12.  PNI provides a proprietary transactional software platform that is used  by several leading retailers such as Costco, CVS Pharmacy, and Rite Aid to sell  personalized photo services and products to consumers.   13.  PNI’s digital software connects these retailers’ websites, in-store  kiosks, and mobile platforms so that consumers are presented with a uniform  storefront at a retailer’s photo center service.   14.  Historically, PNI’s software platform has been used in over 19,000  retail locations and 8,000 kiosks, where consumers made over 18 million  transactions for personalized photo products.   15.  Plaintiff has utilized PNI’s software platform through CVS Pharmacy,  where Ms. Nedlouf created an account on CVSPhoto.com for her digital photo  needs.     16.  Ms. Nedlouf either established a contractual relationship with PNI or  is a third-party beneficiary of PNI’s contractual relationship with CVS.   18.  When Ms. Nedlouf provided PNI with this sensitive personal and  financial information, she reasonably believed PNI would maintain this personal  and financial information in a secure manner and provided her information to PNI  on that basis.     19.  Had Ms. Nedlouf known that PNI would not maintain her information  in a reasonably secure manner, she would not have provided that information to  25.  The Plaintiff Class consists of all United States citizens whose  personal information was compromised by the PNI data breach.   26.  Excluded from the Class is PNI, including any entity in which PNI  has a controlling interest or is a parent or subsidiary, as well as the officers,  directors, affiliates, legal representatives, heirs, predecessors, successors, and  assigns of PNI.  Also excluded are the judges and court personnel in this case and  any members of their immediate families.   27.  Numerosity.  The Class is so numerous that joinder of all members is  impracticable.  The Class includes thousands, possibly hundreds of thousands, of  individuals whose personal information was compromised by the PNI data breach.   29.   Typicality.  Plaintiff’s claims are typical of the claims of the Class in  that she, like all Class members, had her personal information compromised in the  PNI data breach.   30.  Adequacy.  Plaintiff will fairly and adequately protect the interests of  the Class.  Plaintiff has retained counsel who are experienced in class-action and  complex litigation.  Plaintiff has no interests that are adverse to, or in conflict with,  other members of the Class.   31.  The questions of law and fact common to the Class members  predominate over any questions which may affect only individual members.   33.  A class action is an appropriate method for the fair and efficient  adjudication of this controversy.  There is no special interest in the members of the  Class individually controlling the prosecution of separate actions.  The loss of  money and other harm sustained by many individual Class members will not be  large enough to justify individual actions, especially in proportion to the significant  costs and expenses necessary to prosecute this action.  The expense and burden of  individual litigation makes it impossible for many members of the Class  individually to address the wrongs done to them.  Class treatment will permit the  adjudication of claims of Class members who could not afford individually to  litigate their claims against Defendant.  Class treatment will permit a large number  of similarly situated persons to prosecute their common claims in a single form  simultaneously, efficiently, and without duplication of effort and expense that  numerous individual actions would entail.  No difficulties are likely to be  encountered in the management of this class action that would preclude its  maintenance as a class action, and no superior alternative exists for the fair and  efficient adjudication of this controversy.     35.  The prosecution of separate actions by the individual Class members  would create a risk of inconsistent or varying adjudications with respect to  individual Class members, which would establish incompatible standards of  conduct for PNI.  In contrast, the conduct of this action as a class action presents  far fewer management difficulties, conserves judicial resources and the parties’  resources, and protects the rights of each Class member.  36.  Plaintiff incorporates by reference those paragraphs set out above as if  fully set forth herein.    38.  PNI owed a duty, as articulated in its own policies, to protect its  customers’ personal information.   39.  PNI owed a duty to timely disclose the material fact that PNI’s  computer systems and data security practices were inadequate to safeguard  individuals’ personal information.    40.  PNI breached these duties by the conduct alleged herein by (a) failing  to protect its customers’ personal information; (b) failing to maintain adequate  computer systems and data security practices to safeguard customers’ personal  information; (c) failing to disclose the material fact that PNI’s computer systems  and data security practices were inadequate to safeguard customers’ personal  information; and (d) failing to disclose in a timely and accurate manner to Plaintiff  and members of the Class the material fact of the PNI data breach.   43.  When Plaintiff and members of the Class provided their personal  information to PNI, Plaintiff and members of the Class entered into implied  contracts with PNI pursuant to which PNI agreed to safeguard and protect such  information and to timely and accurately notify Plaintiff and Class members that  their data had been breached and compromised.   44.  Plaintiff and Class members would not have provided and entrusted  their personal information to PNI in the absence of the implied contract between  them and PNI.   45.  Plaintiff and members of the Class fully performed their obligations  under the implied contracts with PNI.    46.  PNI breached the implied contracts it made with Plaintiff and Class  members by failing to safeguard and protect the personal information of Plaintiff  and members of the Class and by failing to provide timely and accurate notice to  them that their personal information was compromised in and as a result of PNI  data breach.   48.  Plaintiff incorporates by reference those paragraphs set out above as if  fully set forth herein.    49.  PNI has a contractual obligation to maintain the security of its  customers’ personal information.   50.  PNI breached that contractual obligation by failing to safeguard and  protect the personal information of Plaintiff and members of the Class and by  failing to provide timely and accurate notice to them that their personal  information was compromised as a result of PNI data breach.   51.  The losses and damages sustained by Plaintiff and Class members as  described herein were either the direct and proximate result of PNI’s breaches of  the contracts between PNI and Plaintiff and members of the Class or the direct and  proximate result of PNI’s breaches of its contract(s) with CVS or other non-parties,  of which Plaintiff and the Class are third-party beneficiaries.  53.  In having their personal information delivered to PNI for the purposes  of photo services, Plaintiff and Class members intended and understood that PNI  would adequately safeguard their personal and financial information.    54.  PNI accepted possession of Plaintiff’s and Class members’ personal  information for the purpose of providing photo services.    55.  By accepting possession of Plaintiff’s and Class members’ personal  information, PNI understood that Plaintiff and Class members expected PNI to  adequately safeguard their personal information.  Accordingly, a bailment (or  deposit) was established for the mutual benefit of the parties.   56.  During the bailment (or deposit), PNI owed a duty to Plaintiff and  Class members to exercise reasonable care, diligence, and prudence in protecting  their personal information.    57.  PNI breached its duty of care by failing to take appropriate measures  to safeguard and protect Plaintiff’s and Class members’ personal information,  resulting in the unlawful and unauthorized access to and misuse of Plaintiff’s and  Class members’ personal information.   59.   Plaintiff incorporates by reference those paragraphs set out above as  if fully set forth herein.    60.  The Georgia Legislature has enacted a data breach statute.  See  O.C.G.A. § 10-1-910, et seq.  This statute generally requires that any person or  business conducting business within the state that engages in whole or in part in  the business of collecting, assembling, evaluating, compiling, reporting,  transmitting, transferring, or communicating information concerning individuals  for the primary purpose of furnishing personal information to nonaffiliated third  parties, shall disclose any breach of the security of the system to any resident of the  state whose personal information was acquired by an unauthorized person, and  further require that the disclosure of the breach be made in the most expedient time  possible and without unreasonable delay.    61.  The PNI data breach constitutes a breach of the security system of  PNI within the meaning of O.C.G.A. § 10-1-910, et seq. and the data breached is  covered by the Georgia data breach statute.    63.  PNI unreasonably delayed in informing the public, including Plaintiff  and members of the Class (or suitable Subclass) about the breach of security of  Plaintiff’s and Class (or suitable Subclass) members’ confidential and non-public  personal information after PNI knew or should have known that the data breach  had occurred.    64.  PNI failed to disclose to Plaintiff and the Class (or suitable Subclass)  without unreasonable delay and in the most expedient time possible, the breach of  security of Plaintiff’s and Class (or suitable Subclass) members’ personal and  financial information when PNI knew or reasonably believed such information had  been compromised.    65.  Plaintiff and members of the Class (or suitable Subclass) suffered  harm directly resulting from PNI’s failure to provide and the delay in providing  Plaintiff and Class (or suitable Subclass) members with timely and accurate notice  as required by the Georgia data breach statute.     66.  Plaintiff suffered the damages alleged above as a direct result of PNI’s  delay in providing timely and accurate notice of the data breach.    68.  PNI’s failure to provide timely and accurate notice of the data breach  violated the Georgia data breach statute.    69.  Plaintiff and members of the Class seek all remedies available under  the Georgia data breach statute.     70.  Plaintiff incorporates by reference those paragraphs set out above as if  fully set forth herein.   71.  This count is brought in the alternative to Plaintiff’s breach of contract  counts.  If claims for breach of contract are ultimately successful, this count will be  dismissed.   72.  Plaintiff and Class members conferred a benefit on PNI by way of  customers’ paying PNI to maintain Plaintiff and Class members’ personal  information.   74.  PNI failed to provide reasonable security, safeguards, and protections  to the personal information of Plaintiff and Class members, and as a result PNI was  overpaid.    75.  Under principles of equity and good conscience, PNI should not be  permitted to retain the money because PNI failed to provide adequate safeguards  and security measures to protect Plaintiff’s and Class members’ personal  information that they paid for but did not receive.    76.  PNI wrongfully accepted and retained these benefits to the detriment  of Plaintiff and Class members.   77.  PNI’s enrichment at the expense of Plaintiff and Class members is and  was unjust.    78.  As a result of PNI’s wrongful conduct, as alleged above, Plaintiff and  the Class are entitled to restitution and disgorgement of profits, benefits, and other  compensation obtained by PNI, plus attorneys’ fees, costs, and interest thereon. 