Bohnak v. Marsh & McLennan Companies, Inc.

Background

The case arose from a 2021 data breach involving the defendants, which the opinion describes as two New York-based corporate entities. The breach allegedly exposed the personally identifiable information of at least 7,000 individuals. Shantel Jones and Nancy Bohnak were former employees of the defendants.

The amended complaint asserted four counts: Bohnak’s individual negligence claim in Count I; Jones’s proposed class negligence claim in Count II; Bohnak’s individual implied-contract claim in Count III; and Jones’s proposed class implied-contract claim in Count IV. The plaintiffs alleged that the defendants failed to protect their personal information and that the breach caused losses including identity-theft-related expenses, lost time, diminished information value, and continuing risks to their information.

The defendants moved to dismiss under Federal Rule of Civil Procedure 12(b)(1), which concerns the court’s subject-matter jurisdiction, and Rule 12(b)(6), which concerns whether a complaint states a legally sufficient claim.

Jones’s Negligence Claim

The court first addressed which state’s law governed Jones’s negligence claim. It found an actual conflict between New York and Iowa law because New York does not require an economic loss in data-breach negligence cases, while Iowa’s law generally bars negligence recovery when the plaintiff suffered only economic loss.

Applying New York’s choice-of-law rules, the court held that Iowa law governed because Jones’s injuries occurred in Iowa, the state of her domicile. The court concluded that the damages alleged in Count II—including identity-theft-related expenses, credit-freeze costs, future mitigation costs, and emotional distress tied to the economic injuries—were barred by Iowa’s economic-loss rule. The court therefore granted the motion to dismiss Count II.

Jones’s Implied-Contract Claim

The court also found a conflict between New York and Iowa law concerning Jones’s implied-contract claim. It held that New York law governed Count IV because New York was the site of the defendants’ principal place of business and had the most significant relationship to the security failures alleged in the complaint.

Under New York law, an implied contract may be inferred from the parties’ conduct. The court held that Jones adequately alleged the elements of such a claim: the defendants required employees to provide personal information as a condition of employment; the plaintiffs provided it; the defendants allegedly failed to safeguard it and failed to provide timely notice of the breach; and the plaintiffs allegedly suffered damages. The court therefore denied the motion to dismiss Count IV.

Bohnak’s Individual Claims

The court held that Bohnak’s individual claims did not satisfy the amount-in-controversy requirement for federal diversity jurisdiction. The opinion states that Bohnak’s damages were limited to $24.99 per month for credit-monitoring services, which would not meet the statutory requirement even if incurred for 100 years.

The court also declined to exercise supplemental jurisdiction, meaning jurisdiction over related state-law claims, because Bohnak’s individual claims substantially predominated over Jones’s remaining claim. The court said that resolving Bohnak’s claims would require a separate choice-of-law analysis and would cause the case to proceed on two tracks. It dismissed Bohnak’s individual negligence and implied-contract claims without prejudice and dismissed Bohnak as an individual plaintiff from the action.

Disposition

The court granted the defendants’ motion to dismiss as to Jones’s Count II negligence claim and Bohnak’s Counts I and III individual claims. It denied the motion as to Jones’s Count IV implied-contract claim. Jones was directed to file a second amended complaint within five days, and the defendants were directed to answer it within fourteen days after filing. The court also scheduled a telephone status conference for July 11, 2025.