                               [J-20-2018][M.O. - Baer, J.]
                      IN THE SUPREME COURT OF PENNSYLVANIA
                                   WESTERN DISTRICT


BARBARA A. DITTMAN, GARY R.                   :   No. 43 WAP 2017
DOUGLAS, ALICE PASTIRIK, JOANN                :
DECOLATI, TINA SORRENTINO,                    :   Appeal from the Order of the Superior
KRISTEN CUSHMAN AND SHANNON                   :   Court entered on 1/12/17 at No. 971
MOLYNEAUX, INDIVIDUALLY AND ON                :   WDA 2015, affirming the order of the
BEHALF OF ALL OTHERS SIMILARLY                :   Court of Common Pleas of Allegheny
SITUATED,                                     :   County entered on 5/28/15 at No.
                                              :   GD14-003285
                                              :
                      Appellants              :
                                              :
                                              :   ARGUED: April 10, 2018
                                              :
                 v.                           :
                                              :
UPMC D/B/A THE UNIVERSITY OF                  :
PITTSBURGH MEDICAL CENTER, AND                :
UPMC MCKEESPORT,                              :
                                              :
                      Appellees               :


                        CONCURRING AND DISSENTING OPINION


CHIEF JUSTICE SAYLOR                              DECIDED: NOVEMBER 21, 2018


      I agree with the majority that Employees’ negligence claim should not have been

dismissed upon a demurrer, at the preliminary objection stage, contesting the legal

sufficiency of the complaint. I respectfully differ, however, with material aspects of the

majority’s reasoning.

      From my point of view, the claim in issue sounds in both contract and tort, thus

presenting a hybrid scenario. In this regard, Employees’ claim is expressly premised on

the discrete relationship between employers and employees relative to confidential
personal and financial information provided as a condition of employment. See Second

Amended Class Action Complaint at ¶56.           This suggests that the claim should be

viewed through a contract lens.           Nevertheless, Section 302B of the Second

Restatement -- addressing the risk of intentional or criminal acts -- recognizes that

duties arising out of contractual relationships may form the basis for tort liabilities. See

Restatement (Second) §302B, cmt. e (1965) (“There are . . . situations in which the

actor, as a reasonable man, is required to anticipate and guard against the intentional,

or even criminal, misconduct of others[,] . . . including “[w]here, by contract or otherwise,

the actor has undertaken a duty to protect the other against such misconduct”). See

generally Snoparsky v. Baer, 439 Pa. 140, 145–46, 266 A.2d 707, 710 (1970)

(referencing Section 302B favorably).1

       Ultimately, I find that an employer who collects confidential personal and financial

information from employees stands in such a special relationship to those employees

with respect to that information, and I have no difficulty concluding that such a

relationship should give rise to a duty of reasonable care to ensure the maintenance of

appropriate confidentiality as against reasonably foreseeable criminal activity.2

       This brings me to the economic loss doctrine. Initially, I respectfully differ with

the majority’s position that the doctrine should be essentially removed from the tort

arena so long as the duty involved can be categorized as “existing independently from


1 I agree with the majority’s footnoted treatment of Section 302B, see Majority Opinion,
slip op. at 17 n.11, but my present emphasis is on the interplay between contract and
tort in that particular context. I also have difficulty with the majority’s framing of the duty
in issue presented here in terms of a broader duty of care pertaining to affirmative
conduct that runs to the public at large. See id. at 16-17.

2 My conclusion, in this regard, is similar to that stated by the majority in Part A of its
opinion, albeit that I view the present matter as entailing a special relationship arising, in
the first instance, out of contractual undertakings.


                              [J-20-2018][M.O. – Baer, J.] - 2
any contractual obligations between the parties.” Majority Opinion, slip op. at 31-32.3 In

this regard, I note that the economic loss doctrine serves as a bulwark against

uncontrolled liability. See, e.g., Ultramares Corp. v. Touche, 174 N.E. 441, 444 (N.Y.

1931) (Cardozo, C.J.) (warning against imposing liability “an indeterminate amount for

an indeterminate time to an indeterminate class”). See generally Catherine M. Sharkey,

Can Data Breach Claims Survive the Economic Loss Rule?, 66 DEPAUL L. REV. 339,

348-60 (2017) (depicting the application of the economic loss rule in the “stranger

paradigm,” where the actor has no preexisting contractual or special relationship with an

injured victim). From my point of view, a proclamation negating the operation of the

economic loss doctrine in the tort law arena is both unnecessary to the resolution of the

present case and imprudent.      Instead, particularly because of the hybrid nature of

Employees’ claim, I find that the applicability of the economic loss doctrine should be




3Moreover, as noted above, I disagree with the majority’s conclusion that a duty on the
part of an employer to safeguard confidential personal and financial information
provided by employees as a condition of their employment exists independently of a
contractual employment relationship.

Parenthetically, Employees’ complaint does not attempt to delineate the specific nature
of the employment relationships involved among the 62,000 putative class members.
Presumably, there are individual written contracts, collective bargaining agreements,
and oral agreements involved. In all events -- and while realizing that the Court has
referred to oral at-will employment relationships as “non-contractual,” Weaver v.
Harpster, 601 Pa. 488, 502, 975 A.2d 555, 563 (2009) -- I believe that a contract
overlay is initially appropriate for present purposes in each of the above categories.
Accord Howard C. Ellis, Employment-at-Will and Contract Principles: The Paradigm of
Pennsylvania, 96 DICK. L. REV. 595, 613 (1992) (explaining, that under the terms of at-
will employment relationships, “[e]ach day is a new contract on these terms: a day's
work for a day's pay”).



                             [J-20-2018][M.O. – Baer, J.] - 3
determined more by way of a discrete social policy assessment than as a matter of

mere categorization.4

       In this regard, I am sympathetic to UPMC’s concerns about exposure to litigation

and the scale of the potential liability involved. Nevertheless, I would also be reluctant

to hold that employers should be absolutely immune from liability for any sort of

economic damages occasioned by negligent conduct on their part relative to the

safeguarding of confidential personal and financial data. Along these lines, I note that

some other courts have applied the economic loss doctrine to impose limitations on the

scope of damages without foreclosing economic damages entirely. See, e.g., Anderson

v. Hannaford Bros. Co., 659 F.3d 151, 162 (1st Cir. 2011) (discussing the availability, in

Maine, of recovery for economic losses in the form of “mitigation damages,” i.e.,

recovery for costs and harms incurred during a reasonable effort to mitigate losses

occasioned by computer data breaches). Although any such limitations are not directly

in issue here, I strike the balance here in favor of permitting recovery of at least

mitigation damages -- in the data breach context -- in instances in which an employee or

employees prove that the employer has violated the duty to exercise reasonable care in

protecting confidential personal and financial data.5

       Finally, I appreciate that this matter of substantive tort law is more properly the

domain of the Legislature. Nevertheless, I agree with the majority -- in the broadest


4The gist of the action doctrine serves as a means by which courts categorize claims to
maintain the distinction between theories of breach of contract and tort. See generally
Bruno v. Erie Ins. Co., 630 Pa. 79, 111-12, 106 A.3d 48, 68–69 (2014). Under that
doctrine, I would ultimately view Employees’ claims as properly couched in negligence,
despite the hybrid character, in light of Section 302B of the Restatement.

5 This is not to say that certification of a class action is necessarily proper, particularly
relative to damages issues. See generally Samuel-Bassett v. Kia Motors Am., Inc., 613
Pa. 371, 472-77, 34 A.3d 1, 61-65 (2008) (Saylor, J., dissenting).


                             [J-20-2018][M.O. – Baer, J.] - 4
frame -- that a pre-existing, traditional tort framework can be applied to the claim

involved, and, again, I find that the economic loss doctrine, and other rational

constraints, can be assessed in terms of the damages calculation for proven, wrongful

conduct on an employer’s part.6

       In summary, while I concur in the majority’s determination that Count I of the

complaint should be reinstated, I respectfully dissent concerning the legal principles by

which the majority undertakes to curtail the economic loss doctrine.



       Justice Todd joins this concurring and dissenting opinion.




6 I also agree with the majority that the General Assembly’s passage of an enactment
requiring notification to affected persons of data breaches -- and even its consideration
of potential civil causes of action in connection therewith -- does not control whether
Employees’ claims sufficiently comport with traditional common law principles to survive
a demurrer. See Majority Opinion, slip op. at 15 n.10. In other words, in light of the pre-
existing norms, the failure of the Legislature to pass affirmative legislation is inadequate,
in my view, to signal an abrogation of those norms.

This assessment subsumes consideration of the economic loss doctrine -- in light of all
of the uncertainties attending the doctrine, it seems to me to be unreasonable to
assume that the Legislature would have deemed it sufficient to effectively extinguish
potential common law causes of action regarding data breaches.


                             [J-20-2018][M.O. – Baer, J.] - 5
