Cybersecurity and Data Privacy
Action Item: The Court of Common Pleas in Pennsylvania has refused to recognize negligence claims in data breach lawsuits, making it more difficult for plaintiffs to pursue claims and damages in data breach cases. Although not binding state-wide, this decision adds to the growing body of case law that have held negligence claims for failure to provide reasonable data security protections that are not actionable.
In an important and well-reasoned 12-page decision, Judge Wettick of the Court of Common Pleas of Allegheny County refused to create a common law duty to protect and secure confidential information. The decision was issued in the matter of Dittman v. UPMC, which was filed on behalf of over 62,000 plaintiffs. Although not binding state-wide, Judge Wettick's decision represents an important step in the development of privacy law in Pennsylvania.
The complaint was filed against the University of Pittsburg Medical Center ("UPMC") after names, birthdates, social security numbers, confidential tax information, addresses, salaries, and bank account information pertaining to current and former employees was stolen from UPMC's computer systems. The plaintiffs alleged that UPMC had a common law "duty to protect the private, highly sensitive, confidential and personal financial information, and the tax documents of plaintiffs and the members of the proposed class." The complaint claimed that UPMC violated this duty when it failed to "exercise reasonable care to protect and secure the information."
Advocating for more than simple recognition of a general duty, the Dittman plaintiffs sought court imposition of very specific and onerous duties on UMPC. Given the nature of the employee/employer relationship, the plaintiffs argued that UPMC's duties included the obligation to design, maintain, and test "its security systems to ensure that [] the members of the proposed Classes personal and financial information ... was adequately secured and protected." It was further argued that "UPMC [] had a duty to implement processes that would detect a breach of its security systems in a timely manner." Lastly, the plaintiffs argued that UPMC should be liable for its failure to meet industry standards in the face of a risk that was reasonably foreseeable.
Judge Wettick's decision is important not only for its ultimate holding, finding no common law cause of action for data breaches, but also for the three lines of thought relied upon to support his conclusion. Specifically, Judge Wettick found: (1) Pennsylvania's economic loss doctrine precludes a negligence cause of action for economic loss stemming from a data breach; (2) public policy considerations mitigated against the creation of an affirmative duty of care in connection with data breach cases; and (3) the Pennsylvania General Assembly's prior actions evidenced an intent not to impose such a duty.
With regard to the economic loss doctrine, the court noted that the UPMC employees sustained only economic losses resulting from the improper actions of third-party bad actors. With this finding in hand, the court turned to the economic loss doctrine and affirmed that "no cause of action exists for negligence that results solely in economic losses unaccompanied by physical injury or property damage." Excavation Technologies, Inc. v. Columbia Gas Co. of Pa., 985 A.2d 840, 841 (Pa. 2009). Seeking to overcome the economic loss doctrine, the Dittmer plaintiffs invoked Pennsylvania Supreme Court case law, including Seebold v. Prison Health Servs., Inc., 57 A.3d 1232 (Pa.2012), to suggest the court should impose a common law duty of care on those who maintain the confidential data of third parties. The court rejected this argument as an improper effort to undermine the economic loss doctrine.
The court went on, however, to consider the factors articulated in Seebold and concluded "the controlling factors are the consequences of imposing a duty upon the actor and the overall public interest in the proposed solution." Recognizing the magnitude of the problem, the court noted that "data breaches are widespread ... frequently occur because of sophisticated criminal activity of third persons ... [and] [t]here is not a safe harbor for entities storing confidential information." Judge Wettick further noted that the imposition of a new duty was unnecessary because entities who store confidential information already have a strong incentive to protect the data and avoid the disastrous operational consequences resulting from a breach.
Addressing the public policy component of Seebold, the court adopted a very practical approach. Judge Wettick determined that the creation of a new duty would expose Pennsylvania courts to the "filing each year of possibly hundreds of thousands of lawsuits by persons whose confidential information may be in the hands of third persons"—a burden the courts are not equipped to handle. He further recognized that there is an absence of guidance as to what actions constitute reasonable care, and allowing juries to determine what constitutes reasonable care is not a "viable method for resolving the difficult issue of the minimum requirements of care that should be imposed in data breach litigation." Lastly, the court took notice of the fact that creation of a new cause of action would require companies to expend substantial resources defending lawsuits even though the entities "were victims of the same criminal activity as the plaintiffs."
The court concluded its analysis into the propriety of creating a common law duty by noting that the Pennsylvania General Assembly extensively considered the issues surrounding data breaches when enacting the Breach of Personal Information Notification Act (the "Act"). 73 P.S. § 2301, et seq. (effective June 20, 2006). Notably, the Act did not establish a duty of care or a private cause of action. Rather, the Act created only a notification obligation in the event of a breach. Had the General Assembly wished to impose a new duty, it had the opportunity to do so. Exercising judicial restraint, Judge Wettick concluded "[i]t is not for the courts to alter the direction of the General Assembly because public policy is a matter for the Legislature."
While Judge Wettick's decision will surely not be the last word on liability stemming from data breach cases in Pennsylvania, it is highly instructive, well-reasoned, and likely to be followed by other Pennsylvania courts. A copy of the Judge Wettick's decision can be obtained here.
Notice: The purpose of this update is to identify select developments that may be of interest to readers. The information contained herein is abridged and summarized from various sources, the accuracy and completeness of which cannot be assured. This update should not be construed as legal advice or opinion, and is not a substitute for the advice of counsel.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
