While the United States Supreme Court’s ruling in Spokeo v. Robins, 136 S. Ct. 1540 (2016), has garnered much attention after being cited by numerous courts as a means to dismiss data privacy class actions, defendants should never count out any potential avenues for exiting such a suit; in Pennsylvania (and in many other states following the same legal principle), the economic loss doctrine can also provide summary relief.  As demonstrated in Longenecker-Wells, et al. v. Benecard Services, Inc., et al., No. 15-3538, 2016 WL 4474701 (3d Cir. Aug. 25, 2016), even in data breach suits where actual harm exists and plaintiffs have standing, a quick dismissal is still possible.

The Benecard suit was initiated by former employees and customer members of Benecard Services Inc., which provides medical and vision supply services to public and private organizations.  Plaintiffs sued after unknown third parties breached Benecard’s computer system and accessed plaintiffs’ personal and confidential information.  The hackers then used that information to file fraudulent tax returns, which caused the IRS to issue tax refunds to the third parties rather than to the plaintiffs. 

In the suit, plaintiffs filed negligence and breach of implied contract claims on behalf of all former and current Benecard employees and customer members whose information was exposed by the breach. While many courts have dismissed data breach cases because of lack of standing based on the absence of tangible harm to plaintiffs, the U.S. Court of Appeals for the Third Circuit found different grounds for dismissal in the Benecard litigation.  Specifically, the Third Circuit found that plaintiffs’ negligence claim was foreclosed by Pennsylvania’s economic loss doctrine, while the breach of contract claim was insufficient to state a claim under Fed. R. Civ. P. 12(b)(6), affirming the ruling of the U.S. District Court for the Middle District of Pennsylvania on both counts.  The most significant difference between this ruling and no-harm post-Spokeo rulings was that the District Court, and the Third Circuit, found that the scenario caused plaintiffs actual financial harm; however, plaintiffs ultimately were unable to state a cognizable claim despite clearing the standing hurdle.

Crucial to the decisions of both the Middle District and the Third Circuit in the negligence claim was Pennsylvania’s economic loss doctrine—a legal concept (followed in more or less the same form in most states) that generally establishes that a party cannot maintain a claim for negligence where the damage allegedly caused is only economic in nature, and which is “unaccompanied by physical injury or property damage.” Excavation Techs., Inc. v. Columbia Gas Co. of Pa., 985 A.2d 840, 841 n.3 (Pa. 2009) (quoting Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa. Super. 2003)).

In Benecard, the Third Circuit explained that it was declining plaintiffs’ invitation to permit plaintiffs’ negligence claim to avoid the bar of the economic loss doctrine based on the fact that the claim arose from a common-law duty grounded in public policy, rather than a contractual duty.  In doing so, the Third Circuit noted that a small carve-out to the rule established by the Supreme Court of Pennsylvania in earlier decisions did not save the claim, and pointed out that the “Court recently confirmed that the economic loss doctrine ‘generally precludes recovery in negligence actions for injuries which are solely economic.’”  Thus, the economic loss doctrine was applicable to plaintiffs’ claims, despite the lack of a contractual relationship between plaintiffs and Benecard.  As a result, plaintiffs could not maintain their negligence claim based on the hacking and tax return scheme because the harm was purely economic, and the Third Circuit affirmed the Middle District’s dismissal of that claim.

In the breach of implied contract claim, plaintiffs fared no better. The Third Circuit found, as the Middle District did below, that the allegations in the complaint failed to state a claim under Rule 12(b)(6).  In support of the breach of implied contract claim, plaintiffs argued that an implied contract arose when plaintiffs entrusted Benecard with their personal confidential information by doing business with, or being employed by, the company.  However, the Third Circuit ruled that the provision of that information—even where required as a prerequisite to a job—did “not create a contractual promise to safeguard that information, especially from third party hackers.”  The court observed that bare assertions that an implied contract arose from a course of conduct between the parties were insufficient to state a claim, in the absence of any “company-specific documents or policies from which one could infer an implied contractual duty to protect Plaintiffs’ information.”

As this case demonstrates, standing arguments are far from the only effective means of summarily dismissing a data breach suit. While the Spokeo decision has brought Article III standing to the forefront of many defendants’ dismissal arsenals, a careful look at plaintiffs’ claims is essential, as it may reveal many different theories for dismissal of a data breach suit even where actual harm is adequately alleged. Indeed, depending upon the circumstances and applicable state law, the economic loss doctrine can be an effective tool, though it is by no means the only one.  As this Third Circuit ruling indicates, in Pennsylvania, even where post-Spokeo standing arguments offer no relief, a dismissal motion taking advantage of a diverse array of arguments such as the economic loss doctrine can make a data breach suit disappear just as quickly.