Hall v. Centerspace, LP

Background

Centerspace LP learned in November 2021 that hackers had accessed its computer systems, including files that potentially contained personal identifying information. The company notified potentially affected people, including Gary Hall, in July 2022. The breach allegedly affected 8,190 people, including current and former employees and tenants.

Hall alleged that Centerspace failed to use reasonable cybersecurity measures, failed to train employees adequately, delayed notifying affected people, and failed to follow relevant Federal Trade Commission recommendations. He alleged that he and the proposed class experienced or faced risks including time spent monitoring accounts, anxiety, loss of control over personal information, diminished information value, and identity-theft-related expenses.

Hall asserted claims for negligence, breach of an implied contract, unjust enrichment, and declaratory judgment. He sought class certification, damages, restitution, and declaratory and injunctive relief. The defendants moved to dismiss under Rules 12(b)(1) and 12(b)(6). Rule 12(b)(1) concerns the court’s subject-matter jurisdiction; Rule 12(b)(6) concerns whether a complaint states a legally sufficient claim.

Standing and Forward-Looking Relief

The court held that Hall lacked standing—a required connection between the plaintiff’s injury, the challenged conduct, and the requested relief—to pursue forward-looking declaratory and injunctive relief. Hall had not alleged facts showing that another data breach was certainly impending or that there was a substantial risk of one occurring. The court therefore dismissed those portions of Count IV without prejudice for lack of subject-matter jurisdiction.

The court did not dismiss any request for retrospective declaratory relief because the parties’ briefing did not address that aspect of Count IV. The court also granted the motion, based on Hall’s agreement, to dismiss his claims against Centerspace, Inc. without prejudice. The order thereafter referred to Centerspace LP as “Centerspace.”

Implied-Contract Claim

Applying Minnesota law, the court found that Hall plausibly alleged an implied contract. He alleged that Centerspace required him to provide personal information as part of his employment relationship and implicitly agreed to safeguard that information under its policies and applicable law. He also alleged facts that could support a breach, including inadequate security training, failure to follow security practices, and delayed notice of the breach.

The court rejected the defendants’ argument that the complaint failed to allege damages. Hall alleged that the breach placed his information at risk, diminished its value, and caused him to spend time monitoring his accounts, while also causing anxiety and other emotional harms. The motion to dismiss the implied-contract claim was denied.

Unjust-Enrichment Claim

The court dismissed Count III for failure to state a claim. Under Minnesota law, unjust enrichment requires a benefit conferred on the defendant, the defendant’s knowing acceptance of that benefit, and circumstances making retention of the benefit unjust or inequitable.

The court concluded that Hall did not plausibly allege that providing his personal information or performing employment services conferred a benefit on Centerspace in exchange for greater data protection. The complaint did not allege that employees provided more valuable services for better security or that tenants paid more rent to obtain greater data protection. The order dismissed the unjust-enrichment claim but did not specify “without prejudice” or “with prejudice.”

Negligence Claim

The court held that Hall adequately alleged damages for negligence. His allegations included a present and future risk of identity theft, diminished value of his personal information, time spent monitoring accounts, emotional harms, and harm allegedly resulting from delayed notice of the breach. The court found these allegations sufficient at the motion-to-dismiss stage and denied the motion as to the negligence claim.

Disposition

The court stated that the defendants’ motion to dismiss was “GRANTED IN PART and DENIED IN PART.” Specifically, it dismissed Hall’s claims against Centerspace, Inc. without prejudice; dismissed without prejudice the forward-looking declaratory and injunctive relief for lack of subject-matter jurisdiction; dismissed the unjust-enrichment claim for failure to state a claim; and denied the motion in all other respects. Judge Katherine Menendez did not decide ultimate liability or the merits of any surviving claim.