48 Pa. D. & C.5th 83
Pennsylvania Court of Common P...2015Background
- Plaintiffs are UPMC employees and former employees whose highly sensitive personal and financial data (names, birthdates, SSNs, tax info, addresses, salaries, bank account info) were stolen in a data breach.
- Plaintiffs filed a class action alleging negligence (Count I) and breach of an implied contract (Count II) based on UPMC’s duty to protect employees’ confidential information.
- Plaintiffs allege UPMC failed to design, maintain, test, monitor security, and timely detect and notify employees of the breach, causing fraudulent tax returns and increased risk of identity theft.
- UPMC filed preliminary objections seeking dismissal of both counts.
- The court applied the economic loss doctrine and Seebold/Althaus duty-analysis framework, and also considered legislative treatment of data breaches (Pennsylvania’s Data Breach Act, which mandates notification and limits private enforcement).
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether UPMC owed a common-law duty of care (negligence) to employees for economic harms from a third‑party data breach | UPMC had a duty to reasonably protect employees’ confidential data and failed to do so, causing foreseeable economic harms and increased risk of identity theft | Economic loss doctrine bars negligence recovery for pure economic loss; creation of a broad new duty would conflict with legislative scheme and public policy | Court dismissed negligence claim: economic loss doctrine applies and court will not recognize a new affirmative duty here given public‑policy, administrative burden, and legislative schemes (Data Breach Act) |
| Whether an implied contract existed obligating UPMC to safeguard employee data | An implied contract arose from the employment relationship: employees provided personal data and UPMC agreed to protect it | No meeting of the minds or mutual assent; no factual allegations of promises or exchanges forming an agreement | Court dismissed breach‑of‑contract claim: insufficient allegations of an implied agreement or circumstances demonstrating intent to contract |
Key Cases Cited
- Excavation Techs., Inc. v. Columbia Gas Co. of Pa., 985 A.2d 840 (Pa. 2009) (applies economic loss doctrine to bar negligence recovery for pure economic losses)
- Bilt‑Rite Contractors, Inc. v. The Architectural Studio, 866 A.2d 270 (Pa. 2005) (narrow exception for liability arising from supplying information for pecuniary gain)
- Sovereign Bank v. B.J.'s Wholesale Club, Inc., 533 F.3d 162 (3d Cir. 2008) (discusses limits of Bilt‑Rite exception in data contexts)
- Seebold v. Prison Health Servs., Inc., 57 A.3d 1232 (Pa. 2012) (framework for deciding whether to impose new duties of care)
- Althaus v. Cohen, 756 A.2d 1166 (Pa. 2000) (factors for duty analysis referenced in Seebold)
- Tyco Elecs. Corp. v. Davis, 895 A.2d 638 (Pa. Super. 2006) (standards for finding implied contract based on surrounding circumstances)
- Cooney v. Chicago Pub. Sch., 943 N.E.2d 23 (Ill. App. Ct. 2010) (refused to create common‑law duty beyond legislative notification requirement)