Background
John Doe Nos. 1 through 5, City of Columbus employees, and Jane Doe, a nonemployee who had provided information to the city, sued after a July 2024 cyberattack on the city’s unified IT system. They alleged that cybercriminals obtained and released or threatened to release personally identifiable information on the Dark Web, causing injuries including fraudulent charges, ransom demands, compromised credit information, and expenses to protect their identities.
The consolidated proposed class action alleged negligence and related claims based on inadequate cybersecurity safeguards, system design, employee training, and breach response. The Franklin County Court of Common Pleas found the plaintiffs had standing but dismissed their tort claims under Ohio’s Political Subdivision Tort Liability Act, concluding that the city’s IT infrastructure served governmental functions and was immune.
The Court’s Holding
The Tenth District reversed and remanded. At the pleading stage, the court held that the complaint did not conclusively establish that the city’s operation of its IT infrastructure and protection of stored personal information were governmental functions for purposes of political-subdivision immunity.
The alleged activity directly causing the asserted injuries was the operation and security of the citywide IT system, not the downstream public-safety services that may use that system. The court concluded that such IT and cybersecurity work was not shown on the face of the complaint to benefit all Ohio citizens, and that nongovernmental entities customarily perform similar work. The court did not decide the ultimate immunity question; it held only that dismissal under Civ.R. 12(B)(6) was premature. It left for the trial court on remand the city’s argument that discretionary-function immunity may apply under R.C. 2744.03(A)(5).
Key Takeaways
- A municipality cannot obtain dismissal on immunity grounds unless immunity is conclusively established from the complaint.
- Courts must focus on the specific activity alleged to have caused the injury, rather than broadly characterizing all supporting municipal operations as governmental.
- IT operations and cybersecurity practices may plausibly involve proprietary functions because private entities customarily perform them.
Why It Matters
The decision permits the plaintiffs’ data-breach claims to proceed beyond the pleading stage and rejects a categorical rule that municipal cybersecurity is immune simply because city IT systems support police, fire, and other public services.
For public entities and data-breach litigants, the ruling highlights the fact-specific nature of Ohio immunity analysis when a claim concerns technology infrastructure rather than an expressly listed governmental function.