UNITED STATES DISTRICT COURT FORTHE DISTRICT OF COLUMBIA LORI McDOWELL, on behalfof herselfand similarly situated, Plaintiffs,


### v. CGI FEDERAL INC., and DOES 1through100,inclusive Defendants. CivilAction No. 15-1157 (GK)

MEMORANDUM OPINION Plaintiff, Lori McDowell, alleges that her personal information was stolen by employees ofDefendant, CGI Federal, Inc. ("CGI"), and then used to open accounts and make purchases usingheridentity. CGI acquiredthisinformationpursuantto acontractwiththe StateDepartment, under which CGI received and processed passport applications onbehalfofthe State Department, including the application ofMcDowell. McDowell brings this class action lawsuit on behalfof herselfand other similarly situated individuals, alleging that CGI failed to adequately safeguard theirpersonal dataand is therefore liablefor: (1) violations ofthe DistrictofColumbia'sConsumer Protection Procedures Act, D.C. Code§ 28-3901 etseq. ("CPPA"); (2) negligence; (3) breach of contract; ( 4) breach ofbailment; and (5) unjust enrichment. 1

1 McDowell brings the same claims against unknown individuals who she alleges are "legally responsible in some manner for the unlawful acts referred to herein," collectively Does 1through 100. Amended**Complaint~** 12. Because these Doe defendants are not mentioned in the factual allegations contained in McDowell's Amended Complaint, they are unnecessary to the resolution ofCGI's Motionto Dismiss, and therefore, are not discussed further inthis Opinion. -1-CGI filed a Motion to Dismiss McDowell's Amended Complaint, [Dkt. No. 27], arguing that she has failed to state a claim upon whichreliefcanbe granted for any Countcontained in the Amended Complaint. Upon consideration ofthe Motion to Dismiss, responsive briefs, and the entire record herein, and for the reasons stated below, Defendant's Motion to Dismiss is granted
as to all counts except McDowell's ofbreach ofcontract claim, contained in Count 3. I. 

### BACKGROUND A. Factual Background2 CGI is a Delaware corporation with an office in Washington, D.C., and a principal place ofbusiness in Fairfax, Virginia. Amended Complaint 

## if 11. It provides a number ofservices to the United States Passport Agency, a constituent of the State Department, also located in Washington, D.C. Id. 

## if 11. Pursuantto the contractatissuehere, itprocessespassportapplications for the Passport Agency. Id. 

## if 2. Passport applicants must submit sensitive and personally identifiable information, including: name, date ofbirth, city ofbirth, state ofbirth, country ofbirth, social securitynumber, sex, height, hair color, eye color, occupation, and evidence of U.S. Citizenship, such as a previously issued U.S. Passport or U.S. birth certificate. Amended Complaint 

## if 24. Applicants must also submit present identification such as a fully valid driver's license or military ID. Id. Plaintiffs refer to this information collectively as "Personal Information." Id. CGI typically stores this Personal Information on its computer systems and transmits it to the Passport Agency in Washington, DC. Id. 

## if 24. Under the terms ofCGI's contract, it must "'provide accessible and qualified management, production, and operational supportpersonnel' to

2 All facts are taken from Plaintiffs Amended Complaint. [Dkt. No. 25]. 

### -2-perform document preparation, creation ofdocument batches, document imaging (scanning) and reviewing, retrieval of individual application information, data entry, book printing, quality control, generation ofmailing labels, and verification ofinformation." Amended Complaint

## if 2. Beginning sometime in 2010, until roughly March 2, 2015, unidentified CGI personnel stole the Personal Information of passport applicants. Amended Complaint 

## if 31. These individuals then used the Personal Information to create counterfeit identity documents, obtain commercial lines ofcredit, and purchase iPhones, iPads, and other electronic merchandise. Id. 

## if 32. McDowell was one ofthe applicants whose Personal Information was stolen. Amended Complaint

## if 18. McDowell, aresident and citizenofCarrolton, Georgia, had submitted apassport applicationfrom herhometown. Id. 

## ifif 10, 14. Like other applications, hers containedtherequired Personal Information, which was intended for transmission to Washington, D.C., via CGI's computer systems. Id. 

## if 14. Following the submission ofher application, CreditScore.com, a creditmonitoring service, notifiedMcDowellthat someonehad opened a T-Mobile Accountusing her social securitynumber andthat someonehad also made a $2,300 retail purchase inTexasusing her identity. Id. 

## if 16. Additionally, CreditScore.com notified McDowell that someone attempted
a "hard inquiry'' check ofher credit while attempting to open an account in her name at a Sprint Nextel in Colorado. Id. 

## if 18. On June 3, 2015, the U.S. Department ofJustice formally notified McDowell that shewas avictim ofthetheftofPersonal Informationfrom CGI'scomputersystems. Id. 

## if 18. As a result ofthe theft ofher Personal Information, McDowell has had to: pay for additional credit monitoring protection; expend time disputing fraudulent charges and accounts



### -3-

# ..
with banks, credit card companies, and credit reporting agencies; and take other steps to protect herselffrom additional harm. Id.**~** 20. B. Procedural Background On July 20, 2015, McDowell initiated this class action lawsuit, filing a Complaint against the CGI and the Doe Defendants onbehalfofherselfand other similarly situated individuals who had Personal Information, contained inpassport applications, stolenbyCGI employees. [Dkt. No. 1]. On October 9, 2015, McDowell filed anAmended Complaint, allegingthat CGI was liable for violations ofthe CPPA, negligence, breach ofcontract, breach ofbailment, andunjust enrichment. Amended Complaint**~** 6. CGI then filed a Motionto Dismiss on October 26, 2015, arguing that McDowell failed to state a claim on any of the counts contained in the Amended Complaint. Motion to Dismiss ("MTD") [Dkt. No. 27]. McDowell filed an Opposition on November 23, 2015, [Dkt. No. 30], and CGI filed a Reply onDecember 21, 2015, [Dkt. No. 31]. II. STANDARD OF REVIEW Rule 12(b)(6) ofthe Federal Rules ofCivil Procedure permits dismissal upon the "failure to state a claimupon whichreliefcanbe granted." Fed. R. Civ. P. 12(b)(6). "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to reliefthat is plausible on its face." Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (internal quotation marks and citations omitted). A claim is facially plausible when the pleaded facts "allows the courtto drawthe reasonable inference thatthe defendant is liable for the misconductalleged." Id.



### -4-Plausibility requires "more than a sheer possibility that a defendant has acted unlawfully," but it is not a "probability requirement." Id. At the Rule 12(b)(6) stage, the court accepts all ofthe complaint's factual allegations as true and draws all reasonable inferences from those facts inplaintiffsfavor. Browningv. Clinton, 292 F.3d 235, 242 (D.C. Cir. 2002). However, the court does not accept "inferences drawn by plaintiffif such inferences are unsupported by the facts set out in the complaint." Id. (internal quotation marks and citations omitted). Similarly, the court need not accept plaintiffs legal conclusions simply because they are "cast in the form of factual allegations." Id. (internal quotation marks and citations omitted). "Threadbare recitals of a cause of action's elements, supported by mere conclusory statements," are insufficient to survive a motion to dismiss. Iqbal 556 U.S. at 678. In addition to the complaint, the court may consider other sources, such as "documents incorporated into the complaint by reference and matters of which a court may take judicial notice." Tellabs, Inc. v. Makar Issues & Rights, Ltd., 551 U.S. 308, 322 (2007). III. ANALYSIS A. CPPA Plaintiff alleges that CGI violated the CPPA, which prohibits a person from misrepresenting the characteristics ofconsumer goods or services, by representing that it would
secure the passport application data when it did not. Amended Complaint**~~** 53-64. Defendants argue that this claim should be dismissed because Plaintiffis not a "consumer" under the CPPA. MTD at 17-21. Underthe CPPA, itis anunlawfultradepracticefor "anypersonto: (a) representthatgoods
or services have
... characteristics
...thatthey do nothave." D.C. Code§ 28-3904(a). However, 

### -5-subject to limited exceptions only consumers are authorized to bring suit under the CPPA.3 D.C. Code§ 28-3905(k)(l)(A). Thus, "[t]he D.C. Court ofAppeals has repeatedly concluded that the CPPAwas designedto policetradepractices arising onlyoutofconsumer-merchantrelationships." Ali v. Tolbert, 636 F.3d 622, 628 (D.C. Cir. 2011) (internal quotation marks omitted); Price v. Indep. F.S.B., 110 A.3d 567, 573 (D.C. 2015) (the CPPA "'was designed to police tradepractices arising only out ofconsumer-merchant relationships,' and does not apply to commercial dealings outside the consumer sphere" (quoting Ford v. Chartone, Inc., 908 A.2d 72, 81 (D.C. 2006))). "Consumer goods or services' are those that [a] person does or would purchase, lease (as lessee),
orreceive and normally use for personal, household, or family purposes." Price, 110 A.3d at 574 (emphasis added) (quotation marks omitted). McDowell alleges that CGI misrepresented the services it offered. Amended**Complaint~** 53-64. In abrochure advertisingits services, CGI statedthatitprovides "technologymanagement" services that provide: "secure data center operations;" "around-the-clock monitoring ofsystems, real-time reporting and immediate action on suspicious activity from CGI's security operations centers;" and "[e]xpert threat anticipation and defense ofcritical information and infrastructure." Amended**Complaint~** 58. McDowell argues that these statements misrepresented the security of the servicesprovidedby CGIto the PassportAgency, as evidencedbythe factthatCGI employees
were able to steal Personal Information contained in passport applications. Opp'nat 9.

3 For example, in addition to consumers, the CPPA authorizes: nonprofit organizations to bring suit on behalf ofits member or the general public, D.C. Code § 28-3905(k)(l)(C); and public interest organizations to bring suit on behalf a consumer or class of consumers, Id. § 28- 3905(k)(1 )(D). McDowell does not allege that she is authorized to sue under any ofthese other provisions ofthe CPPA. 

### -6-The problem with McDowell's argument is that the services she alleges that CGI misrepresented are not consumer services, but business services. The technology management services CGI provides to the Passport Agency are typical ofthe back-office services that one companyprovides to another. They are decidedlynotfor personal, household, orfamily purposes, and therefore do not fall within the ambit ofthe CPPA. See Indep. Commun. Network, Inc. v. MCITelecomm. Corp., 657 F. Supp. 785, 788 (D.D.C. 1987) (transactionsbetweentwomerchants that are onthe "supply side" ofthe consumer-merchant do not fall within ambit ofCPPA); Adam A. Weschler & Son, Inc. v. Klank, 561 A.2d 1003, 1005 (D.C. 1989) ("Transactions along the distribution chain that do not involve the ultimate retail customer are not consumer transactions that the Act seeks to reach." (emphasis added)). And even if these were consumer services, McDowell is notthe onewho purchasedthem-thePassportAgencydid-and so itcannotbe said that she was the consumer. In response, McDowell argues that the passport she applied for is a consumer good and therefore that she is a consumer for purposes ofthe CPPA. Opp'n at 8. That argument cannotbe squared with the definition ofa "good" as used in the CPPA, which defines "goods and services"
as "any and all parts ofthe economic output ofsociety, at any stage or related or necessary point in the economic process, and includes consumer credit, franchises, business opportunities, real estate transactions, and consumer services ofall types." D.C. Code § 28-390l(a)(7) (emphasis added). Simply put, a passport is not part ofthe economic output of society. See Urtetiqui v. D'Arcy, 34 U.S. 692, 699 (1835) (apassport "is a document, which, from its nature and object, is addressed to foreign powers; purporting only to be a request, that the bearer ofit may pass safely and freely; and is to be considered rather in the character ofa political document, by which the 

### -7-beareris recognized, inforeign countries, as an Americancitizen; andwhich, by usage andthe law ofnations, is received as evidence ofthe fact." (emphasis added)). As McDowell is not a consumer within the meaning ofthe CPPA, she cannot state a claim for which reliefcanbe granted, and her CPPA claim mustbe dismissed. B. Negligence McDowell also alleges that CGI negligently handled her Personal Information by failing to take reasonable steps to preventthe theft ofPersonal Informationby CGI employees. Amended Complaint

### iii! 66-71. Defendants argue thatthis claim shouldbe dismissedbecause McDowell has alleged only that she has suffered economic injuries, which cannot, in and ofthemselves, support
a claim ofnegligence. MTD at 23-26. "In order to maintain a legally sufficient negligence claim, a plaintiffmust demonstrate: (1) that the defendant owed a duty to the plaintiff, (2) breach ofthat duty, and (3) injury to the plaintiffthat was proximately caused by the breach." Aguilar v. RP MRP Washington Harbour, LLC, 98 A.3d 979, 982 (D.C. 2014) (internalquotations deleted). However, inAguilar, theDistrict of Columbia Court ofAppeals adopted the "economic loss" doctrine, which "bars recovery of purely economic losses in negligence" actions. Id. at 985-86. Under a limited exception to the economic loss doctrine, plaintiffmay recover solely for economic injuries ifshe can demonstrate she had a "special relationship" with the defendant. Id. at 984-86, nn. 3 & 4; Whitt v. Am. Prop. Constr., P.C., No. 15-CV-1199, 2017 WL 1288572, at *6 (D.C. Apr. 6, 2017). Where such a "special relationship" exists, the defendant owes an independent duty ofcare to the plaintiffand it is proper to hold the defendant liable for a breach ofthat duty. Id. Absent such a special relationship, there is no duty and, consequently, no claim for negligence. Id.; see also Jefferson v. Collins, 210 F. Supp. 3d 75, 85-86 (D.D.C. 2016). 

### -8-Whether or not such a special relationship exists "is entirely a question of law that must be determined onlybythe court." Whitt, 2017 WL 1288572 at *7 (quotation marks omitted). In determining whether a special relationship exists, the Court asks whether "defendants had an 'obligation
... to care for the [plaintiffs] economic well-being' or an 'obligation' that 'implicated [her] economic expectancies."' Whitt, 2017 WL 1288572 at *6 (quoting Aguilar, 98 A.3d at 985). Citing approvingly to the decisions ofotherjurisdictions, the District ofColumbia Court ofAppeals has suggestedthat an "intimate nexus" or "closenexus" "betweenthe parties" is required to establish the existence ofa special relationship and that a plaintiffmay demonstrate the existence ofsuch a nexus through "contractual privity or its equivalent." Aguilar, 98 A.3d at 985 n. 3 (internal citations and quotationmarks omitted). A special relationship is unlikelyto exist where "variables beyond [defendant's] negligence could prove determinative ofthe likelihood of serious economic harm." Aguilar, 98 A.3d at 985 n. 4. Forexample, inWhitt, the courtheldthat aconstructioncompanyhad a specialrelationship with the plaintiff-business because: (1) its construction permit contained express terms "specifically protecting [the business] from the effects" ofthe construction project; and (2) the long-term, extensive nature of the construction project meant the harm was not "isolated and unexpected." 2017 WL 1288572 at *7. In Whitt, the defendant constructioncompanyparticipated in an extensive construction project directly outside ofplaintiffs business entrance over a multiyear period. Id. at *6. An express provision ofthe construction permit for the project stated that the project would not block access to the plaintiffs business. Id. Despite this provision, the defendant repeatedly blocked the entrance or interfered with entry to plaintiffs business over the



### -9-course ofthe multi-year project. Id. at *1. Plaintiffrepeatedly complained, to no avail, and was ultimately forced to close her business due to a loss ofcustomers. Id. at *2. Based on the terms ofthe permit and the foreseeability that the project might impact the plaintiffs business, the court concluded that the "[defendant] undertook obligations that would implicate [theplaintiffs] economicexpectancies," andthereforethata specialrelationship existed. Id. at *6. As the construction permit expressly protected access to plaintiffs entrance, the defendant knew that its project could economically impact the plaintiff. Id. And by committing to follow theterms ofthepermit, the defendantvoluntarilytookthat obligationupon itself,thereby creating a special relationship with, and a duty to, the plaintiff. Id. Here, McDowellhas notpleadfacts thatcanestablishthe existenceofa specialrelationship between her and CGI. For example, she does not argue that she was in contractual privity, or its equivalent, with CGI. Nor does she allege that the contract itselfcontained language that created the special relationship. Instead, she argues that "CGI owed a duty ofcare to Plaintiffs because they were foreseeable and probable victims ofany inadequate data security practices." Amended Complaint**~** 69. ButbothAguilar and Whitt make clearthat foreseeability alone is insufficientto establish a specialrelationship. See e.g. Aguilar, LLC, 98 A.3d at 984 ("we again declineto apply the foreseeability test ... in negligence cases involving purely economic losses."). Belatedly, McDowell argues thatthe existence ofa special relationship couldbe shownby ' inspectingthe contract-whichneitherparty submittedto the Courtinfull-andthereforethat she should be allowed to proceed to discovery. See Opp'n at 18. But it is clear from the Amended Complaintthat McDowell believes this duty arises not from the terms ofthe contract, butbecause CGI is "actively engaged in the business of collecting, storing, securely transferring, and 

### -10-maintaining [sensitive personal information]." Id. 

### if 66. The Court will not consider an argument omitted from the Complaint and raised for the first time in a dispositive motion.4 As McDowellhas failedto allege anyfacts thatplausiblyestablishthe existence ofa special relationship, she cannot state a claim for negligence and this count must be dismissed. C. Contract Claims McDowell's Amended Complaint alleges that CGI breached its contract with the State Department by failing to secure her Personal Information. Amended Complaint 

## iii! 73-77. She further alleges that she is entitled to sue to remedy this breach because: (1) she is a party to the contractwith CGI; or (2) inthe alternative, she is an intendedbeneficiaryofthe contractwith CGI.

1. Choice ofLaw As an initial matter, it appears that there is some uncertainty as to whetherfederal common law or the common law ofthe District ofColumbia is applicable to McDowell's contract claims. Ordinarily, federal common law governs the interpretation ofcontracts to whichthe United States is a party. See e.g. Miree v. DeKalb County, Ga., 433 U.S. 25, 28 (1977). However, even where
a lawsuit involves a federal contract, ifit "is purely between private parties and does not touch rights and duties ofthe United States," state, rather than federal, law governs. Boyle v. United Techs. Corp., 487 U.S. 500, 506 (1988); see also Miree, 433 U.S. at 29. It is not necessary to resolve this question, because federal common law and the common law of the District of

4 The Court may disregard a claim raised for the first time in a memorandum oflaw. TunicaBiloxi Tribe ofLa. v. U.S., 577 F. Supp. 2d 382, 411 (D.D.C. 2008). Ifthe factual basis for anew claim is substantially similar to a claim already alleged in a plaintiffs complaint and the court dismisses the newly-raised claim, the courtmust afford the plaintiffleave to amend her complaint to include it. See id.; Wiley v. Glassman, 511F.3d151, 159 (D.C. Cir. 2007) 

### -11-Columbia are so similar as to the issues presented in this case thatthe Courtwouldreach the same conclusion regardless ofwhich law applies. 2. There was no contract between CGI and McDowell McDowell alleges that she entered into a contract with CGI when she submitted her passport application. Amended Complaint 

### i! 74-75. CGI argues that Plaintifffails to allege that any communicationbetweenMcDowell and CGI tookplace, andtherefore, there could have been
no meeting ofthe minds, which is necessary for contract formation. MTD at 28-29. To state a claim for breach ofan express or implied contract, Plaintiffmust allege: "(1) a valid contractbetweenthe parties; (2) an obligation or duty arising outofthe contract; (3) abreach ofthat duty; and (4) damages caused by breach." Brown v. Sessoms, 774 F.3d 1016, 1024 (D.C. Cir. 2014). The partyassertingthe existence ofan enforceable contractbearstheburdenofproving that there has been a "meeting ofthe minds," or mutual assent, as to all material terms. Ekedahl
v. COREStaff, Inc., 183 F.3d 855, 858 (D.C. Cir. 1999); U.S. ex rel. Morsell v. Symantec Corp., 130 F. Supp. 3d 106, 131(D.D.C.2015) ("Thepartyalleging a contractmust showamutual intent to contract"). Without a "meeting of the minds" as to all material terms, there can be no enforceable contract. Bailey v. Fed. Nat'l Mortg. Ass'n, 209 F.3d 740, 746 (D.C. Cir. 2000). Here, there is no valid argument that McDowell and CGI ever formed a valid contract. While there was a meeting ofthe minds between CGI and the State Department, no such meeting ofthe minds tookplace betweenMcDowell and CGI. McDowell's Amended Complaint contains
no allegation ofany interaction from which to infer a meeting ofthe minds between Plaintiffand CGI Federal. Indeed, in her Opposition, McDowell seems to abandon the argument that any contract was formed betweenher and CGI, arguing only that she was a third party beneficiary of the contract between the State Department and CGI. See Opp'n generally (failing to respond to -12-CGI's arguments regarding contract formation); Reply at 15 (similarly noting that "Plaintiff attempts to defend Count 3 solely on a third-party beneficiary theory"). Consequently, Plaintiffhas failed to state a claim that she entered into a contract with CGI, which CGI then breachedby failing to secure her Personal Information. 3. McDowell has stated a claim as a third-party beneficiary In the alternative, McDowell alleges that she is an intended third-party beneficiary ofthe contract between the State Department and CGI, and that she is entitled to sue for its breach. Amended Compli:iint**~** 76. CGI argues that she has failed to allege facts showing that she was an intended beneficiary, and therefore cannot sue for breach ofthe contract. MTD at 31-32. Intendedthird-party beneficiaries to a contractmay sueto enforcethe terms ofthe contract
or obtain a remedy for a breach. Moore v. Gaither, 767 A.2d 278, 287 (D.C. 2001); GECCMC 2005-Cl Plummer St. Off. Ltd. Partn. v. JPMorgan Chase Bank, Nat. Ass'n, 671 F.3d 1027, 1033 (9th Cir. 2012) (internal citations and quotation marks omitted). However, in the context of contracts withthe government, there is apresumptionthatmembers ofthe public are not intended beneficiaries, but merely incidental beneficiaries of the contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033. Such incidental beneficiaries have no right to sue for breach of contract. Moore, 767 A.2d at 287; GECCMC, 671 F.3d at 1033. In order to overcome this presumption, a third-party plaintiffsuing for breach ofcontract must show that the contracting parties "clearly intended" that the contract would benefit the plaintiff, or an identifiable class to which the plaintiffbelongs. GECCMC, 671 F.3d at 1033; Moore, 767 A.2d at 287. Such intent may exist where the plaintiffwould be reasonable inrelying
on the promise as manifesting an intention to confer a right on him or her. See Restatement (Second) ofContracts§ 302(1)(b) cmt. d (1981); see e.g. Klamath Water Users Protective Ass'n 

### -13-

### "·

v. Patterson, 204 F.3d 1206, 1211 (9th Cir. 1999). "This 'clear intent' hurdle is a high one." GECCMC, 671 F.3d at 1033. McDowell has plead sufficient facts to plausibly state a claim that she is an intended beneficiary ofthe contract between CGI and the Department ofState. Her Amended Complaint states "[t]he U.S. and CGI agreed to properly receive, handle, store, and otherwise utilize the Personal Information ofPlaintiffs. Upon information and belief, it was also a term ofthe contract that CGI would act reasonably and employ reasonable safeguards at all times with respect to handling the Personal Information of Plaintiffs, including requiring a background security investigation for all CGI employees with authorized access to the Personal Information." Amended Complaint**~** 

### 76 (emphasis added). In other words, Plaintiffalleges that the contract contains terms that expressly require CGI: (1) to protect the Personal Information it receives; and (2) to do so for the benefit ofan identifiable class ofindividuals, passport applicants, to which she belongs. If

### the contract-which, as already noted, is not before the Court in its entirety-bears out that allegation, it is at least plausible that she can establish that she is an intended beneficiary. Depending on the language ofthe alleged contract provision, as well as the contract as a whole, it is plausible that an objective passport applicant would be reasonable in relying on the promise as manifesting an intention to confer a right on him or her to have their Personal Information safeguarded by CGI. Whether she can do so will depend on the specific language contained in the contract, but that is a merits question that should not be resolved in deciding CGI's Motion to Dismiss when the contract is not before the Court. See SB Charles Alan Wright & 

### Arthur R. Miller, Federal
-14-Practice & Procedure§ 1357 (Supp. 2011) ("Wright & Miller") ("Whetherthe plaintiffultimately
can prevail on the merits is a matter properly determined on the basis ofproof, which means on a summaryjudgment motion or at trial by thejudge or ajury, and not merely on the face ofthe pleadings"). Given the "liberal pleading standard" embodied in the Federal Rules, see Jones v. Air Line Pilots Ass'n, Intern., 642 F.3d 1100, 1104 (D.C. Cir. 2011), McDowell should have the opportunity to do so. CGI's counter-arguments are unpersuasive. First, CGI argues that the test for whether a plaintiffis an intended beneficiary "is not merely whether or not the parties intended to confer a benefit on third parties (or to give a right to 'performance' as Plaintiffalleges), butrather whether
or not 'the parties intended the third party to be able to sue to protect that benefit."' MTD at 32 (quoting Doe v. District of Columbia, 796 F.3d 96, 109 (D.C. Cir. 2015) (emphasis added)). However, that holding was issued in the context of a case involving a consent decree-not an ordinary government contract-and is best read as limited to that context. See Doe, 796 F.3d 96 (involving a challenge to implementation ofa consent decree, reached in a previous lawsuit, by individuals who were not parties to the consent decree). The decision itselfonly discusses the ability of"[t]hird parties to a consent decree" to sue for breach ofthe consent decree and does not discuss third parties to othertypes ofcontracts. See Doe, 796 F.3d at 109. Additionally, CGI's reading of Doe cannot be squared with Moore or GECCMC-both cases that CGI itself cites in its Motion to Dismiss-which do not require a plaintiffto showthat contracting parties intended the plaintiffto be able to sue to protect abenefit conferred by the contractin order to prove that she is an intended beneficiary. Finally, all ofthe
cases cited by the Court ofAppeals in Doe also involved consent decrees, not ordinary contracts.
-15-Doe, 796 F.3d at 109, n.4 (citing: SEC v. Prudential Sec. Inc., 136 F.3d 153, 159 (D.C. Cir. 1998) (involving consent decree between securities seller and the SEC); Blue Chip Stamps v. Manor Drug Stores, 421 U.S. 723, 750 (1975) (involving anti-trust consent decree), Terrell v. District of Columbia, 703 F.Supp.2d 17, 21 (D.D.C. 2010) (involving IDEA consent decree), Beckett v. Air Line Pilots Ass'n, 995 F.2d 280 (D.C.Cir.1993) (involving consent decree between pilots' union and non-member pilots)). As Doe appears only to define the applicable standard for determining who is a third-party beneficiary to consent decrees, itdoes not control resolution ofthis case. Second; CGIpoints to cases in otherjurisdictions inwhich courts have held thatvictims of
a data breach were not intended beneficiaries ofcontracts related to the handling oftheir data. MTD at 32 (relying onthe cases collected in Willingham v. Global Payments, Inc., No. 1:12-CV01157-RWS, 2013 WL 440702, at *19-20 (N.D. Ga. Feb. 5, 2013)). But at least two ofthe three
cases cited in Willingham were decided on motions for summaryjudgment after the contract had been introduced as evidence. See SovereignBankv. BJ's Wholesale Club, Inc., 533 F.3d 162, 167 (3d Cir. 2008) ("the district court converted FifthThird's motion for reconsideration into a motion for summaryjudgment and orderedthe parties to conduct discovery onthe third-party beneficiary issues, i.e., whether Fifth Third's contractual obligationto Visato comply withthe Visa Operating Regulations was intended to benefit Issuers like Sovereign."); Banknorth, N.A. v. BJ's Wholesale Club, Inc., 442 F. Supp. 2d206, 211 (M.D. Pa. 2006) (court grantedmotionfor summaryjudgment because a provision in the contract "specificallyprovidingthatthe contractwas not for thebenefit of, and not intended to be enforcedby, any third party."). That approach accords more closely to the liberal pleading standard established by the Federal Rules. Itis particularly appropriate inthird-party beneficiary cases, where the Plaintiffis
-16-not apartyto the contract, andtherefore, is unlikelyto be able to include express provisions ofthe contract in her Complaint to demonstrate that she is an intended beneficiary. Moreover, because the contract is likelyto be incorporatedinto the plaintiffscomplaintby reference, as itwas inthis case, the defendant-as a party to the contract-has it entirely within its power to submit the contract as an attachment or exhibit to the motion to dismiss without converting it into a motion for summaryjudgment. See Tellabs, 551 U.S. at 322. In doing so, the defendant likely can avoid
even the limited discovery provided for in cases such as Sovereign Bank. McDowell's Amended Complaint states a plausible claim that she is an intended beneficiary ofthe contract between CGI and the State Department, and therefore, the Court will not dismiss herbreach ofcontract claim.
D. Bailment Finally, McDowell alleges that she and CGI entered into a bailment relationship that required CGI to safeguardher Personal Information when she submittedherpassport application, which CGI then breached. Amended Complaint 

## iii! 79-84. CGI counters that no bailment relationship was created because there was no agreement between McDowell and CGI. MTD at 37-40. "A bailment relationship is said to arise where an owner, while retaining title, delivers personalty to another for some particular purpose upon an express or implied contract. The relationship includes a return ofthe goods to the owner or a subsequent disposition in accordance with his instructions." Kam-Almaz v. U.S., 682 F.3d 1364, 1368 (Fed. Cir. 2012). Inthe District ofColumbia, "[a] bailment for hire relationship may be created even inthe absence ofan explicit agreement. All that is required is the existence of a mutual benefit." First Am. Bank, N.A. v. -17-District ofColumbia, 583 A.2d 993, 996 (D.C. 1990). Thus, "[a] personbecomes abailee for hire when he takes property into his care and custody for a compensation. The nature and amount of the compensation are immaterial." First Am. Bank, 583 A.2d at 996. McDowell has failed to allege facts that plausibly support the existence of a bailment relationship. As discussed above, there were no communications between McDowell and CGO, and therefore, they could not have formed an agreement necessary to create an express bailment. Similarly, CGI received no compensation from McDowell nor did it expect to receive additional compensation from the State Department for processing McDowell's passport application, and therefore, they could not have formed an implied bailment or quasi-bailment. See Snowder v. District ofColumbia, 949 A.2d 590, 605 (D.C. 2008) (quasi-bailment is formed whenbailee takes possession ofproperty "inexpectationofcompensation"). To the extent any bailmentrelationship existed it was between McDowell and the State Department, and that is insufficient, in and of itself, to impose liability on CGI for the data breach. 8A Am. Jur. 2d Bailments 

### § 126 (2017 Update) ("A bailee who employs agents or employees who use or otherwise deal with the bailed property is responsible for the conduct ofsuch persons while they are acting within the scope of their employment."). Accordingly, McDowell has failed to state facts thatplausibly supportthe existence ofany form ofa bailment, and therefore cannot state a claim for breach ofbailment.5
E. Unjust Enrichment Finally, McDowell alleges that CGI was unjustly enriched because it received benefits under its contract with the State Department but failed to fulfill its contractual obligation to

5 As no bailment existed, it is unnecessary to address CGI's other arguments. MTD at 39-40. -18-safeguard Personal Information. Amended Complaint

### ifif 86-92. CGI argues that McDowell fails to allege that she conferred any benefit on CGI. MTD at 33-35. Under D.C. law, "unjust enrichment occurs when: (1) the plaintiffconferred a benefit on the defendant; (2) the defendant retains the benefit; and (3) under the circumstances, the defendant's retention ofthe benefit is unjust." Pernice v. Bovim, Civil Action No. 15-541 (JEB), 2015 WL 5063378, at *6 (D.D.C. Aug. 26, 2015) (quoting Peart v. D.C. Hous. Auth., 972 A.2d 810, 813 (D.C. 2009)). "To recover on a theory ofunjust enrichment
...the plaintiffmust show that the defendant was unjustly enriched at his expense ...." Id. at *7 (quoting News World Commc'ns, Inc. v. Thompsen, 878 A.2d 1218, 1222 (D.C. 2005)). McDowell fails to allege any facts that plausibly suggest that she conferred any benefit on CGI. Her Amended Complaintidentifiestwo benefitsthat she argues she conferred on CGI. First, she claims that her passport-application fee was used to pay CGI for the costs ofprocessing her passport application. Amended Complaint

### if 87; Opp'n at 20. But as CGI correctly points out, by law passport application fees must be paid directly to the Treasury. See 22 U.S.C. § 214(a). Therefore, those fees could not have been paid to CGI and they cannot constitute abenefit. Second, she argues that by submitting passport applications, she and the other putative class members created additional demand forpassportprocessing services, whichis itselfabenefit to CGI. Amended Complaint 

### if 86. However, inchoate demand is not itselfa benefit, because it lacks intrinsic value. To be sure, increased demand for a service may create additional value for the supplier, such as by raising the market price for the service or creating a market that did not previously exist. However, McDowell's Amended Complaint does not allege that the additional demand for passportprocessing services by the putative class members increased the value ofthe
-19-contract between CGI and the Passport Agency or that the contract would nothave been executed absent the increased demand. Thus, even under her theory that Plaintiffs' applications increased demand for passport processing services, McDowell has failed to allege any identifiable benefit that CGI received as a result. Additionally, McDowell fails to allege that she "conferred" any ofthese putative benefits
on CGI. Sabre Int'l Sec. v. Torres is instructive. 60 F. Supp. 3d 36 (D.D.C. 2014). In that case, Sabre sued Torres, as well as Torres' individual employees, arguing that Sabre's payments to Torres unjustly enriched the individual employees in the form of salaries and bonuses they received from Torres. Id. at 41-42. The Court found that nothing in the Complaint connected the benefit that the company improperly took from Sabre to the monies paid to the employees. Therefore, the Court dismissed Sabre's unjust enrichment claim, concluding that "Sabre has not plausibly alleged that it had any role in conferring these benefits on the [individual employees]." Id. at 42. Just as in Sabre, McDowell has failed to allege any fact thatplausibly suggests that she had any role in "conferring" anything ofvalue on CGI, and therefore cannot state a claim for unjust enrichment.
IV. CONCLUSION For the foregoing reasons Plaintiffs Amended Complaint is dismissed with respect to all Counts, except Count 3, herthird-party beneficiary breach ofcontract claim.

June 1, 2017

# G'~~ GladysKeSef

- United States District Judge -20-