Can a data-breach plaintiff build negligence per se on a statute the plaintiff can't sue under directly, like the FTC Act? Usually, yes. Federal courts rejected that defense in 7 of 8 decisions. The one win came in New York in 2021, and in 2026 three orders applying the same New York law went the other way.
The defense
A statute has a private right of action when it lets an individual sue to enforce it. The FTC Act and HIPAA, the two statutes data-breach plaintiffs rely on most, don't. Only the government enforces them.
Negligence per se lets a plaintiff use a statute violation to show the defendant was careless. The defense argument is simple: if a plaintiff can't sue under the statute, letting negligence per se rest on it gives the plaintiff a right the legislature withheld.
The same state, opposite answers
| 2021: the defense won | 2026: the defense lost | |
|---|---|---|
| Ruling | In re GE/CBPS Data Breach Litigation, No. 1:20-cv-02903 (S.D.N.Y. 2021) | In re PowerSchool Holdings, Inc. Customer Security Breach Litigation, No. 3:25-md-03149 (S.D. Cal. 2026), three orders applying New York law |
| What the court said | Allowing the claim to proceed on the FTC Act "would be inconsistent with the legislative scheme." | "Accordingly, the Court holds that HIPAA and the FTC Act may support Plaintiffs’ negligence per se claim under New York law." (Movate order) |
The 2026 orders didn't overlook the earlier line. The Movate order said, "There is a split of authority." It named the New York decisions the defense relied on and chose the other side.
The line the 2026 court drew
The Movate court separated two uses of a statute. One is enforcing the statute directly, which a private plaintiff can't do. The other is borrowing its standard of care inside a negligence claim. In the court's words, the New York trial-court reasoning the defense relied on "conflates two distinct concepts: using a statute to create direct liability and using a statute to define the standard of care within an independent tort claim."
The plaintiff still has to prove the rest of negligence, including causation and damages. That is why, in the court's view, the claim doesn't hand the plaintiff the right to sue that the statute withheld.
The other decisions
- Minnesota: In re Change Healthcare, No. 0:24-md-03108 (D. Minn. 2025). "In light of this unclear law, the Court declines to dismiss the negligence per se claims for lack of a private right of action."
- Montana: In re Snowflake, No. 2:24-md-03126 (D. Mont. 2025). Montana's own cases point both ways. "The Court recognizes the conflict in the case law and will adopt the more recent holding" that allows the claim.
- Georgia: In re Young Consulting, No. 1:24-cv-03938 (N.D. Ga. 2026). Both defendants made the argument, and "The Court rejects the Defendants’ private right of action arguments." Georgia got there by its own rule: the question is whether the statute supplies "a legal duty with some ascertainable standard of conduct," not whether it has a private right of action.
What to do
| If you represent the defendant | If you represent the plaintiff |
|---|---|
| Don't lead with this defense. It lost 7 of 8 times, and in New York it now has live authority against it. | Answer with the Movate line: the statute sets the standard of care, and the negligence claim supplies the remedy. |
| If you raise it, brief it as a split, not settled law. Name the cases on the other side before the court does. | Cite your state's own rule if it doesn't ask about a private right of action, as Georgia's doesn't. |
| Look first for a stronger threshold argument, such as whether the state recognizes negligence per se as its own claim at all. | Expect the defendant's better arguments to be about who the statute protects and whether the state allows the claim. |
Method: eight federal district court decisions, in seven orders, in LawSnap's data-breach class-action corpus that ruled on whether a statute without a private right of action can support a negligence per se claim, as of November 11, 2026, each read in full. One Georgia order decided the question for two defendants and counts twice. A Georgia ruling that applied the FTC Act without addressing a private right of action is not counted. District court rulings do not bind other courts. Nothing here is legal advice.