CGI Federal, Inc., is a corporation that provides a number of services to the United States Passport Agency, included the processing of passport application. Passport applicants must submit sensitive and personally identifiable information, including name, place of birth, social security number, occupation, evidence of US citizenship, etc. CGI typically stores this information on its computer systems and transmits it to the Passport Agency. From 2010 to 2015, unidentified CGI employees stole the personal information of passport applicants.

These individuals then used the personal information to create counterfeit identity documents, obtain commercial lines of credit, and make unauthorized purchases.

Lori McDowell was one of the applicants whose personal information was stolen. After McDowell submitted her application, she was notified by a credit monitoring service that someone had opened a T-Mobile account using her Social Security number and had made a

$2,300 retail purchase using her identity. As a result of the theft of her personal information, McDowell has had to pay for additional credit monitoring services and expend time disputing fraudulent charges and accounts.

McDowell sued CGI under the theory that she was an intended third-party beneficiary to the contract between CGI and the Passport Agency. McDowell argues that the contract required CGI to protect the personal information it receives, and to do so for the benefit of passport applicants, a class of individuals to which she belongs. CGI moved to dismiss the case, arguing that the test for whether someone is a third party is not whether the contract intends to confer a benefit on a third party, but whether “the parties intended the third party to be able to sue to protect that benefit.” Is CGI’s statement of the test accurate? How did the court rule?