MEMORANDUM OPINION

Joseph F. Leeson, Jr., United States District Judge.

Defendants' Motion to Dismiss, ECF No. 10-granted in part and denied in Part

Presently before the Court is the Motion to Dismiss of Defendants The Coca-Cola Company, Coca-Cola Refreshments USA, Inc., Keystone Coca-Cola and Bottling and Distribution Corporation, Keystone Coca-Cola Bottling Company, Inc., Keystone Coca-Cola Bottling Co., and Keystone Coca-Cola Bottling Corporation ("the Coke Defendants"). ECF No. 10. The Coke Defendants seek to dismiss each of Plaintiff Shane K. Enslin's state law and federal law claims. First, pursuant to Rule 12(b)(1), the Coke Defendants argue that Plaintiff has not properly alleged an actual case or controversy, depriving this court of subject matter jurisdiction to hear his claim. Second, pursuant to Rule 12(b)(6), the Coke Defendants move to dismiss all ten of Plaintiff's claims for failing to state a claim upon which relief can be granted. The Court finds that Plaintiff has standing to advance his claims, and for the following reasons, the Court grants in part and denies in part Defendants' Motion to Dismiss.

I. Background

This action arises out of the theft of fifty-five laptops allegedly containing the personal identification information ("PII") of Plaintiff and 74,000 other current and former employees of the Coke Defendants. Compl. ¶¶ 2, 31, 44.

Plaintiff was hired by Defendant Keystone Coca-Cola Bottling Company ("Keystone Coke") in 1996 as a service technician assigned to the Poconos region of Pennsylvania. Id. ¶¶ 16, 49. As part of his employment, Plaintiff was required to provide Keystone Coke with his PII. Id. This PII included Plaintiff's Social Security number ("SSN"), address, bank account information, credit card numbers, driver's license information, and motor vehicle records. Id. ¶¶ 32, 49. Plaintiff's PII was stored by Keystone Coke on one or more laptop computers in an unencrypted format. Id. ¶¶ 16, 31. During his term of employment, the Coke Defendants represented to Plaintiff that, in exchange for his employment, his PII would be securely retained. Id. ¶ 42. In 2007, after eleven years of employment, Plaintiff left his job at Keystone Coke. Id. ¶¶ 16, 31

On December 31, 2007, Defendant Coca-Cola Enterprises ("CCE") acquired Keystone Coke as a subsidiary of CCE. Id. ¶ 18. In 2010, The Coca-Cola Company ("Coca-Cola Co.") acquired CCE. Id. ¶ 2. While it is unclear which Coke Defendant controlled Plaintiff's PII at each of the relevant times in Plaintiff's complaint, eventually "laptops assigned to current CCR1 and former CCE users" containing the PII of Plaintiff and relevant class members made their way into the possession of CCE. Id. ¶¶ 2, 4-6, 44, 46, 49; id. Ex. A, at 1.2

Over a nearly six-year period, beginning in January 2007 and continuing through November 2013, approximately fifty-five of these laptop computers were stolen from CCE. Id. ¶¶ 2, 44. The stolen laptops allegedly contained the PII of over 74,000 people, including Plaintiff. Id. ¶¶ 2, 31, 44. On November 17, 2013, the Coke Defendants discovered that the theft had occurred and undertook efforts to recover the stolen laptops. Id. ¶ 45. By December 10, 2013, the Coke Defendants had recovered all fifty-five stolen laptops. Id.

The Coke Defendants determined that Thomas William Rogers, an employee of CCE responsible for retaining or destroying the laptops, was responsible for the theft of the laptops. Id. ¶¶ 24, 44. Rogers was arrested on June 14, 2014, by Cobb County police and stands charged with felony and misdemeanor theft by taking. Id. Plaintiff alleges that, from these stolen laptops, various, unknown identity thieves were able to gain access to Plaintiff's PII. Id. ¶¶ 25-29, 49.

On February 23, 2014, CCE and Coca-Cola Co. sent a letter to Plaintiff, notifying him of the theft of the laptops and informing him that these laptops may have contained his PII. Id. ¶ 46; id. Ex. A, at 1. The letter also offered Plaintiff a one-year subscription of credit monitoring service. Id. ¶ 47; id. Ex. A, at 1.

A few months after receiving this notification letter, Plaintiff alleges he began to experience unauthorized uses of his finances and identity by unknown persons ("Identity thieves"). Id. ¶ 50. Identity thieves fraudulently purchased $958.44 of merchandise from Bloomingdale's, Inc., and had the merchandise shipped to an address in Staten Island, New York. Id. ¶ 51. The same identity thieves then used money from Plaintiff's checking account to pay this bill. Id. Plaintiff was forced to close that account, incurring a $17.00 charge. Id.

On April 8, 2014, the same identity thieves ordered $825.86 of merchandise from Fingerhut, an online retailer, and had this merchandise shipped to the same Staten Island address. Id. ¶ 52. The identity thieves also attempted to change the addresses for each of Plaintiff's bank accounts to the same address in Staten Island. Id. Plaintiff and his wife expended numerous hours attempting to correct these attempted address changes. Id. Also on April 8, 2014 there was fraudulent activity on two of Plaintiff's Capitol One branded credit cards and his Best Buy credit card. Id. ¶ 53. "With these accounts, the [identity thieves] attempted to pay the outstanding balances from [Plaintiff's] checking account." Id. At various times during these events, the same identity thieves also tried to open new credit cards in Plaintiff's name. Id. ¶ 54. The identity thieves also attempted to use Plaintiff's Macy's Department Store credit card and to pay off the balance of the card using his checking account. Id. ¶ 55. In addition, the identity thieves attempted to have new Macy's credit cards shipped to them in Plaintiff's name. Id. On May 1, 2014, the identity thieves successfully changed the address on Plaintiff's Macy's credit card to an address in their control. Id. ¶ 56. Plaintiff was required to expend time and effort in order to revert the changes the identity thieves had made to his Macy's credit card account. Id. Eventually, Plaintiff closed his Macy's credit card account, which required more time and effort. Id. ¶ 57.

On July 4, 2014, an identity thief was able to obtain a job at United Parcel Service of America ("UPS") using Plaintiff's name. Id. ¶ 59. On July 7, 2014, the identity thieves used newly-opened credit card accounts, opened in Plaintiff's name, to make overseas purchases in the Republic of Ireland. Id. ¶ 58. Shortly thereafter, CCE and Coca-Cola Co. contacted Plaintiff and offered him an upgrade to the credit monitoring service originally provided to him. Id. ¶ 60.

Plaintiff brings ten claims on behalf of himself and all others similarly situated. Plaintiff alleges (1) violation of the Driver's Privacy Protection Act, 18 U.S.C. § 2724 (2012), (2) negligence, (3) negligent misrepresentation, (4) fraud, (5) breach of express contract, (6) breach of implied contract, (7) breach of covenant of good faith and fair dealing, (8) unjust enrichment, (9) bailment, and (10) civil conspiracy. Plaintiff claims that he has suffered these injuries due to the negligence of the Coke Defendants in retaining and safeguarding his PII. Compl. ¶¶ 87-90. He further alleges that the Coke Defendants breached their contractual relationship with him when they failed to maintain the security of his PII. Id. ¶¶ 105-29. Plaintiff claims that, after the theft of the laptops containing his PII, the Coke Defendants engaged in misrepresentation, fraud, and conspiracy against him by failing to disclose the true extent of the data breach. Id. ¶¶ 91-104, 134-38. Finally, Plaintiff argues that among his lost PII was his personal driver information, the loss of which constitutes a violation of the Driver's Privacy Protection Act. 18 U.S.C. § 2724 (2012); id. ¶¶ 76-86. Plaintiff seeks actual, punitive, treble, and statutory damages for these harms. Compl. ¶¶ 36-37.

II. Legal Standard

A. Motion to dismiss for lack of standing pursuant to Rule 12(b)(1)

A defendant may move to dismiss an action for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) if the plaintiff lacks standing under Article III of the constitution. Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 101-02, 118, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). Article III limits the jurisdiction of federal courts to "actual cases and controversies," U.S. Const. art. III, § 2, and one element of this "bedrock requirement" is that plaintiffs "must establish that they have standing to sue." Reilly v. Ceridian Corp., 664 F.3d 38, 41 (3d Cir.2011) (quoting Raines v. Byrd, 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997)). Only if the following requirements are met does a plaintiff have standing to bring a claim:

Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (internal citations omitted) (quotation marks omitted).

Each of these elements and the terms used to describe them "cannot be defined so as to make application of the constitutional standing requirement a mechanical exercise." Allen v. Wright, 468 U.S. 737, 751, 104 S.Ct. 3315, 82 L.Ed.2d 556 (1984), abrogated on other grounds by Lexmark Int'l, Inc. v. Static Control Components, Inc., ___ U.S. ___, 134 S.Ct. 1377, 188 L.Ed.2d 392 (2014). To determine whether a plaintiff has Article III standing, courts must look to guiding principles laid out in prior case law. Id. at 752, 104 S.Ct. 3315 (explaining that "[d]etermining standing in a particular case may be facilitated by clarifying principles or even clear rules developed in prior cases").

It is the plaintiff's burden to demonstrate these three elements of standing, and if the plaintiff is unable to establish any element of this test, the claim must be dismissed. Danvers Motor Co., Inc. v. Ford Motor Co., 432 F.3d 286, 290-91 (3d Cir. 2005). Further, "[s]ince they are not mere pleading requirements but rather an indispensable part of the plaintiff's case, each element must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e., with the manner and degree of evidence required at the successive stages of the litigation." Lujan, 504 U.S. at 561, 112 S.Ct. 2130. Therefore, at the pleading stage, a complaint need only contain "general factual allegations of injury resulting from the defendant's conduct ... for on a motion to dismiss [courts] `presum[e] that general allegations embrace those specific facts that are necessary to support the claim.'" Id. (quoting Lujan v. Nat'l Wildlife Fed'n, 497 U.S. 871, 889, 110 S.Ct. 3177, 111 L.Ed.2d 695 (1990)).

When a question of standing is raised in a putative class action, "named plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent." Lewis v. Casey, 518 U.S. 343, 357, 116 S.Ct. 2174, 135 L.Ed.2d 606 (1996) (quoting Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 40 n. 20, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976) (internal quotation marks omitted)). Furthermore, a "plaintiff may not maintain an action on behalf of a class against a specific defendant if the plaintiff is unable to assert an individual cause of action against that defendant." Haas v. Pittsburgh Nat'l Bank, 526 F.2d 1083, 1086 n. 18 (3d Cir.1975). Finally, "[a] plaintiff who raises multiple causes of action `must demonstrate standing for each claim he seeks to press.'" In re Schering Plough Corp. Intron/Temodar Consumer Class Action, 678 F.3d 235, 245 (3d Cir.2012) (quoting DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 352, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006)).

B. Motion to dismiss for failure to state a claim pursuant to Rule 12(b)(6)

The defendant bears the burden of demonstrating that a plaintiff has failed to state a claim upon which relief can be granted. Hedges v. United States, 404 F.3d 744, 750 (3d Cir.2005) (citing Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir.1991)). This Court must "accept all factual allegations as true, construe the complaint in the light most favorable to the plaintiff, and determine whether, under any reasonable reading of the complaint, the plaintiff may be entitled to relief." See Phillips v. Cnty. of Allegheny, 515 F.3d 224, 233 (3d Cir.2008) (quoting Pinker v. Roche Holdings Ltd., 292 F.3d 361, 374 n. 7 (3d Cir.2002)) (internal quotation marks omitted).

In Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007), the Supreme Court recognized that "a plaintiff's obligation to provide the `grounds' of his `entitle[ment] to relief' requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." 550 U.S. at 555, 127 S.Ct. 1955 (citing Papasan v. Allain, 478 U.S. 265, 286, 106 S.Ct. 2932, 92 L.Ed.2d 209 (1986)). In Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009), the Court subsequently laid out a two-part approach to reviewing a motion to dismiss under Rule 12(b)(6).

First, the Court observed, "the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions." Id. at 678, 129 S.Ct. 1937. Thus, "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice" to survive the motion; "instead, `a complaint must allege facts suggestive of [the proscribed] conduct.'" Id.; Phillips, 515 F.3d at 233 (quoting Twombly, 550 U.S. at 563 n. 8, 127 S.Ct. 1955). While Rule 8, which requires only "a short and plain statement of the claim showing that the pleader is entitled to relief," was "a notable and generous departure from the hyper-technical, code-pleading regime of a prior era, ... it does not unlock the doors of discovery for a plaintiff armed with nothing more than conclusions." Iqbal, 556 U.S. at 678-79, 129 S.Ct. 1937 ("Rule 8 ... demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation." (citing Twombly, 550 U.S. at 555, 127 S.Ct. 1955)); see Fed. R. Civ. P. 8(a)(2). For "without some factual allegation in the complaint, a claimant cannot satisfy the requirement that he or she provide not only `fair notice' but also the `grounds' on which the claim rests." Phillips, 515 F.3d 224, 232 (citing Twombly, 550 U.S. at 555 n. 3, 127 S.Ct. 1955).

Second, the Court emphasized, "only a complaint that states a plausible claim for relief survives a motion to dismiss. Determining whether a complaint states a plausible claim for relief ... [is] a context-specific task that requires the reviewing court to draw on its judicial experience and common sense." Id. at 678, 129 S.Ct. 1937. Only if "the `[f]actual allegations ... raise a right to relief above the speculative level'" has the plaintiff stated a plausible claim. Phillips, 515 F.3d at 234 (quoting Twombly, 550 U.S. at 555, 127 S.Ct. 1955). This is because Rule 8(a)(2) "requires not merely a short and plain statement, but instead mandates a statement `showing that the pleader is entitled to relief.'" See id., 515 F.3d at 234 (quoting Fed. R. Civ. P. 8(a)(2)). If "the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged — but it has not `show[n]' — `that the pleader is entitled to relief.'" Iqbal, 556 U.S. at 679, 129 S.Ct. 1937 (quoting Fed. R. Civ. P. 8(a)(2)). "Detailed factual allegations" are not required, id. at 678, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 555, 127 S.Ct. 1955), but a claim must be "nudged ... across the line from conceivable to plausible," id. at 680, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 570, 127 S.Ct. 1955).

"The plausibility standard is not akin to a `probability requirement,'" but there must be "more than a sheer possibility that a defendant has acted unlawfully." Id. at 678, 129 S.Ct. 1937 (quoting Twombly, 550 U.S. at 556, 127 S.Ct. 1955). "Where a complaint pleads facts that are `merely consistent with' a defendant's liability, it `stops short of the line between possibility and plausibility of "entitlement to relief."'" Id. (quoting Twombly, 550 U.S. at 557, 127 S.Ct. 1955)).

III. Plaintiff's allegations are sufficient to establish constitutional standing.

The Coke Defendants attack Plaintiff's standing under the first two elements of the standing test: injury-in-fact and causal connection. Defs.' Mem. Supp. Mot. Dismiss 5-16, ECF No. 10-1. First, the Coke Defendants assert that all future harms that Plaintiff may suffer from the loss of his PII and the preparations he has made in anticipation of these harms are speculative, hypothetical, and not an injury-in-fact. Id. Second, the Coke Defendants claim that even if Plaintiff has suffered an injury-in-fact from the alleged misuse of his PII that has already occurred, these injuries are not fairly traceable to the conduct of the Coke Defendants and the claim should therefore be dismissed, for if Plaintiff cannot show a causal connection between his complained-of injuries and the Coke Defendants conduct, he does not have standing to assert his claims. Id. This Court will discuss each challenge to Plaintiff's standing in turn.

A. Plaintiff has sufficiently alleged an injury-in-fact.

First, the Coke Defendants argue that all of Plaintiff's claims are founded on future harms or increased risk of future harm, rather than any injury-in-fact, and therefore should be dismissed. Defs.' Mem. Supp. Mot. Dismiss 11.

An injury-in-fact sufficient to establish Article III standing must be "distinct and palpable" as opposed to "abstract," and the "alleged harm must be actual or imminent, not conjectural or hypothetical." Whitmore v. Ark., 495 U.S. 149, 155, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990). A plaintiff lacks standing if the injury alleged arises from an "indefinite risk of future harms inflicted by unknown third parties." Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir.2011) (finding no injury-in-fact in an identity theft case where the plaintiff's PII may have been accessed but had not yet been misused); Allison v. Aetna, Inc., No. Civ. A. 09-2560, 2010 WL 3719243, at *6 (E.D.Pa. Mar. 9, 2010) (holding that the plaintiff lacked standing where online phishing scam compromised the plaintiff's PII but the plaintiff had not yet suffered concrete harm).

In Clapper v. Amnesty Int'l, USA, the Supreme Court found that for a risk of future harm to constitute an injury-in-fact, the future harm must be "certainly impending." ___ U.S. ___, 133 S.Ct. 1138, 1147-48, 185 L.Ed.2d 264 (2013) (finding plaintiffs' "objectively reasonable fear" that they would suffer harm in the future insufficient to establish standing). However, the risk of harm need not be "literally certain" to constitute an injury-in-fact; a "substantial risk harm will occur" is sufficient. Id. at 1150 n. 5; Susan B. Anthony List v. Driehaus, ___ U.S. ___, 134 S.Ct. 2334, 2341, 189 L.Ed.2d 246 (2014) (holding that the existence of a "substantial risk" that harm would occur was sufficient to confer Article III standing). There is no substantial risk of harm if an attenuated chain of events would need to occur to bring rise to the harm, making the possibility of harm occurring "mere speculation." Clapper, 133 S.Ct. at 1148.3 The court in Reilly, which analyzed the basis for a plaintiff's purported standing in an identity theft case, stated similarly that, "allegations of possible future injury are not sufficient to establish Article III standing. Instead, a threatened injury must be certainly impending, and proceed with a high degree of immediacy, so as to reduce the possibility of deciding a case in which no injury would have occurred at all." Reilly, 664 F.3d at 40.

Here, Plaintiff's harms are not "future harms," but ongoing, present, distinct, and palpable harms. See Clapper, 133 S.Ct. at 1148. Unlike in Reilly or Clapper, where the possibility that the plaintiffs would suffer any concrete harm was "speculative" and "hypothetical," see Clapper, 133 S.Ct. at 1148; Reilly, 664 F.3d at 38, Plaintiff here has already suffered palpable harm, including the alleged theft of funds from his bank accounts on two occasions, unauthorized use of four credit cards, and the unauthorized issuance of new credit cards in Plaintiff's name.4 Compl. ¶¶ 50-62. Courts that have passed on claims arising out of the loss or theft of PII have hesitated to find the existence of a constitutional injury-in-fact before lost PII is actually misused, but a number of courts have found that plaintiffs who have already suffered identifiable identity attacks, by contrast, have standing to advance their claims. See, e.g., In re Target Corp. Data Security Breach Litig., 66 F.Supp.3d 1154, 1159 (D.Minn.2014) (finding plaintiffs to have standing where their credit cards were used to make unauthorized purchases); In re Zappos.com, Inc., No. 3:12-CV-00325, 2013 WL 4830497, at *3 (D.Nev. Sept. 9, 2013) (finding the existence of standing where the plaintiffs suffered "actual fraud or identity theft"); Holmes v. Countrywide Fin. Corp., No. 5:08-CV-00205, 2012 WL 2873892, at *5 (W.D.Ky. July 12, 2012) (finding that the plaintiffs had suffered an injury-in-fact because they were required to expend time and money to protect their identity).

Indeed, the court in FTC v. Wyndham Worldwide Corp., 10 F.Supp.3d 602, 623-624 (D.N.J.2014), distinguished such cases from Reilly, concluding that the plaintiffs in that case had alleged an injury-in-fact by virtue of their allegations their PII had been misused, which was unlike the mere risk of future harm identified in Reilly. Compare FTC, 10 F.Supp.3d at 623-24 (finding the presence of an actionable injury-in-fact where third-party identity thieves used PII stolen from the defendant to make unreimbursed fraudulent charges on plaintiffs' credit and banking accounts, which required them to spend time, effort, and money to close the accounts), with Reilly, 664 F.3d at 45 (holding that the plaintiff suffered no actionable injury-in-fact where the plaintiff's PII was accessed but had not yet been used for any fraudulent or unlawful activity). Here, Plaintiff has suffered no mere abstract or hypothetical injury in light of the fact that his bank and credit accounts were used to make unreimbursed, fraudulent purchases, requiring him to expend time, effort, and money to combat these incidents. See Compl. ¶¶ 50-59.

The Coke Defendants also argue that Plaintiff lacks standing because his efforts to combat his exposure to future harms do not constitute an actionable injury-in-fact. Defs.' Mem. Supp. Mot. Dismiss 14.

Plaintiffs "cannot manufacture standing by choosing to make expenditures based on hypothetical future harm that is not certainly impending." Clapper, 133 S.Ct. at 1143. That is to say, "costs incurred to prevent future harm is not enough to confer standing." Id. at 1150-51. The United States Court of Appeals for the Third Circuit has explained the application of this principle to cases arising out of losses of electronic information, recognizing that "costs incurred to watch for a speculative chain of future events based on hypothetical future criminal acts are no more `actual' injuries than the alleged `increased risk of injury.'" Reilly, 664 F.3d at 46.

As this Court has observed, Plaintiff's injuries and attempt to prevent future, similar injuries are not founded on "speculative" or "hypothetical" concerns. Id. The Reilly court found that plaintiffs who incurred expenses monitoring their accounts and protecting their personal and financial information "[without] any actual injury (e.g. because their private information was misused or their identities stolen)" lacked standing because "[s]uch misuse is only speculative — not imminent." Id. Here, Plaintiff incurred an expense in connection with his action to close his bank account in response to unauthorized access. Compl. ¶ 51. Plaintiff also expended time and effort protecting other credit cards and bank accounts from the identity thieves, id. ¶¶ 50-61, which Plaintiff did in response to ongoing harms, not harms that were merely "hypothetical." See Reilly, 664 F.3d at 46. Plaintiff, therefore, has sufficiently pled the existence of an injury-in-fact both for the concrete damages he has already suffered and for the expenditures he has made to combat these actual, imminent, and impending harms.

B. Plaintiff has alleged a sufficient causal relationship between Plaintiff's injuries and Defendants' alleged conduct.

The Coke Defendants assert that Plaintiff's harms are not causally connected to their conduct, which deprives Plaintiff of Article III standing. Defs.' Mem. Supp. Mot. Dismiss 7. The Coke Defendants make three arguments in support: first, the time period between the end of Plaintiff's employment with Keystone Coke (2007) and the start of the misuse of Plaintiff's PII (2014) is too great to fairly trace Plaintiff's injuries to the conduct of the Coke Defendants. Id. 7-9. Second, no Coke Defendant (besides Plaintiff's employer, Keystone Coke) had any relation to the harm suffered sufficient to confer standing. Id. 7-11. Third, the information lost on the laptops was insufficient to give rise to the types of harms Plaintiff suffered. Id. 8-11. The Court will discuss each of the arguments in turn.

"The `case or controversy' limitation of Article III still requires that a federal court act only to redress injury that fairly can be traced to the challenged action of the defendant, and not injury that results from the independent action of some third party not before the court." Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 41-42, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976). The Court of Appeals for the Third Circuit has held that "[t]he second requirement of [Article] III standing, causation, requires that the alleged injury-in-fact is causally connected and traceable to an action of the defendant ..." Edmonson v. Lincoln Nat. Life Ins. Co., 725 F.3d 406, 415 (3d Cir.2013) (citing Pitt News v. Fisher, 215 F.3d 354, 360 (3d Cir.2000)); see also Lujan, 504 U.S. at 560, 112 S.Ct. 2130. This means the plaintiff's injury must be "fairly traceable to the defendant's allegedly unlawful conduct." Allen, 468 U.S. at 738, 104 S.Ct. 3315 (emphasis added). The "fairly traceable" requirement of Article III causation has been described as "akin to `but for' causation," thus the Third Circuit Court of Appeals has also "found the traceability requirement [is] met even where the conduct in question might not have been a proximate cause of the harm, due to intervening events." Edmonson, 725 F.3d at 418; (citing Pitt News, 215 F.3d at 360).

First, the Coke Defendants argue that Plaintiff's injuries are not fairly traceable to the Coke Defendants because Plaintiff's employment with Keystone Coke ended more than seven years ago and his data was not allegedly misused until recently. Defs.' Mem. Supp. Mot. Dismiss 7-11. The Court does not agree.

The Coke Defendants frame this argument as an attack on Plaintiff's ability to show "but for" causation, claiming that, because of the passage of time, there is no "but for" connection between Plaintiff's stolen identity and the loss of his PII by the Coke Defendants. Defs.' Mem. Supp. Mot. Dismiss 7-11. Plaintiff, however, needs only "general factual allegations of injury resulting from the defendant's conduct." Lujan, 504 U.S. at 561, 112 S.Ct. 2130; see also In re Target, 66 F.Supp.3d at 1160 ("[A]t the motion-to-dismiss stage, Plaintiffs need only plausibly allege that they can establish the elements of standing."). Additionally, courts are generally lenient in applying the "but for" causation requirement at this early stage of litigation. See U.S. ex rel. Krahling v. Merck & Co., Inc., 44 F.Supp.3d 581, 602 (E.D.Pa. 2014) (finding plaintiff's general allegations that "but for" the defendant's fraudulent misrepresentation plaintiff would not have suffered harm, sufficient to satisfy the causation requirement of Article III); see also Pitt News, 215 F.3d at 360-61 (finding traceability requirement met where "but for" allegations were general and there were numerous intervening causes). Here, Plaintiff has made general allegations that, "but for" the Coke Defendants mishandling his PII, it would not have been lost. Compl. ¶¶ 4-6, 17, 44, 49, 50, as well as general allegations that "but for" the Coke Defendants' misrepresentations and breach of contract, he would not have suffered harm. Id. ¶¶ 91-138.

Where courts have dismissed claims for lacking the requisite presence of "but for" causation, the dismissal is generally based on the conclusion that "the links in the chain of causation ... are far too weak for the chain as a whole to sustain respondants' standing." Allen, 468 U.S. at 759, 104 S.Ct. 3315 (holding that the causation requirement was not met in an action involving "numerous third parties ... whose collective decisions may not have a significant effect" on the alleged harm); see also Warth v. Seldin, 422 U.S. 490, 509, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975) (finding plaintiffs lacked standing where causal link between zoning ordinances and financial harm was not apparent from the complaint). Although seven years passed between Plaintiff's employment and the misuse of his information, the chain linking the loss of Plaintiff's SSN, credit cards, and banking information, and the subsequent identity attacks Plaintiff suffered, is plausible. Compl. ¶¶ 32, 49. The connection between the loss of sensitive PII like SSN and banking information and subsequent identity attacks is apparent from Plaintiff's complaint. See Warth, 422 U.S. at 509, 95 S.Ct. 2197; Compl. ¶¶ 4-6, 17, 44, 49, 50. Because Plaintiff needs only "general factual allegations of injury resulting from the defendant's conduct," Lujan, 504 U.S. at 561, 112 S.Ct. 2130, and the "links in the chain" of causation, see Allen, 468 U.S. at 759, 104 S.Ct. 3315, between the Coke Defendants' conduct and Plaintiff's harm are not too attenuated, the Court finds Plaintiff has sufficiently alleged "but for" causal connection to satisfy the requirements of Article III at this stage of the proceeding.

Next, the Coke Defendants argue that no Coke Defendant other than Plaintiff's direct employer, Keystone Coke, had any relation to Plaintiff or his PII, so Plaintiff's harm cannot be fairly traced to the other Coke Defendants' alleged misconduct. Defs.' Mem. Supp. Mot. Dismiss 8-9.

The Coke Defendants largely rely on Polanco v. Omnicell, Inc., 988 F.Supp.2d 451, 463-65 (D.N.J.2013). In Polanco, one defendant, Sentara, moved for dismissal under 12(b)(1) for failing to satisfy the causation element of standing, arguing that the plaintiff failed to allege that Sentara, a healthcare provider, had ever treated or interacted with the plaintiff or that Sentara had ever held or transferred the plaintiff's personal health information. Id. at 464. The court dismissed Sentara from the action, finding that the harm the plaintiff alleged to have occurred following the loss of his personal information was not fairly traceable to Sentara because Sentara played no part in the chain of events that led to the loss of the plaintiff's personal health information. Id.

But Sentara's position is not analogous to the position of any of the Coke Defendants. Plaintiff has plausibly alleged that each Coke Defendant either held or transferred Plaintiff's PII at some time during the events that allegedly led to Plaintiff's injuries. Compl. ¶¶ 15-19. Keystone Coke, Plaintiff's employer, was a subsidiary of CCE by the end of 2007. Id. ¶ 18. In 2010, Coca-Cola Co. purchased the North American operations of CCE. Id. ¶ 19. Plaintiff's PII was then given to CCR by Coca-Cola Co. and allowed to reside on "laptops assigned to current CCR and former CCE users." Id. ¶¶ 2, 4-6, 44, 49; id. Ex. A, at 1.5 Plaintiff alleges that his PII was stolen from "one or more of the Coke defendants," including "[Coca-Cola Co.], CCE, CCR, and Keystone Coke," making plausible his claim that any or all of the Coke Defendants controlled his PII at one point. Id. ¶¶ 16, 44. These allegations are sufficient to establish, at the pleading stage, causation for the purposes of standing. Furthermore, Coca-Cola Co. and CCR's letter to Plaintiff informing him of the data breach strengthens the argument that at least Coca-Cola Co. and CCR held or were responsible for Plaintiff's PII at some point.6 Id. Ex. A, at 1.

Courts analyzing cases involving the loss of PII have consistently declined to dismiss claims on the basis of a lack of a sufficient causal connection where the defendant has some direct control over the plaintiff's PII. See, e.g., In re Adobe Systems, Inc. Privacy Litigation, 66 F.Supp.3d 1197, 1220-21 (N.D.Cal.2014) (holding that plaintiffs have standing for declaratory relief claims because defendant's failure to take adequate security measures was fairly traceable to subsequent identity theft); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 903 F.Supp.2d 942, 959 (S.D.Cal.2012) (finding sufficient causation to confer standing where the defendant stored and lost plaintiffs' PII, even though the plaintiffs did not allege the defendant promised to securely retain their PII); In re Target, 66 F.Supp.3d at 1159 (finding standing where customer's credit card information was held by the defendant and eventually stolen from the defendant's computers); In re Zappos, 2013 WL 4830497, at *3 (finding sufficient level of causation).

Here, Plaintiff plausibly alleges that each Coke Defendant had direct control over the laptop or laptops containing his PII at some time prior to the theft. Compl. ¶¶ 15-19, 44. Furthermore, Plaintiff has factually alleged that all of the named Coke Defendants contractually agreed to protect his PII. Id. ¶¶ 42, 105-29. He has further alleged that he was misled, conspired against, and defrauded by all of the Coke Defendants in connection with the loss of his PII. Id. ¶¶ 91-138. As such, this court cannot accept the Coke Defendants' argument that the loss of Plaintiff's PII is not fairly traceable to anyone but Plaintiff's direct employer, Keystone Coke.

Finally, the Coke Defendants argue the PII held by the Coke Defendants was insufficient to enable the identity thieves to commit the types of identity attacks on Plaintiff's identity that he allegedly suffered, such that Plaintiff's injury is not fairly traceable to the conduct of the Coke Defendants. Defs.' Mem. Supp. Mot. Dismiss 9-10.

The Coke Defendants supply reasoning from In re Science Applications International Corp. (SAIC) Backup Tape Data Theft Litigation., wherein the court decided that even the plaintiffs who had suffered an injury-in-fact from identity attacks following a loss of their personal information had failed to demonstrate that the harm they suffered was fairly traceable to the conduct of the defendants. 45 F.Supp.3d 14, 31-32 (D.D.C.2014). In SAIC, the plaintiffs did not allege that their bank account or credit card information was stolen, yet they suffered financial injuries that could have been caused only by the loss of these pieces of PII. Id. The court concluded that there was no causal connection between the financial harm the plaintiffs in SAIC suffered and the loss of PII that did not include banking or credit card information. Id. SAIC, however, is not analogous to the present case. Plaintiff has alleged that, as part of his employment agreement with the Coke Defendants, he was required to give his full legal name, address, SSN, bank account information, credit card information, driver's license, driving records, and date of birth to the Coke Defendants. Compl. ¶¶ 32, 49. Plaintiff alleges that, with this information, the identity thieves allegedly stole money directly from his bank account, opened new credit cards in his name, and obtained employment in his name. Id. ¶¶ 50-65. Another court in this Circuit has found that the loss of a SSN, even without concurrent loss of banking and credit card information, was sufficient to enable a third party to engage in the types of attacks Plaintiff suffered. In re Horizon Healthcare Servs., Inc. Data Breach Litig., No. 13-7418, 2015 WL 1472483 *9 (D.N.J. Mar. 31, 2015) (explaining that identity thieves could use the plaintiff's stolen SSN to open new credit cards in the plaintiff's name, making this type of injury fairly traceable to conduct of the defendant). Here, in light of the information that Plaintiff alleges the Coke Defendants lost, the Court finds the unauthorized access of Plaintiff's bank accounts, the opening of new cards in his name, and the job obtained in Plaintiff's name, are, at this time, fairly traceable to the conduct of the Coke Defendants.

Defendants further argue that Plaintiff did not provide his Macy's and Fingerhut credit card information to the Coke Defendants, so any unauthorized access of these cards cannot be fairly traced to the conduct of the Coke Defendants. Defs.' Mem. Supp. Mot. Dismiss 9-10. Plaintiffs have been found to lack standing in data breach cases where the stolen data cannot be used to create the specific types of harm the plaintiffs have suffered: "[Plaintiff's] current credit card information ... was not on the stolen laptops ... Thus, any harm stemming from the fraudulent use of [plaintiff's] current credit card is not `fairly traceable' to [the defendant]." Horizon Healthcare Services, 2015 WL 1472483, at *9; see also SAIC, 45 F.Supp.3d at 31-32 (holding that no causal connection existed where the information stolen from defendant could not be used to cause the type of financial harm the plaintiff suffered). Plaintiff does not allege he gave any of the Coke Defendants his Macy's and Fingerhut credit card information. As such, there is no causal connection between the information Plaintiff gave to the Coke Defendants and the identity thieves' ability to access Plaintiff's Macy's and Fingerhut credit cards for identity theft purposes. SAIC, F.Supp.3d at 31-32; Compl. ¶¶ 50-65.

Nevertheless, Plaintiff has sufficiently pled other types of harms including unauthorized access to his bank account and other unauthorized uses of his identity that could be fairly traced to the PII allegedly lost by the Coke Defendants. Compl. ¶¶ 50-65. Although "plaintiffs must demonstrate standing for each form of relief sought," this does not mean plaintiffs must establish each of their damage claims at the pleadings stage in order to have standing to assert their claims. Friends of the Earth, Inc. v. Laidlaw Envtl. Servs (TOC), Inc., 528 U.S. 167, 185, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) (emphasis added). The question of whether a plaintiff has fairly established an injury-in-fact for standing purposes is a separate issue from whether a plaintiff has sufficiently alleged a basis for relief for each claim of damages. See Krottner v. Starbucks Corp., 406 Fed. Appx. 129, 130-31 (9th Cir.2010) (differentiating between a plaintiff's ability to sufficiently plead an injury-in-fact for purposes of Article III standing and failure to adequately plead damages for state law claims); Pisciotta v. Old Nat'l Bancorp., 499 F.3d 629, 633-34 (7th Cir.2007) (finding that plaintiffs had standing to proceed but dismissing claims for insufficiently alleging injuries claimed); Holmes, 2012 WL 2873892 at *5 ("Even if [p]laintiffs have constitutional standing, they may still have failed to describe a basis for relief."). Although Plaintiff cannot establish all damage claims, Plaintiff has established injury fairly traceable to the Coke Defendants sufficient to confer standing for each of his ten claims, thus Plaintiff has established standing to proceed with his claims. See In re Schering Plough, 678 F.3d at 245 (holding that plaintiffs must establish standing for each claim or cause of action) (emphasis added).

Thus, Plaintiff has successfully alleged he has suffered an injury-in-fact that is fairly traceable to the conduct of the Coke Defendants. As such, Plaintiff has shown he has constitutional Article III standing under 12(b)(1) sufficient to advance his claims in this Court.

IV. Defendants' motion to dismiss for failure to state a claim

A. Plaintiff has failed to state a claim for a violation of the Driver's Privacy Protection Act.

Plaintiff asserts a cause of action under the Driver's Privacy Protection Act ("DPPA"), claiming that the Coke Defendant's loss of PII, which included Plaintiff's motor vehicle records, driver's license information, and his SSN, constituted a violation of this Act. But Plaintiff's Complaint does not state a claim for relief under this Act, and this claim will therefore be dismissed.

The DPPA prohibits the disclosure of a person's driving information ("PDI") by a state department of motor vehicles or any officer, employee, or contractor thereof. 18 U.S.C. § 2721 (2012). PDI includes an "individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information ..." Id. 2725(3). The DPPA also prohibits a business from disclosing PDI for a use that is not included in the list of permissible uses enumerated by the Act. Id. 2721(b)(3). Section 2724(a) of the DPPA creates civil liability for a defendant who "(1) knowingly obtains, discloses, or uses personal information; (2) from a motor vehicle record; and (3) for a purpose not permitted." Id. 2724(a).

The Coke Defendants argue that Plaintiff voluntarily provided his PDI to the Coke Defendants, so they are not liable under the DPPA. Defs.' Mem. Supp. Mot. Dismiss 16-19. The Coke Defendants cite to numerous cases to support their argument that PDI provided voluntarily by individuals, rather than disclosed by state departments or agencies, is not subject to the restrictions of the DPPA. Id. at 18 (citing Hurst v. State Farm Mut. Auto. Ins. Co., No. 10-1001, 2012 WL 426018, at *1 (D.Del. Feb. 9, 2012), aff'd, No. 12-1654 (3d Cir. Oct. 24, 2012); Lake v. Neal, No. 07-2742, 2008 WL 4442603, at *3 (N.D.Ill. Sept. 29, 2008) (holding voluntary disclosure of DPI by an individual does not give rise to a DPPA violation); accord Ocasio v. Riverbay Corp., No. 06-4655, 2007 WL 1771770, at *6 (S.D.N.Y. June 19, 2007) (holding that no liability existed under the DPPA where driving records in question were not obtained from state agency); O'Brien v. Quad Six, Inc., 219 F.Supp.2d 933 (N.D.Ill.2002)). However, Plaintiff has alleged that he provided the Coke Defendants with authorization to obtain his PDI from the Department of Motor Vehicles ("DMV"). Compl. ¶¶ 16, 18, 49, 77-78. It is not unreasonable to assume that, after being provided authorization, Defendant did obtain Plaintiff's records from the DMV, thus giving rise to potential liability under the DPPA for all non-permissible disclosures made by the Coke Defendants. See 18 U.S.C. § 2724(a); Pichler v. UNITE, 542 F.3d 380, 394-95 (3d Cir.2008) (concluding that union workers who collected employee license plate numbers, then used these numbers to obtain employees' addresses from motor vehicle records could be held liable for obtaining these addresses). But, Plaintiff's claim ultimately fails for a different reason: the Coke Defendants' loss of Plaintiff's PII did not constitute a "knowing disclosure" of Plaintiff's PDI, which is a prerequisite to liability under the DPPA.

A disclosure of PII constitutes a violation of the DPPA only if that disclosure was a "knowing disclosure." 18 U.S.C. § 2724(a). A "knowing disclosure" of PDI requires the defendant to take some "voluntary action" to disclose the information. Senne v. Vill. of Palatine, Ill., 695 F.3d 597, 603 (7th Cir.2012) (citing Pichler, 542 F.3d at 394-95). This requirement does not mean, however, that the disclosing party knows that the disclosure is potentially illegal, nor must third parties actually see the disclosed information for the disclosure to constitute a violation. See Pichler, 542 F.3d at 396-97 (holding liability for any voluntary action, not knowledge of illegality or potential consequences); see also Senne, 695 F.3d at 597 (finding voluntary disclosure under DPPA where a police officer placed tickets containing PDI on drivers' windshields, in plain view of the public). Plaintiff largely relies on Senne, claiming that by entrusting an employee with Plaintiff's records in an unsecured, electronic format, the Coke Defendants made the records accessible to the world in much the same way as the police officer in Senne made the drivers' information available to third parties. See Senne, 695 F.3d at 597; Pl.'s Resp. Opp'n. 32. The Court disagrees.

In Senne, traffic citations containing PDI were placed on the windshields of the plaintiffs' cars. Id. at 602-03. The PDI was thus displayed in a public manner, available for all pedestrians and passersby to see. Id. Here, Plaintiff's PDI was not displayed to the public, but kept within the company and its subsidiaries on unsecured laptops. See Compl. ¶¶ 16, 24, 80, 81. Although the Coke Defendants may have been able to take further precautions to protect Plaintiff's PDI, unsecured information on privately held laptops is far different from "placing the information on the windshield of the vehicle in plain view on a public way ..." See Senne, 695 F.3d at 603. Therefore, the Court finds that privately holding PDI, even in an unsecured manner, does not constitute a "voluntary disclosure" under the DPPA.

The Court is equally unpersuaded by Plaintiff's argument that the theft of the PDI constituted a "knowing disclosure" by the Coke Defendants. See 18 U.S.C. § 2724(a); Compl. ¶¶ 76-86. The theft of Plaintiff's PDI cannot be characterized as a "voluntary action" taken by the Coke Defendants to disclose that information. See Pichler, 542 F.3d at 380. Under similar circumstances, the court in Holmes v. Countrywide Fin. Corp., confronted with claims arising out of a loss of personal information after a data breach where "a ne'er-do-well independently stole [defendant's] customer information," held that under the Fair Credit Reporting Act, "no coherent understandings of the words `furnished' or `transmitted'" would give rise to liability under those circumstances. 2012 WL 2873892, at *16. This Court considers the present situation to be analogous to Holmes and finds that "no coherent understanding" of the word "disclose" or "voluntary action" would include theft. See id.

Plaintiff asserts in his opposition to the Coke Defendants' motion that the Coke Defendants transfer of the laptop or laptops containing his PII between different subsidiaries of Coca-Cola Co. amounts to a "voluntary action" giving rise to a "knowing disclosure" under the DPPA. Pl.'s Resp. Opp'n. 29-33. However, Plaintiff's Complaint cannot fairly be read to contain such factual allegations. See Eli Lilly & Co. v. Roussel Corp., 23 F.Supp.2d 460, 492 (D.N.J.1998) (deciding that claims made in the plaintiff's opposition to a motion to dismiss are not asserted in the complaint, and concluding that since a "complaint may not be amended by the briefs in opposition to a motion to dismiss, the Court must disregard these allegations") (quoting Car Carriers, Inc. v. Ford Motor Co., 745 F.2d 1101, 1107 (7th Cir. 1984)); see also Pennsylvania v. PepsiCo, Inc., 836 F.2d 173, 181 (3d Cir.1988) ("[T]he legal theories set forth in [Plaintiff's] brief are helpful only to the extent that they find support in the allegations set forth in the complaint."). In his complaint, Plaintiff does not describe any allegedly improper disclosure of Plaintiff's PDI by one Coke Defendant to another; rather, Plaintiff speaks in general terms about the "Coke [D]efendants" retention of his PDI and purported "disclosure" as a result of the theft of his PDI. Compl. ¶¶ 32-34, 76-86. Plaintiff's repeated reference to the Coke Defendants as a group belies any notion that Plaintiff alleged that one Coke Defendant acted unlawfully by disclosing his PDI to another Coke Defendant. This Court, therefore, dismisses Plaintiff's claim under the DPPA.

B. Plaintiff has failed to state a claim for negligence.

To state a claim for negligence under Pennsylvania law, a Plaintiff must allege: "(1) a duty recognized by law, requiring the actor to conform to a certain standard with respect to the injured party; (2) a failure of the actor to conform to that standard; (3) a causal connection between the conduct and the resulting injury; and (4) actual loss or damage to the interests of another." Felli v. Commw. Dep't. of Transp., 666 A.2d 775, 776 (Pa. Commw.Ct.1995). In Pennsylvania, a claim of negligence must survive Pennsylvania's "Economic Loss Doctrine" and Plaintiff's claim cannot.

"The Economic Loss Doctrine provides that no cause of action exists for negligence that results solely in economic damages unaccompanied by physical injury or property damage." Adams v. Copper Beach Townhome Communities, L.P., 816 A.2d 301, 305 (Pa.Super.Ct.2003) (citing Spivack v. Berks Ridge Corp., 402 Pa.Super. 73, 586 A.2d 402 (1991); Aikens v. Balt. & Ohio R.R. Co., 348 Pa.Super. 17, 501 A.2d 277 (1985)). "The rationale of the economic loss rule is that tort law is not intended to compensate parties for losses suffered as a result of a breach of duties assumed only by agreement." Palco Linings, Inc. v. Pavex, Inc., 755 F.Supp. 1269, 1271 (M.D.Pa.1990). The Third Circuit Court of Appeals and Pennsylvania state courts have applied the Economic Loss Doctrine in cases involving thefts of electronic, personal information, to bar the ability of the parties whose information was lost to recover in negligence. See Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 177-78 (3d Cir.2008) (holding that the Economic Loss Doctrine barred the plaintiff's claims in negligence arising out of a theft of credit card information where the plaintiff suffered only economic harm); see also Dittman v. UPMC, No. GD-14-003285, 2015 WL 4945713 (C.P. Allegheny Cty. May 28, 2015) (holding the Economic Loss Doctrine barred the plaintiff's recovery after a hospital lost plaintiff's personal and financial information). Here, Plaintiff does not assert that he has sustained any injury other than economic losses. Plaintiff contends, however, that his claims fall under the so-called "special relationship" exception to the Economic Loss Doctrine, such that the doctrine does not bar his claim. See Pl.'s Resp. Opp'n. 33-35.

Pennsylvania courts have found an exception to the Economic Loss Doctrine where the plaintiff and defendant are in a "special relationship." Valley Forge Convention & Visitors Bureau v. Visitor's Servs., Inc., 28 F.Supp.2d 947, 952 (E.D.Pa.1998). Courts have defined the special relationship exception as "confidentiality, the repose of special trust or fiduciary responsibilities." Id. In addition, "[the special relationship exception] generally involves a situation where by virtue of the respective strength and weakness of the parties, one has the power to take advantage of or exercise undue influence over the other." Id. (citing Estate of Evasew, 526 Pa. 98, 584 A.2d 910, 913 (1990)). The Valley Forge court further held special relationship does not apply to "parties to an arms-length business contract." 28 F.Supp.2d at 952-53. "[I]n determining whether a fiduciary duty arose in the context of an ordinary business transaction, courts must ask `whether the relationship goes beyond mere reliance on superior skill, and into a relationship characterized by overmastering influence on one side or weakness, dependence, or trust, justifiably reposed on the other side.'" My Space Preschool & Nursery, Inc. v. Capitol Indem. Corp., No. 14-826, 2015 WL 1185959, at *10 (E.D.Pa. Mar. 13, 2015) (quoting Valley Forge, 28 F.Supp.2d at 952).

Plaintiff insists that he was bound in a relationship of special trust with the Coke Defendants when he provided his PII as part of his employment contract. See Pl.'s Resp. Opp'n. 33-35. Plaintiff does not suggest in his Complaint that the Coke Defendants had any "fiduciary duty" to him. Compl. ¶¶ 87-90. Instead, Plaintiff asserts the existence of a standard employment contract between himself and the Coke Defendants. Id. ¶ 106. Courts are hesitant to allow an exception to the Economic Loss Doctrine when the Plaintiff can recover in contract. See, e.g., Sovereign Bank, 533 F.3d 177-78 (finding that Pennsylvania courts may allow an exception to the Economic Loss Doctrine where the plaintiff attempts to recover from a defendant "with whom the plaintiff has no contractual relationship, when the plaintiff has relied on that person's `special expertise ...'" but not where the parties were in a contractual relationship) (emphasis added) (quoting Bilt-Rite Contractors, Inc. v. The Architectural Studio, 581 Pa. 454, 866 A.2d 270, 286 (2005) see also Valley Forge, 28 F.Supp.2d at 953 ("If parties to routine arms length commercial contracts for the provision of needed goods or services were held to have a `special relationship,' virtually every breach of such a contract would support a tort claim.") (citing L & M Beverage Co. v. Guinness Imp. Co., CIV. A. 94-CV-4492, 1995 WL 771113, at *5 (E.D.Pa. Dec. 29, 1995)).

Additionally, Plaintiff is unable to provide any compelling argument that, in his employment contract, he was subject to "undue influence" by the Coke Defendants. Valley Forge, 28 F.Supp.2d at 952. Plaintiff asserts in his opposition brief that "[t]here was a mutual repose of special trust and confidentiality from the inception of this special relationship." Pl.'s Resp. Opp'n. 34 (emphasis added). There is no suggestion that in this exchange of "mutual" trust in a standard employment agreement that the Coke Defendants had "overmastering influence" over Plaintiff or that Plaintiff was in a position of "weakness or dependence." See Valley Forge, 28 F.Supp.2d at 952-53 (citing cases where a special relationship was found, including relationships between an attorney and his client, an 86 year old woman and her sole business counselor, and a guardian and his ward); see also My Space Preschool, 2015 WL 1185959, at *10. Because Plaintiff's employment agreement appears to be an "arms-length business contract" which is not classified as a special relationship, see Valley Forge, 28 F.Supp.2d at 952-53, and because Plaintiff has not sufficiently alleged any "undue power" that the Coke Defendants had over him, this Court finds that no special relationship exists between Plaintiff and the Coke Defendants. See id. at 952.7 As such, Plaintiff's claim for negligence is barred by the Economic Loss Doctrine, and this claim is dismissed with prejudice.

C. Plaintiff has failed to state a claim for negligent misrepresentation.

As with Plaintiff's negligence claim, Plaintiff's claim for negligent misrepresentation is barred by the Economic Loss Doctrine. Pennsylvania law is clear: "Pennsylvania allows suit for negligent misrepresentation, consistent with Section 552 of the Restatement (Second) of Torts, where such misrepresentation results in harm other than mere economic loss. However, the economic loss doctrine bars claims under Section 552 which result in solely economic loss." David Pflumm Paving & Excavating, Inc. v. Found. Servs. Co., 816 A.2d 1164, 1171 (Pa.Super.Ct.2003). Therefore, Plaintiff's claim for negligent misrepresentation is dismissed with prejudice.

D. Plaintiff has failed to state a claim for fraud.

Under Pennsylvania law, fraud is defined as: "(1) a representation; (2) which is material to the transaction at hand; (3) made falsely, with knowledge of its falsity or recklessness as to whether it is true or false; (4) with the intent of misleading another into relying on it; (5) justifiable reliance on the misrepresentation; and (6) the resulting injury was proximately caused by the reliance." Gibbs v. Ernst, 538 Pa. 193, 647 A.2d 882, 889 (1994). For claims of fraud brought in federal court Rule 9(b) requires plaintiffs to plead with particularity the "circumstances" of the alleged fraud ..." Seville Indus. Mach. Corp. v. Southmost Mach. Corp., 742 F.2d 786, 791 (3d Cir.1984) (quoting Fed. R. Civ. P. 9(b)). "Rule 9(b) serves to give defendants `notice of the claims against them, provide[ ] an increased measure of protection for their reputations, and reduce[ ] the number of frivolous suits brought solely to extract settlements.'" In re Suprema Specialties, Inc. Sec. Litig., 438 F.3d 256, 270 (3d Cir.2006) (quoting In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1418 (3d Cir.1997)). In order to meet the heightened pleading requirements of Rule 9(b), a plaintiff may plead with particularity the "`time, place and manner' of each of the defendants' fraudulent statements or actions." Ethanol Partners Accredited v. Wiener, Zuckerbrot, Weiss & Brecher, 635 F.Supp. 18, 22 (E.D.Pa.1985) (quoting Fed. R. Civ. P. 9(b)). Although, "[i]t is certainly true that allegations of `date, place or time' fulfill these functions, [] nothing in the rule requires them. Plaintiffs are free to use alternative means of injecting precision and some measure of substantiation into their allegations of fraud." Seville Indus., 742 F.2d at 791 (quoting Fed. R. Civ. P. 9(b)). At a minimum, however, Rule 9(b) requires "that the plaintiff identify the speaker of the allegedly fraudulent statements." Klein v. General Nutrition Cos., 186 F.3d 338, 345 (3d Cir.1999).

Plaintiff's Complaint does not indicate the time, place, manner, or name of any specific person who allegedly made fraudulent statements to him. The claim of fraud instead appears to utilize the "shotgun approach," containing only vague and general allegations against the Coke Defendants as a collective. See Ethanol Partners, 635 F.Supp. at 22 (finding that the heightened pleadings standard of Rule 9(b) to not be met where the complaint made vague assertions against a broad range of defendants); Compl. ¶¶ 91-104. Therefore, Plaintiff's claim for fraud is dismissed.

E. Plaintiff has stated a claim for breach of contract.

Under Pennsylvania law, the elements of breach of an express contract are: "1) the existence of a contract, including its essential terms, (2) a breach of a duty imposed by the contract, and (3) resultant damages." CoreStates Bank, N.A. v. Cutillo, 723 A.2d 1053, 1058 (Pa.Super.Ct.1999).

Plaintiff alleges that, as part of his employment contract with the Coke Defendants, there was a "mutual exchange of consideration whereby the Coke Defendants entrusted Plaintiff ... with access to the vehicles and equipment for the sale of one of America's most secure brands, Coca-Cola, in exchange for the promise of employment, with salary, benefits, and secure PII." Compl. ¶ 106. These allegations are sufficient to support the existence of a contract, as well as its essential terms. See CoreStates Bank, 723 A.2d at 1058. Plaintiff has also sufficiently alleged the breach of this contract: "[t]he failure of [the Coke Defendants] to keep secure from breach the PII of Plaintiff ... constitutes a material breach of the agreement between the Coke Defendants and the [Plaintiff]." Compl. ¶ 107. Finally, Plaintiff has sufficiently pled damages as a result of this breach due to the costs Plaintiff incurred in connection with the migration of his banking from one account to another.8 See Compl. ¶ 51.

The essential elements of breach of implied contract are the same as an express contract, except the contract is implied through the parties' conduct, rather than expressly written. Highland Sewer & Water Auth. v. Forest Hills Mun. Auth., 797 A.2d 385, 390 (Pa.Commw.Ct.2002). "[T]he pleading of a written contract is only applicable to claims for breach of express contract" and there is no similar requirement for claims of implied contract. Byrne v. Cleveland Clinic, 684 F.Supp.2d 641, 658 (E.D.Pa.2010). Plaintiff claims that the Coke Defendants, through privacy policies, codes of conduct, company security practices, and other conduct, implicitly promised to safeguard his PII in exchange for his employment. See id. ¶ 42. At this stage of the proceedings, whether the relevant terms of the agreement between the parties were stated explicitly or arose implicitly does not affect Plaintiff's ability to survive Defendants' Motion. Plaintiff has fairly alleged the existence of an agreement between the parties that included a covenant by the Coke Defendants to protect Plaintiff's PII, which Plaintiff alleges that the Coke Defendants breached. Therefore, the Coke Defendants' motion to dismiss Plaintiff's claims sounding in contract is denied.

F. Plaintiff has failed to state a claim for breach of the covenant of good faith and fair dealing.

"A breach of the covenant of good faith is nothing more than a breach of contract claim and separate causes of action cannot be maintained for each, even in the alternative." Rambo v. Greene, No. 03894, 2005 WL 579943, at *2 (Pa.Ct.C.P. Feb. 28, 2005); See also In re 400 Walnut Assocs., L.P., 454 B.R. 60, 72 (Bankr. E.D.Pa.2011) ("In Pennsylvania, there is no free-standing claim for breach of good faith. Rather, `[i]n order to plead a cause of action for breach of the covenant of good faith, whether it is an express or implied covenant, a plaintiff must properly plead the elements of a claim of breach of contract."') (quoting CRS Auto Parts, Inc. v. Nat'l Grange Mut. Ins. Co., 645 F.Supp.2d 354, 369 (E.D.Pa.2009)). To the extent Plaintiff asserts the Coke Defendants breached their contractual obligations by not acting in good faith, that contention is merely part of Plaintiff's breach of express and implied contract claims.

G. Plaintiff has stated a claim in restitution.

Under Pennsylvania law, a claim for liability founded on the unjust enrichment of another requires a showing of "(1) benefits conferred on defendant by plaintiff; (2) appreciation of such benefits by defendant; and (3) acceptance and retention of such benefits under such circumstances that it would be inequitable for defendant to retain the benefit without payment of value." Sovereign Bank, 533 F.3d at 180 (quoting Limbach Co. LLC v. City. of Phila., 905 A.2d 567, 575 (Pa. Cmmw.Ct.2006)). Terms such as "inequitable" or "unjust" may suggest a deceptively malleable conception of the law, but the extent to which the law of restitution will "interven[e] in transactions that might be challenged as inequitable is narrower, more predictable, and more objectively determined than the unconstrained implications of the words `unjust enrichment.'" See Restatement (Third) of Restitution and Unjust Enrichment § 1 cmt. b (Am. Law Inst. 2011); see also id. § 1 reporter's note b ("The doctrine of unjust — or, as it is sometimes called, unjustified — enrichment is not a synonym for a type of `palm tree justice' by which every unjust displacement of wealth from one person to another can be remedied." (quoting Kane v. Motor Vessel Leda, 355 F.Supp. 796, 803 (E.D.La.1972))). The touchstone of a meritorious claim is "the transfer of a benefit without adequate legal ground" rather than "unjust enrichment in any such broad sense." See id. § 1 cmt. b. The law of restitution does not supply a forum for judges to engage in an unbounded inquiry into the relative equities of a case, but instead comprises a series of generally accepted "circumstances in which a liability in restitution will be predictably imposed." See id. § 1 cmt. a; see also Meehan v. Cheltenham Twp., 410 Pa. 446, 189 A.2d 593, 596 (1963) ("The Restatement of Restitution sets forth various rules for the determination of whether the retention of a particular enrichment is unjust.").

Critical to assessing a claim in restitution, therefore, is identifying the alleged reason why the benefit in question was obtained without adequate legal ground. Here, Plaintiff alleges that "[by deliberately breaching their contract with Plaintiff] the Coke Defendants have been knowingly enriched by the savings in costs that should have been reasonably expended to protect the PII of the Plaintiff and the Class." Compl. ¶ 126. That claims sounds in the "opportunistic breach" theory of restitution, which supports a claim for relief when "a deliberate breach of contract results in profit to the defaulting promisor and the available damage remedy affords inadequate protection to the promisee's contractual entitlement," measured by the profit realized by the defaulting promisor. In re 400 Walnut Associates, L.P., 506 B.R. 645, 668 (E.D.Pa.2014) (quoting Restatement (Third) of Restitution and Unjust Enrichment § 39(1)); see also Coca-Cola Bottling Co. of Elizabethtown, Inc. v. Coca-Cola Co., 988 F.2d 386, 406-10 (3d Cir.1993).

At this procedural stage, the Court need not precisely sketch the boundaries of this claim but takes this opportunity to observe that the circumstances affording relief under this theory are narrow. See Restatement (Third) of Restitution and Unjust Enrichment § 39 cmt. a ("The restitution claim described in this section is infrequently available, because a breach of contract that satisfies the cumulative tests of § 39 is rare."). Integral to the claim is that the breach must be deliberate. See id. § 39(1); see also Kansas v. Nebraska, ___ U.S. ___, 135 S.Ct. 1042, 1056-57, 191 L.Ed.2d 1 (2015). The breach must not merely have been efficient or advantageous for the breaching party, but must have been the result of "conscious advantage-taking" or "opportunistic calculation." See Kansas, 135 S.Ct. at 1069 (Thomas, J., dissenting). The breach must also be profitable, such that "the gain to the defendant as a result of the default will exceed the injury to the plaintiff from the same cause." Restatement (Third) of Restitution and Unjust Enrichment § 39(3) & cmt. f.

Finally, and vitally, the contractual damage remedy must "afford inadequate protection to the promisee's contractual entitlement," for the essence of the claim is the need to "reinforce[] ... an entitlement that would be inadequately protected if liability for interference were limited to provable damages." See id. § 39(2) & cmt. b. Understood by its purpose, this claim embraces those circumstances where "the promisee's contractual position is vulnerable to abuse" in order to prevent an inadequate damage remedy from "undermin[ing] the stability of any contractual exchange in which one party's performance may neither be easily compelled nor easily valued." See id. § 39 cmt. b.

These requirements serve to distinguish this claim from those circumstances where it is improper to assert a claim in restitution in a contractual setting. Contracting parties sometimes seek to wield a claim in restitution to disgorge a benefit from a counterparty when a contractual benefit, usually unforeseen by the contracting party at the time the bargain was struck, accrues to the counterparty during the course of performance. Such was the case in Wilson Area School District v. Skepton, where a school district, which had invited bids for the construction of a new school, sought to disgorge from the contractor certain cost savings the contractor was able to secure during the course of construction. See 586 Pa. 513, 895 A.2d 1250, 1251-53 (2006). The bid terms required that the contractors secure and pay for all necessary permits, governmental fees, and licenses. After paying the permit fees assessed by the local borough, the contractors, through suit in state court, were able to obtain a refund of those fees when the fees were found to have violated a provision of the borough's code. See id. at 1252-53. The school district sought to disgorge the refunded fees from the contractors, arguing that "a mistake of law" entitled them to a claim in restitution. See id. at 1253. The Supreme Court of Pennsylvania rejected this claim, stating that "it has long been held in this Commonwealth that the doctrine of unjust enrichment is inapplicable when the relationship between the parties is founded upon a written agreement or express contract, regardless of how `harsh the provisions of such contracts may seem in the light of subsequent happenings.'" See id. at 1254 (quoting Third Nat'l & Tr. Co. of Scranton v. Lehigh Valley Coal Co., 353 Pa. 185, 44 A.2d 571, 574 (1945)). Put another way, the benefit obtained by the contractors was not "without adequate legal ground," because the risk associated with the calculation of the fees that the borough would ultimately assess was contractually allocated to the contractors. The line of cases cited in Wilson affirm the basic principle that no claim in restitution arises when a contracting party obtains a contractually-allocated benefit. See Third Nat'l, 44 A.2d at 574 (finding no claim in restitution to disgorge benefits obtained by contract); Schott v. Westinghouse Elec. Corp., 436 Pa. 279, 259 A.2d 443, 448 (1969) (quoting Third Nat'l to observe, in dicta, that "the quasi-contractual doctrine of unjust enrichment [is] inapplicable when the relationship between parties is founded on a written agreement or express contract); Wingert v. T.W. Phillips Gas & Oil Co., 398 Pa. 100, 157 A.2d 92, 105 (1959) (observing, in the context of a lease for oil and gas drilling, that no claim in restitution would exist to seek a production royalty above the rate set by contract); Durham Terrace, Inc. v. Hellertown Borough Auth., 394 Pa. 623, 148 A.2d 899, 904 (1959) (finding no claim in restitution to recover value of water mains that were constructed by builder in accordance with the terms of a contract between builder and borough authority).

By contrast, Plaintiff is not attempting to use the vehicle of restitution to rewrite the terms of an agreement the parties allegedly made. Rather, the claim that another engaged in an opportunistic breach of a contract is "the equivalent, in the contractual context, of an intentional and profitable tort," and "it is properly understood and delimited" by analogy to claims in restitution that arise when one engages in an "intentional and profitable interference with another person's legally protected interests." See Restatement (Third) of Restitution and Unjust Enrichment § 39 cmts. a & b. Plaintiff has stated a claim in restitution, and Defendants' motion to dismiss this claim at this juncture is denied.9

H. Plaintiff has failed to state a claim under the law of bailments.

Plaintiff asserts a claim under the law of bailments, arguing that the Coke Defendants were bailors of his PII and failed to return it to him. Compl. ¶¶ 130-33. The Court does not agree. Under Pennsylvania law "a cause of action for breach of a bailment agreement arises if the bailor can establish that personalty has been delivered to the bailee, a demand for return of the bailed goods has been made, and the bailee has failed to return the personalty." Price v. Brown, 545 Pa. 216, 680 A.2d 1149, 1152 (Pa. 1996).

While courts in Pennsylvania have yet to consider whether such a claim could arise in connection with a loss of electronic information, a number of courts have found that PII lost by a party holding that information was not "property" or "personalty" for the purposes of the law of bailment. See, e.g., Ruiz v. Gap, Inc., 540 F.Supp.2d 1121, 1127 (N.D. Cal. 2008) (holding that social security numbers and credit card information stolen from a computer were not property for purposes of the law of bailment); In re Sony, 903 F.Supp.2d at 974-75 ("[T]he Court is hard pressed to conceive of how Plaintiffs' Personal Information could be construed to be personal property so that Plaintiffs somehow `delivered' this property to Sony and then expected it be returned.") In re Target, 66 F.Supp.3d at 1177 (dismissing a bailment claim with prejudice in the context of lost PII). This Court agrees with the logic of these courts and believes Pennsylvania courts would do the same. Plaintiff has not alleged he entrusted any personalty to the Coke Defendants besides his PII. See Compl. ¶¶ 130-33. Therefore, the claim must be dismissed.

I. Plaintiff has failed to state a claim based on a civil conspiracy.

Finally, Plaintiff brings a claim of civil conspiracy, alleging that the Coke Defendants conspired to keep the loss of PII hidden from Plaintiff. Compl. ¶¶ 134-38. Plaintiff's conspiracy claim is deficient in two respects.

First, Plaintiff's conspiracy claim is founded on his claim of fraud. See Compl. ¶ 135. Because Plaintiff failed to state a claim for fraud, his conspiracy claim must also fail. McKeeman v. Corestates Bank, N.A., 751 A.2d 655, 660 (Pa. Super. 2000) ("[A]bsent a civil cause of action for a particular act, there can be no cause of action for civil conspiracy to commit that act ...") (quoting Pelagatti v. Cohen, 370 Pa.Super. 422, 536 A.2d 1337, 1342 (Pa. Super. 1987)); Compl. ¶ 135.

Second, Plaintiff fails to plausibly allege that the sole purpose of the alleged conspiracy was to maliciously harm him. To state a claim of conspiracy, Plaintiff must allege "(1) a combination of two or more persons acting with a common purpose to do an unlawful act or to do a lawful act by unlawful means or for an unlawful purpose; (2) an overt act done in pursuance of the common purpose; and (3) actual legal damage." Estate of Werner v. Werner, 781 A.2d 188, 191 (Pa. Super. Ct. 2001). In addition, civil conspiracy requires malice on the part of the wrongdoer and intent to injure the plaintiff. Constitution Bank v. DiMarco, 836 F.Supp. 304, 308 (E.D. Pa. 1993). Moreover, "[b]ald assertions that certain actions were malicious are insufficient; it must be alleged that the `sole purpose of the conspiracy was to injure the Plaintiffs.'" Morilus v. Countrywide Home Loans, Inc., 651 F.Supp.2d 292, 313 (E.D. Pa. 2008) (quoting Am. Indep. Ins. v. Lederman, No. CIV.A. 97-4153, 2000 WL 1209371, at *20 (E.D.Pa. Aug. 28, 2000)) (emphasis added). Even acts that amount to fraud are insufficient to show civil conspiracy if there was no specific intent to harm the plaintiff. Morilus, 651 F.Supp.2d at 313 (rejecting a claim for civil conspiracy where defendant's desire to make a larger profit for his business was the likely motivation behind his fraudulent acts).

Here, Plaintiff alleges that "[t]he Coke Defendants performed the acts alleged [in Plaintiff's Complaint] in furtherance of the common plan or design for the conspiracy with knowledge of the injury and damage it would cause to Plaintiff [] and with intent to cause such injuries or with reckless disregard for the consequences." Compl. ¶ 137. That the Coke Defendant's acted "with knowledge of the injury ... and with intent to cause such injuries or with reckless disregard" is insufficient to state a conspiracy claim which arises only when the "sole purpose" of the conduct was the intent to harm. See Morilus, 651 F.Supp.2d at 313; Compl. ¶ 137. Indeed, Plaintiff does not allege facts that would make plausible, rather than merely speculative, his claim that the Coke Defendants acted with the sole intent of harming Plaintiff, as Plaintiff freely admits that the motivations behind the alleged conspiracy are "unknown to Plaintiff." See Morilus, 651 F.Supp.2d at 313 (dismissing a conspiracy claim where, although defendants were aware their actions would cause harm to the plaintiff, their specific intent was not solely to harm the plaintiff); see also Thompson Coal Co. v. Pike Coal Co., 488 Pa. 198, 412 A.2d 466 (1979) (stating that the sole intention in a civil conspiracy claim must be "calculated to do harm to others ...") (quoting Rosenblum v. Rosenblum, 320 Pa. 103, 181 A. 583, 585 (1935)); Compl. ¶ 7. Accordingly, the Court dismisses this claim with prejudice.

V. Conclusion

The questions before the Court are whether Plaintiff has sufficiently pled injury-in-fact fairly traceable to the conduct of the Coke Defendants to have standing under Article III and whether Plaintiff has pled sufficient facts to make his claims for relief plausible. This Court finds that Plaintiff has standing to proceed with his claims consistent with the requirements of Article III. The Court denies the Coke Defendants Motion to Dismiss Plaintiff's express contract, implied contract, and unjust enrichment claims, but grants the Coke Defendants' Motion to Dismiss Plaintiff's other claims in accordance with this Memorandum Opinion.