Pennsylvania Supreme Court Provides New Route For Data Security Breach Plaintiffs

Data security breaches have become ubiquitous. However, in spite of the large number of well-publicized incidents, plaintiffs generally have had limited achievement in bringing private actions against companies suffering the breach. Plaintiffs have seen some  greater success establishing Article III standing under a number of state and federal court cases, but a recent decision from the Supreme Court of Pennsylvania in Dittman v. UPMC may signal a significant change in plaintiffs' fortunes because of the court's willingness to accept a standard that allows recovery for purely pecuniary damages. This decision should put anyone storing or collecting data on notice for the potential increase in security breach litigation in the employer/employee context, and outside that relationship as well.