Perlaki v. J.B. Poindexter & Co, Inc.

Filing 34

MEMORANDUM AND RECOMMENDATIONS re 21 J.B. Poindexter's Motion to Dismiss. Objections to M&R due by 3/24/2025. (Signed by Magistrate Judge Andrew M Edison) Parties notified. (rrc3)

United States District Court
Southern District of Texas

ENTERED
UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF TEXAS
HOUSTON DIVISION
THOMAS PERLAKI,
Plaintiff.
V.
J.B. POINDEXTER & CO., INC.,
Defendant.

March 10, 2025
Nathan Ochsner, Clerk

§
§
§
§
§ CIVIL ACTION NO. 4:24-cv-01649
§
§
§
§

MEMORANDUM AND RECOMMENDATION
This case arises out of a criminal cyberattack that targeted employees’
personal data stored by their employer Defendant J.B. Poindexter & Co. Plaintiff
Thomas Perlaki, a former employee of J.B. Poindexter, is one of many employees
whose information was exposed in the data breach. Perlaki claims to have suffered
damages caused by the theft of his personal identifiable information (“PII”).
Pending before me is J.B. Poindexter’s Motion to Dismiss. See Dkt. 21. J.B.
Poindexter argues that Perlaki lacks standing to bring his claims and that, even if
he has standing, Perlaki fails to properly state a claim upon which relief can be
granted. Having reviewed the briefing, the record, and the applicable law, I
recommend the motion be denied as to Perlaki’s standing, but granted in all other
respects and this case dismissed.
BACKGROUND
On April 4, 2024, J.B. Poindexter learned that cybercriminals had attacked
and accessed information stored on its computer network. Four days later, J.B.
Poindexter notified all potentially affected individuals of the data breach. The
perpetrators of the data breach allegedly accessed and stole the PII of current and
former employees, and their dependents. The PII stored by J.B. Poindexter and
potentially accessed by cybercriminals includes contact information, social
security numbers, dates of birth, and driver’s license numbers.

Perlaki filed a Class Action Complaint against J.B. Poindexter on May 1,
2024. The operative pleading is the Amended Class Action Complaint. See Dkt. 20.
Perlaki alleges that damages caused by the data breach include “a spike in spam
and scam text messages and emails containing suspicious links”; fraudulent
attempts to use his credit card; lost time spent monitoring his financial accounts;
anxiety, sleep disruption, stress, fear, and frustration; a loss in the value of his PII;
the anticipation of future expenses spent to mitigate his injuries; and an “increased
risk of fraud, misuse, and identity theft.” Id. at 9, 11. Perlaki alleges the data breach
is J.B. Poindexter’s second data breach in several years and could have been
avoided if J.B. Poindexter had taken adequate measures to protect its employees’
PII. Perlaki asserts claims against J.B. Poindexter for (1) negligence, (2) breach of
implied contract, (3) invasion of privacy, (4) unjust enrichment, and (5) breach of
fiduciary duty.1
J.B. Poindexter has filed a motion to dismiss, arguing that (1) this case
should be dismissed pursuant to Federal Rule of Civil Procedure 12(b)(1) because
Perlaki lacks Article III standing; and (2) even if Perlaki has standing, his causes
of action should all be dismissed pursuant to Rule 12(b)(6) for failure to state a
claim. I begin by addressing the jurisdictional issues.
RULE 12(b)(1) MOTION TO DISMISS
A.

LEGAL STANDARD
Rule 12(b)(1) allows a party to challenge the subject matter jurisdiction of

the district court to hear a case. See FED. R. CIV. P. 12(b)(1). A claim is properly
dismissed for lack of subject matter jurisdiction under Rule 12(b)(1) when “the
court lacks the statutory or constitutional power to adjudicate the claim.” In re
FEMA Trailer Formaldehyde Prods. Liab. Litig. (Miss. Plaintiffs), 668 F.3d 281,

1 Perlaki also purports to assert a claim for negligence per se. “Negligence per se is not a

separate cause of action that exists independently of a common-law negligence cause of
action. . . . Rather, negligence per se is merely one method of proving a breach of duty, a
requisite element of any negligence cause of action.” Thomas v. Uzoka, 290 S.W.3d 437,
445 (Tex. App.—Houston [14th Dist.] 2009, pet. denied).
2

286 (5th Cir. 2012) (cleaned up). In evaluating a Rule 12(b)(1) motion, I accept all
well-pleaded factual allegations in the complaint as true, viewing them in the light
most favorable to the plaintiff. See Daniel v. Univ. of Tex. Sw. Med. Ctr., 960 F.3d
253, 256 (5th Cir. 2020). “Ultimately, a motion to dismiss for lack of subject matter
jurisdiction should be granted only if it appears certain that the plaintiff cannot
prove any set of facts in support of his claim that would entitle plaintiff to relief.”
Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001).
District courts may dismiss a claim for lack of subject matter jurisdiction
upon consideration of: “(1) the complaint alone; (2) the complaint supplemented
by undisputed facts evidenced in the record; or (3) the complaint supplemented by
undisputed facts plus the court’s resolution of disputed facts.” Spotts v. United
States, 613 F.3d 559, 566 (5th Cir. 2010) (quotation omitted). Where, as here, “a
Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the court
should consider the Rule 12(b)(1) jurisdictional attack before addressing any attack
on the merits.” Ramming, 281 F.3d at 161.
Standing is a jurisdictional question that concerns “the power of the court to
entertain the suit.” Warth v. Seldin, 422 U.S. 490, 498 (1975). Article III of the
United States Constitution limits the power of federal courts to the resolution of
“Cases” or “Controversies.” U.S. CONST. art. III, § 2. The requirement that a
plaintiff establish standing to bring suit “is an essential and unchanging part of the
case-or-controversy requirement of Article III.” Lujan v. Defs. of Wildlife, 504 U.S.
555, 560 (1992). Every plaintiff in federal court must meet the “irreducible
constitutional minimum” of Article III standing, which requires that the plaintiff’s
injury be: (1) concrete, particularized, and actual or imminent; (2) fairly traceable
to the defendant’s challenged action; and (3) likely redressable by a favorable
ruling. Id. at 560–61; see also Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139,
149 (2010). The party asserting federal jurisdiction bears the burden of
demonstrating that standing exists. See TransUnion LLC v. Ramirez, 594 U.S. 413,
430–31 (2021).

3

In TransUnion, a recent case regarding the dissemination of misleading
credit reports, the United States Supreme Court addressed the requirement that a
“plaintiff’s injury in fact be concrete—that is real, and not abstract.” Id. at 424. A
class of 8,185 individuals sued TransUnion, a credit reporting agency, for failure
to use reasonable procedures to ensure the accuracy of their credit files. See id. at
417. For 1,853 of the class members, TransUnion provided misleading credit
reports to third parties, labeling the individuals as “potential terrorists, drug
traffickers, or serious criminals.” Id. at 432. The Supreme Court explained that to
satisfy the concrete harm requirement “the asserted harm [must bear] a ‘close
relationship’ to a harm traditionally recognized as providing a basis for a lawsuit
in American courts—such as physical harm, monetary harm, or various intangible
harms.” Id. at 417. Because the 1,853 class members misleadingly labeled terrorists
and criminals “suffered a harm with a ‘close relationship’ to the harm associated
with the tort of defamation,” the high court held that they “suffered a concrete
harm that qualifies as an injury in fact.” Id. at 432.
The remaining 6,332 class members, however, did not demonstrate a
concrete harm. Although their credit files contained misleading information, their
credit files were not provided to third parties and they were not denied lines of
credit. See id. at 437. Instead, the remaining class members asserted that they
suffered a concrete injury because they faced “a material risk that the information
would be disseminated in the future to third parties and thereby cause them harm.”
Id. at 435. The Supreme Court held that such risk of future harm does not represent
a concrete harm and is “too speculative” to support standing. Id. at 438.
Neither the Supreme Court nor the Fifth Circuit has had the opportunity to
explore standing issues in the context of a data breach. The Fifth Circuit has
reiterated, however, that “[a] plaintiff always must be able to point to a concrete
injury to bring suit. And if a risk hasn’t materialized, the plaintiff hasn’t yet been
injured.’” Perez v. McCreary, Veselka, Bragg & Allen, P.C., 45 F.4th 816, 824 (5th
Cir. 2022). Furthermore, a plaintiff “must demonstrate standing for each claim

4

that they press and for each form of relief that the seek.” Id. at 821 (quoting
TransUnion, 594 U.S. at 431). Although Perez is not a data breach case, its
standing analysis is relevant to this matter. Additionally, there are several district
court cases within the Fifth Circuit that have explored standing issues in data
breach cases after TransUnion. I will address relevant portions of those cases in
my analysis below.
B.

ANALYSIS
Perlaki claims he has standing to sue J.B. Poindexter for a variety of reasons:

(1) he faces an increased risk of identity theft and fraud; (2) he spent time and
efforts to mitigate the risk of harm; (3) he suffered a diminution in value of his PII;
and (4) he has a genuine concern about his personal financial security. I will
examine these allegations one-by-one.
1.

Heightened Risk of Identity Theft and Fraud Is Not a
Concrete Injury

Perlaki alleges that he suffers “imminent and impending injury arising from
the substantially increased risk of fraud, misuse, and identity theft . . . because
Defendant’s Data Breach placed Plaintiff’s PII right in the hands of criminals.” Dkt.
20 at 11. Yet, Perlaki provides no factual allegations to suggest that his information
is actually in criminal hands. Perlaki does not allege that his PII has been sold on
the dark web or to a criminal enterprise; nor does Perlaki allege that any of his PII
has actually been misused. Instead, he alleges that his PII may be misused in the
future. “Unless and until these conjectures come true, [Perlaki’s] alleged future
injuries are speculative—even hypothetical—but certainly not imminent.” Peters v.
St. Joseph Servs. Corp., 74 F. Supp. 3d 847, 854 (S.D. Tex. 2015).
As the Fifth Circuit held, “if a risk hasn’t materialized, the plaintiff
hasn’t yet been injured.” Perez, 45 F.4th at 824; see also Williams v.
Bienville Orthopaedic Specialists, LLC, No. 1:23CV232-LG-MTP,
2024 WL 3387169, at *5 (S.D. Miss. June 18, 2024) (“[Plaintiffs] have
not alleged an injury-in-fact because they have not alleged misuse or
actual access of their private information.”); Logan v. Marke[r]
Group, Inc., No. 4:22-CV-174, 2024 WL 3489208, at *4 (S.D. Tex.
July 18, 2024) (noting that the theory of heightened risk []has been
5

rejected by courts in the Fifth Circuit on several occasions). Here,
absent any evidence of actual or imminent misuse, the risk to [Perlaki]
has not materialized. Under Fifth Circuit precedent, the heightened
risk of identity theft and fraud does not suffice for an Article III injury.
In re ESO Sols., Inc. Breach Litig., No. 1:23-cv-1557, 2024 WL 4456703, at *5
(W.D. Tex. July 30, 2024). Because “a risk of injury does not qualify as concrete
harm for purposes of a damages claim,” Perlaki lacks standing to pursue a claim
for damages arising from the hypothetical heightened future risk of identity theft
or fraud. Perez, 45 F.4th at 827.
In addition to his claim of an increased risk of identity theft or fraud, Perlaki
alleges he “suffered from a spike in spam and scam text messages and emails
containing suspicious links” after the data breach. Dkt. 20 at 9. “Spam calls, texts,
and e-mails have become very common in this digitized world, and a number of
courts have declined to confer standing when considering an increase in spam
communications.” McCombs v. Delta Grp. Elecs., Inc., 676 F. Supp. 3d 1064, 1074
(D.N.M. 2023) (collecting cases). Accordingly, spam is not a concrete harm.
Perlaki further alleges that he had been “notified of fraudulent attempts to
make purchases at a Walmart store using [his] Capital One credit card.” Dkt. 20 at
10. Notably, however, Perlaki does not allege that J.B. Poindexter stored his credit
card information. Even considering Perlaki’s receipt of spam and a fraudulent
credit card attempt as a concrete harm, Perlaki does not allege that the spam and
fraud are fairly traceable to J.B. Poindexter’s data breach. Traceability means the
injury was caused by the “challenged action of the defendant” as opposed to an
“independent action of” a third party. Lujan, 504 U.S. at 560 (quotation omitted).
Most people have experienced attempted fraudulent credit card usage, and even
more people receive spam calls, texts, and emails daily. Because Perlaki’s phone
number and email address could have been accessed elsewhere, and because his
credit card information has not been alleged to be in J.B. Poindexter’s possession,
Perlaki fails to show that his alleged harm is traceable to J.B. Poindexter’s data
breach. Even if Perlaki could demonstrate traceability, it is unlikely that a favorable

6

decision would redress the alleged harm he has experienced. See Peters, 74 F.
Supp. 3d at 857. Thus, Perlaki does not have standing to seek damages for the
heightened risk of identity theft and fraud.
2.

Lost Time and Possible Future Expenses Are Not Concrete
Injuries

Perlaki also claims damages for lost “time and effort [he spent] monitoring
his accounts to protect himself from identity theft” after the data breach. Dkt. 20
at 9. J.B. Poindexter argues that time spent mitigating a potential risk of fraud or
identity theft does not create standing. See Dkt. 21 at 8. I agree. The Fifth Circuit
has stated that it is “not aware of any tort that makes a person liable for wasting
another’s time.” Perez, 45 F.4th at 825. To establish standing, Perlaki’s lost time
claim must bear a close relationship to some cognizable harm. Like the plaintiff in
Perez, Perlaki “doesn’t offer a common-law analog to the time-based injury [he]
claims to have suffered.” Id. Thus, he “has not met [his] burden to demonstrate
that [he] has standing based on that theory.” Id. (cleaned up).
“While the heightened risk of a data breach does not confer standing, dicta
from the Fifth Circuit suggests that mitigation efforts may show a concrete injury,”
but only if the plaintiff properly alleges such harm. In re ESO Solutions, 2024 WL
4456703, at *5 (citing Perez, 45 F.4th at 822). In the Amended Class Action
Complaint, Perlaki alleges that he “anticipates spending considerable amounts of
time and money to try and mitigate his injuries.” Dkt. 20 at 11 (emphasis added).
Importantly, Perlaki fails to allege that he has actually incurred any mitigation
expenses to date. While Perlaki may, in the future, spend money mitigating harms
from the data breach, this is plainly insufficient to confer standing at the present
time. Because Perlaki does not allege that he has incurred any sums on mitigation
efforts, he has not alleged a concrete injury.
In sum, lost time is not a concrete injury, and Perlaki fails to allege that he
has actually spent any money on mitigation efforts. Accordingly, Perlaki does not
have standing to seek damages for lost time and future mitigation expenses.

7

3.

Diminished Value of PII Is Not a Concrete Injury

Perlaki alleges that he “suffered actual injury in the form of damages to and
diminution in the value of his PII” because “PII is a form of intangible property.”
Dkt. 20 at 11. In response, J.B. Poindexter insists that the alleged diminution in
value of Perlaki’s PII is not a concrete harm. J.B. Poindexter argues that Perlaki
fails to allege the value of his PII prior to and after the data breach, and also fails
to allege that his PII has been published or sold after the data breach.
“District courts nationwide are split on whether diminution of PII
constitutes a concrete injury.” In re ESO Solutions, 2024 WL 4456703, at *6. Many
cases holding that diminution in value of PII is sufficiently concrete “involved
circumstances where the defendants collected information that was itself
monetized and used for commercial purposes.” In re Am. Med. Collection Agency,
Inc. Consumer Data Sec. Breach Litig., No. 2:19-cv-2904, 2021 WL 5937742, at
*10 (D.N.J. Dec. 16, 2021). “However, district courts in Texas have been more
skeptical, with at least three dismissing similar ‘loss-of-value’ claims.” In re ESO
Solutions, 2024 WL 4456703, at *6 (citing Ellis v. Cargill Meat Sols., No. 4:22-cv864, 2023 WL 9547632 (N.D. Tex. Oct. 31, 2023); Logan, 2024 WL 3489208, at
*7; Williams, 2024 WL 3387169, at *6).
Even if diminished PII was cognizable in the Fifth Circuit, [Perlaki
does] not plausibly show [his] PII has diminished in value. [Perlaki]
fail[s] to allege that [he] attempted to or would have ever sold [his]
PII. Nor [does Perlaki] allege that if [he] now attempted to sell [his]
PII, [he] would be forced to accept a diminished price for it. Most
problematically, [Perlaki] fail[s] to plausibly show that [his]
information is (or was) being actively distributed on the dark web or
any other marketplace for private information. The PII was stolen
from [J.B. Poindexter], but [Perlaki] has not plausibly alleged it has
been distributed any further. Until [Perlaki] plausibly allege[s] the
actual distribution of [his] information, [he] cannot viably claim that
[his] PII has diminished in value.
In re ESO Sols., 2024 WL 4456703, at *7 (cleaned up).
“District courts have been reluctant to find standing based solely on a theory
that the value of a plaintiff’s personal information has been diminished.” Logan,
8

2024 WL 3489208, at *7 (cleaned up). Even assuming “that personal information
has an inherent value and the deprivation of such value is an injury sufficient to
confer standing, [Perlaki] has failed to allege facts indicating how the value of his
personal information has decreased as a result of the Data Breach.” Green v. eBay
Inc., No. 14-1688, 2015 WL 2066531, at *5 n.59 (E.D. La. May 4, 2015). Because
Perlaki does not provide any factual support for the claim that his PII has
diminished in value, he does not have standing to seek damages for the diminution
in value of his PII.
4.

Perlaki’s Concern About His Personal Financial Security Is
a Concrete Injury

Perlaki alleges that he “fears for his personal financial security and worries
about what information was exposed in the Data Breach.” Dkt. 20 at 10.
Specifically, Perlaki claims the data breach has caused him to suffer from “anxiety,
sleep disruption, stress, fear, and frustration.” Id.
In TransUnion, the Supreme Court found that class members who were
merely put at risk of suffering some future harm lacked standing. See 594 U.S. at
439. The Court implied, however, that if the class members whose information had
not been misused had alleged “that they suffered some other injury (such as an
emotional injury) from the mere risk” of harm, they may have had standing to
pursue their claims. Id. at 437. The Court recognized that “a plaintiff’s knowledge
that he or she is exposed to a risk of future physical, monetary, or reputational
harm could cause its own current emotional or psychological harm,” but did not
reach the issue because no such harms were alleged. Id. at 436 n.7. Regardless, the
Fifth Circuit has held that “emotional harm satisfies the ‘injury in fact’ requirement
of constitutional standing.” Rideau v. Keller Indep. Sch. Dist., 819 F.3d 155, 169
(5th Cir. 2016); see also Perez, 45 F.4th at 824 (“A plaintiff can sue for damages if
the risk materializes or causes a separate injury-in-fact, such as emotional
distress.”); Smith v. Am. Pain & Wellness, PLLC, No. 4:23-cv-295, 2024 WL
4028050, at *7 (E.D. Tex. Sept. 3, 2024) (“[I]f the plaintiff’s knowledge of the

9

substantial risk of identity theft causes the plaintiff to presently experience
emotion distress . . . , the plaintiff has alleged a sufficiently concrete injury.”
(quotation omitted)). Thus, Perlaki may pursue damages for the emotional distress
he alleges due to fear for his financial security as a result of the data breach.
***
Because I find that Perlaki has standing to pursue damages for emotional
distress, I recommend that J.B. Poindexter’s Rule 12(b)(1) motion be denied. I now
turn to J.B. Poindexter’s argument that, even if Perlaki has standing, he
nonetheless fails to state a claim upon which relief can be granted. For the reasons
discussed below, I agree.
RULE 12(b)(6) MOTION TO DISMISS
A.

LEGAL STANDARD
Rule 12(b)(6) allows dismissal if a plaintiff fails “to state a claim upon which

relief can be granted.” FED. R. CIV. P. 12(b)(6). To avoid dismissal under Rule
12(b)(6), “a complaint must contain sufficient factual matter, accepted as true, to
‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662,
678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). These
factual allegations need not be detailed but “must be enough to raise a right to relief
above the speculative level.” Twombly, 550 U.S. at 555. “Determining whether a
complaint states a plausible claim for relief [is] . . . a context-specific task that
requires the reviewing court to draw on its judicial experience and common sense.”
Iqbal, 556 U.S. at 679. “[A] complaint must do more than name laws that may have
been violated by the defendant; it must also allege facts regarding what conduct
violated those laws.” Anderson v. U.S. Dep’t of Hous. & Urban Dev., 554 F.3d 525,
528 (5th Cir. 2008). In analyzing a Rule 12(b)(6) motion, I “accept all well-pleaded
facts as true, drawing all reasonable inferences in the nonmoving party’s favor.”
Benfield v. Magee, 945 F.3d 333, 336 (5th Cir. 2019).

10

B.

ANALYSIS
J.B. Poindexter argues that Perlaki fails to state any claim for relief. I will

address each of Perlaki’s claims in turn below.
1.

Perlaki Cannot Pursue a Negligence Claim with Only
Emotional Distress Damages

Negligence is the failure to use ordinary or due care—the failure to act as a
reasonably prudent person would have acted under the same or similar
circumstances. See 20801, Inc. v. Parker, 249 S.W.3d 392, 398 (Tex. 2008). I will
assume, for the sake of argument, that Perlaki adequately alleges the elements of a
negligence claim. Even so, as J.B. Poindexter points out, a “negligence claim
cannot survive solely on allegations of emotional distress.” Dkt. 21 at 19.
“Texas does not recognize a general legal duty to avoid negligently inflicting
mental anguish.” City of Tyler v. Likes, 962 S.W.2d 489, 494 (Tex. 1997). “There
are few situations in which a claimant who is not physically injured by the
defendant’s breach of duty may recover mental anguish damages.” Temple-Inland
Forest Prods. Corp. v. Carter, 993 S.W.2d 88, 91 (Tex. 1999) (quotation omitted).
A plaintiff may recover such damages only when: (1) the defendant acted with
intent or malice; (2) a special relationship exists between the two parties; or
(3) “the defendant’s negligence causes a mental shock which produces a serious
bodily injury.” City of Tyler v. Likes, 962 S.W.2d 489, 495 (Tex. 1997). Here,
Perlaki cannot satisfy any of these three conditions. First, Perlaki does not allege
that J.B. Poindexter acted with intent or malice. Second, “[a]n employment
relationship governed by the at-will doctrine does not give rise to a special
relationship.” Quintanilla v. K-Bin, Inc., 993 F. Supp. 560, 563 (S.D. Tex. 1998).
Third, Perlaki does not claim he has suffered a bodily injury. Thus, Perlaki’s
emotional distress damages cannot support his negligence claim. I recommend
that Perlaki’s negligence claim against J.B. Poindexter be dismissed.

11

2.

Perlaki Cannot Pursue Breach of Implied Contract Claim
with Only Emotional Distress Damages

Perlaki alleges that he provided his PII to J.B. Poindexter as a condition of
his employment and believed that a portion of the funds derived from his
employment would be used to pay for cybersecurity measures to protect his PII.
Perlaki alleges there was an implied promise by J.B. Poindexter to protect and not
disclose his PII to unauthorized persons, as evidenced by J.B. Poindexter’s privacy
policy. Perlaki claims that J.B. Poindexter breached that implied contract by failing
to: (1) safeguard his PII, (2) notify him promptly of the data breach, (3) comply
with industry standards, (4) comply with legal obligations enumerated in
agreements between the parties, and (5) ensure the confidentiality and integrity of
his PII. In response, J.B. Poindexter argues that Perlaki offers no factual support
evincing a meeting of the minds between the parties to support the finding of an
implied contract.
I will assume, without deciding, that Perlaki states a breach of implied
contract claim. Even so, it is well settled law in Texas that a “breach of contract
claim is barred as a matter of law [where] the damages pleaded by [the plaintiff]
are only for mental anguish which are not recoverable in a breach of contract case.”
Delgado v. Methodist Hosp., 936 S.W.2d 479, 484 (Tex. App.—Houston [14th
Dist.] 1996, no writ); see also Stewart Title Guar. Co. v. Aiello, 941 S.W.2d 68, 72
(Tex. 1997) (“[A] breach of contract action will not support mental anguish
damages.”); Bus. Staffing, Inc. v. Jackson Hot Oil Serv., 401 S.W.3d 224, 244 (Tex.
App.—El Paso 2012, pet. denied) (“For breach of contract, a party could recover
economic damages and attorney’s fees, but not mental anguish or exemplary
damages.”); In re Antone’s Recs., Inc., 445 B.R. 758, 789 (Bankr. W.D. Tex. 2011)
(“Damages for mental anguish and exemplary damages are not available in a
breach of contract case.”). “Certain ‘special relationships,’ including a very limited
number of contracts dealing with intensely emotional noncommercial subjects
such as preparing a corpse for burial, may give rise to a legal duty to avoid causing

12

mental anguish. [Perlaki does] not contend that any such duty existed here.” Jones
v. Pesak Bros. Const., Inc., 416 S.W.3d 618, 631 n.4 (Tex. App.—Houston [1st Dist.]
2013, no pet.) (cleaned up). Accordingly, I recommend that Perlaki’s breach of
implied contract claim be dismissed because, as with his negligence claim, Perlaki
has no cognizable damages to support such a claim.
Although J.B. Poindexter raised the fact that emotional distress damages
alone are not a compensable injury for a negligence claim under Texas law, it failed
to raise the same argument in regard to Perlaki’s breach of implied contract claim.
Even so, the law is the law. At some point in this litigation, the court will be forced
to dismiss Perlaki’s breach of implied contract claim because his only damages are
unrecoverable emotional distress damages. The Fifth Circuit has held that “[a]
district court may dismiss sua sponte a complaint for failure to state a claim as long
as the procedure employed is fair.” Anokwuru v. City of Houston, 990 F.3d 956,
967 (5th Cir. 2021). So, I will save the parties some time by raising this issue myself.
This Memorandum and Recommendation serves as sufficient notice, and Perlaki
has the opportunity to be heard by filing objections to this Memorandum and
Recommendation.
3.

Perlaki Fails to Allege an Invasion of Privacy Claim

Perlaki pleads that J.B. Poindexter “owed a duty to its current and former
employees” to protect and keep confidential their PII, and the data breach
“constitutes an intentional interference with [his] . . . interest in solitude or
seclusion.” Dkt. 20 at 26, 27. Perlaki alleges that he had a legitimate expectation of
privacy regarding his PII, and that J.B. Poindexter breached its duty by
“permit[ing] the Data Breach” and knowingly “fail[ing] to notify [Perlaki] . . . in a
timely fashion about the Data Breach.” Id. at 27.
A person commits the tort of intrusion upon seclusion—colloquially known
as “invasion of privacy”—by “intentionally intrud[ing], physically or otherwise,
upon the solitude or seclusion of another or his private affairs or concerns . . . if the
intrusion would be highly offensive to a reasonable person.” RESTATEMENT

13

(SECOND) OF TORTS § 652B. “Texas courts have held that intrusion upon private
affairs typically requires either a trespass or an attempt to discover or perceive
private information.” Amin v. United Parcel Serv., Inc., 66 F.4th 568, 577 (5th Cir.
2023). “The Texas Supreme Court defines the invasion of privacy as an intentional
tort.” Hays v. Frost & Sullivan, Inc., SA-23-cv-1490, 2024 WL 4052741, at *11
(W.D. Tex. Aug. 16, 2024).
J.B. Poindexter argues that Perlaki “voluntarily gave personal information
to J.B. Poindexter in the regular course of his employment.” Dkt. 21 at 16. Because
Perlaki “voluntarily gave his information to [J.B. Poindexter], he cannot now allege
that [J.B. Poindexter] intruded on his solitude. When confronted with invasion-ofprivacy claims in the data breach context, courts have similarly noted that a
plaintiff’s voluntary disclosure of their personal information dooms their claim.”
Logan, 2024 WL 3489208, at *9 (quotation omitted).
Although Perlaki alleges J.B. Poindexter acted intentionally in failing to keep
his PII confidential and preventing “[t]he unauthorized acquisition (i.e., theft) by
a third party of” his PII, Dkt. 20 at 27, Perlaki fails to allege facts showing J.B.
Poindexter willfully intruded upon Perlaki’s solitude. “[I]nvasion of privacy is an
intentional tort, [thus] a theory based on negligent failure to safeguard and protect
personal information is insufficient to state a claim for invasion of privacy.” Logan,
2024 WL 3489208, at *9 (quotation omitted). Perlaki states, in a conclusory
manner, that J.B. Poindexter “acted with a knowing state of mind when it
permitted the Data Breach because it knew its information security practices were
inadequate.” Dkt. 20 at 27. Such an allegation is insufficient to show J.B.
Poindexter intentionally permitted access to or disseminated Perlaki’s PII to third
parties. Because Perlaki fails to allege that J.B. Poindexter acted with intent, I
recommend his invasion of privacy claim be dismissed.

14

4.

Perlaki Fails to Allege an Unjust Enrichment Claim

Perlaki alleges that he “conferred a benefit upon” J.B. Poindexter by
providing his PII to J.B. Poindexter to “facilitate employment” and by allowing J.B.
Poindexter to use his labor to “derive profit.” Dkt. 20 at 28.
“Under Texas law an unjust enrichment claim requires showing that one
party has obtained a benefit from another by fraud, duress, or the taking of an
undue advantage.” Digital Drilling Data Sys., L.L.C. v. Petrolink Servs., Inc., 965
F.3d 365, 379 (5th Cir. 2020) (quotation omitted). Perlaki does not plead that J.B.
Poindexter acquired his PII by fraud or duress, but instead argues that J.B.
Poindexter has taken some undue advantage by requiring employees’ personal
information and failing to subsequently secure that data. Perlaki argues that J.B.
Poindexter “enriched itself by saving the costs they reasonably should have
expended on data security measures” and instead “utilize[ed] cheaper, ineffective
security measures” at Perlaki’s expense. Dkt. 20 at 29.
“Several courts across the country have allowed unjust enrichment claims to
survive at the Rule 12 stage in the data-breach context . . . [where] the plaintiffs
allege that their data was given to the defendant along with something else of
value—usually money.” Logan, 2024 WL 3489208, at *10. Perlaki argues that he
agreed to engage in an employment relationship with J.B. Poindexter with the
expectation that J.B. Poindexter would take precautions and spend necessary
expenses on data security. Maybe so, but Perlaki agreed to engage in an
employment relationship with J.B. Poindexter with the expectation that J.B.
Poindexter would pay Perlaki for his labor. Perlaki makes no allegation that J.B.
Poindexter has failed to adequately pay him, nor does Perlaki otherwise allege
“something of value” he gave to J.B. Poindexter in return for safeguarding his data.
“[T]he only thing [Perlaki] gave to [J.B. Poindexter] was his personal information”
and “nothing else to serve as consideration for the safe keeping of such
information.” Logan, 2024 WL 3489208, at *11.

15

Because Perlaki has not alleged that he conferred a benefit on J.B.
Poindexter for which he was not compensated, he fails to allege a claim for unjust
enrichment. Thus, I recommend Perlaki’s unjust enrichment claim be dismissed.
5.

Perlaki Fails to Allege a Breach of Fiduciary Duty Claim

Perlaki alleges that “given the relationship between” the parties, J.B.
Poindexter “became a fiduciary by its undertaking and guardianship of the PII”
and is responsible for safeguarding his PII, timely notifying Perlaki of a data
breach, and maintaining his PII. Dkt. 20 at 30. Perlaki argues that J.B. Poindexter
breached its fiduciary duty “by failing to sufficiently encrypt or otherwise protect”
his PII and “by failing to diligently discover, investigate, and give notice of the Data
Breach in a reasonable” time. Id. J.B. Poindexter moves to dismiss Perlaki’s breach
of fiduciary duty claim on the ground that Perlaki has failed to allege sufficient facts
to demonstrate that a fiduciary relationship existed between the parties. I agree.
To succeed on a breach of fiduciary duty claim, Texas law requires “(1) a
fiduciary relationship between the plaintiff and defendant, (2) a breach by the
defendant of his fiduciary duty to the plaintiff, and (3) an injury to the plaintiff or
benefit to the defendant as a result of the defendant’s breach.” Lundy v. Masson,
260 S.W.3d 482, 501 (Tex. App.—Houston [14th Dist.] 2008, pet. denied.). There
are two types of fiduciary relationships: (1) a “formal” relationship in which a duty
arises as a matter of law (such as attorney-client, principal-agent, trusteebeneficiary, or between partners in a partnership); and (2) an “informal”
relationship arising from a moral, social, domestic, or personal relationship called
a “confidential” relationship. Id. at 502.
It is well settled that “[i]n Texas, employers generally do not owe fiduciary
duties to their employees.” Meadows v. Hartford Life Ins. Co., 492 F.3d 634, 640
(5th Cir. 2007). Thus, fiduciary duty claims based on an employer-employee
relationship are often dismissed. See, e.g., Garcia v. Cmtys. in Schs. of Brazoria
Cnty, Inc., No. H-18-4558, 2019 WL 2420079, at *11 (S.D. Tex. June 10, 2019)
(“Texas law does not recognize a fiduciary duty or a duty of good faith and fair

16

dealing owed by an employer to an employee.”); Arizmendi v. ORC Indus., No. B06-125, 2007 WL 1231464, at *1 (S.D. Tex. Apr. 26, 2007) (dismissing employee’s
claim because “Texas does not recognize a fiduciary duty or a duty of good faith
and fair dealing owed by an employer to an employee” (quotation omitted)).
While there is no formal fiduciary duty between an employer and an
employee, there still may be an informal fiduciary relationship, characterized by a
close personal relationship of trust and confidence between the parties. See
Bombardier Aerospace Corp. v. SPEP Aircraft Holdings, LLC, 572 S.W.3d 213,
220 (Tex. 2019) (noting that an informal fiduciary relationship may be formed
“from a moral, social, domestic or purely personal relationship of trust and
confidence” (quotation omitted)). In Hays, a data breach case regarding an
employee-employer relationship, the court analyzed whether there was a “special
relationship of trust and confidence” between an employer and employee sufficient
to “impose an informal fiduciary duty.” 2024 WL 4052741, at *10. The court held
that in order to find an informal fiduciary duty, the parties must have engaged in
some “business transaction,” but the plaintiff had “not pleaded any such special
relationship.” Id. Similarly, Perlaki has not alleged any special relationship here.
“A fiduciary relationship is an extraordinary one and will not be lightly
created; the mere fact that one subjectively trusts another does not alone indicate
that confidence is placed in another in the sense demanded by fiduciary
relationships.” Hoggett v. Brown, 971 S.W.2d 472, 488 (Tex. App.—Houston [14th
Dist.] 1997, writ denied). The Amended Class Action Complaint is completely
devoid of allegations indicating that a fiduciary relationship existed between the
parties. Even viewed in the light most favorable to Perlaki, the relationship
between Perlaki and J.B. Poindexter is nothing more than that of employer and
employee—a relationship that does not give rise to a fiduciary duty. Accordingly, I
recommend Perlaki’s breach of fiduciary duty claim be dismissed.

17

CONCLUSION
Perlaki’s only cognizable injury is for his alleged emotional damages caused
by the data breach. Those emotional damages are not recoverable in negligence or
contract, so Perlaki’s negligence and breach of implied contract claims should be
dismissed. Likewise, Perlaki’s claims for invasion of privacy, breach of fiduciary
duty, and unjust enrichment should be dismissed for failure to state a claim.
Because there are no claims remaining, I recommend the case be dismissed.
The parties have 14 days from service of this Memorandum and
Recommendation to file written objections. See 28 U.S.C. § 636(b)(1)(C); FED. R.
CIV. P. 72(b)(2). Failure to file timely objections will preclude appellate review of
factual findings and legal conclusions, except for plain error.
SIGNED this 10th day of March 2025.
______________________________
ANDREW M. EDISON
UNITED STATES MAGISTRATE JUDGE

18