In McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295 (2 nd Cir. 2021), employees of Carlos Lopez & Associates, LLP (“CLA”), an organization which provides mental and behavioral health services to veterans, brought a putative class action against CLA for the inadvertent disclosure of certain sensitive personally identifiable information (“PII”). According to the complaint, an employee of CLA had inadvertently disclosed the PII of approximately 130 current and former CLA employees by circulating a companywide email that included an attached spreadsheet divulging the social security number, home addresses, dates of birth, telephone numbers, educational degrees, and dates of hires of the affected employees. Devonne McMorris and two other affected employees filed a class action asserting state-law claims for negligence, negligence per se, and statutory consumer protection violations on behalf of classes in California, Florida, Texas, Maine, New Jersey, and New York.