Labor & Employment Law Daily Wrap Up, PROCEDURE—E.D. Mich.: Failure to plead physical injury dooms data-breach negligence claim, (Sep 29, 2025)

By Sherri M. Schroeder, J.D.

The court also lacked jurisdiction over the negligence and breach-of-implied-contract claims insofar as they sought injunctive relief and damages for increased risk of fraud and diminished value of private information.

A federal district court in Michigan has granted in part and denied in part the data-breach claims made by a former employee against CRG Lynwood LLC d/b/a Lynwood Manor, a provider of medical care and assisted-living services. Many years after the nurse aide left the company, hackers “potentially accessed and acquired” the Social Security numbers, driver’s license numbers, dates of birth, and medical diagnoses of approximately 6,500 current and former employees and patients of Lynwood. After the aide filed suit, claiming Lynwood was negligent and that it breached an implied agreement to keep her data secure, Lynwood asked the court to dismiss the complaint. The court first found the aide’s alleged privacy injury to be “actual” and “concrete” and that it satisfied the injury-in-fact requirement for standing. However, the court found the aide did not have standing to bring suit for her two other alleged injuries—increased risk of fraud and diminished value of private information—because she did not adequately plead them. The court also found that the aide lacked standing to seek forward-looking relief. Turning to the merits of the case, the court then found the lack of physical injury to be fatal to the aide’s negligence claim but that she had adequately pleaded mutual assent to uphold her breach-of-implied-contract claim (Rodriguez v. CRG Lynwood LLC, No. 24-11576 (E.D. Mich. Sept. 22, 2025)).

Injury in fact. Noting that no one disputed the former aide’s injury satisfied the particularity requirement of standing, the court first looked to whether the aide’s claimed injuries—violation of privacy, increased risk of fraud or identity theft, and the diminishment in value of her private information—were concrete and actual or imminent. Here, the court found the privacy injury to be actual because it was reasonable to infer that if Lynwood sent her a letter about a data breach involving her sensitive information, her records were among those accessed by hackers. Furthermore, the court found the injury to be concrete because it was the kind of harm that is the basis of a tort claim traditionally addressed by courts. However, the court found no standing for the claim of risk of future fraud because almost three years had passed without incident before the aide had filed her suit, showing the risk was not substantial. As to the diminished information value claim, the court noted the claim focused mainly on the value of the data on the black market, but the court found no intent by the aide to participate in an illegal market. Therefore, the aide did not have standing to pursue claims based on her assertions that the data breach increased the risk of fraud in the future and diminished the value of her private information.

Forward-looking relief. The court then noted the aide was asking for forward-looking relief in that she wanted Lynwood to increase its data security, improve how it addresses data breaches, and to pay for at least 10 years of credit monitoring. The court, however, found she lacked standing to seek such an order because (1) “[A] mere possibility does not confer standing,” and (2) “Credit monitoring does nothing to fix the injuries [the aide] experienced from having her privacy violated (e.g., embarrassment). And while credit monitoring does reduce the risk of fraud, the Court has found that [the aide] lacks standing to pursue claims based on that injury.”

Physical injury. Turning to the merits of the negligence claim, the court looked to Angus v. Flagstar Bank wherein Michigan victims of a data breach brought an ordinary negligence claim that did not allege any physical injuries from the breach, but the court denied the claim due to the lack of a present physical injury. Finding this persuasive, and after determining that the aide only had standing to pursue claims based on injuries stemming from hackers viewing her private data (e.g., embarrassment), the court dismissed the negligence claim for failure to plead physical injury.

Breach of implied contract. The court was not persuaded by Lynwood’s arguments relying on a collective-bargaining agreement (CBA) between itself and the aide’s former union to claim preemption under § 301 of the Labor Management Relations Act, lack of exhaustion, and preclusion of an implied contract by an express contract. For the preemption and exhaustion arguments, the court noted that Lynwood had not identified a single provision of the CBA that discussed the collection of employees’ identifying information nor one that governed how that information would be secured. As to preclusion, the court noted that Lynwood had not established the factual basis for the argument. “In sum, at this stage of the case,” stated the court, “Lynwood has not shown that the CBA warrants dismissal of [the aide’s] breach-of-implied-contract claim.”

Lynwood also argued that the breach-of-implied-contract claim must be dismissed because the aide had not adequately pleaded that Lynwood agreed to secure her private information, meaning Lynwood was attacking the mutual assent element. Calling it a “very close call,” the court noted a significant divide between the circuits. Finding the scale tipped slightly in the aide’s favor, the court ultimately found that the aide had adequately pleaded mutual assent.

Conclusion. The court granted in part and denied in part the motion to dismiss, stating it lacked jurisdiction over the negligence and breach-of-implied-contract claims insofar as they seek injunctive relief and insofar as they seek damages for increased risk of fraud and diminished value of private information. The court dismissed the remainder of the negligence claim for failure to plead physical injury. Therefore, the only claim remaining was the breach-of-implied-contract claim to recover damages for injuries stemming from hackers invading the aide’s privacy (e.g., embarrassment).

The case is No. 24-11576.

Judge: Michelson, L.

Attorneys: David M. Blanchard (Blanchard & Walker, PLLC) for Jennifer Rodriguez. William S. Cook (Wilson Elser) for CRG Lynwood LLC d/b/a Lynwood Manor.

Companies: CRG Lynwood LLC d/b/a Lynwood Manor

Cases: Procedure TortClaims ContractClaims Privacy MichiganNews