Janet Reetz v. Advocate Aurora Health, Inc.

2022 WI APP 59

COURT OF APPEALS OF WISCONSIN
PUBLISHED OPINION

Case No.: 2021AP520

Complete Title of Case:

JANET REETZ,

PLAINTIFF-APPELLANT,

V.

ADVOCATE AURORA HEALTH, INC.,

DEFENDANT-RESPONDENT.

Opinion Filed: November 29, 2022
Submitted on Briefs: January 12, 2022
Oral Argument:

JUDGES: Brash, C.J., Dugan and White, JJ.
Concurred:
Dissented:

Appellant
ATTORNEYS: On behalf of the plaintiff-appellant, the cause was submitted on the
brief of Mary C. Turke, Samuel J. Strauss, and Nathan DeLadurantey
of Turke & Strauss LLP.

Respondent
ATTORNEYS: On behalf of the defendant-respondent, the cause was submitted on the
brief of Daniel E. Conley, Brandon M. Krajewski, and James E.
Goldschmidt of Quarles & Brady LLP; Edward McNicholas and Fran
Faircloth, pro hac vice, of Ropes & Gray, LLP.
2022 WI App 59

COURT OF APPEALS
DECISION NOTICE
DATED AND FILED This opinion is subject to further editing. If
published, the official version will appear in
the bound volume of the Official Reports.
November 22, 2022
A party may file with the Supreme Court a
Sheila T. Reiff petition to review an adverse decision by the
Clerk of Court of Appeals Court of Appeals. See WIS. STAT. § 808.10 and
RULE 809.62.

Appeal No. 2021AP520 Cir. Ct. No. 2020CV2361

STATE OF WISCONSIN IN COURT OF APPEALS

JANET REETZ,

PLAINTIFF-APPELLANT,

V.

ADVOCATE AURORA HEALTH, INC.,

DEFENDANT-RESPONDENT.

APPEAL from an order of the circuit court for Milwaukee County:
TIMOTHY M. WITKOWIAK, Judge. Affirmed in part; reversed in part and cause
remanded for further proceedings.

Before Brash, C.J., Dugan and White, JJ.

¶1 WHITE, J. Janet Reetz appeals the order dismissing her class action
against Advocate Aurora Healthcare, Inc. (Aurora). Reetz alleged negligence,
invasion of privacy, breach of contract, breach of implied covenant of good faith
No. 2021AP520

and fair dealing, and declaratory relief for Aurora’s actions related to a data breach
of personal information from Aurora’s systems.

¶2 Upon review, we conclude that Reetz had standing to pursue her
claims, adequately pleaded sufficient damages, and adequately pleaded a cause of
action for negligence. Therefore, we reverse that part of the order dismissing the
negligence claim and remand the same to the circuit court for further proceedings
consistent with this decision. However, Reetz failed to state a claim upon which
relief may be granted for her other four claims: invasion of privacy, breach of
contract, breach of implied covenant of good faith and fair dealing, and declaratory
relief. Therefore, we affirm the parts of the circuit court order dismissing those
claims.

BACKGROUND

¶3 We recite the facts of this case as drawn from the factual allegations
in the pleadings. This case arises out of a data breach of Aurora’s information
technology systems. On February 20, 2020, Aurora sent a notice of a security
incident that occurred in January 2020 during which an unauthorized person gained
temporary access through a phishing scheme to an Aurora human resources system
that housed personal information for current and former Aurora employees. When
Aurora became aware of the issue on January 9, 2020, it locked out the intruder.
Aurora’s internal investigation showed that the personal information of current and
former Aurora employees at Wisconsin locations was at risk, including employees’
Social Security numbers, bank accounts used for direct deposit, birth dates, and
home addresses. Aurora discovered that sixty-three employees had their direct
deposit information changed to deposit paychecks into the intruder’s account(s).
Aurora offered complimentary one-year memberships in an identity theft protection

2
No. 2021AP520

service to all former and current employees whose information was contained in the
affected system. Reetz, a former Aurora employee, had her personal information
contained in the affected HR system; however, her account’s direct deposit
instructions were not among the sixty-three accounts discovered as compromised.

¶4 Reetz first filed a class action suit against Aurora in March 2020,
pursuing claims against Aurora for herself and as a representative of other similarly
situated individuals. Aurora moved to dismiss Reetz’s action in June 2020. In
response, Reetz amended her complaint in July 2020. Aurora again moved to
dismiss in September 2020. After argument before the circuit court in December
2020, the circuit court dismissed Reetz’s action with prejudice in a written decision
on February 18, 2021.

¶5 Reetz appeals.

DISCUSSION

¶6 Reetz argues that the circuit court erred when it dismissed her
complaint with prejudice. A motion to dismiss tests the sufficiency of the
complaint. Data Key Partners v. Permira Advisers LLC, 2014 WI 86, ¶19, 356
Wis. 2d 665, 849 N.W.2d 693. When we review a motion to dismiss, “[a]ll facts
pleaded and all reasonable inferences from those facts are admitted as true,” for the
purpose of our review. Scott v. Savers Prop. & Cas. Ins. Co., 2003 WI 60, ¶5, 262
Wis. 2d 127, 663 N.W.2d 715. “The pleadings are to be liberally construed and a
claim will only be dismissed if the plaintiff cannot recover under any
circumstances.” Heinritz v. Lawrence Univ., 194 Wis. 2d 606, 610-11, 535 N.W.2d
81 (Ct. App. 1995). “We independently review as a question of law whether a
complaint states a cognizable claim.” DeBruin v. St. Patrick Congregation, 2012
WI 94, ¶10, 343 Wis. 2d 83, 816 N.W.2d 878.

3
No. 2021AP520

I. Standing

¶7 We begin with the issue of standing. The circuit court concluded
Reetz had standing, but had not sufficiently alleged damages to state a claim upon
which relief may be granted. Reetz argues that she has standing to bring her claims
and that she sufficiently alleged damages. Aurora argues she neither has standing
nor sufficiently alleged damages. “Whether a party has standing is a question of
law that we review independently.” Friends of Black River Forest v. Kohler Co.,
2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342 (citation omitted). Under
Wisconsin law, the standing of a party whose interest is challenged is determined
by: (1) personal interest in the controversy; (2) injury or adverse effect; and
(3) judicial policy that “calls for protecting the interest of the party whose standing
has been challenged.” Foley-Ciccantelli v. Bishop’s Grove Condo. Ass’n, Inc.,
2011 WI 36, ¶5, 333 Wis. 2d 402, 797 N.W.2d 789. The law of standing is liberally
construed. Krier v. Vilione, 2009 WI 45, ¶20, 317 Wis. 2d 288, 766 N.W.2d 517.

¶8 As noted, on appeal, Aurora challenges the circuit court’s finding that
Reetz had standing to bring this action. “To say that the plaintiffs have standing is
to say that they have alleged injury in fact, and if they have suffered an injury then
damages are available[.]” Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826, 828
(7th Cir. 2018).1 Her operative complaint alleged an injury in fact from
cybercriminals unlawfully accessing Aurora’s HR systems, which allowed them to
access current and former employees’ personally identifiable information (PII)

1
We note that we consider several federal cases on data breaches in the standing
discussion, acknowledging that “[f]ederal law on standing is not binding in Wisconsin.” Friends
of Black River Forest v. Kohler Co., 2022 WI 52, ¶17, 402 Wis. 2d 587, 977 N.W.2d 342. “Because
our state constitution lacks the jurisdiction-limiting language of its federal counterpart, ‘standing
in Wisconsin is not a matter of jurisdiction, but of sound judicial policy.’” Id. (citation omitted).
However, this court considers federal case law as persuasive authority regarding standing questions
because Wisconsin’s standing analysis is conceptually similar to the federal analysis. See id., ¶18.

4
No. 2021AP520

including Social Security numbers, birth dates, home addresses, and bank accounts
used for direct deposit. Reetz alleged that she suffered $2,700 in fraudulent charges
against her bank account and a resulting $600 in insufficient funds and overdraft
fees. To establish standing in a data breach identity theft case, allegations of “time
spent dealing with fraud attempts, the threat of future identity theft, and money spent
mitigating that threat … [are] sufficient to establish standing[.]” Fox v. Iowa
Health Sys., 399 F. Supp. 3d 780, 790 (W.D. Wis. 2019). We agree that Reetz has
established an injury in fact and standing to pursue this action.

¶9 Nevertheless, Aurora asserts that Reetz does not have standing and
the circuit court should not have exercised jurisdiction over her claims. “Being
damaged, however, without more, does not automatically confer standing.” Krier,
317 Wis. 2d 288, ¶20. Aurora contends that Reetz has failed to adequately plead
damages to establish standing, because she has not shown the causal link between
her damages and Aurora’s conduct. Aurora argues that the timing of the theft from
Reetz’s bank accounts does not prove that the theft occurred as a result of the data
breach. “[W]hen a defendant does not submit evidence that contradicts a specific
allegation, the court accepts that allegation as true[.]” Fox, 399 F. Supp. 3d at 792.
Aurora has not offered any evidence that Reetz’s data was stolen in a different way.
Ultimately, Aurora may be correct that Reetz’s information was exposed in another
way that caused the alleged monetary losses, but that is an issue of causation to be
resolved at trial or summary judgment. See id. Therefore, Reetz’s allegations are
sufficient to establish standing.

¶10 Having concluded that Reetz’s allegations are sufficient to establish
standing, we next address whether she has sufficiently plead damages to support
each of her claims. Further, we address Aurora’s arguments that Reetz’s damages
are speculative and do not support her claims.

5
No. 2021AP520

II. Negligence

¶11 Reetz argues she successfully stated a claim for common-law
negligence; therefore, the circuit court erred in dismissing this claim. For a
negligence claim to survive a motion to dismiss, a plaintiff must have “sufficiently
pled facts, which if proven true, would establish all four required elements of an
actionable negligence claim.” Nichols v. Progressive N. Ins. Co., 2008 WI 20, ¶11,
308 Wis. 2d 17, 746 N.W.2d 220. The four elements of a negligence claim
are: “(1) the existence of a duty of care on the part of the defendant, (2) a breach of
that duty of care, (3) a causal connection between the defendant’s breach of the duty
of care and the plaintiff’s injury, and (4) actual loss or damage resulting from the
injury.” Hornback v. Archdiocese of Milwaukee, 2008 WI 98, ¶16, 313 Wis. 2d
294, 752 N.W.2d 862 (citation omitted). Reetz alleged that, as her former employer,
Aurora had a duty of care to safeguard the PII within its control because it was
foreseeable that cybercriminals would attempt to access the PII. Reetz alleged that
Aurora breached that duty by failing to exercise reasonable care in safeguarding the
PII. Reetz then alleged that as a result of Aurora’s negligence, she suffered damages
including monetary damages and increased risk of future harm from identity theft.

¶12 Aurora argues that the negligence claim fails to state a claim because
Reetz has failed to allege actual damages and because the economic loss doctrine
bars the claim. Both of these arguments fail. We begin with actual damages.
Damages in tort claims accrue only when actual damages occur, which is “harm that
has already occurred or is ‘reasonably certain’ to occur in the future.” Tietsworth
v. Harley-Davidson, Inc., 2004 WI 32, ¶17, 270 Wis. 2d 146, 677 N.W.2d 233
(citation omitted). Reetz alleged damages from fraudulent transactions and
overdraft fees. Money damages may arise from a data breach because
“unauthorized withdrawals from [victims’] accounts cause a loss (the time value of

6
No. 2021AP520

money) even when banks later restore the principal, and because the value of one’s
own time needed to set things straight is a loss from an opportunity-cost
perspective.” Dieffenbach, 887 F.3d at 828. Further, a data breach of PII creates a
risk of future identity theft.2 Cf. Lewert v. P.F. Chang’s China Bistro, Inc., 819
F.3d 963, 966 (7th Cir. 2016) (concluding that the increased risk of identity theft
was a sufficiently imminent injury after a data breach). We note that Aurora
allegedly acknowledged this risk when it offered credit monitoring to employees
and former employees whose PII was contained in the breached system. Cf. Fox,
399 F. Supp. 3d at 791.

¶13 Reetz’s complaint is based on a data breach, which allowed
unauthorized access of her PII, including fraudulent transactions and resulting
overdraft fees in her bank account.3 Reetz argues that the circuit court improperly
concluded that she did not plead actual damages because she did not allege that she
requested a return of the overdraft fees or that the overdraft fees were not
reimbursed. In our review, we accept the allegations in the complaint as being true;
therefore, we accept as true Reetz’s allegations that she incurred the fraudulent
charges and the overdraft fees. Accordingly, the pleading of those specific amounts
constitute adequate actual damages to overcome Aurora’s motion to dismiss for
failure to state a claim. Further, Reetz’s damages do not arise only from the

2
As the Seventh Circuit stated in discussing a data breach of Neiman Marcus credit cards,
“Why else would hackers break into a store’s database and steal consumers’ private information?
Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those
consumers’ identities.” Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015).
3
Reetz further alleged that her PII is now a black market commodity and that its value
constitutes damages. We decline to address this argument because it is both undeveloped and
unnecessary to examine in addition to our conclusion that she adequately pleaded damages. See
Maryland Arms Ltd. P’ship v. Connell, 2010 WI 64, ¶48, 326 Wis. 2d 300, 786 N.W.2d 15
(“Typically, an appellate court should decide cases on the narrowest possible grounds.”).

7
No. 2021AP520

overdraft fees, but from allegations of “time spent dealing with fraud attempts [and]
the threat of future identity theft.” See Fox, 399 F. Supp. 3d at 790.

¶14 Next, Aurora argues that the economic loss doctrine bars tort recovery
for contractual claims, and therefore, Reetz’s claim is barred. “The economic loss
doctrine is a judicially created doctrine that seeks to preserve the distinction between
contract and tort.” Insurance Co. of N. Am. v. Cease Elec. Inc., 2004 WI 139, ¶15,
276 Wis. 2d 361, 688 N.W.2d 462. “Recovery for economic loss is intended to
protect purchasers from losses suffered because a product failed in its intended use.”
Northridge Co. v. W.R. Grace & Co., 162 Wis. 2d 918, 933, 471 N.W.2d 179
(1991). Economic loss for this purpose includes both direct economic loss, which
“is loss in value of the product itself,” and consequential economic loss, which is
“all other economic losses attributable to the product defect.” Daanen & Janssen,
Inc. v. Cedarapids, Inc., 216 Wis. 2d 395, 401, 573 N.W.2d 842 (1998). “Economic
damages do not include losses due to personal injury or damage to other property.”
Linden v. Cascade Stone Co., 2005 WI 113, ¶6, 283 Wis. 2d 606, 699 N.W.2d 189.
Moreover, the doctrine “is inapplicable to claims for the negligent provision of
services.” Cease Elec. Inc., 276 Wis. 2d 361, ¶52. We independently review as a
question of law whether the economic loss doctrine applies to a given set of facts.
Linden, 283 Wis. 2d 606, ¶5.

¶15 The relationship between Reetz and Aurora is, in essence, contractual,
arising out of Reetz’s at-will employment contract with Aurora for her employment
services. There are no products or goods exchanged under this contract; therefore,
her claims of economic loss do not derive from a loss in value of any product or a
loss attributable to a product defect. Daanen & Janssen, Inc., 216 Wis. 2d at 401.
Aurora relies on multiple cases from other jurisdictions holding that the economic

8
No. 2021AP520

loss doctrine bars negligence claims in data breach cases.4 We do not find these
cases persuasive. We conclude there is no application of the economic loss doctrine
to Reetz’s claims that Aurora did not exercise reasonable care to safeguard her PII.
Further, Aurora failed to refute Reetz’s argument that the economic loss doctrine is
inapplicable to services. Therefore, we consider Aurora to have conceded this
argument. See United Coop. v. Frontier FS Coop., 2007 WI App 197, ¶39, 304
Wis. 2d 750, 738 N.W.2d 578 (explaining that the failure to refute an argument may
be taken as a concession).

¶16 Aurora argues that because Reetz’s claims arise out of her
employment contract, this court should not allow her negligence claim to proceed.
The circuit court concluded that tort law is not applicable in employment law under
Mackenzie v. Miller Brewing Co., 2001 WI 23, ¶¶27-28, 241 Wis. 2d 700, 623
N.W.2d 739. In Mackenzie, our supreme court explained that tort law protects
society as a whole and “rests on obligations imposed by law,” Daanen &
Janssen, Inc., 216 Wis. 2d at 405; in contrast, employment law is based on contract
principles and obligations imposed by bargaining, Mackenzie, 241 Wis. 2d 700,
¶28. There, our supreme court declined to recognize a new fraudulent
representation tort–—intentional misrepresentation to induce continued
4
Aurora cited cases based on Illinois, Pennsylvania, and Colorado law. See, e.g.,
Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 817 (7th Cir. 2018)
(concluding that Illinois’s economic loss rule would bar recovery in a tort claim arising out of a
cybersecurity breach); Longenecker-Wells v. Benecard Servs. Inc., 658 F. App’x 659, 661 (3d Cir.
2016) (concluding Pennsylvania’s economic loss rule applied to tort claims arising out of a data
breach because damage was solely economic and was not accompanied by physical injury or
property damage); SELCO Cmty. Credit Union v. Noodles & Co., 267 F. Supp. 3d 1288, 1296 (D.
Colo. 2017) (concluding that Colorado’s economic loss rule barred recovery for a tort claim by
credit unions arising out of a data breach of a restaurant chain). The Wisconsin Supreme Court
acknowledged that some jurisdictions, such as Illinois, “exempted some professions from the
economic loss doctrine” but not other services or professions, leading to a “slippery slope” of
requiring judicial determination of exceptions. Insurance Co. of N. Am. v. Cease Elec. Inc., 2004
WI 139, ¶¶49-50, 276 Wis. 2d 361, 688 N.W.2d 462. Instead, Wisconsin simply does not apply
the economic loss doctrine to service contracts. Id., ¶52.

9
No. 2021AP520

employment–within an at-will employment context. Id., ¶30. Although the
Mackenzie court discussed the difference between tort and contract law, it did not
apply the economic loss doctrine as a basis of its decision. Without a clear directive
that the economic loss doctrine applies to employment law and given our supreme
court’s clear directive that it is not applicable to service contracts, we decline to
extend a blanket application of the economic loss doctrine in the employment law
context. See Cook v. Cook, 208 Wis. 2d 166, 188-89, 560 N.W.2d 246 (1997)
(explaining that the Wisconsin Court of Appeals is primarily an error correcting
court and the Wisconsin Supreme Court’s function is law declaration and
development).

¶17 We conclude that Reetz has successfully stated a claim for negligence
and pleaded damages in support of her claim. We reverse that part of the circuit
court’s order dismissing this claim. We remand for further proceedings on the
negligence claim and its class action ramifications.

III. Invasion of Privacy

¶18 Reetz argues that the circuit court erred when it dismissed her invasion
of privacy claim. She argues that she successfully stated a claim under WIS. STAT.
§ 995.50 (2019-20).5 Under that statute, Wisconsin recognizes four types of
invasion of privacy actions, including the issue here: giving publicity to private
facts. This cause of action is set forth by statute as:

Publicity given to a matter concerning the private life of
another, of a kind highly offensive to a reasonable person, if
the defendant has acted either unreasonably or recklessly as
to whether there was a legitimate public interest in the matter
involved, or with actual knowledge that none existed. It is

5
All references to the Wisconsin Statutes are to the 2019-20 version unless otherwise
noted.

10
No. 2021AP520

not an invasion of privacy to communicate any information
available to the public as a matter of public record.

Sec. 995.50(2)(am)3. Under Wisconsin law, to establish this cause of action, a
plaintiff must prove:

(1) a public disclosure of facts regarding the plaintiff; (2) the
facts disclosed are private facts; (3) the private matter made
public is one which would be highly offensive to a
reasonable person of ordinary sensibilities; and (4) the
defendant acted either unreasonably or recklessly as to
whether there was a legitimate public interest in the matter,
or with actual knowledge that none existed.

Pachowitz v. LeDoux, 2003 WI App 120, ¶18, 265 Wis. 2d 631, 666 N.W.2d 88.6

¶19 Reetz pleaded that Aurora publicized and exposed her PII, which
contained private details and facts generally not known to the public, facts not
publicly available, and not of legitimate public concern. Aurora argues that Reetz’s
claim fails because she has not alleged intentional conduct by Aurora in the data
breach. Reetz argues that intentional conduct is not required and that invasion of

6
We note that Pachowitz v. LeDoux, 2003 WI App 120, ¶18, 265 Wis. 2d 631, 666
N.W.2d 88, referenced the earlier version of the invasion of privacy statute, WIS. STAT. § 895.50
(2003-04). This statute remains substantively the same but was renumbered to WIS. STAT. § 995.50
in 2005 Wis. Act 155, § 51. Further, the subdivisions within § 995.50(2) were renumbered in 2019
Wis. Act 72, § 1.

11
No. 2021AP520

privacy is not an intentional tort.7 Neither the language of WIS. STAT.
§ 995.50(2)(am)3., nor the elements of this action provided by case law state an
intentional requirement.8 This is a matter of first impression. In concluding that the
publicity of private facts cause of action requires intentional conduct in Wisconsin,
we are persuaded by the reasoning employed by the United States District Court for
the Western District of Wisconsin’s in Fox, 399 F. Supp. 3d 780 in 2019. The Fox
court noted that while there was no case on point in Wisconsin, “[s]ection 995.50 is
to be ‘interpreted in accordance with the developing common law of privacy,’
[]§ 995.50(3)”; therefore, it was likely Wisconsin courts would reach the same
holding reached by “courts that have considered similar claims in other jurisdictions
… that intentional action is required.” Id., 399 F. Supp. 3d at 796-97. Further, the
court noted that the plaintiff there “pointed to no authority (and the court has found
none) in which a defendant was held liable under this statute, or a similar statute,

7
Reetz argues that invasion of privacy can be intentional, reckless, or negligent, relying
on a 1982 Marquette Law Review article for this supposition. See Jacqueline Hanson Dee,
Comment, The Absence of False Light from the Wisconsin Privacy Statute, 66 Marq. L. Rev. 99,
113 (1982). Reetz does not offer any Wisconsin legal authority for this position. Reetz offers a
non-Wisconsin case in support of her position that the disclosure need not be knowingly offensive
for the cause of action to exist. Benally v. Hundred Arrows Press, Inc., 614 F. Supp. 969, 982
(D.N.M. 1985), rev’d sub nom. Benally on Behalf of Benally v. Amon Carter Museum of W. Art,
858 F.2d 618 (10th Cir. 1988) (concluding that it was irrelevant whether the defendant knew a
photograph of the plaintiff it publicized would offend the plaintiffs). Beyond the fact that it is
unclear how this case applies to a data breach instigated by a third-party, we note that the Benally
court’s intent inquiry focused on whether it mattered if there was an intent to offend. It did not
analyze whether there was an intent to publish or disclose or whether an intent to publish was
relevant. Reetz’s argument here is undeveloped. We decline to develop it for her. See State v.
Pettit, 171 Wis. 2d 627, 646, 492 N.W.2d 633 (Ct. App. 1992) (“We may decline to review issues
inadequately briefed.”).
8
In Schaefer v. State Bar of Wisconsin, 77 Wis. 2d 120, 125-26, 252 N.W.2d 343 (1977),
our supreme court concluded it would “not reach the question of whether the complaint states a
cause of action for invasion of privacy for the reason Wisconsin does not recognize a cause of
action for invasion of privacy without a specific intention to inflict harm.” Id. However, we do
not consider this decision dispositive of the issue because it was decided prior to the codification
of the privacy statute in 1977 Wis. Laws, ch. 176, § 5 published November 29, 1977. Schaefer
was issued in April 1977.

12
No. 2021AP520

for information stolen by a third party.” Id. Similarly, Reetz fails to provide a case
where a defendant was liable under a theory of invasion of privacy for publicity of
private facts for a data breach involving a third-party.

¶20 “Publicity” as used in WIS. STAT. § 995.50(2)(am)3. has been defined
under Wisconsin law to mean making a private matter “public, by communicating
it to the public at large, or to so many persons that the matter must be regarded as
substantially certain to become one of public knowledge.” RESTATEMENT
(SECOND) OF TORTS § 652D cmt. a (1977); see also Hillman v. Columbia Cnty.,
164 Wis. 2d 376, 394, 474 N.W.2d 913 (Ct. App. 1991); Pachowitz, 265 Wis. 2d
631, ¶18. Our supreme court’s prior analysis has determined that publicity of
private facts occurred when oral communication by employees and inmates within
a prison disclosed an inmate’s HIV status, Hillman, 164 Wis. 2d at 395, when an
internal company newsletter listed why an employee was discharged, Zinda v.
Louisiana Pac. Corp., 149 Wis. 2d 913, 932, 440 N.W.2d 548 (1989), and when an
EMT disclosed a patient’s overdose to a third-party, Pachowitz, 265 Wis. 2d 631,
¶25. The commonality of the prior analysis of “publicity” is whether the
information was disclosed widely enough—with this court eventually reaching a
conclusion that “disclosure of private information to one person or to a small group
does not, as a matter of law in all cases, fail to satisfy the publicity element of an
invasion of privacy claim.” Id., ¶24. However, the entity’s conduct as the discloser
or distributor of private facts was not disputed in Pachowitz, Hillman, or Zinda.
We conclude that intentional conduct is integral to the disclosure of private facts
and that giving “publicity” requires intentional conduct.

¶21 As support for the idea that intentionality is inherent to invasion of
privacy–publicity of private facts, we note that invasion of privacy is classified as
an intentional tort for the statute of limitations under WIS. STAT. § 893.57 and that

13
No. 2021AP520

jury instructions for invasion of privacy are structured within other intentional torts.
See WIS JI—CIVIL 2550-52. In our analysis of civil invasion of privacy in Gillund
v. Meridian Mut. Ins. Co., 2010 WI App 4, ¶28, 323 Wis. 2d 1, 778 N.W.2d 662,
we assumed without deciding that “an invasion of privacy cannot be committed
accidentally” and that civil “invasions of privacy encompass intentional acts.”
Upon review, we conclude that those assumptions are correct and a claim for
invasion of privacy–publicity of private facts requires intentional conduct.9

¶22 Having established our legal standard, our question is whether Reetz
has alleged facts to support that conduct by Aurora intentionally gave publicity to
her PII. In the complaint, Reetz alleged that Aurora “has disclosed and given access
to the PII … for criminals to use in the conduct of criminal activity” and that her
“PII was publicly disclosed by Aurora in the Data Breach with reckless disregard
for the reasonable offensiveness of the disclosure.” She alleged that Aurora “opened
up, disclosed, and exposed the PII … to persons engaged in disruptive and unlawful
business practices and tactics.” She alleged that Aurora’s outdated and insecure
systems “demonstrates a willful and conscious disregard for employee privacy.”
However, these allegations are conclusory as to Aurora’s participation and conduct.
In the complaint, Reetz alleged that Aurora failed to prevent the cyberattack and
data breach, but an allegation of failing to prevent a data breach is not an allegation
that Aurora intended the disclosure or publicity of private facts. Accordingly, we

9
Reetz relies on Gillund v. Meridian Mut. Ins. Co., 2010 WI App 4, ¶29, 323 Wis. 2d 1,
778 N.W.2d 662, which provides that the objective test of invasion of privacy for a highly offensive
intrusion is “whether a reasonable person would find the intrusion highly offensive. There is no
requirement that the actor have a particular mental state or intent.” Id. This reliance is misplaced
because Reetz does not allege a highly offensive intrusion, which implicates WIS. STAT.
§ 995.50(2)(am)1., but that Aurora publicized private facts, which implicates § 995.50(2)(am)3.
There is no similar holding in Gillund regarding the mental state required to give publicity under
subdivision three. Therefore, Gillund is not dispositive to the question of intent for publicity of
private facts.

14
No. 2021AP520

conclude Reetz’s pleadings were insufficient to state a claim for invasion of
privacy–publicity of private facts. Therefore, the circuit court did not err when it
dismissed this count of the complaint, and we affirm this part of the order.

IV. Breach of contract claims

¶23 Reetz argues the circuit court erred when it dismissed her claims for
breach of her employment contract with Aurora—express or implied and breach of
the covenant of good faith and fair dealing within every contract. “A valid contract
requires an offer, acceptance and consideration.” Piaskoski & Assocs. v. Ricciardi,
2004 WI App 152, ¶7, 275 Wis. 2d 650, 686 N.W.2d 675. “Offer and acceptance
exist when the parties mutually express assent, and consideration exists if the parties
manifest an intent to be bound to the contract.” Id. “A contract must be definite
and certain as to its basic terms and requirements to be enforceable.” Metropolitan
Ventures, LLC v. GEA Assocs., 2006 WI 71, ¶22, 291 Wis. 2d 393, 717 N.W.2d
58, op. clarified on denial of reconsideration, 2007 WI 23, 299 Wis. 2d 174, 727
N.W.2d 502. Both the existence of a contract and whether the provisions of a
contract are definite are questions of law we interpret independently. Id.; Piaskoski
& Assocs., 275 Wis. 2d 650, ¶7.

¶24 Reetz argues that in her contract for employment with Aurora, she was
obligated to provide PII and that Aurora breached its duty to safeguard the PII.
Employment is “essentially contractual.” Atkinson v. Everbrite, Inc., 224 Wis. 2d
724, 729, 592 N.W.2d 299 (Ct. App. 1999). An employer’s obligations to an
employee “stem from their agreement that [the employee] would work for [the
employer], and that [the employer] would compensate [the employee] for his [or
her] services.” Id.

15
No. 2021AP520

¶25 Aurora argues that Reetz has not identified an express term in the
employment contract that required it to safeguard the PII. Our examination of the
pleadings supports that, even accepting all facts and reasonable inferences as true,
Reetz has failed to identify a contract provision to support her claims. Reetz alleged
that she and other class members “were required to provide their PII … to Defendant
as a condition of employment.” She further alleged that Aurora “therefore offered
… a unilateral contract of employment, which [she] accepted by providing the
necessary PII and showing up for work.” Reetz’s allegations do not point to an
express contract term; but instead, she alleges that Aurora’s obligation to safeguard
the PII was “[i]mplicit in the agreement” and that Aurora “implicitly promised to
retain PII only under conditions that kept such information secure and confidential.”
We conclude that Reetz failed to allege an express contract provision that obligated
Aurora to safeguard the PII.

¶26 Reetz also alleged that “Aurora’s Code of Conduct contained
additional covenants restricting its disclosure of PII.” Aurora argues that Reetz did
not plead that she saw the Code of Conduct and agreed to it prior to accepting the
employment offer. It is true that “as a matter of law, an employment contract can
be modified by the use of an employees’ handbook.” Ferraro v. Koelsch, 124 Wis.
2d 154, 169, 368 N.W.2d 666 (1985). However, there must be “evidence indicating
that [the employee and employer] agreed to be bound by the terms of the policy,”
or else it would “not rise to the level of a contract, either implied or otherwise.”
Vorwald v. School Dist. of River Falls, 167 Wis. 2d 549, 558, 482 N.W.2d 93
(1992). This is where Reetz’s allegations are insufficient to state a claim upon
which relief may be granted. Her conclusory phrase in the complaint about
covenants in the Code of Conduct does not support that the employment contract
was modified by mutual assent to the term to safeguard the PII. We conclude that

16
No. 2021AP520

Reetz’s breach of express contract claim failed to state a claim upon which relief
may be granted.

¶27 Alternatively, Reetz argues that she had an implied contract with
Aurora based on her providing her PII and Aurora agreeing to safeguard that
information. Aurora argues that Reetz providing legally required PII and working
at Aurora is not separate consideration to establish that an implied contract existed
with provisions requiring Aurora to safeguard her PII. Aurora also contends that an
implied contract to safeguard personal information from a data breach requires
assent from both parties, an assent not alleged in the pleadings.

¶28 Reetz did not separately plead a breach of implied contract in the
complaint, instead folding her allegations into the breach of express contract claim.
An implied contract in law is a theory of unjust enrichment. There are three
elements, as described in the Wisconsin jury instructions on implied contracts: “(1)
a benefit conferred upon the defendant by the plaintiff; (2) knowledge or
appreciation of the benefit by the defendant; and (3) acceptance and retention by the
defendant of such benefit under such circumstances that it would be unfair … to
retain it without paying the value thereof.” WIS JI—CIVIL 3028.

¶29 Construing all facts and reasonable inferences of those facts in the
pleadings as true, an implied contract is an awkward application to the facts of this
case and we conclude that she has not stated a claim for breach of implied contract.
See Scott, 262 Wis. 2d 127, ¶5. To find that a benefit was conferred upon Aurora
by Reetz would mean that it was to Aurora’s benefit for Reetz to provide her PII—
rather, at best we could reasonably infer that Aurora needed Reetz’s PII to comply
with federal and state regulations of employers. Further, that benefit to Aurora and
Aurora’s knowledge of that benefit is not alleged in the complaint and is unclear

17
No. 2021AP520

from our review of the facts. Ultimately, there are no facts that an implied contract,
if it existed, had a contractual term that obligated Aurora to safeguard the PII.
Unjust enrichment generally refers to a monetary benefit conferred upon a defendant
and here, the facts alleged fail to show that there was a monetary benefit to Aurora
such that it would have unjust enrichment if it did not protect Reetz’s PII. See W.H.
Fuller Co. v. Seater, 226 Wis. 2d 381, 387, 595 N.W.2d 96 (Ct. App. 1999)
(“Depending upon the circumstances, the value of the benefit received by the
defendant may include services rendered for the defendant, goods or merchandise
received by the defendant, or improvements made to the defendant’s real estate.”).
We conclude that Reetz’s claim based on a breach of implied contract failed to state
a claim upon which relief may be granted.

¶30 Next, Reetz alleged that Aurora breached the covenant of good faith
and fair dealing implicit in every contract.10 “Every contract implies good faith and
fair dealing between the parties to it, and a duty of cooperation on the part of both
parties.” Beidel v. Sideline Software, Inc., 2013 WI 56, ¶27, 348 Wis. 2d 360, 842
N.W.2d 240 (citation omitted). Good faith is an issue of the parties’ performance
of the contract after formation “because no contract exists unless and until issues
concerning indefiniteness are resolved[.]” Metropolitan Ventures, LLC, 291
Wis. 2d 393, ¶22 n.9. “A party can be liable for breach of the implied covenant of
good faith ‘even though all the terms of the written agreement may have been

10
Additionally, Reetz argues that the circuit court erred in considering the implied
covenant of good faith and fair dealing a tort claim, when it instead sounds in contract. A breach
of “the covenant of good faith that accompanies every contract” is a contract claim, recognized in
Wisconsin since at least Chayka v. Santini, 47 Wis. 2d 102, 107, 176 N.W.2d 561 (1970).
Although there has been confusion over the years as to whether this claim sounds in contract or
tort, “Wisconsin has not recognized a cause of action in tort for lack of good faith or ‘tortious
breach of contract,’” but instead recognizes the breach of good faith under a contract action. Hauer
v. Union State Bank of Wautoma, 192 Wis. 2d 576, 595, 532 N.W.2d 456 (Ct. App. 1995).
However, we do not address this issue further because we conclude that there was no contract
provision at issue requiring performance with good faith and fair dealing.

18
No. 2021AP520

fulfilled.’” Kreckel v. Walbridge Aldinger Co., 2006 WI App 168, ¶20, 295 Wis. 2d
649, 721 N.W.2d 508 (citation omitted).

¶31 Therefore, to state a claim for a breach of this covenant, the plaintiff
must plead that a valid contract with express, definite, enforceable terms exists, and
that the breaching party acted without good faith in its performance of that contract.
See Beidel, 348 Wis. 2d 360, ¶29. Although there is no dispute that Reetz and
Aurora had an employment contract, we have concluded that there was no provision
within that contract that required Aurora to safeguard the PII. Without a contract
provision establishing that safeguarding the PII was Aurora’s contractual obligation,
Aurora did not breach its duty of good faith by failing to safeguard the PII. The
good faith and fair dealing obligations must relate to the performance of the
contract. See Gerruth Realty Co. v. Pire, 17 Wis. 2d 89, 94, 115 N.W.2d 557 (1962)
(concluding good faith issues arises only after the determination of the enforceable
terms of the contract). Accordingly, we conclude that Reetz failed to state a claim
for breach of the covenant of good faith and fair dealing, and we affirm the circuit
court order dismissing this claim.

¶32 Additionally, we note that Reetz failed to refute Aurora’s arguments
relating to her contract claims. Aurora contended that there was no contract
provision requiring Aurora to safeguard PII, that there was no implied contract, and
without an underlying operative contract, there was no breach of the covenant of
good faith and fair dealing. We consider Reetz to have conceded these arguments.
See United Coop., 304 Wis. 2d 750, ¶39.

¶33 We conclude that Reetz has failed to state a claim for breach of
contract, express or implied or through the covenant of good faith and fair dealing.
Accordingly, we affirm the circuit court’s order dismissing Reetz’s contract claims.

19
No. 2021AP520

V. Injunctive relief and declaratory judgment

¶34 Reetz’s final argument is that the circuit court erred in dismissing her
request for declaratory judgment and injunctive relief. Under the Uniform
Declaratory Judgments Act, a circuit court “shall have power to declare rights,
status, and other legal relations whether or not further relief is or could be claimed.”
WIS. STAT. § 806.04(1). A declaratory judgment “terminates any controversy
between these parties. Moreover, it limits and defines the parameters of any
controversies that remain.” Loy v. Bunderson, 107 Wis. 2d 400, 408, 320 N.W.2d
175 (1982). “A court must be presented with a justiciable controversy before it may
exercise its jurisdiction over a claim for declaratory judgment.” Olson v. Town of
Cottage Grove, 2008 WI 51, ¶28, 309 Wis. 2d 365, 749 N.W.2d 211.

¶35 Reetz contends she faces an ongoing injury from the data breach and
requests a court order appointing a third-party ombudsman to conduct, test, and
audit Aurora’s data procedures, and to oversee training and education for employees
on PII data issues and privacy practices. Reetz alleges that her damages arising
from the data breach and identify theft are ongoing. However, she has failed to
allege how declaratory judgment would remedy those future harms. A plaintiff may
seek declaratory judgment prior to the suffering an injury as long as “the facts are
sufficiently developed to allow a conclusive adjudication.” Putnam v. Time
Warner Cable of Se. Wis., Ltd. P’ship, 2002 WI 108, ¶44, 255 Wis. 2d 447, 649
N.W.2d 626. Reetz has failed to show that declaratory judgment is an appropriate
remedy to resolve her claims.

¶36 Aurora contends that Reetz’s request was properly denied by the
circuit court because declaratory relief must be narrowly tailored toward remedying
an ongoing harm, not premised on past conduct. Aurora asserts that Reetz only

20
No. 2021AP520

alleged past conduct from the data breach and speculative future harms. Aurora
argues that Reetz has failed to allege what “impermissible conduct” by Aurora is
ongoing and continuing to harm Reetz. Further, Aurora asserts that Reetz has failed
to plead any statutory or common law basis for injunctive relief or declaratory
judgment. Reetz failed to refute Aurora’s argument and we consider her to have
conceded the issue. See United Coop., 304 Wis. 2d 750, ¶39. Therefore, we
conclude that the circuit court properly dismissed Reetz’s request for declaratory
judgment and injunctive relief.

CONCLUSION

¶37 We conclude that Reetz has adequately pleaded standing and a
negligence claim. We reverse this part of the circuit court order and remand for
further proceedings on this claim. Conversely, we conclude that Reetz has failed to
state a claim for invasion of privacy–publicity of public facts; breach of contract–
either express or implied or the covenant of good faith and fair dealing; or
declaratory judgment and injunctive relief. Therefore, we affirm the circuit court
order dismissing these claims.

By the Court.—Order affirmed in part; order reversed in part and
cause remanded for further proceedings.

21