345 Ga. App. 669
Ga. Ct. App.2018Background
- Plaintiff Thomas McConnell sued the Georgia Department of Labor (GDOL) after a GDOL employee inadvertently emailed a spreadsheet to ~1,000 recipients containing names, Social Security numbers, phone numbers, email addresses, and ages for over 4,000 registrants (including McConnell).
- McConnell alleged negligent disclosure of personal information, breach of fiduciary duty, and invasion of privacy (public disclosure of private facts), seeking economic damages (credit-monitoring costs, credit-score impacts) and emotional distress from increased risk of identity theft; no actual identity theft was alleged.
- The Superior Court of Cobb County dismissed the complaint for failure to state a claim and on sovereign immunity grounds; the Court of Appeals initially affirmed, but the Georgia Supreme Court remanded directing the Court of Appeals to decide the sovereign-immunity threshold first.
- On remand, the Court of Appeals held the GTCA waived sovereign immunity for McConnell’s tort claims (economic and emotional losses may qualify as "loss" under OCGA § 50-21-22(3)) and reversed the dismissal on sovereign-immunity grounds.
- The court nonetheless affirmed dismissal in part on the merits: (1) no common-law negligence duty to safeguard personal information was established by Georgia statutes cited; (2) no fiduciary relationship pleaded; and (3) invasion-of-privacy (public disclosure of private facts) claim failed because disclosure of SSNs/PII without allegations of embarrassing facts does not state that tort.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| 1) Did the Georgia Tort Claims Act (GTCA) waive sovereign immunity for McConnell’s alleged economic and emotional losses? | GTCA’s definition of “loss” includes "any other element of actual damages recoverable in actions for negligence," so economic and emotional harms from disclosure are covered. | The GTCA limits recoverable economic damages to plaintiffs who have suffered personal injury, disease, or death; McConnell alleges only economic and prospective harms. | Waiver applies: the catch‑all phrase in OCGA § 50‑21‑22(3) covers economic and emotional losses even absent physical injury; sovereign immunity does not bar these claims. |
| 2) Does a legal duty exist (negligence) to safeguard personal information under Georgia law? | Common law duty arises from GPIPA/FBPA findings and statutory protections; breach of such duty supports negligence per se or negligence claim. | Statutes (GPIPA, FBPA) do not impose an affirmative data‑security standard or general duty to prevent unintentional disclosure; they impose notice/notification duties or prohibit intentional public posting only. | No statutory or established common‑law duty to secure data was identified; complaint fails to state negligence claim based on a general duty to safeguard PII. |
| 3) Did McConnell plead a fiduciary relationship with the Department? | Submission of PII to obtain government benefits and reliance on the Department’s protection created a confidential/fiduciary relationship. | A fiduciary relationship cannot be inferred simply from a government-citizen benefit application; no precedent creating such a fiduciary duty in this context. | No fiduciary duty pleaded; the facts do not establish a relationship of mutual confidence or controlling influence sufficient to state a breach-of-fiduciary-duty claim. |
| 4) Does dissemination of SSNs/PII support invasion of privacy (public disclosure of private facts)? | SSNs/PII are private information; publication exposed plaintiff to identity‑theft risk and financial harm, supporting the tort. | The tort requires disclosure of private facts that are embarrassing/offensive; speculative risk of identity theft or financial harm is insufficient. | Claim fails: disclosure of SSNs/PII without allegations that the disclosed facts are embarrassing or placed plaintiff in a recognized privacy tort category does not state public-disclosure-of-private-facts. |
Key Cases Cited
- Dept. of Transp. v. Montgomery Tank Lines, Inc., 276 Ga. 105 (interpreting GTCA’s broad "any other element of actual damages" language to allow non‑physical economic claims)
- Wells Fargo Bank, N.A. v. Jenkins, 293 Ga. 162 (statutory or aspirational federal standards do not automatically create a state tort duty)
- Cumberland Contractors, Inc. v. State Bank & Trust Co., 327 Ga. App. 121 (disclosure of SSNs/PII without embarrassing facts does not state invasion‑of‑privacy claim)
- Lathrop v. Deal, 301 Ga. 408 (sovereign immunity is jurisdictional; courts may not hear suit against the State without consent)
- Bd. of Regents of Univ. Sys. of Ga. v. Myers, 295 Ga. 843 (discussing GTCA purpose and limits)