McDowell v. Cgi Group, Inc.

• Court: District Court, District of Columbia
• Decided: June 1, 2017
• Docket: Civil Action No. 2015-1157
• Status: Published

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

LORI McDOWELL, on behalf of herself and similarly situated,

Plaintiffs,

v.

CGI FEDERAL INC., and Civil Action No. 15-1157 (GK) DOES 1through100, inclusive

Defendants.

MEMORANDUM OPINION

Plaintiff, Lori McDowell, alleges that her personal information was stolen by employees

of Defendant, CGI Federal, Inc. ("CGI"), and then used to open accounts and make purchases

using her identity. CGI acquired this information pursuant to a contract with the State Department,

under which CGI received and processed passport applications on behalf of the State Department,

including the application of McDowell. McDowell brings this class action lawsuit on behalf of

herself and other similarly situated individuals, alleging that CGI failed to adequately safeguard

their personal data and is therefore liable for: ( 1) violations of the District of Columbia's Consumer

Protection Procedures Act, D.C. Code§ 28-3901 et seq. ("CPPA"); (2) negligence; (3) breach of

contract; (4) breach of bailment; and (5) unjust enrichment. 1

1 McDowell brings the same claims against unknown individuals who she alleges are "legally responsible in some manner for the unlawful acts referred to herein," collectively Does 1 through 100. Amended Complaint~ 12. Because these Doe defendants are not mentioned in the factual allegations contained in McDowell's Amended Complaint, they are unnecessary to the resolution of CGI' s Motion to Dismiss, and therefore, are not discussed further in this Opinion. -1- CGI filed a Motion to Dismiss McDowell's Amended Complaint, [Dkt. No. 27], arguing

that she has failed to state a claim upon which relief can be granted for any Count contained in the

Amended Complaint. Upon consideration of the Motion to Dismiss, responsive briefs, and the

entire record herein, and for the reasons stated below, Defendant's Motion to Dismiss is granted

as to all counts except McDowell's of breach of contract claim, contained in Count 3.

I. BACKGROUND A. Factual Background2

CGI is a Delaware corporation with an office in Washington, D.C., and a principal place

of business in Fairfax, Virginia. Amended Complaint if 11. It provides a number of services to

the United States Passport Agency, a constituent of the State Department, also located in

Washington, D.C. Id. if 11. Pursuant to the contract at issue here, it processes passport applications

for the Passport Agency. Id. if 2. Passport applicants must submit sensitive and personally identifiable information,

including: name, date of birth, city of birth, state of birth, country of birth, social security number,

sex, height, hair color, eye color, occupation, and evidence of U.S. Citizenship, such as a

previously issued U.S. Passport or U.S. birth certificate. Amended Complaint if 24. Applicants

must also submit present identification such as a fully valid driver's license or military ID. Id.

Plaintiffs refer to this information collectively as "Personal Information." Id.

CGI typically stores this Personal Information on its computer systems and transmits it to

the Passport Agency in Washington, DC. Id. if 24. Under the terms of CGI's contract, it must "'provide accessible and qualified management, production, and operational support personnel' to

2 All facts are taken from Plaintiffs Amended Complaint. [Dkt. No. 25]. -2- perform document preparation, creation of document batches, document imaging (scanning) and

reviewing, retrieval of individual application information, data entry, book printing, quality

control, generation of mailing labels, and verification of information." Amended Complaint if 2.

Beginning sometime in 2010, until roughly March 2, 2015, unidentified CGI personnel

stole the Personal Information of passport applicants. Amended Complaint if 31. These individuals then used the Personal Information to create counterfeit identity documents, obtain

commercial lines of credit, and purchase iPhones, iPads, and other electronic merchandise. Id. if

32.

McDowell was one of the applicants whose Personal Information was stolen. Amended

Complaint if 18. McDowell, a resident and citizen of Carrolton, Georgia, had submitted a passport

application from her hometown. Id. ifif 10, 14. Like other applications, hers contained the required

Personal Information, which was intended for transmission to Washington, D.C., via CGI's

computer systems. Id. if 14. Following the submission of her application, CreditScore.com, a credit monitoring service, notified McDowell that someone had opened a T-Mobile Account using

her social security number and that someone had also made a $2,300 retail purchase in Texas using

her identity. Id. if 16. Additionally, CreditScore.com notified McDowell that someone attempted

a "hard inquiry'' check of her credit while attempting to open an account in her name at a Sprint

Nextel in Colorado. Id. if 18. On June 3, 2015, the U.S. Department of Justice formally notified McDowell that she was a victim of the theft of Personal Information from CGI's computer systems.

Id. if 18. As a result of the theft of her Personal Information, McDowell has had to: pay for additional credit monitoring protection; expend time disputing fraudulent charges and accounts

-3- ..

with banks, credit card companies, and credit reporting agencies; and take other steps to protect

herself from additional harm. Id. ~ 20.

B. Procedural Background

On July 20, 2015, McDowell initiated this class action lawsuit, filing a Complaint against

the CGI and the Doe Defendants on behalf of herself and other similarly situated individuals who

had Personal Information, contained in passport applications, stolen by CGI employees. [Dkt. No.

1]. On October 9, 2015, McDowell filed an Amended Complaint, alleging that CGI was liable for

violations of the CPPA, negligence, breach of contract, breach ofbailment, and unjust enrichment.

Amended Complaint ~ 6.

CGI then filed a Motion to Dismiss on October 26, 2015, arguing that McDowell failed to

state a claim on any of the counts contained in the Amended Complaint. Motion to Dismiss

("MTD") [Dkt. No. 27]. McDowell filed an Opposition on November 23, 2015, [Dkt. No. 30],

and CGI filed a Reply on December 21, 2015, [Dkt. No. 31].

II. STANDARD OF REVIEW

Rule 12(b)( 6) of the Federal Rules of Civil Procedure permits dismissal upon the "failure

to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). "To survive a motion

to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to

relief that is plausible on its face." Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (internal quotation

marks and citations omitted). A claim is facially plausible when the pleaded facts "allows the

court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.

-4- Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully," but it

is not a "probability requirement." Id.

At the Rule 12(b)(6) stage, the court accepts all of the complaint's factual allegations as

true and draws all reasonable inferences from those facts in plaintiffs favor. Browning v. Clinton,

292 F.3d 235, 242 (D.C. Cir. 2002). However, the court does not accept "inferences drawn by

plaintiff if such inferences are unsupported by the facts set out in the complaint." Id. (internal

quotation marks and citations omitted). Similarly, the court need not accept plaintiffs legal

conclusions simply because they are "cast in the form of factual allegations." Id. (internal

quotation marks and citations omitted). "Threadbare recitals of a cause of action's elements,

supported by mere conclusory statements," are insufficient to survive a motion to dismiss. Iqbal

556 U.S. at 678.

In addition to the complaint, the court may consider other sources, such as "documents

incorporated into the complaint by reference and matters of which a court may take judicial

notice." Tellabs, Inc. v. Makar Issues & Rights, Ltd., 551 U.S. 308, 322 (2007).

III. ANALYSIS

A. CPPA

Plaintiff alleges that CGI violated the CPPA, which prohibits a person from

misrepresenting the characteristics of consumer goods or services, by representing that it would

secure the passport application data when it did not. Amended Complaint ~~ 53-64. Defendants

argue that this claim should be dismissed because Plaintiff is not a "consumer" under the CPPA.

MTD at 17-21.

Under the CPPA, it is an unlawful trade practice for "any person to: (a) represent that goods

or services have ... characteristics ... that they do not have." D.C. Code§ 28-3904(a). However, -5- subject to limited exceptions only consumers are authorized to bring suit under the CPPA. 3 D.C.

Code§ 28-3905(k)(l)(A). Thus, "[t]he D.C. Court of Appeals has repeatedly concluded that the

CPPA was designed to police trade practices arising only out of consumer-merchant relationships."

Ali v. Tolbert, 636 F.3d 622, 628 (D.C. Cir. 2011) (internal quotation marks omitted); Price v.

Indep. F.S.B., 110 A.3d 567, 573 (D.C. 2015) (the CPPA "'was designed to police trade practices

arising only out of consumer-merchant relationships,' and does not apply to commercial dealings

outside the consumer sphere" (quoting Ford v. Chartone, Inc., 908 A.2d 72, 81 (D.C. 2006))).

"Consumer goods or services' are those that [a] person does or would purchase, lease (as lessee),

or receive and normally use for personal, household, or family purposes." Price, 110 A.3d at 574

(emphasis added) (quotation marks omitted).

McDowell alleges that CGI misrepresented the services it offered. Amended Complaint~

53-64. In a brochure advertising its services, CGI stated that it provides "technology management"

services that provide: "secure data center operations;" "around-the-clock monitoring of systems,

real-time reporting and immediate action on suspicious activity from CGI's security operations

centers;" and "[e]xpert threat anticipation and defense of critical information and infrastructure."

Amended Complaint~ 58. McDowell argues that these statements misrepresented the security of

the services provided by CGI to the Passport Agency, as evidenced by the fact that CGI employees

were able to steal Personal Information contained in passport applications. Opp'n at 9.

3 For example, in addition to consumers, the CPPA authorizes: nonprofit organizations to bring suit on behalf of its member or the general public, D.C. Code § 28-3905(k)(l)(C); and public interest organizations to bring suit on behalf a consumer or class of consumers, Id. § 28- 3905(k)( 1)(D). McDowell does not allege that she is authorized to sue under any of these other provisions of the CPPA. -6- The problem with McDowell's argument is that the services she alleges that CGI

misrepresented are not consumer services, but business services. The technology management

services CGI provides to the Passport Agency are typical of the back-office services that one

company provides to another. They are decidedly not for personal, household, or family purposes,

and therefore do not fall within the ambit of the CPPA. See Indep. Commun. Network, Inc. v.

MCI Telecomm. Corp., 657 F. Supp. 785, 788 (D.D.C. 1987) (transactions between two merchants

that are on the "supply side" of the consumer-merchant do not fall within ambit ofCPPA); Adam

A. Weschler & Son, Inc. v. Klank, 561 A.2d 1003, 1005 (D.C. 1989) ("Transactions along the

distribution chain that do not involve the ultimate retail customer are not consumer transactions

that the Act seeks to reach." (emphasis added)). And even if these were consumer services,

McDowell is not the one who purchased them-the Passport Agency did-and so it cannot be said

that she was the consumer.

In response, McDowell argues that the passport she applied for is a consumer good and

therefore that she is a consumer for purposes of the CPPA. Opp'n at 8. That argument cannot be

squared with the definition of a "good" as used in the CPPA, which defines "goods and services"

as "any and all parts of the economic output of society, at any stage or related or necessary point

in the economic process, and includes consumer credit, franchises, business opportunities, real

estate transactions, and consumer services of all types." D.C. Code § 28-390l(a)(7) (emphasis

added). Simply put, a passport is not part of the economic output of society. See Urtetiqui v.

D'Arcy, 34 U.S. 692, 699 (1835) (a passport "is a document, which, from its nature and object, is

addressed to foreign powers; purporting only to be a request, that the bearer of it may pass safely

and freely; and is to be considered rather in the character of a political document, by which the

-7- bearer is recognized, in foreign countries, as an American citizen; and which, by usage and the law

of nations, is received as evidence of the fact." (emphasis added)).

As McDowell is not a consumer within the meaning of the CPPA, she cannot state a claim

for which relief can be granted, and her CPP A claim must be dismissed.

B. Negligence

McDowell also alleges that CGI negligently handled her Personal Information by failing

to take reasonable steps to prevent the theft of Personal Information by CGI employees. Amended

Complaint iii! 66-71. Defendants argue that this claim should be dismissed because McDowell has

alleged only that she has suffered economic injuries, which cannot, in and of themselves, support

a claim of negligence. MTD at 23-26.

"In order to maintain a legally sufficient negligence claim, a plaintiff must demonstrate:

(1) that the defendant owed a duty to the plaintiff, (2) breach of that duty, and (3) injury to the

plaintiff that was proximately caused by the breach." Aguilar v. RP MRP Washington Harbour,

LLC, 98 A.3d 979, 982 (D.C. 2014) (internal quotations deleted). However, in Aguilar, the District

of Columbia Court of Appeals adopted the "economic loss" doctrine, which "bars recovery of

purely economic losses in negligence" actions. Id. at 985-86.

Under a limited exception to the economic loss doctrine, plaintiff may recover solely for

economic injuries if she can demonstrate she had a "special relationship" with the defendant. Id.

at 984-86, nn. 3 & 4; Whitt v. Am. Prop. Constr., P.C., No. 15-CV-1199, 2017 WL 1288572, at

*6 (D.C. Apr. 6, 2017). Where such a "special relationship" exists, the defendant owes an

independent duty of care to the plaintiff and it is proper to hold the defendant liable for a breach

of that duty. Id. Absent such a special relationship, there is no duty and, consequently, no claim

for negligence. Id.; see also Jefferson v. Collins, 210 F. Supp. 3d 75, 85-86 (D.D.C. 2016). -8- Whether or not such a special relationship exists "is entirely a question of law that must be

determined only by the court." Whitt, 2017 WL 1288572 at *7 (quotation marks omitted).

In determining whether a special relationship exists, the Court asks whether "defendants

had an 'obligation ... to care for the [plaintiffs] economic well-being' or an 'obligation' that

'implicated [her] economic expectancies."' Whitt, 2017 WL 1288572 at *6 (quoting Aguilar, 98

A.3d at 985). Citing approvingly to the decisions of other jurisdictions, the District of Columbia

Court of Appeals has suggested that an "intimate nexus" or "close nexus" "between the parties" is

required to establish the existence of a special relationship and that a plaintiff may demonstrate

the existence of such a nexus through "contractual privity or its equivalent." Aguilar, 98 A.3d at

985 n. 3 (internal citations and quotation marks omitted). A special relationship is unlikely to exist

where "variables beyond [defendant's] negligence could prove determinative of the likelihood of

serious economic harm." Aguilar, 98 A.3d at 985 n. 4.

For example, in Whitt, the court held that a construction company had a special relationship

with the plaintiff-business because: (1) its construction permit contained express terms

"specifically protecting [the business] from the effects" of the construction project; and (2) the

long-term, extensive nature of the construction project meant the harm was not "isolated and

unexpected." 2017 WL 1288572 at *7. In Whitt, the defendant construction company participated

in an extensive construction project directly outside of plaintiffs business entrance over a multi-

year period. Id. at *6. An express provision of the construction permit for the project stated that

the project would not block access to the plaintiffs business. Id. Despite this provision, the

defendant repeatedly blocked the entrance or interfered with entry to plaintiffs business over the

-9- course of the multi-year project. Id. at *1. Plaintiff repeatedly complained, to no avail, and was

ultimately forced to close her business due to a loss of customers. Id. at *2.

Based on the terms of the permit and the foreseeability that the project might impact the

plaintiffs business, the court concluded that the "[defendant] undertook obligations that would

implicate [the plaintiffs] economic expectancies," and therefore that a special relationship existed.

Id. at *6. As the construction permit expressly protected access to plaintiffs entrance, the

defendant knew that its project could economically impact the plaintiff. Id. And by committing

to follow the terms of the permit, the defendant voluntarily took that obligation upon itself, thereby

creating a special relationship with, and a duty to, the plaintiff. Id.

Here, McDowell has not plead facts that can establish the existence of a special relationship

between her and CGI. For example, she does not argue that she was in contractual privity, or its

equivalent, with CGI. Nor does she allege that the contract itself contained language that created

the special relationship. Instead, she argues that "CGI owed a duty of care to Plaintiffs because

they were foreseeable and probable victims of any inadequate data security practices." Amended

Complaint ~ 69. But both Aguilar and Whitt make clear that foreseeability alone is insufficient to

establish a special relationship. See e.g. Aguilar, LLC, 98 A.3d at 984 ("we again decline to apply

the foreseeability test ... in negligence cases involving purely economic losses.").

Belatedly, McDowell argues that the existence of a special relationship could be shown by '

inspecting the contract-which neither party submitted to the Court in full-and therefore that she

should be allowed to proceed to discovery. See Opp'n at 18. But it is clear from the Amended

Complaint that McDowell believes this duty arises not from the terms of the contract, but because

CGI is "actively engaged in the business of collecting, storing, securely transferring, and

-10- maintaining [sensitive personal information]." Id. if 66. The Court will not consider an argument

omitted from the Complaint and raised for the first time in a dispositive motion. 4

As McDowell has failed to allege any facts that plausibly establish the existence of a special

relationship, she cannot state a claim for negligence and this count must be dismissed.

C. Contract Claims

McDowell's Amended Complaint alleges that CGI breached its contract with the State

Department by failing to secure her Personal Information. Amended Complaint iii! 73-77. She

further alleges that she is entitled to sue to remedy this breach because: (1) she is a party to the

contract with CGI; or (2) in the alternative, she is an intended beneficiary of the contract with CGI.

1. Choice of Law

As an initial matter, it appears that there is some uncertainty as to whether federal common

law or the common law of the District of Columbia is applicable to McDowell's contract claims.

Ordinarily, federal common law governs the interpretation of contracts to which the United States

is a party. See e.g. Miree v. DeKalb County, Ga., 433 U.S. 25, 28 (1977). However, even where

a lawsuit involves a federal contract, if it "is purely between private parties and does not touch

rights and duties of the United States," state, rather than federal, law governs. Boyle v. United

Techs. Corp., 487 U.S. 500, 506 (1988); see also Miree, 433 U.S. at 29. It is not necessary to

resolve this question, because federal common law and the common law of the District of

4 The Court may disregard a claim raised for the first time in a memorandum of law. Tunica- Biloxi Tribe of La. v. U.S., 577 F. Supp. 2d 382, 411 (D.D.C. 2008). If the factual basis for a new claim is substantially similar to a claim already alleged in a plaintiffs complaint and the court dismisses the newly-raised claim, the court must afford the plaintiff leave to amend her complaint to include it. See id.; Wiley v. Glassman, 511F.3d151, 159 (D.C. Cir. 2007) -11- Columbia are so similar as to the issues presented in this case that the Court would reach the same

conclusion regardless of which law applies.

2. There was no contract between CGI and McDowell

McDowell alleges that she entered into a contract with CGI when she submitted her

passport application. Amended Complaint i! 74-75. CGI argues that Plaintiff fails to allege that

any communication between McDowell and CGI took place, and therefore, there could have been

no meeting of the minds, which is necessary for contract formation. MTD at 28-29.

To state a claim for breach of an express or implied contract, Plaintiff must allege: "(1) a

valid contract between the parties; (2) an obligation or duty arising out of the contract; (3) a breach

of that duty; and (4) damages caused by breach." Brown v. Sessoms, 774 F.3d 1016, 1024 (D.C.

Cir. 2014 ). The party asserting the existence of an enforceable contract bears the burden of proving

that there has been a "meeting of the minds," or mutual assent, as to all material terms. Ekedahl

v. COREStaff, Inc., 183 F.3d 855, 858 (D.C. Cir. 1999); U.S. ex rel. Morsell v. Symantec Corp.,

130 F. Supp. 3d 106, 131(D.D.C.2015) ("The party alleging a contract must show a mutual intent

to contract"). Without a "meeting of the minds" as to all material terms, there can be no

enforceable contract. Bailey v. Fed. Nat'l Mortg. Ass'n, 209 F.3d 740, 746 (D.C. Cir. 2000).

Here, there is no valid argument that McDowell and CGI ever formed a valid contract.

While there was a meeting of the minds between CGI and the State Department, no such meeting

of the minds took place between McDowell and CGI. McDowell's Amended Complaint contains

no allegation of any interaction from which to infer a meeting of the minds between Plaintiff and

CGI Federal. Indeed, in her Opposition, McDowell seems to abandon the argument that any

contract was formed between her and CGI, arguing only that she was a third party beneficiary of

the contract between the State Department and CGI. See Opp'n generally (failing to respond to -12- CGI's arguments regarding contract formation); Reply at 15 (similarly noting that "Plaintiff

attempts to defend Count 3 solely on a third-party beneficiary theory").

Consequently, Plaintiff has failed to state a claim that she entered into a contract with

CGI, which CGI then breached by failing to secure her Personal Information.

3. McDowell has stated a claim as a third-party beneficiary

In the alternative, McDowell alleges that she is an intended third-party beneficiary of the

contract between the State Department and CGI, and that she is entitled to sue for its breach.

Amended Compli:iint ~ 76. CGI argues that she has failed to allege facts showing that she was an

intended beneficiary, and therefore cannot sue for breach of the contract. MTD at 31-32.

Intended third-party beneficiaries to a contract may sue to enforce the terms of the contract

or obtain a remedy for a breach. Moore v. Gaither, 767 A.2d 278, 287 (D.C. 2001); GECCMC

2005-Cl Plummer St. Off. Ltd. Partn. v. JPMorgan Chase Bank, Nat. Ass'n, 671 F.3d 1027, 1033

(9th Cir. 2012) (internal citations and quotation marks omitted). However, in the context of

contracts with the government, there is a presumption that members of the public are not intended

beneficiaries, but merely incidental beneficiaries of the contract. Moore, 767 A.2d at 287;

GECCMC, 671 F.3d at 1033. Such incidental beneficiaries have no right to sue for breach of

contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033.

In order to overcome this presumption, a third-party plaintiff suing for breach of contract

must show that the contracting parties "clearly intended" that the contract would benefit the

plaintiff, or an identifiable class to which the plaintiff belongs. GECCMC, 671 F.3d at 1033;

Moore, 767 A.2d at 287. Such intent may exist where the plaintiff would be reasonable in relying

on the promise as manifesting an intention to confer a right on him or her. See Restatement

(Second) of Contracts§ 302(1)(b) cmt. d (1981); see e.g. Klamath Water Users Protective Ass'n -13- "·

v. Patterson, 204 F.3d 1206, 1211 (9th Cir. 1999). "This 'clear intent' hurdle is a high one."

GECCMC, 671 F.3d at 1033.

McDowell has plead sufficient facts to plausibly state a claim that she is an intended

beneficiary of the contract between CGI and the Department of State. Her Amended Complaint

states "[t]he U.S. and CGI agreed to properly receive, handle, store, and otherwise utilize the

Personal Information of Plaintiffs. Upon information and belief, it was also a term of the contract

that CGI would act reasonably and employ reasonable safeguards at all times with respect to

handling the Personal Information of Plaintiffs, including requiring a background security

investigation for all CGI employees with authorized access to the Personal Information."

Amended Complaint ~ 76 (emphasis added). In other words, Plaintiff alleges that the contract

contains terms that expressly require CGI: (1) to protect the Personal Information it receives; and

(2) to do so for the benefit of an identifiable class of individuals, passport applicants, to which she

belongs.

If the contract-which, as already noted, is not before the Court in its entirety-bears out

that allegation, it is at least plausible that she can establish that she is an intended beneficiary.

Depending on the language of the alleged contract provision, as well as the contract as a whole, it

is plausible that an objective passport applicant would be reasonable in relying on the promise as

manifesting an intention to confer a right on him or her to have their Personal Information

safeguarded by CGI.

Whether she can do so will depend on the specific language contained in the contract, but

that is a merits question that should not be resolved in deciding CGI's Motion to Dismiss when

the contract is not before the Court. See SB Charles Alan Wright & Arthur R. Miller, Federal

-14- Practice & Procedure§ 1357 (Supp. 2011) ("Wright & Miller") ("Whether the plaintiff ultimately

can prevail on the merits is a matter properly determined on the basis of proof, which means on a

summary judgment motion or at trial by the judge or a jury, and not merely on the face of the

pleadings"). Given the "liberal pleading standard" embodied in the Federal Rules, see Jones v.

Air Line Pilots Ass'n, Intern., 642 F.3d 1100, 1104 (D.C. Cir. 2011), McDowell should have the

opportunity to do so.

CGI's counter-arguments are unpersuasive. First, CGI argues that the test for whether a

plaintiff is an intended beneficiary "is not merely whether or not the parties intended to confer a

benefit on third parties (or to give a right to 'performance' as Plaintiff alleges), but rather whether

or not 'the parties intended the third party to be able to sue to protect that benefit."' MTD at 32

(quoting Doe v. District of Columbia, 796 F.3d 96, 109 (D.C. Cir. 2015) (emphasis added)).

However, that holding was issued in the context of a case involving a consent decree-not an

ordinary government contract-and is best read as limited to that context. See Doe, 796 F.3d 96

(involving a challenge to implementation of a consent decree, reached in a previous lawsuit, by

individuals who were not parties to the consent decree).

The decision itself only discusses the ability of "[t]hird parties to a consent decree" to sue

for breach of the consent decree and does not discuss third parties to other types of contracts. See

Doe, 796 F.3d at 109. Additionally, CGI's reading of Doe cannot be squared with Moore or

GECCMC-both cases that CGI itself cites in its Motion to Dismiss-which do not require a

plaintiff to show that contracting parties intended the plaintiff to be able to sue to protect a benefit

conferred by the contract in order to prove that she is an intended beneficiary. Finally, all of the

cases cited by the Court of Appeals in Doe also involved consent decrees, not ordinary contracts.

-15- Doe, 796 F.3d at 109, n.4 (citing: SEC v. Prudential Sec. Inc., 136 F.3d 153, 159 (D.C. Cir. 1998)

(involving consent decree between securities seller and the SEC); Blue Chip Stamps v. Manor

Drug Stores, 421 U.S. 723, 750 (1975) (involving anti-trust consent decree), Terrell v. District of

Columbia, 703 F.Supp.2d 17, 21 (D.D.C. 2010) (involving IDEA consent decree), Beckett v. Air

Line Pilots Ass'n, 995 F.2d 280 (D.C.Cir.1993) (involving consent decree between pilots' union

and non-member pilots)). As Doe appears only to define the applicable standard for determining

who is a third-party beneficiary to consent decrees, it does not control resolution of this case.

Second; CGI points to cases in other jurisdictions in which courts have held that victims of

a data breach were not intended beneficiaries of contracts related to the handling of their data.

MTD at 32 (relying on the cases collected in Willingham v. Global Payments, Inc., No. 1:12-CV-

01157-RWS, 2013 WL 440702, at *19-20 (N.D. Ga. Feb. 5, 2013)). But at least two of the three

cases cited in Willingham were decided on motions for summary judgment after the contract had

been introduced as evidence. See Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 167

(3d Cir. 2008) ("the district court converted Fifth Third's motion for reconsideration into a motion

for summary judgment and ordered the parties to conduct discovery on the third-party beneficiary

issues, i.e., whether Fifth Third's contractual obligation to Visa to comply with the Visa Operating

Regulations was intended to benefit Issuers like Sovereign."); Banknorth, N.A. v. BJ's Wholesale

Club, Inc., 442 F. Supp. 2d 206, 211 (M.D. Pa. 2006) (court granted motion for summary judgment

because a provision in the contract "specifically providing that the contract was not for the benefit

of, and not intended to be enforced by, any third party.").

That approach accords more closely to the liberal pleading standard established by the

Federal Rules. It is particularly appropriate in third-party beneficiary cases, where the Plaintiff is

-16- not a party to the contract, and therefore, is unlikely to be able to include express provisions of the

contract in her Complaint to demonstrate that she is an intended beneficiary. Moreover, because

the contract is likely to be incorporated into the plaintiffs complaint by reference, as it was in this

case, the defendant-as a party to the contract-has it entirely within its power to submit the

contract as an attachment or exhibit to the motion to dismiss without converting it into a motion

for summary judgment. See Tellabs, 551 U.S. at 322. In doing so, the defendant likely can avoid

even the limited discovery provided for in cases such as Sovereign Bank.

McDowell's Amended Complaint states a plausible claim that she is an intended

beneficiary of the contract between CGI and the State Department, and therefore, the Court will

not dismiss her breach of contract claim.

D. Bailment

Finally, McDowell alleges that she and CGI entered into a bailment relationship that

required CGI to safeguard her Personal Information when she submitted her passport application,

which CGI then breached. Amended Complaint iii! 79-84. CGI counters that no bailment

relationship was created because there was no agreement between McDowell and CGI. MTD at

37-40.

"A bailment relationship is said to arise where an owner, while retaining title, delivers

personalty to another for some particular purpose upon an express or implied contract. The

relationship includes a return of the goods to the owner or a subsequent disposition in accordance

with his instructions." Kam-Almaz v. U.S., 682 F.3d 1364, 1368 (Fed. Cir. 2012). In the District

of Columbia, "[a] bailment for hire relationship may be created even in the absence of an explicit

agreement. All that is required is the existence of a mutual benefit." First Am. Bank, N.A. v.

-17- District of Columbia, 583 A.2d 993, 996 (D.C. 1990). Thus, "[a] person becomes a bailee for hire

when he takes property into his care and custody for a compensation. The nature and amount of

the compensation are immaterial." First Am. Bank, 583 A.2d at 996.

McDowell has failed to allege facts that plausibly support the existence of a bailment

relationship. As discussed above, there were no communications between McDowell and CGO,

and therefore, they could not have formed an agreement necessary to create an express bailment.

Similarly, CGI received no compensation from McDowell nor did it expect to receive additional

compensation from the State Department for processing McDowell's passport application, and

therefore, they could not have formed an implied bailment or quasi-bailment. See Snowder v.

District of Columbia, 949 A.2d 590, 605 (D.C. 2008) (quasi-bailment is formed when bailee takes

possession of property "in expectation of compensation"). To the extent any bailment relationship

existed it was between McDowell and the State Department, and that is insufficient, in and of

itself, to impose liability on CGI for the data breach. 8A Am. Jur. 2d Bailments § 126 (2017

Update) ("A bailee who employs agents or employees who use or otherwise deal with the bailed

property is responsible for the conduct of such persons while they are acting within the scope of

their employment.").

Accordingly, McDowell has failed to state facts that plausibly support the existence of any

form of a bailment, and therefore cannot state a claim for breach of bailment. 5

E. Unjust Enrichment

Finally, McDowell alleges that CGI was unjustly enriched because it received benefits

under its contract with the State Department but failed to fulfill its contractual obligation to

5 As no bailment existed, it is unnecessary to address CGI's other arguments. MTD at 39-40. -18- safeguard Personal Information. Amended Complaint ifif 86-92. CGI argues that McDowell fails

to allege that she conferred any benefit on CGI. MTD at 33-35.

Under D.C. law, "unjust enrichment occurs when: (1) the plaintiff conferred a benefit on

the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the

defendant's retention of the benefit is unjust." Pernice v. Bovim, Civil Action No. 15-541 (JEB),

2015 WL 5063378, at *6 (D.D.C. Aug. 26, 2015) (quoting Peart v. D.C. Hous. Auth., 972 A.2d

810, 813 (D.C. 2009)). "To recover on a theory of unjust enrichment ... the plaintiff must show

that the defendant was unjustly enriched at his expense .... " Id. at *7 (quoting News World

Commc'ns, Inc. v. Thompsen, 878 A.2d 1218, 1222 (D.C. 2005)).

McDowell fails to allege any facts that plausibly suggest that she conferred any benefit on

CGI. Her Amended Complaint identifies two benefits that she argues she conferred on CGI. First,

she claims that her passport-application fee was used to pay CGI for the costs of processing her

passport application. Amended Complaint if 87; Opp'n at 20. But as CGI correctly points out, by

law passport application fees must be paid directly to the Treasury. See 22 U.S.C. § 214(a).

Therefore, those fees could not have been paid to CGI and they cannot constitute a benefit.

Second, she argues that by submitting passport applications, she and the other putative

class members created additional demand for passport processing services, which is itself a benefit

to CGI. Amended Complaint if 86. However, inchoate demand is not itself a benefit, because it

lacks intrinsic value. To be sure, increased demand for a service may create additional value for

the supplier, such as by raising the market price for the service or creating a market that did not

previously exist. However, McDowell's Amended Complaint does not allege that the additional

demand for passport processing services by the putative class members increased the value of the

-19- contract between CGI and the Passport Agency or that the contract would not have been executed

absent the increased demand. Thus, even under her theory that Plaintiffs' applications increased

demand for passport processing services, McDowell has failed to allege any identifiable benefit

that CGI received as a result.

Additionally, McDowell fails to allege that she "conferred" any of these putative benefits

on CGI. Sabre Int'l Sec. v. Torres is instructive. 60 F. Supp. 3d 36 (D.D.C. 2014). In that case,

Sabre sued Torres, as well as Torres' individual employees, arguing that Sabre's payments to

Torres unjustly enriched the individual employees in the form of salaries and bonuses they

received from Torres. Id. at 41-42. The Court found that nothing in the Complaint connected the

benefit that the company improperly took from Sabre to the monies paid to the employees.

Therefore, the Court dismissed Sabre's unjust enrichment claim, concluding that "Sabre has not

plausibly alleged that it had any role in conferring these benefits on the [individual employees]."

Id. at 42.

Just as in Sabre, McDowell has failed to allege any fact that plausibly suggests that she had

any role in "conferring" anything of value on CGI, and therefore cannot state a claim for unjust

enrichment.

IV. CONCLUSION

For the foregoing reasons Plaintiffs Amended Complaint is dismissed with respect to all

Counts, except Count 3, her third-party beneficiary breach of contract claim.

June 1, 2017 G'~~ - GladysKeSef United States District Judge

-20-