Opinion
Civil Action 2:23-cv-531
03-26-2024
HOKKY TJAHJONO, individually and on behalf of all others similarly situated, and MILES BLACK, Plaintiffs, v. WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORPORATION doing business as WABTEC CORPORATION, Defendant.
MEMORANDUM OPINION
WILLIAM S. STICKMAN IV, UNITED STATES DISTRICT JUDGE
Plaintiffs Hokky Tjahjono and Miles Black (collectively, “Plaintiffs”) brought this putative class action asserting claims of negligence (Count I), negligence per se (Count II), breach of implied contract (Count III), unjust enrichment (Count IV), and declaratory judgment (Count V) against their former employer, Westinghouse Air Brake Technologies Corporation, d/b/a Wabtec Corporation (“Wabtec”). (ECF No. 13). Plaintiffs' claims arise out of a data breach at Wabtec that allegedly compromised their identifying information (“PII”). Wabtec has moved to dismiss Plaintiffs' amended complaint (“Amended Complaint”). (ECF No. 23). Wabtec's Motion to Dismiss Plaintiffs' First Amended Class Action Complaint (“Motion”) is premised on two intertwined theories for dismissal. It first argues that this matter is governed by Florida and Texas law (the home states of the two class representative Plaintiffs) and that the private common law causes of action that they assert are barred by statutory enactments of both states. Wabtec further argues that Plaintiffs failed to plead plausible claims under the pleading standards required by Federal Rule of Civil Procedure 8, as interpreted by Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), and Ashcroft v. Iqbal, 556 U.S. 662 (2009). For the reasons explained below, the Motion will be granted in part and denied in part. Plaintiffs may proceed on their claims for negligence, breach of implied contract, and unjust enrichment. Their claims for negligence per se and declaratory judgment will be dismissed.
I. Factual Background
Wabtec is a Delaware corporation with its principal place of business in Pennsylvania. (ECF No. 13, ¶ 14). It is a global manufacturer of locomotives and rail systems. (Id. ¶ 2). Employees must submit PII to Wabtec as a requirement of employment, which Wabtec stores on its internal network. (Id. ¶¶ 20-21). Class representative Plaintiffs Hokky Tjahjono and Miles Black are citizens and residents of Texas and Florida, respectively, and were Wabtec employees. (Id. ¶¶8, 11).
In June 2022, Wabtec discovered that cybercriminals had introduced malware into its computer storage systems, including where employees' PII was stored. (Id. ¶ 54). The leaked PII included, but was not limited to, employees' full names, dates of birth, medical records, health insurance information, non-US national ID numbers, non-US social insurance numbers or fiscal codes, passport numbers, IP addresses, financial information, and social security numbers. CW. ¶ 1).
LockBit, a ransomware group, claimed responsibility for the breach and demanded that Wabtec pay thirty million dollars in exchange for it to not release the stolen data. (Id. ¶ 61). Because Wabtec did not pay the ransom, LockBit leaked the data on its ransomware site in August 2022. (Id.). In December 2022, Wabtec announced that its computer systems were subjected to a successful ransomware attack that impacted employees' PII. Thereafter, it offered affected employees two-years of credit monitoring services. (Id. ¶¶ 3, 64).
II. Standard of Review
A motion to dismiss filed under Federal Rule of Civil Procedure (“Rule”) 12(b)(6) tests the legal sufficiency of the complaint. Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). A plaintiff must allege sufficient facts that, if accepted as true, state a claim for relief plausible on its face. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007); see also Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A court must accept all well-pleaded factual allegations as true and view them in the light most favorable to a plaintiff. See Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009); see also DiCarlo v. St. Mary Hosp., 530 F.3d 255, 262-63 (3d Cir. 2008). Although a court must accept the allegations in the complaint as true, it is “not compelled to accept unsupported conclusions and unwarranted inferences, or a legal conclusion couched as a factual allegation.” Baraka v. McGreevey, 481 F.3d 187, 195 (3d Cir. 2007) (citations omitted).
The “plausibility” standard required for a complaint to survive a motion to dismiss is not akin to a “probability” requirement but asks for more than sheer “possibility.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). In other words, the complaint's factual allegations must be enough to raise a right to relief above the speculative level, on the assumption that all the allegations are true even if doubtful in fact. Twombly, 550 U.S. at 555. Facial plausibility is present when a plaintiff pleads factual content that allows the court to draw the reasonable inference that a defendant is liable for the misconduct alleged. Iqbal, 556 U.S. at 678. Even if the complaint's well-pleaded facts lead to a plausible inference, that inference alone will not entitle a plaintiff to relief. Id. at 682. The complaint must support the inference with facts to plausibly justify that inferential leap. Id.
III. Analysis
As to the substance of Plaintiffs' claims, Wabtec argues that Texas and Florida law control and Plaintiffs are barred from recovering under Texas and Florida statutes pertaining to negligence actions for data breaches. (ECF No. 24, pp. 15-17). The applicable statutes are the Texas Identity Theft Employment and Protection Act (“TITEPA”) and the Florida Information Protection Act (“FIPA”). Wabtec contends that the statutes bar Plaintiffs' claims because they empower only the state attorney general to pursue an action arising out of a data breach. (Id. at 15-16). Plaintiffs counter that the Court should not engage in the choice of law analysis until after discovery because a more complete factual record is necessary to meaningfully perform the analysis. (ECF No. 36-1, pp. 11-12). Plaintiffs alternatively contend that even if the Court were to engage in the choice of law analysis now, the Texas and Florida statutes cited by Wabtec do not preclude their causes of action. (Id. at 12-13).
While many of the arguments set forth in the Motion presuppose the application of Texas and Florida laws, and that those laws foreclose a private right of action arising out of a data breach, Wabtec also argues that the Amended Complaint should be dismissed for failure to state a claim. (ECF No. 24, pp. 21-40). It asserts that Plaintiffs have cobbled together the allegations in the Amended Complaint from rehashed stock material that does not adequately plead the actual, individualized claims of Plaintiffs under the minimal standards of Rule 8. (See id.). Plaintiffs disagree. They assert that the allegations in their Amended Complaint are more than sufficient to survive the Motion. (ECF No. 36-1, pp. 14-28).
A. It is premature for the Court to undertake a choice of law analysis.
The Court has subject matter jurisdiction based on diversity of citizenship. 28 U.S.C. § 1332. When a federal court exercises diversity jurisdiction, the conflict of law rules of the forum state apply. See Wilson v. Slatalla, 970 F.Supp. 405, 413 (E.D. Pa. 1997) (citations omitted). Since the Court sits in Pennsylvania, it will apply Pennsylvania's choice of law rules.
Pennsylvania employs a two-step hybrid framework to analyze choice of law questions. The Court must first determine whether there is a relevant difference between the law of the jurisdictions whose laws may apply, i.e., whether a conflict exists. Hammersmith v. TIG Ins., 480 F.3d 220, 230 (3d Cir. 2007). If the laws of the jurisdictions are the same, “then there is no conflict at all, and a choice of law analysis is unnecessary.” Id. (emphasis in original). In the absence of a conflict, “the district court sitting in diversity may refer interchangeably to the laws of the states whose laws potentially apply” or “apply the law of the forum.” Huber v. Taylor, 469 F.3d 67, 74 (3d Cir. 2006) (citing On Air Ent. Corp. v. Nat'l Indem. Co., 210 F.3d 146, 149 (3d Cir. 2000)); O'Malley v. Vilsmeier Auctions Co., 986 F.Supp. 306, 307 (E.D. Pa. 1997).
If the laws differ, the Court must examine the interests and policies underlying each for every jurisdiction at issue and determine whether the conflict is “true,” “false,” or an “unprovided for” situation. Hammersmith, 480 F.3d at 230-32. A false conflict exists only if one jurisdiction's governmental interests would be impaired by the application of another jurisdiction's law. Budget Rent-A-Car Sys., Inc. v. Chappell, 407 F.3d 166, 170 (3d Cir. 2005) (citation omitted). When there is a false conflict, the Court must apply the law of the only interested jurisdiction. Id. If no jurisdiction's interests would be impaired if its laws were not applied, there is an “unprovided for” conflict and lex loci delicti (the law of the place of the wrong) continues to govern. Id. (citing Miller v. Gay, 470 A.2d 1353, 1355-56 (Pa. Super. 1983)).
“A ‘deeper [choice of law] analysis' is necessary only if both jurisdictions' interests would be impaired by the application of the other's laws (i.e., there is a true conflict).” Hammersmith, 480 F.3d at 230 (alterations in original) (citation omitted); see also Budget Rent-A-Car Sys., 407 F.3d at 170 (“A true conflict exists ‘when the governmental interests of [multiple] jurisdictions would be impaired if their law were not applied.'”) (alteration in original) (quoting Lacey v. Cessna Aircraft Co., 932 F.2d 170, 187, 187 n.15 (3d Cir. 1991)). If a true conflict exists, the Court must determine which state has the “greater interest in the application of its law.” Hammersmith, 480 F.3d at 231 (quoting Cipolla v. Shaposka, 267 A.2d 854, 856 (Pa. 1970)). To this end, the Court must weigh each state's contacts on a “qualitative scale according to their relation to the policies and interests underlying the [particular] issue.” Shields v. Consol. Rail Corp., 810 F.2d 397, 400 (3d Cir. 1987). The United States Court of Appeals for the Third Circuit has held that Pennsylvania choice of law analysis “employs depecage, the principle whereby ‘different states' laws may apply to different issues in a single case.'” Id. (citations omitted).
“A French word, depecage (DE-PA-SAJ) is defined as a ‘cutting up, dismembering, carving up.'” Taylor v. Mooney Aircraft Corp., 265 Fed.Appx. 87, 91 n.5 (3d Cir. 2008) (citation omitted).
The Amended Complaint pleads claims for negligence (Count I) and negligence per se (Count II). Pennsylvania courts use the Restatement (Second) of Conflicts of Law (“Restatement”) methodology when undertaking the conflicts of law analysis for tort claims. Melville v. Am. Home Assurance Co., 584 F.2d 1306, 1311-12 (3d Cir. 1978) (collecting Pennsylvania tort cases). Section 145(2) of the Restatement sets forth a general four-factor test for determining which state has the most significant relationship to a tort claim: 1) the place where the injury occurred; 2) the place where the conduct causing injury occurred; 3) the domicile, residence, nationality, place of incorporation, and place of business of the parties; and 4) the place where the relationship between the parties is centered. These factors are considered in light of seven overarching choice of law principles: 1) the needs of the interstate systems; 2) the policies of the forum state; 3) the policies of other interested states; 4) the protection of justified expectations; 5) the policies underlying the field of law; 6) certainty, predictability, and uniformity of result; and 7) the ease in determining and applying the law. Restatement (Second) of Conflicts of Law § 6.
At Count III, Plaintiffs allege a claim for breach of implied contract. The determination of what law to apply to an implied contract follows the general principles governing choice of law for contracts. Pennsylvania courts have adopted § 188 of the Restatement to govern the choice of law analysis in common law contract actions where there is no choice of law clause at issue. See, e.g., McDonald v. Wells Fargo Bank, N.A., F.Supp.3d 462, 480-81 (W.D. Pa. 2019) (applying Pennsylvania law and § 188(2) in a contract dispute); Knauer v. Knauer, 470 A.2d 553, 558 (Pa. Super. 1983) (applying § 188(2) to a case in assumpsit); Gillan v. Gillan, 345 A.2d 742, 744 (Pa. Super. 1975) (applying New York law and § 188(1) to a separation agreement dispute); Ario v. Underwriting Members of Lloyd's of London Syndicates 33, 205 and 506, 996 A.2d 588, 595 (Pa. Commw. 2010) (applying New York law and § 188(2) to a contract dispute).
Section 188(2) of the Restatement provides that in the absence of a stipulated choice of law provision, a court should pick the state with the most significant relationship to the dispute based on the following factors: 1) the place where the contract was executed; 2) the place where the contract was negotiated; 3) the place of performance; 4) the location of the subject matter of the contract; and 5) the domicile, residence, nationality, place of incorporation, and place of business of the parties.
Plaintiffs also plead a claim for unjust enrichment at Count IV. “Pennsylvania, however, does not consider unjust enrichment to be either an action in tort or contract. Unjust enrichment, rather, [is] an equitable remedy and synonym for quantum meruit, [and] is ‘a form of restitution.'” Powers v. Lycoming Engines, 328 Fed.Appx. 121, 126 (3d Cir. 2009) (citations omitted). “The Restatement views restitution as an area of the law ‘which is neither contract nor tort.'” Id. (citing Restatement (Second) of Conflicts of Law § 221 cmt. a). In determining which law applies to an unjust enrichment and/or restitution claim, courts must consider the following factors:
(1) the place where the parties' relationship was centered; (2) the state where defendants received the alleged benefit or enrichment; (3) the location where the act bestowing the enrichment or benefit was done; (4) the parties' domicile, residence, place of business, and place of incorporation; and (5) the jurisdiction “where a physical thing which was substantially related to the enrichment, was situated at the time of the enrichment.”Id. (citing § 221(2)).
To summarize the authority above, Pennsylvania's choice of law analysis for Plaintiffs' claims at Counts I, II, III, and IV includes both factual and legal components. On the one hand, which states' laws may be implicated is largely influenced by the facts of the case-i.e., which states can be said to have some “contact” with the claim(s) raised as well as the nature and significance of those contacts. These factual contacts include the residence of the parties, where the allegedly actionable event occurred, and where the harm from that action or event was experienced (if different from where the event occurred). On the other hand, the terms of the potentially applicable laws, and the extent of the state interests which they represent, are largely questions of law.
Because the choice of law analysis includes a necessary factual component, courts have held that factual development outside the four comers of a complaint is often necessary to undertake the requisite analysis and, as such, the analysis is not appropriate at the motion to dismiss stage. Harper v. LG Elecs. USA, Inc. 595 F.Supp.2d 486 (D.N.J. 2009) (declining to undertake a choice of law analysis at the motion to dismiss stage because such an analysis is “fact-intensive”); see also Graboff v. The Collern Firm, No. 10-1710, 2010 WL 4456923 (E.D. Pa. Nov. 8, 2010) (“[C]onducting a Pennsylvania choice of law analysis is fact-intensive and context specific. Due to the complexity of this analysis, when confronted with a choice of law issue at the motion to dismiss stage, courts within the Third Circuit have concluded that it is more appropriate to address the issue at a later stage in the proceedings.”).
Courts have specifically recognized that “[t]he data breach context raises unique problems in choice-of-law analysis” because it is not always clear where the breach occurred and where the harm from the breach can be said to have accrued. In re Mednax Servs., Inc., Customer Data Sec. Breach Litig., 603 F.Supp.3d 1183, 1199 (S.D. Fla. 2022) (“Gone are the days when all data was stored on local servers or mainframes, whose physical location readily determined the location of the injury-i.e., the breach. Instead, today's cases often involve data stored on the cloud-an interconnected and redundant storage mechanism distributed across datacenters whose locations may be unknown or even unknowable.”). A substantial number of cases addressing the issue in the context of data breach cases have accordingly held that it is inappropriate to decide which law applies at the motion to dismiss stage.
In First Choice Fed. Credit Union v. Wendy's Co., No. 16-506, 2017 WL 9487086, at *2 (W.D. Pa. Feb. 13, 2017), United States Magistrate Judge Maureen P. Kelly declined the invitation to decide which law applied to claims involving a data breach, observing that “[a] choice of law analysis in deciding a motion to dismiss is problematic because of the fact-intensive inquiry such an analysis generally requires.” See also In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. 19-md-2904, 2021 WL 5937742 (D.N.J. Dec. 16, 2021) (citation omitted) (collecting cases and holding that the “‘[c]hoice of law analysis has routinely been found to be premature at the motion to dismiss phase of a class action lawsuit,' because a choice of law analysis is fact-intensive and requires an inquiry on a claim-by-claim basis”); Carr v. Okla. Student Loan Auth., No. CIV-23-99-R, 2023 WL 6929853, at *2 (W.D. Okla. Oct. 19, 2023) (“At the outset, the Court recognizes the likelihood of choice of law determinations being necessary in this case. As [Defendant] notes, however, choice of law analysis is a fact intensive process which this Court is ill-equipped to engage in at this early stage of litigation.”).
The Court recognizes, as Wabtec argues, that there are circumstances where a choice of law analysis is appropriate at the motion to dismiss stage. In some circumstances, the appropriate law may be evident from the face of a complaint without any deeper examination of factual background. In many other cases, it is not possible to do so, and it is more appropriate to defer such determination until later in the proceedings.
Here, the Court holds that the decision on which state's law should apply must be deferred until a more fulsome factual record is developed. The fact intensive analysis required to determine which state's law applies to Plaintiffs' claims cannot be undertaken from the face of the pleadings. For example, to determine which law applies to Plaintiffs' negligence and negligence per se claims, the Court must consider: 1) the place where the injury occurred; 2) the place where the conduct causing injury occurred; 3) the domicile, residence, nationality, place of incorporation, and place of business of the parties; and 4) the place where the relationship between the parties is centered. Restatement (Second) Conflict of Laws § 145.
There are a number of considerations that the Court must weigh to make its choice of law determination as to each of Plaintiffs' claims. The Amended Complaint alleges that Plaintiffs are employees of Wabtec. While their personal residences are pled in the Amended Complaint, there is nothing pled about where their employment relationship was centered (including, but not limited to where they performed their work and where their employment-related administrative functions were performed). The Amended Complaint does not plead details about where (and in what manner) Wabtec stored Plaintiffs' PII, how and where the breach occurred, or where Wabtec exercised administrative oversight of data security issues. This non-exhaustive list highlights facts that may impact the choice of law determination with respect to Plaintiffs' claims for negligence, negligence per se, breach of implied contract, and unjust enrichment. These facts are not clear from the face of the Amended Complaint. The Court holds, therefore, that it is premature to undertake the choice of law analysis for Plaintiffs' claims. The parties may create a more fulsome record in discovery that will aid the Court in making such determinations at a later date.
B. Counts I, III, and IV are sufficiently pled and will proceed, but Counts II and V will be dismissed.
Wabtec contends that each of Plaintiffs' five causes of action are inadequately pled and should be dismissed. Plaintiffs counter that they have pled enough to survive the Motion. “A pleading party need not establish the elements of a prima facie case at this stage; the party must only ‘put forth allegations that “raise a reasonable expectation that discovery will reveal evidence of the necessary element[s].'”” First Choice, 2017 WL 9487086, at *2 (quoting Fowler v. UPMC Shadyside, 578 F.3d 203, 213 (3d. Cir. 2009) (citation omitted)).
1) Negligence
Plaintiffs have pled a plausible cause of action for negligence (Count I). Deferring the question of whether Plaintiffs may maintain a private cause of action in light of the Florida and Texas statutes, the Court only evaluated whether the Amended Complaint could support a negligence claim. It can. Numerous courts have recognized that there is a duty to protect PII that is entrusted either as incidental to employment or to a consumer relationship. See, e.g, Dittman v. UPMC, 196 A.3d 1036, 1048 (Pa. 2018); Clemens v. ExecuPharm Inc., 48 F.4th 146, 158-59 (3d Cir. 2022). Plaintiffs have sufficiently alleged a breach of that duty. They have also adequately pled a plausible clam that Wabtec's breach caused damages.
2) Negligence Per Se
Plaintiffs assert a claim for negligence per se at Count II that hinges on Wabtec's alleged violation of Section 5 of the Federal Trade Commission Act (“FTC Act”). Wabtec argues that the claim should be dismissed because negligence per se is not a stand-alone cause of action and, on a substantive basis, that alleged violations of the FTC Act cannot support a negligence action. (ECF No. 24, pp. 37-38).
It is well recognized that “[w]here a plaintiff alleges negligence and negligence per se as separate causes of action, courts within the Third Circuit routinely dismiss the negligence per se claim as subsumed within the standard negligence claim.” In re Rutter's Inc. Data Sec. Breach Litig, 511 F.Supp.3d 514, 531 (M.D. Pa. 2021) (collecting cases). Indeed, “negligence per se is not a separate cause of action, but is instead a theory of liability that supports a negligence claim.” Simmons v. Simpson House, Inc., 224 F.Supp.3d 406, 417 (E.D. Pa. 2016). Here, the Court has held that Plaintiffs have sufficiently pled a cause of action for negligence. Their claim for negligence per se is duplicative and will be dismissed. .
As in In re Rutter's Inc. Data Sec. Breach Litig., 511 F.Supp.3d 514, 532-33 (M.D. Pa. 2021), this dismissal is without prejudice in order for Plaintiffs, if they so choose, to employ a negligence per se theory in support of their claim for negligence. The Court defers to another day the question of whether a violation of Section 5 of the FTC Act can serve as a basis of negligence per se theory. Id. at 532 (“Because Plaintiffs' negligence claim will proceed regardless, we need not reach a decision on the viability of this alternative theory of negligence today. Summary judgment or pre-trial motion practice are more appropriate vehicles to analyze the applicability of the FTC Act as a predicate for a Pennsylvania negligence per se claim than the motion sub judice, especially because a decision in favor of [defendant] on this point would not dispose of the underlying negligence claim.”).
3) Breach of Implied Contract
Plaintiffs have pled a cognizable claim for breach of an implied contract (Count III). Pennsylvania applies the generally accepted common law formulation for breach of implied contract actions: “(1) the existence of a contract, including its essential terms, (2) a breach of a duty imposed by the contract and (3) resultant damages.” CoreStates Bank, N.A. v. Cutillo, 723 A.2d 1053, 1058 (Pa. Super. 1999) (citation omitted). “The essential elements of breach of implied contract are the same as an express contract, except the contract is implied through the parties' conduct, rather than expressly written.” Enslin v. The Coca-Cola Co., 136 F.Supp.3d 654, 675 (E.D. Pa. 2015) (citing Highland Sewer & Water Auth. v. Forest Hills Mun. Auth., 797 A.2d 385, 390 (Pa. Commw. 2002), aff'd sub nom., 739 Fed.Appx. 91 (3d Cir. 2018)). Intent can be “gleaned from the parties' ordinary course of dealing,” but “naked assertions devoid of further factual enhancement fail to state an actionable claim.” Longenecker-Wells v. Benecard Servs. Inc., 658 Fed.Appx. 659, 662 (3d Cir. 2016) (citations omitted).
Courts have held that a plaintiff may maintain a claim for a breach of implied contract in the data breach context. See In re Rutter's, 511 F.Supp.3d at 535-36; Sackin v. TransPerfect Global, Inc., 278 F.Supp.3d 739, 750-51 (S.D.N.Y. 2017); Enslin, 136 F.Supp.3d at 675. The rationale of the court denying the motion to dismiss in Enslin is instructive:
Plaintiff claims that the Coke Defendants, through privacy policies, codes of conduct, company security practices, and other conduct, implicitly promised to safeguard his PII in exchange for his employment. At this stage of the proceedings, whether the relevant terms of the agreement between the parties were stated explicitly or arose implicitly does not affect Plaintiffs ability to survive Defendants' Motion. Plaintiff has fairly alleged the existence of an agreement between the parties that included a covenant by the Coke Defendants to protect Plaintiffs PII, which Plaintiff alleges that the Coke Defendants breached. Therefore, the Coke Defendants' motion to dismiss Plaintiff s claims sounding in contract is denied.Enslin, 136 F.Supp.3d at 675.
The Court must permit a claim to move forward provided it pleads more than “naked assertions devoid of further factual enhancement.” Longenecker-Wells, 658 Fed.Appx. at 662 (citation omitted). The Court holds that Plaintiffs' claim does. Plaintiffs plead that they were required, as a condition of employment, to entrust their PII to Wabtec. (ECF No. 13, ¶ 21). They quote language from Wabtec's notification of the data breach recognizing its responsibility to protect employees' PII. (Id. at ¶ 22). Plaintiffs have not provided great detail for their claim, but they have pled more than naked assertions. The Court finds that they have pled enough for their breach of an implied contract claim to survive a motion to dismiss.
4) Unjust Enrichment
Plaintiffs have also adequately pled, at this stage, a claim for unjust enrichment at Count IV. Plaintiffs assert that they plead this claim in the alternative to their claim for breach of implied contract. Pennsylvania employs the standard common law formulation of unjust enrichment: “(1) benefits conferred on defendant by plaintiff; (2) appreciation of such benefits by defendant; and (3) acceptance and retention of such benefits under such circumstances that it would be inequitable for defendant to retain the benefit without payment of value.” Enslin, 136 F.Supp.3d at 676 (citation omitted). Courts have permitted claims for unjust enrichment arising out of a data breach to proceed beyond the pleading stage. Id. at 676-77; Sackin, 278 F.Supp.3d at 751-52. In such instances, the courts viewed the employees' labor as the benefit conferred and the enrichment as the acceptance of that labor while failing to take adequate steps to secure employees' PII.
Here, Plaintiffs aver in the Amended Complaint that they were required to provide their PII as a condition of employment. They plead that Wabtec benefited from “their labor and the profits earned therefrom.” (ECF No. 13, ¶ 123). They also allege that Wabtec was unjustly enriched by accepting Plaintiffs' labor while failing to take adequate safeguards against data breaches. (Id. at ¶ 124). Consistent with Enslin and Sackin, the Court holds that this is sufficient to overcome the Motion.
5) Declaratory Judgment
Plaintiffs' claim for declaratory judgment at Count V will be dismissed. The Declaratory Judgment Act provides:
In a case of actual controversy within its jurisdiction ... any court of the United States, upon the filing of an appropriate pleading, may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought.28 U.S.C. § 2201(a). District courts possess discretion in determining whether and when to entertain an action under the Declaratory Judgment Act, even when the suit otherwise satisfies subject matter jurisdiction prerequisites. Wilton v. Seven Falls Co., 515 U.S. 277, 282 (1995) (citing Brillhart v. Excess Ins. Co. of Am., 316 U.S. 491 (1942)). A court should decline to exercise its jurisdiction under the Declaratory Judgment Act when a request for declaratory judgment is duplicative of other claims. Ford v. Progressive Specialty Ins., 588 F.Supp.3d 589, 597 (E.D. Pa. 2022) (citing State Auto Ins. v. Summy, 234 F.3d 131, 134 (3d Cir. 2000) (“A federal court should also decline to exercise its discretionary jurisdiction when doing so would promote judicial economy by avoiding duplicative and piecemeal litigation.”)); see also Maniscalco v. Brother Intern. Corp. (USA), 627 F.Supp.2d 494, 504-05 (D.N.J. 2009) (dismissing a declaratory judgment claim where the declaration sought would be duplicative of a favorable finding on another claim).
The declaratory relief sought by Plaintiffs is set forth in Paragraph 133 of the Amended Complaint and it is as follows:
Pursuant to its authority under the Declaratory Judgment Act, this Court should enter a judgment declaring, among other things, the following:
a. Wabtec owes a legal duty to secure employees' PII and to timely notify employees of a data breach under the common law, Section 5 of the FTC Act, and various state statutes; and
b. Wabtec continues to breach this legal duty by failing to employ reasonable measures to secure employees' PII.(ECF No. 13, p. 34). The Court finds this declaratory judgment request to be duplicative of Plaintiffs' negligence claim (which includes its negligence per se theory, as described above). The adjudication of Plaintiffs' negligence claim will involve determining whether Wabtec owed a duty to secure employees' PII and/or to timely notify employees of a data breach. Thus, the question of duty presented by Plaintiffs' negligence claim is inseparable from the question presented in Plaintiffs' request for declaratory judgment. Consequently, the Court declines to exercise its jurisdiction under the Declaratory Judgment Act. Count V of the Amended Complaint will be dismissed with prejudice.
Plaintiffs' unjust enrichment claim at Count V also seeks injunctive relief. In other words, Plaintiffs have pled an equitable claim as part of their statutory cause of action under the Declaratory Judgment Act. Presuming this was procedurally proper, the Court holds that Plaintiffs have failed to set forth a cognizable claim for injunctive relief. Whereas the declaration they seek is duplicative of their negligence claim, the equitable relief they pursue is contradictory to the legal claims they raise. Specifically, in support of an injunction, they argue that absent injunctive relief, they would lack an adequate legal remedy if another data breach should occur. But Plaintiffs' negligence, breach of implied contract, and unjust enrichment. claims in the face of the data breach that already occurred seek just that-legal remedies. The Amended Complaint is silent as to how a hypothetical future data breach would be different.
IV. Conclusion
For the reasons set forth above, the Motion will be granted in part and denied in part. The Court will grant the Motion as to Counts II and V, but will deny it as to the remaining claims. An Order of Court will follow.