Patrick Stokes, individually and on behalf of all others similarly situated v. A.Y. McDonald Industries, Inc.

Summary

The United States District Court for the Northern District of Iowa considers A.Y. McDonald Industries’ motion to dismiss claims arising from a January 2025 data breach involving current and former employees’ personal information. The court predicts that Iowa’s economic loss rule bars the plaintiff’s negligence claim, but concludes that the plaintiff plausibly pleaded implied-contract and unjust-enrichment claims at the motion-to-dismiss stage.

Holdings

1. Under Iowa law, the economic loss rule bars Stokes's negligence claim because the alleged injuries arising from the data breach, including diminution in the value of personally identifiable information, emotional distress, lost time, loss of privacy, and mitigation expenses, are not sufficient to take the claim outside the rule.
2. Stokes plausibly alleged that an implied contract existed under which A.Y. McDonald Industries agreed to safeguard employees' personally identifiable information, and the complaint sufficiently alleged consideration at the pleading stage.
3. Stokes plausibly alleged breach of the implied contract because he identified specific security measures A.Y. McDonald Industries allegedly failed to employ, including encryption and deletion of former employees' personally identifiable information.
4. Stokes plausibly alleged unjust enrichment in the alternative to his implied-contract claim because he alleged that A.Y. McDonald Industries received benefits associated with his labor and retained funds that should have been used for data-security measures.

Questions Presented

1. Whether Iowa's economic loss rule bars Stokes's negligence claim arising from the alleged theft of personal data.
2. Whether Stokes plausibly alleged the existence and breach of an implied contract requiring A.Y. McDonald Industries to safeguard employee personally identifiable information.
3. Whether Stokes plausibly alleged unjust enrichment based on the company's alleged retention of funds that should have been used for data-security measures.

Disposition

other