Third Circuit Affirms Dismissal of Putative Class Action Following Data Breach and Misuse of Customer and Employee PII

FUENTES, Circuit Judge

Plaintiffs appeal the District Court’s judgment granting Benecard Services, Inc.’s (“Benecard”) motion to dismiss. Because we agree that Plaintiffs’ negligence claim is barred by Pennsylvania’s economic loss doctrine, and that their breach of implied contract claim fails to pass muster under Federal Rule of Civil Procedure 12(b)(6), we will affirm.

I.1

This case arises from an illegal data breach of Benecard’s computer system. Benecard is a prescription benefit administration services company that provides mail and specialty drug dispensing, managed vision services, and contact lens mail services to public and private sector organizations. Plaintiffs are former employees and customer members of Benecard who provided Benecard with their full names, dates of birth, addresses, and social security numbers as a prerequisite to employment or use of Benecard’s services. Benecard also maintained Plaintiffs’ personal financial information, including W-2 tax forms.

In early 2015, unknown third parties breached Benecard’s computer system and gained access to Plaintiffs’ personal and confidential information. Plaintiffs suffered financial harm when these unknown third parties used Plaintiffs’ information to file fraudulent tax returns and the IRS issued tax refunds to the unknown third parties rather than to Plaintiffs. Plaintiffs filed this putative class action diversity lawsuit on behalf ofall former and current Benecard employees and customer members whose information was compromised by the data breach. Plaintiffs brought claims for negligence and breach of implied contract under Pennsylvania law.

In granting Benecard’s motion to dismiss, the District Court held that Pennsylvania’s economic loss doctrine barred Plaintiffs’ negligence claim, and that Plaintiffs’ breach of implied contract claim failed to state a claim under Rule 12(b)(6). This appeal followed.

II.2

A. Negligence

Pennsylvania’s economic loss doctrine provides that “no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage.”3 This doctrine “is concerned with two main factors: foreseeability and limitation of liability.”4 The District Court held that because Plaintiffs’ negligence claim sounds only in economic loss resulting from the fraudulent tax returns filed with their information, the economic loss doctrine bars their claim. We agree.

Plaintiffs contend that the “contours of the economic loss doctrine have been broadened and muddied” by virtually all courts that have considered the issue.5 They ask us to “right the ship” by interpreting it as a bar only against negligence claims that flow from a contract. 6 They argue that, pursuant to the Pennsylvania Supreme Court’s interpretation of the doctrine in Bilt-Rite Contractors, Inc. v. The Architectural Studio, 7 the doctrine applies “only in cases where the source of the duty plaintiff seeks to enforce arises from a contract and, even then, only in instances where the harm suffered is limited to economic loss arising from the interference with contractual expectation.” 8 They maintain that because their negligence claim does not arise from a contractual duty, but rather a common law duty grounded in public policy, the economic loss doctrine does not bar their claim. We have rejected this argument before and, without contrary guidance from the Pennsylvania Supreme Court, will do so again here.

In Bilt-Rite, the Pennsylvania Supreme Court considered a negligence action against an architectural firm that provided faulty building plans to a school with knowledge that the plans would be used by prospective contractors.9 The contractor, relying on the faulty plans, spent more money than it had anticipated and sued the architectural firm for negligent misrepresentation under Section 552 of the Restatement (Second) of Torts. Section 552 imposes a duty of care on suppliers of professionalinformation for use by others. 10 The Pennsylvania Supreme Court held that the contractor could recover purely economic damages in this instance.11

Plaintiffs read the Bilt-Rite court’s interpretation of the economic loss doctrine as a bar to negligence claims only when the alleged duty owed to the plaintiff flows from a contract or, pursuant to the exception the court carved out, when the harm resulted from plaintiff’s reliance on the harm-causing party’s expert advice. We have rejected this argument in this past. In Sovereign Bank v. BJ’s Wholesale Club, we explained that “Bilt-Rite did not hold that the economic loss doctrine may not apply where the plaintiff has no available contract remedy.”12 Rather, “the Bilt-Rite Court simply carved-out an exception to allow a commercial plaintiff to seek recourse from an ‘expert supplier of information’ with whom the plaintiff has no contractual relationship” when loss resulted from reliance on the expert’s information. 13 Indeed, the Pennsylvania Supreme Court recently confirmed that the economic loss doctrine “generally precludes recovery in negligence actions for injuries which are solely economic,” but does not apply to “claims of negligent misrepresentation under § 552.”14 Likewise, in Azur v. Chase Bank, we rejected the plaintiff’s argument that the economic loss doctrine was inapplicable to hisnegligence claim because he had no contractual remedy.15 As that court stated, “we already rejected an identical argument in Sovereign Bank.”16

With this case law as our guide, we decline to hold that Pennsylvania’s economic loss doctrine is inapplicable here simply because Plaintiffs are not in contractual privity with Benecard and thus have no contractual remedy. While we note that the case law on Pennsylvania’s economic loss doctrine can be read in several different ways, we decline to “right the ship” as Plaintiffs here suggest. That task, if necessary, is for the Pennsylvania Supreme Court, not this Court.

B. Breach of Implied Contract

Plaintiffs argue, in the alternative, that Benecard breached an implied contract by failing to adequately safeguard Plaintiffs’ confidential information. The implied contract allegedly arose when Plaintiffs entrusted Benecard with confidential information as a condition of employment or doing business with the company. We agree with the District Court that under Rule 12(b)(6), these allegations do not sufficiently state a claim.

An implied contract arises in the same manner as an express contract, except that the parties’ intention, “instead of being expressed in words, is inferred from acts in the light of the surrounding circumstances.”17 That is, the agreement is inferred from the conduct of the parties. Though intent can be gleaned from the parties’ “ordinary courseof dealing[s],”18 “naked assertions devoid of further factual enhancement” fail to state an actionable claim. 19

Here, Plaintiffs have failed to plead any facts supporting their contention that an implied contract arose between the parties other than that Benecard required Plaintiffs’ personal information as a prerequisite to employment. This requirement alone did not create a contractual promise to safeguard that information, especially from third party hackers. By way of contrast, in Enslin v. Coca-Cola Co., the plaintiff’s breach of implied contract claim survived a motion to dismiss when he pled that Coca-Cola, “through privacy policies, codes of conduct, company security practices, and other conduct, implicitly promised to safeguard his [personal information] in exchange for his employment.” 20 Plaintiffs here do not plead any company-specific documents or policies from which one could infer an implied contractual duty to protect Plaintiffs’ information. Merely claiming that an implied contract arose “from the course of conduct”21 between Plaintiffs and Benecard is insufficient to defeat a motion to dismiss.

III.

For the foregoing reasons, we conclude that the District Court did not err in granting Benecard’s motion to dismiss Plaintiffs’ negligence and breach of implied contract claims. We will therefore affirm

1 Because this appeal arises out of the District Court’s grant of a motion to dismiss, we assume the facts alleged in Plaintiffs’ complaint are true. See Gould Elec. Inc. v. United States, 220 F.3d 169, 178 (3d Cir. 2000).

2 The District Court had original jurisdiction under 28 U.S.C. § 1332(d)(2). We have appellate jurisdiction under 28 U.S.C. § 1291. “We exercise plenary review over the grant of a motion to dismiss.” Brown v. Card Serv. Ctr., 464 F.3d 450, 452 (3d Cir. 2006).

3 Excavation Techs., Inc. v. Columbia Gas Co. of Pa., 985 A.2d 840, 841 n.3 (Pa. 2009) (quoting Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa. Super. Ct. 2003)).

4 Adams, 816 A.2d at 307.

5 Pl. Reply Br. 2

6 Id. at 1.

7 866 A.2d 270 (Pa. 2005).

8 Pl. Br. 12

9 Bilt-Rite, 866 A.2d at 272-73.10 Restatement (Second) of Torts § 552 (1977).

11 Bilt-Rite, 866 A.2d at 288.

12 533 F.3d 162, 180 (3d Cir. 2008).

13 Id.

14 Excavation Techs., 985 A.2d at 841.

15 601 F.3d 212, 223 (3d Cir. 2010).

16 Id.

17 Liss & Marion P.C. v. Recordex Acquisition Corp., 983 A.2d 652, 659 (Pa. 2009) (quoting Elias v. Elias, 237 A.2d 215, 217 (Pa. 1968)).

18 Id. (quoting Ingrassia Const. Co. v. Walsh, 486 A.2d 478, 483 (Pa. Super. Ct. 1984)).

19 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted).

20 136 F. Supp. 3d 654, 675 (E.D. Pa. 2015).

21 J.A. 39 ¶ 84