Duty of Care in the Protection of Employee Data – Guest Analysis from Pepper Hamilton
Employees Who Suffer Only Economic Losses From a Data Breach Cannot Sustain a Negligence Claim Against Their Employer
Firestorm would like to thank our presentation partners at the Law Firm of Pepper Hamilton, LLP and we welcome participation in our upcoming Virtual Cyber Crisis Stress Test by Attorney Angelo A. Stio, III.
To join our May 25th Cyber Crisis Stress Test | Register Now
We are pleased to present the below analysis from Pepper Hamilton, LLP related to a growing area of concern for employers. The original PDF was published in June of 2015 and may be downloaded here.
© 2015 Pepper Hamilton LLP | Reprinted with permission. Pepper Hamilton LLP is a national law firm with offices nationwide, ranked among the 100 largest firms in the United States. Read more from Angelo Stio
Authors: Susan K. Lessack | [email protected] | Angelo A. Stio III | [email protected] | Tracey E. Diamond | [email protected] | Brian R. Zurich | [email protected]
On May 28, 2015 the Court of Common Pleas of Allegheny County, Pennsylvania, handed a victory to employers by dismissing a class action complaint brought on behalf of employees and former employees of the University of Pittsburgh Medical Center (UPMC). In Dittman v. UPMC d/b/a The University of Pittsburgh Medical Center, No.
The class representatives asserted a claim for negligence, claiming that UPMC breached its duty of care to protect and secure its employees’ personal and financial information, and also asserted a claim for breach of an implied contract, alleging that UPMC breached contract terms to protect the security of employee information it maintained.
UPMC filed preliminary objections arguing, among other things, that (i) the class representatives did not have standing to maintain an action premised on a hypothetical future injury, (ii) the negligence claim was barred by the economic loss doctrine, and (iii) the breach of contract claim failed for lack of mutual intent and consideration.
The court sustained preliminary objections on both claims. Citing the Pennsylvania Supreme Court’s 2009 opinion in Excavation Technologies, Inc. v. Columbia Gas Co., 985 A.2d 840 (Pa. 2009), the court concluded that, under the “economic loss doctrine,” no cause of action can exist for negligence that resulted solely in economic losses unaccompanied by physical injury or property damage.
The Court Finds That the Economic Loss Doctrine Applies to Bar Negligence Claims Arising from a Data Breach
The plaintiffs in Dittman argued that Excavation Technologies was not controlling and that the court should follow instead the Pennsylvania Supreme Court’s prior decision in Bilt- Rite Contractors, Inc. v. Architectural Studio, 866 A.2d 270 (Pa. 2005), which mandated recovery for negligent misrepresentation based on an architect’s liability for economic damages caused to third parties. However, as in Excavation Technologies, the court in Dittman limited the
The Dittman court also dismissed the claim for breach of implied contract. The class representatives alleged that, pursuant to the terms of an implied contract, they agreed to make their personal information available to UPMC, and, in exchange, UPMC agreed to safeguard and protect that personal information. The court held that no implied contract existed because there was no “meeting of the minds.” The complaint contained no description of an agreement between the parties or of communications between the parties in which UPMC made any promises. As the court noted, there would be no “apparent reason why UPMC would enter into an agreement with its employees to allow its employees to sue UPMC in the event of a data breach.”
The Court Finds That UPMC Was as Much a Victim as Its Employees
In rendering its decision, the court analyzed the public policy implications of allowing a lawsuit against employers for data breaches by third parties to continue and made three significant observations. First, in dismissing the claims, the court observed that “[d]ata breaches are widespread. They frequently occur because of sophisticated criminal activity of third persons. There is not a safe harbor for entities 
storing confidential information.” According to the court, creating a private cause of action in negligence for data breaches “could result within Pennsylvania alone[,] of the filing each year of possibly hundreds of thousands of lawsuits by persons whose confidential information may be in the hands of third persons. Clearly the judicial system is not equipped to handle this increased caseload.”
Second, the court considered the substantial resources that employers would have to spend in responding to lawsuits for data breaches grounded in negligence and breach of contract. The court stated, “[t]hese entities are victims of the same criminal activity as the plaintiffs. The courts should not, without guidance from the Legislature, create a body of law that does not allow entities that are victims of criminal activity to get on with their businesses.” In this regard, the court noted, “the best interests of society would [not] be served through the recognition of new affirmative duties of care imposing liability on health care providers and other entities electronically storing confidential information, the financial impact of which could even put these entities out of business. . . . An ‘improved’ system for storing confidential information will not necessarily prevent a breach of the system. These entities are also victims of criminal activity.”
Finally, the court recognized that the Pennsylvania legislature already enacted legislation in the data breach arena (the Data Breach Act), which addressed the obligations of entities that suffer a breach of their security systems. In the event of a data breach, the act requires the entity to notify the individuals affected by the data breach and affords the Office of Attorney General exclusive authority to bring an action for violation of that notification requirement, but it does not contemplate a private cause of action. Because the legislature has considered the issues raised by the class representatives and has not, to date, imposed a duty of care upon entities whose security systems are breached, the court concluded that it was not appropriate for a court to create a new duty. Any further developments should be within the province of the legislature.
The Dittman case is not unique in its holding. The dismissal of the negligence claims based on the economic loss doctrine is supported by prior Pennsylvania decisions. In two Pennsylvania cases arising out of a data breach that occurred at BJ’s Wholesale Club, for example, the courts found that the economic loss doctrine barred the plaintiffs’ negligence claims because the alleged losses were solely economic in that they related primarily to the costs of issuing new credit cards to replace the ones that had been compromised by the breach.(1)
Application of the economic loss doctrine to bar a negligence claim varies from state to state, however, and other states have allowed negligence claims related to a data breach to proceed, even in the absence of physical injury or property damage.(2) For example, in a recent opinion in the Target data breach litigation, the court concluded that the economic loss doctrine did not bar the plaintiffs’
Likewise, as we have reported previously(4) victims of data breaches face difficulty when pursuing claims related to data breaches if there is no demonstrable injury or imminent threat of a future injury. The Dittman case continues the tradition in this jurisdiction of dismissing, under the economic loss doctrine, data
Download footnotes and the full PDF
“What should we do now?” “What should we say?”