Employees’ data breach suit can move forward against restaurant chain

Summary: Fourteen federal lawsuits filed against Taco Bell and Taylor Farms Michigan Department of Health reports over 12,000 cyclosporiasis cases Judicial Panel on Multidistrict Litigation may centralize federal cases   Lawsuits are mounting from Michigan's largest outbreak of cyclosporiasis, a parasitic illness that causes extreme gastrointestinal issues, as some of those infected seek compensation for what they've endured, and at least one legal expert sees hundreds more claims coming down the road. Fourteen people have filed federal lawsuits against Taco Bell and Taylor Farms connected to the outbreak, which started in late June and has infected more than 12,000 people in Michigan alone. The lawsuits represent plaintiffs from all over Michigan, including a Clinton Township couple and a Warren woman. Most of the lawsuits seek compensation and contend the fast-food chain and California-based Taylor Farms were negligent and should have done more to protect customers. The most recent suit was filed last week by Dawn Koss, a Melvin, Michigan, resident who filed a class action. "Individuals have a reasonable expectation that they should be able to eat commercially produced and publicly available food products without becoming violently ill due to the negligence, gross negligence and deceptive practices of the corporations producing and selling that food," contended one complaint filed July 23 in federal court in Detroit by seven Michigan plaintiffs against Taylor Farms and Taco Bell. William Marler, an attorney who specializes in food safety litigation and who has filed two lawsuits related to the outbreak in Michigan, estimated 50 to 100 lawsuits will be filed nationwide in the outbreak. "Size-wise, this is getting to be one of the largest foodborne illness outbreaks in … easily the last 30 years. … You just don't normally see that this size," Marler said. The litigation comes as cases finally appear to be tapering off in Michigan. The Michigan Department of Health and Human Services, which has reported 12,485 cases of cyclosporiasis since cases were first reported June 22, recently lifted its recommendation to avoid bagged salad mixes during the outbreak. Marc Lipton, a Southfield-based attorney for seven people from different Michigan communities who are now suing related to the outbreak, said he "would not be surprised" if thousands of cyclosporiasis lawsuits get filed and then consolidated into one centralized federal case. One federal judge would be responsible for the pre-trial process for all of the federal cases across the country if they are consolidated, he said. Marler said it's the largest foodborne illness outbreak since a Salmonella outbreak in 1994 that was linked to ice cream. The Centers for Disease Control and Prevention, the Food and Drug Administration, and state public health officials have been investigating the multistate outbreak of cyclosporiasis linked to tainted iceberg lettuce from central Mexico since late June. Fifteen states are now included in the outbreak: Michigan, Indiana, Kentucky, Ohio, West Virginia, Kansas, Illinois, Oklahoma, Pennsylvania, Missouri, Arkansas, Iowa, Nebraska, New Hampshire and North Carolina. On July 17, Taylor Farms, a global producer of salads and other foods, initiated a recall of all iceberg lettuce sourced from central Mexico, according to the Centers for Disease Control and Prevention. At least two people in Michigan have died from cyclosporiasis, though state health officials have noted they had underlying health conditions. Marler, of The Marler Clark Law Firm, a prominent food safety law practice based in Washington state, said he has been retained by over 400 people in the U.S. who got cyclosporiasis this year. He has filed five lawsuits. Marler said he doesn't need to file lawsuits for all his clients. He said he often sends demands to the companies responsible for his clients' illnesses, which can lead them to be compensated without a lawsuit being filed. Marler said the information he learns through the discovery process for one case can be used in other cases. Lipton, the Southfield-based attorney, soon plans to file another case, including about 30 people. Lawsuits have been filed in U.S. District Court in other states, and the Judicial Panel on Multidistrict Litigation will decide which federal judge will be responsible for the pre-trial process for all of the federal cases, he said. "We're going to argue that because Michigan has the most victims and is centrally located among all of the states ... where the victims are, the case should center in Michigan," Lipton said. For those who have been affected and are now suing, Marler said his job is "to be a lawyer" and get his clients compensated for what they went through. That would include medical bills, wage loss and more. He said he is also very interested in learning "what happened" in a foodborne-illness outbreak and what can be done to prevent the next outbreak from happening. "That's another part of ... the reason why I file lawsuits and do discovery is because I can force people to testify under oath. I can get documents under oath. I can force people to ... be truthful," Marler said. Lipton pointed to reporting in publications such as WIRED that said the federal lab that responded to the cyclosporiasis outbreaks shrank from 11 people to three because of federal government layoffs last year by the Department of Government Efficiency. Cyclospora was one of multiple parasites that were removed from a mandatory reporting list last summer under the Trump administration, USA Today reported in mid-July. Historically, the CDC's Foodborne Diseases Active Surveillance Network, or FoodNet, tracked cases of food poisoning, referring to a number of pathogens that can cause gastrointestinal and other symptoms. Under Secretary Robert F. Kennedy Jr., required monitoring was reduced from eight pathogens to two, and the other six pathogens were made optional, including Cyclospora. Salmonella and STEC remain the two required pathogens for monitoring. Kennedy told USA Today that the surveillance of foodborne illness is working and that federal authorities have been quick to track the outbreaks that occur every summer. “We have a surveillance system in place, and it's working better than it's ever worked in history,” Kennedy said, also rejecting that personnel cuts at the CDC hurt disease surveillance. But Marler said the U.S. needs to "fix our public health system" instead of dismantling it. "The cuts to the FDA, both by DOGE, and the cuts to the CDC have been devastating to public health. The cuts to state and local health departments ... for their own infrastructure has been also devastating to public health," he said. This article originally appeared on The Detroit News: “Lawsuits rising in cyclosporiasis outbreak with more likely coming, experts say” Reporting by Anne Snabes, The Detroit News / The Detroit News USA TODAY NETWORK

Summary: North Carolina Business Court denies restaurant motion to dismiss Plaintiffs allege breach of implied contract and negligence claims More than 100 employees' personal data compromised in 2024 breach Former restaurant employees can move forward on their claims of negligence, breach of implied contract, unjust enrichment, declaratory judgment and a violation of the Unfair and Deceptive Trade Practices Act, the North Carolina Business Court has ruled, denying the employer’s motion to dismiss those claims. Nine former employees (six of whom reside in North Carolina) filed suit against the fast-food chain they used to work for after a data breach occurred between Feb. 19 and March 12, 2024. As a condition of their employment, the plaintiffs were required to provide their personal identifying information and protected health information (PII/PHI) for payroll and other employment-related purposes. The restaurant’s privacy policy states: “ has security policies and practices in place designed to protect your Personal Information against unauthorized access or disclosure, theft, misuse, and loss,” and promises that the restaurant will “make commercially reasonable efforts to for secure handling of this information.” According to the lawsuit, more than 100 employees’ names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, passport numbers, state ID numbers, financial information, insurance information and medical information were compromised in the data breach. The plaintiffs brought claims for negligence, negligence per se, breach of implied contract, invasion of privacy, unjust enrichment, violation of the North Carolina Unfair and Deceptive Trade Practices Act (UDTPA) and declaratory judgment, asserting that the restaurant failed to use reasonable and appropriate measure to protect against unauthorized access, failed to follow industry best standards and failed to implement industry standard cybersecurity measures. They claimed that their actual damages include the lost value of their PII/PHI, lost time and money to mitigate and remediate the effects of the data breach and lost “benefit of the bargain.” In addition to monetary damages, the plaintiffs alleged that they suffered from an increased risk of future harm, embarrassment, humiliation, frustration and emotional distress. The restaurant moved to dismiss. Special Superior Court Judge for Complex Business Cases Julianna T. Earp granted the motion in part and denied it in part. Considering the negligence claim, the court found that the plaintiffs adequately alleged that the restaurant had a legal duty to protect their data. They alleged that it was foreseeable that cybercriminals would attempt a data breach and that they would be successful given the inadequate security measures. They further alleged that the restaurant had a duty to notify them of the data breach within a reasonable timeframe. Similarly, the plaintiffs satisfied their pleading obligation regarding causation as well as damages, the court said, noting that while the restaurant argued their alleged damages were too speculative to state a claim, the plaintiffs alleged that they currently existed. As for the breach of implied contract claim, the court relied upon recent federal court decisions in the state – Capiau v. Ascendum Mach., Inc. and Midkiff v. Shoe Show, Inc. – where both courts held that in cases involving plaintiffs who were required to provide their personal confidential information to employers, the employer has an implicit obligation to adequately safeguard the information it receives. “Likewise, Plaintiffs in this case allege that ‘s a condition of employment with ’ they were required to provide their PII/PHI,” the court wrote. “Plaintiffs allege that they ‘trusted would use reasonable measures to protect it according to internal policies, as well as state and federal law.’ policy promised (but did not guarantee) that would protect the information against theft and that would make ‘commercially reasonable efforts’ for the secure handling of the information. These allegations are sufficient to plead the existence of an implied contract.” Turning to unjust enrichment, the plaintiffs adequately alleged that they expected to receive a benefit, claiming that they reasonably understood that in exchange for receiving their PII/PHI, the restaurant would use adequate cybersecurity measures to protect it – and further alleged the restaurant utilized “cheaper, ineffective security measures.” As for the UDTPA claim, the plaintiffs satisfied the notice pleading standard with allegations that the restaurant failed to implement and maintain reasonable security and privacy measures, the court determined, again citing Capiau for support. The court also allowed the plaintiffs’ claim declaratory judgment. “Plaintiffs allege that an actual controversy exists because maintains possession of their PII/PHI and, they believe, continues to fail to implement appropriate and adequate security measures,” the court said. “These allegations are enough to state a claim for declaratory judgment.” However, the court made quick work of the negligence per se claim, which the employees had abandoned, dismissing it with prejudice. The court also granted the motion to dismiss the plaintiffs’ claim for invasion of privacy, agreeing with the restaurant that North Carolina does not recognize a cause of action for public disclosure of private facts. Granting the motion to dismiss with prejudice on negligence per se and invasion of privacy claims, the court denied it for the remaining claims. Scott C. Harris of Bryson Harris Suciu & DeMay in Raleigh, who represented the plaintiffs, did not respond to a request for comment on the decision. Neither did Charlotte attorney Charles E. Johnson of Robinson, Bradshaw & Hinson, who represented the restaurant.

Summary: ACLU of Rhode Island urges Cumberland to end Flock contract Eva Pizzarelli seeks $750,000 for false arrest and malicious prosecution Federal lawsuit filed in U.S. district court alleges misidentification The American Civil Liberties Union of Rhode Island is imploring the town of Cumberland to end its contract with Flock Safety based on allegations in a federal lawsuit accusing the police of using a photo pulled from the license plate reader to wrongfully arrest and prosecute a woman. The ACLU is calling on Cumberland leaders to cancel the town's contract with Flock and the use of their automated license plate readers based on concerns raised in the complaint that the cameras have been used to take photos not just of license plates but of people inside the vehicle, the organization said in a press release on Aug. 7. The incident, it says, highlights that “contrary to routine police claims that the ALPRs only take photos of license plates, in this case, the camera was also capable of taking pictures of drivers and passengers.” “These cameras are concerning enough when used just as license plate readers, but their danger is exponentially increased when expanded to take photos of people as well. Just as disturbing is the fact that no mention was made about this capability when the cameras were approved for purchase in 2024,” Steven Brown, executive director of the ACLU of RI, said in a letter to the Town Council. The ACLU is calling, too, for full disclosure to the public about how the cameras are being used and when they began being used to capture photos of people inside vehicles, as well as “whether and when this previously unreported surveillance expansion beyond license plate data was ever shared publicly.” Cumberland Mayor Jeffrey Mutter said in an email as he was traveling back from South Carolina that the town is “taking the matter seriously and have been paying attention to actions of other communities here in Rhode Island.” “I also have concerns about instances in other states that have been reported recently,” Mutter said in an email. A spokesperson for Flock Safety did not immediately respond to an email inquiry. The suit was filed in U.S. District Court in June on behalf of Eva Pizzarelli and alleges that she was wrongfully arrested and prosecuted by Cumberland police after she was misidentified by an officer using Flock photos. According to the claims, Officer Jack Halloran was patroling Broad Street on March 26, 2025, when he saw a gray Volkswagen fail to signal a turn. Halloran tried to stop the car, but instead it fled into Attleboro, Massachusetts, at a high speed. Halloran stopped the pursuit minutes later and reported that he had a “clear view” of the driver, a “white, middle-aged woman, with red hair.” Sgt. Brandon Correia tracked down that the car was registered to a 73-year-old disabled veteran from South Kingstown, the complaint says. Correia reviewed people associated with the car and searched the Facebook account of one potential user. Correia then reviewed that individual’s "friends" and located a photograph of a White woman with red hair, leading him to the profile of Pizzarelli, who at the time of that photo, had red hair. Correia forwarded the profile to Halloran, who confirmed that Pizzarelli was the driver, the suit says. Correia reported that he had secured footage from a Flock camera and concluded that the driver in the footage “matches” Pizzarelli’s driver’s license photo. Halloran wrote up a complaint charging Pizzarelli with reckless driving and eluding police and other traffic offenses, the suit says. On April 8, 2025, the East Providence police stopped Pizzarelli for an alleged traffic violation and took her into custody after learning there was a warrant for her arrest out of Cumberland, the suit says. Pizzarelli was taken to Cumberland, where she was questioned and denied any involvement or knowledge of the incident in March. During questioning, Halloran stated, “Now that I see you in person, I am 1,000% sure it was you,” Pizzarelli alleges in the suit. Halloran noted that it was Pizzarelli’s birthday, sarcastically stating, “Happy Birthday,” while she was being held for more than six hours before being charged and released. Pizzarelli was prosecuted and temporarily had her license suspended before the charges were dismissed, the suit says. Pizzarelli is seeking $750,000 in damages for claims that include malicious prosecutions, false arrest and negligence. The town denied the claims in its response in court and argues that the officers are shielded by qualified immunity. This article originally appeared on The Providence Journal: "RI woman says Flock camera misidentified her, leading to arrest" Reporting by Katie Mulvaney, Providence Journal / The Providence Journal