In a win for the first law firm to face a class action for lax data security, a Chicago federal judge ruled Wednesday that claims against Chicago-based Johnson & Bell for allegedly failing to protect client information must be heard individually in arbitration, not lumped together as a class.

The suit, filed by well-known class-action lawyer Jay Edelson, made headlines when it was unsealed in December and seemed to represent Edelson making good on an earlier promise to bring a spate of data privacy complaints against law firms. He had said he identified 15 firms with lagging security.