Pa. Supreme Court rules UPMC — and all employers — must protect workers' data. Doing so is harder.
Gary Lynch, Esq. and Jamisen Etzel argued and won at the Commonwealth of Pennsylvania Supreme Court that UPMC breached common law legal duty.
They said UPMC had to meet a standard of reasonable care in handling employee data, because failure to do so could result in harm and it did - to the tune of several million dollars.
Lynch Carpenter Wins Major Data Privacy Case in Pennsylvania Supreme Court
On November 21, 2018, the Supreme Court of Pennsylvania issued a landmark ruling in the case of Dittman v. UPMC in favor of employees at the University of Pittsburgh Medical Center (UPMC) represented by Lynch Carpenter. In its decision, the Supreme Court of Pennsylvania held that UPMC had a duty to reasonably protect its workers’ personal data from cyber theft. This decision will very likely have a profound impact on future data breach litigation, specifically regarding the degree to which recipients of sensitive, personally identifying information are required to act reasonably in electronically storing and safeguarding such data. Gary Lynch argued the case on behalf of the employees, with Lynch Carpenter attorney Jamisen Etzel spearheading the briefing.
How the Case Arose
In February 2014, UPMC first informed the public about its data breach. Initially, UPMC claimed the data leak involved the names, addresses, bank information, birth dates, salaries, and social security numbers of only 22 workers. Two months later, however, in April 2014, UPMC updated this information and stated that 27,000 workers had information stolen. In May 2014, UPMC finally confirmed that all of its current as well as former workers were affected by the breach.
While the extent of the breach was still being investigated, in June 2014, Lynch Carpenter filed a class action lawsuit against UPMC in the Court of Common Pleas of Allegheny County, on behalf of all UPMC employees (consisting of approximately 62,000 current workers and an undetermined number of former employees). The lawsuit alleged that UPMC:
- Failed to adopt, design, and maintain adequate security measures for worker data privacy rights.
- Failed to implement processes that would detect security breaches in a timely manner
- Failed to meet current data security industry standards regarding authentication protocols, encryption, and firewalls
- Breached its duty of reasonable care to secure personal information, and
- Violated administrative guidelines
The lawsuit sought recovery of economic losses resulting from the filing of fraudulent tax returns in the names of workers whose information was stolen, as well as the increased risk that workers faced in the future of becoming the victims of identity theft, fraud, and abuse.
The Procedural History of the Case
The case took several years before it was heard by the Pennsylvania Supreme Court. The Court of Common Pleas initially dismissed all counts in the complaint, holding that UPMC owed no duty to reasonably protect employee data from cyber theft and, in any event, such a negligence claim based solely on economic damages would be barred by Pennsylvania’s economic loss doctrine. The Superior Court later affirmed the Court of Common Pleas’ dismissal. The Supreme Court of Pennsylvania, however, ultimately reversed this decision.
The Supreme Court of Pennsylvania’s Ruling
There are two notable components to the Supreme Court of Pennsylvania’s ruling:
- Duty to protect sensitive data from cyber theft. As part of its decision, the Supreme Court of Pennsylvania rejected the concept that it was creating a “new affirmative duty” for the holders of sensitive information. Instead, the Court found it was merely applying a long-established duty to a novel scenario. As a result, the Court held that where an employer’s collection of personal data belonging to workers creates a foreseeable risk of data breach, an employer has a duty of reasonable care to secure this data. This led the Court to conclude that UPMC should have realized a cybercriminal might take advantage of vulnerabilities in the company’s computer system and steal data belonging to current and past workers.
- Negligence claims involving “purely” economic loss. In its decision, the Supreme Court of Pennsylvania further held that Pennsylvania’s economic loss doctrine does not prohibit negligence claims seeking “purely” economic damages, so long as the duty sought to be enforced arises independently of any contractual duty. In reaching this holding, the Court clarified its prior decisions enunciating and applying the economic loss doctrine and rejected any and all previous pronouncements of the doctrine by lower Pennsylvania courts which had suggested an oversimplified interpretation of the doctrine which disallowed any tort claim in which only economic damages are sought. This significant holding by the Court makes it clear that if the duty which forms the basis for a tort claim arises independently of any contractual obligation between parties, such claim is viable even if purely economic damages are sought. As a result, the Court found that UPMC had a duty to reasonably secure personal data under general principles of negligence law, and the economic loss doctrine does not prohibit the workers’ claims.
Protecting the Privacy Rights of Workers
Data breaches are occurring in our society at an alarming rate. If you are a victim of a data breach, it is important to remember that the holder of your data is obligated to act reasonably to store and protect it from cyber theft. If you believe the holder of your data has failed to uphold this duty, please contact Gary Lynch at Lynch Carpenter today by calling 1-(800)-467-5241 or contact us here.
Court Preliminarily Approves Nationwide ADA Parking Settlement Against Cracker Barrel
On May 15, 2017, the Honorable Robert C. Mitchell, sitting in the Western District of Pennsylvania, entered an Order preliminarily approving the proposed class actions settlement, directing the issuance of settlement notice and scheduling a hearing on final approval in Sarah Heinzl v. Cracker Barrel Old Country Store, Inc. This relief achieved on behalf of the mobility-disabled community is nothing less than extraordinary. The settlement is the culmination of two and a half years of vigorously pursued and hotly contested litigation in which Ms. Heinzl successfully defeated each and every motion filed by Cracker Barrel. The comprehensive and historic relief achieved here obligates Cracker Barrel to, not only, ensure that all of the Cracker Barrel Parking Facilities are accessible to individuals with mobility disabilities but it also puts in place a policy and process for identifying and removing barriers at Cracker Barrel Parking Facilities nationwide for years to come. Ms. Heinzl has proven her importance and dedication to the disabled community not only through her advocacy and past employment but also as a class representative in this case and others. Lynch Carpenter partner Ed Kilpela led the firm’s litigation efforts behalf of the Class. Lynch Carpenter partner Ed Kilpela led the firm’s litigation efforts behalf of the Class.
Lynch Carpenter Certifies Class In Steak’n Shake
On April 27, 2017, the Honorable Robert C. Mitchell, sitting in the Western District of Pennsylvania, entered an Order certifying a class or all persons with mobility disabilities who were or will be denied the full and equal enjoyment of the goods, services, facilities, privileges, advantages or accommodations of any Steak ‘n Shake restaurant location in the United States on the basis of a disability because such persons encountered accessibility barriers in the parking facilities of the restaurant. In granting class certification, Judge Mitchell rejected every single argument advanced by Steak ‘n Shake and found the case presented common questions with common answers: “The Plaintiffs have shown sufficient evidence – at this juncture – that Defendant applies the same ADA maintenance policies and practices in a uniform way to the restaurants it owns and controls, which may prove to be harmful to the class members protected rights” noting that while Steak ‘n Shake monitors its parking lots for cracks and potholes it does nothing to identify or remediate slope issues and other relevant disability access violations. Additionally, Judge Mitchell confirmed Steak ‘n Shake’s obligation under the ADA to maintain the accessible features of its restaurants so that individuals with disabilities may have the same dining experience as able-bodied individuals. Lynch Carpenter partner Ed Kilpela is leading the firm’s litigation efforts.
Federal Court Holds That Commercial Websites Are Public Accomodations
On April 21, 2017, the Honorable Arthur J. Schwab, sitting in the Western District of Pennsylvania, entered a Consolidated Memorandum Opinion and Order denying motions to dismiss filed by Churchill Downs Incorporated and AmeriServ Financial Bank. Plaintiffs in both cases -- Lisa Frazier, R. David New and Access Now Inc. -- are blind individuals who attempted to use various websites owned and operated by Churchill Downs and AmeriServ but could not because the websites are inaccessible in violation of the ADA. Plaintiffs, by way of their Complaints, asserted that a permanent injunction is necessary to ensure Defendants’ websites will become, and will remain accessible to Plaintiffs and other blind or visually impaired individuals.
Churchill Downs and Ameriserv each moved to dismiss Plaintiffs’ Complaints relying largely on the same underlying arguments -- that because the websites are not “places of public accommodation” under Title III of the ADA, Defendants cannot be said to have violated the ADA by virtue of their inaccessible websites. In a thorough and well-reasoned Opinion, Judge Schwab highlighted the purpose of the ADA based on its legislative history:
The purpose of Title III of the ADA, is “to bring individuals with disabilities into the economic and social mainstream of American life . . . in a clear, balanced, and reasonable manner.” H.R.Rep. No. 485, 101st Cong., 2d Sess., pt. 2, at 99 (1990), reprinted in 1990 U.S.C.C.A.N. 303, 382. In drafting Title III, Congress intended that people with disabilities have equal access to the array of goods and services offered by private establishments and made available to those who do not have disabilities. S.Rep. No. 116, 101st Cong., 1st Sess. at 58 (1989).
Consistent with the statutory language of the ADA and case law in the 1st Circuit, 3rd Circuit and others, Judge Schwab held that because Plaintiffs’ were subject to discrimination at property which Churchill Downs and AmeriServ own and operate, and through which they offer their services, Churchill Downs and AmeriServ may be liable under Title III of the ADA.
Lynch Carpenter Wins $24 Million Dollar Award On Behalf Of Certified Class Of Mortgage Borrowers Following 13 Day Federal Court Arbitration
On March 24, 2017, a three judge panel awarded $24 million dollars to a certified class of mortgage borrowers represented by Lynch Carpenter.The award followed a 13 day arbitration trial conducted in the federal courthouse in Pittsburgh. The panel of arbitrators included a former judge from the United States District Court for the Western District of Pennsylvania and two former litigation department heads at AmLaw 100 law firms.Bruce Carlson was co-lead counsel for the class and Carlson along with his partner Gary Lynch led the Lynch Carpenter trial team that tried the case. This arbitration award represented the culmination of more than ten years of litigation, including three trips to the United States Court of Appeals for the Third Circuit and the certification of a RICO class which was affirmed by the Third Circuit. Judge Arthur Schwab was the presiding judge in the District Court.
Third Circuit Affirms Class Certification In Nationwide Mortgage Fraud Action Against PNC Bank
On July 29, 2015, the Third Circuit issued a 62 page precedential opinion affirming a class certification order that had been entered in favor of 22,000 plus second mortgage borrowers and against PNC by Judge Arthur J.Schwab in the Western District of Pennsylvania. .
Bruce Carlson is co-lead counsel for this national class and presented oral argument on its behalf before the Third Circuit. Discovery in the case is largely complete and Carlson expects that the case will now proceed quickly to a jury trial. PNC has potential exposure of over 1 billion dollars in this matter.
Important Opinion Denying Motion To Dismiss Issued In ADA Parking Accessibility Case Filed By Lynch Carpenter Against Starbucks
On March 9, 2015, the United States District Court for the Western District of Pennsylvania (Mitchell, J.) issued an opinion denying a motion to dismiss filed by Starbucks in a case challenging the accessibility of parking lots at Starbucks restaurants. The opinion is significant in that it thoughtfully analyzes, and rejects, many of the defenses that have been historically asserted on behalf of defendants in barrier removal cases under Title III of the ADA. This case is part of Lynch Carpenter’s national initiative to improve parking accessibility for those individuals with mobility disabilities—the top priority for the Department of Justice’s ADA enforcement division. To that end, and working with the disability rights community, Lynch Carpenter files Title III cases with the objective of improving accessibility throughout a given public accommodation’s entire network of business locations—not just the location that was visited by a given disabled plaintiff. Bruce Carlson manages the disability rights group at Lynch Carpenter.
Lynch Carpenter Argues Eleventh Circuit Appeal
On February 4, 2015, CLSK attorney Jamisen Etzel presented oral argument in the Eleventh Circuit Court of Appeals on behalf of Plaintiff in Gomez v. Dade County FCU. The Eleventh Circuit panel was sitting in Miami for this argument session. Gomez is class action which seeks to enforce ADA regulations calculated to make ATM machines accessible to the blind and visually impaired. The district court granted defendant’s motion to dismiss on standing/mootness grounds.
Lynch Carpenter Files Complaint Seeking In Excess Of $250 Million In Insurance Coverage As Part Of Rescap Bankruptcy Settlement
On February 4, 2015, Lynch Carpenter filed a complaint in the Southern District of New York Bankruptcy Court asserting claims based upon the assignment of insurance rights to the class as part of the Kessler class action settlement. Bruce Carlson is co-lead counsel for the Kessler Class. In the Kessler settlement—which was also prosecuted in the bankruptcy court in the Southern District of New York—Rescap (the debtor in bankruptcy) agreed to pay the Kessler Class an allowed claim amount of $300 million to settle allegations that second mortgage loans made to the class included inflated fees as a result of an illegal kickback scheme. Currently, it is expected that the allowed claim amount settlement of $300 million will yield a payment of approximately $38 million dollars from the debtor to the Kessler Settlement Class. This coverage action that was filed by Lynch Carpenter on February 4th seeks to recover the difference between the $38 million that will be paid to the Kessler Class by the debtor and the $300 million allowed claim amount that was negotiated in the settlement. The defendants in the coverage action include Lloyd’s of London, Twin City Fire Insurance and Swiss Re International, SE, among others.