McGlenn v. Driveline Retail Merchandising Inc

IN THE UNITED STATES DISTRICT COURT

FOR THE CENTRAL DISTRICT OF ILLINOIS

SPRINGFIELD DIVISION

LYNN MCGLENN, )

)

Plaintiff, ) Case No. 18-cv-2097

)

v. )

)

DRIVELINE RETAIL )

MERCHANDISING, INC., )

)

Defendant. )

ORDER AND OPINION

SUE E. MYERSCOUGH, U.S. District Judge:

This cause is before the Court on Defendant Driveline Retail

Merchandising, Inc.’s (“Driveline”) Motion for Summary Judgment

(d/e 84). For the reasons stated below, the Court GRANTS

Defendant’s Motion for Summary Judgment (d/e 84).

I. FACTS

The Court draws the following facts from the parties’

statements of undisputed facts and from the evidence submitted by

the parties. Any facts not disputed, or disputed without evidentiary

documentation of the basis for the dispute, have been deemed

admitted. See CDIL-LR 7.1(D)(2)(b)(2).

On January 25, 2017, Driveline and thousands of its

employees became the victims of a criminal phishing attack. An

unknown individual (the “perpetrator”), disguised as the Chief

Financial Officer (“CFO”) of Driveline, sent an e-mail to a Driveline

employee who worked in the payroll department. The perpetrator

asked the employee to send all of Driveline’s employees’ 2016 W-2s.

The employee responded to the email and sent the 2016 W-2s of

15,878 employees to the perpetrator. These 15,878 W-2s contained

social security numbers, names, home addresses, and wage

information for employees who worked at and received wages from

Driveline during the time period of January 1 2016 to December 31,

2016. Driveline admits that this information is irretrievably lost, to

be used against its employees forever.

When Driveline realized that the email had been a phishing

attack, it notified the Federal Bureau of Investigation (“FBI”).

Driveline also provided the IRS with the names and Social Security

numbers (“SSNs”) of the affected employees so the IRS could impose

appropriate controls to prevent the filing of fraudulent returns.1

1 McGlenn states that she objects to the temporal characterization of the FBI

and IRS notifications being “immediately” or “within hours of the breach.” At

least with regards to the IRS notification, email documentation confirms that

Driveline notified the appropriate governmental authorities of all

fifty states, Guam, and Puerto Rico of the Disclosure.

Effective January 31, 2017, Driveline retained the services of

AllClear ID, a credit and identity theft prevention monitoring

service, to protect the employees whose personal identifying

information (“PII”) was involved in the Disclosure. All affected

employees were automatically enrolled in the base protection, called

“AllClear ID Identity Repair.” Any employee suspecting identity

theft could file a claim, and AllClear ID would provide identity and

credit remediation services. Additionally, employees were given the

opportunity to enroll for free for one year of enhanced services,

called “AllClear Credit Monitoring.” To obtain the enhanced

services, the employees had to contact AllClear ID and set up their

individual accounts.

Driveline waited to notify employees of the Disclosure until the

FBI gave Driveline the “green light.” On February 14, 2017, after

this information was sent to the IRS roughly two days after the phishing email

was sent. See January 27, 2017 Email Communications from S. Hasenfratz to

A. Douglas, attached as Exhibit 3 to Defendant’s Motion, d/e 84-3. The Court

finds that the dispute on temporal terminology, however, is not material to this

motion.

the FBI notified Driveline that issuing notice would not hinder the

FBI’s investigation, AllClear ID mailed a letter and supporting

materials on behalf of Driveline to all the employees involved in the

Disclosure.

McGlenn’s PII was part of the Disclosure. She received the

Disclosure notification letter, but McGlenn did not enroll in the free

enhanced credit monitoring offered by Driveline through AllClear

ID. Some Driveline employees involved in the Disclosure received

letters from the IRS requiring them to present to an IRS office in

person before filing their 2016 taxes, but McGlenn did not receive

such a letter. McGlenn does not claim that anyone attempted to file

a fraudulent tax return using her PII.

McGlenn, however, did experience some fraudulent activity on

her financial accounts after the Disclosure. Six months after the

Disclosure, someone tried to activate a Capital One credit card on

an account opened in her name. Capital One received a credit card

application that included McGlenn’s former married name (Lynn

Watts), her telephone number, her date of birth, address, and SSN

on or about July 20, 2017. A man attempted to activate the Capital

One account via telephone by providing McGlenn’s former name,

her telephone number, and her date of birth. McGlenn’s W-2 does

not contain her date of birth. Nor did the Disclosure reveal her

telephone number or former last names. Driveline never even knew

McGlenn’s former married name (Watts) because when she applied

for a job with Driveline, she was already married to Mr. McGlenn.

In December 2017, eleven months after the Disclosure,

someone used McGlenn’s Charlotte Metro Credit Union debit card

to incur a $252.79 charge. McGlenn confirmed that the

information at issue in the debit card charge, which included her

credit union account number, credit union name, credit card

numbers, and debit card numbers, were not part of the Driveline

Disclosure.

McGlenn also acknowledged that her data was stolen during

the Equifax data breach. As clarified in McGlenn’s response,

Equifax provided notice of the breach in September 2017, but the

breach itself occurred between May 2017 and July 2017. See d/e

86 at p. 3 (citing In re Equifax, Inc., Customer Data Sec. Breach

Litig., 362 F. Supp. 3d 1295, 1308 (N.D. Ga. 2019) (“On September

7, 2017, the Defendant Equifax Inc. announced that it was the

subject of one of the largest data breaches in history. From mid-

May through the end of July 2017, hackers stole the personal and

financial information of nearly 150 million Americans.”)). McGlenn

assumes that the Equifax data breach disclosed her SSN, her past

and present address, her date of birth, other names she has used in

the past, and the identities of her banks, lending institutions, and

past and present credit card issuers. Equifax, like Driveline, offered

free credit monitoring. McGlenn declined both offers because she

was already using Credit Karma.

McGlenn also highlights reports by the IRS and FBI warning

about certain frauds prior to the Disclosure. Driveline does not

dispute the facts surrounding these reports, but Driveline argues

that they are immaterial because there is no evidence that Driveline

had received, was aware of, or should have been aware of these

reports. First, on August 27, 2015, the FBI issued a report warning

of the increasingly common scam, known as Business Email

Compromise, in which companies had fallen victim to phishing

emails. The report called attention to the significant spike in

scams, also referred to as “spoofing,” in which emails that appear to

have been initiated from the CEO or other top-level executives

request employee W-2 or other personal information.

Second, on March 1, 2016, the IRS issued an alert to payroll

and human resources professionals warning of a scheme whereby

false emails, purportedly from one of the company’s chief officers,

were sent to individuals in the human resources or accounting

department asking for copies of W-2 data for all employees. The

alert stated:

The Internal Revenue Service today issued an alert to

payroll and human resources professionals to beware of

an emerging phishing email scheme that purports to be

from company executives and requests personal

information on employees.

The IRS has learned this scheme—part of the surge in

phishing emails seen this year—already has claimed

several victims as payroll and human resources offices

mistakenly email payroll data including Forms W-2 that

contain Social Security numbers and other personally

identifiable information to cybercriminals posing as

company executives.

Pl. Resp., Ex. 4, IRS March 1, 2016 Alert, d/e 86-4. The IRS

renewed this alert on January 25, 2017, specifically urging

“company payroll officials to double check any executive-level or

unusual requests for lists of Forms W-2 or Social Security

numbers.” Pl. Resp., Ex. 5, IRS January 25, 2017 Alert, d/e 86-5.

McGlenn also alleges these additional facts regarding the

training, or lack of training, that Driveline provided its employees:

• Before January 25, 2017, Susan Merciel, the Driveline

Payroll Department Manager who released Driveline

Employees’ W-2s, had no training from Driveline that

would have aided her in spotting a phishing email.

• Before January 25, 2017, Ms. Merciel had not been

trained or advised by Driveline that W-2 phishing

emails were being perpetrated on payroll departments.

• Before Driveline sent out its employees’ personal data,

its employees had not been trained to hover their

computer mouse over the sender’s name to see from

whom an email was sent.

• If Driveline’s employees had been so trained, Ms.

Merciel or any other employee receiving the spoofing

email would have seen that the request for employees

W-2 was coming not from Driveline’s CFO Lori

Bennett, whose Driveline email address had always

been “lbennett@drivelineretail.com,” but instead came

from fidelitycharitylaw@gmail.com.

• Ms. Merciel told another Driveline employee, Kristine

Fountain, that she had previously received a request

for W-2s in 2016, and that was why she did not find

the 2017 phishing email unusual.

• Before Driveline sent out employees’ personal data,

Driveline employees had not been trained to question a

request to email employees’ PII or to call the person

who was requesting via email a file containing the

sensitive personal financial information of employees

to confirm it was a real request.

• Prior to the Driveline Disclosure, Driveline’s CFO Lori

Bennett routinely requested confidential personal

information of employees be sent to her via email

without requiring or suggesting that the requested file

be encrypted or password protected.

• Prior to the Driveline Disclosure, Driveline employees

had not been trained to transfer sensitive and private

employee data in an encrypted file.

• Driveline employees handling the most sensitive

personal and financial information for the company’s

workforce had never been trained how to encrypt a file

or how to transfer sensitive and private employee

information in a password protected file.

• Following the Driveline Disclosure, some employees

were required to take a one-time computer training

course on identity theft. They were not required to

take the course annually.

While Driveline does not dispute these facts, Driveline argues that

the facts are immaterial to Driveline’s Motion for Summary

Judgment because Driveline argues it does not owe a duty to its

employees to safeguard their PII.

II. PROCEDURAL BACKGROUND

The Complaint for this action was originally brought by Shirley

Lavender, individually and on behalf of all others similarly situated,

against Driveline. However, Plaintiff Lavender filed a Motion for

Leave to Substitute Class Representative and for Leave to File an

Amended Class Action Complaint in Accordance with the

Substitution. See d/e 34. On September 6, 2019, the Court

granted Plaintiff Lavender’s Motion for Leave to Substitute. See

Order, d/e 43. On September 10, 2019, Plaintiff Lynn McGlenn

was substituted as Plaintiff in this case when she filed an Amended

Complaint. See Amended Complaint, d/e 44. McGlenn has filed

claims for negligence (Count I), invasion of privacy (Count II),

breach of implied contract (Count III), breach of fiduciary duty

(Count IV), violation of Illinois Personal Information Protection Act

(“IPIPA”) (Count V), and violation of Illinois Consumer Fraud and

Deceptive Business Practices Act (“ICFA”) (Count VI) against

Driveline. McGlenn seeks a mandatory injunction directing

Driveline to adequately safeguard the PII of employees by

implementing improved security procedures and measures and to

provide adequate notice to each employee relating to the full nature

and extent of the Disclosure and ordering Driveline to pay an award

of monetary damages. See d/e 44. On January 19, 2021, the

Court denied McGlenn’s Renewed Motion for Class Certification.

See Opinion and Order, d/e 87.

Driveline filed this Motion for Summary Judgment (d/e 84) on

December 14, 2020, and moves for summary judgment on all of

McGlenn’s individual claims. McGlenn filed a response (d/e 86) on

January 15, 2021, in which she agreed summary judgment was

appropriate for her invasion of privacy claim, see d/e 86 at p. 2,

n.1, but otherwise opposed summary judgment. Driveline filed its

reply (d/e 88) on January 29, 2021.

III. JURISDICTION AND VENUE

McGlenn invokes jurisdiction under the Class Action Fairness

Act, 28 U.S.C. § 1332(d) (“CAFA”). The CAFA provides federal

courts with jurisdiction over certain class actions if the class has

more than 100 members, the parties are minimally diverse, and the

amount in controversy exceeds $5 million, exclusive of interest and

costs. 28 U.S.C. § 1332(d)(2), (5)(B); Standard Fire Ins. Co. v.

Knowles, 568 U.S. 588, 592 (2013). The claims of the individual

class members are aggregated to determine whether the amount in

controversy threshold is met. 28 U.S.C. § 1332(d)(6).

McGlenn’s Amended Complaint alleged that the aggregate

amount in controversy exceeds $5 million, exclusive of interest and

costs, that there are more than 100 class members, and that at

least one class member is a citizen of a state different from

Driveline. See Amended Complaint, d/e 44, ¶ 3. McGlenn is a

citizen of North Carolina. Id., ¶ 1. Driveline has indicated that

Driveline is a citizen of New Jersey and Texas because Driveline is

incorporated in New Jersey and has its principal place of business

in Texas. See Defendant’s Declaration of State of Incorporation and

Principal Place of Business, d/e 42.

Moreover, the Court retains jurisdiction over the case

pursuant to 28 U.S.C. § 1332(d) even though the Court has now

denied Plaintiff’s Motion for Class Certification. See Cunningham

Charter Corp. v. Learjet, Inc., 592 F.3d 805 (7th Cir. 2010) (“Federal

jurisdiction under the Class Action Fairness Act does not depend on

certification”). Therefore, the Court finds that the Court continues

to have subject-matter jurisdiction.

IV. LEGAL STANDARD

Summary judgment is proper if the movant shows that no

genuine dispute exists as to any material fact and that the movant

is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a).

The movant bears the initial responsibility of informing the Court of

the basis for the motion and identifying the evidence the movant

believes demonstrates the absence of any genuine dispute of

material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). A

genuine dispute of material fact exists if a reasonable trier of fact

could find in favor of the nonmoving party. Marnocha v. St. Vincent

Hosp. & Health Care Ctr., Inc., 986 F.3d 711, 718 (7th Cir. 2021).

When ruling on a motion for summary judgment, the Court

must construe all facts in the light most favorable to the non-

moving party and draw all reasonable inferences in that party’s

favor. King v. Hendricks Cty. Commissioners, 954 F.3d 981, 984

(7th Cir. 2020). A movant may demonstrate the absence of a

genuine dispute through specific cites to admissible evidence or by

showing that the nonmovant “cannot produce admissible evidence

to support the [material] fact.” Fed. R. Civ. P. 56(c)(1). If the

movant clears this hurdle, the nonmovant may not simply rest on

his or her allegations in the complaint, but instead must point to

admissible evidence in the record to show that a genuine dispute

exists. Id.; Harvey v. Town of Merrillville, 649 F.3d 526, 529 (7th

Cir. 2011).

V. ANALYSIS

Driveline argues that it is entitled to summary judgment on all

of the claims brought by McGlenn (negligence (Count I), invasion of

privacy (Count II), breach of implied contract (Count III), breach of

fiduciary duty (Count IV), violation of Illinois Personal Information

Protection Act (“IPIPA”) (Count V), and violation of Illinois Consumer

Fraud and Deceptive Business Practices Act (“ICFA”) (Count VI)).

McGlenn agrees that her invasion of privacy claim (Count II) is

subject to summary judgment. Accordingly the Court grants

summary judgment for Driveline on this claim. Further, the Court

agrees with Driveline that summary judgment is appropriate on

McGlenn’s remaining claims.

A. Driveline is Entitled to Summary Judgment on

McGlenn’s Illinois Common Law Tort Claims.

As an initial matter, the Court finds that McGlenn has waived

any arguments that Illinois law does not apply. McGlenn has

previously argued that Illinois law applies to her common law

claims. See Plaintiff’s Memorandum of Law In Support of Renewed

Motion for Summary Judgment, d/e 52-1 at p.16. While Driveline

has previously questioned whether the law of Illinois or North

Carolina (the state of McGlenn’s residence and where she worked

while employed by Driveline) applies, see Defendant’s Objection to

Plaintiff’s Renewed Motion for Class Certification, d/e 54, p.36,

n.25, Driveline’s Motion for Summary Judgment assumes that

Illinois law does apply. It is not clear from the facts of this case

that Illinois law would necessarily apply given that neither McGlenn

nor Driveline are Illinois residents and any harm to McGlenn did

not occur in Illinois. Nonetheless, McGlenn did not raise the

choice-of-law issue in her response, and the Court finds that the

argument is now waived. See Ward v. Soo Line R.R. Co., 901 F.3d

868, 880 (7th Cir. 2018) (“The choice-of-law issue is waived if a

party fails to raise it.”).

Applying Illinois law, Driveline argues that McGlenn cannot

succeed on her negligence claim because Driveline does not have a

duty under Illinois law to safeguard McGlenn’s PII. Driveline argues

that McGlenn cannot succeed on her breach of fiduciary duty claim

because she has not established that Driveline owed her a fiduciary

duty. Driveline also argues that the economic loss doctrine bars

recovery of any tort damages.

1. McGlenn Cannot Prove Negligence Because Driveline

Does Not Have a Duty Under Illinois Law to

Safeguard McGlenn’s PII.

To show negligence under Illinois law, a plaintiff must prove

“that the defendant owed a duty to the plaintiff, that defendant

breached that duty, and that the breach was the proximate cause of

the plaintiff’s injuries.” Blood v. VH-1 Music First, 668 F.3d 543,

546 (7th Cir. 2012) (quoting First Springfield Bank & Trust v.

Galman, 188 Ill.2d 252, 242 Ill.Dec. 113, 720 N.E.2d 1068, 1071

(1999)). Driveline argues that under Illinois law, Driveline did not

owe any duty to McGlenn to safeguard her PII. While the Illinois

Supreme Court has not spoken on this issue, the Seventh Circuit in

Cmty. Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803,

816 (7th Cir. 2018), found that the defendant retailer, Schnuck

Markets, did not owe a duty to the customer’s banks under Illinois

law when Schnucks suffered a major breach of its customers’ data.

See also Perdue v. Hy-Vee, Inc., 455 F. Supp. 3d 749, 757-58 (C.D.

Ill. 2020). The Seventh Circuit relied on the Illinois appellate case

of Cooney v. Chicago Pub. Sch., 407 Ill. App. 3d 358, 363, 943

N.E.2d 23, 29 (2010) in reaching its holding. In Cooney, the city

board of education, through a third party, had mistakenly sent PII

of former school employees in a mailing. Cooney, 407 Ill. App. at

363. In declining to create a new common law duty, the Illinois

appellate court emphasized that “[w]hile we do not minimize the

importance of protecting this information, we do not believe that the

creation of a new legal duty beyond legislative requirements already

in place is part of our role on appellate review. As noted, the

legislature has specifically addressed the issue and only required

the Board to provide notice of the disclosure.” Id. The Seventh

Circuit in Cmty. Bank of Trenton interpreted Cooney as “a more

general statement that no duty to safeguard personal information

existed, regardless of the kind of loss” and predicted “that the state

court would not impose the common law data security duty the

plaintiff banks call for here.” Cmty. Bank of Trenton, 887 F.3d at

817.

McGlenn attempts to distinguish Cooney based on the way the

information was disclosed, arguing the disclosure in Cooney was a

“mistake,” whereas the disclosure here “was the foreseeable

consequence of the defendant’s actions and failure to act.” See d/e

86 at p. 11. McGlenn points to cases applying Georgia law and

argues that this Court should find Illinois law would recognize the

existence of a similar common law duty when the disclosure was

foreseeable. See d/e 86 at p. 11-12 (citing In re Equifax, Inc.,

Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295 (N.D. Ga.

2019); In re: The Home Depot, Inc. Customer Data Sec. Breach

Litig., 2016 WL 2897520, at *3 (N.D. Ga. May 18, 2016); In re

Arby’s Restaurant Grp. Inc. Litig., 2018 WL 2128441, at *5 (N.D.

Ga. Mar. 5, 2018)). However, while these cases highlight important

policy reasons why a company should be required to safeguard PII,

McGlenn does not explain how these cases would allow the Court to

ignore the Seventh Circuit’s holding in Cmty. Bank of Trenton.

Moreover, McGlenn’s distinction between a “mistake” and a

“foreseeable consequence” does not address Cooney’s rationale that

courts should not impose “a new legal duty beyond legislative

requirements.” Cooney, 407 Ill. App. at 363. Regardless of whether

the data breach was foreseeable or merely a “mistake,” the Court

finds that Illinois does not impose a common law duty to safeguard

PII.

McGlenn also argues that, even if no common law duty exists,

a statutory duty now exists. As the court noted in Cooney, “a

violation of a statute designed to protect human life and property

may be used as prima facie evidence of negligence.” 407 Ill.App.3d

at 361. In Cooney, the court rejected the plaintiffs’ argument that a

statutory duty existed under Illinois Personal Information Protection

Act (“PIPA”) because PIPA only requires a data collector to provide

notice of a breach. Id. at 363; see also Cmty. Bank of Trenton, 887

F.3d at 816 (noting Cooney’s conclusions).

However, McGlenn highlights that in 2017, after Cooney, the

Illinois legislature amended PIPA. Specifically, PIPA now includes a

section that provides:

A data collector that owns or licenses, or maintains or

stores but does not own or license, records that contain

personal information concerning an Illinois resident shall

implement and maintain reasonable security measures to

protect those records from unauthorized access,

acquisition, destruction, use, modification, or disclosure.

815 ILCS § 530/45(a) (emphasis added). Driveline argues that this

provision is irrelevant in light of the Seventh Circuit’s decision in

Cmty. Bank of Trenton, which is binding on this Court. However,

the data breach at issue in Cmty. Bank of Trenton occurred in

2012, so the 2017 amendments to PIPA were not relevant to the

Seventh Circuit’s analysis in Cmty. Bank of Trenton.

Nonetheless, the Court finds that the 2017 amendments to

PIPA do not change the result here. While Driveline qualifies as a

“data collector” under the broad definition of the act, see 815 ILCS

530/5, Driveline’s duty under this provision is expressly limited to

Illinois residents. McGlenn is not an Illinois resident—she is a

North Carolina resident. McGlenn has not responded to Driveline’s

argument that PIPA does not protect non-Illinois residents, nor has

she otherwise attempted to explain how this provision could be

interpreted to create a duty to safeguard a non-resident’s PII.

Accordingly, the Court finds that Driveline is entitled to summary

judgment on McGlenn’s negligence claim because Driveline did not

owe a duty under Illinois law to safeguard McGlenn’s PII.

2. McGlenn Cannot Show a Breach of Fiduciary Duty

Because Driveline did not have a Fiduciary Duty to

Protect McGlenn’s PII.

To establish a claim for breach of fiduciary duty under Illinois

law, McGlenn “must prove the existence of a fiduciary duty, breach

of that duty, and damages proximately resulting from that

breach.” Autotech Tech. Ltd. P’ship v. Automationdirect.com, 471

F.3d 745, 748 (7th Cir. 2006) (citing Neade v. Portes, 193 Ill.2d 433,

739 N.E.2d 496, 502, 250 Ill.Dec. 733 (Ill. 2000)). A fiduciary duty

exists under Illinois law either “as a matter of law from the

relationship of the parties (such as an attorney-client relationship),

or based on the facts of a particular situation, such as a

relationship where confidence and trust is reposed on one side,

resulting in dominance and influence on the other side.” Dahlin v.

Evangelical Child & Family Agency, 252 F. Supp. 2d 666, 669 (N.D.

Ill. 2002) (citations omitted).

McGlenn does not argue that a fiduciary duty exists as a

matter of law, but rather that a fiduciary duty exists because

McGlenn was required to entrust Driveline with her sensitive

personal information as a condition of gaining and maintaining her

employment. However, in Cooney, the Illinois appellate court found

that there is no fiduciary duty created when an employee provides

an employer with information “in confidence.” 407 Ill. App. 3d at

363; Landale Signs & Neon, Ltd. v. Runnion Equip. Co., No. 16-cv-

7619, 2016 WL 7409916, at *4 (N.D. Ill. Dec. 22, 2016). McGlenn

has not attempted to distinguish Cooney and does not provide

caselaw to support her argument.

McGlenn does, however, acknowledge that under Illinois law

“trust and confidence are not enough to create a fiduciary

relationship; superiority and influence must result from the trust

and confidence.” Tummelson v. White, 47 N.E.3d 579, 584 (Ill.

App. Ct. 2015). In Tummelson, the Illinois appellate court further

explained that a fiduciary relationship exists where “trust and

confidence are reposed by one person in another who, as a result

thereof, gains influence and superiority over the other. . . significant

dominance and superiority [are] necessary to establish a fiduciary

relationship.” . . .“Dominance,” in this context, means “the ability to

exercise undue influence.” Id. (internal citations and quotations

omitted). In Tummelson, the court found no fiduciary relationship

existed between a homeowner and cohabitant merely because the

cohabitant contributed money toward the mortgage of the house

and he trusted that this would result in his ability to continue to

reside at the house. Id. Rather, the court found that the

dominance that the homeowner had over the cohabitant (to evict

the cohabitant if she chose) was “merely the dominance that a

licenser typically has over a licensee.” Id.

Here, McGlenn argues that she put trust in Driveline to

safeguard her PII and that, as her employer, Driveline had

superiority and influence. But it is not enough that superiority and

influence generally exists in the relationship. The superiority and

influence must result from the trust and confidence. McGlenn

trusted Driveline with her PII because it was required as a condition

of employment. Moreover, McGlenn has not explained how

Driveline gained dominance or “undue influence” over McGlenn

because of the information McGlenn provided. Like Tummelson,

the “dominance” that existed was typical for the type of relationship

(employer-employee) that McGlenn and Driveline had. Accordingly,

the Court finds that Driveline is entitled to summary judgment on

McGlenn’s breach of fiduciary duty claim.

3. The Court Declines to Determine Whether the

Economic Loss Doctrine Applies.

Driveline also argues that it is entitled to summary judgment

on McGlenn’s tort claims because her damages are barred under

the economic loss doctrine. In addressing tort claims in commercial

litigation, “state courts have generally refused to recognize tort

liabilities for purely economic losses inflicted by one business on

another where those businesses have already ordered their duties,

rights, and remedies by contract.” Cmty. Bank of Trenton, 887

F.3d at 812. “Courts invoking the economic loss rule trust the

commercial parties interested in a particular activity to work out an

efficient allocation of risks among themselves in their contracts.

Courts see no reason to intrude into the parties’ allocation of the

risk when bargaining should be sufficient to protect the parties’

interests, and where additional tort law remedies would act as

something of a wild card to upset their expectations.” Id. (internal

quotations omitted).

In Illinois, the economic loss rule is known as the Moorman

Doctrine. Id. (citing Moorman Mfg. Co. v. Nat’l Tank Co., 91 Ill. 2d

69, 435 N.E.2d 443 (1982)). “Illinois recognizes three exceptions,

but none applies here: for personal injuries or property damage

resulting from sudden or dangerous occurrences, for fraud, and for

negligent misrepresentations by professional business advisors.”

Id. at 813. In Cmty. Bank of Trenton, the Seventh Circuit held that

the Illinois’ economic loss rule barred the tort claims alleged by the

customers’ banks as a result of a grocery chain’s data breach. Id.

(“The plaintiff banks are disappointed in the amounts the card

networks’ contractual reimbursement process provided. That type

of tort claim is not permitted under Moorman.”).

McGlenn argues that the Seventh Circuit and other federal

courts have reached the wrong answer when they “reflexively

applied the economic loss rule to negligence claims” because they

did not perform any analysis about whether the principles behind

the economic loss rule apply to data breaches. McGlenn draws

support from In re Marriott International, Inc., Customer Data

Security Breach Litigation, 440 F. Supp. 3d 447, 473 (D. Md. 2020),

which noted that the Illinois Supreme Court has not yet addressed

whether the economic loss rule would apply to data breaches. The

district court in In re Marriott Int’l, Inc., Customer Data Sec.

Breach Litig. found that “the rule’s development suggests that its

historical roots in products liability are not a close fit with the

injuries that arise in the context of data breaches like this one,

which casts doubt on how it would be applied by the Illinois

Supreme Court.” In re Marriott Int’l, Inc., Customer Data Sec.

Breach Litig., 440 F. Supp. 3d at 469.

While the analysis by the district court in In re Marriott Int’l,

Inc., Customer Data Sec. Breach Litig. is well-reasoned, the Court

must not disregard the Seventh Circuit’s binding precedent in

Cmty. Bank of Trenton which found that the economic loss rule did

apply to data breaches. However, the Court notes that Cmty. Bank

of Trenton was litigation between two commercial entities: a grocery

store chain that had a data breach of its customers’ data, and the

banks of the customers whose data was breached. Here, where

McGlenn is a former employee of Driveline and provided her PII as a

legal condition of employment, the economic loss rule would be

stretched significantly further from its product liability roots than

the application of the rule in Cmty. Bank of Trenton. Regardless, as

the Court finds that Driveline is entitled to summary judgment on

its tort claims due to an absence of duty, the Court declines to also

determine whether the economic loss doctrine would bar McGlenn’s

claims.

B. McGlenn Has Not Shown Sufficient Evidence That

Driveline Proximately Caused Her Present Injuries For

Her Tort or Contract Claims.

Driveline next argues that McGlenn cannot succeed on any of

her common law claims—including her breach of implied contract

claim—because she has not established proximate cause that the

Disclosure caused her present injuries, and an increased risk of

future harm alone is insufficient to show damages. McGlenn does

not dispute that, under Illinois law, an increased risk of future

harm alone is insufficient to show damages. See also, Rowe v.

UniCare Life & Health Ins. Co., No. 09 C 2286, 2010 WL 86391, at

*6 (N.D. Ill. Jan. 5, 2010) (applying Illinois law and concluding that

the plaintiff in a data breach action “may collect damages based on

the increased risk of future harm he incurred, but only if he can

show that he suffered from some present injury beyond the mere

exposure of his information to the public.”); Williams v. Manchester,

228 Ill. 2d 404, 425, 888 N.E.2d 1, 13 (2008) (“[A]n increased risk of

future harm is an element of damages that can be recovered for a

present injury—it is not the injury itself.” (emphasis in original)).

Accordingly, standing alone, McGlenn’s allegation that she is at an

increased risk of future identity theft is insufficient to show

damages.

Nonetheless, McGlenn argues that she has suffered two

incidents of identity theft that qualify as present injuries: First, six

months after receiving the notice of the data breach from Driveline,

Plaintiff was alerted that someone used her PII to open a new credit

card account with Capital One. Second, approximately eleven

months after the breach, a fraudulent charge of $252.79 was made

on her debit card. However, the Court agrees that McGlenn has not

shown that Driveline caused these present injuries.

In tort law, as well as with breaches of contracts, a defendant

is only liable for damages the breach caused. See In re: Emerald

Casino, Inc., 867 F.3d 743, 755 (7th Cir. 2017). In Illinois,

causation is referred to as proximate causation and has two

components: legal cause and cause in fact. Id. (citing Young v.

Bryco Arms, 213 Ill.2d 433, 290 Ill.Dec. 504, 821 N.E.2d 1078,

1085–1086 (2004)). Here, only cause in fact is at issue. To show

cause in fact, a plaintiff must show that “there is a reasonable

certainty that a defendant’s acts caused the injury or damage.” In

re: Emerald Casino, Inc., 867 F.3d at 755. In Illinois, two tests are

used to determine cause in fact. First, under the traditional “but-

for” test, “a defendant’s breach is a cause in fact of damages if the

damages would not have occurred had the defendant not breached

the contract” or breached its duty. Id. Second, “a defendant’s

breach is a cause in fact of damages ‘if it was a material element

and a substantial factor in bringing the event about.’” Id. (internal

citations omitted). McGlenn argues that the substantial-factor test

applies here, which is used “when multiple defendants caused the

damages so that no one defendant could be considered a but-for

cause.” Id.

Driveline argues that McGlenn has not produced sufficient

evidence for a jury to find that Driveline’s Disclosure caused the two

incidents of identity theft. The only evidence McGlenn has

presented tying the Driveline Disclosure to the incidents of identity

theft is that the identity theft incidents occurred a few months after

the Driveline Disclosure. Driveline highlights that McGlenn was

also involved in the Equifax breach, which revealed more of

McGlenn’s PII than the Driveline Disclosure did and included the

identity of her financial institutions and credit card companies.

Moreover, Driveline highlights that the individual who attempted to

open a new credit card at Capital One used her former last name,

her current telephone number, and her date of birth—none of

which was included in the Driveline Disclosure. Further,

Driveline’s Disclosure did not reveal the identity of her credit union,

the debit-card number, or account information used in the

fraudulent charge on McGlenn’s debit card

At the initial pleading stage, allegations that data was

disclosed and that McGlenn later suffered identity theft would be

sufficient to survive a motion to dismiss. See, e.g., Remijas v.

Neiman Marcus Grp., LLC, 794 F.3d 688, 696 (7th Cir. 2015)

(finding that to survive a motion to dismiss, it is sufficient that

defendant “admitted that 350,000 cards might have been exposed

and that it contacted members of the class to tell them they were at

risk. Those admissions and actions by the store adequately raise

the plaintiffs’ right to relief above the speculative level.”); Lewert v.

P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 969 (7th Cir. 2016).

See also In re Zappos.com, Inc., 888 F.3d 1020, 1029 (9th Cir.

2018) (“That hackers might have stolen Plaintiffs’ PII in unrelated

breaches, and that Plaintiffs might suffer identity theft or fraud

caused by the data stolen in those other breaches (rather than the

data stolen from Zappos), is less about standing and more about

the merits of causation and damages.”).

However, at the summary judgment phase more than these

allegations is needed. Under Illinois law, at the summary judgment

phase, facts cannot “be established from circumstantial evidence

where more than one conclusion can be drawn. . . If plaintiff relies

upon circumstantial evidence to establish proximate cause to defeat

a motion for summary judgment, the circumstantial evidence must

be of such a nature and so related as to make the conclusion more

probable as opposed to merely possible.” Majetich v. P.T. Ferro

Const. Co., 389 Ill. App. 3d 220, 224–25, 906 N.E.2d 713, 718

(2009) (internal citations omitted); Garland v. Sybaris Clubs Int’l,

Inc., 141 N.E.3d 730, 764 (Ill. Ct. App. 2019) (“Cause in fact exists

where there is a reasonable certainty that a defendant's acts caused

the injury or damage.”).

As McGlenn notes, “[i]f there are multiple companies that

could have exposed the plaintiffs’ private information to the

hackers, then the common law of torts has long shifted the burden

of proof to defendants to prove that their negligent actions were not

the “but-for” cause of the plaintiff's injury.” Remijas v. Neiman

Marcus Grp., LLC, 794 F.3d 688, 696 (7th Cir. 2015) (citation and

internal quotation marks omitted). But, McGlenn’s incidents of

identity theft necessarily relied on PII that was not disclosed in

Driveline’s Disclosure. The obvious implication is that the thieves

could not have relied on Driveline’s Disclosure alone to commit the

incidents of identity theft. And McGlenn does not dispute that at

least the Equifax data breach would have exposed all the

information that was needed to commit these incidents of identity

theft. Moreover, data breaches have become increasingly common.

McGlenn has not presented any evidence that Driveline’s Disclosure

was involved in her incidents of identity theft beyond the fact that

Driveline’s Disclosure happened prior to these incidents.

Understandably, neither McGlenn nor Driveline has been able

to determine who committed the identity thefts and determine

where they got the information used. But, especially in light of the

fact that Driveline’s Disclosure did not provide all the information

used to commit the incidents of identity theft, McGlenn needed to

present some evidence of causation other than temporal proximity

for a reasonable jury to find Driveline responsible for her injuries.

Any finding in McGlenn’s favor would be merely speculative. See

also Walker v. Macy’s Merchandising Group, Inc., 288 F. Supp. 3d

840, 856 (N.D. Ill. 2017) (under Illinois law, “[p]roximate cause is

not established, however, where the causal connection is

contingent, speculative or merely possible.” (internal citations

omitted)). See also, Nolan v. Weil-McLain, 233 Ill. 2d 416, 431, 910

N.E.2d 549, 557 (2009) (“Illinois courts have, as a matter of law,

refused to allow a plaintiff to take the causation question to the jury

when there is insufficient evidence for the jury to reasonably find

that the defendant’s conduct was a cause of the plaintiff’s harm or

injury.”).

Because McGlenn’s only remaining alleged harm is her alleged

increased risk of future identity theft, which she concedes is

insufficient on its own to entitle her to damages, Driveline is

entitled to summary judgment on McGlenn’s tort and contract

claims under Illinois law.

C. Driveline is Entitled to Summary Judgment on

McGlenn’s Statutory Claims.

McGlenn also claims that Driveline violated the Illinois

Personal Information Protection Act (“PIPA”) and the Illinois

Consumer Fraud and Deceptive Business Practices Act (“ICFA”).

Driveline argues that it met the Notice requirements of PIPA and,

therefore, McGlenn cannot prove a violation of PIPA. In her

response, McGlenn clarifies that the basis of her PIPA claim is not

the notice requirements but, rather, the 2017 amendments. As

stated above, these amendments require that a data collector that

“maintains or stores . . . records that contain personal information

concerning an Illinois resident shall implement and maintain

reasonable security measures to protect those records from

unauthorized access, acquisition, destruction, use, modification, or

disclosure.” 815 ILCS § 530/45(a) (emphasis added).

However, McGlenn fails to respond to Driveline’s other

argument regarding PIPA: McGlenn is a North Carolina resident.

Even if McGlenn can show that Driveline failed to “implement and

maintain reasonable security measures to protect” her PII from

disclosure, she will not have shown a PIPA violation because she is

not an Illinois resident.

Driveline is also entitled to summary judgment for McGlenn’s

final claim: a violation ICFA. McGlenn argues that Driveline

violated ICFA because a violation of PIPA “constitutes an unlawful

practice under the Consumer Fraud and Deceptive Business

Practices Act.” 815 ILCS § 530/20. However, because the Court

finds that Driveline did not violated PIPA as to McGlenn, McGlenn

also cannot show a violation of ICFA. Accordingly, the Court finds

that Driveline is entitled to summary judgment on McGlenn’s

Illinois statutory claims as well.

VI. CONCLUSION

For the reasons set forth above, the Court GRANTS

Defendant’s Motion for Summary Judgment (d/e 84). The Court

DIRECTS the Clerk to enter judgment in favor of Defendant

Driveline. This order terminates the case.

ENTERED: September 21, 2021

FOR THE COURT:

/s/ Sue E. Myerscough

SUE E. MYERSCOUGH

UNITED STATES DISTRICT JUDGE