[J-20-2018]
IN THE SUPREME COURT OF PENNSYLVANIA
WESTERN DISTRICT
SAYLOR, C.J., BAER, TODD, DONOHUE, DOUGHERTY, WECHT, MUNDY, JJ.
BARBARA A. DITTMAN, GARY R. : No. 43 WAP 2017
DOUGLAS, ALICE PASTIRIK, JOANN :
DECOLATI, TINA SORRENTINO, : Appeal from the Order of the Superior
KRISTEN CUSHMAN AND SHANNON : Court entered January 12, 2017 at
MOLYNEAUX, INDIVIDUALLY AND ON : No. 971 WDA 2015, affirming the
BEHALF OF ALL OTHERS SIMILARLY : Order of the Court of Common Pleas
SITUATED, : of Allegheny County entered May 28,
: 2015 at No. GD14-003285.
Appellants :
: ARGUED: April 10, 2018
:
v. :
:
:
UPMC D/B/A THE UNIVERSITY OF :
PITTSBURGH MEDICAL CENTER, AND :
UPMC MCKEESPORT, :
:
Appellees :
OPINION
JUSTICE BAER DECIDED: NOVEMBER 21, 2018
We granted discretionary review in this matter to determine whether an employer
has a legal duty to use reasonable care to safeguard its employees’ sensitive personal
information that the employer stores on an internet-accessible computer system. We also
examine the scope of Pennsylvania’s economic loss doctrine, specifically whether it
permits recovery in negligence for purely pecuniary damages. For the reasons discussed
below, we hold that an employer has a legal duty to exercise reasonable care to safeguard
its employees’ sensitive personal information stored by the employer on an internet-
accessible computer system. We further hold that, under Pennsylvania’s economic loss
doctrine, recovery for purely pecuniary damages is permissible under a negligence theory
provided that the plaintiff can establish the defendant’s breach of a legal duty arising
under common law that is independent of any duty assumed pursuant to contract. As the
Superior Court came to the opposite conclusions, we now vacate its judgment.
Barbara A. Dittman, Gary R. Douglas, Alice Pastirik, Joann Decolati, Tina
Sorrentino, Kristen Cushman, and Shannon Molyneaux, individually and on behalf of all
others similarly situated (collectively, Employees), filed the operative class action
complaint in this matter against UPMC d/b/a the University of Pittsburgh Medical Center
and UPMC McKeesport (collectively, UPMC) on June 25, 2014. In the complaint,
Employees alleged that a data breach had occurred through which the personal and
financial information, including names, birth dates, social security numbers, addresses,
tax forms, and bank account information of all 62,000 UPMC employees and former
employees was accessed and stolen from UPMC’s computer systems. Second Amended
Class Action Complaint, 6/25/2014, at ¶¶ 21-22, 27, 53. Employees further alleged that
the stolen data, which consisted of information UPMC required Employees to provide as
a condition of their employment, was used to file fraudulent tax returns on behalf of the
victimized Employees, resulting in actual damages. Id. ¶¶ 21, 23, 35.
Based on the foregoing, Employees asserted a negligence claim and breach of
implied contract claim against UPMC.1 With respect to their negligence claim, Employees
1 Employees brought their claims on behalf of two separate but overlapping classes of
similarly situated persons: (1) current and former UPMC employees whose personal and
financial information was stolen and “used to file fraudulent tax returns or otherwise
misused in a manner which resulted in financial harm,” and (2) current and former UPMC
employees whose personal and financial information was stolen and “who are at an
increased and imminent risk of becoming victims of identity theft crimes, fraud and abuse
as a result of the [d]ata [b]reach.” Second Amended Class Action Complaint, 6/25/2014,
at ¶ 39.
[J-20-2018] - 2
alleged that UPMC had a duty to exercise reasonable care to protect their “personal and
financial information within its possession or control from being compromised, lost, stolen,
misused, and/or disclosed to unauthorized parties.” Id. at ¶ 53. Employees further
alleged that UPMC undertook a duty of care to ensure the security of their information in
light of the special relationship between Employees and UPMC, whereby UPMC required
Employees to provide the information as a condition of their employment. Id. at ¶ 56.
Employees averred that this “duty included, among other things, designing, maintaining,
and testing its security systems to ensure” that Employees’ information was adequately
protected, and implementing “processes that would detect a breach of its security
systems in a timely manner.” Id. at ¶¶ 54-55.
Additionally, Employees claimed that UPMC breached its duty to use reasonable
care “by failing to adopt, implement, and maintain adequate security measures to
safeguard [Employees’] … information, failing to adequately monitor the security of its
network, allowing unauthorized access to [Employees’] … information, and failing to
recognize in a timely manner that [Employees’] … information had been compromised.”
Id. at ¶ 57. Employees further averred that UPMC “violated administrative guidelines”
and “failed to meet current data security industry standards,” specifically by failing to
encrypt data properly, “establish adequate firewalls to handle a server intrusion
contingency,” and “implement adequate authentication protocol to protect the confidential
information contained in its computer network.” Id. at ¶¶ 33-34.
Employees also claimed that UPMC’s breach of its duties was the direct and
proximate cause of the harm to Employees. Id. at ¶¶ 59-60. Finally, Employees alleged
that, as a result of UPMC’s negligence, Employees “incurred damages relating to
fraudulently filed tax returns” and are “at an increased and imminent risk of becoming
[J-20-2018] - 3
victims of identity theft crimes, fraud and abuse.” Id. at ¶¶ 61-62. Based on the foregoing,
Employees sought monetary damages, among other forms of relief. Id. at ¶ 70.
On July 16, 2014, UPMC filed preliminary objections to Employees’ complaint
arguing that, inter alia, their negligence claim failed as a matter of law. Specifically, UPMC
argued that no cause of action exists for negligence because Employees did not allege
any physical injury or property damage and, under the economic loss doctrine, “no cause
of action exists for negligence that results solely in economic damages unaccompanied
by physical injury or property damage.” UPMC’s Preliminary Objections to Employees’
Second Amended Class Action Complaint, 7/16/2014, at ¶¶ 15-17 (quoting Excavation
Technologies, Inc. v. Columbia Gas Co. of Pa., 985 A.2d 840, 841 n.3 (Pa. 2009)).
Employees responded in opposition, and UPMC filed a reply to Employees’ response.
Thereafter, on October 22, 2014, the parties appeared before the trial court for oral
argument on UPMC’s preliminary objections. Following argument, at the court’s direction,
both parties filed supplemental briefs addressing whether UPMC owed a duty of care to
Employees under the five-factor test set forth in Althaus ex rel. Althaus v. Cohen, 756
A.2d 1166 (Pa. 2000).2
On May 28, 2015, the court sustained UPMC’s preliminary objections and
dismissed Employees’ negligence claim.3 Relying upon the general description of the
2 In Althaus, this Court observed:
The determination of whether a duty exists in a particular case involves the
weighing of several discrete factors which include: (1) the relationship
between the parties; (2) the social utility of the actor’s conduct; (3) the
nature of the risk imposed and foreseeability of the harm incurred; (4) the
consequences of imposing a duty upon the actor; and (5) the overall public
interest in the proposed solution.
Althaus, 756 A.2d at 1169.
3The court also dismissed Employees’ breach of implied contract claim on preliminary
objections. That claim is not at issue in this appeal.
[J-20-2018] - 4
economic loss doctrine quoted from Excavation Technologies above, the trial court
observed that, while Employees claimed that UPMC owed them a duty of care, the only
losses Employees sustained were economic in nature. Trial Ct. Op., 5/28/2015, at 4. The
trial court then briefly examined this Court’s decision in Bilt-Rite Contractors, Inc. v. The
Architectural Studio, 866 A.2d 270 (Pa. 2005), which allowed a negligence action based
upon economic loss alone, viewing it as merely creating an exception to the economic
loss doctrine for losses incurred as a result of a plaintiff’s reliance on advice given by
professionals for pecuniary gain.4 Id. at 4-5. The trial court concluded that, because this
“case does not involve defendants in the business of supplying information for economic
gain,” the exception did not apply. Id.
The trial court further opined that the Althaus factors and duty of care “should not
be considered where the plaintiff seeks to recover only economic losses,” as “the
Pennsylvania appellate courts have already balanced the competing interests through
adoption of the economic loss doctrine.” Id. at 5. This determination notwithstanding, the
trial court went on to analyze the Althaus factors and conclude that courts should not
impose “a new affirmative duty of care that would allow data breach actions to recover
damages recognized in common law negligence actions.” Id. The trial court found the
controlling factors of the Althaus test to be (1) the consequences of imposing a duty upon
the actor, and (2) the overall public interest in the proposed solution. In this regard, the
trial court observed that data breaches are widespread and frequent. The trial court
4 As later discussed in detail, Bilt-Rite involved a contractor’s claim for negligent
misrepresentation under Section 552 of the Restatement (Second) of Torts, infra at pages
23-24 n.17, against an architectural firm that had provided plans to a school district for
use in soliciting bids for a construction project. Bilt-Rite, 866 A.2d at 272-73. The
contractor alleged that, due to misrepresentations in the plans, which it had ultimately
incorporated into its construction contract with the school district upon winning the bid for
the project, it incurred substantial extra costs in performing the work. Id. This Court
concluded that the economic loss doctrine did not bar the contractor’s claim. Id. at 288.
[J-20-2018] - 5
further explained that, under Employees’ proposed solution of creating a private
negligence cause of action to recover actual damages resulting from data breaches,
“hundreds of thousands of lawsuits” could result, which would overwhelm the judicial
system and require entities to expend substantial resources in defending against those
actions. Id. at 6. Additionally, the trial court reasoned that there are no generally accepted
reasonable care standards for evaluating one’s conduct in protecting data, and that use
of expert testimony and jury findings is not a viable method to develop those standards in
data breach litigation. Id.
The trial court opined that it could not say with reasonable certainty that the best
interests of society would be served through the recognition of a new affirmative duty
under these circumstances, noting that the financial impact of doing so could put entities
out of business. Id. at 7. The trial court further explained that entities storing confidential
information already have an incentive to protect that information because any breach will
affect their operations, that an improved system would not necessarily prevent a breach,
and that the entities were also victims of the criminal activity involved. Id. at 7-8. Finally,
the trial court observed that the Legislature is aware of and has considered the issues
that Employees sought the court to consider herein as evidenced by the Breach of
Personal Information Notification Act (Data Breach Act), 73 P.S. §§ 2301-2329.
Specifically, the court explained that, under the Data Breach Act, the Legislature has
imposed a duty on entities to provide notice of a data breach only, 73 P.S. § 2303, and
given the Office of Attorney General the exclusive authority to bring an action for violation
of the notification requirement, id. at § 2308. Trial Ct. Op., 5/28/2015, at 8-10. The court
[J-20-2018] - 6
thus reasoned that, as public policy was a matter for the Legislature, it was not for the
courts to alter the Legislature’s direction.5 Id. at 10.
Employees appealed to the Superior Court. Relevant to the issues before this
Court, Employees argued that the trial court erred in finding that UPMC did not owe a
duty of reasonable care in its collection and storage of Employees’ information, and that
the economic loss doctrine barred their claim.
In a split opinion, a three-judge panel of the Superior Court affirmed the order of
the trial court sustaining UPMC’s preliminary objections and dismissing Employees’
claims. Dittman v. UPMC, 154 A.3d 318 (Pa. Super. 2017). As to the issue of duty, the
Superior Court applied the Althaus factors, concluding first that the relationship between
the parties weighed in favor of imposing a duty on UPMC because the employer-
employee relationship “traditionally has given rise to duties on the employer.” Id. at 323.
The court also reasoned that “[t]here is an obvious social utility” in electronically storing
employees’ personal information “to promote efficiency,” which outweighed the nature of
the risk imposed and foreseeability of the harm incurred in so doing. Id. at 323-24. While
the court noted that the general risk of storing information electronically increases as data
breaches become more common and that data breaches and the ensuing harm were
generally foreseeable, “more and more information is stored electronically” in the modern
5 In this regard, the trial court found a decision from the Appellate Court of Illinois, Cooney
v. Chicago Public Schools, 943 N.E.2d 23 (Ill. App. 2010), to be persuasive. There, the
personal information of more than 1,700 former Chicago Public School employees had
been disclosed via a mailing that was sent to each of the former employees. The court
rejected the argument that it “should recognize a ‘new common law duty’ to safeguard
information” that had been disclosed. Id. at 28. The court explained that the plaintiffs
failed to cite any Illinois case law to support their argument and that the legislature had
already addressed the issue via statute, which imposed a duty to provide notice of the
disclosure only. The court did not believe that creating “a new legal duty beyond
legislative requirements already in place is part of [its] role on appellate review.” Id. at
29.
[J-20-2018] - 7
era and “employees and consumers alike derive substantial benefits from” the resulting
efficiencies. Id. at 323. The court further observed that “a third party committing a crime
is a superseding cause” against which “a defendant does not have a duty to guard …
unless he realized, or should have realized, the likelihood of such a situation.” 6 Id.
The Superior Court further agreed with the trial court’s analysis of the fourth and
fifth Althaus factors, the consequences of imposing a duty upon the actor and the overall
public interest in the proposed solution, respectively. As to the fourth factor, the Superior
Court added to the trial court’s reasoning that no judicially created duty of care is needed
to incentivize companies to protect their employees’ confidential information because
there are “statutes and safeguards in place to prevent employers from disclosing
confidential information.” Id. at 324 (citing, inter alia, the Data Breach Act). The Superior
Court also found it “unnecessary to require employers to incur potentially significant costs
to increase security measures when there was no true way to prevent data breaches
altogether.” Id. The court reasoned that “[e]mployers strive to run their businesses
efficiently and they have incentive to protect employee information and prevent these
types of occurrences.” Id.
Thus, upon consideration of all of the Althaus factors, the Superior Court
concluded that the trial court properly found that UPMC owed no duty to Employees under
Pennsylvania law. Nevertheless, the Superior Court continued to examine whether the
economic loss doctrine applied to bar Employees’ negligence claim. Reiterating the
generalized statement of the doctrine (i.e., that “no cause of action exists for negligence
that results solely in economic damages unaccompanied by physical injury or property
damage”), the Superior Court opined that the trial court was correct in noting that the Bilt-
6In focusing on risk and foreseeability in a general sense, the Superior Court noted that
Employees failed to allege that UPMC encountered a specific threat of a data breach.
Dittman, 154 A.3d at 323-24 & n.4.
[J-20-2018] - 8
Rite decision was meant to provide a narrow exception to the doctrine only when the
losses result from the reliance on the advice of professionals. Id. at 325. The Superior
Court further agreed with the trial court that the narrow exception did not apply to this
case.7 Id.
Judge Stabile filed a concurring statement that Judge Olson, the author of the
majority opinion, joined. Judge Stabile reasoned that the court’s decision declining to find
a legal duty should be limited to the facts as alleged in this case. Id. at 326 (Stabile, J.,
concurring). He further reasoned that the balance of the Althaus factors may change in
favor of employees at some point in the future “with the evolution and increased use of”
electronic storage of information. Id. at 327 (Stabile, J., concurring).
Judge Musmanno wrote a dissenting statement concluding that, on balance, the
Althaus factors weighed in favor of imposing a duty of reasonable care on UPMC.
Specifically, Judge Musmanno challenged the majority’s conclusion that the social utility
of electronically storing employee information outweighed the risk and foreseeability of
the harm, believing it to be “untenable, given the ubiquitous nature of electronic data
storage, the risk to UPMC’s employees posed by the failure to reasonably protect such
information, and the foreseeability of a computer breach and subsequent identify theft.”
Id. at 328 (Musmanno, J., dissenting). Moreover, Judge Musmanno posited that
Employees’ “assertions, if proven, would establish that UPMC knew or should have
realized that inadequate electronic data protections would create a likelihood that its
employees’ personal information would be compromised, and that a third party would
avail itself of the opportunity to steal this sensitive data.” Id. (Musmanno, J., dissenting).
7 This agreement notwithstanding, the Superior Court relied upon Bilt-Rite to posit further
that, for Employees to recover for economic loss alone, they must show that UPMC
breached a duty imposed by law, but that no such duty existed here. Dittman, 154 A.3d
at 325. The court explained that, “[w]ithout a duty imposed by law or a legally recognized
special relationship, the economic loss doctrine bars [Employees’] claims.” Id.
[J-20-2018] - 9
Further, Judge Musmanno reasoned that, “[u]nder the circumstances alleged, the criminal
acts of third parties do not relieve UPMC of its duty of care in the protection of
[Employees’] sensitive personal data.” Id. (Musmanno, J., dissenting).
Judge Musmanno also disagreed with the majority’s conclusion that the imposition
of a duty of care is unnecessary to incentivize companies to protect their confidential
information. Judge Musmanno noted that, while the majority declined to impose a duty
due to the significant costs imposed upon employers and the inability to prevent every
data breach, the Althaus test does not require that the proposed duty prevent all harm.8
Id. (Musmanno, J., dissenting). Judge Musmanno continued that, when considered
against the cost to employees resulting from the data breach, the factor relating to the
consequences of imposing a duty weighed in favor of imposing a duty. Id. (Musmanno,
J., dissenting). Finally, Judge Musmanno disagreed with the majority’s conclusion that
the public interest in imposing a duty weighed in favor of UPMC, opining that, “[w]hile
judicial resources may be expended during litigation of data breaches, the public has a
greater interest in protecting the personal and sensitive data collected and electronically
stored by employers.” Id. at 328-29 (Musmanno, J., dissenting).
We granted allowance of appeal to address the following issues, as stated by
Employees:
a. Does an employer have a legal duty to use reasonable care to safeguard
sensitive personal information of its employees when the employer chooses
to store such information on an internet accessible computer system?
b. Does the economic loss doctrine permit recovery for purely pecuniary
damages which result from the breach of an independent legal duty arising
under common law, as opposed to the breach of a contractual duty?
8 Judge Musmanno also criticized the majority’s observation that there were statutes and
safeguards in place to prevent employers from disclosing confidential information,
presumably because this case did not involve the employer itself disclosing the
information. Dittman, 154 A.3d at 328 (Musmanno, J., dissenting).
[J-20-2018] - 10
Dittman v. UPMC, 170 A.3d 1042 (Pa. 2017) (per curiam).
This matter presents pure questions of law, over which our standard of review is
de novo, and our scope of review is plenary. Skotnicki v. Insurance Department, 175
A.3d 239, 247 (Pa. 2017). Further, as Employees’ negligence claim was dismissed on
preliminary objections in the nature of a demurrer, we must determine “whether, on the
facts averred, the law says with certainty that no recovery is possible.” Bilt-Rite
Contractors, 866 A.2d at 274. Any existing doubt as to whether a demurrer should be
sustained should be resolved in favor of overruling it. Id. Additionally, we accept as true
all material facts as set forth in the complaint and any inferences reasonably deducible
therefrom in conducting our review. Id. at 272.
A. Duty
Employees contend that, in collecting and storing the sensitive personal and
financial information it required Employees to provide, UPMC owed a duty to Employees
to exercise reasonable care under the circumstances, which includes using reasonable
measures to protect the information from the foreseeable risk of a data breach. In support
of their position, Employees first argue that resort to the Althaus factors for purposes of
determining the existence of a duty in this case is unnecessary. Specifically, Employees
argue that the Althaus test applies only when determining whether to impose a new,
affirmative duty not yet existing under common law, and not when a longstanding
preexisting duty arises in a novel factual scenario. Employees’ Brief at 14-15 (quoting
Alderwoods (Pennsylvania), Inc. v. Duquesne Light Co., 106 A.3d 27, 40 (Pa. 2014)
(explaining that, inter alia, the Althaus factors are “more relevant to the creation of new
duties than to the vindication of existing ones”)). Employees contend that the trial court
and Superior Court erred in treating their claim as one seeking the creation of a new,
affirmative duty requiring application of the Althaus test, and in concluding that UPMC did
[J-20-2018] - 11
not owe a duty. As further explained below, Employees claim that they instead seek to
impose upon UPMC a duty of care long-established in Pennsylvania law under the novel
facts of this case.
In support of their assertion, Employees argue that, as a general rule, “anyone who
does an affirmative act is under a duty to others to exercise the care of a reasonable man
to protect them against an unreasonable risk of harm to them arising out of the act.”
Employees’ Brief at 17 (quoting Restatement (Second) of Torts § 302, cmt. a (1965)).
Employees claim that this is a broad expression of duty applicable to many forms of
activity, even in novel factual scenarios with no direct precedent such as this one.
Applying this broad expression of duty to the facts herein, Employees contend that UPMC
engaged in the affirmative act of collecting Employees’ sensitive personal data and
storing it on their internet-accessible computer systems. Employees maintain that, in so
doing, UPMC was under a duty to them to exercise reasonable care under the
circumstances, which includes taking reasonable measures to protect them from the
foreseeable risk that third parties would attempt to access and pilfer that information.
Thus, Employees claim that they are alleging misfeasance on behalf of UPMC in
collecting and storing Employees’ sensitive personal data.
Employees further contend that this broad duty is limited by the concept of
foreseeability.9 With respect to foreseeability, Employees argue that troves of electronic
data stored on internet-accessible computers held by large entities are obvious targets
for cyber criminals and that a reasonable entity in UPMC’s position should foresee that a
9 Employees also claim that common law duties can be limited in rare instances in light
of public policy concerns, but those concerns are best addressed through legislative
action. Employees’ Brief at 18 (citing, inter alia, Alderwoods, 106 A.3d at 39-40
(explaining that determinations as to immunity from common law tort liability are better
suited for the Legislature, which is “better positioned to make informed policymaking
judgments”).
[J-20-2018] - 12
failure to use basic security measures can lead to exposure of the data and serious
financial consequences for the victims. Employees thus claim that, in light of the
prevalence of electronic data storage in the employment context and the foreseeable risk
of breaches of such data, it is appropriate to require employers to use reasonable care
when handling and storing employee data in order to protect it from compromise.
Employees argue that there is no sound justification for exempting employers from a duty
to act with reasonable care when they collect and store employees’ sensitive personal
information.
Finally, Employees contend that the fact that the ultimate harm in this case resulted
from criminal activity does not eviscerate the duty UPMC owed to Employees to handle
its collection and storage of employee data with reasonable care. Employees
acknowledge that one generally does not owe a duty to others to protect them against
criminal conduct. Employees contend, however, that there are many exceptions to this
rule and that the duty to take reasonable anticipatory measures against foreseeable
criminal conduct in certain scenarios has deep roots in common law. Employees’ Brief
at 22-24 (relying upon Sections 302 and 302B of the Restatement (Second) of Torts and
Comment E thereto, discussed infra).
In response, UPMC challenges Employees’ assertion that it assumed a legal duty
to protect against a criminal data breach through commission of an affirmative act. UPMC
contends that it merely possessed employee information incident to a general
employment relationship, which cannot constitute an affirmative act that entails legal
liability for third-party criminal conduct. UPMC notes that it is not in the business of
providing data security, was not retained to provide data security, was not otherwise
tasked with providing data security, and never pursued such an undertaking.
[J-20-2018] - 13
Indeed, according to UPMC, Employees are not claiming any affirmative
misfeasance on UPMC’s part but, rather, nonfeasance in that UPMC failed to prevent the
harm incurred or some speculative future harm. In that regard, UPMC notes that there is
a “no-duty rule in rescue/protection scenarios where the defendant did not create the risk
resulting in harm to the plaintiff.” UPMC’s Brief at 45 (quoting Seebold v. Prison Health
Services, Inc., 57 A.3d 1232, 1246 (Pa. 2012)). UPMC contends that “[i]t is nonsensical
to suggest that [it] created the risk of harm from a criminal data breach[] simply by
possessing employee data” and its business neither increased the risk of criminal activity
nor posed a special danger to the public regarding unshielded data. Id. at 45, 50-51.
UPMC contends that third party criminality, not any affirmative conduct on UPMC’s part,
created the risk of harm and that it cannot be held liable for an external criminal hack
merely because of the general prevalence or conceivable risk of data breaches. UPMC
further argues that a third-party criminal act is a superseding cause of the resulting harm
and should not be deemed “foreseeable by a negligent actor merely because he or she
could have speculated that they might conceivably occur.” Id. at 51 (citing, inter alia, Ford
v. Jeffries, 379 A.2d 111, 115 (Pa. 1977), and Mahan v. Am-Gard, Inc., 841 A.2d 1052,
1061 (Pa. Super. 2003)).
UPMC thus argues that Employees “are proposing a radical reconstruction of duty”
where they seek to impose liability on UPMC for the criminal acts of unknown third parties.
Id. at 45. UPMC contends that the decision to impose a legal duty requires a policy
determination, made through analysis of the Althaus factors, regarding whether a plaintiff
is entitled to recover from a defendant for a particular harm on particular facts. UPMC
further claims that, as recognized by the courts below, policy considerations do not permit
Employees’ recovery in negligence in this case under both an Althaus analysis and the
economic loss doctrine, and numerous other jurisdictions have likewise declined to adopt
[J-20-2018] - 14
that duty. UPMC contends that, having failed below to establish an exception to the
economic loss doctrine or a legal duty under Althaus, Employees now seek to ignore the
requisite policy analysis and instead make the specious claim that UPMC owes them a
duty under general negligence principles. UPMC contends that no general rule of
negligence can subject them to liability for third-party criminal conduct and claims that to
subject all Pennsylvania companies that store employee data to liability for criminal data
breaches is untenable and against the lower courts’ policy determination pursuant to
Althaus that no such duty be imposed.10
Having considered the parties’ arguments, we agree with Employees that this case
is one involving application of an existing duty to a novel factual scenario, as opposed to
the imposition of a new, affirmative duty requiring analysis of the Althaus factors. As
Employees set forth in their brief, this Court observed in Alderwoods that the Althaus
factors are “more relevant to the creation of new duties than to the vindication of existing
ones.” Alderwoods, 106 A.3d at 40. This Court further explained that it is unnecessary
“to conduct a full-blown public policy assessment in every instance in which a
longstanding duty imposed on members of the public at large arises in a novel factual
scenario. Common-law duties stated in general terms are framed in such fashion for the
10 Prior to reaching our analysis, we note that both parties also provide argument in their
briefs as to whether a common law duty of care exists under the circumstances of this
case in light of the Legislature’s enactment of the Data Breach Act. Briefly, Employees
argue that, in imposing only a duty of notification of a data breach, the Data Breach Act
does not address, let alone preclude, the existence of a common law duty to act with
reasonable care in collecting and storing data for the purpose of preventing a breach in
the first place. In contrast, UPMC argues against the imposition of a common law duty
on the basis that, through enactment of the Data Breach Act, the Legislature has
conducted a comprehensive assessment of data breaches and determined that entities
that suffer a data breach have a duty only to provide notice of the disclosure of personal
information. Upon review of the act, we agree with Employees that, in requiring an entity
to provide notification of a data breach, the act has no bearing on whether an entity has
an initial duty under common law to exercise reasonable care to protect data prior to a
breach. Thus, we find any further discussion of the Data Breach Act to be unnecessary
with respect to the issue of duty before us.
[J-20-2018] - 15
very reason that they have broad-scale application.” Id. at 40-41; see also Scampone v.
Highland Park Care Center, LLC, 57 A.3d 582, 599 (Pa. 2012) (“Like any other cause of
action at common law, negligence evolves through either directly applicable decisional
law or by analogy, meaning that a defendant is not categorically exempt from liability
simply because appellate decisional law has not specifically addressed a theory of liability
in a particular context.”).
As for the common law duty at issue here, this Court has observed that “[i]n
scenarios involving an actor’s affirmative conduct, he is generally ‘under a duty to others
to exercise the care of a reasonable man to protect them against an unreasonable risk of
harm to them arising out of the act.” Seebold, 57 A.3d at 1246 (quoting Section 302 cmt.
a of the Restatement (Second) of Torts). The Seebold Court explained that “[t]his duty
appropriately undergirds the vast expanse of tort claims in which a defendant’s
affirmative, risk-causing conduct is in issue.” Id. Indeed, this Court noted that “many
judicial opinions on the subject of negligence do not specifically address the duty
element,” not because they “fail to see duty as an element of negligence, but because
they presume the existence of a duty where the defendant’s conduct created a risk.” Id.
at 1246 n.21 (quoting Cardi & Green, Duty Wars, 81 S. CAL. L. REV. 671, 702 (2008)).
Employees have alleged and, as the case is before us at the preliminary objection
stage, we currently must accept as true that, as a condition of employment, UPMC
required them to provide certain personal and financial information, which UPMC
collected and stored on its internet-accessible computer system without use of adequate
security measures, including proper encryption, adequate firewalls, and an adequate
authentication protocol. These factual assertions plainly constitute affirmative conduct on
the part of UPMC. Additionally, while UPMC is correct that, generally, “there is no duty
to protect or rescue someone who is at risk on account of circumstances the defendant
[J-20-2018] - 16
had no role in creating,” id. at 1246, Employees have sufficiently alleged that UPMC’s
affirmative conduct created the risk of a data breach. Thus, we agree with Employees
that, in collecting and storing Employees’ data on its computer systems, UPMC owed
Employees a duty to exercise reasonable care to protect them against an unreasonable
risk of harm arising out of that act.
Further, to the extent that UPMC argues that the presence of third-party criminality
in this case eliminates the duty it owes to Employees, we do not agree. As stated above,
UPMC relies on selected portions of Ford and Mahan in support of its position that it
cannot be liable for third-party criminal conduct that could “conceivably occur.” However,
as Ford more fully outlined:
The act of a third person in committing an intentional tort or crime is a
superseding cause of harm to another resulting therefrom, although the
actor’s negligent conduct created a situation which afforded an opportunity
to the third person to commit such a tort or crime, unless the actor at the
time of his negligent conduct realized or should have realized the likelihood
that such a situation might be created, and that a third person might avail
himself of the opportunity to commit such a tort or crime.
Ford, 379 A.2d at 115 (quoting Section 448 of the Restatement (Second) of Torts
(1965)).11 Further, while the Superior Court in Mahan observed that “the wrongful actions
11 See also Restatement (Second) of Torts Section 302 (“A negligent act or omission may
be one which involves an unreasonable risk of harm to another through … the foreseeable
action of the other [or] a third person….”); Section 302B (“An act or an omission may be
negligent if the actor realizes or should realize that it involves an unreasonable risk of
harm to another through the conduct of the other or a third person which is intended to
cause harm, even though such conduct is criminal.”), and Comment E thereto (providing
that situations exist “in which the actor, as a reasonable man, is required to anticipate and
guard against the intentional, or even criminal, misconduct of others” and that, generally,
these situations arise “where the actor is under a special responsibility toward the one
who suffers the harm, which includes the duty to protect him against such intentional
misconduct; or where the actor’s own affirmative act has created or exposed the other to
a recognizable high degree of risk of harm through such misconduct, which a reasonable
man would take into account”). Comment E further sets forth a non-exhaustive list of
these situations, including “[w]here the actor stands in such a relation to the other that he
is under a duty to protect him against such misconduct … [such as] employer and
[J-20-2018] - 17
of a third party are not deemed to be foreseeable by a negligent actor merely because he
or she could have speculated that they might conceivably occur,” the court, citing Jeffries,
acknowledged that liability could be found if the actor “realized or should have realized
the likelihood that such a situation might be created and that a third person might avail
himself of the opportunity to commit such a tort or crime.” Mahan, 841 A.2d at 1061.12
Again, Employees allege that UPMC, their employer, undertook the collection and
storage of their requested sensitive personal data without implementing adequate
security measures to protect against data breaches, including encrypting data properly,
establishing adequate firewalls, and implementing adequate authentication protocol. The
alleged conditions surrounding UPMC’s data collection and storage are such that a
cybercriminal might take advantage of the vulnerabilities in UPMC’s computer system and
steal Employees’ information; thus, the data breach was “within the scope of the risk
created by” UPMC. See Ford, 379 A.2d at 115 (explaining that the dilapidated condition
of the appellee’s property, which had caught fire and damaged the appellant’s
neighboring property, “was such that third persons might avail themselves of the
opportunity to commit a tort or crime” and that “such acts were within the scope of the risk
created by the appellee”). Therefore, the criminal acts of third parties in executing the
employee,” and “[w]here property of which the actor has possession or control affords a
peculiar temptation or opportunity for intentional interference likely to cause harm.”
Section 302B of the Restatement (Second) of Torts Cmt. e(B), (G).
12 In support of its position that it cannot be held liable for the criminal acts of third parties,
UPMC also relies upon Feld v. Merriam, 485 A.2d 742 (Pa. 1984), for the proposition that
“absent agreement, a landlord has no general duty to protect tenants against third-party
criminal conduct.” UPMC’s Brief at 51. Feld, however, did not involve the situation where
the landlord’s conduct created the risk of injury from the criminal acts of third parties.
Feld, 485 A.2d at 746 (explaining that “the risk of injury from the criminal acts of third
persons arises not from the conduct of the landlord but from the conduct of an
unpredictable independent agent,” and contrasting that circumstance from the risk of
injury from a physical defect in the property, where “the landlord has effectively
perpetuated the risk of injury by refusing to correct a known and verifiable defect”).
[J-20-2018] - 18
data breach do not alleviate UPMC of its duty to protect Employees’ personal and financial
information from that breach.
Based on the foregoing, we conclude that the lower courts erred in finding that
UPMC did not owe a duty to Employees to exercise reasonable care in collecting and
storing their personal and financial information on its computer systems. This conclusion
notwithstanding, Employees’ claim cannot proceed if we nonetheless hold that it is barred
by the economic loss doctrine. Thus, we turn to our analysis of that doctrine.
B. The Economic Loss Doctrine
The crux of the dispute before us is whether the economic loss doctrine as applied
in Pennsylvania precludes all negligence claims that seek to recover for purely economic
damages, save for specifically delineated and narrow exceptions, or whether such claims
are generally permitted provided that a plaintiff can establish a breach of a legal duty
independent of any contractual duties existing between the parties. As evidenced
throughout this opinion, much of the dispute in this regard centers on the proper
interpretation of our decisions in Bilt-Rite and Excavation Technologies, which form the
basis of the parties’ arguments and which we analyze in further detail below.
Beginning with the parties’ contentions, Employees argue that courts have
incorrectly read our decision in Bilt-Rite as merely permitting negligent misrepresentation
claims under Section 552 of the Restatement (Second) of Torts, see infra at pages 23-24
n.17, as a narrow exception to an otherwise broad economic loss doctrine precluding all
negligence claims for solely monetary harm. Employees claim that, under Bilt-Rite, the
economic loss doctrine does not bar negligence-based tort claims involving purely
financial harm, provided that the plaintiff establishes that the defendant owed a common
law duty arising independently from any contract between the parties. Employees argue
[J-20-2018] - 19
that the holding in Bilt-Rite did not rely or otherwise depend upon the particular legal duty
imposed or tort alleged in that case and therefore was not limited in that manner.
Employees contend that Bilt-Rite’s iteration of the rule as they believe it should
be interpreted is more coherent and precise than the general statement of the rule, “which
fails to explain or reconcile a plethora of obvious ‘exceptions.’” Employees’ Brief at 51.
Employees further argue that their interpretation of the doctrine, which focuses on the
source of the duty, is consistent with the definition accepted by many states and scholars,
and will reduce confusion and unjust deployment of the rule against legitimate tort claims
while serving the rule’s purpose of precluding those claims that seek to compensate
parties for losses resulting from a breach of contractual duties. Employees thus contend
that, here, we need only to reaffirm Bilt-Rite’s enunciation of the rule as stated by them
and hold that it does not bar their negligence claim.
UPMC counters that the lower courts correctly held that the economic loss doctrine
precludes Employees’ negligence claim for monetary damages.13 UPMC argues that the
economic loss doctrine is well-settled in Pennsylvania and broadly applies to bar
negligence claims that result “solely in economic damages unaccompanied by physical
injury or property damage.” UPMC’s Brief at 12, 14-15 (quoting Excavation Technologies,
Inc., 985 A.2d at 841 n.3). Relying upon Excavation Technologies, UPMC further
interprets Bilt-Rite’s holding as creating a narrow exception to the broad economic loss
doctrine for negligent misrepresentation claims under Section 552 of the Restatement
(Second) of Torts that involve design professionals supplying information to others for
13 The Pennsylvania Defense Institute, Chamber of Commerce of the United States of
America, and Pennsylvania Chamber of Business and Industry have filed an amici curiae
brief in support of UPMC, where they advance and expand upon the arguments set forth
by UPMC regarding the economic loss doctrine as discussed infra. In so doing, amici
add that a majority of jurisdictions apply the economic loss doctrine broadly to bar all
negligence claims that cause only economic loss and that the Bilt-Rite “exception” is also
widely followed.
[J-20-2018] - 20
pecuniary gain. UPMC claims that no Pennsylvania court has applied Employees’
interpretation of Bilt-Rite in an action to recover purely economic damages under a
common law negligence theory and argues that this Court already declined to expand
Bilt-Rite in the manner Employees suggest in Excavation Technologies.
UPMC also claims that Employees, focusing upon “misleading dicta” in Bilt-Rite,
argue for an improperly expansive interpretation of that case which would effectively
render the economic loss doctrine a nullity by exempting all common law negligence
claims from its application.14 Id. at 16-18. UPMC contends that the language Employees
rely upon from Bilt-Rite in support of their position “merely recognizes an uncontroversial
aspect of tort law”: that “financial damages may be recoverable under several specific
torts [that include] financial detriment … as an element of the tort itself.” Id. at 18. UPMC
argues that Employees’ failure to distinguish between common law negligence and
specific tort claims highlights the error in their argument.
UPMC argues that Employees’ “tortured construction” of the economic loss
doctrine “distills to the untenable proposition that our appellate courts have misconstrued
the rule since its inception” and that accepting Employees’ position would contravene the
doctrine’s purpose of preventing indeterminate liability. Id. at 12-13, 16 n.4. UPMC
further maintains that the Third Circuit has already considered and rejected Employees’
arguments regarding the contours of Pennsylvania’s economic loss doctrine and Bilt-
Rite’s holding, including in the context of computer information theft. Id. at 18-20 (citing,
inter alia, Sovereign Bank v. BJ’s Wholesale Club, Inc., 533 F.3d 162, 178 (3d Cir. 2008)
14 UPMC also argues, apparently in the alternative, that Employees are improperly
attempting to fit their cause of action within the narrow exception created by Bilt-Rite,
which does not apply to this case, as the lower courts concluded. In their reply brief,
Employees note that they are not attempting to fit this case into any alleged “Section 552
exception” and that they have never disputed that Bilt-Rite’s holding as it relates to
Section 552 is inapplicable to this case. Employees’ Reply Brief at 1-2.
[J-20-2018] - 21
(opining that this Court in Bilt-Rite “simply carved out a narrow exception [to the economic
loss doctrine] when losses result from the reliance on the advice of professionals”)).
Additionally, UPMC claims that a majority of jurisdictions confronting data breach litigation
have dismissed negligence claims in accord with the economic loss doctrine.15 16
As the parties’ arguments focus on this Court’s decisions in Bilt-Rite (2005) and
Excavation Technologies (2009), we begin with a summary of those cases. In Bilt-Rite,
East Penn School District (District) entered into a contract with The Architectural Studio
(TAS) for architectural services related to the design and construction of a new school.
These services included the preparation of plans, drawings, and specifications that would
be submitted to contractors for the purpose of preparing bids for the new school’s
15In their reply brief, Employees argue that, inter alia, UPMC misconstrues various cases
in support of its position, including Bilt-Rite and Excavation Technologies, and
misapprehends the economic loss doctrine as well as the purpose behind it.
16 We further note that, as we similarly commented with respect to the issue of duty in
footnote 10, supra at page 15, the parties provide argument regarding the impact of the
Legislature’s enactment of the Data Breach Act on application of the economic loss
doctrine in this case. UPMC claims that, because the Data Breach Act does not provide
a private cause of action for economic losses, but instead established an enforcement
action reserved exclusively for the Attorney General for violations of the notification
requirement, applying the economic loss doctrine to bar this case is consistent with the
actions of the Legislature in enacting the Data Breach Act. UPMC’s Brief at 21-24 (relying
upon Excavation Technologies, 985 A.2d at 842 (finding “it apparent our legislature did
not intend utility companies to be liable for economic harm caused by an inaccurate
response under the [One Call] Act, [see infra at page 26 n.20,] because it did not provide
a private cause of action for economic losses”)). In response, Employees distinguish
Excavation Technologies by noting that the duty in that case was statutorily imposed and,
thus, the Court properly looked to the One Call Act in analyzing whether an entity could
be liable for economic losses. Employees’ Reply Brief at 13-14. As we concluded with
respect to the issue of duty above, we likewise conclude that the Data Breach Act’s failure
to provide for a private cause of action for economic damages based upon a violation of
the statutory duty to provide notification has no impact on the issue of whether a plaintiff
can recover solely economic damages under a common law negligence theory for a
defendant’s initial failure to protect information from a data breach. Thus, no further
discussion of the Data Breach Act is necessary as it relates to application of the economic
loss doctrine under the circumstances of this case.
[J-20-2018] - 22
construction. The District solicited bids from contractors for the project, including TAS’s
plans, drawings, and specifications in the bid documents supplied to the contractors. The
District eventually awarded the contract to Bilt-Rite Contractors, Inc. (Bilt-Rite), and the
District and Bilt-Rite entered into a contract for the project. The contract specifically
referred to and incorporated by reference the plans, drawings, and specifications from
TAS.
As part of the project, TAS’s plans provided for the installation of certain systems
that TAS “expressly represented could be installed and constructed through the use of
normal and reasonable construction means and methods, using standard construction
design tables.” Bilt-Rite, 866 A.2d at 272. However, once Bilt-Rite began the work, it
discovered that construction of the systems required it to employ special construction
means, methods, and design tables, resulting in substantially increased construction
costs. It thus “sued TAS on a theory of negligent misrepresentation under Section 552 of
the Restatement (Second) of Torts,[17] claiming that TAS’s specifications were false
17 Section 552, titled “Information Negligently Supplied for the Guidance of Others,”
provides:
(1) One who, in the course of his business, profession or employment, or in
any other transaction in which he has a pecuniary interest, supplies false
information for the guidance of others in their business transactions, is
subject to liability for pecuniary loss caused to them by their justifiable
reliance upon the information, if he fails to exercise reasonable care or
competence in obtaining or communicating the information.
(2) Except as stated in Subsection (3), the liability stated in Subsection (1)
is limited to loss suffered
(a) by the person or one of a limited group of persons for whose
benefit and guidance he intends to supply the information or knows
that the recipient intends to supply it; and
[J-20-2018] - 23
and/or misleading, and seeking damages for its increased construction costs.” Id. at 272-
73. TAS filed preliminary objections in the nature of a demurrer, arguing that “‘the
economic loss doctrine,’ which holds that a tort plaintiff cannot recover for purely
economic losses” barred Bilt-Rite’s action and that TAS did not owe a duty to Bilt-Rite,
with whom it had no contractual relationship. Id. at 273. The trial court sustained TAS’s
preliminary objections, and the Superior Court affirmed.
On appeal, this Court was presented with the issue of “whether a building
contractor may maintain a negligent misrepresentation claim against an architect for
alleged misrepresentations in the architect’s plans for a public construction contract,
where there was no privity of contract between the architect and the contractor, but the
contractor reasonably relied upon the misrepresentations in submitting its winning bid and
consequently suffered purely economic damages as a result of that reliance.” Id. at 272.
In addressing that issue, this Court formally adopted Section 552 of the Restatement
(Second) of Torts as the law in Pennsylvania for negligent misrepresentation claims
involving those in the business of supplying information to others, such as an architect or
design professional.18 Id. at 287. The Court noted that recovery was possible even if the
(b) through reliance upon it in a transaction that he intends the
information to influence or knows that the recipient so intends or in a
substantially similar transaction.
(3) The liability of one who is under a public duty to give the information
extends to loss suffered by any of the class of persons for whose benefit
the duty is created, in any of the transactions in which it is intended to
protect them.
As discussed in further detail below, Section 552(3) was not at issue in Bilt-Rite.
18 The Court emphasized that, in adopting Section 552, it was not supplanting the
common law tort of negligent misrepresentation, but rather “clarifying the contours of the
tort as it applies to those in the business of providing information to others.” Bilt-Rite, 866
A.2d at 287.
[J-20-2018] - 24
third party had no direct contractual relationship with the supplier of the information, as
“Section 552 negates any requirement of privity.” Id.
Most importantly for our current purposes, with respect to application of the
economic loss doctrine, the Court looked to the “reasoned approach to the rule”
expressed by the South Carolina Supreme Court in Tommy L. Griffin Plumbing & Heating
Co. v. Jordan, Jones & Goulding, Inc., 463 S.E.2d 85 (S.C. 1995), which observed that
its
application of the “economic loss” rule maintains the dividing line between
tort and contract while recognizing the realities of modern tort law. Purely
“economic loss” may be recoverable under a variety of tort theories. The
question, thus, is not whether the damages are physical or economic.
Rather, the question of whether the plaintiff may maintain an action in tort
for purely economic loss turns on the determination of the source of the duty
plaintiff claims the defendant owed. A breach of a duty which arises under
the provisions of a contract between the parties must be redressed under
contract, and a tort action will not lie. A breach of duty arising independently
of any contract duties between the parties, however, may support a tort
action.
Id. at 287-88 (quoting Tommy L. Griffin Plumbing, 463 S.E.2d at 88 (footnote and citation
omitted)). The Tommy L. Griffin Plumbing Court listed libel and defamation, accountant
malpractice, legal malpractice, and architect liability among the examples of tort actions
for which purely economic loss is recoverable. Tommy L. Griffin Plumbing, 463 S.E.2d
at 88 & n.2.
This Court in Bilt-Rite explained that, “[l]ike South Carolina, Pennsylvania has long
recognized that purely economic losses are recoverable in a variety of tort actions
including the professional malpractice actions noted by the South Carolina Supreme
Court.” Bilt-Rite Contractors, 866 A.2d at 288. It thus agreed that “a plaintiff is not barred
from recovering economic losses simply because the action sounds in tort rather than
contract law.” Id. In so doing, the Court noted that Bilt-Rite had no contractual
relationship with TAS and thus, recovery under a contract theory was unavailable.
[J-20-2018] - 25
However, because Bilt-Rite stated a viable claim for negligent misrepresentation under
Section 552, which did not require privity, “logic dictate[d] that Bilt-Rite not be barred from
recovering the damages it incurred, if proven.”19 Id. The Court therefore held that the
economic loss doctrine was inapplicable to negligent representation claims arising under
Section 552. Id.
Following Bilt-Rite, this Court decided Excavation Technologies. In that case,
Excavation Technologies, Inc. (Excavation Technologies) requested that Columbia Gas
Company of Pennsylvania (Columbia) mark the locations of gas lines around work sites
pursuant to the One Call Act.20 Columbia improperly marked some lines and failed to
mark others, resulting in Excavation Technologies striking various gas lines, which in turn
hampered its work and caused it economic damages. Based on the foregoing,
Excavation Technologies sued Columbia on a theory of negligent misrepresentation
under Section 552 of the Restatement (Second) of Torts, alleging that Columbia failed to
comply with its duties under the One Call Act. In response, Columbia filed preliminary
objections in the nature of a demurrer, claiming that the economic loss doctrine precluded
liability. The trial court sustained Columbia’s preliminary objections, and the Superior
Court affirmed.
This Court granted review to decide “whether [Section] 552 of the Restatement
(Second) of Torts [see supra at pages 23-24 n.17] imposes liability for economic losses
to a contractor caused when a gas utility company fails to mark or improperly marks the
location of gas lines.” Excavation Technologies, 985 A.2d at 842. In answering this
19The Court additionally observed that application of the economic loss doctrine in the
context of a claim arising under Section 552 would be “nonsensical,” as it would allow a
party to pursue a cause of action, but preclude recovery for its losses once the elements
were demonstrated. Bilt-Rite Contractors, 866 A.2d at 288.
2073 P.S. §§ 176-86. The One Call Act requires facility owners to mark the position of
underground lines upon request. Id. at § 177(5)(i).
[J-20-2018] - 26
question, the Court distinguished the case from Bilt-Rite on the basis that Columbia was
“not in the business of providing information for pecuniary gain” and therefore concluded
that Section 552(1) and (2) of the Restatement (Second) of Torts were inapplicable. Id.
at 843. Additionally, the Court declined Excavation Technologies’ invitation to impose
liability under Section 552(3) of the Restatement (Second) of Torts, which was not at issue
and thus not addressed by Bilt-Rite. The Court rejected the argument that Section 552(3)
applied because Columbia was under a duty to provide accurate information as to the
location of its underground lines. In support of its conclusion, the Court reasoned that:
(1) the Act’s purpose was to protect against physical harm and property damage, not
economic losses; (2) excavators, and not utility companies, ultimately retained the duty
to identify the precise location of facilities pursuant to the Act; and (3) public policy
weighed against imposing liability, as the costs would inevitably be passed to the
consumer if utility companies were exposed to liability for an excavators’ economic
losses.21 Id. at 844.
In addition to its analysis above, the Court concluded that there was no statutory
basis to impose liability for economic losses. It is at this point the Court discussed the
economic loss doctrine, which the Court previously defined in a footnote as providing that
“no cause of action exists for negligence that results solely in economic damages
unaccompanied by physical injury or property damage.” Id. at 841 n.3 (quoting Adams v.
Copper Beach Townhome Communities. L.P., 816 A.2d 301, 305 (Pa. Super. 2003)).
The Court reasoned that the “economic loss doctrine was well-established in tort law
when the [One Call] Act was enacted” and later amended. Id. at 842 (citing Aikens v.
21 On the last point, the Court noted that “if this is to be done, the legislature will say so
specifically” and that “[u]ntil that day, we decline to afford heightened protection to the
private interests of entities who are fully capable of protecting themselves, at the public’s
expense.” Excavation Technologies, 985 A.2d at 844.
[J-20-2018] - 27
Baltimore and Ohio Railroad Co., 501 A.2d 277 (Pa. Super. 1985), which noted that the
roots of the economic loss doctrine were first recognized in Robins Dry Dock & Repair
Co. v. Flint, 275 U.S. 303 (1927)). The Court continued by explaining that “[t]he legislature
was presumably aware of the economic loss doctrine when it established the statutory
scheme governing the relationship among the entities required to participate under the
Act,” and found that “our legislature did not intend utility companies to be liable for
economic harm caused by an inaccurate response under the Act, because it did not
provide a private cause of action for economic losses.” Id. at 842-43. In the context of
this discussion, the Court cited In re Rodriguez, 900 A.2d 341, 345 (Pa. 2003), for the
proposition that “courts must assume [that the] legislature understands [the] legal
landscape on which it enacts laws, and when [the] common law rule is not abrogated,
they must assume it persists.” Id. at 843.
Having set forth our decisions in Bilt-Rite and Excavation Technologies, we hold
that those cases do not stand for the proposition that the economic loss doctrine, as
applied in Pennsylvania, precludes all negligence claims seeking solely economic
damages. Indeed, the Bilt-Rite Court unequivocally stated that “Pennsylvania has long
recognized that purely economic losses are recoverable in a variety of tort actions” and
that “a plaintiff is not barred from recovering economic losses simply because the action
sounds in tort rather than contract law.” Bilt-Rite, 866 A.2d at 288. In so doing, the Court
set forth a “reasoned approach” to applying the economic loss doctrine that “turns on the
determination of the source of the duty plaintiff claims the defendant owed.” Id. (quoting
Tommy L. Griffin Plumbing, 463 S.E.2d at 88). Specifically, if the duty arises under a
contract between the parties, a tort action will not lie from a breach of that duty. However,
if the duty arises independently of any contractual duties between the parties, then a
breach of that duty may support a tort action. Id.
[J-20-2018] - 28
As stated above, the Bilt-Rite Court took this approach from the Supreme Court of
South Carolina in the case of Tommy L. Griffin Plumbing. Notably, in Tommy L. Griffin
Plumbing, the Supreme Court of South Carolina observed that “some states use the
‘economic loss’ rule to prohibit all recovery of purely economic damages in tort.” Tommy
L. Griffin Plumbing, 463 S.E.2d at 88. The South Carolina Supreme Court, however,
rejected that approach in light of the fact that “[t]he law in South Carolina … has long
recognized tort actions when the damages are purely economic.” Id. at 88 & n.2 (citing
cases involving tort actions for purely economic damages, including architect liability,
legal malpractice, accountant malpractice, and libel and defamation). In recognizing that
Pennsylvania similarly “has long recognized that purely economic losses are recoverable
in variety of tort actions,” Bilt-Rite, 866 A.2d at 288, and accepting South Carolina’s
annunciation of the economic loss doctrine, this Court likewise rejected that approach.
As for UPMC’s argument that Bilt-Rite merely created a narrow exception to the
otherwise broad economic loss doctrine for negligent misrepresentation claims falling
under Section 552 of the Restatement, we find that argument unpersuasive. The Bilt-Rite
Court set forth the general approach to the economic loss doctrine as gleaned from the
South Carolina Supreme Court above and noted that Pennsylvania permits recovery of
purely economic losses in a variety of tort actions. The Bilt-Rite Court concluded that,
because Bilt-Rite had stated a viable claim for negligent misrepresentation under Section
552 of the Restatement, the economic loss doctrine did not bar its claim. In other words,
Bilt-Rite held that a negligent misrepresentation claim made under Section 552 of the
Restatement is one among many tort claims in Pennsylvania for which the economic loss
doctrine does not act as a bar for recovery of purely economic losses.
Our reading of Excavation Technologies does not compel a different conclusion.
As noted, the issue in that case was whether, under a theory of negligent
[J-20-2018] - 29
misrepresentation pursuant to Section 552 of the Restatement (Second) of Torts, a utility
is liable to a contractor for economic losses sustained when the utility fails to mark or
improperly marks the location of gas lines pursuant to the One Call Act. In deciding that
issue in the negative, the Court held that the contractor’s claim did not fall under Section
552(1) and (2) of the Restatement (Second) of Torts and declined to impose liability under
Section 552(3) of the Restatement. Thus, the Excavation Technologies Court did not
hold that the economic loss doctrine barred Excavation Technologies’ claim. Rather, it
held that Excavation Technologies failed to state a viable claim for negligent
misrepresentation under Section 552 of the Restatement in the first instance.
We acknowledge that the Excavation Technologies Court concluded that there
was no statutory basis to impose liability on utility companies for economic losses under
the One Call Act and, in so doing, included a broad definition and brief discussion of the
economic loss doctrine. However, we find these observations to be ancillary not only to
the Court’s conclusion that the One Call Act did not provide for recovery of economic
losses, but also to the Court’s central holding that, in contrast to Bilt-Rite, the contractor
failed to state a claim for negligent misrepresentation under Section 552 under the
Restatement. Further, the Court supported its comments on the economic loss doctrine
by citing nonbinding cases from the Superior Court that pre-date this Court’s approach to
the doctrine in Bilt-Rite. See Excavation Technologies, 985 A.2d at 841-43 & n.3 (quoting
Adams, 816 A.2d at 305, and citing Aikens, 501 A.2d at 278-79).22 Indeed, the Excavation
22 A brief discussion of Aikens and Adams is warranted. In Aikens, the Superior Court
rejected a negligence claim made by employees of a manufacturing plant against a
railroad company for lost wages resulting from the plant’s curtailed production due to
damage caused by a train derailment. The Superior Court adopted Section 776C of the
Restatement (Second) of Torts, which bars recovery of purely economic damages for
negligent interference with a contract or a prospective contractual relation, and concluded
that recovery is only possible if the tortious interference is intentional or involved parties
in a special relationship to one another. Aikens, 501 A.2d at 278-79. Exhibiting a clear
[J-20-2018] - 30
Technologies Court did not discuss Bilt-Rite’s approach to the doctrine, set forth above,
at all. Thus, to the extent Excavation Technologies can be interpreted as having any
impact on the Court’s expression of the rule under Bilt-Rite as we have now reaffirmed,
we reject that interpretation.
Here, Employees have asserted that UPMC breached its common law duty to act
with reasonable care in collecting and storing their personal and financial information on
its computer systems. As this legal duty exists independently from any contractual
concern with foreseeability and limitation of liability, the court supported its conclusion by
reasoning that, inter alia, “the negligent actor has no knowledge of the contract or
prospective relation and thus has no reason to foresee any harm to the plaintiff’s interest”
and that “[t]o allow a cause of action for negligent cause of purely economic loss would
be to open the door to every person in the economic chain of the negligent person or
business to bring a cause of action.” Id. at 279.
Similarly, in Adams, the Superior Court rejected a claim for lost wages and benefits
made under the Storm Water Management Act (SWMA), 32 P.S. §§ 680.1-680.17, by
employees of a manufacturing plant against entities that owned properties adjacent to the
plant, based upon the plant’s temporary closure due to storm water runoff from a
neighboring property. The Superior Court held that lost wages and benefits did not fall
within the scope of the term “injury” as used in the SWMA. Adams, 816 A.2d at 307.
Though discussion of the economic loss doctrine was ancillary to its conclusion that the
employees had no statutory basis for relief (as we similarly observed above with respect
to Excavation Technologies), the court relied upon Aikens to explain that the term “‘injury’
as used by the SWMA is analogous to the ‘physical injury or property damage’
requirements” of the doctrine and concluded that the trial court “properly applied” the
doctrine in dismissing the claim. Id.
Admittedly, both decisions state generally that “no cause of action exists for
negligence” that causes only economic loss, and other language included in the opinions
would appear, at first blush, to support that general notion. Aikens, 501 A.2d at 278-79;
Adams, 816 A.2d at 305, 307. However, a closer examination reveals that, when read in
context, the court’s observations are made in reference to employees’ attempt to bring
negligence claims for damages arising out of the contract/relationship they had with their
employer, of which the tortfeasor was unaware. Thus, those generalized
pronouncements do not support the conclusion that all negligence claims for economic
losses are barred under Pennsylvania law.
[J-20-2018] - 31
obligations between the parties, the economic loss doctrine does not bar Employees’
claim.
D. Conclusion
Based on the foregoing, we conclude that the courts below erred in determining
that UPMC did not owe a duty to Employees to use reasonable care to safeguard their
sensitive personal data in collecting and storing it on an internet-accessible computer
system. We further hold that the lower courts erred in concluding that Pennsylvania’s
economic loss doctrine bars Employees’ negligence claim. Accordingly, we vacate the
judgment of the Superior Court, reverse the order of the trial court, and remand the matter
to the trial court for further proceedings consistent with this opinion.
Justices Dougherty, Wecht and Mundy join the opinion.
Chief Justice Saylor files a concurring and dissenting opinion in which Justice Todd
joins.
Justice Donohue did not participate in the consideration or decision of this matter.
[J-20-2018] - 32