McDowell v. Cgi Group, Inc.

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

LORI McDOWELL, on behalf of herself and similarly situated,

Plaintiffs,

v.

CGI FEDERAL INC., and Civil Action No. 15-1157 (GK) DOES 1through100, inclusive

Defendants.

MEMORANDUM OPINION

Plaintiff, Lori McDowell, alleges that her personal information was stolen by employees of Defendant, CGI Federal, Inc. ("CGI"), and then used to open accounts and make purchases using her identity. CGI acquired this information pursuant to a contract with the State Department, under which CGI received and processed passport applications on behalf of the State Department, including the application of McDowell. McDowell brings this class action lawsuit on behalf of herself and other similarly situated individuals, alleging that CGI failed to adequately safeguard their personal data and is therefore liable for: ( 1) violations of the District of Columbia's Consumer Protection Procedures Act, D.C. Code§ 28-3901 et seq. ("CPPA"); (2) negligence; (3) breach of contract; (4) breach of bailment; and (5) unjust enrichment. 1

1 McDowell brings the same claims against unknown individuals who she alleges are "legally responsible in some manner for the unlawful acts referred to herein," collectively Does 1 through 100. Amended Complaint~ 12. Because these Doe defendants are not mentioned in the factual allegations contained in McDowell's Amended Complaint, they are unnecessary to the resolution of CGI' s Motion to Dismiss, and therefore, are not discussed further in this Opinion.

2

CGI filed a Motion to Dismiss McDowell's Amended Complaint, [Dkt. No. 27], arguing that she has failed to state a claim upon which relief can be granted for any Count contained in the Amended Complaint. Upon consideration of the Motion to Dismiss, responsive briefs, and the entire record herein, and for the reasons stated below, Defendant's Motion to Dismiss is granted as to all counts except McDowell's of breach of contract claim, contained in Count 3.

I. BACKGROUND A. Factual Background2

CGI is a Delaware corporation with an office in Washington, D.C., and a principal place of business in Fairfax, Virginia. Amended Complaint if 11. It provides a number of services to the United States Passport Agency, a constituent of the State Department, also located in Washington, D.C. Id. if 11. Pursuant to the contract at issue here, it processes passport applications

for the Passport Agency. Id. if 2.

Passport applicants must submit sensitive and personally identifiable information,

including: name, date of birth, city of birth, state of birth, country of birth, social security number, sex, height, hair color, eye color, occupation, and evidence of U.S. Citizenship, such as a previously issued U.S. Passport or U.S. birth certificate. Amended Complaint if 24. Applicants must also submit present identification such as a fully valid driver's license or military ID. Id. Plaintiffs refer to this information collectively as "Personal Information." Id.

CGI typically stores this Personal Information on its computer systems and transmits it to

the Passport Agency in Washington, DC. Id. if 24. Under the terms of CGI's contract, it must "'provide accessible and qualified management, production, and operational support personnel' to

2 All facts are taken from Plaintiffs Amended Complaint. [Dkt. No. 25].

3

perform document preparation, creation of document batches, document imaging (scanning) and reviewing, retrieval of individual application information, data entry, book printing, quality control, generation of mailing labels, and verification of information." Amended Complaint if 2.

Beginning sometime in 2010, until roughly March 2, 2015, unidentified CGI personnel

stole the Personal Information of passport applicants. Amended Complaint if 31. These individuals then used the Personal Information to create counterfeit identity documents, obtain

commercial lines of credit, and purchase iPhones, iPads, and other electronic merchandise. Id. if 32.

McDowell was one of the applicants whose Personal Information was stolen. Amended Complaint if 18. McDowell, a resident and citizen of Carrolton, Georgia, had submitted a passport application from her hometown. Id. ifif 10, 14. Like other applications, hers contained the required Personal Information, which was intended for transmission to Washington, D.C., via CGI's

computer systems. Id. if 14. Following the submission of her application, CreditScore.com, a credit monitoring service, notified McDowell that someone had opened a T-Mobile Account using

her social security number and that someone had also made a $2,300 retail purchase in Texas using her identity. Id. if 16. Additionally, CreditScore.com notified McDowell that someone attempted a "hard inquiry'' check of her credit while attempting to open an account in her name at a Sprint

Nextel in Colorado. Id. if 18. On June 3, 2015, the U.S. Department of Justice formally notified McDowell that she was a victim of the theft of Personal Information from CGI's computer systems.

Id. if 18. As a result of the theft of her Personal Information, McDowell has had to: pay for additional credit monitoring protection; expend time disputing fraudulent charges and accounts

4

..

with banks, credit card companies, and credit reporting agencies; and take other steps to protect herself from additional harm. Id. ~ 20.

B. Procedural Background

On July 20, 2015, McDowell initiated this class action lawsuit, filing a Complaint against the CGI and the Doe Defendants on behalf of herself and other similarly situated individuals who had Personal Information, contained in passport applications, stolen by CGI employees. [Dkt. No.

1]. On October 9, 2015, McDowell filed an Amended Complaint, alleging that CGI was liable for violations of the CPPA, negligence, breach of contract, breach ofbailment, and unjust enrichment.

Amended Complaint ~ 6.

CGI then filed a Motion to Dismiss on October 26, 2015, arguing that McDowell failed to state a claim on any of the counts contained in the Amended Complaint. Motion to Dismiss ("MTD") [Dkt. No. 27]. McDowell filed an Opposition on November 23, 2015, [Dkt. No. 30], and CGI filed a Reply on December 21, 2015, [Dkt. No. 31].

II. STANDARD OF REVIEW Rule 12(b)( 6) of the Federal Rules of Civil Procedure permits dismissal upon the "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citations omitted). A claim is facially plausible when the pleaded facts "allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.

5

Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully," but it is not a "probability requirement." Id.

At the Rule 12(b)(6) stage, the court accepts all of the complaint's factual allegations as true and draws all reasonable inferences from those facts in plaintiffs favor. Browning v. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002). However, the court does not accept "inferences drawn by plaintiff if such inferences are unsupported by the facts set out in the complaint." Id. (internal quotation marks and citations omitted). Similarly, the court need not accept plaintiffs legal conclusions simply because they are "cast in the form of factual allegations." Id. (internal quotation marks and citations omitted). "Threadbare recitals of a cause of action's elements, supported by mere conclusory statements," are insufficient to survive a motion to dismiss. Iqbal 556 U.S. at 678.

In addition to the complaint, the court may consider other sources, such as "documents incorporated into the complaint by reference and matters of which a court may take judicial notice." Tellabs, Inc. v. Makar Issues & Rights, Ltd., 551 U.S. 308, 322 (2007). III. ANALYSIS A. CPPA Plaintiff alleges that CGI violated the CPPA, which prohibits a person from misrepresenting the characteristics of consumer goods or services, by representing that it would secure the passport application data when it did not. Amended Complaint ~~ 53-64. Defendants argue that this claim should be dismissed because Plaintiff is not a "consumer" under the CPPA. MTD at 17-21.

Under the CPPA, it is an unlawful trade practice for "any person to: (a) represent that goods or services have ... characteristics ... that they do not have." D.C. Code§ 28-3904(a). However,

6

subject to limited exceptions only consumers are authorized to bring suit under the CPPA. 3 D.C. Code§ 28-3905(k)(l)(A). Thus, "[t]he D.C. Court of Appeals has repeatedly concluded that the CPPA was designed to police trade practices arising only out of consumer-merchant relationships." Ali v. Tolbert, 636 F.3d 622, 628 (D.C. Cir. 2011) (internal quotation marks omitted); Price v. Indep. F.S.B., 110 A.3d 567, 573 (D.C. 2015) (the CPPA "'was designed to police trade practices arising only out of consumer-merchant relationships,' and does not apply to commercial dealings outside the consumer sphere" (quoting Ford v. Chartone, Inc., 908 A.2d 72, 81 (D.C. 2006))). "Consumer goods or services' are those that [a] person does or would purchase, lease (as lessee), or receive and normally use for personal, household, or family purposes." Price, 110 A.3d at 574 (emphasis added) (quotation marks omitted).

McDowell alleges that CGI misrepresented the services it offered. Amended Complaint~

53-64. In a brochure advertising its services, CGI stated that it provides "technology management" services that provide: "secure data center operations;" "around-the-clock monitoring of systems, real-time reporting and immediate action on suspicious activity from CGI's security operations centers;" and "[e]xpert threat anticipation and defense of critical information and infrastructure." Amended Complaint~ 58. McDowell argues that these statements misrepresented the security of the services provided by CGI to the Passport Agency, as evidenced by the fact that CGI employees were able to steal Personal Information contained in passport applications. Opp'n at 9.

3 For example, in addition to consumers, the CPPA authorizes: nonprofit organizations to bring suit on behalf of its member or the general public, D.C. Code § 28-3905(k)(l)(C); and public interest organizations to bring suit on behalf a consumer or class of consumers, Id. § 28- 3905(k)( 1)(D). McDowell does not allege that she is authorized to sue under any of these other provisions of the CPPA.

7

The problem with McDowell's argument is that the services she alleges that CGI misrepresented are not consumer services, but business services. The technology management services CGI provides to the Passport Agency are typical of the back-office services that one company provides to another. They are decidedly not for personal, household, or family purposes, and therefore do not fall within the ambit of the CPPA. See Indep. Commun. Network, Inc. v. MCI Telecomm. Corp., 657 F. Supp. 785, 788 (D.D.C. 1987) (transactions between two merchants that are on the "supply side" of the consumer-merchant do not fall within ambit ofCPPA); Adam A. Weschler & Son, Inc. v. Klank, 561 A.2d 1003, 1005 (D.C. 1989) ("Transactions along the distribution chain that do not involve the ultimate retail customer are not consumer transactions that the Act seeks to reach." (emphasis added)). And even if these were consumer services, McDowell is not the one who purchased them-the Passport Agency did-and so it cannot be said that she was the consumer.

In response, McDowell argues that the passport she applied for is a consumer good and therefore that she is a consumer for purposes of the CPPA. Opp'n at 8. That argument cannot be squared with the definition of a "good" as used in the CPPA, which defines "goods and services" as "any and all parts of the economic output of society, at any stage or related or necessary point in the economic process, and includes consumer credit, franchises, business opportunities, real estate transactions, and consumer services of all types." D.C. Code § 28-390l(a)(7) (emphasis added). Simply put, a passport is not part of the economic output of society. See Urtetiqui v. D'Arcy, 34 U.S. 692, 699 (1835) (a passport "is a document, which, from its nature and object, is addressed to foreign powers; purporting only to be a request, that the bearer of it may pass safely and freely; and is to be considered rather in the character of a political document, by which the

8

bearer is recognized, in foreign countries, as an American citizen; and which, by usage and the law of nations, is received as evidence of the fact." (emphasis added)).

As McDowell is not a consumer within the meaning of the CPPA, she cannot state a claim for which relief can be granted, and her CPP A claim must be dismissed.

B. Negligence McDowell also alleges that CGI negligently handled her Personal Information by failing to take reasonable steps to prevent the theft of Personal Information by CGI employees. Amended Complaint iii! 66-71. Defendants argue that this claim should be dismissed because McDowell has alleged only that she has suffered economic injuries, which cannot, in and of themselves, support a claim of negligence. MTD at 23-26.

"In order to maintain a legally sufficient negligence claim, a plaintiff must demonstrate:

(1) that the defendant owed a duty to the plaintiff, (2) breach of that duty, and (3) injury to the plaintiff that was proximately caused by the breach." Aguilar v. RP MRP Washington Harbour, LLC, 98 A.3d 979, 982 (D.C. 2014) (internal quotations deleted). However, in Aguilar, the District of Columbia Court of Appeals adopted the "economic loss" doctrine, which "bars recovery of purely economic losses in negligence" actions. Id. at 985-86.

Under a limited exception to the economic loss doctrine, plaintiff may recover solely for economic injuries if she can demonstrate she had a "special relationship" with the defendant. Id. at 984-86, nn. 3 & 4; Whitt v. Am. Prop. Constr., P.C., No. 15-CV-1199, 2017 WL 1288572, at *6 (D.C. Apr. 6, 2017). Where such a "special relationship" exists, the defendant owes an independent duty of care to the plaintiff and it is proper to hold the defendant liable for a breach of that duty. Id. Absent such a special relationship, there is no duty and, consequently, no claim for negligence. Id.; see also Jefferson v. Collins, 210 F. Supp. 3d 75, 85-86 (D.D.C. 2016).

9

Whether or not such a special relationship exists "is entirely a question of law that must be determined only by the court." Whitt, 2017 WL 1288572 at *7 (quotation marks omitted).

In determining whether a special relationship exists, the Court asks whether "defendants had an 'obligation ... to care for the [plaintiffs] economic well-being' or an 'obligation' that 'implicated [her] economic expectancies."' Whitt, 2017 WL 1288572 at *6 (quoting Aguilar, 98 A.3d at 985). Citing approvingly to the decisions of other jurisdictions, the District of Columbia Court of Appeals has suggested that an "intimate nexus" or "close nexus" "between the parties" is required to establish the existence of a special relationship and that a plaintiff may demonstrate the existence of such a nexus through "contractual privity or its equivalent." Aguilar, 98 A.3d at 985 n. 3 (internal citations and quotation marks omitted). A special relationship is unlikely to exist where "variables beyond [defendant's] negligence could prove determinative of the likelihood of serious economic harm." Aguilar, 98 A.3d at 985 n. 4.

For example, in Whitt, the court held that a construction company had a special relationship with the plaintiff-business because: (1) its construction permit contained express terms "specifically protecting [the business] from the effects" of the construction project; and (2) the long-term, extensive nature of the construction project meant the harm was not "isolated and unexpected." 2017 WL 1288572 at *7. In Whitt, the defendant construction company participated in an extensive construction project directly outside of plaintiffs business entrance over a multi- year period. Id. at *6. An express provision of the construction permit for the project stated that the project would not block access to the plaintiffs business. Id. Despite this provision, the defendant repeatedly blocked the entrance or interfered with entry to plaintiffs business over the

10

course of the multi-year project. Id. at *1. Plaintiff repeatedly complained, to no avail, and was ultimately forced to close her business due to a loss of customers. Id. at *2.

Based on the terms of the permit and the foreseeability that the project might impact the plaintiffs business, the court concluded that the "[defendant] undertook obligations that would implicate [the plaintiffs] economic expectancies," and therefore that a special relationship existed. Id. at *6. As the construction permit expressly protected access to plaintiffs entrance, the defendant knew that its project could economically impact the plaintiff. Id. And by committing to follow the terms of the permit, the defendant voluntarily took that obligation upon itself, thereby creating a special relationship with, and a duty to, the plaintiff. Id.

Here, McDowell has not plead facts that can establish the existence of a special relationship between her and CGI. For example, she does not argue that she was in contractual privity, or its equivalent, with CGI. Nor does she allege that the contract itself contained language that created the special relationship. Instead, she argues that "CGI owed a duty of care to Plaintiffs because they were foreseeable and probable victims of any inadequate data security practices." Amended Complaint ~ 69. But both Aguilar and Whitt make clear that foreseeability alone is insufficient to establish a special relationship. See e.g. Aguilar, LLC, 98 A.3d at 984 ("we again decline to apply the foreseeability test ... in negligence cases involving purely economic losses.").

Belatedly, McDowell argues that the existence of a special relationship could be shown by '

inspecting the contract-which neither party submitted to the Court in full-and therefore that she should be allowed to proceed to discovery. See Opp'n at 18. But it is clear from the Amended Complaint that McDowell believes this duty arises not from the terms of the contract, but because CGI is "actively engaged in the business of collecting, storing, securely transferring, and

11

maintaining [sensitive personal information]." Id. if 66. The Court will not consider an argument omitted from the Complaint and raised for the first time in a dispositive motion. 4 As McDowell has failed to allege any facts that plausibly establish the existence of a special relationship, she cannot state a claim for negligence and this count must be dismissed.

C. Contract Claims McDowell's Amended Complaint alleges that CGI breached its contract with the State Department by failing to secure her Personal Information. Amended Complaint iii! 73-77. She further alleges that she is entitled to sue to remedy this breach because: (1) she is a party to the contract with CGI; or (2) in the alternative, she is an intended beneficiary of the contract with CGI.

1. Choice of Law

As an initial matter, it appears that there is some uncertainty as to whether federal common law or the common law of the District of Columbia is applicable to McDowell's contract claims. Ordinarily, federal common law governs the interpretation of contracts to which the United States is a party. See e.g. Miree v. DeKalb County, Ga., 433 U.S. 25, 28 (1977). However, even where a lawsuit involves a federal contract, if it "is purely between private parties and does not touch rights and duties of the United States," state, rather than federal, law governs. Boyle v. United Techs. Corp., 487 U.S. 500, 506 (1988); see also Miree, 433 U.S. at 29. It is not necessary to resolve this question, because federal common law and the common law of the District of

4 The Court may disregard a claim raised for the first time in a memorandum of law. Tunica- Biloxi Tribe of La. v. U.S., 577 F. Supp. 2d 382, 411 (D.D.C. 2008). If the factual basis for a new claim is substantially similar to a claim already alleged in a plaintiffs complaint and the court dismisses the newly-raised claim, the court must afford the plaintiff leave to amend her complaint to include it. See id.; Wiley v. Glassman, 511F.3d151, 159 (D.C. Cir. 2007)

12

Columbia are so similar as to the issues presented in this case that the Court would reach the same conclusion regardless of which law applies.

2. There was no contract between CGI and McDowell McDowell alleges that she entered into a contract with CGI when she submitted her passport application. Amended Complaint i! 74-75. CGI argues that Plaintiff fails to allege that any communication between McDowell and CGI took place, and therefore, there could have been no meeting of the minds, which is necessary for contract formation. MTD at 28-29.

To state a claim for breach of an express or implied contract, Plaintiff must allege: "(1) a valid contract between the parties; (2) an obligation or duty arising out of the contract; (3) a breach of that duty; and (4) damages caused by breach." Brown v. Sessoms, 774 F.3d 1016, 1024 (D.C. Cir. 2014 ). The party asserting the existence of an enforceable contract bears the burden of proving that there has been a "meeting of the minds," or mutual assent, as to all material terms. Ekedahl v. COREStaff, Inc., 183 F.3d 855, 858 (D.C. Cir. 1999); U.S. ex rel. Morsell v. Symantec Corp., 130 F. Supp. 3d 106, 131(D.D.C.2015) ("The party alleging a contract must show a mutual intent to contract"). Without a "meeting of the minds" as to all material terms, there can be no enforceable contract. Bailey v. Fed. Nat'l Mortg. Ass'n, 209 F.3d 740, 746 (D.C. Cir. 2000).

Here, there is no valid argument that McDowell and CGI ever formed a valid contract.

While there was a meeting of the minds between CGI and the State Department, no such meeting of the minds took place between McDowell and CGI. McDowell's Amended Complaint contains no allegation of any interaction from which to infer a meeting of the minds between Plaintiff and CGI Federal. Indeed, in her Opposition, McDowell seems to abandon the argument that any contract was formed between her and CGI, arguing only that she was a third party beneficiary of the contract between the State Department and CGI. See Opp'n generally (failing to respond to

13

CGI's arguments regarding contract formation); Reply at 15 (similarly noting that "Plaintiff attempts to defend Count 3 solely on a third-party beneficiary theory").

Consequently, Plaintiff has failed to state a claim that she entered into a contract with CGI, which CGI then breached by failing to secure her Personal Information.

3. McDowell has stated a claim as a third-party beneficiary In the alternative, McDowell alleges that she is an intended third-party beneficiary of the contract between the State Department and CGI, and that she is entitled to sue for its breach. Amended Compli:iint ~ 76. CGI argues that she has failed to allege facts showing that she was an intended beneficiary, and therefore cannot sue for breach of the contract. MTD at 31-32.

Intended third-party beneficiaries to a contract may sue to enforce the terms of the contract or obtain a remedy for a breach. Moore v. Gaither, 767 A.2d 278, 287 (D.C. 2001); GECCMC 2005-Cl Plummer St. Off. Ltd. Partn. v. JPMorgan Chase Bank, Nat. Ass'n, 671 F.3d 1027, 1033 (9th Cir. 2012) (internal citations and quotation marks omitted). However, in the context of contracts with the government, there is a presumption that members of the public are not intended beneficiaries, but merely incidental beneficiaries of the contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033. Such incidental beneficiaries have no right to sue for breach of contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033.

In order to overcome this presumption, a third-party plaintiff suing for breach of contract must show that the contracting parties "clearly intended" that the contract would benefit the plaintiff, or an identifiable class to which the plaintiff belongs. GECCMC, 671 F.3d at 1033; Moore, 767 A.2d at 287. Such intent may exist where the plaintiff would be reasonable in relying on the promise as manifesting an intention to confer a right on him or her. See Restatement (Second) of Contracts§ 302(1)(b) cmt. d (1981); see e.g. Klamath Water Users Protective Ass'n

14

"·

v. Patterson, 204 F.3d 1206, 1211 (9th Cir. 1999). "This 'clear intent' hurdle is a high one."

GECCMC, 671 F.3d at 1033.

McDowell has plead sufficient facts to plausibly state a claim that she is an intended beneficiary of the contract between CGI and the Department of State. Her Amended Complaint states "[t]he U.S. and CGI agreed to properly receive, handle, store, and otherwise utilize the Personal Information of Plaintiffs. Upon information and belief, it was also a term of the contract that CGI would act reasonably and employ reasonable safeguards at all times with respect to handling the Personal Information of Plaintiffs, including requiring a background security investigation for all CGI employees with authorized access to the Personal Information."

Amended Complaint ~ 76 (emphasis added). In other words, Plaintiff alleges that the contract contains terms that expressly require CGI: (1) to protect the Personal Information it receives; and (2) to do so for the benefit of an identifiable class of individuals, passport applicants, to which she belongs.

If the contract-which, as already noted, is not before the Court in its entirety-bears out that allegation, it is at least plausible that she can establish that she is an intended beneficiary.

Depending on the language of the alleged contract provision, as well as the contract as a whole, it is plausible that an objective passport applicant would be reasonable in relying on the promise as manifesting an intention to confer a right on him or her to have their Personal Information safeguarded by CGI.

Whether she can do so will depend on the specific language contained in the contract, but that is a merits question that should not be resolved in deciding CGI's Motion to Dismiss when the contract is not before the Court. See SB Charles Alan Wright & Arthur R. Miller, Federal

15

Practice & Procedure§ 1357 (Supp. 2011) ("Wright & Miller") ("Whether the plaintiff ultimately can prevail on the merits is a matter properly determined on the basis of proof, which means on a summary judgment motion or at trial by the judge or a jury, and not merely on the face of the pleadings"). Given the "liberal pleading standard" embodied in the Federal Rules, see Jones v. Air Line Pilots Ass'n, Intern., 642 F.3d 1100, 1104 (D.C. Cir. 2011), McDowell should have the opportunity to do so.

CGI's counter-arguments are unpersuasive. First, CGI argues that the test for whether a plaintiff is an intended beneficiary "is not merely whether or not the parties intended to confer a benefit on third parties (or to give a right to 'performance' as Plaintiff alleges), but rather whether or not 'the parties intended the third party to be able to sue to protect that benefit."' MTD at 32 (quoting Doe v. District of Columbia, 796 F.3d 96, 109 (D.C. Cir. 2015) (emphasis added)). However, that holding was issued in the context of a case involving a consent decree-not an ordinary government contract-and is best read as limited to that context. See Doe, 796 F.3d 96 (involving a challenge to implementation of a consent decree, reached in a previous lawsuit, by individuals who were not parties to the consent decree).

The decision itself only discusses the ability of "[t]hird parties to a consent decree" to sue for breach of the consent decree and does not discuss third parties to other types of contracts. See Doe, 796 F.3d at 109. Additionally, CGI's reading of Doe cannot be squared with Moore or GECCMC-both cases that CGI itself cites in its Motion to Dismiss-which do not require a plaintiff to show that contracting parties intended the plaintiff to be able to sue to protect a benefit conferred by the contract in order to prove that she is an intended beneficiary. Finally, all of the cases cited by the Court of Appeals in Doe also involved consent decrees, not ordinary contracts.

16

Doe, 796 F.3d at 109, n.4 (citing: SEC v. Prudential Sec. Inc., 136 F.3d 153, 159 (D.C. Cir. 1998) (involving consent decree between securities seller and the SEC); Blue Chip Stamps v. Manor Drug Stores, 421 U.S. 723, 750 (1975) (involving anti-trust consent decree), Terrell v. District of Columbia, 703 F.Supp.2d 17, 21 (D.D.C. 2010) (involving IDEA consent decree), Beckett v. Air Line Pilots Ass'n, 995 F.2d 280 (D.C.Cir.1993) (involving consent decree between pilots' union and non-member pilots)). As Doe appears only to define the applicable standard for determining who is a third-party beneficiary to consent decrees, it does not control resolution of this case.

Second; CGI points to cases in other jurisdictions in which courts have held that victims of a data breach were not intended beneficiaries of contracts related to the handling of their data. MTD at 32 (relying on the cases collected in Willingham v. Global Payments, Inc., No. 1:12-CV- 01157-RWS, 2013 WL 440702, at *19-20 (N.D. Ga. Feb. 5, 2013)). But at least two of the three cases cited in Willingham were decided on motions for summary judgment after the contract had been introduced as evidence. See Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 167 (3d Cir. 2008) ("the district court converted Fifth Third's motion for reconsideration into a motion for summary judgment and ordered the parties to conduct discovery on the third-party beneficiary issues, i.e., whether Fifth Third's contractual obligation to Visa to comply with the Visa Operating Regulations was intended to benefit Issuers like Sovereign."); Banknorth, N.A. v. BJ's Wholesale Club, Inc., 442 F. Supp. 2d 206, 211 (M.D. Pa. 2006) (court granted motion for summary judgment because a provision in the contract "specifically providing that the contract was not for the benefit of, and not intended to be enforced by, any third party.").

That approach accords more closely to the liberal pleading standard established by the Federal Rules. It is particularly appropriate in third-party beneficiary cases, where the Plaintiff is

17

not a party to the contract, and therefore, is unlikely to be able to include express provisions of the contract in her Complaint to demonstrate that she is an intended beneficiary. Moreover, because the contract is likely to be incorporated into the plaintiffs complaint by reference, as it was in this case, the defendant-as a party to the contract-has it entirely within its power to submit the contract as an attachment or exhibit to the motion to dismiss without converting it into a motion for summary judgment. See Tellabs, 551 U.S. at 322. In doing so, the defendant likely can avoid even the limited discovery provided for in cases such as Sovereign Bank.

McDowell's Amended Complaint states a plausible claim that she is an intended beneficiary of the contract between CGI and the State Department, and therefore, the Court will not dismiss her breach of contract claim.

D. Bailment Finally, McDowell alleges that she and CGI entered into a bailment relationship that required CGI to safeguard her Personal Information when she submitted her passport application, which CGI then breached. Amended Complaint iii! 79-84. CGI counters that no bailment relationship was created because there was no agreement between McDowell and CGI. MTD at 37-40.

"A bailment relationship is said to arise where an owner, while retaining title, delivers personalty to another for some particular purpose upon an express or implied contract. The relationship includes a return of the goods to the owner or a subsequent disposition in accordance with his instructions." Kam-Almaz v. U.S., 682 F.3d 1364, 1368 (Fed. Cir. 2012). In the District of Columbia, "[a] bailment for hire relationship may be created even in the absence of an explicit agreement. All that is required is the existence of a mutual benefit." First Am. Bank, N.A. v.

18

District of Columbia, 583 A.2d 993, 996 (D.C. 1990). Thus, "[a] person becomes a bailee for hire when he takes property into his care and custody for a compensation. The nature and amount of the compensation are immaterial." First Am. Bank, 583 A.2d at 996.

McDowell has failed to allege facts that plausibly support the existence of a bailment relationship. As discussed above, there were no communications between McDowell and CGO, and therefore, they could not have formed an agreement necessary to create an express bailment. Similarly, CGI received no compensation from McDowell nor did it expect to receive additional compensation from the State Department for processing McDowell's passport application, and therefore, they could not have formed an implied bailment or quasi-bailment. See Snowder v. District of Columbia, 949 A.2d 590, 605 (D.C. 2008) (quasi-bailment is formed when bailee takes possession of property "in expectation of compensation"). To the extent any bailment relationship existed it was between McDowell and the State Department, and that is insufficient, in and of itself, to impose liability on CGI for the data breach. 8A Am. Jur. 2d Bailments § 126 (2017 Update) ("A bailee who employs agents or employees who use or otherwise deal with the bailed property is responsible for the conduct of such persons while they are acting within the scope of their employment.").

Accordingly, McDowell has failed to state facts that plausibly support the existence of any form of a bailment, and therefore cannot state a claim for breach of bailment. 5

E. Unjust Enrichment Finally, McDowell alleges that CGI was unjustly enriched because it received benefits under its contract with the State Department but failed to fulfill its contractual obligation to

5 As no bailment existed, it is unnecessary to address CGI's other arguments. MTD at 39-40.

19

safeguard Personal Information. Amended Complaint ifif 86-92. CGI argues that McDowell fails to allege that she conferred any benefit on CGI. MTD at 33-35.

Under D.C. law, "unjust enrichment occurs when: (1) the plaintiff conferred a benefit on the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the defendant's retention of the benefit is unjust." Pernice v. Bovim, Civil Action No. 15-541 (JEB), 2015 WL 5063378, at *6 (D.D.C. Aug. 26, 2015) (quoting Peart v. D.C. Hous. Auth., 972 A.2d 810, 813 (D.C. 2009)). "To recover on a theory of unjust enrichment ... the plaintiff must show that the defendant was unjustly enriched at his expense .... " Id. at *7 (quoting News World Commc'ns, Inc. v. Thompsen, 878 A.2d 1218, 1222 (D.C. 2005)).

McDowell fails to allege any facts that plausibly suggest that she conferred any benefit on CGI. Her Amended Complaint identifies two benefits that she argues she conferred on CGI. First, she claims that her passport-application fee was used to pay CGI for the costs of processing her passport application. Amended Complaint if 87; Opp'n at 20. But as CGI correctly points out, by law passport application fees must be paid directly to the Treasury. See 22 U.S.C. § 214(a). Therefore, those fees could not have been paid to CGI and they cannot constitute a benefit.

Second, she argues that by submitting passport applications, she and the other putative class members created additional demand for passport processing services, which is itself a benefit to CGI. Amended Complaint if 86. However, inchoate demand is not itself a benefit, because it lacks intrinsic value. To be sure, increased demand for a service may create additional value for the supplier, such as by raising the market price for the service or creating a market that did not previously exist. However, McDowell's Amended Complaint does not allege that the additional demand for passport processing services by the putative class members increased the value of the

20

contract between CGI and the Passport Agency or that the contract would not have been executed absent the increased demand. Thus, even under her theory that Plaintiffs' applications increased demand for passport processing services, McDowell has failed to allege any identifiable benefit that CGI received as a result.

Additionally, McDowell fails to allege that she "conferred" any of these putative benefits on CGI. Sabre Int'l Sec. v. Torres is instructive. 60 F. Supp. 3d 36 (D.D.C. 2014). In that case, Sabre sued Torres, as well as Torres' individual employees, arguing that Sabre's payments to Torres unjustly enriched the individual employees in the form of salaries and bonuses they received from Torres. Id. at 41-42. The Court found that nothing in the Complaint connected the benefit that the company improperly took from Sabre to the monies paid to the employees. Therefore, the Court dismissed Sabre's unjust enrichment claim, concluding that "Sabre has not plausibly alleged that it had any role in conferring these benefits on the [individual employees]." Id. at 42.

Just as in Sabre, McDowell has failed to allege any fact that plausibly suggests that she had any role in "conferring" anything of value on CGI, and therefore cannot state a claim for unjust enrichment.

IV. CONCLUSION For the foregoing reasons Plaintiffs Amended Complaint is dismissed with respect to all Counts, except Count 3, her third-party beneficiary breach of contract claim.

June 1, 2017 G'~~ -

GladysKeSef

United States District Judge