8th Circuit ruling reveals importance of nuance in state data incident law


Data privacy litigators are well aware of the critical importance of a motion to dismiss if unsubstantiated data incident claims are to be dismissed at the oral argument stage. A recent decision underlines the crucial importance of choice of law arguments as part of an overall litigation strategy. Why? Well, in some cases, the differences between the laws of two states regarding frequently contested data incident claims can be determinative for the purposes of a motion to dismiss. Read on to find out more.

First of all, a little background. It is well established that federal courts sitting in diversity apply the conflict of law rules of the forum state. For example, in Greenstate Credit Union v. Hy-Vee, Inc., a dispute over a recently pending data incident in Minnesota federal district court, the court noted that:

Under Minnesota law, the first question is whether there is an actual conflict of laws. Next, the court must determine “whether the law of the two states can be applied constitutionally”. If there is a determinative outcome conflict and two-state law can be applied constitutionally, the court applies the Minnesota multi-factor test. . . to determine which state law should apply.

2021 US Dist. LEXIS 133894 (D. Minn. July 19, 2021).

Many data incident disputes involve tort actions (for example, negligence) which have some similarities between jurisdictions. As such, the reaction of some newbies to data privacy may be to dismiss choice of law considerations in a dispute. After all, everyone knows that a negligence claim always involves the application of the same four elements (duty, breach, causation, damage), right?

Wrong answer. Choice of law arguments can be decisive as to which party prevails in a dispute. Therefore, make an informed assessment of the laws of which forum can and should Applying in a data breach dispute is a critical investigation at the start of a case.

For example, Greenstate Credit Union The relevant class action lawsuit arose out of Hy-Vee’s handling of a data breach that exposed consumers’ credit card data. The Applicant GreenState Federal Credit Union is a federally chartered credit union headquartered in Iowa. Defendant Hy-Vee is incorporated in Iowa and has its principal place of business in Iowa. However, Hy-Vee operates supermarkets, convenience stores, and gas stations, with 240 retail stores in eight states, including Minnesota.

Why is this important? Plaintiff made claims under the Minnesota Plastic Card Security Act (PCSA), common law negligence, negligence in itself, and for declaratory and injunctive judgments. The defendant argued, however, that instead of Minnesota law, Iowa law should govern the plaintiff’s claims. This was motivated by the fact that unlike Minnesota, Iowa adopted the doctrine of economic loss. As the Iowa Supreme Court put it, this doctrine “prohibits recovery in cases of negligence where the plaintiff has suffered only economic loss”.

Here, the court found that:

GreenState’s negligence claim would be excluded by Iowa’s Economic Loss Doctrine. GreenState’s alleged injuries – cancellation of compromised cards, reissue of new cards, reimbursement to members for fraudulent charges and loss of interest and transaction fees due to reduced card use – are all indirect economic losses . . Because GreenState alleges nothing more than economic losses, Iowa law prohibits its negligence claims.

(emphasis added).

Further, based on the election rules of Minnesota law, the court concluded that “[a]All employees concerned with Hy-Vee’s information security and decision-making are located in Iowa. It is foreseeable that Iowa law would apply. For these and other reasons, the court ruled that the Iowa law should apply. He then quickly dismissed the plaintiff’s claims pursuant to a straightforward application of the Iowa Damages Act.

While the Economic Loss Rule is one of the more well-known variations of state law, there are other areas involving even more nuance. Which in turn makes choice of law considerations (and the assessment of whether a defendant should strategically advocate for the law of another forum in which a dispute has been filed to apply) absolutely essential.

© Copyright 2021 Squire Patton Boggs (US) LLPRevue nationale de droit, volume XI, number 203


Comments are closed.