D. Young v. J. Wetzel & DOC

IN THE COMMONWEALTH COURT OF PENNSYLVANIA

Dana Young, : Appellant : : v. : : John Wetzel and : No. 743 C.D. 2020 Department of Corrections : Submitted: January 15, 2021

BEFORE: HONORABLE P. KEVIN BROBSON, President Judge HONORABLE MICHAEL H. WOJCIK, Judge HONORABLE CHRISTINE FIZZANO CANNON, Judge

OPINION NOT REPORTED

MEMORANDUM OPINION BY JUDGE FIZZANO CANNON FILED: May 12, 2021

Dana Young (Young), pro se, appeals from the July 2, 2020 order of the Court of Common Pleas of Schuylkill County (trial court) sustaining preliminary objections filed by the Pennsylvania Department of Corrections (Department) and its Secretary, John Wetzel (Wetzel) (collectively, Appellees), and dismissing Young’s complaint with prejudice. Upon review, we affirm.

I. Background Young is an individual incarcerated at the State Correctional Institution at Mahanoy. Original Record (O.R.), Complaint at 1, ¶ 1. In July 2018, the Department sent Young notice of an April 2018 data breach that may have compromised the security of his personal information, including his full name,

driver’s license number, home address, social security number and medical records. O.R., Complaint at 2, ¶ 4. The July 2018 notice identified Accreditation, Audit & Risk Management Security, LLC (AARMS), a vendor providing an online system utilized by the Department to conduct, manage and track audits and inspections related to accreditation and internal operations, as the target of the data breach. O.R., Complaint at 2, ¶ 6. Also in July 2018, Young’s counselor1 requested the enrollment code from the notice and subsequently called a representative of the Department regarding identity protection for Young. O.R., Complaint at 2, ¶ 7. In August 2018, Young received confirmation of enrollment in MYIDcare identity protection. O.R., Complaint at 2, ¶ 8. In April 2020, Young filed a complaint against Appellees in the trial court, alleging negligence by the Department in using AARMS as a vendor.2 O.R., Complaint at 2, ¶ 9. Young contended that the Department bore a duty to protect his personal and financial information, as such information constituted property in its care, custody and control; that the Department breached this duty by negligently and carelessly permitting AARMS to provide the online system utilized by the Department to conduct, manage and track audits and inspections related to its accreditation and internal operations; that the Department received actual knowledge

1 Young identifies the counselor as Ms. Bolts in his complaint, but fails to specify whether she is an employee of the Department or to provide any further information. See Original Record (O.R.), Complaint at 2, ¶ 7. 2 Despite identifying both John Wetzel (Wetzel) and the Pennsylvania Department of Corrections (Department) as defendants, see O.R., Complaint at 1, ¶¶ 2-3, Young only asserts that the Department committed negligence, see O.R., Complaint at 2, ¶¶ 9-13. Further, Young specifically identifies the Department as defendant in the subheading of his complaint titled “Count I, Plaintiff -vs- Defendant DOC, Negligence.” See O.R., Complaint at 3. Appellees have noted that Young “made no direct allegations that Defendant Wetzel was responsible, or even involved, in contracting with the third-party vendor who later suffered a data breach.” O.R., Preliminary Objections at 5, ¶ 21.

and notice from AARMS of the data breach; and that the data breach has placed Young at increased and imminent risk of falling victim to the crimes of identity theft and fraud. O.R., Complaint at 3-4, ¶¶ 18-21. Young also asserted that the Department failed to safeguard his information and to prevent vulnerabilities in its computer systems—specifically, that the Department failed to properly encrypt data, establish adequate firewalls and implement adequate authentication protocols for the protection of information in its computer network. O.R., Complaint at 3, ¶¶ 11-12. Further, Young maintained that the criminal acts of a third party did not relieve the Department of its duty of care to protect his personal and financial information. O.R., Complaint at 3, ¶ 14. Young also contended that the Department’s utilization of AARMS’ services constituted breach of implied contract. O.R., Complaint at 2, ¶ 9.3 Young averred that he utilized the inmate grievance system to attempt to resolve his complaint, resulting in a “final review” dated October 1, 2018. O.R., Complaint at 3, ¶ 15. Young sought damages in excess of $35,000 as well as litigation costs, exemplary damages to the extent permitted by law and such other relief as the trial court may deem just and proper. O.R., Complaint at 4. In May 2020, Appellees filed preliminary objections to Young’s complaint and requested dismissal thereof with prejudice. O.R., Preliminary Objections at 1 & 9 (citing Pa.R.C.P. No. 1028(a)(4)).4 Appellees contended that Young’s claim of negligence is barred by the doctrine of sovereign immunity. O.R., Preliminary Objections at 1 & 3-5, ¶¶ 14-24. Appellees also asserted that Young

3 Young stated that the Department’s use of services provided by AARMS “constitute[d] negligence and breach of implied contract by the increased and imminent risk of becoming a victim of identity theft crimes, fraud, and abuse as a result of the data breach.” Complaint at 2, ¶ 9. 4 Pennsylvania Rule of Civil Procedure No. 1028(a)(4) permits a party to file preliminary objections in the form of a demurrer challenging the legal insufficiency of a pleading. See Pa.R.C.P. No. 1028(a)(4).

failed to state a claim of breach of implied contract for failure to allege facts that would establish the existence of any contract between Young and the Department. O.R., Preliminary Objections at 5, ¶ 26. Further, Appellees maintained that, assuming arguendo Young established the existence of a contract between himself and the Department, such a contract would fall under the purview of the Board of Claims, which retains exclusive jurisdiction over contractual disputes between individuals and Commonwealth agencies pursuant to the Commonwealth Procurement Code, 62 Pa.C.S. §§ 101-2311. O.R., Preliminary Objections at 7, ¶¶ 33-35. Appellees also objected to Young’s complaint on the basis of lack of standing, contending that Young’s assertions that his personal information may have been compromised and that the data breach could render him susceptible to potential identity theft and fraud fail to establish actual harm. O.R., Preliminary Objections at 7-8, ¶¶ 36-45.5 Young filed an answer to Appellees’ preliminary objections, asserting that his complaint contained specific allegations and averments of fact sufficient to enable Appellees to conduct discovery and to prepare a defense regarding Wetzel’s responsibility and direct involvement in contracting with the third-party vendor that suffered the data breach. Answer to Preliminary Objections at 2, ¶ 21. On July 2, 2020, the trial court issued an opinion and order sustaining Appellees’ preliminary objections and dismissing Young’s complaint with

5 Pennsylvania Rule of Civil Procedure No. 1028(b)(5), pertaining to lack of capacity to sue, governs preliminary objections raised on the basis of lack of standing. See Pa.R.C.P No. 1028(b)(5); see also C.G. v. J.H., 172 A.3d 43, 54 (Pa. Super. 2017), aff’d, 193 A.3d 891 (Pa. 2018) (holding that “[b]ecause standing goes to a party’s capacity to sue, a standing objection is properly raised by an objection under Rule 1028(a)(5)”); Howard v. Commonwealth, 957 A.2d 332, 335 (Pa. Cmwlth. 2008) (sustaining preliminary objection filed pursuant to Pennsylvania Rule of Civil Procedure No. 1028(a)(5), where respondents objected that prisoner lacked capacity to sue on the basis of lack of standing to bring the action).

prejudice. Trial Court Op. at 1; Trial Court Order, 7/2/20. The trial court determined that sovereign immunity barred Young’s negligence claim, that Young failed to plead any facts supporting the existence of a contract between himself and the Department, and that Young lacked standing to bring suit. O.R., Trial Court Op. at 3-6.6 Young thereafter appealed to this Court. Young filed a statement of errors complained of on appeal pursuant to Pennsylvania Rule of Appellate Procedure 1925(b) identifying the question on appeal as whether the trial court abused its discretion in sustaining the Department’s preliminary objections and dismissing with prejudice his complaint alleging negligence for the failure to protect his personal and financial information. O.R, Statement of Errors Complained of On Appeal, 8/6/20. Young further asserted that he “sufficiently alleged his personal property was in the prison official’s care, custody or control,” such that “he is not precluded from pursuing his claim for negligence against . . . Wetzel and [the Department] for breach of his property.” Id.

II. Issues on Appeal On appeal,7 Young again argues that Appellees acted negligently in selecting a vendor that was subsequently targeted in a data breach. See id. at 8. Further, Young contends that he properly pleaded intentional tort claims that are not barred by sovereign immunity. See id. Young also asserts that sovereign immunity does not bar an action alleging negligence resulting in damage to property in the 6 The trial court adopted the rationale set forth in its July 2, 2020 opinion as its Pa.R.A.P. 1925(a) opinion. See Trial Court Order, 8/21/20. 7 “Our scope of review where a trial court sustains preliminary objections and dismisses a complaint is limited to determining whether the trial court committed an error of law or abused its discretion.” Kusher v. Woloschuk, 123 A.3d 341, 344 n.3 (Pa. Cmwlth. 2015).

care, custody or control of prison employees or the Department, and that his personal financial information became Appellees’ responsibility upon his transfer from county to state custody. See id. at 8-9. Moreover, Young maintains that the criminal acts of the third party perpetuating the data breach did not constitute a superseding cause relieving Appellees of liability, because the data breach was foreseeable. See id. at 9-10. Appellees repeat that Young’s negligence claim is barred by the doctrine of sovereign immunity; that Young fails to allege the elements of an action for breach of implied contract; that, regardless, jurisdiction over a dispute regarding such a contract would lie with the Board of Claims; and that Young lacks standing to bring his claims for failure to allege actual harm. Appellees’ Br. at 12-17.

III. Discussion Preliminary objections “are deemed to admit all well-pleaded material facts and any inferences reasonably deduced therefrom . . . .” Lennitt v. Dep’t of Corr., 964 A.2d 37, 40 (Pa. Cmwlth. 2008). “The Court, however, is not bound by legal conclusions, unwarranted inferences from facts, argumentative allegations, or expressions of opinion encompassed in the petition for review.” Thomas v. Corbett, 90 A.3d 789, 794 (Pa. Cmwlth. 2014). “In order to sustain preliminary objections, it must appear with certainty that the law will not permit recovery and any doubt should be resolved by a refusal to sustain them.” Neely v. Dep’t of Corr., 838 A.2d 16, 19 n.4 (Pa. Cmwlth. 2003); see also Mueller v. Pa. State Police Headquarters, 532 A.2d 900, 902 (Pa. Cmwlth. 1987) (holding that “[w]hen faced with a demurrer, the pertinent inquiry for a reviewing court is to determine whether the petitioner has

stated on the face of his petition a cause of action that, if proved, would entitle him to relief”). A. Standing “[A] party to litigation must establish as a threshold matter that he or she has standing to bring an action.” Markham v. Wolf, 136 A.3d 134, 140 (Pa. 2016). “The core concept [of standing] is that a person who is not adversely affected in any way by the matter he seeks to challenge is not ‘aggrieved’ thereby and has no standing to obtain a judicial resolution of his challenge.” Wm. Penn Parking Garage, Inc. v. City of Pittsburgh, 346 A.2d 269, 280 (Pa. 1975). Our Supreme Court has explained as follows: In determining whether a party is aggrieved, courts consider whether the litigant has a substantial, direct, and immediate interest in the matter. To have a substantial interest, the concern in the outcome of the challenge must surpass the common interest of all citizens in procuring obedience to the law. An interest is direct if it is an interest that mandates demonstration that the matter caused harm to the party’s interest. Finally, the concern is immediate if that causal connection is not remote or speculative. The keystone to standing in these terms is that the person must be negatively impacted in some real and direct fashion.

Markham, 136 A.3d at 140 (internal citations and quotation marks omitted). Thus, “[j]udicial intervention is appropriate only where the underlying controversy is real and concrete, rather than abstract.” Brouillette v. Wolf, 213 A.3d 341, 366 (Pa. Cmwlth. 2019) (citation and internal quotation marks omitted).

We agree with the trial court that Young lacks standing to pursue his negligence claim.8 As noted above, the “keystone” of standing is that a person must be negatively impacted in some real and direct fashion. See Markham, 136 A.3d at 140. Here, Young averred only that the July 2018 notice regarding the data breach stated that the exported data “may include” his personal information. See O.R., Complaint at 2, ¶¶ 4-5. Failing even to allege that his personal information was among data compromised in the breach, Young, therefore, is unable to establish a “real and concrete” controversy or that any potential, future harm is neither remote nor speculative. Brouillette, 213 A.3d at 366; see also Markham, 136 A.3d at 140. Further, Young merely alleged that the data breach resulted in “the increased and imminent risk” of falling victim to identity theft and fraud. See O.R, Complaint at 2, ¶ 9. Having failed to establish that he was adversely affected in any way by the data breach, Young lacks standing to pursue his negligence claim. See Reilly v. Ceridian Corp., 664 F.3d 38, 46 (3d Cir. 2011) (holding that plaintiff’s allegations of an increased risk of identity theft as a result of a security breach were merely hypothetical, future injuries and, therefore, failed to establish standing); 9 compare

8 We note that Young failed to set forth a cause of action for breach of implied contract, as he failed to include a separate count in his complaint corresponding to this claim. See Pa.R.C.P. No. 1020(a) (providing that a “plaintiff may state in the complaint more than one cause of action cognizable in a civil action against the same defendant, and that “[e]ach cause of action and any special damage related thereto shall be stated in a separate count containing a demand for relief”); see also Commonwealth v. Parisi, 873 A.2d 3, 9 (Pa. Cmwlth. 2005) (citing Pa.R.C.P. 1020(a)) (holding that plaintiff failed to set forth a cause of action against a particular defendant for failure to present the claim in a separate count including averments of facts pertaining to the particular claim and relief sought, reasoning that “averments in Count II [did] not suffice to maintain a cause of action against [the defendant] in Count I”); Garcia v. Cmty. Legal Servs. Corp., 524 A.2d 980, 982 (Pa. Super. 1987) (holding that plaintiff waived her breach of implied contract claim, as “failure to designate such a count in her complaint constituted a waiver of that cause of action”).

9 In Reilly, the United States Court of Appeals for the Third Circuit explained further:

Dittman v. UPMC, 196 A.3d 1036, 1038-39 (Pa. 2018) (employer possessed legal duty to exercise reasonable care to safeguard employees’ sensitive personal information stored on employer’s internet-accessible computer system, where employees levied claims of negligence and breach of implied contract against employer, alleging personal and financial information of employees stolen from employer’s computer systems by means of a data breach was used to file fraudulent tax returns on behalf of victimized employees, resulting in actual damages). Thus, we discern no error in the trial court’s decision to sustain Appellees’ preliminary objection on the basis of lack of standing.

B. Sovereign Immunity Regardless of Young’s lack of standing, we also agree with the trial court that the doctrine of sovereign immunity bars Young’s negligence claim. Although the Commonwealth and its agencies are generally shielded by the defense of sovereign immunity, our General Assembly has waived that defense “as a bar to an action against Commonwealth parties[] for damages arising out of a negligent act where the damages would be recoverable under the common

In data breach cases where no misuse is alleged, . . . there has been no injury—indeed, no change in the status quo. Here, [the a]ppellants’ credit card statements are exactly the same today as they would have been had [the payroll processing firm’s] database never been hacked. Moreover, there is no quantifiable risk of damage in the future. Any damages that may occur here are entirely speculative and dependent on the skill and intent of the hacker.

Reilly, 664 F.3d at 45 (citation omitted). Although “[t]he decisions of the federal district courts and courts of appeal . . . are not binding on Pennsylvania courts,” we observe that “federal courts lower than the United States Supreme Court possess a persuasive authority.” Zablow v. Bd. of Educ. of Sch. Dist. of Pittsburgh, 729 A.2d 124, 128 (Pa. Cmwlth. 1999) (citation omitted). Thus, it is possible that a plaintiff may have standing to pursue a claim in state court while failing to present a justiciable “case or controversy” for purposes of standing on appeal in federal court. See, e.g., Doremus v. Bd. of Educ. of Borough of Hawthorne, 342 U.S. 429, 434-35 (1952).

law or a statute creating a cause of action if the injury were caused by a person not having available the defense of sovereign immunity.” 42 Pa.C.S. § 8522(a).10 Thus, “[t]o impose liability on a Commonwealth party, (1) the alleged negligent act must involve a cause of action that is recognized at common law or by a statute, and (2) the case must fall within one of [the] exceptions to sovereign immunity listed in Section 8522(b)” of what is commonly referred to as the Sovereign Immunity Act.11 Bufford v. Pa. Dep’t of Transp., 670 A.2d 751, 753 (Pa. Cmwlth. 1996) (citing 42 Pa.C.S. § 8522(b)).12 Young, therefore, bore the “initial burden” of setting forth a claim for negligence against the Department13 where damages would be recoverable under the common law or a statute creating a cause of action. LaChance v. Michael

10 Section 2310 of the Pennsylvania Consolidated Statutes provides as follows:

Pursuant to section 11 of Article 1 of the Constitution of Pennsylvania, it is hereby declared to be the intent of the General Assembly that the Commonwealth, and its officials and employees acting within the scope of their duties, shall continue to enjoy sovereign immunity and official immunity and remain immune from suit except as the General Assembly shall specifically waive the immunity.

1 Pa.C.S. § 2310; see also Pa. Const. art. I, § 11 (providing that “[s]uits may be brought against the Commonwealth in such manner, in such courts and in such cases as the Legislature may by law direct”).

11 42 Pa.C.S. §§ 8521-8528. 12 Section 8522(b) of the Sovereign Immunity Act waives the immunity of Commonwealth parties from negligence suits for damages caused by: (1) vehicle liability; (2) medical-professional liability; (3) care, custody or control of personal property; (4) commonwealth real estate, highways and sidewalks; (5) potholes and other dangerous conditions; (6) care, custody or control of animals; (7) liquor store sales; (8) national guard activities; (9) toxoids and vaccines; and (10) sexual abuse. See 42 Pa.C.S. § 8522(b). These exceptions are to “be narrowly construed to effect the General Assembly’s intent to insulate state and local agencies from tort liability.” Williams v. Phila. Hous. Auth., 873 A.2d 81, 86 (Pa. Cmwlth. 2005). 13 As noted above, Young failed to identify Wetzel as a defendant in connection with his negligence claim. See supra note 2.

Baker Corp., 869 A.2d 1054, 1057 (Pa. Cmwlth. 2005), as amended (Feb. 10, 2005); see also Williams v. Phila. Hous. Auth., 873 A.2d 81, 85 (Pa. Cmwlth. 2005) (“The threshold question in a case of . . . sovereign immunity is whether the plaintiff would have an action in damages at common law or statute if the defendant could not claim the defense of governmental or sovereign immunity.”). To state a negligence claim, “the plaintiff must demonstrate that the defendant owed a duty of care to the plaintiff, the defendant breached that duty, the breach resulted in injury to the plaintiff, and the plaintiff suffered an actual loss or damage.” Martin v. Evans, 711 A.2d 458, 461 (Pa. 1998). Young alleged that the Department’s use of AARMS as a vendor constituted negligence. See O.R., Complaint at 2, ¶ 9. However, as a general rule, an employer cannot be held liable for negligence in hiring an independent contractor unless physical harm has resulted from a lack of skill on the part of the contractor of which the employer had reason to know. See Restatement (Second) of Torts, § 411 & cmt. b (Am. Law Inst. 1965).14 Here, Young has alleged neither that he suffered physical harm nor that the Department had reason to know of any lack of skill on the part of AARMS. Young’s allegations, therefore, fail to support that the Department owed him a duty of care in connection with the storage of his personal information in the online system provided by AARMS. Young further asserted that the Department possessed a legal duty to protect his personal and financial information as property under its “care, custody and control,” thereby tracking the requirements of the exception to sovereign immunity contained in Section 8522(b)(3) of the Sovereign Immunity Act. See O.R.,

14 Our Supreme Court has applied Section 411 of the Restatement (Second) of Torts, including comment b, as Pennsylvania law. See Brletich v. U.S. Steel Corp., 285 A.2d 133, 137 (Pa. 1971).

Complaint at 2, ¶ 10; 42 Pa.C.S. § 8522(b)(3) (waiving the defense of sovereign immunity for claims for damages caused by “[t]he care, custody or control of personal property in the possession or control of Commonwealth parties”). However, “[a]n exception to immunity does not create a cause of action. The cause of action must exist independently.” Frazier v. Commonwealth, 845 A.2d 253, 258 (Pa. Cmwlth. 2004). Thus, because Young fails to meet his initial burden of setting forth a cause of action for negligence against the Department for which damages would be recoverable, it is not necessary to consider whether any particular exception to the Department’s immunity is applicable under the circumstances sub judice. See 42 Pa.C.S. § 8522(a); see also LaChance, 869 A.2d at 1055 (affirming summary judgment in favor of the Pennsylvania Department of Transportation (PennDOT); decedent’s estate “could not make out a common law claim of negligence against PennDOT, which is the initial burden of a plaintiff in a tort claim brought against a Commonwealth agency,” where the “[e]state could not show a basis for holding PennDOT liable for the negligence of its contractor”). We, therefore, agree with the trial court’s decision to sustain Appellees’ demurrer to Young’s negligence claim.15

C. Implied Contract Further, we discern no error in the trial court’s determination that Young failed to establish a breach of implied contract claim against Appellees. A

15 Contrary to Young’s assertion, the doctrine of sovereign immunity bars intentional tort claims against Commonwealth parties. See Williams v. Stickman, 917 A.2d 915, 917 (Pa. Cmwlth. 2007) (affirming the trial court’s dismissal of an inmate’s intentional tort claim against prison employees, reasoning that where “an employee of a Commonwealth agency [is] acting within the scope of his or her duties, the Commonwealth employee is protected by sovereign immunity from the imposition of liability for intentional tort claims”); La Frankie v. Miklich, 618 A.2d 1145, 1149 (Pa. Cmwlth.1992) (same). In any event, Young did not plead an intentional tort.

cause of action for breach of contract “must be established by pleading the existence of a contract (including its essential terms), a breach of duty imposed by the contract and resultant damages.” Gen. State Auth. v. Coleman Cable & Wire Co., 365 A.2d 1347, 1349 (Pa. Cmwlth. 1976). “While not every term of a contract must be stated in complete detail, every element must be specifically pleaded.” Pelino v. Wetzel (Pa. Cmwlth., No. 92 M.D. 2019, filed Apr. 20, 2020), slip op. at 716 (quoting CoreStates Bank, N.A. v. Cutillo, 723 A.2d 1053, 1058 (Pa. Super. 1999). Here, Young merely stated in his complaint that “the [Department’s] use of [AARMS as a vendor] constitute[d] negligence and breach of implied contract by the increased and imminent risk of becoming a victim of identity theft crimes, fraud[] and abuse as a result of the data breach.” O.R., Complaint at 2, ¶ 9. He alleged no actual harm. Thus, Young failed to establish a cause of action for breach of implied contract. See Pelino, slip op. at 7 (holding that an inmate failed to plead a breach of contract action, where the inmate did not allege that any damages resulted from the Department’s alleged breach of a power of attorney agreement). We, therefore, agree with the trial court’s decision to sustain Appellees’ demurrer to Young’s breach of implied contract claim.17

16 We cite this unreported opinion as persuasive authority pursuant to this Court’s Internal Operating Procedures. 210 Pa. Code § 69.414(a). 17 As observed by the trial court, we note that the General Assembly has waived sovereign immunity for contract claims against the Commonwealth that fall within the narrow jurisdiction of the Board of Claims and are brought in accordance with its procedure. See Dubaskas v. Dep’t of Corr., 81 A.3d 167, 173-74 (Pa. Cmwlth. 2013); see also 62 Pa.C.S. § 1724(a)(1) (“The [Board of Claims] shall have exclusive jurisdiction to arbitrate claims arising from . . . [a] contract entered into by a Commonwealth agency in accordance with this part and filed with the board in accordance with section 1712.1 (relating to contract controversies)”); 62 Pa.C.S. § 1702.

IV. Conclusion Because it “appear[s] with certainty that the law will not permit recovery,” Neely, 838 A.2d at 19 n.4, we, therefore, affirm the trial court’s decision sustaining Appellees’ preliminary objections and dismissing Young’s claims with prejudice.

__________________________________ CHRISTINE FIZZANO CANNON, Judge

IN THE COMMONWEALTH COURT OF PENNSYLVANIA

Dana Young, : Appellant : : v. : : John Wetzel and : No. 743 C.D. 2020 Department of Corrections :

ORDER

AND NOW, this 12th day of May, 2021, the July 2, 2020 order of the Court of Common Pleas of Schuylkill County is AFFIRMED.

__________________________________ CHRISTINE FIZZANO CANNON, Judge