吉布森诉勇士冶金煤炭公司案

This is a putative class action arising from a July 2023 data breach at Warrior Met Coal Inc. The company collects and maintains personal identifying information of its employees. Unauthorized third parties stole the personal identifying information of over 19,000 current and former employees. Plaintiff Douglas Gibson, a former employee from 2013 to 2019, brought state law claims on behalf of himself and a putative class, seeking injunctive relief and monetary damages for negligence, negligence per se, breach of implied contract, invasion of privacy, and unjust enrichment. Warrior moved to dismiss the complaint.

The court granted in part and denied in part Warrior's motion to dismiss. It dismissed without prejudice all requests for injunctive relief except the request to educate class members, for lack of standing. It dismissed Count Four (invasion of privacy) for failure to state a claim. It denied the motion to dismiss Counts One, Two, Three, and Five (negligence, negligence per se, breach of implied contract, and unjust enrichment).

Whether the plaintiff had Article III standing to seek injunctive relief and whether he adequately stated claims for negligence, negligence per se, breach of implied contract, invasion of privacy, and unjust enrichment under Alabama law. The court also examined whether the invasion of privacy claim required showing intentional wrongful intrusion, which reckless conduct could not satisfy.

The decision clarifies the standing requirements for injunctive relief in data breach class actions and establishes that reckless data security practices alone do not support an Alabama invasion of privacy claim. It allows negligence and contract-based claims to proceed, reinforcing corporate accountability for protecting employee data. The ruling provides guidance for data breach litigation, emphasizing that plaintiffs must demonstrate concrete injuries for standing while permitting monetary damages claims to advance.