Data Breach Negligence Claims Not Recognized In Pennsylvania

Cybersecurity and Data Privacy

Action Item: The Court of Common Pleas in Pennsylvania has refused to recognize negligence claims in data breach lawsuits, making it more difficult for plaintiffs to pursue claims and damages in data breach cases. Although not binding state-wide, this decision adds to the growing body of case law that have held negligence claims for failure to provide reasonable data security protections that are not actionable.

In an important and well-reasoned 12-page decision, Judge Wettick of the Court of Common Pleas of Allegheny County refused to create a common law duty to protect and secure confidential information. The decision was issued in the matter of Dittman v. UPMC, which was filed on behalf of over 62,000 plaintiffs. Although not binding state-wide, Judge Wettick's decision represents an important step in the development of privacy law in Pennsylvania.