Archey v. Osmose Utilities Services, Inc.

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION BENNIE ARCHEY, Plaintiff, v. No. 20-cv-05247 Judge Franklin U. Valderrama OSMOSE UTILITIES SERVICES, INC., Defendant. MEMORANDUM OPINION AND ORDER Plaintiff Bennie Archey (Archey) worked for Defendant Osmose Utilities Services, Inc. (Osmose) until Osmose terminated him, shortly after Archey sustained a work related injury. Several years following Archey’s termination, Osmose experienced a cyberattack that compromised Archey’s personal information stored in Osmose’s computer systems. Archey filed suit against Osmose, asserting a retaliatory discharge claim under the Illinois Workers’ Compensation Act (IWCA), 820 ILCS 305/1, et seq. (Count I); a claim for breach of an implied contract under Illinois law (Count II); and a claim for a violation of the Illinois Consumer Fraud and Deceptive Business Practices Act (ICFA), 815 ILCS 505/1, et seq. (Count III). R. 53, Second Amended Complaint (SAC).1 Osmose moves to dismiss Counts II and III of the SAC pursuant to Federal Rule of Civil Procedure 12(b)(6). R. 55, Mot. Dismiss. at 1. For the reasons that follow, the Court grants Osmose’s motion. 1Citations to the docket are indicated by “R.” followed by the docket number or filing name, and where necessary, a page or paragraph citation. Background Osmose hired Archey in approximately July 2016. SAC ¶¶ 8–9.2 As part of Archey’s employment, Osmose collected Archey’s personal information, including Archey’s name, social security number, and direct deposit bank account and routing numbers. Id. ¶¶ 10, 31. While on the job in March 2017, Archey sustained an elbow injury. Id. ¶ 12. Osmose fired Archey one month later. Id. ¶¶ 24–25. In July 2020, Osmose suffered a cyberattack against its computer systems containing the personal information of current and former employees. Id. ¶¶ 29–31. Osmose launched an investigation into the cyberattack and on August 21, 2020, determined that the cyberattack had exposed Archey’s personal information to an unauthorized third party. Id. ¶ 31. On September 2, 2020, Osmose mailed Archey a letter notifying him of the cyberattack and investigation. Id. ¶¶ 30–31. Archey subsequently filed a multi-count complaint against Osmose alleging breach of an implied contract and violations of the IWCA and ICFA. R. 1. Archey has since amended his original complaint twice. Archey’s first amended complaint (FAC), was dismissed because Archey failed to allege actual damages for his breach of contract and ICFA claims. R. 52, Opinion. In the SAC, Archey again alleges a violation of the IWCA (Count I), breach of an implied-in-fact contract (Count II), and violation of the ICFA (Count III). Id. Osmose’s motion to dismiss Counts II and III of the SAC is currently before the Court. Mot. Dismiss. 2The Court accepts as true all of the well-pleaded facts in the complaint and draws all reasonable inferences in favor of the plaintiff. Platt v. Brown, 872 F.3d 848, 851 (7th Cir. 2017). Legal Standard A motion to dismiss under Rule 12(b)(6) challenges the sufficiency of the complaint. Hallinan v. Fraternal Order of Police of Chi. Lodge No. 7, 570 F.3d 811, 820 (7th Cir. 2009). Under Rule 8(a)(2), a complaint must include only “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). To survive a motion to dismiss, a complaint need only contain factual allegations, accepted as true, sufficient to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. The allegations “must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555 . The allegations that are entitled to the assumption of truth are those that are factual, rather than mere legal conclusions. Iqbal, 556 U.S. at 678–79. Analysis I. Implied Contract (Count II) Archey alleges in Count II that by providing his personal information to Osmose, Archey and Osmose entered into an implied contract whereby Osmose was obligated to take, but failed to take, reasonable steps to secure and safeguard Archey’s personal information. SAC ¶¶ 41–42. Under Illinois law, the elements for an implied-in-fact contract and a breach of contract are the same. See Nissan N. Am., Inc. v. Jim M’Lady Oldsmobile, Inc., 486 F.3d 989, 996 (7th Cir. 2007) (finding the same elements are required for an implicit and express contract under Illinois law). So, to plead breach of an implied-in-fact contract in Illinois, a plaintiff must allege: (1) the existence of a valid and enforceable contract; (2) performance by the plaintiff; (3) breach of contract by the defendant; and (4) resultant injury to the plaintiff. Hess v. Bresney, 784 F.3d 1154 , 1158–59 (7th Cir. 2015) (citations omitted). See also Gociman v. Loyola, 41 F.4th 873, 883 (7th Cir. 2022). The terms of an implied-in-fact contract, however, unlike an express contract, are inferred from the conduct of the parties. Gociman, 41 F.4th at 883 (citation omitted). Osmose argues that the SAC fails to adequately allege mutual assent because the allegations of mutual assent are conclusory.3 Memo. Dismiss at 12 (citing Longenecker-Wells v. Benecard Services Inc., 658 Fed. Appx 659 (3d Cir. 2016); Vann v. Dolly, Inc., 2019 WL 1785589 , at *3 (N.D. Ill. Apr. 24, 2019)). Archey retorts that because he was required to provide Osmose with his personal information as a condition of employment,4 an implied-in-fact contract arose between the parties. 3Osmose also argues that the SAC fails to assert breach of an implied-contract, as well as actual loss or injury. R. 56, Memo. Dismiss at 5, 12–14. However, because the Court agrees with Osmose that Archey has failed to plead the element of mutual assent, the Court does not address Osmose’s breach and loss arguments. 4As discussed further below, the SAC omits the previously included allegation that Osmose required Archey’s personal information as a condition of employment, and Archey cannot amend the SAC via response brief. See Agnew v. Nat'l Collegiate Athletic Ass'n, 683 F.3d 328, 348 (7th Cir. 2012) (internal quotation marks and citation omitted) (“[I]t is a basic principle that the complaint may not be amended by the briefs in opposition to a motion to dismiss, nor can it be amended by the briefs on appeal.”). R. 59, Resp. at 5. Under this contract, Osmose had a duty, according to Archey, to safeguard his personal information. Id.; SAC ¶ 41. It is black letter law that “[i]n order for there to be a contract between parties there must be a meeting of the minds or mutual assent as to the terms of the contract.” Midland Hotel Corp. v. Reuben H. Donnelley Corp., 515 N.E.2d 61, 65 (Ill. 1987) (citation omitted). This requirement, of course, applies equally to an impliedin-fact contract. See Jim M'Lady Oldsmobile, Inc., 486 F.3d at 996 (internal quotation marks and citations omitted) (holding Illinois law requires plaintiff to show meeting of minds and implied contract arises where “circumstances under common understanding show a mutual intent to contract”). For an implied-in-fact contract, the circumstances must allow an inference that the parties had a deal, or meeting of the minds, even though there was no statement to that effect. Al's Serv. Ctr. v. BP Prod. N. Am., Inc., 599 F.3d 720, 726 (7th Cir. 2010) (citations omitted) (interpreting Illinois law). Significantly, “[a]n implied-in-fact contract is one in which a contractual duty is imposed by a promissory expression which may be inferred from the facts and circumstances and the expressions on the part of the promisor which show an intention to be bound.” Gociman, 41 F.4th at 883 (internal quotation marks and citations omitted) (emphasis added). Here, Archey alleges that he provided his personal information, including his name, social security number, and direct deposit bank account information, and that “by virtue of providing his personal information to his employer, it was inferred Archey entered into an implied-in-fact contract with Osmose whereby Osmose was obligated to take reasonable steps to secure and safeguard Archey’s personal information and to take reasonable steps following unauthorized disclosures of such information.” SAC ¶¶ 40, 41. But Archey’s subjective inference that a contract was formed does not suffice to show the existence of an implied-in-fact contract. See Miksis v. Evanston Twp. High Sch. Dist. # 202, 235 F. Supp. 3d 960, 996 (N.D. Ill. 2017), as amended (Feb. 2, 2017) (interpreting Illinois law) (party’s subjective belief that community college classes were part of the settlement agreement was “not sufficient to establish a meeting of the minds”). See also Dynegy Mktg. & Trade v. Multiut Corp., 648 F.3d 506, 515 (7th Cir. 2011) (“Unilateral ‘understandings’ are not enough to give rise to an enforceable oral contract in Illinois.”). Rather, even under the lenient notice pleadings standard, see Resp. at 6, Archey has to point to “facts and circumstances and the expressions on the part of [Osmose] which show[ed] an intention to be bound.” Gociman, 41 F.4th at 883 (internal quotation marks and citations omitted). The SAC is devoid of any such allegations, so the Court finds that Archey fails to plead mutual assent for an implied-in-fact contract. Archey likens his case to In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 531 (N.D. Ill. 2011), but the Court does not find the comparison persuasive. Resp. at 4–5. In re Michaels dealt with an implicit contract in the merchant-consumer space, and Archey does not explain how or why a data breach in the employeeemployer context should be analyzed in the same way. Additionally, Archey insists that In re Michaels is on all fours with this case because Archey “was required to provide Osmose his personal information as a condition of employment[.]” Resp. at 5. But that is not what the SAC alleges. Instead, as Osmose observes, “Plaintiff no longer alleges that he ‘was required to provide Osmose his personal information as a condition of employment[;]’ instead, he merely alleges that he provided his information to Osmose.” Memo. Dismiss at 12. Archey’s citation of the Illinois Personal Information Protection Act, 815 ILCS 530/1 et seq. (PIPA) is likewise unconvincing. Archey argues that PIPA required Osmose to “implement and maintain reasonable security measures to protect Archey’s personal information, and to notify him regarding any unauthorized disclosure in the most expedient time possible and without unreasonable delay.” Resp. at 6. Even assuming Archey’s reading of PIPA is accurate, the Court agrees with Osmose that an independent statutory duty does not mean that a contractual obligation exists because Osmose would be bound by the statute, regardless of contract. See R. 61, Reply at 6–7. Acknowledging “a scarcity of case law in the Seventh Circuit” on the issue of the implied contractual duty of an employer to protect its employees’ data, Resp. at 6, Archey directs the Court to Sackin v. TransPerfect Glob., Inc., 278 F. Supp. 3d 739, 750 (S.D.N.Y. 2017). Id. at 6–7. However, rather than advancing his position, the Sackin case highlights how the SAC is lacking. In Sackin, the court found that the employee-plaintiffs had sufficiently alleged a conduct and course of dealing between themselves and their employer, which raised a strong inference of an implied contract. 278 F. Supp. 3d at 750 . In particular, the court in Sackin highlighted the following allegations made by the plaintiffs: (1) the employer required and obtained the employees’ personally identifiable information as part of the employment relationship; and (2) the employer’s privacy policies and securities practices manual stated that the company “maintains robust procedures designed to carefully protect the [personally identifiable information] with which it [is] entrusted[.]” Id. (citations omitted). By contrast here, the SAC omits the previous allegation that Osmose required Archey to provide his personal information. The SAC further lacks mention of any policy, manual, or handbook (or any conduct at all) supporting a finding of an implicit promise made by Osmose to protect Archey’s information. Archey’s Sackin argument thus fails to redeem the SAC. To be clear, the Court is not holding that an employee could never plead an implied-in-fact contract with respect to a data breach. The Court even—generally, at least—agrees with the proposition that “it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of Social Security numbers or other sensitive personal information would not imply the recipient’s assent to protect the information sufficiently.” Sackin, 278 F. Supp. 3d at 751 (quoting Castillo v. Seagate Tech., LLC, No. 16 civ. 1958, 2016 WL 9280242 , at *9 (N.D. Cal. Sept. 14, 2016)). At the same time, many of the courts that have found an implied contract in the employee-employer data breach context have done so when the plaintiffs were able to point to some document, expression, or action of the employer which indicated an intention to protect the employee’s personal information. See, e.g., Enslin v. The Coca–Cola Co., 136 F. Supp. 3d 654, 675 (E.D. Pa. 2015); In re Waste Mgmt. Data Breach Litig., No. 21CV6147 (DLC), 2022 WL 561734 , at *5 (S.D.N.Y. Feb. 24, 2022); In re GE/CBPS Data Breach Litig., No. 20 CIV. 2903 (KPF), 2021 WL 3406374 , at *11 (S.D.N.Y. Aug. 4, 2021). See also Longenecker-Wells v. Benecard Servs. Inc, 658 F. App'x 659, 663 (3d Cir. 2016) (comparing pleadings to those in Enslin, 136 F. Supp. 3d 654 , and finding plaintiffs’ allegations fell short where plaintiffs did not plead “any company-specific documents or policies from which one could infer an implied contractual duty to protect Plaintiffs’ information). These cases are persuasive because they are in line with the Seventh Circuit’s guidance that “[a]n implied-in-fact contract is one in which a contractual duty is imposed by a promissory expression which may be inferred from the facts and circumstances and the expressions on the part of the promisor which show an intention to be bound.” Gociman, 41 F.4th at 883 (internal quotation marks and citations omitted) (emphasis added). Indeed, in Gociman, the Seventh Circuit held that students of Loyola University adequately pled the existence of an implied-in-fact contract (“that, in exchange for tuition and fees, Loyola promised in-person instruction and access to on-campus facilities and services”) by pointing to Loyola’s catalogs, registration portal, pre-pandemic practice, and distinct charges for Loyola’s online versus on-campus programs. Id. at 884 . In the absence of binding authority in the employee-employer data breach context, Gociman indicates that the Seventh Circuit would require more than what Archey has pled here. Because Archey has failed to allege mutual assent, Archey’s implied-in-fact contract claim cannot stand. Osmose’s motion to dismiss Count II is granted. II. ICFA (Count III) In Count III, Archey alleges that Osmose violated the ICFA based on a violation of the PIPA requirements for reasonable data security and reasonable notice of data breach. SAC ¶¶ 47–50. For an ICFA claim, Archey must plead: (1) a deceptive act or practice by Osmose; (2) that the act or practice occurred in the course of conduct involving trade or commerce; (3) that Osmose intended Archey to rely on the deception; and (4) that actual damages were proximately caused by the deception. See Oshana v. Coca-Cola, 472 F.3d 506, 513 (7th Cir. 2006) (citing Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 850 (Ill. 2005)). An ICFA claim must derive from allegations showing facts that “primarily and substantially” happened in Illinois. Crichton v. Golden Rule Ins. Co., 576 F.3d 392, 396 (7th Cir. 2009) (quoting Avery, 835 N.E.2d at 854 ). A violation of the PIPA constitutes an unlawful practice under the ICFA. 815 ILCS 505/2Z; 815 ILCS 530/20; In re Michaels Stores, 830 F. Supp. 2d at 527 . The PIPA requires data collectors who own, license, maintain, or store records containing personal information about an Illinois resident to “implement and maintain reasonable security measures to protect those records from unauthorized access . . . or disclosure.” 815 ILCS 530/45(a). PIPA also requires that “[data breach] disclosure notification[s] shall be made in the most expedient time possible and without unreasonable delay. . . .” 815 ILCS 530/10(a). Osmose argues that the Court should dismiss Count III because Archey fails to plead a nexus between “Illinois and the circumstances giving rise to his ICFA claim.”5 Memo. Dismiss at 14–15 (citing Int’l Equip. Trading, Ltd. V. Illumina, Inc., 312 F. Supp. 3d 725, 733 (N.D. Ill. 2018); Avery, 835 N.E.2d at 852 ). Surprisingly, Archey fails to address this argument in his response and therefore, has waived his response on this issue. Brown v. City of Chi., 2020 WL 8174676 , at *3 (N.D. Ill. Dec. 2, 2020) (citing United States v. Holm, 326 F.3d 872, 877 (7th Cir. 2003)). Notwithstanding Archey’s failure to address this issue, the Court nevertheless assesses Osmose’s nexus argument. In Avery, the Illinois Supreme Court held that the ICFA does not have extraterritorial effect. Nonresident claimants, explained the court, may assert a claim under the ICFA only where the circumstances of the disputed transaction occurred “primarily and substantially” in Illinois. Avery, 835 N.E.2d at 854 . The court noted that “there is no single formula or bright-line test for determining whether a transaction occurs within Illinois, instead each case must be decided on its own facts.” Id. While Avery dealt with nonresident claimants, subsequent decisions have clarified that the test of a viable ICFA claim is whether the disputed transaction takes place “primarily and substantially in Illinois.” See Barbara’s Sales, Inc. v. Intel Corp., 879 N.E.2d 910, 919 (Ill. 2007) (internal quotations omitted); Gridley v. State Farm Mut. Auto. Ins. Co., 840 N.E.2d 269, 275 (Ill. 2005); Phillips v. Bally Total Fitness Holding Corp., 865 N.E.2d 310, 316 (Ill. App. Ct. 2007). Thus, while Avery set out a nexus test for non-resident plaintiffs, the law is nevertheless clear that even an 5Because the Court agrees, the Court does not address Osmose’s argument that Archey fails to plead a cognizable loss or injury for his ICFA claim. Illinois resident must show that the disputed transaction occurred “primarily and substantially in Illinois. See Perdue v. Hy-Vee, Inc., 455 F. Supp. 749 (C.D. Ill. 2020) (dismissing Illinois resident’s ICFA claim where transaction did not occur primarily and substantially in Illinois). Here, the SAC fails to allege that the data breach occurred primarily and substantially in Illinois. True, the SAC alleges that Archey is an Illinois resident and that Archey interviewed with Osmose in Illinois. SAC ¶¶ 1, 8. But, as Osmose points out, the SAC does not allege that the “cyberattack occurred in Illinois or that Osmose stored [Archey]’s information in Illinois.” Id. Nor does Archey allege that Osmose asked for, or that he provided his personal information to Osmose in Illinois. Instead, the SAC alleges that Osmose is a Georgia corporation and that Archey worked for Osmose in Texas. Stated differently, the SAC is devoid of any allegations connecting the data breach to Illinois. Archey therefore attempts to apply the ICFA extraterritorially in contravention of Illinois law. See Crichton, 576 F.3d at 396 . The Court consequently finds that Archey has failed to state an ICFA claim and dismisses Count III. Conclusion For the foregoing reasons, the Court grants Osmose’s Motion to Dismiss and dismisses Counts II and III with prejudice. As the Court noted in its previous order, Archey’s second failed attempt to state a claim under Rule 12(b)(6) would be with prejudice. See Bank of Am., N. Am., at 818–19 (affirming dismissal with prejudice of third pleading attempt because “in court, as in baseball, three strikes and you’re out’). The dismissal is further with prejudice because any subsequent amendments would be futile. Heng v. Heauner, Beyers & Mihlar, LLC, 849 F.3d 348, 354 (7th Cir. 2017). Dated: August 18, 2022 ef \nbslan 4 Z United States District Judge Franklin U. Valderrama