UNITED STATES DISTRICT COURT 

FOR THE DISTRICT OF COLUMBIA 

LORI McDOWELL, on behalf of 

herself and similarly situated, 

Plaintiffs, 

v. 

CGI FEDERAL INC., and 

DOES 1through100, inclusive 

Defendants. 

Civil Action No. 15-1157 (GK) 

MEMORANDUM OPINION 

Plaintiff, Lori McDowell, alleges that her personal information was stolen by employees 

of Defendant, CGI Federal, Inc. ("CGI"), and then used to open accounts and make purchases 

using her identity. CGI acquired this information pursuant to a contract with the State Department, 

under which CGI received and processed passport applications on behalf of the State Department, 

including the application of McDowell. McDowell brings this class action lawsuit on behalf of 

herself and other similarly situated individuals, alleging that CGI failed to adequately safeguard 

their personal data and is therefore liable for: ( 1) violations of the District of Columbia's Consumer 

Protection Procedures Act, D.C. Code§ 28-3901 et seq. ("CPPA"); (2) negligence; (3) breach of 

contract; ( 4) breach of bailment; and ( 5) unjust enrichment. 1 

1 McDowell brings the same claims against unknown individuals who she alleges are "legally 

responsible in some manner for the unlawful acts referred to herein," collectively Does 1 through 

100. Amended Complaint~ 12. Because these Doe defendants are not mentioned in the factual 

allegations contained in McDowell's Amended Complaint, they are unnecessary to the resolution 

of CGI' s Motion to Dismiss, and therefore, are not discussed further in this Opinion. 

-1-
CGI filed a Motion to Dismiss McDowell's Amended Complaint, [Dkt. No. 27], arguing 

that she has failed to state a claim upon which relief can be granted for any Count contained in the 

Amended Complaint. Upon consideration of the Motion to Dismiss, responsive briefs, and the 

entire record herein, and for the reasons stated below, Defendant's Motion to Dismiss is granted 

as to all counts except McDowell's of breach of contract claim, contained in Count 3. 

I. BACKGROUND 

A. Factual Background2 

CGI is a Delaware corporation with an office in Washington, D.C., and a principal place 

of business in Fairfax, Virginia. Amended Complaint if 11. It provides a number of services to 

the United States Passport Agency, a constituent of the State Department, also located in 

Washington, D.C. Id. if 11. Pursuant to the contract at issue here, it processes passport applications 

for the Passport Agency. Id. if 2. 

Passport applicants must submit sensitive and personally identifiable information, 

including: name, date of birth, city of birth, state of birth, country of birth, social security number, 

sex, height, hair color, eye color, occupation, and evidence of U.S. Citizenship, such as a 

previously issued U.S. Passport or U.S. birth certificate. Amended Complaint if 24. Applicants 

must also submit present identification such as a fully valid driver's license or military ID. Id. 

Plaintiffs refer to this information collectively as "Personal Information." Id. 

CGI typically stores this Personal Information on its computer systems and transmits it to 

the Passport Agency in Washington, DC. Id. if 24. Under the terms of CGI's contract, it must 

"'provide accessible and qualified management, production, and operational support personnel' to 

2 All facts are taken from Plaintiffs Amended Complaint. [Dkt. No. 25]. 

-2-
perform document preparation, creation of document batches, document imaging (scanning) and 

reviewing, retrieval of individual application information, data entry, book printing, quality 

control, generation of mailing labels, and verification of information." Amended Complaint if 2. 

Beginning sometime in 2010, until roughly March 2, 2015, unidentified CGI personnel 

stole the Personal Information of passport applicants. Amended Complaint if 31. These 

individuals then used the Personal Information to create counterfeit identity documents, obtain 

commercial lines of credit, and purchase iPhones, iPads, and other electronic merchandise. Id. if 

32. 

McDowell was one of the applicants whose Personal Information was stolen. Amended 

Complaint if 18. McDowell, a resident and citizen of Carrolton, Georgia, had submitted a passport 

application from her hometown. Id. ifif 10, 14. Like other applications, hers contained the required 

Personal Information, which was intended for transmission to Washington, D.C., via CGI's 

computer systems. Id. if 14. Following the submission of her application, CreditScore.com, a 

credit monitoring service, notified McDowell that someone had opened a T-Mobile Account using 

her social security number and that someone had also made a $2,300 retail purchase in Texas using 

her identity. Id. if 16. Additionally, CreditScore.com notified McDowell that someone attempted 

a "hard inquiry'' check of her credit while attempting to open an account in her name at a Sprint 

Nextel in Colorado. Id. if 18. On June 3, 2015, the U.S. Department of Justice formally notified 

McDowell that she was a victim of the theft of Personal Information from CG I's computer systems. 

Id. if 18. As a result of the theft of her Personal Information, McDowell has had to: pay for 

additional credit monitoring protection; expend time disputing fraudulent charges and accounts 

-3-
.. 

with banks, credit card companies, and credit reporting agencies; and take other steps to protect 

herself from additional harm. Id. ~ 20. 

B. Procedural Background 

On July 20, 2015, McDowell initiated this class action lawsuit, filing a Complaint against 

the CGI and the Doe Defendants on behalf of herself and other similarly situated individuals who 

had Personal Information, contained in passport applications, stolen by CGI employees. [Dkt. No. 

1]. On October 9, 2015, McDowell filed an Amended Complaint, alleging that CGI was liable for 

violations of the CPPA, negligence, breach of contract, breach ofbailment, and unjust enrichment. 

Amended Complaint ~ 6. 

CGI then filed a Motion to Dismiss on October 26, 2015, arguing that McDowell failed to 

state a claim on any of the counts contained in the Amended Complaint. Motion to Dismiss 

("MTD") [Dkt. No. 27]. McDowell filed an Opposition on November 23, 2015, [Dkt. No. 30], 

and CGI filed a Reply on December 21, 2015, [Dkt. No. 31]. 

II. STANDARD OF REVIEW 

Rule 12(b )( 6) of the Federal Rules of Civil Procedure permits dismissal upon the "failure 

to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b )( 6). "To survive a motion 

to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to 

relief that is plausible on its face." Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (internal quotation 

marks and citations omitted). A claim is facially plausible when the pleaded facts "allows the 

court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. 

-4-
Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully," but it 

is not a "probability requirement." Id. 

At the Rule 12(b)(6) stage, the court accepts all of the complaint's factual allegations as 

true and draws all reasonable inferences from those facts in plaintiffs favor. Browning v. Clinton, 

292 F.3d 235, 242 (D.C. Cir. 2002). However, the court does not accept "inferences drawn by 

plaintiff if such inferences are unsupported by the facts set out in the complaint." Id. (internal 

quotation marks and citations omitted). Similarly, the court need not accept plaintiffs legal 

conclusions simply because they are "cast in the form of factual allegations." Id. (internal 

quotation marks and citations omitted). "Threadbare recitals of a cause of action's elements, 

supported by mere conclusory statements," are insufficient to survive a motion to dismiss. Iqbal 

556 U.S. at 678. 

In addition to the complaint, the court may consider other sources, such as "documents 

incorporated into the complaint by reference and matters of which a court may take judicial 

notice." Tellabs, Inc. v. Makar Issues & Rights, Ltd., 551 U.S. 308, 322 (2007). 

III. ANALYSIS 

A. CPPA 

Plaintiff alleges that CGI violated the CPP A, which prohibits a person from 

misrepresenting the characteristics of consumer goods or services, by representing that it would 

secure the passport application data when it did not. Amended Complaint ~~ 53-64. Defendants 

argue that this claim should be dismissed because Plaintiff is not a "consumer" under the CPP A. 

MTD at 17-21. 

Under the CPPA, it is an unlawful trade practice for "any person to: (a) represent that goods 

or services have ... characteristics ... that they do not have." D.C. Code§ 28-3904(a). However, 

-5-
subject to limited exceptions only consumers are authorized to bring suit under the CPPA.3 D.C. 

Code§ 28-3905(k)(l)(A). Thus, "[t]he D.C. Court of Appeals has repeatedly concluded that the 

CPPA was designed to police trade practices arising only out of consumer-merchant relationships." 

Ali v. Tolbert, 636 F.3d 622, 628 (D.C. Cir. 2011) (internal quotation marks omitted); Price v. 

Indep. F.S.B., 110 A.3d 567, 573 (D.C. 2015) (the CPPA "'was designed to police trade practices 

arising only out of consumer-merchant relationships,' and does not apply to commercial dealings 

outside the consumer sphere" (quoting Ford v. Chartone, Inc., 908 A.2d 72, 81 (D.C. 2006))). 

"Consumer goods or services' are those that [a] person does or would purchase, lease (as lessee), 

or receive and normally use for personal, household, or family purposes." Price, 110 A.3d at 574 

(emphasis added) (quotation marks omitted). 

McDowell alleges that CGI misrepresented the services it offered. Amended Complaint~ 

53-64. In a brochure advertising its services, CGI stated that it provides "technology management" 

services that provide: "secure data center operations;" "around-the-clock monitoring of systems, 

real-time reporting and immediate action on suspicious activity from CGI's security operations 

centers;" and "[e]xpert threat anticipation and defense of critical information and infrastructure." 

Amended Complaint~ 58. McDowell argues that these statements misrepresented the security of 

the services provided by CGI to the Passport Agency, as evidenced by the fact that CGI employees 

were able to steal Personal Information contained in passport applications. Opp'n at 9. 

3 For example, in addition to consumers, the CPPA authorizes: nonprofit organizations to bring 

suit on behalf of its member or the general public, D.C. Code § 28-3905(k)(l)(C); and public 

interest organizations to bring suit on behalf a consumer or class of consumers, Id. § 28-

3905(k)( 1 )(D). McDowell does not allege that she is authorized to sue under any of these other 

provisions of the CPP A. 

-6-
The problem with McDowell's argument is that the services she alleges that CGI 

misrepresented are not consumer services, but business services. The technology management 

services CGI provides to the Passport Agency are typical of the back-office services that one 

company provides to another. They are decidedly not for personal, household, or family purposes, 

and therefore do not fall within the ambit of the CPPA. See Indep. Commun. Network, Inc. v. 

MCI Telecomm. Corp., 657 F. Supp. 785, 788 (D.D.C. 1987) (transactions between two merchants 

that are on the "supply side" of the consumer-merchant do not fall within ambit ofCPPA); Adam 

A. Weschler & Son, Inc. v. Klank, 561 A.2d 1003, 1005 (D.C. 1989) ("Transactions along the 

distribution chain that do not involve the ultimate retail customer are not consumer transactions 

that the Act seeks to reach." (emphasis added)). And even if these were consumer services, 

McDowell is not the one who purchased them-the Passport Agency did-and so it cannot be said 

that she was the consumer. 

In response, McDowell argues that the passport she applied for is a consumer good and 

therefore that she is a consumer for purposes of the CPPA. Opp'n at 8. That argument cannot be 

squared with the definition of a "good" as used in the CPP A, which defines "goods and services" 

as "any and all parts of the economic output of society, at any stage or related or necessary point 

in the economic process, and includes consumer credit, franchises, business opportunities, real 

estate transactions, and consumer services of all types." D.C. Code § 28-390l(a)(7) (emphasis 

added). Simply put, a passport is not part of the economic output of society. See Urtetiqui v. 

D'Arcy, 34 U.S. 692, 699 (1835) (a passport "is a document, which, from its nature and object, is 

addressed to foreign powers; purporting only to be a request, that the bearer of it may pass safely 

and freely; and is to be considered rather in the character of a political document, by which the 

-7-
bearer is recognized, in foreign countries, as an American citizen; and which, by usage and the law 

of nations, is received as evidence of the fact." (emphasis added)). 

As McDowell is not a consumer within the meaning of the CPPA, she cannot state a claim 

for which relief can be granted, and her CPP A claim must be dismissed. 

B. Negligence 

McDowell also alleges that CGI negligently handled her Personal Information by failing 

to take reasonable steps to prevent the theft of Personal Information by CGI employees. Amended 

Complaint iii! 66-71. Defendants argue that this claim should be dismissed because McDowell has 

alleged only that she has suffered economic injuries, which cannot, in and of themselves, support 

a claim of negligence. MTD at 23-26. 

"In order to maintain a legally sufficient negligence claim, a plaintiff must demonstrate: 

(1) that the defendant owed a duty to the plaintiff, (2) breach of that duty, and (3) injury to the 

plaintiff that was proximately caused by the breach." Aguilar v. RP MRP Washington Harbour, 

LLC, 98 A.3d 979, 982 (D.C. 2014) (internal quotations deleted). However, in Aguilar, the District 

of Columbia Court of Appeals adopted the "economic loss" doctrine, which "bars recovery of 

purely economic losses in negligence" actions. Id. at 985-86. 

Under a limited exception to the economic loss doctrine, plaintiff may recover solely for 

economic injuries if she can demonstrate she had a "special relationship" with the defendant. Id. 

at 984-86, nn. 3 & 4; Whitt v. Am. Prop. Constr., P.C., No. 15-CV-1199, 2017 WL 1288572, at 

*6 (D.C. Apr. 6, 2017). Where such a "special relationship" exists, the defendant owes an 

independent duty of care to the plaintiff and it is proper to hold the defendant liable for a breach 

of that duty. Id. Absent such a special relationship, there is no duty and, consequently, no claim 

for negligence. Id.; see also Jefferson v. Collins, 210 F. Supp. 3d 75, 85-86 (D.D.C. 2016). 

-8-
Whether or not such a special relationship exists "is entirely a question of law that must be 

determined only by the court." Whitt, 2017 WL 1288572 at *7 (quotation marks omitted). 

In determining whether a special relationship exists, the Court asks whether "defendants 

had an 'obligation ... to care for the [plaintiffs] economic well-being' or an 'obligation' that 

'implicated [her] economic expectancies."' Whitt, 2017 WL 1288572 at *6 (quoting Aguilar, 98 

A.3d at 985). Citing approvingly to the decisions of other jurisdictions, the District of Columbia 

Court of Appeals has suggested that an "intimate nexus" or "close nexus" "between the parties" is 

required to establish the existence of a special relationship and that a plaintiff may demonstrate 

the existence of such a nexus through "contractual privity or its equivalent." Aguilar, 98 A.3d at 

985 n. 3 (internal citations and quotation marks omitted). A special relationship is unlikely to exist 

where "variables beyond [defendant's] negligence could prove determinative of the likelihood of 

serious economic harm." Aguilar, 98 A.3d at 985 n. 4. 

For example, in Whitt, the court held that a construction company had a special relationship 

with the plaintiff-business because: (1) its construction permit contained express terms 

"specifically protecting [the business] from the effects" of the construction project; and (2) the 

long-term, extensive nature of the construction project meant the harm was not "isolated and 

unexpected." 2017 WL 1288572 at *7. In Whitt, the defendant construction company participated 

in an extensive construction project directly outside of plaintiffs business entrance over a multiyear period. Id. at *6. An express provision of the construction permit for the project stated that 

the project would not block access to the plaintiffs business. Id. Despite this provision, the 

defendant repeatedly blocked the entrance or interfered with entry to plaintiffs business over the 

-9-
course of the multi-year project. Id. at *1. Plaintiff repeatedly complained, to no avail, and was 

ultimately forced to close her business due to a loss of customers. Id. at *2. 

Based on the terms of the permit and the foreseeability that the project might impact the 

plaintiffs business, the court concluded that the "[defendant] undertook obligations that would 

implicate [the plaintiffs] economic expectancies," and therefore that a special relationship existed. 

Id. at *6. As the construction permit expressly protected access to plaintiffs entrance, the 

defendant knew that its project could economically impact the plaintiff. Id. And by committing 

to follow the terms of the permit, the defendant voluntarily took that obligation upon itself, thereby 

creating a special relationship with, and a duty to, the plaintiff. Id. 

Here, McDowell has not plead facts that can establish the existence of a special relationship 

between her and CGI. For example, she does not argue that she was in contractual privity, or its 

equivalent, with CGI. Nor does she allege that the contract itself contained language that created 

the special relationship. Instead, she argues that "CGI owed a duty of care to Plaintiffs because 

they were foreseeable and probable victims of any inadequate data security practices." Amended 

Complaint ~ 69. But both Aguilar and Whitt make clear that foreseeability alone is insufficient to 

establish a special relationship. See e.g. Aguilar, LLC, 98 A.3d at 984 ("we again decline to apply 

the foreseeability test ... in negligence cases involving purely economic losses."). 

Belatedly, McDowell argues that the existence of a special relationship could be shown by ' 

inspecting the contract-which neither party submitted to the Court in full-and therefore that she 

should be allowed to proceed to discovery. See Opp'n at 18. But it is clear from the Amended 

Complaint that McDowell believes this duty arises not from the terms of the contract, but because 

CGI is "actively engaged in the business of collecting, storing, securely transferring, and 

-10-
maintaining [sensitive personal information]." Id. if 66. The Court will not consider an argument 

omitted from the Complaint and raised for the first time in a dispositive motion.4 

As McDowell has failed to allege any facts that plausibly establish the existence of a special 

relationship, she cannot state a claim for negligence and this count must be dismissed. 

C. Contract Claims 

McDowell's Amended Complaint alleges that CGI breached its contract with the State 

Department by failing to secure her Personal Information. Amended Complaint iii! 73-77. She 

further alleges that she is entitled to sue to remedy this breach because: (1) she is a party to the 

contract with CGI; or (2) in the alternative, she is an intended beneficiary of the contract with CGI. 

1. Choice of Law 

As an initial matter, it appears that there is some uncertainty as to whether federal common 

law or the common law of the District of Columbia is applicable to McDowell's contract claims. 

Ordinarily, federal common law governs the interpretation of contracts to which the United States 

is a party. See e.g. Miree v. DeKalb County, Ga., 433 U.S. 25, 28 (1977). However, even where 

a lawsuit involves a federal contract, if it "is purely between private parties and does not touch 

rights and duties of the United States," state, rather than federal, law governs. Boyle v. United 

Techs. Corp., 487 U.S. 500, 506 (1988); see also Miree, 433 U.S. at 29. It is not necessary to 

resolve this question, because federal common law and the common law of the District of 

4 The Court may disregard a claim raised for the first time in a memorandum of law. TunicaBiloxi Tribe of La. v. U.S., 577 F. Supp. 2d 382, 411 (D.D.C. 2008). If the factual basis for a new 

claim is substantially similar to a claim already alleged in a plaintiffs complaint and the court 

dismisses the newly-raised claim, the court must afford the plaintiff leave to amend her complaint 

to include it. See id.; Wiley v. Glassman, 511F.3d151, 159 (D.C. Cir. 2007) 

-11-
Columbia are so similar as to the issues presented in this case that the Court would reach the same 

conclusion regardless of which law applies. 

2. There was no contract between CGI and McDowell 

McDowell alleges that she entered into a contract with CGI when she submitted her 

passport application. Amended Complaint i! 74-75. CGI argues that Plaintiff fails to allege that 

any communication between McDowell and CGI took place, and therefore, there could have been 

no meeting of the minds, which is necessary for contract formation. MTD at 28-29. 

To state a claim for breach of an express or implied contract, Plaintiff must allege: "(1) a 

valid contract between the parties; (2) an obligation or duty arising out of the contract; (3) a breach 

of that duty; and (4) damages caused by breach." Brown v. Sessoms, 774 F.3d 1016, 1024 (D.C. 

Cir. 2014 ). The party asserting the existence of an enforceable contract bears the burden of proving 

that there has been a "meeting of the minds," or mutual assent, as to all material terms. Ekedahl 

v. COREStaff, Inc., 183 F.3d 855, 858 (D.C. Cir. 1999); U.S. ex rel. Morsell v. Symantec Corp., 

130 F. Supp. 3d 106, 131(D.D.C.2015) ("The party alleging a contract must show a mutual intent 

to contract"). Without a "meeting of the minds" as to all material terms, there can be no 

enforceable contract. Bailey v. Fed. Nat'l Mortg. Ass'n, 209 F.3d 740, 746 (D.C. Cir. 2000). 

Here, there is no valid argument that McDowell and CGI ever formed a valid contract. 

While there was a meeting of the minds between CGI and the State Department, no such meeting 

of the minds took place between McDowell and CGI. McDowell's Amended Complaint contains 

no allegation of any interaction from which to infer a meeting of the minds between Plaintiff and 

CGI Federal. Indeed, in her Opposition, McDowell seems to abandon the argument that any 

contract was formed between her and CGI, arguing only that she was a third party beneficiary of 

the contract between the State Department and CGI. See Opp'n generally (failing to respond to 

-12-
CGI's arguments regarding contract formation); Reply at 15 (similarly noting that "Plaintiff 

attempts to defend Count 3 solely on a third-party beneficiary theory"). 

Consequently, Plaintiff has failed to state a claim that she entered into a contract with 

CGI, which CGI then breached by failing to secure her Personal Information. 

3. McDowell has stated a claim as a third-party beneficiary 

In the alternative, McDowell alleges that she is an intended third-party beneficiary of the 

contract between the State Department and CGI, and that she is entitled to sue for its breach. 

Amended Compli:iint ~ 76. CGI argues that she has failed to allege facts showing that she was an 

intended beneficiary, and therefore cannot sue for breach of the contract. MTD at 31-32. 

Intended third-party beneficiaries to a contract may sue to enforce the terms of the contract 

or obtain a remedy for a breach. Moore v. Gaither, 767 A.2d 278, 287 (D.C. 2001); GECCMC 

2005-Cl Plummer St. Off. Ltd. Partn. v. JPMorgan Chase Bank, Nat. Ass'n, 671 F.3d 1027, 1033 

(9th Cir. 2012) (internal citations and quotation marks omitted). However, in the context of 

contracts with the government, there is a presumption that members of the public are not intended 

beneficiaries, but merely incidental beneficiaries of the contract. Moore, 767 A.2d at 287; 

GECCMC, 671 F.3d at 1033. Such incidental beneficiaries have no right to sue for breach of 

contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033. 

In order to overcome this presumption, a third-party plaintiff suing for breach of contract 

must show that the contracting parties "clearly intended" that the contract would benefit the 

plaintiff, or an identifiable class to which the plaintiff belongs. GECCMC, 671 F.3d at 1033; 

Moore, 767 A.2d at 287. Such intent may exist where the plaintiff would be reasonable in relying 

on the promise as manifesting an intention to confer a right on him or her. See Restatement 

(Second) of Contracts§ 302(1)(b) cmt. d (1981); see e.g. Klamath Water Users Protective Ass'n 

-13-
"· 

v. Patterson, 204 F.3d 1206, 1211 (9th Cir. 1999). "This 'clear intent' hurdle is a high one." 

GECCMC, 671 F.3d at 1033. 

McDowell has plead sufficient facts to plausibly state a claim that she is an intended 

beneficiary of the contract between CGI and the Department of State. Her Amended Complaint 

states "[t]he U.S. and CGI agreed to properly receive, handle, store, and otherwise utilize the 

Personal Information of Plaintiffs. Upon information and belief, it was also a term of the contract 

that CGI would act reasonably and employ reasonable safeguards at all times with respect to 

handling the Personal Information of Plaintiffs, including requiring a background security 

investigation for all CGI employees with authorized access to the Personal Information." 

Amended Complaint ~ 76 (emphasis added). In other words, Plaintiff alleges that the contract 

contains terms that expressly require CGI: (1) to protect the Personal Information it receives; and 

(2) to do so for the benefit of an identifiable class of individuals, passport applicants, to which she 

belongs. 

If the contract-which, as already noted, is not before the Court in its entirety-bears out 

that allegation, it is at least plausible that she can establish that she is an intended beneficiary. 

Depending on the language of the alleged contract provision, as well as the contract as a whole, it 

is plausible that an objective passport applicant would be reasonable in relying on the promise as 

manifesting an intention to confer a right on him or her to have their Personal Information 

safeguarded by CGI. 

Whether she can do so will depend on the specific language contained in the contract, but 

that is a merits question that should not be resolved in deciding CGI's Motion to Dismiss when 

the contract is not before the Court. See SB Charles Alan Wright & Arthur R. Miller, Federal 

-14-
Practice & Procedure§ 1357 (Supp. 2011) ("Wright & Miller") ("Whether the plaintiff ultimately 

can prevail on the merits is a matter properly determined on the basis of proof, which means on a 

summary judgment motion or at trial by the judge or a jury, and not merely on the face of the 

pleadings"). Given the "liberal pleading standard" embodied in the Federal Rules, see Jones v. 

Air Line Pilots Ass'n, Intern., 642 F.3d 1100, 1104 (D.C. Cir. 2011), McDowell should have the 

opportunity to do so. 

CGI's counter-arguments are unpersuasive. First, CGI argues that the test for whether a 

plaintiff is an intended beneficiary "is not merely whether or not the parties intended to confer a 

benefit on third parties (or to give a right to 'performance' as Plaintiff alleges), but rather whether 

or not 'the parties intended the third party to be able to sue to protect that benefit."' MTD at 32 

(quoting Doe v. District of Columbia, 796 F.3d 96, 109 (D.C. Cir. 2015) (emphasis added)). 

However, that holding was issued in the context of a case involving a consent decree-not an 

ordinary government contract-and is best read as limited to that context. See Doe, 796 F.3d 96 

(involving a challenge to implementation of a consent decree, reached in a previous lawsuit, by 

individuals who were not parties to the consent decree). 

The decision itself only discusses the ability of "[t]hird parties to a consent decree" to sue 

for breach of the consent decree and does not discuss third parties to other types of contracts. See 

Doe, 796 F.3d at 109. Additionally, CGI's reading of Doe cannot be squared with Moore or 

GECCMC-both cases that CGI itself cites in its Motion to Dismiss-which do not require a 

plaintiff to show that contracting parties intended the plaintiff to be able to sue to protect a benefit 

conferred by the contract in order to prove that she is an intended beneficiary. Finally, all of the 

cases cited by the Court of Appeals in Doe also involved consent decrees, not ordinary contracts. 

-15-
Doe, 796 F.3d at 109, n.4 (citing: SEC v. Prudential Sec. Inc., 136 F.3d 153, 159 (D.C. Cir. 1998) 

(involving consent decree between securities seller and the SEC); Blue Chip Stamps v. Manor 

Drug Stores, 421 U.S. 723, 750 (1975) (involving anti-trust consent decree), Terrell v. District of 

Columbia, 703 F.Supp.2d 17, 21 (D.D.C. 2010) (involving IDEA consent decree), Beckett v. Air 

Line Pilots Ass'n, 995 F.2d 280 (D.C.Cir.1993) (involving consent decree between pilots' union 

and non-member pilots)). As Doe appears only to define the applicable standard for determining 

who is a third-party beneficiary to consent decrees, it does not control resolution of this case. 

Second; CGI points to cases in other jurisdictions in which courts have held that victims of 

a data breach were not intended beneficiaries of contracts related to the handling of their data. 

MTD at 32 (relying on the cases collected in Willingham v. Global Payments, Inc., No. 1:12-CV01157-RWS, 2013 WL 440702, at *19-20 (N.D. Ga. Feb. 5, 2013)). But at least two of the three 

cases cited in Willingham were decided on motions for summary judgment after the contract had 

been introduced as evidence. See Sovereign Bank v. BJ's Wholesale Club, Inc., 533 F.3d 162, 167 

(3d Cir. 2008) ("the district court converted Fifth Third's motion for reconsideration into a motion 

for summary judgment and ordered the parties to conduct discovery on the third-party beneficiary 

issues, i.e., whether Fifth Third's contractual obligation to Visa to comply with the Visa Operating 

Regulations was intended to benefit Issuers like Sovereign."); Banknorth, N.A. v. BJ's Wholesale 

Club, Inc., 442 F. Supp. 2d 206, 211 (M.D. Pa. 2006) (court granted motion for summary judgment 

because a provision in the contract "specifically providing that the contract was not for the benefit 

of, and not intended to be enforced by, any third party."). 

That approach accords more closely to the liberal pleading standard established by the 

Federal Rules. It is particularly appropriate in third-party beneficiary cases, where the Plaintiff is 

-16-
not a party to the contract, and therefore, is unlikely to be able to include express provisions of the 

contract in her Complaint to demonstrate that she is an intended beneficiary. Moreover, because 

the contract is likely to be incorporated into the plaintiffs complaint by reference, as it was in this 

case, the defendant-as a party to the contract-has it entirely within its power to submit the 

contract as an attachment or exhibit to the motion to dismiss without converting it into a motion 

for summary judgment. See Tellabs, 551 U.S. at 322. In doing so, the defendant likely can avoid 

even the limited discovery provided for in cases such as Sovereign Bank. 

McDowell's Amended Complaint states a plausible claim that she is an intended 

beneficiary of the contract between CGI and the State Department, and therefore, the Court will 

not dismiss her breach of contract claim. 

D. Bailment 

Finally, McDowell alleges that she and CGI entered into a bailment relationship that 

required CGI to safeguard her Personal Information when she submitted her passport application, 

which CGI then breached. Amended Complaint iii! 79-84. CGI counters that no bailment 

relationship was created because there was no agreement between McDowell and CGI. MTD at 

37-40. 

"A bailment relationship is said to arise where an owner, while retaining title, delivers 

personalty to another for some particular purpose upon an express or implied contract. The 

relationship includes a return of the goods to the owner or a subsequent disposition in accordance 

with his instructions." Kam-Almaz v. U.S., 682 F.3d 1364, 1368 (Fed. Cir. 2012). In the District 

of Columbia, "[a] bailment for hire relationship may be created even in the absence of an explicit 

agreement. All that is required is the existence of a mutual benefit." First Am. Bank, N.A. v. 

-17-
District of Columbia, 583 A.2d 993, 996 (D.C. 1990). Thus, "[a] person becomes a bailee for hire 

when he takes property into his care and custody for a compensation. The nature and amount of 

the compensation are immaterial." First Am. Bank, 583 A.2d at 996. 

McDowell has failed to allege facts that plausibly support the existence of a bailment 

relationship. As discussed above, there were no communications between McDowell and CGO, 

and therefore, they could not have formed an agreement necessary to create an express bailment. 

Similarly, CGI received no compensation from McDowell nor did it expect to receive additional 

compensation from the State Department for processing McDowell's passport application, and 

therefore, they could not have formed an implied bailment or quasi-bailment. See Snowder v. 

District of Columbia, 949 A.2d 590, 605 (D.C. 2008) (quasi-bailment is formed when bailee takes 

possession of property "in expectation of compensation"). To the extent any bailment relationship 

existed it was between McDowell and the State Department, and that is insufficient, in and of 

itself, to impose liability on CGI for the data breach. 8A Am. Jur. 2d Bailments § 126 (2017 

Update) ("A bailee who employs agents or employees who use or otherwise deal with the bailed 

property is responsible for the conduct of such persons while they are acting within the scope of 

their employment."). 

Accordingly, McDowell has failed to state facts that plausibly support the existence of any 

form of a bailment, and therefore cannot state a claim for breach of bailment. 5 

E. Unjust Enrichment 

Finally, McDowell alleges that CGI was unjustly enriched because it received benefits 

under its contract with the State Department but failed to fulfill its contractual obligation to 

5 As no bailment existed, it is unnecessary to address CGI's other arguments. MTD at 39-40. 

-18-
safeguard Personal Information. Amended Complaint ifif 86-92. CGI argues that McDowell fails 

to allege that she conferred any benefit on CGI. MTD at 33-35. 

Under D.C. law, "unjust enrichment occurs when: (1) the plaintiff conferred a benefit on 

the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the 

defendant's retention of the benefit is unjust." Pernice v. Bovim, Civil Action No. 15-541 (JEB), 

2015 WL 5063378, at *6 (D.D.C. Aug. 26, 2015) (quoting Peart v. D.C. Hous. Auth., 972 A.2d 

810, 813 (D.C. 2009)). "To recover on a theory of unjust enrichment ... the plaintiff must show 

that the defendant was unjustly enriched at his expense .... " Id. at *7 (quoting News World 

Commc'ns, Inc. v. Thompsen, 878 A.2d 1218, 1222 (D.C. 2005)). 

McDowell fails to allege any facts that plausibly suggest that she conferred any benefit on 

CGI. Her Amended Complaint identifies two benefits that she argues she conferred on CGI. First, 

she claims that her passport-application fee was used to pay CGI for the costs of processing her 

passport application. Amended Complaint if 87; Opp'n at 20. But as CGI correctly points out, by 

law passport application fees must be paid directly to the Treasury. See 22 U.S.C. § 214(a). 

Therefore, those fees could not have been paid to CGI and they cannot constitute a benefit. 

Second, she argues that by submitting passport applications, she and the other putative 

class members created additional demand for passport processing services, which is itself a benefit 

to CGI. Amended Complaint if 86. However, inchoate demand is not itself a benefit, because it 

lacks intrinsic value. To be sure, increased demand for a service may create additional value for 

the supplier, such as by raising the market price for the service or creating a market that did not 

previously exist. However, McDowell's Amended Complaint does not allege that the additional 

demand for passport processing services by the putative class members increased the value of the 

-19-
contract between CGI and the Passport Agency or that the contract would not have been executed 

absent the increased demand. Thus, even under her theory that Plaintiffs' applications increased 

demand for passport processing services, McDowell has failed to allege any identifiable benefit 

that CGI received as a result. 

Additionally, McDowell fails to allege that she "conferred" any of these putative benefits 

on CGI. Sabre Int'l Sec. v. Torres is instructive. 60 F. Supp. 3d 36 (D.D.C. 2014). In that case, 

Sabre sued Torres, as well as Torres' individual employees, arguing that Sabre's payments to 

Torres unjustly enriched the individual employees in the form of salaries and bonuses they 

received from Torres. Id. at 41-42. The Court found that nothing in the Complaint connected the 

benefit that the company improperly took from Sabre to the monies paid to the employees. 

Therefore, the Court dismissed Sabre's unjust enrichment claim, concluding that "Sabre has not 

plausibly alleged that it had any role in conferring these benefits on the [individual employees]." 

Id. at 42. 

Just as in Sabre, McDowell has failed to allege any fact that plausibly suggests that she had 

any role in "conferring" anything of value on CGI, and therefore cannot state a claim for unjust 

enrichment. 

IV. CONCLUSION 

For the foregoing reasons Plaintiffs Amended Complaint is dismissed with respect to all 

Counts, except Count 3, her third-party beneficiary breach of contract claim. 

June 1, 2017 GladysKeSef G'~~ -

United States District Judge 

-20-