In five states, a data-breach plaintiff can't bring negligence per se as a separate claim. In six federal rulings applying the law of Arizona, Michigan, Nevada, Pennsylvania and Washington, the court said so, and the standalone count was dismissed every time. The plaintiff's ordinary negligence claim was a separate question.
What negligence per se is
Negligence per se lets a plaintiff use a defendant's violation of a statute to show the defendant was careless. In data-breach cases, the statute is usually the Federal Trade Commission Act or HIPAA, the federal health privacy law. Plaintiffs often plead it twice: once inside their negligence claim, and once as its own count.
In these five states, the second count doesn't exist. The statute can still help prove the negligence claim. It just can't stand alone.
The rule, state by state
| State | Ruling | What the court said |
|---|---|---|
| Arizona | Dobson v. SimonMed Imaging LLC, No. 2:25-cv-00527 (D. Ariz. 2025) | The court said "negligence per se is not a standalone cause of action" and dismissed the claim "to the extent that it is brought as a standalone cause of action." |
| Michigan | In re A-Line Staffing Solutions Data Security Incident Litigation, No. 2:24-cv-11917 (E.D. Mich. 2026) | Michigan law "does not subscribe to [that] doctrine" as an independent tort, so the court dismissed the standalone count. |
| Michigan | Malone v. Edw. C. Levy Co., No. 2:25-cv-11107 (E.D. Mich. 2026) | "Michigan does not recognize this claim as an independent cause of action." The plaintiff had already dropped the standalone count. |
| Nevada | Jordan v. Absolute Dental Group, LLC, No. 2:25-cv-00986 (D. Nev. 2026) | "Negligence per se is not an independent cause of action but a means of establishing the duty and breach elements of a negligence claim." The count was dismissed as duplicative. |
| Pennsylvania | In re Rutter's Inc. Data Security Breach Litigation, No. 1:20-cv-00382 (M.D. Pa. 2021) | Negligence per se is not "an independent basis of tort liability but rather establishes, by reference to a statutory scheme, the standard of care appropriate to the underlying tort." |
| Washington | In re MCG Health Data Security Issue Litigation, No. 2:22-cv-00849 (W.D. Wash. 2023) | "Washington does not recognize negligence per se as a separate cause of action." The rule appears in a magistrate judge's recommendation, which the district judge adopted. |
What survives
Dismissing the count did not end the statutory theory. In Rutter's, the court dismissed the negligence per se count without prejudice "to Plaintiffs’ ability to pursue a negligence per se theory of liability in Count I." Count I was the negligence claim. In Jordan, the negligence claim itself went forward.
So the motion cleans up the complaint. It doesn't win the case. The fight that decides negligence is still about duty, injury and causation.
What to do
| If you represent the defendant | If you represent the plaintiff |
|---|---|
| Check the governing state's law before anything else. In these five states, a motion against the standalone count rests on a rule the courts apply directly. | Plead the statute inside the negligence count, not as its own count. The Malone plaintiff dropped the standalone count and relied on the theory inside the negligence claim. |
| Expect the statute to stay in the case as evidence of the standard of care. Put your real effort into duty, injury and causation. | Don't treat the dismissal as a loss on the merits. In Rutter's, the dismissal expressly preserved the theory. |
Method: six federal district court rulings in LawSnap's data-breach class-action corpus that decided a negligence per se count on the ground that the state does not recognize it as a separate claim, as of November 11, 2026, each read in full. This covers only these five states. Other states treat negligence per se differently, and some allow it as its own claim. District court rulings do not bind other courts. Nothing here is legal advice.