BARBARA A. DITTMAN, GARY R. DOUGLAS, ALICE PASTIRIK, JOANN DECOLATI, TINA SORRENTINO, KRISTEN CUSHMAN AND SHANNON MOLYNEAUX, INDIVIDUALLY AND ON BEHALF OF ALL OTHERS SIMILARLY SITUATED v. UPMC D/B/A THE UNIVERSITY OF PITTSBURGH MEDICAL CENTER, AND UPMC MCKEESPORT
No. 43 WAP 2017
IN THE SUPREME COURT OF PENNSYLVANIA WESTERN DISTRICT
NOVEMBER 21, 2018
[J-20-2018]
SAYLOR, C.J., BAER, TODD, DONOHUE, DOUGHERTY, WECHT, MUNDY, JJ.
Appeal from the Order of the Superior Court entered January 12, 2017 at No. 971 WDA 2015, affirming the Order of the Court of Common Pleas of Allegheny County entered May 28, 2015 at No. GD14-003285.
ARGUED: April 10, 2018
OPINION
JUSTICE BAER
We granted discretionary review in this matter to determine whether an employer has a legal duty to use reasonable care to safeguard its employees’ sensitive personal information that the employer stores on an internet-accessible computer system. We also examine the scope of Pennsylvania‘s economic loss doctrine, specifically whether it permits recovery in negligence for purely pecuniary damages. For the reasons discussed below, we hold that an employer has a legal duty to exercise reasonable care to safeguard its employees’ sensitive personal information stored by the employer on an internet-accessible computer system. We further hold that, under Pennsylvania‘s economic loss doctrine, recovery for purely pecuniary damages is permissible under a negligence theory provided that the plaintiff can establish the defendant‘s breach of a legal duty arising under common law that is independent of any duty assumed pursuant to contract. As the Superior Court came to the opposite conclusions, we now vacate its judgment.
Barbara A. Dittman, Gary R. Douglas, Alice Pastirik, Joann Decolati, Tina Sorrentino, Kristen Cushman, and Shannon Molyneaux, individually and on behalf of all others similarly situated (collectively, Employees), filed the operative class action complaint in this matter against UPMC d/b/a the University of Pittsburgh Medical Center and UPMC McKeesport (collectively, UPMC) on June 25, 2014. In the complaint, Employees alleged that a data breach had occurred through which the personal and financial information, including names, birth dates, social security numbers, addresses, tax forms, and bank account information of all 62,000 UPMC employees and former employees was accessed and stolen from UPMC‘s computer systems. Second Amended Class Action Complaint, 6/25/2014, at ¶¶ 21-22, 27, 53. Employees further alleged that the stolen
Based on the foregoing, Employees asserted a negligence claim and breach of implied contract claim against UPMC.1 With respect to their negligence claim, Employees alleged that UPMC had a duty to exercise reasonable care to protect their “personal and financial information within its possession or control from being compromised, lost, stolen, misused, and/or disclosed to unauthorized parties.” Id. at ¶ 53. Employees further alleged that UPMC undertook a duty of care to ensure the security of their information in light of the special relationship between Employees and UPMC, whereby UPMC required Employees to provide the information as a condition of their employment. Id. at ¶ 56. Employees averred that this “duty included, among other things, designing, maintaining, and testing its security systems to ensure” that Employees’ information was adequately protected, and implementing “processes that would detect a breach of its security systems in a timely manner.” Id. at ¶¶ 54-55.
Additionally, Employees claimed that UPMC breached its duty to use reasonable care “by failing to adopt, implement, and maintain adequate security measures to safeguard [Employees‘] ... information, failing to adequately monitor the security of its network, allowing unauthorized access to [Employees‘] ... information, and failing to recognize in a timely manner that [Employees‘] ... information had been compromised.” Id. at ¶ 57. Employees further averred that UPMC “violated administrative guidelines” and “failed to meet current data security industry standards,” specifically by failing to encrypt data properly, “establish adequate firewalls to handle a server intrusion contingency,” and “implement adequate authentication protocol to protect the confidential information contained in its computer network.” Id. at ¶¶ 33-34.
Employees also claimed that UPMC‘s breach of its duties was the direct and proximate cause of the harm to Employees. Id. at ¶¶ 59-60. Finally, Employees alleged that, as a result of UPMC‘s negligence, Employees “incurred damages relating to fraudulently filed tax returns” and are “at an increased and imminent risk of becoming victims of identity theft crimes, fraud and abuse.” Id. at ¶¶ 61-62. Based on the foregoing, Employees sought monetary damages, among other forms of relief. Id. at ¶ 70.
On July 16, 2014, UPMC filed preliminary objections to Employees’ complaint arguing that, inter alia, their negligence claim failed as a matter of law. Specifically, UPMC argued that no cause of action exists for negligence because Employees did not allege any physical injury or property damage and, under the economic loss doctrine, “no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.” UPMC‘s Preliminary
On May 28, 2015, the court sustained UPMC‘s preliminary objections and dismissed Employees’ negligence claim.3 Relying upon the general description of the economic loss doctrine quoted from Excavation Technologies above, the trial court observed that, while Employees claimed that UPMC owed them a duty of care, the only losses Employees sustained were economic in nature. Trial Ct. Op., 5/28/2015, at 4. The trial court then briefly examined this Court‘s decision in Bilt-Rite Contractors, Inc. v. The Architectural Studio, 866 A.2d 270 (Pa. 2005), which allowed a negligence action based upon economic loss alone, viewing it as merely creating an exception to the economic loss doctrine for losses incurred as a result of a plaintiff‘s reliance on advice given by professionals for pecuniary gain.4 Id. at 4-5. The trial court concluded that, because this “case does not involve defendants in the business of supplying information for economic gain,” the exception did not apply. Id.
The trial court further opined that the Althaus factors and duty of care “should not be considered where the plaintiff seeks to recover only economic losses,” as “the Pennsylvania appellate courts have already balanced the competing interests through adoption of the economic loss doctrine.” Id. at 5. This determination notwithstanding, the trial court went on to analyze the Althaus factors and conclude that courts should not impose “a new affirmative duty of care that would allow data breach actions to recover damages recognized in common law negligence actions.” Id. The trial court found the controlling factors of the Althaus test to be (1) the consequences of imposing a duty upon the actor, and (2) the overall public interest in the proposed solution. In this regard, the trial court observed that data breaches are widespread and frequent. The trial court further explained that, under Employees’ proposed solution of creating a private
The trial court opined that it could not say with reasonable certainty that the best interests of society would be served through the recognition of a new affirmative duty under these circumstances, noting that the financial impact of doing so could put entities out of business. Id. at 7. The trial court further explained that entities storing confidential information already have an incentive to protect that information because any breach will affect their operations, that an improved system would not necessarily prevent a breach, and that the entities were also victims of the criminal activity involved. Id. at 7-8. Finally, the trial court observed that the Legislature is aware of and has considered the issues that Employees sought the court to consider herein as evidenced by the
Employees appealed to the Superior Court. Relevant to the issues before this Court, Employees argued that the trial court erred in finding that UPMC did not owe a duty of reasonable care in its collection and storage of Employees’ information, and that the economic loss doctrine barred their claim.
In a split opinion, a three-judge panel of the Superior Court affirmed the order of the trial court sustaining UPMC‘s preliminary objections and dismissing Employees’ claims. Dittman v. UPMC, 154 A.3d 318 (Pa. Super. 2017). As to the issue of duty, the Superior Court applied the Althaus factors, concluding first that the relationship between the parties weighed in favor of imposing a duty on UPMC because the employer-employee relationship “traditionally has given rise to duties on the employer.” Id. at 323. The court also reasoned that “[t]here is an obvious social utility” in electronically storing employees’ personal information “to promote efficiency,” which outweighed the nature of the risk imposed
The Superior Court further agreed with the trial court‘s analysis of the fourth and fifth Althaus factors, the consequences of imposing a duty upon the actor and the overall public interest in the proposed solution, respectively. As to the fourth factor, the Superior Court added to the trial court‘s reasoning that no judicially created duty of care is needed to incentivize companies to protect their employees’ confidential information because there are “statutes and safeguards in place to prevent employers from disclosing confidential information.” Id. at 324 (citing, inter alia, the Data Breach Act). The Superior Court also found it “unnecessary to require employers to incur potentially significant costs to increase security measures when there was no true way to prevent data breaches altogether.” Id. The court reasoned that “[e]mployers strive to run their businesses efficiently and they have incentive to protect employee information and prevent these types of occurrences.” Id.
Thus, upon consideration of all of the Althaus factors, the Superior Court concluded that the trial court properly found that UPMC owed no duty to Employees under Pennsylvania law. Nevertheless, the Superior Court continued to examine whether the economic loss doctrine applied to bar Employees’ negligence claim. Reiterating the generalized statement of the doctrine (i.e., that “no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage“), the Superior Court opined that the trial court was correct in noting that the Bilt-Rite decision was meant to provide a narrow exception to the doctrine only when the losses result from the reliance on the advice of professionals. Id. at 325. The Superior Court further agreed with the trial court that the narrow exception did not apply to this case.7 Id.
Judge Stabile filed a concurring statement that Judge Olson, the author of the majority opinion, joined. Judge Stabile reasoned that the court‘s decision declining to find a legal duty should be limited to the facts as alleged in this case. Id. at 326 (Stabile, J., concurring). He further reasoned that the balance of the Althaus factors may change in favor of employees at some point in the future “with the evolution and increased use of” electronic storage of information. Id. at 327 (Stabile, J., concurring).
Further, Judge Musmanno reasoned that, “[u]nder the circumstances alleged, the criminal acts of third parties do not relieve UPMC of its duty of care in the protection of [Employees‘] sensitive personal data.” Id. (Musmanno, J., dissenting).
Judge Musmanno also disagreed with the majority‘s conclusion that the imposition of a duty of care is unnecessary to incentivize companies to protect their confidential information. Judge Musmanno noted that, while the majority declined to impose a duty due to the significant costs imposed upon employers and the inability to prevent every data breach, the Althaus test does not require that the proposed duty prevent all harm.8 Id. (Musmanno, J., dissenting). Judge Musmanno continued that, when considered against the cost to employees resulting from the data breach, the factor relating to the consequences of imposing a duty weighed in favor of imposing a duty. Id. (Musmanno, J., dissenting). Finally, Judge Musmanno disagreed with the majority‘s conclusion that the public interest in imposing a duty weighed in favor of UPMC, opining that, “[w]hile judicial resources may be expended during litigation of data breaches, the public has a greater interest in protecting the personal and sensitive data collected and electronically stored by employers.” Id. at 328-29 (Musmanno, J., dissenting).
We granted allowance of appeal to address the following issues, as stated by Employees:
- Does an employer have a legal duty to use reasonable care to safeguard sensitive personal information of its employees when the employer chooses to store such information on an internet accessible computer system?
- Does the economic loss doctrine permit recovery for purely pecuniary damages which result from the breach of an independent legal duty arising under common law, as opposed to the breach of a contractual duty?
Dittman v. UPMC, 170 A.3d 1042 (Pa. 2017) (per curiam).
This matter presents pure questions of law, over which our standard of review is de novo, and our scope of review is plenary. Skotnicki v. Insurance Department, 175 A.3d 239, 247 (Pa. 2017). Further, as Employees’ negligence claim was dismissed on preliminary objections in the nature of a demurrer, we must
A. Duty
Employees contend that, in collecting and storing the sensitive personal and financial information it required Employees to provide, UPMC owed a duty to Employees to exercise reasonable care under the circumstances, which includes using reasonable measures to protect the information from the foreseeable risk of a data breach. In support of their position, Employees first argue that resort to the Althaus factors for purposes of determining the existence of a duty in this case is unnecessary. Specifically, Employees argue that the Althaus test applies only when determining whether to impose a new, affirmative duty not yet existing under common law, and not when a longstanding preexisting duty arises in a novel factual scenario. Employees’ Brief at 14-15 (quoting Alderwoods (Pennsylvania), Inc. v. Duquesne Light Co., 106 A.3d 27, 40 (Pa. 2014) (explaining that, inter alia, the Althaus factors are “more relevant to the creation of new duties than to the vindication of existing ones“)). Employees contend that the trial court and Superior Court erred in treating their claim as one seeking the creation of a new, affirmative duty requiring application of the Althaus test, and in concluding that UPMC did not owe a duty. As further explained below, Employees claim that they instead seek to impose upon UPMC a duty of care long-established in Pennsylvania law under the novel facts of this case.
In support of their assertion, Employees argue that, as a general rule, “anyone who does an affirmative act is under a duty to others to exercise the care of a reasonable man to protect them against an unreasonable risk of harm to them arising out of the act.” Employees’ Brief at 17 (quoting Restatement (Second) of Torts § 302, cmt. a (1965)). Employees claim that this is a broad expression of duty applicable to many forms of activity, even in novel factual scenarios with no direct precedent such as this one. Applying this broad expression of duty to the facts herein, Employees contend that UPMC engaged in the affirmative act of collecting Employees’ sensitive personal data and storing it on their internet-accessible computer systems. Employees maintain that, in so doing, UPMC was under a duty to them to exercise reasonable care under the circumstances, which includes taking reasonable measures to protect them from the foreseeable risk that third parties would attempt to access and pilfer that information. Thus, Employees claim that they are alleging misfeasance on behalf of UPMC in collecting and storing Employees’ sensitive personal data.
Employees further contend that this broad duty is limited by the concept of foreseeability.9 With respect to foreseeability, Employees argue that troves of electronic data stored on internet-accessible computers held by large entities are obvious
failure to use basic security measures can lead to exposure of the data and serious financial consequences for the victims. Employees thus claim that, in light of the prevalence of electronic data storage in the employment context and the foreseeable risk of breaches of such data, it is appropriate to require employers to use reasonable care when handling and storing employee data in order to protect it from compromise. Employees argue that there is no sound justification for exempting employers from a duty to act with reasonable care when they collect and store employees’ sensitive personal information.
Finally, Employees contend that the fact that the ultimate harm in this case resulted from criminal activity does not eviscerate the duty UPMC owed to Employees to handle its collection and storage of employee data with reasonable care. Employees acknowledge that one generally does not owe a duty to others to protect them against criminal conduct. Employees contend, however, that there are many exceptions to this rule and that the duty to take reasonable anticipatory measures against foreseeable criminal conduct in certain scenarios has deep roots in common law. Employees’ Brief at 22-24 (relying upon Sections 302 and 302B of the Restatement (Second) of Torts and Comment E thereto, discussed infra).
In response, UPMC challenges Employees’ assertion that it assumed a legal duty to protect against a criminal data breach through commission of an affirmative act. UPMC contends that it merely possessed employee information incident to a general employment relationship, which cannot constitute an affirmative act that entails legal liability for third-party criminal conduct. UPMC notes that it is not in the business of providing data security, was not retained to provide data security, was not otherwise tasked with providing data security, and never pursued such an undertaking.
Indeed, according to UPMC, Employees are not claiming any affirmative misfeasance on UPMC‘s part but, rather, nonfeasance in that UPMC failed to prevent the harm incurred or some speculative future harm. In that regard, UPMC notes that there is a “no-duty rule in rescue/protection scenarios where the defendant did not create the risk resulting in harm to the plaintiff.” UPMC‘s Brief at 45 (quoting Seebold v. Prison Health Services, Inc., 57 A.3d 1232, 1246 (Pa. 2012)). UPMC contends that “[i]t is nonsensical to suggest that [it] created the risk of harm from a criminal data breach[] simply by possessing employee data” and its business neither increased the risk of criminal activity nor posed a special danger to the public regarding unshielded data. Id. at 45, 50-51. UPMC contends that third party criminality, not any affirmative conduct on UPMC‘s part, created the risk of harm and that it cannot be held liable for an external criminal hack merely because of the general prevalence or conceivable risk of data breaches. UPMC further argues that a third-party criminal act is a superseding cause of the resulting harm and should not be deemed “foreseeable by a negligent actor merely because he or she could have speculated that they might conceivably occur.” Id. at 51 (citing, inter alia, Ford v. Jeffries, 379 A.2d 111, 115 (Pa. 1977), and Mahan v. Am-Gard, Inc., 841 A.2d 1052, 1061 (Pa. Super. 2003)).
UPMC thus argues that Employees “are proposing a radical reconstruction of duty” where they seek to impose liability on UPMC for the criminal acts of unknown third parties. Id. at 45. UPMC contends that the decision to impose a legal duty
Having considered the parties’ arguments, we agree with Employees that this case is one involving application of an existing duty to a novel factual scenario, as opposed to the imposition of a new, affirmative duty requiring analysis of the Althaus factors. As Employees set forth in their brief, this Court observed in Alderwoods that the Althaus factors are “more relevant to the creation of new duties than to the vindication of existing ones.” Alderwoods, 106 A.3d at 40. This Court further explained that it is unnecessary “to conduct a full-blown public policy assessment in every instance in which a longstanding duty imposed on members of the public at large arises in a novel factual scenario. Common-law duties stated in general terms are framed in such fashion for the very reason that they have broad-scale application.” Id. at 40-41; see also Scampone v. Highland Park Care Center, LLC, 57 A.3d 582, 599 (Pa. 2012) (“Like any other cause of action at common law, negligence evolves through either directly applicable decisional law or by analogy, meaning that a defendant is not categorically exempt from liability simply because appellate decisional law has not specifically addressed a theory of liability in a particular context.“).
As for the common law duty at issue here, this Court has observed that “[i]n scenarios involving an actor‘s affirmative conduct, he is generally ‘under a duty to others to exercise the care of a reasonable man to protect them against an unreasonable risk of harm to them arising out of the act.‘” Seebold, 57 A.3d at 1246 (quoting Section 302 cmt. a of the Restatement
Employees have alleged and, as the case is before us at the preliminary objection stage, we currently must accept as true that, as a condition of employment, UPMC required them to provide certain personal and financial information, which UPMC collected and stored on its internet-accessible computer system without use of adequate security measures, including proper encryption, adequate firewalls, and an adequate authentication protocol. These factual assertions plainly constitute affirmative conduct on the part of UPMC. Additionally, while UPMC is correct that, generally, “there is no duty to protect or rescue someone who is at risk on account of circumstances the defendant had no role in creating,” id. at 1246, Employees have sufficiently alleged that UPMC‘s affirmative conduct created the risk of a data breach. Thus, we agree with Employees that, in collecting and storing Employees’ data on its computer systems, UPMC owed Employees a duty to exercise reasonable care to protect them against an unreasonable risk of harm arising out of that act.
Further, to the extent that UPMC argues that the presence of third-party criminality in this case eliminates the duty it owes to Employees, we do not agree. As stated above, UPMC relies on selected portions of Ford and Mahan in support of its position that it cannot be liable for third-party criminal conduct that could “conceivably occur.” However, as Ford more fully outlined:
The act of a third person in committing an intentional tort or crime is a superseding cause of harm to another resulting therefrom, although the actor‘s negligent conduct created a situation which afforded an opportunity to the third person to commit such a tort or crime, unless the actor at the time of his negligent conduct realized or should have realized the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to commit such a tort or crime.
Ford, 379 A.2d at 115 (quoting Section 448 of the Restatement (Second) of Torts (1965)).11 Further, while the Superior
of a third party are not deemed to be foreseeable by a negligent actor merely because he or she could have speculated that they might conceivably occur,” the court, citing Jeffries, acknowledged that liability could be found if the actor “realized or should have realized the likelihood that such a situation might be created and that a third person might avail himself of the opportunity to commit such a tort or crime.” Mahan, 841 A.2d at 1061.12
Again, Employees allege that UPMC, their employer, undertook the collection and storage of their requested sensitive personal data without implementing adequate security measures to protect against data breaches, including encrypting data properly, establishing adequate firewalls, and implementing adequate authentication protocol. The alleged conditions surrounding UPMC‘s data collection and storage are such that a cybercriminal might take advantage of the vulnerabilities in UPMC‘s computer system and steal Employees’ information; thus, the data breach was “within the scope of the risk created by” UPMC. See Ford, 379 A.2d at 115 (explaining that the dilapidated condition of the appellee‘s property, which had caught fire and damaged the appellant‘s neighboring property, “was such that third persons might avail themselves of the opportunity to commit a tort or crime” and that “such acts were within the scope of the risk created by the appellee“). Therefore, the criminal acts of third parties in executing the
employee,” and “[w]here property of which the actor has possession or control affords a peculiar temptation or opportunity for intentional interference likely to cause harm.” Section 302B of the Restatement (Second) of Torts Cmt. e(B), (G).
data breach do not alleviate UPMC of its duty to protect Employees’ personal and financial information from that breach.
Based on the foregoing, we conclude that the lower courts erred in finding that UPMC did not owe a duty to Employees to exercise reasonable care in collecting and storing their personal and financial information on its computer systems. This conclusion notwithstanding, Employees’ claim cannot proceed if we nonetheless hold that it is barred by the economic loss doctrine. Thus, we turn to our analysis of that doctrine.
B. The Economic Loss Doctrine
The crux of the dispute before us is whether the economic loss doctrine as applied in Pennsylvania precludes all negligence claims that seek to recover for purely economic damages, save for specifically delineated and narrow exceptions, or whether such claims are generally permitted provided that a plaintiff can establish a breach of a legal duty independent of any contractual duties existing between the parties. As evidenced throughout this opinion, much of the dispute in this regard
Beginning with the parties’ contentions, Employees argue that courts have incorrectly read our decision in Bilt-Rite as merely permitting negligent misrepresentation claims under Section 552 of the Restatement (Second) of Torts, see infra at pages 23-24 n.17, as a narrow exception to an otherwise broad economic loss doctrine precluding all negligence claims for solely monetary harm. Employees claim that, under Bilt-Rite, the economic loss doctrine does not bar negligence-based tort claims involving purely financial harm, provided that the plaintiff establishes that the defendant owed a common law duty arising independently from any contract between the parties. Employees argue that the holding in Bilt-Rite did not rely or otherwise depend upon the particular legal duty imposed or tort alleged in that case and therefore was not limited in that manner.
Employees contend that Bilt-Rite‘s iteration of the rule as they believe it should be interpreted is more coherent and precise than the general statement of the rule, “which fails to explain or reconcile a plethora of obvious ‘exceptions.‘” Employees’ Brief at 51. Employees further argue that their interpretation of the doctrine, which focuses on the source of the duty, is consistent with the definition accepted by many states and scholars, and will reduce confusion and unjust deployment of the rule against legitimate tort claims while serving the rule‘s purpose of precluding those claims that seek to compensate parties for losses resulting from a breach of contractual duties. Employees thus contend that, here, we need only to reaffirm Bilt-Rite‘s enunciation of the rule as stated by them and hold that it does not bar their negligence claim.
UPMC counters that the lower courts correctly held that the economic loss doctrine precludes Employees’ negligence claim for monetary damages.13 UPMC argues that the economic loss doctrine is well-settled in Pennsylvania and broadly applies to bar negligence claims that result “solely in economic damages unaccompanied by physical injury or property damage.” UPMC‘s Brief at 12, 14-15 (quoting Excavation Technologies, 985 A.2d at 841 n.3). Relying upon Excavation Technologies, UPMC further interprets Bilt-Rite‘s holding as creating a narrow exception to the broad economic loss doctrine for negligent misrepresentation claims under Section 552 of the Restatement (Second) of Torts that involve design professionals supplying information to others for
pecuniary gain. UPMC claims that no Pennsylvania court has applied Employees’ interpretation of Bilt-Rite in an action to recover purely economic damages under a common law negligence theory and argues that this Court already declined to expand Bilt-Rite in the manner Employees suggest in Excavation Technologies.UPMC also claims that Employees, focusing upon “misleading dicta” in Bilt-Rite, argue for an improperly expansive interpretation of that case which would
UPMC argues that Employees’ “tortured construction” of the economic loss doctrine “distills to the untenable proposition that our appellate courts have misconstrued the rule since its inception” and that accepting Employees’ position would contravene the doctrine‘s purpose of preventing indeterminate liability. Id. at 12-13, 16 n.4. UPMC further maintains that the Third Circuit has already considered and rejected Employees’ arguments regarding the contours of Pennsylvania‘s economic loss doctrine and Bilt-Rite‘s holding, including in the context of computer information theft. Id. at 18-20 (citing, inter alia, Sovereign Bank v. BJ‘s Wholesale Club, Inc., 533 F.3d 162, 178 (3d Cir. 2008) (opining that this Court in Bilt-Rite “simply carved out a narrow exception [to the economic loss doctrine] when losses result from the reliance on the advice of professionals“)). Additionally, UPMC claims that a majority of jurisdictions confronting data breach litigation have dismissed negligence claims in accord with the economic loss doctrine.1516
As part of the project, TAS‘s plans provided for the installation of certain systems that TAS “expressly represented could be installed and constructed through the use of normal and reasonable construction means and methods, using standard construction design tables.” Bilt-Rite, 866 A.2d at 272. However, once Bilt-Rite began the work, it discovered that construction of the systems required it to employ special construction means, methods, and design tables, resulting in substantially increased construction costs. It thus “sued TAS on a theory of negligent misrepresentation under Section 552 of the Restatement (Second) of Torts,17 claiming that TAS‘s specifications were false and/or misleading, and seeking damages for its increased construction costs.” Id. at 272-73. TAS filed preliminary objections in the nature of a demurrer, arguing that “the economic loss doctrine,” which holds that a tort plaintiff cannot recover for purely economic losses” barred Bilt-Rite‘s action and that TAS did not owe a duty to Bilt-Rite, with whom it had no contractual relationship. Id. at 273. The trial court sustained TAS‘s preliminary objections, and the Superior Court affirmed.
On appeal, this Court was presented with the issue of “whether a building contractor may maintain a negligent misrepresentation claim against an architect for alleged misrepresentations in the architect‘s plans for a public construction contract, where there was no privity of contract between the architect and the contractor, but the contractor reasonably
Most importantly for our current purposes, with respect to application of the economic loss doctrine, the Court looked to the “reasoned approach to the rule” expressed by the South Carolina Supreme Court in Tommy L. Griffin Plumbing & Heating Co. v. Jordan, Jones & Goulding, Inc., 463 S.E.2d 85 (S.C. 1995), which observed that its
application of the “economic loss” rule maintains the dividing line between tort and contract while recognizing the realities of modern tort law. Purely “economic loss” may be recoverable under a variety of tort theories. The question, thus, is not whether the damages are physical or economic. Rather, the question of whether the plaintiff may maintain an action in tort for purely economic loss turns on the determination of the source of the duty plaintiff claims the defendant owed. A breach of a duty which arises under the provisions of a contract between the parties must be redressed under contract, and a tort action will not lie. A breach of a duty arising independently of any contract duties between the parties, however, may support a tort action.
Id. at 287-88 (quoting Tommy L. Griffin Plumbing, 463 S.E.2d at 88 (footnote and citation omitted)). The Tommy L. Griffin Plumbing Court listed libel and defamation, accountant malpractice, legal malpractice, and architect liability among the examples of tort actions for which purely economic loss is recoverable. Tommy L. Griffin Plumbing, 463 S.E.2d at 88 & n.2.
This Court in Bilt-Rite explained that, “[l]ike South Carolina, Pennsylvania has long recognized that purely economic losses are recoverable in a variety of tort actions including the professional malpractice actions noted by the South Carolina Supreme Court.” Bilt-Rite Contractors, 866 A.2d at 288. It thus agreed that “a plaintiff is not barred from recovering economic losses simply because the action sounds in tort rather than contract law.” Id. In so doing, the Court noted that Bilt-Rite had no contractual relationship with TAS and thus, recovery under a contract theory was unavailable. However, because Bilt-Rite stated a viable claim for negligent misrepresentation under
Following Bilt-Rite, this Court decided Excavation Technologies. In that case, Excavation Technologies, Inc. (Excavation Technologies) requested that Columbia Gas Company of Pennsylvania (Columbia) mark the locations of gas lines around work sites pursuant to the One Call Act.20 Columbia improperly marked some lines and failed to mark others, resulting in Excavation Technologies striking various gas lines, which in turn hampered its work and caused it economic damages. Based on the foregoing, Excavation Technologies sued Columbia on a theory of negligent misrepresentation under
This Court granted review to decide “whether [Section] 552 of the Restatement (Second) of Torts [see supra at pages 23-24 n.17] imposes liability for economic losses to a contractor caused when a gas utility company fails to mark or improperly marks the location of gas lines.” Excavation Technologies, 985 A.2d at 842. In answering this question, the Court distinguished the case from Bilt-Rite on the basis that Columbia was “not in the business of providing information for pecuniary gain” and therefore concluded that
In addition to its analysis above, the Court concluded that there was no statutory basis to impose liability for economic losses. It is at this point the Court discussed the economic loss doctrine, which the Court previously defined in a footnote as providing that “no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.” Id. at 841 n.3 (quoting Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa. Super. 2003)). The Court reasoned that the “economic loss doctrine was well-established in tort law when the [One Call] Act was enacted” and later amended. Id. at 842 (citing Aikens v. Baltimore and Ohio Railroad Co., 501 A.2d 277 (Pa. Super. 1985), which noted that the roots of the economic loss doctrine were first recognized in Robins Dry Dock & Repair Co. v. Flint, 275 U.S. 303 (1927)). The Court continued by explaining that “[t]he legislature was presumably aware of the economic loss doctrine when it established the statutory scheme governing the relationship among the entities required to participate under the Act,” and found that “our legislature did not intend utility companies to be liable for economic harm caused by an inaccurate response under the Act, because it did not provide a private cause of action for economic losses.” Id. at 842-43. In the context of this discussion, the Court cited In re Rodriguez, 900 A.2d 341, 345 (Pa. 2003), for the proposition that “courts must assume [that the] legislature understands [the] legal landscape on which it enacts laws, and when [the] common law rule is not abrogated, they must assume it persists.” Id. at 843.
Having set forth our decisions in Bilt-Rite and Excavation Technologies, we hold that those cases do not stand for the proposition that the economic loss doctrine, as applied in Pennsylvania, precludes all negligence claims seeking solely economic damages. Indeed, the Bilt-Rite Court unequivocally stated that “Pennsylvania has long recognized that purely economic losses are recoverable in a variety of tort actions” and that “a plaintiff is not barred from recovering economic losses simply because the action sounds in tort rather than contract law.” Bilt-Rite, 866 A.2d at 288. In so doing, the Court set forth a “reasoned approach” to applying the economic loss doctrine that “turns on the determination of the source of the duty plaintiff claims the defendant owed.” Id. (quoting Tommy L. Griffin Plumbing, 463 S.E.2d at 88). Specifically, if the duty arises under a contract between the parties, a tort action will not lie from a breach of that duty. However, if the duty arises independently of any contractual duties between the parties, then a breach of that duty may support a tort action. Id.
As stated above, the Bilt-Rite Court took this approach from the Supreme Court of South Carolina in the case of Tommy L. Griffin Plumbing. Notably, in Tommy L. Griffin Plumbing, the Supreme Court of South Carolina observed that “some states use the ‘economic loss’ rule to prohibit all recovery of purely economic damages in tort.” Tommy L. Griffin Plumbing, 463 S.E.2d at 88. The South Carolina Supreme Court, however, rejected that approach in light of the fact that “[t]he law in South Carolina ... has long recognized tort actions when the damages are purely economic.” Id. at 88 & n.2 (citing cases involving tort actions for purely economic damages, including architect liability, legal malpractice, accountant malpractice, and libel and defamation). In recognizing that Pennsylvania similarly “has long recognized that purely economic losses are recoverable in variety of tort actions,” Bilt-Rite, 866 A.2d at 288, and accepting South Carolina‘s annunciation of the economic loss doctrine, this Court likewise rejected that approach.
As for UPMC‘s argument that Bilt-Rite merely created a narrow exception to the otherwise broad economic loss doctrine for negligent misrepresentation claims falling under
Our reading of Excavation Technologies does not compel a different conclusion. As noted, the issue in that case was whether, under a theory of negligent misrepresentation pursuant to
We acknowledge that the Excavation Technologies Court concluded that there was no statutory basis to impose liability on utility companies for economic losses under the One Call Act and, in so doing, included a broad definition and brief discussion of the economic loss doctrine. However, we find these observations to be ancillary not only to the Court‘s conclusion that the One Call Act did not provide for recovery of economic losses, but also to the Court‘s central holding that, in contrast to Bilt-Rite, the contractor failed to state a claim for negligent misrepresentation under
Here, Employees have asserted that UPMC breached its common law duty to act with reasonable care in collecting and storing their personal and financial information on its computer systems. As this legal duty exists independently from any contractual obligations between the parties, the economic loss doctrine does not bar Employees’ claim.
D. Conclusion
Based on the foregoing, we conclude that the courts below erred in determining that UPMC did not owe a duty to Employees to use reasonable care to safeguard their sensitive personal data in collecting and storing it on an internet-accessible computer system. We further hold that the lower courts erred in concluding that Pennsylvania‘s economic loss doctrine bars Employees’ negligence claim. Accordingly, we vacate the judgment of the Superior Court, reverse the order of the trial court, and remand the matter to the trial court for further proceedings consistent with this opinion.
Justices Dougherty, Wecht and Mundy join the opinion.
Chief Justice Saylor files a concurring and dissenting opinion in which Justice Todd joins.
Justice Donohue did not participate in the consideration or decision of this matter.
Notes
Althaus, 756 A.2d at 1169.The determination of whether a duty exists in a particular case involves the weighing of several discrete factors which include: (1) the relationship between the parties; (2) the social utility of the actor‘s conduct; (3) the nature of the risk imposed and foreseeability of the harm incurred; (4) the consequences of imposing a duty upon the actor; and (5) the overall public interest in the proposed solution.
- One who, in the course of his business, profession or employment, or in any other transaction in which he has a pecuniary interest, supplies false information for the guidance of others in their business transactions, is subject to liability for pecuniary loss caused to them by their justifiable reliance upon the information, if he fails to exercise reasonable care or competence in obtaining or communicating the information.
- Except as stated in Subsection (3), the liability stated in Subsection (1) is limited to loss suffered
- by the person or one of a limited group of persons for whose benefit and guidance he intends to supply the information or knows that the recipient intends to supply it; and
- through reliance upon it in a transaction that he intends the information to influence or knows that the recipient so intends or in a substantially similar transaction.
- The liability of one who is under a public duty to give the information extends to loss suffered by any of the class of persons for whose benefit the duty is created, in any of the transactions in which it is intended to protect them.
As discussed in further detail below,
