[J-20-2018][M.O. - Baer, J.] IN THE SUPREME COURT OF PENNSYLVANIA WESTERN DISTRICT
BARBARA A. DITTMAN, GARY R. : No. 43 WAP 2017 DOUGLAS, ALICE PASTIRIK, JOANN : DECOLATI, TINA SORRENTINO, : Appeal from the Order of the Superior KRISTEN CUSHMAN AND SHANNON : Court entered on 1/12/17 at No. 971 MOLYNEAUX, INDIVIDUALLY AND ON : WDA 2015, affirming the order of the BEHALF OF ALL OTHERS SIMILARLY : Court of Common Pleas of Allegheny SITUATED, : County entered on 5/28/15 at No. : GD14-003285 : Appellants : : : ARGUED: April 10, 2018 : v. : : UPMC D/B/A THE UNIVERSITY OF : PITTSBURGH MEDICAL CENTER, AND : UPMC MCKEESPORT, : : Appellees :
CONCURRING AND DISSENTING OPINION
CHIEF JUSTICE SAYLOR DECIDED: NOVEMBER 21, 2018
I agree with the majority that Employees’ negligence claim should not have been
dismissed upon a demurrer, at the preliminary objection stage, contesting the legal
sufficiency of the complaint. I respectfully differ, however, with material aspects of the
majority’s reasoning.
From my point of view, the claim in issue sounds in both contract and tort, thus
presenting a hybrid scenario. In this regard, Employees’ claim is expressly premised on
the discrete relationship between employers and employees relative to confidential personal and financial information provided as a condition of employment. See Second
Amended Class Action Complaint at ¶56. This suggests that the claim should be
viewed through a contract lens. Nevertheless, Section 302B of the Second
Restatement -- addressing the risk of intentional or criminal acts -- recognizes that
duties arising out of contractual relationships may form the basis for tort liabilities. See
Restatement (Second) §302B, cmt. e (1965) (“There are . . . situations in which the
actor, as a reasonable man, is required to anticipate and guard against the intentional,
or even criminal, misconduct of others[,] . . . including “[w]here, by contract or otherwise,
the actor has undertaken a duty to protect the other against such misconduct”). See
generally Snoparsky v. Baer, 439 Pa. 140, 145–46, 266 A.2d 707, 710 (1970)
(referencing Section 302B favorably).1
Ultimately, I find that an employer who collects confidential personal and financial
information from employees stands in such a special relationship to those employees
with respect to that information, and I have no difficulty concluding that such a
relationship should give rise to a duty of reasonable care to ensure the maintenance of
appropriate confidentiality as against reasonably foreseeable criminal activity.2
This brings me to the economic loss doctrine. Initially, I respectfully differ with
the majority’s position that the doctrine should be essentially removed from the tort
arena so long as the duty involved can be categorized as “existing independently from
1 I agree with the majority’s footnoted treatment of Section 302B, see Majority Opinion, slip op. at 17 n.11, but my present emphasis is on the interplay between contract and tort in that particular context. I also have difficulty with the majority’s framing of the duty in issue presented here in terms of a broader duty of care pertaining to affirmative conduct that runs to the public at large. See id. at 16-17.
2 My conclusion, in this regard, is similar to that stated by the majority in Part A of its opinion, albeit that I view the present matter as entailing a special relationship arising, in the first instance, out of contractual undertakings.
[J-20-2018][M.O. – Baer, J.] - 2 any contractual obligations between the parties.” Majority Opinion, slip op. at 31-32.3 In
this regard, I note that the economic loss doctrine serves as a bulwark against
uncontrolled liability. See, e.g., Ultramares Corp. v. Touche, 174 N.E. 441, 444 (N.Y.
1931) (Cardozo, C.J.) (warning against imposing liability “an indeterminate amount for
an indeterminate time to an indeterminate class”). See generally Catherine M. Sharkey,
Can Data Breach Claims Survive the Economic Loss Rule?, 66 DEPAUL L. REV. 339,
348-60 (2017) (depicting the application of the economic loss rule in the “stranger
paradigm,” where the actor has no preexisting contractual or special relationship with an
injured victim). From my point of view, a proclamation negating the operation of the
economic loss doctrine in the tort law arena is both unnecessary to the resolution of the
present case and imprudent. Instead, particularly because of the hybrid nature of
Employees’ claim, I find that the applicability of the economic loss doctrine should be
3Moreover, as noted above, I disagree with the majority’s conclusion that a duty on the part of an employer to safeguard confidential personal and financial information provided by employees as a condition of their employment exists independently of a contractual employment relationship.
Parenthetically, Employees’ complaint does not attempt to delineate the specific nature of the employment relationships involved among the 62,000 putative class members. Presumably, there are individual written contracts, collective bargaining agreements, and oral agreements involved. In all events -- and while realizing that the Court has referred to oral at-will employment relationships as “non-contractual,” Weaver v. Harpster, 601 Pa. 488, 502, 975 A.2d 555, 563 (2009) -- I believe that a contract overlay is initially appropriate for present purposes in each of the above categories. Accord Howard C. Ellis, Employment-at-Will and Contract Principles: The Paradigm of Pennsylvania, 96 DICK. L. REV. 595, 613 (1992) (explaining, that under the terms of at- will employment relationships, “[e]ach day is a new contract on these terms: a day's work for a day's pay”).
[J-20-2018][M.O. – Baer, J.] - 3 determined more by way of a discrete social policy assessment than as a matter of
mere categorization.4
In this regard, I am sympathetic to UPMC’s concerns about exposure to litigation
and the scale of the potential liability involved. Nevertheless, I would also be reluctant
to hold that employers should be absolutely immune from liability for any sort of
economic damages occasioned by negligent conduct on their part relative to the
safeguarding of confidential personal and financial data. Along these lines, I note that
some other courts have applied the economic loss doctrine to impose limitations on the
scope of damages without foreclosing economic damages entirely. See, e.g., Anderson
v. Hannaford Bros. Co., 659 F.3d 151, 162 (1st Cir. 2011) (discussing the availability, in
Maine, of recovery for economic losses in the form of “mitigation damages,” i.e.,
recovery for costs and harms incurred during a reasonable effort to mitigate losses
occasioned by computer data breaches). Although any such limitations are not directly
in issue here, I strike the balance here in favor of permitting recovery of at least
mitigation damages -- in the data breach context -- in instances in which an employee or
employees prove that the employer has violated the duty to exercise reasonable care in
protecting confidential personal and financial data.5
Finally, I appreciate that this matter of substantive tort law is more properly the
domain of the Legislature. Nevertheless, I agree with the majority -- in the broadest
Free access — add to your briefcase to read the full text and ask questions with AI
[J-20-2018][M.O. - Baer, J.] IN THE SUPREME COURT OF PENNSYLVANIA WESTERN DISTRICT
BARBARA A. DITTMAN, GARY R. : No. 43 WAP 2017 DOUGLAS, ALICE PASTIRIK, JOANN : DECOLATI, TINA SORRENTINO, : Appeal from the Order of the Superior KRISTEN CUSHMAN AND SHANNON : Court entered on 1/12/17 at No. 971 MOLYNEAUX, INDIVIDUALLY AND ON : WDA 2015, affirming the order of the BEHALF OF ALL OTHERS SIMILARLY : Court of Common Pleas of Allegheny SITUATED, : County entered on 5/28/15 at No. : GD14-003285 : Appellants : : : ARGUED: April 10, 2018 : v. : : UPMC D/B/A THE UNIVERSITY OF : PITTSBURGH MEDICAL CENTER, AND : UPMC MCKEESPORT, : : Appellees :
CONCURRING AND DISSENTING OPINION
CHIEF JUSTICE SAYLOR DECIDED: NOVEMBER 21, 2018
I agree with the majority that Employees’ negligence claim should not have been
dismissed upon a demurrer, at the preliminary objection stage, contesting the legal
sufficiency of the complaint. I respectfully differ, however, with material aspects of the
majority’s reasoning.
From my point of view, the claim in issue sounds in both contract and tort, thus
presenting a hybrid scenario. In this regard, Employees’ claim is expressly premised on
the discrete relationship between employers and employees relative to confidential personal and financial information provided as a condition of employment. See Second
Amended Class Action Complaint at ¶56. This suggests that the claim should be
viewed through a contract lens. Nevertheless, Section 302B of the Second
Restatement -- addressing the risk of intentional or criminal acts -- recognizes that
duties arising out of contractual relationships may form the basis for tort liabilities. See
Restatement (Second) §302B, cmt. e (1965) (“There are . . . situations in which the
actor, as a reasonable man, is required to anticipate and guard against the intentional,
or even criminal, misconduct of others[,] . . . including “[w]here, by contract or otherwise,
the actor has undertaken a duty to protect the other against such misconduct”). See
generally Snoparsky v. Baer, 439 Pa. 140, 145–46, 266 A.2d 707, 710 (1970)
(referencing Section 302B favorably).1
Ultimately, I find that an employer who collects confidential personal and financial
information from employees stands in such a special relationship to those employees
with respect to that information, and I have no difficulty concluding that such a
relationship should give rise to a duty of reasonable care to ensure the maintenance of
appropriate confidentiality as against reasonably foreseeable criminal activity.2
This brings me to the economic loss doctrine. Initially, I respectfully differ with
the majority’s position that the doctrine should be essentially removed from the tort
arena so long as the duty involved can be categorized as “existing independently from
1 I agree with the majority’s footnoted treatment of Section 302B, see Majority Opinion, slip op. at 17 n.11, but my present emphasis is on the interplay between contract and tort in that particular context. I also have difficulty with the majority’s framing of the duty in issue presented here in terms of a broader duty of care pertaining to affirmative conduct that runs to the public at large. See id. at 16-17.
2 My conclusion, in this regard, is similar to that stated by the majority in Part A of its opinion, albeit that I view the present matter as entailing a special relationship arising, in the first instance, out of contractual undertakings.
[J-20-2018][M.O. – Baer, J.] - 2 any contractual obligations between the parties.” Majority Opinion, slip op. at 31-32.3 In
this regard, I note that the economic loss doctrine serves as a bulwark against
uncontrolled liability. See, e.g., Ultramares Corp. v. Touche, 174 N.E. 441, 444 (N.Y.
1931) (Cardozo, C.J.) (warning against imposing liability “an indeterminate amount for
an indeterminate time to an indeterminate class”). See generally Catherine M. Sharkey,
Can Data Breach Claims Survive the Economic Loss Rule?, 66 DEPAUL L. REV. 339,
348-60 (2017) (depicting the application of the economic loss rule in the “stranger
paradigm,” where the actor has no preexisting contractual or special relationship with an
injured victim). From my point of view, a proclamation negating the operation of the
economic loss doctrine in the tort law arena is both unnecessary to the resolution of the
present case and imprudent. Instead, particularly because of the hybrid nature of
Employees’ claim, I find that the applicability of the economic loss doctrine should be
3Moreover, as noted above, I disagree with the majority’s conclusion that a duty on the part of an employer to safeguard confidential personal and financial information provided by employees as a condition of their employment exists independently of a contractual employment relationship.
Parenthetically, Employees’ complaint does not attempt to delineate the specific nature of the employment relationships involved among the 62,000 putative class members. Presumably, there are individual written contracts, collective bargaining agreements, and oral agreements involved. In all events -- and while realizing that the Court has referred to oral at-will employment relationships as “non-contractual,” Weaver v. Harpster, 601 Pa. 488, 502, 975 A.2d 555, 563 (2009) -- I believe that a contract overlay is initially appropriate for present purposes in each of the above categories. Accord Howard C. Ellis, Employment-at-Will and Contract Principles: The Paradigm of Pennsylvania, 96 DICK. L. REV. 595, 613 (1992) (explaining, that under the terms of at- will employment relationships, “[e]ach day is a new contract on these terms: a day's work for a day's pay”).
[J-20-2018][M.O. – Baer, J.] - 3 determined more by way of a discrete social policy assessment than as a matter of
mere categorization.4
In this regard, I am sympathetic to UPMC’s concerns about exposure to litigation
and the scale of the potential liability involved. Nevertheless, I would also be reluctant
to hold that employers should be absolutely immune from liability for any sort of
economic damages occasioned by negligent conduct on their part relative to the
safeguarding of confidential personal and financial data. Along these lines, I note that
some other courts have applied the economic loss doctrine to impose limitations on the
scope of damages without foreclosing economic damages entirely. See, e.g., Anderson
v. Hannaford Bros. Co., 659 F.3d 151, 162 (1st Cir. 2011) (discussing the availability, in
Maine, of recovery for economic losses in the form of “mitigation damages,” i.e.,
recovery for costs and harms incurred during a reasonable effort to mitigate losses
occasioned by computer data breaches). Although any such limitations are not directly
in issue here, I strike the balance here in favor of permitting recovery of at least
mitigation damages -- in the data breach context -- in instances in which an employee or
employees prove that the employer has violated the duty to exercise reasonable care in
protecting confidential personal and financial data.5
Finally, I appreciate that this matter of substantive tort law is more properly the
domain of the Legislature. Nevertheless, I agree with the majority -- in the broadest
4The gist of the action doctrine serves as a means by which courts categorize claims to maintain the distinction between theories of breach of contract and tort. See generally Bruno v. Erie Ins. Co., 630 Pa. 79, 111-12, 106 A.3d 48, 68–69 (2014). Under that doctrine, I would ultimately view Employees’ claims as properly couched in negligence, despite the hybrid character, in light of Section 302B of the Restatement.
5 This is not to say that certification of a class action is necessarily proper, particularly relative to damages issues. See generally Samuel-Bassett v. Kia Motors Am., Inc., 613 Pa. 371, 472-77, 34 A.3d 1, 61-65 (2008) (Saylor, J., dissenting).
[J-20-2018][M.O. – Baer, J.] - 4 frame -- that a pre-existing, traditional tort framework can be applied to the claim
involved, and, again, I find that the economic loss doctrine, and other rational
constraints, can be assessed in terms of the damages calculation for proven, wrongful
conduct on an employer’s part.6
In summary, while I concur in the majority’s determination that Count I of the
complaint should be reinstated, I respectfully dissent concerning the legal principles by
which the majority undertakes to curtail the economic loss doctrine.
Justice Todd joins this concurring and dissenting opinion.
6 I also agree with the majority that the General Assembly’s passage of an enactment requiring notification to affected persons of data breaches -- and even its consideration of potential civil causes of action in connection therewith -- does not control whether Employees’ claims sufficiently comport with traditional common law principles to survive a demurrer. See Majority Opinion, slip op. at 15 n.10. In other words, in light of the pre- existing norms, the failure of the Legislature to pass affirmative legislation is inadequate, in my view, to signal an abrogation of those norms.
This assessment subsumes consideration of the economic loss doctrine -- in light of all of the uncertainties attending the doctrine, it seems to me to be unreasonable to assume that the Legislature would have deemed it sufficient to effectively extinguish potential common law causes of action regarding data breaches.
[J-20-2018][M.O. – Baer, J.] - 5