A Pennsylvania judge has dismissed a class action arising out of the breach of confidential employee information, adding to a growing body of state courts that have found that negligence claims alleging failure to provide reasonable data security for personal health and other information are not actionable.
Dittman v. UPMC arose out of a data breach of the University of Pittsburgh Medical Center's (UPMC) network, resulting in the theft of sensitive personal information for 62,000 employees, including birthdates, Social Security numbers, confidential tax information, addresses, salaries, and bank account information. Plaintiffs sought to recover damages associated with "imminent identity theft," including the cost of credit monitoring, asserting that UPMC had a common law duty to protect highly sensitive personal and financial information by designing, maintaining, and testing its security systems.
Allegheny County Court of Common Pleas Judge R. Stanton Wettick, Jr. rejected that argument, holding that Pennsylvania law did not recognize such a common law duty, which in the Court's view would need to be created by the state General Assembly. "The legislature is aware of and has considered the issues that plaintiffs want this court to consider. As of this date, the only legislation which the General Assembly has chosen to enact requires entities that suffer a breach of their security systems to provide notification," Judge Wettick wrote. "Furthermore, the legislature gives the Office of Attorney General exclusive authority to bring an action for violation of the notification requirement (i.e., no private actions are permitted)."
The Court also cited the economic loss doctrine, which precludes negligence claims for purely economic losses that do not involve bodily damage or property damage, as a basis for rejecting the plaintiffs' negligence claim.
Dittman is the latest in a line of cases rejecting class actions seeking economic damages arising out of data breaches. The balance of federal case law currently favors dismissal of such actions on the grounds that fear of identity theft is not a sufficient harm to trigger Article III standing. Most state courts examining the issue have found, like Judge Wettick, that there is no common law duty to provide adequate and reasonable data security.
The case, if anything, goes further than other state court decisions analyzing the wisdom of imposing a common law duty to protect sensitive personal information, noting the public policy implications if state courts were to permit such claims to go forward. In particular the Court expressed concern that a ruling in favor of the plaintiffs could result in hundreds of thousands of new lawsuits being filed in Pennsylvania. "Clearly, the judicial system is not equipped to handle this increased caseload of negligence actions," Judge Wettick said. "Courts will not adopt a proposed solution that will overwhelm Pennsylvania's judicial system" and would require defendant companies, victims themselves as the Court noted, to expend substantial resources to defend such claims.
Dittman also differs from other data breach class actions insofar as at least some of the plaintiffs alleged actual identify theft in the form of fraudulent income tax returns. Many courts that have rejected claims for damages arising out of data breaches have nonetheless permitted claims to go forward where the plaintiffs were able to demonstrate actual damages, rather than a speculative fear of identity theft.
Notwithstanding Dittman, the viability of future negligence claims stemming from the loss of sensitive personal information in connection with a data breach remains an open issue in many jurisdictions. The case does not address the viability of consumer fraud or breach of contract claims. Likewise, because the UPMC employment records disclosed in Dittman did not constitute "protected health information" under HIPAA, the Court sidestepped the question of whether HIPAA provides the standard of care for a common law negligence claim. While HIPAA does not provide a private cause of action for statutory violations, several state courts, including the Connecticut Supreme Court in Byrne v. Avery Center for Obstetrics and Gynecology, 2014 WK 5507439, Conn. Nov. 11, 2014, have rejected preemption arguments and allowed plaintiffs to use HIPAA to establish the standard of care in negligence claims.
