COLLINS v. ATHENS ORTHOPEDIC CLINIC, P.ACOLLINS v. ATHENS ORTHOPEDIC CLINIC, P.A
When a criminal steals consumers’ sensitive personal data, what do those consumers have to plead against the allegedly negligent business from whom the data was stolen to show a legally cognizable injury under Georgia tort law? The Court of Appeals has held in cases involving the exposure of personal information that the failure to show that the information had actually fallen into criminal hands, let alone that the information was used to the consumers’ detriment, meant that plaintiffs had failed to show a legally cognizable injury. But this case, which was dismissed on the pleadings despite allegations of large-scale criminal activity, falls into a different category of data-exposure cases. The plaintiffs here, current or former patients of the defendant medical clinic, brought a putative class action after the clinic informed them that a hacker had stolen their personal data from the clinic. We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable. Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligence clаims, we reverse that holding. Because that error may have affected the Court of Appeals‘s other holdings, we vacate those other holdings and remand the case.
- Background.
The complaint, verified by each of the named plaintiffs, alleges that in June 2016 an anonymous hacker stole the personally identifiable information, including social security numbers, addresses, birth dates, and health insurance details, of at least 200,000 current or former patients of Athens Orthopedic Clinic (“the Clinic“) from the Clinic‘s computer databases. Those current or former patients inсluded named plaintiffs Christine Collins, Paulette Moreland, and Kathryn Strickland. According to the allegations contained in the complaint, the hacker demanded a ransom, but the Clinic refused to pay. The hacker offered at least some of the stolen personal data for sale on the so-called “dark web,” and some of the information was made available, at least temporarily, on Pastebin, a data-storage website. The Clinic notified the plaintiffs of the breach in August 2016.
The plaintiffs allege that because their personal data has beеn “compromised and made
In their suit against the Clinic, the plaintiffs sought class certification and asserted claims for negligence, breach of implied contract, and unjust enrichment. They sought damаges based on costs related to credit monitoring and identity theft protection, as well as attorneys’ fees. They also sought injunctive relief under the
A divided panel of the Court of Appeals affirmed. See Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13 (815 SE2d 639) (2018). The Court of Appeals concluded that the plaintiffs’ negligence claim was properly dismissed because the plaintiffs “seek only to rеcover for an increased risk of harm.” Id. at 18 (2) (a). The majority concluded that although the credit monitoring and other precautionary measures alleged by the plaintiffs were “undoubtedly prudent,” they were “designed to ward off exposure to future, speculative harm” and thus “insufficient to state a cognizable claim under Georgia law.” Id.1
Then-Presiding Judge McFadden dissented from that holding, concluding that the plaintiffs had standing to bring their claims given that their allegations of future injury show a substantial risk that harm will occur. Collins, 347 Ga. App. at 22-25 (1)-(2) (McFadden, P. J., concurring in part and dissenting in part). We granted the plaintiffs’ petition for certiorari to consider whether the Court of Appeals erred in holding that the plaintiffs failed to allege a legally cognizable injury. We conclude that the plaintiffs did allege a cognizable injury.
- The Georgia case law relied on by the Court of Appeals is inapplicable for two reasons.
“It is well established that to recover for injuries caused by another‘s negligence, a plaintiff must show four elements: a duty, a breach of that duty, causation[,] and damages.” Goldstein, Garber & Salama, LLC v. J. B., 300 Ga. 840, 841 (1) (797 SE2d 87) (2017) (citation and punctuation omitted). In other words, “before an action for a tort will lie, the plaintiff must show he sustаined injury or damage as a result of the negligent act or omission to act in some duty owed to him.” Whitehead v. Cuffie, 185 Ga. App. 351, 353 (2) (364 SE2d 87) (1987); see also
[A] wrongdoer is not responsible for a consequence which is merely possible, according to occasional experience, but only for a consequence which is probable, according to ordinary and usual experience. . . . A fear of future damages is too speculative to form the basis for recovery.
Finnerty v. State Bank & Trust Co., 301 Ga. App. 569, 572 (4) (687 SE2d 842) (2009) (citation and punctuation omitted), disapproved of on other grounds by Cumberland Contractors, Inc. v. State Bank & Trust Co., 327 Ga. App. 121, 125 (2) n.4 (755 SE2d 511) (2014); see also
Concluding that the plaintiffs had not sufficiently pleaded injury here, the Court of Appeals relied on two of its opinions addressing the exposure of sensitive personal information, Finnerty and Rite Aid of Georgia v. Peacock, 315 Ga. App. 573 (726 SE2d 577) (2012). In Finnerty, the matter came before the Court of Appeals on the grant of summary judgment against a civil case defendant who complained that the plaintiff bank had included his social security number in an exhibit to the civil complaint. 301 Ga. App. at 569. As one of several alternative bases for affirming the summary judgment order, the Court of Appeals concluded that the defendant‘s state law counterclaims alleging that the bank‘s action caused him injuries were “wholly speculative.” Id. at 572 (4). The court noted that the defendant had “failed to demonstrate that the Bank‘s purported unlawful disclosure made it ‘probable’ that he would suffer any identity theft or that any specific persons actually have accessed his confidential personal information as a result of the purported unlawful disclosure.” Id. And in Rite Aid, the Court of Appeals reversed a grant of class certification in a case arising from the defendant pharmacy‘s sale of its customers’ medication information to another pharmacy, concluding the trial court erred in finding that the named plaintiff and the proposed class of customers shared common questions of law and fact and that the named plaintiff was a sufficiently typical class representative. In particular, the Court of Appeals noted that the named plaintiff could only speculate that a criminal might associate with an employee of the new phаrmacy who had access to his prescription information. 315 Ga. App. at 576-577 (1) (a) (i).
The Court of Appeals in this case also relied on its prior opinion in Boyd v. Orkin Exterminating Co., 191 Ga. App. 38 (381 SE2d 295) (1989), overruled on other grounds by Hanna v. McWilliams, 213 Ga. App. 648, 651 (2) (b) (446 SE2d 741) (1994), in which the Court of Appeals affirmed a grant of partial summary judgment to the defendant pest control company on the plaintiffs’ suit alleging that the negligent application of pesticide in their home subjected their children to an increased risk of cancer. In particular, the Boyd court rejected the notion that the plaintiffs could recover for an alleged increased risk of cancer as a result of the pest treatments, because, although the plaintiffs produced testimony that their children would require monitoring in the future to determine whether they developed health problems due to their exposure, they had fallen “far short” of establishing to a “reasonable medical certainty” that such consequences would occur. 191 Ga. App. at 40-41 (2) (citation and punctuation omitted). Although the plaintiffs in Boyd pointed to the presence of elevated levels of a certain metabolite in the children‘s bloodstream, the record in that case provided no “indication that the presence of these metabolites had caused or would eventually cause actual disease, pain, or impairment of some kind[.]” Id. at 40 (1).
The Court of
(a) The key Georgia decisions relied on by the Court of Appeals were not issued in the context of a motion to dismiss.
First, neither Finnerty, nor Rite Aid, nor Boyd was decided in the context of a motion to dismiss. Finnerty and Boyd were summary judgment cases, and Rite Aid involved a question of class certification. To avoid dismissal on summary judgment, a plaintiff must present evidence that raises a genuine issue of material fact. See Nguyen v. Southwestern Emergency Physicians, P.C., 298 Ga. 75, 82 (3) (779 SE2d 334) (2015). And to prevail on a request for class certification, a plaintiff must show with evidence that the requirements for certification are satisfied. See Georgia-Pacific Consumer Products v. Ratner, 295 Ga. 524, 526 (1) (762 SE2d 419) (2014). Therefore, it was not enough for the claimants in Finnerty and Rite Aid merely to allege that identity theft was a possible, or even likely, result of the opposing party‘s actions. And it was not enough for the plaintiffs in Boyd merely to allege that it was possible, or even likely, that their children would develop cancer as a result of the pesticide application. Given the stages in which those cases presented themselves to the Court of Appeals, evidence beyond mere allegations was required in order for the claimants to prevail.
Not so here. This case comes before us as an appeal from the grant of a motion to dismiss for failure to state a claim under
Here, the
(b) The Court of Appeals‘s prior cases involved a sort of exposure of data fundamentally different than the actual data theft in this case.
In addition to the differences in procedural posture, the facts of Finnerty and Rite Aid put them in a category different from that of this case. In neither Finnerty nor Rite Aid was there any reason to believe that the data in question had in fact fallen into a criminal‘s hands; here, plаintiffs allege that their data was stolen by a criminal whose alleged purpose was to sell the data to other criminals. To conclude that the claimants in Finnerty and Rite Aid would likely suffer identity theft as a result of the opposing parties’ actions would have required a long series of speculative inferences, including that someone with malicious intent would obtain the data in the first place, that this person would attempt to use the data to steal the claimant‘s identity or make the data available to someone who would attempt to do so, and that the would-be identity thief would succeed in fraudulent usage of the claimant‘s identity. See also McLoughlin v. People‘s United Bank, Inc., 2009 WL 2843269, at *7-*8 (Case No. 3:08-cv-00944 (VLB), D. Conn., decided Aug. 31, 2009) (where box containing backup tapes of electronic banking data was lost or stolen from truck with broken lock — with no indication that box was stolen for the data it contained — no injury under Connecticut tort law, as tapes “could have been inadvertently discarded or destroyed,” or “collecting dust in some forgotten warehouse,” and it “is only through speculation that one concludes that they are in possession of an individual who is driven tо maliciously mine the tapes for the personal data that they contain“). Those cases are far different from this one.
Here, the plaintiffs alleged that (1) a thief stole a large amount of personal data by hacking into a business‘s computer databases and demanded a ransom for the data‘s return, (2) the thief offered at least some of the data for sale, and (3) all class members now face the “imminent and substantial risk” of identity theft given criminals’ ability to use the stolen data to assume the class members’ identities and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts in their names. Assuming the truth of these allegations, as we must at this stage, we must presume that a criminal actor has maliciously accessed the plaintiffs’ data and has at least attempted to sell at least some of the data to other wrongdoers. Moreover, an important part of the value of that data to anyone who would buy it in that fashion is its utility in committing identity theft. See Remijas v. Neiman Marcus Group, LLC, 794 F3d 688, 693 (7th Cir. 2015) (“[I]t is plausible to infer that the plaintiffs have shown a substantial risk of harm from the . . . data breach. Why else wоuld hackers break into a store‘s database and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.“).4 Thus, we are much further along in the chain of inferences that one must
draw in order to conclude that the plaintiffs here likely will suffer identity theft.5
As explained above, showing injury as a result of the exposure of data is easier in a
under either
- The plaintiffs’ negligence claim should not have been dismissed for failure to allege a cognizable injury.
Construing the plaintiffs’ allegations — particularly that criminals are able to assume their identities fraudulently as a result of the data breach and that the risk of such identity theft is “imminent and substantial” — in the light most favorable to the plaintiffs, we cannot say that the plaintiffs will not be able to introduce sufficient evidence of injury within the framework of the complaint. The plaintiffs allege that their personal data has been stolen on a mass scale by a criminal, who in turn has offered it for sale to other criminals. They also allege that, as a result, criminals are able to аssume their identities and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts in their names. These allegations raise more than a mere specter of harm. See Attias v. CareFirst, Inc., 865 F3d 620, 629 (D.C. Cir. 2017) (“No long sequence of uncertain contingencies involving multiple independent actors has to occur before the plaintiffs in this case will suffer any harm; a substantial risk of harm exists already, simply by virtue of the hack and the nature of the data that the plaintiffs allege was taken.“). These allegations are sufficient to survivе a motion to dismiss the plaintiffs’ negligence claims.
Our conclusion that dismissal of the negligence claims for lack of injury is not warranted at this stage does not depend on the plaintiffs’ allegations that the breach has caused them to spend money attempting to mitigate the consequences of the breach by avoiding actual identity theft. Although this may represent all or some measure of the plaintiffs’ damages to date, their allegation that the criminal theft of their personal data has left them at an imminent and substantial risk of identity theft is sufficient at this stage оf the litigation.8
- Our conclusion is consistent with recent federal decisions applying Georgia law.
Recent persuasive federal district court decisions applying Georgia law in similar cases
In another federal case over theft of consumers’ personal data by hackers, a district court also rejected the defendants’ argument that the plaintiffs’ Georgia tort claims failed because they had not pleaded a legally cognizable injury. See In re Equifax, Inc., Customer Data Security Breach Litigation, 362 FSupp.3d 1295, 1314-1317 (N.D. Ga. 2019). Again, although the plaintiffs’ allegations in that case included allegations that some members of the class had suffered actual identity theft, the district court also pointed to the allegations about a risk of identity theft, as well as measures to mitigate that risk, in concluding that the allegation of injury was sufficient:
Plaintiffs here have alleged that they have been harmed by having to take measures to combat the risk of identity theft, by identity theft that has already occurred to some members of the class, by expending time and effort to monitor their credit and identity, and that they all face a serious and imminent risk of fraud and identity theft due to the Data Breach. These allegations of actual injury are sufficient to support a claim for relief.
Although ultimately this Court is the final arbiter of the meaning of Georgia law, the district courts’ conclusions in these cases are somewhat more рersuasive because, although those cases also came before district courts on motions to dismiss, they were subject to the more stringent pleading standards governing federal cases. Compare Ashcroft v. Iqbal, 556 U. S. 662, 679 (129 SCt 1937, 173 LE2d 868) (2009) (under federal law, legal conclusions recited in complaint “must be supported by factual allegations” that “plausibly give rise to an entitlement to relief“), with Dillingham v. Doctors Clinic, P.A., 236 Ga. 302, 303 (223 SE2d 625) (1976) (under
Georgia law, complaint need only “give the defendant fair notice of what the claim is and a general indication of the type of litigation involved; the discovery process bears the burden of filling in details“).
Because the Court of Appeals erred in concluding that the trial court properly dismissed the plaintiffs’ negligence claims due to failure to plead a legally cognizable injury, we reverse that holding. Because that error may have affected the Court of Appeals‘s other holdings, we vacate those other holdings and remand the case.
Judgment reversed in part and vacated in part, and case remanded. All the Justices concur.
13.
DECIDED DECEMBER 23, 2019.
Certiorari to the Court of Appeals of Georgia — 347 Ga. App. 13.
David A. Bain; Goldman Scarlato & Penny, Mark S. Goldman, Douglas J. Bench, for appellants.
Chilivis, Cochran, Larkins & Bever, John D. Dalbey, for appellee.