KENT, Conn.—Waterbury Superior Court Judge Daniel J. Klau has given the green light for a partial class action suit against Kent School for failing to oversee and supervise an employee who allegedly accessed personal information and photos stored on dozens of staff and students’ electronic devices.
The judge defined the class as all current or former students who had personal information stored on electronic devices that were accessed and used at any time by former Kent School IT employee Daniel Clery.
He limited the class action to claims of negligence; whether Kent School owed the plaintiffs a duty of care during the times the offenses took place; whether the school was reckless in meeting its duty of care, and whether the school’s failure to maintain reasonable cybersecurity protocols for a school environment constituted unfair or deceptive trade practices under theConnecticut Unfair Trade Practices Act (CUTPA).
He denied class action on claims of invasion of privacy, computer crimes and negligent infliction of emotional distress.
The lawsuit was initiated in February 2025 after 11 staff members and 70 students complained that Clery used his position as Network and Systems Administrator to access, view, copy and retain their personal pictures and videos over a period of up to four years. He also accessed the personal pictures and data of 11 female members of staff.
Following an investigation by a private cybersecurity firm, Clery, 49, of Brookfield, was arrested by state police in 2024 and charged with two counts of first-degree computer crimes. Clery pleaded not guilty and is free on $25,000 bond.
The civil action consolidates four cases on the court’s docket. According to the lawsuit, a member of the staff notified the school in 2022 that the employee had accessed her personal data, but the school failed to investigate and failed to take any steps to safeguard the students’ data.
The school did take action after the same staff member notified the school eight months later that the employee had accessed her data again. It terminated the employee in 2023.
To qualify for a class action, the court must conduct a “rigorous analysis” that ensures the class certification is appropriate. Kent School argued against a class action, asserting that the plaintiffs “make no effort to account for the number of students whose claims would survive the applicable limitations periods or to how many students would actually satisfy the criteria set out …”
But the judge was not persuaded. He cited case law that found “courts reluctant to deny class action status because affirmative defenses might be available against different class members as long as the defenses do not overshadow the primary claims.”
“I conclude that Kent School’s affirmative defenses, particularly [the] statute of limitations, do not overshadow the plaintiff’s primary claims,” he wrote.
The criteria of “commonality” of the complaint was easily satisfied. A class need have only one complaint in common. These complainants “list 21 allegedly common questions of law and fact,” the judge found.
Kent School disputed a third perquisite: typicality. It argued that statute of limitations defenses make most of the plaintiff’s claims “atypical,” that the damages claims are not representative of the class, and that claims arise from individual circumstances.
The judge agreed that the plaintiff’s damages claims are not representative of the class, but said the class action relates only to liability, with damages to be address in individual hearings. Whether Kent School was negligent in failing to have security measures in place and other assertions are typical of all the class members’ claims, thus satisfying the requirement.
Lastly, the named plaintiffs had to persuade the court that they will fairly represent the interests of the class. The school did not dispute this point.
The judge concluded that the “highly individual nature of each Plaintiff’s damages claim” would have precluded a class action for liability if the law did not allow for partial class actions.
He reached a very different conclusion on the plaintiff’s request for class certification for claims of invasion of privacy, computer crimes and negligent infliction of emotional distress, finding that “common questions of law or fact do not predominate over individual questions as to those claims.”
The firms of Faxon Law Group LLC and Silver, Golub & Teitel LLP were named co-counsel for the case.
