Labor & Employment Law Daily Wrap Up, PRIVACY—E.D. Ky.: Claims proceed against HR solutions company over data breach, (Apr 25, 2025)

By Donielle Tigay Stutland, J.D.

The court dismissed a former employee’s claim under the Kentucky Consumer Protection Act finding that employees do not qualify as a consumer for protection under the Act.

The federal district court in Covington, Kentucky dismissed some claims brought against One Point HR Solutions LLC (“One Point”) related to a data breach brought by two consumers and one former employee of the company. The court granted One Point’s motion to dismiss the claims for negligence per se, breach of confidence, breach of implied covenant, breach of fiduciary duty, declaratory/injunctive relief, and the employee’s claim for violations of the Kentucky Consumer Protection Act (KCPA). With respect to the KCPA, the court found that only consumers may bring claims under that statute, not employees. The court denied the HR company’s motion to dismiss the negligence, breach of implied contract, unjust enrichment, invasion of privacy, and the two consumer’s KCPA claims, finding those clams were adequately plead (Viviali v. One Point HR Solutions, LLC, No. 2:24-cv-00185-DCR (E.D. Ky. Apr. 21, 2025)).

Background. Charles Viviali, Lisa Alicea, and Kayla Lofton brought a suit against One Point related to a data breach. On July 3, 2023, cybercriminals infiltrated One Point’s network, gaining access to their personal identifiable information (“PII”) and protected health information (“PHI”) including (but not limited to) their full names, social security numbers, dates of birth, driver’s license numbers, state and federal identification numbers, medical and health insurance information, passport numbers, usernames and passwords, and payment card information.

The suit alleges that the plaintiffs were “kept in the dark” about the breach. Alicea was notified of the breach on October 11, 2024, and subsequently received alerts from Experian that her information was found on the Dark Web. Viviali, a former employee of One Point, also received notice of the breach on October 11, 2024. Lofton was unsure how One Point obtained her personal data, but she asserts that she was informed of the breach on October 11, 2024. Following the notice, Lofton signed up for credit monitoring offered by One Point. Lofton’s bank account faced a fraudulent charge, and she was issued a new debit card thereafter. All three plaintiffs allege that they suffered mental distress from the breach.

One Point moved to dismiss, arguing that the claims should be dismissed due to lack of standing or for failure to state a claim.

Standing. To establish standing, a plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” One Point argued that the plaintiffs lack standing because they did not plead “out of pocket expenses or monetary damages as a result of the data breach.”

Allegations of a substantial risk of harm, coupled with reasonably incurred mitigation costs, are sufficient to establish a cognizable Article III injury at the pleading stage. The court found the plaintiffs had standing,as the plaintiffs had alleged concrete injuries (e.g., mitigation costs, emotional distress, and actual fraud attempts) traceable to the breach, despite the Supreme Court’s stricter standard in TransUnion LLC v. Ramirez. The court held TransUnion did not abrogate a prior Sixth Circuit holding related to intentional data breaches. Here, the plaintiffs experienced an illicit breach and exfiltration of their data and now claim to suffer the misuse of their information, emotional distress, lost time and out of pocket costs attempting to mitigate the breach, and a diminution in the value of their personal data.

Negligence. The court next turned to the negligence claim, which, under Kentucky law requires: “(1) that the defendant owed the plaintiffs a duty of care, (2) that the defendant breached the applicable duty of care, (3) causation, including both cause in fact and proximate cause, and (4) that the plaintiff was damaged by the breach of the duty of care.” Here, One Point disputes that the plaintiffs have damages. The court found that the plaintiffs adequately alleged they “have suffered and will continue to suffer … anxiety, emotional distress, loss of privacy, and other economic and non-economic losses” stemming from One Point’s actions, which the court found sufficient to survive a motion to dismiss.

Negligence per se. One Point argued that the plaintiffs’ negligence per se claim should be dismissed because in Kentucky, only statutes can serve as the required standard of care to be substituted for the elements of duty and breach. The court agreed, noting that here, the plaintiffs only asserted a negligence per se claim by virtue of the Federal Trade Commission (“FTC”) Act and the Health Insurance Portability and Accountability Act (“HIPAA”), both federal statutes. The court dismissed the negligence per se claim, as Kentucky law (KRS 446.070) only allows state statutes to establish the standard of care, not federal laws like the FTC Act or HIPAA.

Breach of confidence. The court next addressed One Point’s contention that the plaintiffs’ breach of confidence claim should be dismissed because no such cause of action exists for data breach claims in Kentucky. The court agreed and dismissed this claim finding that “Kentucky common law” does not recognize a “breach of confidential relationship” claim in a data breach setting.

Breach of implied contract. One Point argued for dismissal of this claim, as the plaintiffs have not pled sufficient allegations to establish the conduct, acts, or relations of the parties necessary in an implied contract claim. The court denied One Point’s motion to dismiss, finding that the plaintiffs sufficiently alleged mutual assent to safeguard their data, with One Point’s delay in discovering and notifying the plaintiffs of the breach exacerbated the harm.

Implied covenant of good faith and fair dealing. The court concluded that the, “claim for Intentional Breach of the Implied Covenant of Good Faith and Fair Dealing fails as a matter of law … [because] Kentucky law does not recognize an independent tort for breach of good faith and fair dealing outside of insurance contracts.”

Breach of fiduciary duty. The court noted that this claim is governed by Kentucky law and a fiduciary duty involves a party “who has expressly undertaken to act for the plaintiff’s primary benefit.” The court found the plaintiffs did not meet the burden of showing that One Point undertook to act on their benefit, so this claim was dismissed.

Unjust enrichment. The complaint alleges the plaintiffs “conferred a benefit” on One Point and the company was unjustly enriched when it profited without any coordinate efforts to protect the plaintiffs’ data in the transaction. The court found the unjust enrichment claim survives, as the plaintiffs alleged they conferred a benefit to One Point, which was inequitably retained without adequate data protection.

Invasion of privacy. A claim for an intrusion upon seclusion invasion of privacy claim, must allege “an [intentional] intrusion by the defendant; that is highly offensive to a reasonable person; into some matter in which a person has a legitimate expectation of privacy[.]” While the parties disputed whether or not One Point’s actions were intentional, the court found that the plaintiffs had alleged One Point’s knowing failure to secure data and delayed disclosure, which is sufficient at this stage of the litigation. The court found this claim can proceed.

Consumer Protection Act. The court began by outlining that the KCPA applies to “[a]ny person who purchases or leases goods or services primarily for personal, family or household purposes and thereby suffers any ascertainable loss of money or property, real or personal, as a result of the use or employment by another person of a method, act or practice declared unlawful by KRS 367.170[.]” The court also noted that under Bowen, employees are ineligible for protection under the act because they do not qualify as consumers. The court dismissed Plaintiff Viviali’s claim given his status as a former employee, finding that he did not qualify as a consumer for protection under the KCPA.

With respect to plaintiffs Alicea and Lofton, the court found that they had plausibly alleged they were consumers harmed by One Point’s deceptive practices. Although One Point argued that the plaintiffs “have not alleged that it engaged in trade or commerce with Plaintiffs to make them consumers, nor that Plaintiffs leased goods or services from [One Point.]” The court indicated that the complaint alleges that “Defendant required Representative Plaintiffs and Class Members to provide and entrust their PII/PHI as a condition of obtaining Defendant’s services[.]” The court found that One Point’s alleged intentional failure to disclose the breach promptly after it occurred could plausibly create a causal link to increased harm to the plaintiffs. Because of this “distinct factual wrinkle,” the court concluded that the KCPA claim asserted by Alicea and Lofton could survive.

Damages. The claim for declaratory and injunctive relief was dismissed. The court concluded that the plaintiffs failed to show a substantial risk of future harm or an impending second breach.

The Case is No. 2:24-cv-00185-DCR.

Judge: Reeves, D.

Attorneys: Andrew E. Mize (Stranch, Jennings & Garvey PLLC) for Charles Viviali. Claudia D. McCarron (Mullen Coughlin LLC) for One Point HR Solutions, LLC.

Companies: One Point HR Solutions, LLC

Cases: Privacy StateLawClaims ContractClaims TortClaims KentuckyNews