Janet Reetz v. Advocate Aurora Health, Inc.

Annotate this Case

Download PDF

COURT OF APPEALS DECISION DATED AND FILED November 22, 2022 Sheila T. Reiff Clerk of Court of Appeals Appeal No. NOTICE This opinion is subject to further editing. If published, the official version will appear in the bound volume of the Official Reports. A party may file with the Supreme Court a petition to review an adverse decision by the Court of Appeals. See WIS. STAT. § 808.10 and RULE 809.62. Cir. Ct. No. 2020CV2361 2021AP520 STATE OF WISCONSIN IN COURT OF APPEALS DISTRICT I JANET REETZ, PLAINTIFF-APPELLANT, V. ADVOCATE AURORA HEALTH, INC., DEFENDANT-RESPONDENT. APPEAL from an order of the circuit court for Milwaukee County: TIMOTHY M. WITKOWIAK, Judge. Affirmed in part; reversed in part and cause remanded for further proceedings. Before Brash, C.J., Dugan and White, JJ. ¶1 WHITE, J. Janet Reetz appeals the order dismissing her class action against Advocate Aurora Healthcare, Inc. (Aurora). Reetz alleged negligence, invasion of privacy, breach of contract, breach of implied covenant of good faith No. 2021AP520 and fair dealing, and declaratory relief for Aurora’s actions related to a data breach of personal information from Aurora’s systems. ¶2 Upon review, we conclude that Reetz had standing to pursue her claims, adequately pleaded sufficient damages, and adequately pleaded a cause of action for negligence. Therefore, we reverse that part of the order dismissing the negligence claim and remand the same to the circuit court for further proceedings consistent with this decision. However, Reetz failed to state a claim upon which relief may be granted for her other four claims: invasion of privacy, breach of contract, breach of implied covenant of good faith and fair dealing, and declaratory relief. Therefore, we affirm the parts of the circuit court order dismissing those claims. BACKGROUND ¶3 We recite the facts of this case as drawn from the factual allegations in the pleadings. This case arises out of a data breach of Aurora’s information technology systems. On February 20, 2020, Aurora sent a notice of a security incident that occurred in January 2020 during which an unauthorized person gained temporary access through a phishing scheme to an Aurora human resources system that housed personal information for current and former Aurora employees. When Aurora became aware of the issue on January 9, 2020, it locked out the intruder. Aurora’s internal investigation showed that the personal information of current and former Aurora employees at Wisconsin locations was at risk, including employees’ Social Security numbers, bank accounts used for direct deposit, birth dates, and home addresses. Aurora discovered that sixty-three employees had their direct deposit information changed to deposit paychecks into the intruder’s account(s). Aurora offered complimentary one-year memberships in an identity theft protection 2 No. 2021AP520 service to all former and current employees whose information was contained in the affected system. Reetz, a former Aurora employee, had her personal information contained in the affected HR system; however, her account’s direct deposit instructions were not among the sixty-three accounts discovered as compromised. ¶4 Reetz first filed a class action suit against Aurora in March 2020, pursuing claims against Aurora for herself and as a representative of other similarly situated individuals. Aurora moved to dismiss Reetz’s action in June 2020. In response, Reetz amended her complaint in July 2020. Aurora again moved to dismiss in September 2020. After argument before the circuit court in December 2020, the circuit court dismissed Reetz’s action with prejudice in a written decision on February 18, 2021. ¶5 Reetz appeals. DISCUSSION ¶6 Reetz argues that the circuit court erred when it dismissed her complaint with prejudice. A motion to dismiss tests the sufficiency of the complaint. Data Key Partners v. Permira Advisers LLC, 2014 WI 86, ¶19, 356 Wis. 2d 665, 849 N.W.2d 693. When we review a motion to dismiss, “[a]ll facts pleaded and all reasonable inferences from those facts are admitted as true,” for the purpose of our review. Scott v. Savers Prop. & Cas. Ins. Co., 2003 WI 60, ¶5, 262 Wis. 2d 127, 663 N.W.2d 715. “The pleadings are to be liberally construed and a claim will only be dismissed if the plaintiff cannot recover under any circumstances.” Heinritz v. Lawrence Univ., 194 Wis. 2d 606, 610-11, 535 N.W.2d 81 (Ct. App. 1995). “We independently review as a question of law whether a complaint states a cognizable claim.” DeBruin v. St. Patrick Congregation, 2012 WI 94, ¶10, 343 Wis. 2d 83, 816 N.W.2d 878. 3 No. 2021AP520 I. Standing ¶7 We begin with the issue of standing. The circuit court concluded Reetz had standing, but had not sufficiently alleged damages to state a claim upon which relief may be granted. Reetz argues that she has standing to bring her claims and that she sufficiently alleged damages. Aurora argues she neither has standing nor sufficiently alleged damages. “Whether a party has standing is a question of law that we review independently.” Friends of Black River Forest v. Kohler Co., 2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342 (citation omitted). Under Wisconsin law, the standing of a party whose interest is challenged is determined by: (1) personal interest in the controversy; (2) injury or adverse effect; and (3) judicial policy that “calls for protecting the interest of the party whose standing has been challenged.” Foley-Ciccantelli v. Bishop’s Grove Condo. Ass’n, Inc., 2011 WI 36, ¶5, 333 Wis. 2d 402, 797 N.W.2d 789. The law of standing is liberally construed. Krier v. Vilione, 2009 WI 45, ¶20, 317 Wis. 2d 288, 766 N.W.2d 517. ¶8 As noted, on appeal, Aurora challenges the circuit court’s finding that Reetz had standing to bring this action. “To say that the plaintiffs have standing is to say that they have alleged injury in fact, and if they have suffered an injury then damages are available[.]” Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826, 828 (7th Cir. 2018).1 Her operative complaint alleged an injury in fact from cybercriminals unlawfully accessing Aurora’s HR systems, which allowed them to access current and former employees’ personally identifiable information (PII) 1 We note that we consider several federal cases on data breaches in the standing discussion, acknowledging that “[f]ederal law on standing is not binding in Wisconsin.” Friends of Black River Forest v. Kohler Co., 2022 WI 52, ¶17, 402 Wis. 2d 587, 977 N.W.2d 342. “Because our state constitution lacks the jurisdiction-limiting language of its federal counterpart, ‘standing in Wisconsin is not a matter of jurisdiction, but of sound judicial policy.’” Id. (citation omitted). However, this court considers federal case law as persuasive authority regarding standing questions because Wisconsin’s standing analysis is conceptually similar to the federal analysis. See id., ¶18. 4 No. 2021AP520 including Social Security numbers, birth dates, home addresses, and bank accounts used for direct deposit. Reetz alleged that she suffered $2,700 in fraudulent charges against her bank account and a resulting $600 in insufficient funds and overdraft fees. To establish standing in a data breach identity theft case, allegations of “time spent dealing with fraud attempts, the threat of future identity theft, and money spent mitigating that threat … [are] sufficient to establish standing[.]” Fox v. Iowa Health Sys., 399 F. Supp. 3d 780, 790 (W.D. Wis. 2019). We agree that Reetz has established an injury in fact and standing to pursue this action. ¶9 Nevertheless, Aurora asserts that Reetz does not have standing and the circuit court should not have exercised jurisdiction over her claims. “Being damaged, however, without more, does not automatically confer standing.” Krier, 317 Wis. 2d 288, ¶20. Aurora contends that Reetz has failed to adequately plead damages to establish standing, because she has not shown the causal link between her damages and Aurora’s conduct. Aurora argues that the timing of the theft from Reetz’s bank accounts does not prove that the theft occurred as a result of the data breach. “[W]hen a defendant does not submit evidence that contradicts a specific allegation, the court accepts that allegation as true[.]” Fox, 399 F. Supp. 3d at 792. Aurora has not offered any evidence that Reetz’s data was stolen in a different way. Ultimately, Aurora may be correct that Reetz’s information was exposed in another way that caused the alleged monetary losses, but that is an issue of causation to be resolved at trial or summary judgment. See id. Therefore, Reetz’s allegations are sufficient to establish standing. ¶10 Having concluded that Reetz’s allegations are sufficient to establish standing, we next address whether she has sufficiently plead damages to support each of her claims. Further, we address Aurora’s arguments that Reetz’s damages are speculative and do not support her claims. 5 No. 2021AP520 II. Negligence ¶11 Reetz argues she successfully stated a claim for common-law negligence; therefore, the circuit court erred in dismissing this claim. For a negligence claim to survive a motion to dismiss, a plaintiff must have “sufficiently pled facts, which if proven true, would establish all four required elements of an actionable negligence claim.” Nichols v. Progressive N. Ins. Co., 2008 WI 20, ¶11, 308 Wis. 2d 17, 746 N.W.2d 220. The four elements of a negligence claim are: “(1) the existence of a duty of care on the part of the defendant, (2) a breach of that duty of care, (3) a causal connection between the defendant’s breach of the duty of care and the plaintiff’s injury, and (4) actual loss or damage resulting from the injury.” Hornback v. Archdiocese of Milwaukee, 2008 WI 98, ¶16, 313 Wis. 2d 294, 752 N.W.2d 862 (citation omitted). Reetz alleged that, as her former employer, Aurora had a duty of care to safeguard the PII within its control because it was foreseeable that cybercriminals would attempt to access the PII. Reetz alleged that Aurora breached that duty by failing to exercise reasonable care in safeguarding the PII. Reetz then alleged that as a result of Aurora’s negligence, she suffered damages including monetary damages and increased risk of future harm from identity theft. ¶12 Aurora argues that the negligence claim fails to state a claim because Reetz has failed to allege actual damages and because the economic loss doctrine bars the claim. Both of these arguments fail. We begin with actual damages. Damages in tort claims accrue only when actual damages occur, which is “harm that has already occurred or is ‘reasonably certain’ to occur in the future.” Tietsworth v. Harley-Davidson, Inc., 2004 WI 32, ¶17, 270 Wis. 2d 146, 677 N.W.2d 233 (citation omitted). overdraft fees. Reetz alleged damages from fraudulent transactions and Money damages may arise from a data breach because “unauthorized withdrawals from [victims’] accounts cause a loss (the time value of 6 No. 2021AP520 money) even when banks later restore the principal, and because the value of one’s own time needed to set things straight is a loss from an opportunity-cost perspective.” Dieffenbach, 887 F.3d at 828. Further, a data breach of PII creates a risk of future identity theft.2 Cf. Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 966 (7th Cir. 2016) (concluding that the increased risk of identity theft was a sufficiently imminent injury after a data breach). We note that Aurora allegedly acknowledged this risk when it offered credit monitoring to employees and former employees whose PII was contained in the breached system. Cf. Fox, 399 F. Supp. 3d at 791. ¶13 Reetz’s complaint is based on a data breach, which allowed unauthorized access of her PII, including fraudulent transactions and resulting overdraft fees in her bank account.3 Reetz argues that the circuit court improperly concluded that she did not plead actual damages because she did not allege that she requested a return of the overdraft fees or that the overdraft fees were not reimbursed. In our review, we accept the allegations in the complaint as being true; therefore, we accept as true Reetz’s allegations that she incurred the fraudulent charges and the overdraft fees. Accordingly, the pleading of those specific amounts constitute adequate actual damages to overcome Aurora’s motion to dismiss for failure to state a claim. Further, Reetz’s damages do not arise only from the 2 As the Seventh Circuit stated in discussing a data breach of Neiman Marcus credit cards, “Why else would hackers break into a store’s database and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.” Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015). 3 Reetz further alleged that her PII is now a black market commodity and that its value constitutes damages. We decline to address this argument because it is both undeveloped and unnecessary to examine in addition to our conclusion that she adequately pleaded damages. See Maryland Arms Ltd. P’ship v. Connell, 2010 WI 64, ¶48, 326 Wis. 2d 300, 786 N.W.2d 15 (“Typically, an appellate court should decide cases on the narrowest possible grounds.”). 7 No. 2021AP520 overdraft fees, but from allegations of “time spent dealing with fraud attempts [and] the threat of future identity theft.” See Fox, 399 F. Supp. 3d at 790. ¶14 Next, Aurora argues that the economic loss doctrine bars tort recovery for contractual claims, and therefore, Reetz’s claim is barred. “The economic loss doctrine is a judicially created doctrine that seeks to preserve the distinction between contract and tort.” Insurance Co. of N. Am. v. Cease Elec. Inc., 2004 WI 139, ¶15, 276 Wis. 2d 361, 688 N.W.2d 462. “Recovery for economic loss is intended to protect purchasers from losses suffered because a product failed in its intended use.” Northridge Co. v. W.R. Grace & Co., 162 Wis. 2d 918, 933, 471 N.W.2d 179 (1991). Economic loss for this purpose includes both direct economic loss, which “is loss in value of the product itself,” and consequential economic loss, which is “all other economic losses attributable to the product defect.” Daanen & Janssen, Inc. v. Cedarapids, Inc., 216 Wis. 2d 395, 401, 573 N.W.2d 842 (1998). “Economic damages do not include losses due to personal injury or damage to other property.” Linden v. Cascade Stone Co., 2005 WI 113, ¶6, 283 Wis. 2d 606, 699 N.W.2d 189. Moreover, the doctrine “is inapplicable to claims for the negligent provision of services.” Cease Elec. Inc., 276 Wis. 2d 361, ¶52. We independently review as a question of law whether the economic loss doctrine applies to a given set of facts. Linden, 283 Wis. 2d 606, ¶5. ¶15 The relationship between Reetz and Aurora is, in essence, contractual, arising out of Reetz’s at-will employment contract with Aurora for her employment services. There are no products or goods exchanged under this contract; therefore, her claims of economic loss do not derive from a loss in value of any product or a loss attributable to a product defect. Daanen & Janssen, Inc., 216 Wis. 2d at 401. Aurora relies on multiple cases from other jurisdictions holding that the economic 8 No. 2021AP520 loss doctrine bars negligence claims in data breach cases.4 We do not find these cases persuasive. We conclude there is no application of the economic loss doctrine to Reetz’s claims that Aurora did not exercise reasonable care to safeguard her PII. Further, Aurora failed to refute Reetz’s argument that the economic loss doctrine is inapplicable to services. Therefore, we consider Aurora to have conceded this argument. See United Coop. v. Frontier FS Coop., 2007 WI App 197, ¶39, 304 Wis. 2d 750, 738 N.W.2d 578 (explaining that the failure to refute an argument may be taken as a concession). ¶16 Aurora argues that because Reetz’s claims arise out of her employment contract, this court should not allow her negligence claim to proceed. The circuit court concluded that tort law is not applicable in employment law under Mackenzie v. Miller Brewing Co., 2001 WI 23, ¶¶27-28, 241 Wis. 2d 700, 623 N.W.2d 739. In Mackenzie, our supreme court explained that tort law protects society as a whole and “rests on obligations imposed by law,” Daanen & Janssen, Inc., 216 Wis. 2d at 405; in contrast, employment law is based on contract principles and obligations imposed by bargaining, Mackenzie, 241 Wis. 2d 700, ¶28. There, our supreme court declined to recognize a new fraudulent representation tort–—intentional misrepresentation 4 to induce continued Aurora cited cases based on Illinois, Pennsylvania, and Colorado law. See, e.g., Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 817 (7th Cir. 2018) (concluding that Illinois’s economic loss rule would bar recovery in a tort claim arising out of a cybersecurity breach); Longenecker-Wells v. Benecard Servs. Inc., 658 F. App’x 659, 661 (3d Cir. 2016) (concluding Pennsylvania’s economic loss rule applied to tort claims arising out of a data breach because damage was solely economic and was not accompanied by physical injury or property damage); SELCO Cmty. Credit Union v. Noodles & Co., 267 F. Supp. 3d 1288, 1296 (D. Colo. 2017) (concluding that Colorado’s economic loss rule barred recovery for a tort claim by credit unions arising out of a data breach of a restaurant chain). The Wisconsin Supreme Court acknowledged that some jurisdictions, such as Illinois, “exempted some professions from the economic loss doctrine” but not other services or professions, leading to a “slippery slope” of requiring judicial determination of exceptions. Insurance Co. of N. Am. v. Cease Elec. Inc., 2004 WI 139, ¶¶49-50, 276 Wis. 2d 361, 688 N.W.2d 462. Instead, Wisconsin simply does not apply the economic loss doctrine to service contracts. Id., ¶52. 9 No. 2021AP520 employment–within an at-will employment context. Id., ¶30. Although the Mackenzie court discussed the difference between tort and contract law, it did not apply the economic loss doctrine as a basis of its decision. Without a clear directive that the economic loss doctrine applies to employment law and given our supreme court’s clear directive that it is not applicable to service contracts, we decline to extend a blanket application of the economic loss doctrine in the employment law context. See Cook v. Cook, 208 Wis. 2d 166, 188-89, 560 N.W.2d 246 (1997) (explaining that the Wisconsin Court of Appeals is primarily an error correcting court and the Wisconsin Supreme Court’s function is law declaration and development). ¶17 We conclude that Reetz has successfully stated a claim for negligence and pleaded damages in support of her claim. We reverse that part of the circuit court’s order dismissing this claim. We remand for further proceedings on the negligence claim and its class action ramifications. III. Invasion of Privacy ¶18 Reetz argues that the circuit court erred when it dismissed her invasion of privacy claim. She argues that she successfully stated a claim under WIS. STAT. § 995.50 (2019-20).5 Under that statute, Wisconsin recognizes four types of invasion of privacy actions, including the issue here: giving publicity to private facts. This cause of action is set forth by statute as: Publicity given to a matter concerning the private life of another, of a kind highly offensive to a reasonable person, if the defendant has acted either unreasonably or recklessly as to whether there was a legitimate public interest in the matter involved, or with actual knowledge that none existed. It is 5 All references to the Wisconsin Statutes are to the 2019-20 version unless otherwise noted. 10 No. 2021AP520 not an invasion of privacy to communicate any information available to the public as a matter of public record. Sec. 995.50(2)(am)3. Under Wisconsin law, to establish this cause of action, a plaintiff must prove: (1) a public disclosure of facts regarding the plaintiff; (2) the facts disclosed are private facts; (3) the private matter made public is one which would be highly offensive to a reasonable person of ordinary sensibilities; and (4) the defendant acted either unreasonably or recklessly as to whether there was a legitimate public interest in the matter, or with actual knowledge that none existed. Pachowitz v. LeDoux, 2003 WI App 120, ¶18, 265 Wis. 2d 631, 666 N.W.2d 88.6 ¶19 Reetz pleaded that Aurora publicized and exposed her PII, which contained private details and facts generally not known to the public, facts not publicly available, and not of legitimate public concern. Aurora argues that Reetz’s claim fails because she has not alleged intentional conduct by Aurora in the data breach. Reetz argues that intentional conduct is not required and that invasion of 6 We note that Pachowitz v. LeDoux, 2003 WI App 120, ¶18, 265 Wis. 2d 631, 666 N.W.2d 88, referenced the earlier version of the invasion of privacy statute, WIS. STAT. § 895.50 (2003-04). This statute remains substantively the same but was renumbered to WIS. STAT. § 995.50 in 2005 Wis. Act 155, § 51. Further, the subdivisions within § 995.50(2) were renumbered in 2019 Wis. Act 72, § 1. 11 No. 2021AP520 privacy is not an intentional tort.7 Neither the language of WIS. STAT. § 995.50(2)(am)3., nor the elements of this action provided by case law state an intentional requirement.8 This is a matter of first impression. In concluding that the publicity of private facts cause of action requires intentional conduct in Wisconsin, we are persuaded by the reasoning employed by the United States District Court for the Western District of Wisconsin’s in Fox, 399 F. Supp. 3d 780 in 2019. The Fox court noted that while there was no case on point in Wisconsin, “[s]ection 995.50 is to be ‘interpreted in accordance with the developing common law of privacy,’ []§ 995.50(3)”; therefore, it was likely Wisconsin courts would reach the same holding reached by “courts that have considered similar claims in other jurisdictions … that intentional action is required.” Id., 399 F. Supp. 3d at 796-97. Further, the court noted that the plaintiff there “pointed to no authority (and the court has found none) in which a defendant was held liable under this statute, or a similar statute, 7 Reetz argues that invasion of privacy can be intentional, reckless, or negligent, relying on a 1982 Marquette Law Review article for this supposition. See Jacqueline Hanson Dee, Comment, The Absence of False Light from the Wisconsin Privacy Statute, 66 Marq. L. Rev. 99, 113 (1982). Reetz does not offer any Wisconsin legal authority for this position. Reetz offers a non-Wisconsin case in support of her position that the disclosure need not be knowingly offensive for the cause of action to exist. Benally v. Hundred Arrows Press, Inc., 614 F. Supp. 969, 982 (D.N.M. 1985), rev’d sub nom. Benally on Behalf of Benally v. Amon Carter Museum of W. Art, 858 F.2d 618 (10th Cir. 1988) (concluding that it was irrelevant whether the defendant knew a photograph of the plaintiff it publicized would offend the plaintiffs). Beyond the fact that it is unclear how this case applies to a data breach instigated by a third-party, we note that the Benally court’s intent inquiry focused on whether it mattered if there was an intent to offend. It did not analyze whether there was an intent to publish or disclose or whether an intent to publish was relevant. Reetz’s argument here is undeveloped. We decline to develop it for her. See State v. Pettit, 171 Wis. 2d 627, 646, 492 N.W.2d 633 (Ct. App. 1992) (“We may decline to review issues inadequately briefed.”). 8 In Schaefer v. State Bar of Wisconsin, 77 Wis. 2d 120, 125-26, 252 N.W.2d 343 (1977), our supreme court concluded it would “not reach the question of whether the complaint states a cause of action for invasion of privacy for the reason Wisconsin does not recognize a cause of action for invasion of privacy without a specific intention to inflict harm.” Id. However, we do not consider this decision dispositive of the issue because it was decided prior to the codification of the privacy statute in 1977 Wis. Laws, ch. 176, § 5 published November 29, 1977. Schaefer was issued in April 1977. 12 No. 2021AP520 for information stolen by a third party.” Id. Similarly, Reetz fails to provide a case where a defendant was liable under a theory of invasion of privacy for publicity of private facts for a data breach involving a third-party. ¶20 “Publicity” as used in WIS. STAT. § 995.50(2)(am)3. has been defined under Wisconsin law to mean making a private matter “public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.” RESTATEMENT (SECOND) OF TORTS § 652D cmt. a (1977); see also Hillman v. Columbia Cnty., 164 Wis. 2d 376, 394, 474 N.W.2d 913 (Ct. App. 1991); Pachowitz, 265 Wis. 2d 631, ¶18. Our supreme court’s prior analysis has determined that publicity of private facts occurred when oral communication by employees and inmates within a prison disclosed an inmate’s HIV status, Hillman, 164 Wis. 2d at 395, when an internal company newsletter listed why an employee was discharged, Zinda v. Louisiana Pac. Corp., 149 Wis. 2d 913, 932, 440 N.W.2d 548 (1989), and when an EMT disclosed a patient’s overdose to a third-party, Pachowitz, 265 Wis. 2d 631, ¶25. The commonality of the prior analysis of “publicity” is whether the information was disclosed widely enough—with this court eventually reaching a conclusion that “disclosure of private information to one person or to a small group does not, as a matter of law in all cases, fail to satisfy the publicity element of an invasion of privacy claim.” Id., ¶24. However, the entity’s conduct as the discloser or distributor of private facts was not disputed in Pachowitz, Hillman, or Zinda. We conclude that intentional conduct is integral to the disclosure of private facts and that giving “publicity” requires intentional conduct. ¶21 As support for the idea that intentionality is inherent to invasion of privacy–publicity of private facts, we note that invasion of privacy is classified as an intentional tort for the statute of limitations under WIS. STAT. § 893.57 and that 13 No. 2021AP520 jury instructions for invasion of privacy are structured within other intentional torts. See WIS JI—CIVIL 2550-52. In our analysis of civil invasion of privacy in Gillund v. Meridian Mut. Ins. Co., 2010 WI App 4, ¶28, 323 Wis. 2d 1, 778 N.W.2d 662, we assumed without deciding that “an invasion of privacy cannot be committed accidentally” and that civil “invasions of privacy encompass intentional acts.” Upon review, we conclude that those assumptions are correct and a claim for invasion of privacy–publicity of private facts requires intentional conduct.9 ¶22 Having established our legal standard, our question is whether Reetz has alleged facts to support that conduct by Aurora intentionally gave publicity to her PII. In the complaint, Reetz alleged that Aurora “has disclosed and given access to the PII … for criminals to use in the conduct of criminal activity” and that her “PII was publicly disclosed by Aurora in the Data Breach with reckless disregard for the reasonable offensiveness of the disclosure.” She alleged that Aurora “opened up, disclosed, and exposed the PII … to persons engaged in disruptive and unlawful business practices and tactics.” She alleged that Aurora’s outdated and insecure systems “demonstrates a willful and conscious disregard for employee privacy.” However, these allegations are conclusory as to Aurora’s participation and conduct. In the complaint, Reetz alleged that Aurora failed to prevent the cyberattack and data breach, but an allegation of failing to prevent a data breach is not an allegation that Aurora intended the disclosure or publicity of private facts. Accordingly, we 9 Reetz relies on Gillund v. Meridian Mut. Ins. Co., 2010 WI App 4, ¶29, 323 Wis. 2d 1, 778 N.W.2d 662, which provides that the objective test of invasion of privacy for a highly offensive intrusion is “whether a reasonable person would find the intrusion highly offensive. There is no requirement that the actor have a particular mental state or intent.” Id. This reliance is misplaced because Reetz does not allege a highly offensive intrusion, which implicates WIS. STAT. § 995.50(2)(am)1., but that Aurora publicized private facts, which implicates § 995.50(2)(am)3. There is no similar holding in Gillund regarding the mental state required to give publicity under subdivision three. Therefore, Gillund is not dispositive to the question of intent for publicity of private facts. 14 No. 2021AP520 conclude Reetz’s pleadings were insufficient to state a claim for invasion of privacy–publicity of private facts. Therefore, the circuit court did not err when it dismissed this count of the complaint, and we affirm this part of the order. IV. Breach of contract claims ¶23 Reetz argues the circuit court erred when it dismissed her claims for breach of her employment contract with Aurora—express or implied and breach of the covenant of good faith and fair dealing within every contract. “A valid contract requires an offer, acceptance and consideration.” Piaskoski & Assocs. v. Ricciardi, 2004 WI App 152, ¶7, 275 Wis. 2d 650, 686 N.W.2d 675. “Offer and acceptance exist when the parties mutually express assent, and consideration exists if the parties manifest an intent to be bound to the contract.” Id. “A contract must be definite and certain as to its basic terms and requirements to be enforceable.” Metropolitan Ventures, LLC v. GEA Assocs., 2006 WI 71, ¶22, 291 Wis. 2d 393, 717 N.W.2d 58, op. clarified on denial of reconsideration, 2007 WI 23, 299 Wis. 2d 174, 727 N.W.2d 502. Both the existence of a contract and whether the provisions of a contract are definite are questions of law we interpret independently. Id.; Piaskoski & Assocs., 275 Wis. 2d 650, ¶7. ¶24 Reetz argues that in her contract for employment with Aurora, she was obligated to provide PII and that Aurora breached its duty to safeguard the PII. Employment is “essentially contractual.” Atkinson v. Everbrite, Inc., 224 Wis. 2d 724, 729, 592 N.W.2d 299 (Ct. App. 1999). An employer’s obligations to an employee “stem from their agreement that [the employee] would work for [the employer], and that [the employer] would compensate [the employee] for his [or her] services.” Id. 15 No. 2021AP520 ¶25 Aurora argues that Reetz has not identified an express term in the employment contract that required it to safeguard the PII. Our examination of the pleadings supports that, even accepting all facts and reasonable inferences as true, Reetz has failed to identify a contract provision to support her claims. Reetz alleged that she and other class members “were required to provide their PII … to Defendant as a condition of employment.” She further alleged that Aurora “therefore offered … a unilateral contract of employment, which [she] accepted by providing the necessary PII and showing up for work.” Reetz’s allegations do not point to an express contract term; but instead, she alleges that Aurora’s obligation to safeguard the PII was “[i]mplicit in the agreement” and that Aurora “implicitly promised to retain PII only under conditions that kept such information secure and confidential.” We conclude that Reetz failed to allege an express contract provision that obligated Aurora to safeguard the PII. ¶26 Reetz also alleged that “Aurora’s Code of Conduct contained additional covenants restricting its disclosure of PII.” Aurora argues that Reetz did not plead that she saw the Code of Conduct and agreed to it prior to accepting the employment offer. It is true that “as a matter of law, an employment contract can be modified by the use of an employees’ handbook.” Ferraro v. Koelsch, 124 Wis. 2d 154, 169, 368 N.W.2d 666 (1985). However, there must be “evidence indicating that [the employee and employer] agreed to be bound by the terms of the policy,” or else it would “not rise to the level of a contract, either implied or otherwise.” Vorwald v. School Dist. of River Falls, 167 Wis. 2d 549, 558, 482 N.W.2d 93 (1992). This is where Reetz’s allegations are insufficient to state a claim upon which relief may be granted. Her conclusory phrase in the complaint about covenants in the Code of Conduct does not support that the employment contract was modified by mutual assent to the term to safeguard the PII. We conclude that 16 No. 2021AP520 Reetz’s breach of express contract claim failed to state a claim upon which relief may be granted. ¶27 Alternatively, Reetz argues that she had an implied contract with Aurora based on her providing her PII and Aurora agreeing to safeguard that information. Aurora argues that Reetz providing legally required PII and working at Aurora is not separate consideration to establish that an implied contract existed with provisions requiring Aurora to safeguard her PII. Aurora also contends that an implied contract to safeguard personal information from a data breach requires assent from both parties, an assent not alleged in the pleadings. ¶28 Reetz did not separately plead a breach of implied contract in the complaint, instead folding her allegations into the breach of express contract claim. An implied contract in law is a theory of unjust enrichment. There are three elements, as described in the Wisconsin jury instructions on implied contracts: “(1) a benefit conferred upon the defendant by the plaintiff; (2) knowledge or appreciation of the benefit by the defendant; and (3) acceptance and retention by the defendant of such benefit under such circumstances that it would be unfair … to retain it without paying the value thereof.” WIS JI—CIVIL 3028. ¶29 Construing all facts and reasonable inferences of those facts in the pleadings as true, an implied contract is an awkward application to the facts of this case and we conclude that she has not stated a claim for breach of implied contract. See Scott, 262 Wis. 2d 127, ¶5. To find that a benefit was conferred upon Aurora by Reetz would mean that it was to Aurora’s benefit for Reetz to provide her PII— rather, at best we could reasonably infer that Aurora needed Reetz’s PII to comply with federal and state regulations of employers. Further, that benefit to Aurora and Aurora’s knowledge of that benefit is not alleged in the complaint and is unclear 17 No. 2021AP520 from our review of the facts. Ultimately, there are no facts that an implied contract, if it existed, had a contractual term that obligated Aurora to safeguard the PII. Unjust enrichment generally refers to a monetary benefit conferred upon a defendant and here, the facts alleged fail to show that there was a monetary benefit to Aurora such that it would have unjust enrichment if it did not protect Reetz’s PII. See W.H. Fuller Co. v. Seater, 226 Wis. 2d 381, 387, 595 N.W.2d 96 (Ct. App. 1999) (“Depending upon the circumstances, the value of the benefit received by the defendant may include services rendered for the defendant, goods or merchandise received by the defendant, or improvements made to the defendant’s real estate.”). We conclude that Reetz’s claim based on a breach of implied contract failed to state a claim upon which relief may be granted. ¶30 Next, Reetz alleged that Aurora breached the covenant of good faith and fair dealing implicit in every contract.10 “Every contract implies good faith and fair dealing between the parties to it, and a duty of cooperation on the part of both parties.” Beidel v. Sideline Software, Inc., 2013 WI 56, ¶27, 348 Wis. 2d 360, 842 N.W.2d 240 (citation omitted). Good faith is an issue of the parties’ performance of the contract after formation “because no contract exists unless and until issues concerning indefiniteness are resolved[.]” Metropolitan Ventures, LLC, 291 Wis. 2d 393, ¶22 n.9. “A party can be liable for breach of the implied covenant of good faith ‘even though all the terms of the written agreement may have been 10 Additionally, Reetz argues that the circuit court erred in considering the implied covenant of good faith and fair dealing a tort claim, when it instead sounds in contract. A breach of “the covenant of good faith that accompanies every contract” is a contract claim, recognized in Wisconsin since at least Chayka v. Santini, 47 Wis. 2d 102, 107, 176 N.W.2d 561 (1970). Although there has been confusion over the years as to whether this claim sounds in contract or tort, “Wisconsin has not recognized a cause of action in tort for lack of good faith or ‘tortious breach of contract,’” but instead recognizes the breach of good faith under a contract action. Hauer v. Union State Bank of Wautoma, 192 Wis. 2d 576, 595, 532 N.W.2d 456 (Ct. App. 1995). However, we do not address this issue further because we conclude that there was no contract provision at issue requiring performance with good faith and fair dealing. 18 No. 2021AP520 fulfilled.’” Kreckel v. Walbridge Aldinger Co., 2006 WI App 168, ¶20, 295 Wis. 2d 649, 721 N.W.2d 508 (citation omitted). ¶31 Therefore, to state a claim for a breach of this covenant, the plaintiff must plead that a valid contract with express, definite, enforceable terms exists, and that the breaching party acted without good faith in its performance of that contract. See Beidel, 348 Wis. 2d 360, ¶29. Although there is no dispute that Reetz and Aurora had an employment contract, we have concluded that there was no provision within that contract that required Aurora to safeguard the PII. Without a contract provision establishing that safeguarding the PII was Aurora’s contractual obligation, Aurora did not breach its duty of good faith by failing to safeguard the PII. The good faith and fair dealing obligations must relate to the performance of the contract. See Gerruth Realty Co. v. Pire, 17 Wis. 2d 89, 94, 115 N.W.2d 557 (1962) (concluding good faith issues arises only after the determination of the enforceable terms of the contract). Accordingly, we conclude that Reetz failed to state a claim for breach of the covenant of good faith and fair dealing, and we affirm the circuit court order dismissing this claim. ¶32 Additionally, we note that Reetz failed to refute Aurora’s arguments relating to her contract claims. Aurora contended that there was no contract provision requiring Aurora to safeguard PII, that there was no implied contract, and without an underlying operative contract, there was no breach of the covenant of good faith and fair dealing. We consider Reetz to have conceded these arguments. See United Coop., 304 Wis. 2d 750, ¶39. ¶33 We conclude that Reetz has failed to state a claim for breach of contract, express or implied or through the covenant of good faith and fair dealing. Accordingly, we affirm the circuit court’s order dismissing Reetz’s contract claims. 19 No. 2021AP520 V. Injunctive relief and declaratory judgment ¶34 Reetz’s final argument is that the circuit court erred in dismissing her request for declaratory judgment and injunctive relief. Under the Uniform Declaratory Judgments Act, a circuit court “shall have power to declare rights, status, and other legal relations whether or not further relief is or could be claimed.” WIS. STAT. § 806.04(1). A declaratory judgment “terminates any controversy between these parties. Moreover, it limits and defines the parameters of any controversies that remain.” Loy v. Bunderson, 107 Wis. 2d 400, 408, 320 N.W.2d 175 (1982). “A court must be presented with a justiciable controversy before it may exercise its jurisdiction over a claim for declaratory judgment.” Olson v. Town of Cottage Grove, 2008 WI 51, ¶28, 309 Wis. 2d 365, 749 N.W.2d 211. ¶35 Reetz contends she faces an ongoing injury from the data breach and requests a court order appointing a third-party ombudsman to conduct, test, and audit Aurora’s data procedures, and to oversee training and education for employees on PII data issues and privacy practices. Reetz alleges that her damages arising from the data breach and identify theft are ongoing. However, she has failed to allege how declaratory judgment would remedy those future harms. A plaintiff may seek declaratory judgment prior to the suffering an injury as long as “the facts are sufficiently developed to allow a conclusive adjudication.” Putnam v. Time Warner Cable of Se. Wis., Ltd. P’ship, 2002 WI 108, ¶44, 255 Wis. 2d 447, 649 N.W.2d 626. Reetz has failed to show that declaratory judgment is an appropriate remedy to resolve her claims. ¶36 Aurora contends that Reetz’s request was properly denied by the circuit court because declaratory relief must be narrowly tailored toward remedying an ongoing harm, not premised on past conduct. Aurora asserts that Reetz only 20 No. 2021AP520 alleged past conduct from the data breach and speculative future harms. Aurora argues that Reetz has failed to allege what “impermissible conduct” by Aurora is ongoing and continuing to harm Reetz. Further, Aurora asserts that Reetz has failed to plead any statutory or common law basis for injunctive relief or declaratory judgment. Reetz failed to refute Aurora’s argument and we consider her to have conceded the issue. See United Coop., 304 Wis. 2d 750, ¶39. Therefore, we conclude that the circuit court properly dismissed Reetz’s request for declaratory judgment and injunctive relief. CONCLUSION ¶37 We conclude that Reetz has adequately pleaded standing and a negligence claim. We reverse this part of the circuit court order and remand for further proceedings on this claim. Conversely, we conclude that Reetz has failed to state a claim for invasion of privacy–publicity of public facts; breach of contract– either express or implied or the covenant of good faith and fair dealing; or declaratory judgment and injunctive relief. Therefore, we affirm the circuit court order dismissing these claims. By the Court.—Order affirmed in part; order reversed in part and cause remanded for further proceedings. Recommended for publication in the official reports. 21

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.