MCDOWELL v. CGI GROUP, INC. et al

Filing 35

MEMORANDUM OPINION to the Order granting in part and denying in part Defendant's Motion to Dismiss. Signed by Judge Gladys Kessler on 6/1/17. (CL)

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
LORI McDOWELL, on behalf of
herself and similarly situated,
Plaintiffs,

v.
CGI FEDERAL INC., and
DOES 1through100, inclusive

Civil Action No. 15-1157 (GK)

Defendants.

MEMORANDUM OPINION

Plaintiff, Lori McDowell, alleges that her personal information was stolen by employees
of Defendant, CGI Federal, Inc. ("CGI"), and then used to open accounts and make purchases
using her identity. CGI acquired this information pursuant to a contract with the State Department,
under which CGI received and processed passport applications on behalf of the State Department,
including the application of McDowell. McDowell brings this class action lawsuit on behalf of
herself and other similarly situated individuals, alleging that CGI failed to adequately safeguard
their personal data and is therefore liable for: ( 1) violations of the District of Columbia's Consumer
Protection Procedures Act, D.C. Code§ 28-3901 et seq. ("CPPA"); (2) negligence; (3) breach of
contract; (4) breach of bailment; and (5) unjust enrichment. 1

1

McDowell brings the same claims against unknown individuals who she alleges are "legally
responsible in some manner for the unlawful acts referred to herein," collectively Does 1 through
100. Amended Complaint~ 12. Because these Doe defendants are not mentioned in the factual
allegations contained in McDowell's Amended Complaint, they are unnecessary to the resolution
of CGI' s Motion to Dismiss, and therefore, are not discussed further in this Opinion.
-1-

CGI filed a Motion to Dismiss McDowell's Amended Complaint, [Dkt. No. 27], arguing
that she has failed to state a claim upon which relief can be granted for any Count contained in the
Amended Complaint. Upon consideration of the Motion to Dismiss, responsive briefs, and the
entire record herein, and for the reasons stated below, Defendant's Motion to Dismiss is granted
as to all counts except McDowell's of breach of contract claim, contained in Count 3.
I.

BACKGROUND
A. Factual Background2
CGI is a Delaware corporation with an office in Washington, D.C., and a principal place

of business in Fairfax, Virginia. Amended Complaint if 11. It provides a number of services to
the United States Passport Agency, a constituent of the State Department, also located in
Washington, D.C. Id. if 11. Pursuant to the contract at issue here, it processes passport applications
for the Passport Agency. Id.

if 2.

Passport applicants must submit sensitive and personally identifiable information,
including: name, date of birth, city of birth, state of birth, country of birth, social security number,
sex, height, hair color, eye color, occupation, and evidence of U.S. Citizenship, such as a
previously issued U.S. Passport or U.S. birth certificate. Amended Complaint if 24. Applicants
must also submit present identification such as a fully valid driver's license or military ID. Id.
Plaintiffs refer to this information collectively as "Personal Information." Id.
CGI typically stores this Personal Information on its computer systems and transmits it to
the Passport Agency in Washington, DC. Id.

if 24. Under the terms of CGI's contract, it must

"'provide accessible and qualified management, production, and operational support personnel' to

2

All facts are taken from Plaintiffs Amended Complaint. [Dkt. No. 25].

-2-

perform document preparation, creation of document batches, document imaging (scanning) and
reviewing, retrieval of individual application information, data entry, book printing, quality
control, generation of mailing labels, and verification of information." Amended Complaint if 2.
Beginning sometime in 2010, until roughly March 2, 2015, unidentified CGI personnel
stole the Personal Information of passport applicants.

Amended Complaint

if 31. These

individuals then used the Personal Information to create counterfeit identity documents, obtain
commercial lines of credit, and purchase iPhones, iPads, and other electronic merchandise. Id. if
32.
McDowell was one of the applicants whose Personal Information was stolen. Amended
Complaint if 18. McDowell, a resident and citizen of Carrolton, Georgia, had submitted a passport
application from her hometown. Id. ifif 10, 14. Like other applications, hers contained the required
Personal Information, which was intended for transmission to Washington, D.C., via CGI's
computer systems. Id.

if 14. Following the submission of her application, CreditScore.com, a

credit monitoring service, notified McDowell that someone had opened a T-Mobile Account using
her social security number and that someone had also made a $2,300 retail purchase in Texas using
her identity. Id. if 16. Additionally, CreditScore.com notified McDowell that someone attempted
a "hard inquiry'' check of her credit while attempting to open an account in her name at a Sprint
Nextel in Colorado. Id.

if 18. On June 3, 2015, the U.S. Department of Justice formally notified

McDowell that she was a victim of the theft of Personal Information from CGI's computer systems.
Id.

if 18. As a result of the theft of her Personal Information, McDowell has had to: pay for

additional credit monitoring protection; expend time disputing fraudulent charges and accounts

-3-

..
with banks, credit card companies, and credit reporting agencies; and take other steps to protect
herself from additional harm. Id.

~

20.

B. Procedural Background
On July 20, 2015, McDowell initiated this class action lawsuit, filing a Complaint against
the CGI and the Doe Defendants on behalf of herself and other similarly situated individuals who
had Personal Information, contained in passport applications, stolen by CGI employees. [Dkt. No.
1]. On October 9, 2015, McDowell filed an Amended Complaint, alleging that CGI was liable for
violations of the CPPA, negligence, breach of contract, breach ofbailment, and unjust enrichment.
Amended Complaint ~ 6.
CGI then filed a Motion to Dismiss on October 26, 2015, arguing that McDowell failed to
state a claim on any of the counts contained in the Amended Complaint. Motion to Dismiss
("MTD") [Dkt. No. 27]. McDowell filed an Opposition on November 23, 2015, [Dkt. No. 30],
and CGI filed a Reply on December 21, 2015, [Dkt. No. 31].
II.

STANDARD OF REVIEW
Rule 12(b)( 6) of the Federal Rules of Civil Procedure permits dismissal upon the "failure

to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). "To survive a motion
to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to
relief that is plausible on its face." Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (internal quotation
marks and citations omitted). A claim is facially plausible when the pleaded facts "allows the
court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id.

-4-

Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully," but it
is not a "probability requirement." Id.
At the Rule 12(b)(6) stage, the court accepts all of the complaint's factual allegations as
true and draws all reasonable inferences from those facts in plaintiffs favor. Browning v. Clinton,
292 F.3d 235, 242 (D.C. Cir. 2002). However, the court does not accept "inferences drawn by
plaintiff if such inferences are unsupported by the facts set out in the complaint." Id. (internal
quotation marks and citations omitted). Similarly, the court need not accept plaintiffs legal
conclusions simply because they are "cast in the form of factual allegations." Id. (internal
quotation marks and citations omitted). "Threadbare recitals of a cause of action's elements,
supported by mere conclusory statements," are insufficient to survive a motion to dismiss. Iqbal
556 U.S. at 678.
In addition to the complaint, the court may consider other sources, such as "documents
incorporated into the complaint by reference and matters of which a court may take judicial
notice." Tellabs, Inc. v. Makar Issues & Rights, Ltd., 551 U.S. 308, 322 (2007).

III.

ANALYSIS
A. CPPA
Plaintiff alleges that CGI violated the CPPA, which prohibits a person from

misrepresenting the characteristics of consumer goods or services, by representing that it would
secure the passport application data when it did not. Amended Complaint ~~ 53-64. Defendants
argue that this claim should be dismissed because Plaintiff is not a "consumer" under the CPPA.
MTD at 17-21.
Under the CPPA, it is an unlawful trade practice for "any person to: (a) represent that goods
or services have ... characteristics ... that they do not have." D.C. Code§ 28-3904(a). However,

-5-

subject to limited exceptions only consumers are authorized to bring suit under the CPPA. 3 D.C.
Code§ 28-3905(k)(l)(A). Thus, "[t]he D.C. Court of Appeals has repeatedly concluded that the
CPPA was designed to police trade practices arising only out of consumer-merchant relationships."
Ali v. Tolbert, 636 F.3d 622, 628 (D.C. Cir. 2011) (internal quotation marks omitted); Price v.
Indep. F.S.B., 110 A.3d 567, 573 (D.C. 2015) (the CPPA "'was designed to police trade practices
arising only out of consumer-merchant relationships,' and does not apply to commercial dealings
outside the consumer sphere" (quoting Ford v. Chartone, Inc., 908 A.2d 72, 81 (D.C. 2006))).
"Consumer goods or services' are those that [a] person does or would purchase, lease (as lessee),
or receive and normally use for personal, household, or family purposes." Price, 110 A.3d at 574
(emphasis added) (quotation marks omitted).
McDowell alleges that CGI misrepresented the services it offered. Amended

Complaint~

53-64. In a brochure advertising its services, CGI stated that it provides "technology management"
services that provide: "secure data center operations;" "around-the-clock monitoring of systems,
real-time reporting and immediate action on suspicious activity from CGI's security operations
centers;" and "[e]xpert threat anticipation and defense of critical information and infrastructure."
Amended

Complaint~

58. McDowell argues that these statements misrepresented the security of

the services provided by CGI to the Passport Agency, as evidenced by the fact that CGI employees
were able to steal Personal Information contained in passport applications. Opp'n at 9.

3

For example, in addition to consumers, the CPPA authorizes: nonprofit organizations to bring
suit on behalf of its member or the general public, D.C. Code § 28-3905(k)(l)(C); and public
interest organizations to bring suit on behalf a consumer or class of consumers, Id. § 283905(k)( 1)(D). McDowell does not allege that she is authorized to sue under any of these other
provisions of the CPPA.

-6-

The problem with McDowell's argument is that the services she alleges that CGI
misrepresented are not consumer services, but business services. The technology management
services CGI provides to the Passport Agency are typical of the back-office services that one
company provides to another. They are decidedly not for personal, household, or family purposes,
and therefore do not fall within the ambit of the CPPA. See Indep. Commun. Network, Inc. v.
MCI Telecomm. Corp., 657 F. Supp. 785, 788 (D.D.C. 1987) (transactions between two merchants
that are on the "supply side" of the consumer-merchant do not fall within ambit ofCPPA); Adam
A. Weschler & Son, Inc. v. Klank, 561 A.2d 1003, 1005 (D.C. 1989) ("Transactions along the
distribution chain that do not involve the ultimate retail customer are not consumer transactions
that the Act seeks to reach." (emphasis added)). And even if these were consumer services,
McDowell is not the one who purchased them-the Passport Agency did-and so it cannot be said
that she was the consumer.
In response, McDowell argues that the passport she applied for is a consumer good and
therefore that she is a consumer for purposes of the CPPA. Opp'n at 8. That argument cannot be
squared with the definition of a "good" as used in the CPPA, which defines "goods and services"
as "any and all parts of the economic output of society, at any stage or related or necessary point
in the economic process, and includes consumer credit, franchises, business opportunities, real
estate transactions, and consumer services of all types." D.C. Code § 28-390l(a)(7) (emphasis
added). Simply put, a passport is not part of the economic output of society. See Urtetiqui v.
D'Arcy, 34 U.S. 692, 699 (1835) (a passport "is a document, which, from its nature and object, is
addressed to foreign powers; purporting only to be a request, that the bearer of it may pass safely
and freely; and is to be considered rather in the character of a political document, by which the

-7-

bearer is recognized, in foreign countries, as an American citizen; and which, by usage and the law
of nations, is received as evidence of the fact." (emphasis added)).
As McDowell is not a consumer within the meaning of the CPPA, she cannot state a claim
for which relief can be granted, and her CPP A claim must be dismissed.
B. Negligence

McDowell also alleges that CGI negligently handled her Personal Information by failing
to take reasonable steps to prevent the theft of Personal Information by CGI employees. Amended
Complaint iii! 66-71. Defendants argue that this claim should be dismissed because McDowell has
alleged only that she has suffered economic injuries, which cannot, in and of themselves, support
a claim of negligence. MTD at 23-26.
"In order to maintain a legally sufficient negligence claim, a plaintiff must demonstrate:
(1) that the defendant owed a duty to the plaintiff, (2) breach of that duty, and (3) injury to the
plaintiff that was proximately caused by the breach." Aguilar v. RP MRP Washington Harbour,
LLC, 98 A.3d 979, 982 (D.C. 2014) (internal quotations deleted). However, in Aguilar, the District
of Columbia Court of Appeals adopted the "economic loss" doctrine, which "bars recovery of
purely economic losses in negligence" actions. Id. at 985-86.
Under a limited exception to the economic loss doctrine, plaintiff may recover solely for
economic injuries if she can demonstrate she had a "special relationship" with the defendant. Id.
at 984-86, nn. 3 & 4; Whitt v. Am. Prop. Constr., P.C., No. 15-CV-1199, 2017 WL 1288572, at
*6 (D.C. Apr. 6, 2017).

Where such a "special relationship" exists, the defendant owes an

independent duty of care to the plaintiff and it is proper to hold the defendant liable for a breach
of that duty. Id. Absent such a special relationship, there is no duty and, consequently, no claim
for negligence. Id.; see also Jefferson v. Collins, 210 F. Supp. 3d 75, 85-86 (D.D.C. 2016).

-8-

Whether or not such a special relationship exists "is entirely a question of law that must be
determined only by the court." Whitt, 2017 WL 1288572 at *7 (quotation marks omitted).
In determining whether a special relationship exists, the Court asks whether "defendants
had an 'obligation ... to care for the [plaintiffs] economic well-being' or an 'obligation' that
'implicated [her] economic expectancies."' Whitt, 2017 WL 1288572 at *6 (quoting Aguilar, 98
A.3d at 985). Citing approvingly to the decisions of other jurisdictions, the District of Columbia
Court of Appeals has suggested that an "intimate nexus" or "close nexus" "between the parties" is
required to establish the existence of a special relationship and that a plaintiff may demonstrate
the existence of such a nexus through "contractual privity or its equivalent." Aguilar, 98 A.3d at
985 n. 3 (internal citations and quotation marks omitted). A special relationship is unlikely to exist
where "variables beyond [defendant's] negligence could prove determinative of the likelihood of
serious economic harm." Aguilar, 98 A.3d at 985 n. 4.
For example, in Whitt, the court held that a construction company had a special relationship
with the plaintiff-business because: (1) its construction permit contained express terms
"specifically protecting [the business] from the effects" of the construction project; and (2) the
long-term, extensive nature of the construction project meant the harm was not "isolated and
unexpected." 2017 WL 1288572 at *7. In Whitt, the defendant construction company participated
in an extensive construction project directly outside of plaintiffs business entrance over a multiyear period. Id. at *6. An express provision of the construction permit for the project stated that
the project would not block access to the plaintiffs business. Id. Despite this provision, the
defendant repeatedly blocked the entrance or interfered with entry to plaintiffs business over the

-9-

course of the multi-year project. Id. at *1. Plaintiff repeatedly complained, to no avail, and was
ultimately forced to close her business due to a loss of customers. Id. at *2.
Based on the terms of the permit and the foreseeability that the project might impact the
plaintiffs business, the court concluded that the "[defendant] undertook obligations that would
implicate [the plaintiffs] economic expectancies," and therefore that a special relationship existed.
Id. at *6.

As the construction permit expressly protected access to plaintiffs entrance, the

defendant knew that its project could economically impact the plaintiff. Id. And by committing
to follow the terms of the permit, the defendant voluntarily took that obligation upon itself, thereby
creating a special relationship with, and a duty to, the plaintiff. Id.
Here, McDowell has not plead facts that can establish the existence of a special relationship
between her and CGI. For example, she does not argue that she was in contractual privity, or its
equivalent, with CGI. Nor does she allege that the contract itself contained language that created
the special relationship. Instead, she argues that "CGI owed a duty of care to Plaintiffs because
they were foreseeable and probable victims of any inadequate data security practices." Amended
Complaint ~ 69. But both Aguilar and Whitt make clear that foreseeability alone is insufficient to
establish a special relationship. See e.g. Aguilar, LLC, 98 A.3d at 984 ("we again decline to apply
the foreseeability test ... in negligence cases involving purely economic losses.").
Belatedly, McDowell argues that the existence of a special relationship could be shown by '
inspecting the contract-which neither party submitted to the Court in full-and therefore that she
should be allowed to proceed to discovery. See Opp'n at 18. But it is clear from the Amended
Complaint that McDowell believes this duty arises not from the terms of the contract, but because
CGI is "actively engaged in the business of collecting, storing, securely transferring, and

-10-

maintaining [sensitive personal information]." Id. if 66. The Court will not consider an argument
omitted from the Complaint and raised for the first time in a dispositive motion. 4
As McDowell has failed to allege any facts that plausibly establish the existence of a special
relationship, she cannot state a claim for negligence and this count must be dismissed.
C. Contract Claims

McDowell's Amended Complaint alleges that CGI breached its contract with the State
Department by failing to secure her Personal Information. Amended Complaint iii! 73-77. She
further alleges that she is entitled to sue to remedy this breach because: (1) she is a party to the
contract with CGI; or (2) in the alternative, she is an intended beneficiary of the contract with CGI.

1. Choice of Law

As an initial matter, it appears that there is some uncertainty as to whether federal common
law or the common law of the District of Columbia is applicable to McDowell's contract claims.
Ordinarily, federal common law governs the interpretation of contracts to which the United States
is a party. See e.g. Miree v. DeKalb County, Ga., 433 U.S. 25, 28 (1977). However, even where
a lawsuit involves a federal contract, if it "is purely between private parties and does not touch
rights and duties of the United States," state, rather than federal, law governs. Boyle v. United
Techs. Corp., 487 U.S. 500, 506 (1988); see also Miree, 433 U.S. at 29. It is not necessary to
resolve this question, because federal common law and the common law of the District of

4

The Court may disregard a claim raised for the first time in a memorandum of law. TunicaBiloxi Tribe of La. v. U.S., 577 F. Supp. 2d 382, 411 (D.D.C. 2008). If the factual basis for a new
claim is substantially similar to a claim already alleged in a plaintiffs complaint and the court
dismisses the newly-raised claim, the court must afford the plaintiff leave to amend her complaint
to include it. See id.; Wiley v. Glassman, 511F.3d151, 159 (D.C. Cir. 2007)
-11-

Columbia are so similar as to the issues presented in this case that the Court would reach the same
conclusion regardless of which law applies.

2. There was no contract between CGI and McDowell
McDowell alleges that she entered into a contract with CGI when she submitted her
passport application. Amended Complaint i! 74-75. CGI argues that Plaintiff fails to allege that
any communication between McDowell and CGI took place, and therefore, there could have been
no meeting of the minds, which is necessary for contract formation. MTD at 28-29.
To state a claim for breach of an express or implied contract, Plaintiff must allege: "(1) a
valid contract between the parties; (2) an obligation or duty arising out of the contract; (3) a breach
of that duty; and (4) damages caused by breach." Brown v. Sessoms, 774 F.3d 1016, 1024 (D.C.
Cir. 2014 ). The party asserting the existence of an enforceable contract bears the burden of proving
that there has been a "meeting of the minds," or mutual assent, as to all material terms. Ekedahl
v. COREStaff, Inc., 183 F.3d 855, 858 (D.C. Cir. 1999); U.S. ex rel. Morsell v. Symantec Corp.,
130 F. Supp. 3d 106, 131(D.D.C.2015) ("The party alleging a contract must show a mutual intent
to contract").

Without a "meeting of the minds" as to all material terms, there can be no

enforceable contract. Bailey v. Fed. Nat'l Mortg. Ass'n, 209 F.3d 740, 746 (D.C. Cir. 2000).
Here, there is no valid argument that McDowell and CGI ever formed a valid contract.
While there was a meeting of the minds between CGI and the State Department, no such meeting
of the minds took place between McDowell and CGI. McDowell's Amended Complaint contains
no allegation of any interaction from which to infer a meeting of the minds between Plaintiff and
CGI Federal. Indeed, in her Opposition, McDowell seems to abandon the argument that any
contract was formed between her and CGI, arguing only that she was a third party beneficiary of
the contract between the State Department and CGI. See Opp'n generally (failing to respond to
-12-

CGI's arguments regarding contract formation); Reply at 15 (similarly noting that "Plaintiff
attempts to defend Count 3 solely on a third-party beneficiary theory").
Consequently, Plaintiff has failed to state a claim that she entered into a contract with
CGI, which CGI then breached by failing to secure her Personal Information.
3. McDowell has stated a claim as a third-party beneficiary
In the alternative, McDowell alleges that she is an intended third-party beneficiary of the
contract between the State Department and CGI, and that she is entitled to sue for its breach.
Amended Compli:iint ~ 76. CGI argues that she has failed to allege facts showing that she was an
intended beneficiary, and therefore cannot sue for breach of the contract. MTD at 31-32.
Intended third-party beneficiaries to a contract may sue to enforce the terms of the contract
or obtain a remedy for a breach. Moore v. Gaither, 767 A.2d 278, 287 (D.C. 2001); GECCMC
2005-Cl Plummer St. Off. Ltd. Partn. v. JPMorgan Chase Bank, Nat. Ass'n, 671 F.3d 1027, 1033
(9th Cir. 2012) (internal citations and quotation marks omitted). However, in the context of
contracts with the government, there is a presumption that members of the public are not intended
beneficiaries, but merely incidental beneficiaries of the contract.

Moore, 767 A.2d at 287;

GECCMC, 671 F.3d at 1033. Such incidental beneficiaries have no right to sue for breach of
contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033.
In order to overcome this presumption, a third-party plaintiff suing for breach of contract
must show that the contracting parties "clearly intended" that the contract would benefit the
plaintiff, or an identifiable class to which the plaintiff belongs. GECCMC, 671 F.3d at 1033;
Moore, 767 A.2d at 287. Such intent may exist where the plaintiff would be reasonable in relying
on the promise as manifesting an intention to confer a right on him or her. See Restatement
(Second) of Contracts§ 302(1)(b) cmt. d (1981); see e.g. Klamath Water Users Protective Ass'n
-13-

"·

v. Patterson, 204 F.3d 1206, 1211 (9th Cir. 1999). "This 'clear intent' hurdle is a high one."
GECCMC, 671 F.3d at 1033.
McDowell has plead sufficient facts to plausibly state a claim that she is an intended
beneficiary of the contract between CGI and the Department of State. Her Amended Complaint
states "[t]he U.S. and CGI agreed to properly receive, handle, store, and otherwise utilize the
Personal Information of Plaintiffs. Upon information and belief, it was also a term of the contract
that CGI would act reasonably and employ reasonable safeguards at all times with respect to
handling the Personal Information of Plaintiffs, including requiring a background security
investigation for all CGI employees with authorized access to the Personal Information."
Amended Complaint

~

76 (emphasis added). In other words, Plaintiff alleges that the contract

contains terms that expressly require CGI: (1) to protect the Personal Information it receives; and
(2) to do so for the benefit of an identifiable class of individuals, passport applicants, to which she
belongs.
If the contract-which, as already noted, is not before the Court in its entirety-bears out

that allegation, it is at least plausible that she can establish that she is an intended beneficiary.
Depending on the language of the alleged contract provision, as well as the contract as a whole, it
is plausible that an objective passport applicant would be reasonable in relying on the promise as
manifesting an intention to confer a right on him or her to have their Personal Information
safeguarded by CGI.
Whether she can do so will depend on the specific language contained in the contract, but
that is a merits question that should not be resolved in deciding CGI's Motion to Dismiss when
the contract is not before the Court. See SB Charles Alan Wright & Arthur R. Miller, Federal
-14-

Practice & Procedure§ 1357 (Supp. 2011) ("Wright & Miller") ("Whether the plaintiff ultimately
can prevail on the merits is a matter properly determined on the basis of proof, which means on a
summary judgment motion or at trial by the judge or a jury, and not merely on the face of the
pleadings"). Given the "liberal pleading standard" embodied in the Federal Rules, see Jones v.
Air Line Pilots Ass'n, Intern., 642 F.3d 1100, 1104 (D.C. Cir. 2011), McDowell should have the
opportunity to do so.
CGI's counter-arguments are unpersuasive. First, CGI argues that the test for whether a
plaintiff is an intended beneficiary "is not merely whether or not the parties intended to confer a
benefit on third parties (or to give a right to 'performance' as Plaintiff alleges), but rather whether
or not 'the parties intended the third party to be able to sue to protect that benefit."' MTD at 32
(quoting Doe v. District of Columbia, 796 F.3d 96, 109 (D.C. Cir. 2015) (emphasis added)).
However, that holding was issued in the context of a case involving a consent decree-not an
ordinary government contract-and is best read as limited to that context. See Doe, 796 F.3d 96
(involving a challenge to implementation of a consent decree, reached in a previous lawsuit, by
individuals who were not parties to the consent decree).
The decision itself only discusses the ability of "[t]hird parties to a consent decree" to sue
for breach of the consent decree and does not discuss third parties to other types of contracts. See
Doe, 796 F.3d at 109. Additionally, CGI's reading of Doe cannot be squared with Moore or
GECCMC-both cases that CGI itself cites in its Motion to Dismiss-which do not require a
plaintiff to show that contracting parties intended the plaintiff to be able to sue to protect a benefit
conferred by the contract in order to prove that she is an intended beneficiary. Finally, all of the
cases cited by the Court of Appeals in Doe also involved consent decrees, not ordinary contracts.

-15-

Doe, 796 F.3d at 109, n.4 (citing: SEC v. Prudential Sec. Inc., 136 F.3d 153, 159 (D.C. Cir. 1998)
(involving consent decree between securities seller and the SEC); Blue Chip Stamps v. Manor
Drug Stores, 421 U.S. 723, 750 (1975) (involving anti-trust consent decree), Terrell v. District of
Columbia, 703 F.Supp.2d 17, 21 (D.D.C. 2010) (involving IDEA consent decree), Beckett v. Air
Line Pilots Ass'n, 995 F.2d 280 (D.C.Cir.1993) (involving consent decree between pilots' union
and non-member pilots)). As Doe appears only to define the applicable standard for determining
who is a third-party beneficiary to consent decrees, it does not control resolution of this case.
Second; CGI points to cases in other jurisdictions in which courts have held that victims of
a data breach were not intended beneficiaries of contracts related to the handling of their data.
MTD at 32 (relying on the cases collected in Willingham v. Global Payments, Inc., No. 1:12-CV01157-RWS, 2013 WL 440702, at *19-20 (N.D. Ga. Feb. 5, 2013)). But at least two of the three
cases cited in Willingham were decided on motions for summary judgment after the contract had
been introduced as evidence. See Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 167
(3d Cir. 2008) ("the district court converted Fifth Third's motion for reconsideration into a motion
for summary judgment and ordered the parties to conduct discovery on the third-party beneficiary
issues, i.e., whether Fifth Third's contractual obligation to Visa to comply with the Visa Operating
Regulations was intended to benefit Issuers like Sovereign."); Banknorth, N.A. v. BJ's Wholesale
Club, Inc., 442 F. Supp. 2d 206, 211 (M.D. Pa. 2006) (court granted motion for summary judgment
because a provision in the contract "specifically providing that the contract was not for the benefit
of, and not intended to be enforced by, any third party.").
That approach accords more closely to the liberal pleading standard established by the
Federal Rules. It is particularly appropriate in third-party beneficiary cases, where the Plaintiff is

-16-

not a party to the contract, and therefore, is unlikely to be able to include express provisions of the
contract in her Complaint to demonstrate that she is an intended beneficiary. Moreover, because
the contract is likely to be incorporated into the plaintiffs complaint by reference, as it was in this
case, the defendant-as a party to the contract-has it entirely within its power to submit the
contract as an attachment or exhibit to the motion to dismiss without converting it into a motion
for summary judgment. See Tellabs, 551 U.S. at 322. In doing so, the defendant likely can avoid
even the limited discovery provided for in cases such as Sovereign Bank.
McDowell's Amended Complaint states a plausible claim that she is an intended
beneficiary of the contract between CGI and the State Department, and therefore, the Court will
not dismiss her breach of contract claim.

D. Bailment
Finally, McDowell alleges that she and CGI entered into a bailment relationship that
required CGI to safeguard her Personal Information when she submitted her passport application,
which CGI then breached.

Amended Complaint

iii!

79-84.

CGI counters that no bailment

relationship was created because there was no agreement between McDowell and CGI. MTD at
37-40.
"A bailment relationship is said to arise where an owner, while retaining title, delivers
personalty to another for some particular purpose upon an express or implied contract. The
relationship includes a return of the goods to the owner or a subsequent disposition in accordance
with his instructions." Kam-Almaz v. U.S., 682 F.3d 1364, 1368 (Fed. Cir. 2012). In the District
of Columbia, "[a] bailment for hire relationship may be created even in the absence of an explicit
agreement. All that is required is the existence of a mutual benefit." First Am. Bank, N.A. v.
-17-

District of Columbia, 583 A.2d 993, 996 (D.C. 1990). Thus, "[a] person becomes a bailee for hire
when he takes property into his care and custody for a compensation. The nature and amount of
the compensation are immaterial." First Am. Bank, 583 A.2d at 996.
McDowell has failed to allege facts that plausibly support the existence of a bailment
relationship. As discussed above, there were no communications between McDowell and CGO,
and therefore, they could not have formed an agreement necessary to create an express bailment.
Similarly, CGI received no compensation from McDowell nor did it expect to receive additional
compensation from the State Department for processing McDowell's passport application, and
therefore, they could not have formed an implied bailment or quasi-bailment. See Snowder v.
District of Columbia, 949 A.2d 590, 605 (D.C. 2008) (quasi-bailment is formed when bailee takes
possession of property "in expectation of compensation"). To the extent any bailment relationship
existed it was between McDowell and the State Department, and that is insufficient, in and of
itself, to impose liability on CGI for the data breach. 8A Am. Jur. 2d Bailments § 126 (2017
Update) ("A bailee who employs agents or employees who use or otherwise deal with the bailed
property is responsible for the conduct of such persons while they are acting within the scope of
their employment.").
Accordingly, McDowell has failed to state facts that plausibly support the existence of any
form of a bailment, and therefore cannot state a claim for breach of bailment. 5

E. Unjust Enrichment
Finally, McDowell alleges that CGI was unjustly enriched because it received benefits
under its contract with the State Department but failed to fulfill its contractual obligation to

5

As no bailment existed, it is unnecessary to address CGI's other arguments. MTD at 39-40.
-18-

safeguard Personal Information. Amended Complaint ifif 86-92. CGI argues that McDowell fails
to allege that she conferred any benefit on CGI. MTD at 33-35.
Under D.C. law, "unjust enrichment occurs when: (1) the plaintiff conferred a benefit on
the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the
defendant's retention of the benefit is unjust." Pernice v. Bovim, Civil Action No. 15-541 (JEB),
2015 WL 5063378, at *6 (D.D.C. Aug. 26, 2015) (quoting Peart v. D.C. Hous. Auth., 972 A.2d
810, 813 (D.C. 2009)). "To recover on a theory of unjust enrichment ... the plaintiff must show
that the defendant was unjustly enriched at his expense .... " Id. at *7 (quoting News World
Commc'ns, Inc. v. Thompsen, 878 A.2d 1218, 1222 (D.C. 2005)).
McDowell fails to allege any facts that plausibly suggest that she conferred any benefit on
CGI. Her Amended Complaint identifies two benefits that she argues she conferred on CGI. First,
she claims that her passport-application fee was used to pay CGI for the costs of processing her
passport application. Amended Complaint if 87; Opp'n at 20. But as CGI correctly points out, by
law passport application fees must be paid directly to the Treasury. See 22 U.S.C. § 214(a).
Therefore, those fees could not have been paid to CGI and they cannot constitute a benefit.
Second, she argues that by submitting passport applications, she and the other putative
class members created additional demand for passport processing services, which is itself a benefit
to CGI. Amended Complaint if 86. However, inchoate demand is not itself a benefit, because it
lacks intrinsic value. To be sure, increased demand for a service may create additional value for
the supplier, such as by raising the market price for the service or creating a market that did not
previously exist. However, McDowell's Amended Complaint does not allege that the additional
demand for passport processing services by the putative class members increased the value of the

-19-

contract between CGI and the Passport Agency or that the contract would not have been executed
absent the increased demand. Thus, even under her theory that Plaintiffs' applications increased
demand for passport processing services, McDowell has failed to allege any identifiable benefit
that CGI received as a result.
Additionally, McDowell fails to allege that she "conferred" any of these putative benefits
on CGI. Sabre Int'l Sec. v. Torres is instructive. 60 F. Supp. 3d 36 (D.D.C. 2014). In that case,
Sabre sued Torres, as well as Torres' individual employees, arguing that Sabre's payments to
Torres unjustly enriched the individual employees in the form of salaries and bonuses they
received from Torres. Id. at 41-42. The Court found that nothing in the Complaint connected the
benefit that the company improperly took from Sabre to the monies paid to the employees.
Therefore, the Court dismissed Sabre's unjust enrichment claim, concluding that "Sabre has not
plausibly alleged that it had any role in conferring these benefits on the [individual employees]."
Id. at 42.
Just as in Sabre, McDowell has failed to allege any fact that plausibly suggests that she had
any role in "conferring" anything of value on CGI, and therefore cannot state a claim for unjust
enrichment.

IV.

CONCLUSION

For the foregoing reasons Plaintiffs Amended Complaint is dismissed with respect to all
Counts, except Count 3, her third-party beneficiary breach of contract claim.

G'~~ -

GladysKeSef
United States District Judge

June 1, 2017

-20-