A panel of the United States Court of Appeals for the Third Circuit affirmed a district court decision granting defendant’s motion to dismiss in Longenecker-Wells v. Benecard Svcs. Inc., et al, No. 15-3538 (3rd Cir. 8/25/16) http://www2.ca3.uscourts.gov/opinarch/153538np.pdf.
The Third Circuit found that plaintiffs’ negligence claim for a data breach, in which the data of customers and employees of a pharmacy benefit manager was stolen and used to file fraudulent tax returns resulting in refunds to unknown third parties, was barred by Pennsylvania’s economic loss doctrine. The economic loss doctrine provides that “no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.” Plaintiffs argued that under the Pennsylvania Supreme Court’s interpretation of the doctrine in Bilt-Rite Contractors, Inc. v. The Architectural Studio, the doctrine only applies where defendant’s duty to plaintiff arises from a contract and that the negligence in this case arises from a common law duty grounded in public policy. The Third Circuit rejected that argument stating that in Bilt-Rite, the negligence claim arose out of an alleged misrepresentation under Section 552 of the Restatement (Second) of Torts that imposes a duty of care on suppliers of professional information for use by others. Thus, the Third Circuit continued, Bilt-Rite did not hold that the economic loss doctrine may not apply where the plaintiff has no available contract remedy, but rather it created a carved out exception to allow a commercial plaintiff to seek recourse from an expert supplier of information when the loss resulted from reliance on the expert’s information. The court found that while Pennsylvania’s economic loss doctrine can be read in several different ways, it declined to “right the ship”, saying that task, if necessary, is for the Pennsylvania Supreme Court, not the Third Circuit.
The Court also affirmed dismissal of plaintiffs’ breach of implied contract claim alleging that defendants breached an implied contract by failing to adequately safeguard Plaintiffs’ confidential information. The Court found that an implied contract arises when the parties’ intention to be bound can be inferred from the conduct of the parties. In this case, the Court found that plaintiffs failed to plead any facts supporting their contention that an implied contract arose between the parties. The Court contrasted this case with another where an implied contract to protect the plaintiff’s confidential information was found through allegations of privacy policies, codes of conduct, company security practices and other conduct. Here, the Court found that the plaintiffs did not plead any company-specific documents or policies from which one could infer an implied contractual duty to protect plaintiffs’ information. Merely claiming that an implied contract arose “from the course of conduct” was insufficient to defeat a motion to dismiss.
This case underscores the fact that courts will rely on traditional rules of tort to evaluate the factual and legal basis for a data breach claim. Often differences in state law and the interpretation of doctrines such the economic loss doctrine will have an impact on where and in what court a data breach claim can be prosecuted successfully.