address could have been accessed elsewhere, and because his credit card information has not been alleged to be in J.B. Poindexter’s possession, Perlaki fails to show that his alleged harm is traceable to J.B. Poindexter’s data breach. Even if Perlaki could demonstrate traceability, it is unlikely that a favorable decision would redress the alleged harm he has experienced. See Peters, 74 F. Supp. 3d at 857. Thus, Perlaki does not have standing to seek damages for the heightened risk of identity theft and fraud. 2. Lost Time and Possible Future Expenses Are Not Concrete Injuries Perlaki also claims damages for lost “time and effort [he spent] monitoring his accounts to protect himself from identity theft” after the data breach. Dkt. 20 at 9. J.B. Poindexter argues that time spent mitigating a potential risk of fraud or identity theft does not create standing. See Dkt. 21 at 8. I agree. The Fifth Circuit has stated that it is “not aware of any tort that makes a person liable for wasting another’s time.” Perez, 45 F.4th at 825. To establish standing, Perlaki’s lost time claim must bear a close relationship to some cognizable harm. Like the plaintiff in Perez, Perlaki “doesn’t offer a common-law analog to the time-based injury [he] claims to have suffered.” Id. Thus, he “has not met [his] burden to demonstrate that [he] has standing based on that theory.” Id. (cleaned up). “While the heightened risk of a data breach does not confer standing, dicta from the Fifth Circuit suggests that mitigation efforts may show a concrete injury,” but only if the plaintiff properly alleges such harm. In re ESO Solutions, 2024 WL 4456703, at *5 (citing Perez, 45 F.4th at 822). In the Amended Class Action Complaint, Perlaki alleges that he “anticipates spending considerable amounts of time and money to try and mitigate his injuries.” Dkt. 20 at 11 (emphasis added). Importantly, Perlaki fails to allege that he has actually incurred any mitigation expenses to date. While Perlaki may, in the future, spend money mitigating harms from the data breach, this is plainly insufficient to confer standing at the present time. Because Perlaki does not allege that he has incurred any sums on mitigation efforts, he has not alleged a concrete injury. In sum, lost time is not a concrete injury, and Perlaki fails to allege that he has actually spent any money on mitigation efforts. Accordingly, Perlaki does not have standing to seek damages for lost time and future mitigation expenses. 3. Diminished Value of PII Is Not a Concrete Injury Perlaki alleges that he “suffered actual injury in the form of damages to and diminution in the value of his PII” because “PII is a form of intangible property.” Dkt. 20 at 11. In response, J.B. Poindexter insists that the alleged diminution in value of Perlaki’s PII is not a concrete harm. J.B. Poindexter argues that Perlaki fails to allege the value of his PII prior to and after the data breach, and also fails to allege that his PII has been published or sold after the data breach. “District courts nationwide are split on whether diminution of PII constitutes a concrete injury.” In re ESO Solutions, 2024 WL 4456703, at *6. Many cases holding that diminution in value of PII is sufficiently concrete “involved circumstances where the defendants collected information that was itself monetized and used for commercial purposes.” In re Am. Med. Collection Agency, Inc. Consumer Data Sec. Breach Litig., No. 2:19-cv-2904, 2021 WL 5937742, at *10 (D.N.J. Dec. 16, 2021). “However, district courts in Texas have been more skeptical, with at least three dismissing similar ‘loss-of-value’ claims.” In re ESO Solutions, 2024 WL 4456703, at *6 (citing Ellis v. Cargill Meat Sols., No. 4:22-cv- 864, 2023 WL 9547632 (N.D. Tex. Oct. 31, 2023); Logan, 2024 WL 3489208, at *7; Williams, 2024 WL 3387169, at *6). Even if diminished PII was cognizable in the Fifth Circuit, [Perlaki does] not plausibly show [his] PII has diminished in value. [Perlaki] fail[s] to allege that [he] attempted to or would have ever sold [his] PII. Nor [does Perlaki] allege that if [he] now attempted to sell [his] PII, [he] would be forced to accept a diminished price for it. Most problematically, [Perlaki] fail[s] to plausibly show that [his] information is (or was) being actively distributed on the dark web or any other marketplace for private information. The PII was stolen from [J.B. Poindexter], but [Perlaki] has not plausibly alleged it has been distributed any further. Until [Perlaki] plausibly allege[s] the actual distribution of [his] information, [he] cannot viably claim that [his] PII has diminished in value. In re ESO Sols., 2024 WL 4456703, at *7 (cleaned up). “District courts have been reluctant to find standing based solely on a theory that the value of a plaintiff’s personal information has been diminished.” Logan, 2024 WL 3489208, at *7 (cleaned up). Even assuming “that personal information has an inherent value and the deprivation of such value is an injury sufficient to confer standing, [Perlaki] has failed to allege facts indicating how the value of his personal information has decreased as a result of the Data Breach.” Green v. eBay Inc., No. 14-1688, 2015 WL 2066531, at *5 n.59 (E.D. La. May 4, 2015). Because Perlaki does not provide any factual support for the claim that his PII has diminished in value, he does not have standing to seek damages for the diminution in value of his PII. 4. Perlaki’s Concern About His Personal Financial Security Is a Concrete Injury Perlaki alleges that he “fears for his personal financial security and worries about what information was exposed in the Data Breach.” Dkt. 20 at 10. Specifically, Perlaki claims the data breach has caused him to suffer from “anxiety, sleep disruption, stress, fear, and frustration.” Id. In TransUnion, the Supreme Court found that class members who were merely put at risk of suffering some future harm lacked standing. See 594 U.S. at 439. The Court implied, however, that if the class members whose information had not been misused had alleged “that they suffered some other injury (such as an emotional injury) from the mere risk” of harm, they may have had standing to pursue their claims. Id. at 437. The Court recognized that “a plaintiff’s knowledge that he or she is exposed to a risk of future physical, monetary, or reputational harm could cause its own current emotional or psychological harm,” but did not reach the issue because no such harms were alleged. Id. at 436 n.7. Regardless, the Fifth Circuit has held that “emotional harm satisfies the ‘injury in fact’ requirement of constitutional standing.” Rideau v. Keller Indep. Sch. Dist., 819 F.3d 155, 169 (5th Cir. 2016); see also Perez, 45 F.4th at 824 (“A plaintiff can sue for damages if the risk materializes or causes a separate injury-in-fact, such as emotional distress.”); Smith v. Am. Pain & Wellness, PLLC, No. 4:23-cv-295, 2024 WL 4028050, at *7 (E.D. Tex. Sept. 3, 2024) (“[I]f the plaintiff’s knowledge of the substantial risk of identity theft causes the plaintiff to presently experience emotion distress . . . , the plaintiff has alleged a sufficiently concrete injury.” (quotation omitted)). Thus, Perlaki may pursue damages for the emotional distress he alleges due to fear for his financial security as a result of the data breach. * * * Because I find that Perlaki has standing to pursue damages for emotional distress, I recommend that J.B. Poindexter’s Rule 12(b)(1) motion be denied. I now turn to J.B. Poindexter’s argument that, even if Perlaki has standing, he nonetheless fails to state a claim upon which relief can be granted. For the reasons discussed below, I agree. RULE 12(b)(6) MOTION TO DISMISS A. LEGAL STANDARD Rule 12(b)(6) allows dismissal if a plaintiff fails “to state a claim upon which relief can be granted.” FED. R. CIV. P. 12(b)(6). To avoid dismissal under Rule 12(b)(6), “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). These factual allegations need not be detailed but “must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555. “Determining whether a complaint states a plausible claim for relief [is] . . . a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. “[A] complaint must do more than name laws that may have been violated by the defendant; it must also allege facts regarding what conduct violated those laws.” Anderson v. U.S. Dep’t of Hous. & Urban Dev., 554 F.3d 525, 528 (5th Cir. 2008). In analyzing a Rule 12(b)(6) motion, I “accept all well-pleaded facts as true, drawing all reasonable inferences in the nonmoving party’s favor.” Benfield v. Magee, 945 F.3d 333, 336 (5th Cir. 2019). B. ANALYSIS J.B. Poindexter argues that Perlaki fails to state any claim for relief. I will address each of Perlaki’s claims in turn below. 1. Perlaki Cannot Pursue a Negligence Claim with Only Emotional Distress Damages Negligence is the failure to use ordinary or due care—the failure to act as a reasonably prudent person would have acted under the same or similar circumstances. See 20801, Inc. v. Parker, 249 S.W.3d 392, 398 (Tex. 2008). I will assume, for the sake of argument, that Perlaki adequately alleges the elements of a negligence claim. Even so, as J.B. Poindexter points out, a “negligence claim cannot survive solely on allegations of emotional distress.” Dkt. 21 at 19. “Texas does not recognize a general legal duty to avoid negligently inflicting mental anguish.” City of Tyler v. Likes, 962 S.W.2d 489, 494 (Tex. 1997). “There are few situations in which a claimant who is not physically injured by the defendant’s breach of duty may recover mental anguish damages.” Temple-Inland Forest Prods. Corp. v. Carter, 993 S.W.2d 88, 91 (Tex. 1999) (quotation omitted). A plaintiff may recover such damages only when: (1) the defendant acted with intent or malice; (2) a special relationship exists between the two parties; or (3) “the defendant’s negligence causes a mental shock which produces a serious bodily injury.” City of Tyler v. Likes, 962 S.W.2d 489, 495 (Tex. 1997). Here, Perlaki cannot satisfy any of these three conditions. First, Perlaki does not allege that J.B. Poindexter acted with intent or malice. Second, “[a]n employment relationship governed by the at-will doctrine does not give rise to a special relationship.” Quintanilla v. K-Bin, Inc., 993 F. Supp. 560, 563 (S.D. Tex. 1998). Third, Perlaki does not claim he has suffered a bodily injury. Thus, Perlaki’s emotional distress damages cannot support his negligence claim. I recommend that Perlaki’s negligence claim against J.B. Poindexter be dismissed. 2. Perlaki Cannot Pursue Breach of Implied Contract Claim with Only Emotional Distress Damages Perlaki alleges that he provided his PII to J.B. Poindexter as a condition of his employment and believed that a portion of the funds derived from his employment would be used to pay for cybersecurity measures to protect his PII. Perlaki alleges there was an implied promise by J.B. Poindexter to protect and not disclose his PII to unauthorized persons, as evidenced by J.B. Poindexter’s privacy policy. Perlaki claims that J.B. Poindexter breached that implied contract by failing to: (1) safeguard his PII, (2) notify him promptly of the data breach, (3) comply with industry standards, (4) comply with legal obligations enumerated in agreements between the parties, and (5) ensure the confidentiality and integrity of his PII. In response, J.B. Poindexter argues that Perlaki offers no factual support evincing a meeting of the minds between the parties to support the finding of an implied contract. I will assume, without deciding, that Perlaki states a breach of implied contract claim. Even so, it is well settled law in Texas that a “breach of contract claim is barred as a matter of law [where] the damages pleaded by [the plaintiff] are only for mental anguish which are not recoverable in a breach of contract case.” Delgado v. Methodist Hosp., 936 S.W.2d 479, 484 (Tex. App.—Houston [14th Dist.] 1996, no writ); see also Stewart Title Guar. Co. v. Aiello, 941 S.W.2d 68, 72 (Tex. 1997) (“[A] breach of contract action will not support mental anguish damages.”); Bus. Staffing, Inc. v. Jackson Hot Oil Serv., 401 S.W.3d 224, 244 (Tex. App.—El Paso 2012, pet. denied) (“For breach of contract, a party could recover economic damages and attorney’s fees, but not mental anguish or exemplary damages.”); In re Antone’s Recs., Inc., 445 B.R. 758, 789 (Bankr. W.D. Tex. 2011) (“Damages for mental anguish and exemplary damages are not available in a breach of contract case.”). “Certain ‘special relationships,’ including a very limited number of contracts dealing with intensely emotional noncommercial subjects such as preparing a corpse for burial, may give rise to a legal duty to avoid causing mental anguish. [Perlaki does] not contend that any such duty existed here.” Jones v. Pesak Bros. Const., Inc., 416 S.W.3d 618, 631 n.4 (Tex. App.—Houston [1st Dist.] 2013, no pet.) (cleaned up). Accordingly, I recommend that Perlaki’s breach of implied contract claim be dismissed because, as with his negligence claim, Perlaki has no cognizable damages to support such a claim. Although J.B. Poindexter raised the fact that emotional distress damages alone are not a compensable injury for a negligence claim under Texas law, it failed to raise the same argument in regard to Perlaki’s breach of implied contract claim. Even so, the law is the law. At some point in this litigation, the court will be forced to dismiss Perlaki’s breach of implied contract claim because his only damages are unrecoverable emotional distress damages. The Fifth Circuit has held that “[a] district court may dismiss sua sponte a complaint for failure to state a claim as long as the procedure employed is fair.” Anokwuru v. City of Houston, 990 F.3d 956, 967 (5th Cir. 2021). So, I will save the parties some time by raising this issue myself. This Memorandum and Recommendation serves as sufficient notice, and Perlaki has the opportunity to be heard by filing objections to this Memorandum and Recommendation. 3. Perlaki Fails to Allege an Invasion of Privacy Claim Perlaki pleads that J.B. Poindexter “owed a duty to its current and former employees” to protect and keep confidential their PII, and the data breach “constitutes an intentional interference with [his] . . . interest in solitude or seclusion.” Dkt. 20 at 26, 27. Perlaki alleges that he had a legitimate expectation of privacy regarding his PII, and that J.B. Poindexter breached its duty by “permit[ing] the Data Breach” and knowingly “fail[ing] to notify [Perlaki] . . . in a timely fashion about the Data Breach.” Id. at 27. A person commits the tort of intrusion upon seclusion—colloquially known as “invasion of privacy”—by “intentionally intrud[ing], physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.” RESTATEMENT (SECOND) OF TORTS § 652B. “Texas courts have held that intrusion upon private affairs typically requires either a trespass or an attempt to discover or perceive private information.” Amin v. United Parcel Serv., Inc., 66 F.4th 568, 577 (5th Cir. 2023). “The Texas Supreme Court defines the invasion of privacy as an intentional tort.” Hays v. Frost & Sullivan, Inc., SA-23-cv-1490, 2024 WL 4052741, at *11 (W.D. Tex. Aug. 16, 2024). J.B. Poindexter argues that Perlaki “voluntarily gave personal information to J.B. Poindexter in the regular course of his employment.” Dkt. 21 at 16. Because Perlaki “voluntarily gave his information to [J.B. Poindexter], he cannot now allege that [J.B. Poindexter] intruded on his solitude. When confronted with invasion-of- privacy claims in the data breach context, courts have similarly noted that a plaintiff’s voluntary disclosure of their personal information dooms their claim.” Logan, 2024 WL 3489208, at *9 (quotation omitted). Although Perlaki alleges J.B. Poindexter acted intentionally in failing to keep his PII confidential and preventing “[t]he unauthorized acquisition (i.e., theft) by a third party of” his PII, Dkt. 20 at 27, Perlaki fails to allege facts showing J.B. Poindexter willfully intruded upon Perlaki’s solitude. “[I]nvasion of privacy is an intentional tort, [thus] a theory based on negligent failure to safeguard and protect personal information is insufficient to state a claim for invasion of privacy.” Logan, 2024 WL 3489208, at *9 (quotation omitted). Perlaki states, in a conclusory manner, that J.B. Poindexter “acted with a knowing state of mind when it permitted the Data Breach because it knew its information security practices were inadequate.” Dkt. 20 at 27. Such an allegation is insufficient to show J.B. Poindexter intentionally permitted access to or disseminated Perlaki’s PII to third parties. Because Perlaki fails to allege that J.B. Poindexter acted with intent, I recommend his invasion of privacy claim be dismissed. 4. Perlaki Fails to Allege an Unjust Enrichment Claim Perlaki alleges that he “conferred a benefit upon” J.B. Poindexter by providing his PII to J.B. Poindexter to “facilitate employment” and by allowing J.B. Poindexter to use his labor to “derive profit.” Dkt. 20 at 28. “Under Texas law an unjust enrichment claim requires showing that one party has obtained a benefit from another by fraud, duress, or the taking of an undue advantage.” Digital Drilling Data Sys., L.L.C. v. Petrolink Servs., Inc., 965 F.3d 365, 379 (5th Cir. 2020) (quotation omitted). Perlaki does not plead that J.B. Poindexter acquired his PII by fraud or duress, but instead argues that J.B. Poindexter has taken some undue advantage by requiring employees’ personal information and failing to subsequently secure that data. Perlaki argues that J.B. Poindexter “enriched itself by saving the costs they reasonably should have expended on data security measures” and instead “utilize[ed] cheaper, ineffective security measures” at Perlaki’s expense. Dkt. 20 at 29. “Several courts across the country have allowed unjust enrichment claims to survive at the Rule 12 stage in the data-breach context . . . [where] the plaintiffs allege that their data was given to the defendant along with something else of value—usually money.” Logan, 2024 WL 3489208, at *10. Perlaki argues that he agreed to engage in an employment relationship with J.B. Poindexter with the expectation that J.B. Poindexter would take precautions and spend necessary expenses on data security. Maybe so, but Perlaki agreed to engage in an employment relationship with J.B. Poindexter with the expectation that J.B. Poindexter would pay Perlaki for his labor. Perlaki makes no allegation that J.B. Poindexter has failed to adequately pay him, nor does Perlaki otherwise allege “something of value” he gave to J.B. Poindexter in return for safeguarding his data. “[T]he only thing [Perlaki] gave to [J.B. Poindexter] was his personal information” and “nothing else to serve as consideration for the safe keeping of such information.” Logan, 2024 WL 3489208, at *11. Because Perlaki has not alleged that he conferred a benefit on J.B. Poindexter for which he was not compensated, he fails to allege a claim for unjust enrichment. Thus, I recommend Perlaki’s unjust enrichment claim be dismissed. 5. Perlaki Fails to Allege a Breach of Fiduciary Duty Claim Perlaki alleges that “given the relationship between” the parties, J.B. Poindexter “became a fiduciary by its undertaking and guardianship of the PII” and is responsible for safeguarding his PII, timely notifying Perlaki of a data breach, and maintaining his PII. Dkt. 20 at 30. Perlaki argues that J.B. Poindexter breached its fiduciary duty “by failing to sufficiently encrypt or otherwise protect” his PII and “by failing to diligently discover, investigate, and give notice of the Data Breach in a reasonable” time. Id. J.B. Poindexter moves to dismiss Perlaki’s breach of fiduciary duty claim on the ground that Perlaki has failed to allege sufficient facts to demonstrate that a fiduciary relationship existed between the parties. I agree. To succeed on a breach of fiduciary duty claim, Texas law requires “(1) a fiduciary relationship between the plaintiff and defendant, (2) a breach by the defendant of his fiduciary duty to the plaintiff, and (3) an injury to the plaintiff or benefit to the defendant as a result of the defendant’s breach.” Lundy v. Masson, 260 S.W.3d 482, 501 (Tex. App.—Houston [14th Dist.] 2008, pet. denied.). There are two types of fiduciary relationships: (1) a “formal” relationship in which a duty arises as a matter of law (such as attorney-client, principal-agent, trustee- beneficiary, or between partners in a partnership); and (2) an “informal” relationship arising from a moral, social, domestic, or personal relationship called a “confidential” relationship. Id. at 502. It is well settled that “[i]n Texas, employers generally do not owe fiduciary duties to their employees.” Meadows v. Hartford Life Ins. Co., 492 F.3d 634, 640 (5th Cir. 2007). Thus, fiduciary duty claims based on an employer-employee relationship are often dismissed. See, e.g., Garcia v. Cmtys. in Schs. of Brazoria Cnty, Inc., No. H-18-4558, 2019 WL 2420079, at *11 (S.D. Tex. June 10, 2019) (“Texas law does not recognize a fiduciary duty or a duty of good faith and fair dealing owed by an employer to an employee.”); Arizmendi v. ORC Indus., No. B- 06-125, 2007 WL 1231464, at *1 (S.D. Tex. Apr. 26, 2007) (dismissing employee’s claim because “Texas does not recognize a fiduciary duty or a duty of good faith and fair dealing owed by an employer to an employee” (quotation omitted)). While there is no formal fiduciary duty between an employer and an employee, there still may be an informal fiduciary relationship, characterized by a close personal relationship of trust and confidence between the parties. See Bombardier Aerospace Corp. v. SPEP Aircraft Holdings, LLC, 572 S.W.3d 213, 220 (Tex. 2019) (noting that an informal fiduciary relationship may be formed “from a moral, social, domestic or purely personal relationship of trust and confidence” (quotation omitted)). In Hays, a data breach case regarding an employee-employer relationship, the court analyzed whether there was a “special relationship of trust and confidence” between an employer and employee sufficient to “impose an informal fiduciary duty.” 2024 WL 4052741, at *10. The court held that in order to find an informal fiduciary duty, the parties must have engaged in some “business transaction,” but the plaintiff had “not pleaded any such special relationship.” Id. Similarly, Perlaki has not alleged any special relationship here. “A fiduciary relationship is an extraordinary one and will not be lightly created; the mere fact that one subjectively trusts another does not alone indicate that confidence is placed in another in the sense demanded by fiduciary relationships.” Hoggett v. Brown, 971 S.W.2d 472, 488 (Tex. App.—Houston [14th Dist.] 1997, writ denied). The Amended Class Action Complaint is completely devoid of allegations indicating that a fiduciary relationship existed between the parties. Even viewed in the light most favorable to Perlaki, the relationship between Perlaki and J.B. Poindexter is nothing more than that of employer and employee—a relationship that does not give rise to a fiduciary duty. Accordingly, I recommend Perlaki’s breach of fiduciary duty claim be dismissed. CONCLUSION Perlaki’s only cognizable injury is for his alleged emotional damages caused by the data breach. Those emotional damages are not recoverable in negligence or contract, so Perlaki’s negligence and breach of implied contract claims should be dismissed. Likewise, Perlaki’s claims for invasion of privacy, breach of fiduciary duty, and unjust enrichment should be dismissed for failure to state a claim. Because there are no claims remaining, I recommend the case be dismissed. The parties have 14 days from service of this Memorandum and Recommendation to file written objections. See 28 U.S.C. § 636(b)(1)(C); FED. R. CIV. P. 72(b)(2). Failure to file timely objections will preclude appellate review of factual findings and legal conclusions, except for plain error. SIGNED this 10th day of March 2025.

______________________________ ANDREW M. EDISON UNITED STATES MAGISTRATE JUDGE