Carlos Ramirez v. The Paradies Shops, LLC, No. 22-12853 (11th Cir. 2023)
Annotate this Case
Plaintiff worked for a company later acquired by the Paradies Shops. He, like many employees, entrusted his employer with sensitive, personally identifiable information (PII). In October 2020, Paradies suffered a ransomware attack on its administrative systems in which cybercriminals obtained the Social Security numbers of Plaintiff and other current and former employees. Shortly after learning of the data breach, Plaintiff brought claims for negligence and breach of implied contract on behalf of himself and those affected by the data breach, arguing Paradies should have protected the PII. He now appeals from the district court’s order granting Paradies’s motion to dismiss for failure to state a claim. He contends the district court demanded too much at the pleadings stage.
The Eleventh Circuit affirmed the dismissal of the breach of implied contract claim and reversed the district court’s dismissal of Plaintiff’s negligence claim, and remanded for further proceedings. The court explained that, as the Georgia Supreme Court has noted, “traditional tort law is a rather blunt instrument for resolving all of the complex tradeoffs at issue in a case such as this, tradeoffs that may well be better resolved by the legislative process.” Nevertheless, having applied Georgia’s traditional tort principles, the court concluded Plaintiff has pled facts giving rise to a duty of care on the part of Paradies. Getting past summary judgment may prove a tougher challenge, but Plaintiff has pled enough for his negligence claim to survive a Rule 12(b)(6) motion to dismiss.
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.