In late 2018, The Supreme Court of Pennsylvania issued an important decision of which all employers and employees must carefully take note. In Dittman v. UPMC, 2018 Pa. LEXIS 6051 (Pa. Nov. 21, 2018), the court held that:
The Dittman decision marks an expansion of risk for companies that collect data. Companies are now expected to protect this data or suffer serious legal consequences. The decision reflects our society in 2019 – as identity and data theft have become more prevalent and problematic, global regulation has occurred on a major scale in recent years. The European Union’s passage of the General Protection Data Regulation (GPDR) is one example. While The Consumer Data Security and Notification Act (requiring disclosure of security breaches by financial institutions) in the United States is another.
In Dittman, current and former employees of the Pittsburgh Medical Center (UPMC) brought a class action after personal information collected as a condition of their employment was stolen. This data consisted of names, birth dates, social security numbers, addresses, tax forms, and bank account information.
In total, 62,000 employees had their personal data stolen from UPMC’s computer systems. The plaintiffs alleged economic loss after this stolen data was used by the cybercriminals to file fraudulent tax returns. The trial court dismissed the lawsuit since the plaintiffs did not allege any physical injury or property damage.
In Pennsylvania, plaintiffs may not recover solely economic damages under the economic loss doctrine. While the Superior Court noted that UPMC owed plaintiffs a special duty under Pennsylvania law, it affirmed since it also agreed that the economic loss doctrine would prohibit recovery.
The Pennsylvania Supreme Court reversed the decision of the Superior Court, reasoning that the economic loss doctrine does not bar the plaintiffs’ claim since they asserted that UPMC breached its common law duty to act with reasonable care in collecting and storing their personal and financial information on its computer systems. Because this legal duty exists independently from any contractual obligations between the parties, the economic loss doctrine does not bar recovery.
Thus, the holding in Dittman allows employees, whether current or former, to sue their employers for a cybersecurity data breach involving their personal information. While this may increase an employer’s risk and cost of doing business, it should lead to better overall cybersecurity among Pennsylvania companies. Hopefully, most will achieve this by proactive measures rather than as a response to litigation, as in the case of UPMC.
In 2019, under Pennsylvania law, employers have an independent duty to protect employee data from cyberattacks. Because Pennsylvania now recognizes a common law duty for data protection, employees now may sue their employers for purely economic loss arising from any failure to protect this personal data. In 1906, James Powell, Sr. founded Powell Law. Since then, our practice has evolved litigating all types of civil and criminal cases and building a body of knowledge and expertise that clearly provides our clients with a unique, distinct and incomparable advantage. Powell Law has an established 113-year-old reputation throughout northeastern Pennsylvania. Contact Powell Law at call (570) 961-0777. The consultation is FREE.
