## Facts

- Shane K. Enslin worked for a Coca-Cola bottling company starting in 1996 and, as a condition of employment, provided personal identifying information (PII) including Social Security, driver’s license, and bank account information.
- Enslin alleged the employer, and later related Coca-Cola entities, promised (expressly or implicitly) to safeguard his PII and to use it only for legitimate employment purposes.
- A Coca-Cola IT employee allegedly removed decommissioned laptops that still contained unencrypted PII of current and former employees and kept, gave away, or otherwise mishandled them.
- In February 2014, Coca-Cola notified Enslin that stolen laptops may have contained his PII.
- After the notice, Enslin alleged he suffered identity theft and fraudulent activity involving his personal and banking information.
- Enslin filed a putative class action asserting, among other claims, breach of contract and unjust enrichment; defendants moved to dismiss under Rule 12(b)(6).

## Issues

1. Whether the complaint plausibly alleged an express or implied contractual obligation to safeguard employee PII that could support a breach-of-contract claim.
2. Whether the plaintiff could recover, as contract damages, restitution or disgorgement measured by the defendant’s alleged cybersecurity “cost savings.”
3. Whether unjust enrichment could proceed where the same alleged duty and conduct were pleaded as part of the parties’ contractual relationship.

## Decision

- The court granted the motion to dismiss in part and denied it in part.
- The breach-of-contract claim survived to the extent it was based on an alleged contractual duty to protect Enslin’s PII.
- The court dismissed the request for disgorgement/restitution based on the defendant’s alleged cost savings, holding it was not an available measure of contract damages on the pleaded facts.
- The court dismissed or substantially limited unjust enrichment as duplicative because the alleged relationship and duties were grounded in contract.
- For pleading purposes, the court treated the alleged post-notice identity theft as a plausible injury connected to the alleged data compromise, without making final causation findings.

## Legal Principles

- At the motion-to-dismiss stage, an employee may plausibly plead an implied contractual data-security obligation where provision of sensitive PII is required for employment and the employer allegedly commits to safeguarding and properly using that information.
- Contract damages generally aim to place the plaintiff in the position they would have occupied had the contract been performed; disgorgement of the breaching party’s gains or “saved costs” is ordinarily unavailable absent special circumstances.
- Under Pennsylvania law, unjust enrichment is generally unavailable when the parties’ relationship and the disputed obligations are governed by an express or implied contract covering the same subject matter.

## Conclusion

The court permitted a conventional breach-of-contract theory for failure to protect employee PII to proceed past Rule 12(b)(6) while rejecting a restitutionary “cost savings” remedy and narrowing unjust enrichment as duplicative of the alleged contractual relationship.


Enslin v. The Coca-Cola Co., 136 F. Supp. 3d 654 (E.D. Pa. 2015)