Defining Reasonable Care for the Protection of Personal Data

While the scope of the decision technically was confined to the employer-employee relationship, the court's reasoning implies that such a duty of reasonable care may arise in any scenario where one party engages in the collection of personal information, such as Social Security or financial account numbers, from another party, and the first party fails to implement adequate security measures to protect that information from a data breach. The common law duty recognized by the court does not seem bound exclusively to the employment context, and so the decision would seem equally applicable in any context, including that of any business and its customers. Indeed, as noted below, the Dittman decision has been cited in recent litigation arising out of merchant data breaches.

Procedurally, the Dittman decision addressed the preliminary objections to the plaintiff's class action complaint, and so the court did not examine UPMC's presumable defense that, indeed, it had exercised reasonable care by implementing adequate security measures, but nonetheless fell victim to a criminal hack of its systems. This is not a scenario where res ipsa loquitor or strict liability might apply, such that the occurrence of a data breach means the defendant must have been negligent.