307 Ga. 555
Ga.
2019

COLLINS et al. v. ATHENS ORTHOPEDIC CLINIC, P.A.

S19G0007

Supreme Court of Georgia

DECEMBER 23, 2019

307 Ga. 555

PETERSON, Justice.

FINAL COPY

PETERSON, Justice.

When a criminal steals consumers’ sensitive personal data, what do those consumers have to plead against the allegedly negligent business from whom the data was stolen to show a legally cognizable injury under Georgia tort law? The Court of Appeals has held in cases involving the exposure of personal information that the failure to show that the information had actually fallen into criminal hands, let alone that the information was used to the consumers’ detriment, meant that plaintiffs had failed to show a legally cognizable injury. But this case, which was dismissed on the pleadings despite allegations of large-scale criminal activity, falls into a different category of data-exposure cases. The plaintiffs here, current or former patients of the defendant medical clinic, brought a putative class action after the clinic informed them that a hacker had stolen their personal data from the clinic. We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable. Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligencе claims, we reverse that holding. Because that error may have affected the Court of Appeals‘s other holdings, we vacate those other holdings and remand the case.

  1. Background.

The complaint, verified by each of the named plaintiffs, alleges that in June 2016 an anonymous hacker stole the personally identifiable information, including social security numbers, addresses, birth dates, and health insurance details, of at least 200,000 current or former patients of Athens Orthopedic Clinic (“the Clinic“) from the Clinic‘s computer databases. Those current or former рatients included named plaintiffs Christine Collins, Paulette Moreland, and Kathryn Strickland. According to the allegations contained in the complaint, the hacker demanded a ransom, but the Clinic refused to pay. The hacker offered at least some of the stolen personal data for sale on the so-called “dark web,” and some of the information was made available, at least temporarily, on Pastebin, a data-storage website. The Clinic notified the plaintiffs of the breach in August 2016.

The plaintiffs allege that because their personal dаta has been “compromised and made available to others on the dark web, criminals are now able to assume Class Members’ identit[ies] and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts, all in Class Members’ names.” Each named plaintiff alleges that she has “spent time calling a credit reporting agency and placing a fraud or credit alert on her credit report to try to contain the impact of the data breach and anticipates having to spend mоre time and money in the future on similar activities.” Collins also alleges that fraudulent charges to her credit card were made “[s]hortly” after the data breach and that she spent time getting the charges reversed by the card issuer. And the complaint alleges that “[e]ven Class Members who have not yet experienced identity theft or are not yet aware of it nevertheless face the imminent and substantial risk of future injury.”

In their suit against the Clinic, the plaintiffs sought class certification and asserted claims for negligence, breach of implied contract, and unjust еnrichment. They sought damages based on costs related to credit monitoring and identity theft protection, as well as attorneys’ fees. They also sought injunctive relief under the Georgia Uniform Deceptive Trade Practices Act, OCGA § 10-1-370 et seq. (“UDTPA“), and a declaratory judgment to the effect that the Clinic must take certain actions to ensure the security of class members’ personal data in the future. The Clinic filed a motion to dismiss based on both OCGA § 9-11-12 (b) (1) and OCGA § 9-11-12 (b) (6), which the trial court granted summarily.

A divided panel of the Court of Appeals affirmed. See . The Court of Appeals concluded that the plaintiffs’ negligence claim was properly dismissed because thе plaintiffs “seek only to recover for an increased risk of harm.” . The majority concluded that although the credit monitoring and other precautionary measures alleged by the plaintiffs were “undoubtedly prudent,” they were “designed to ward off exposure to future, speculative harm” and thus “insufficient to state a cognizable claim under Georgia law.” 1

Then-Presiding Judge McFadden dissented from that holding, concluding that the plaintiffs had standing to bring their claims given that their allegations of future injury show a substantial risk that harm will occur. (McFadden, P. J., concurring in part and dissenting in part). We granted the plaintiffs’ petition for certiorari to consider whether the Court of Appeals erred in holding that the plaintiffs failed to allege a legally cognizable injury. We conclude that the plaintiffs did allege a cognizable injury.

  1. The Georgia case law relied on by the Court of Appeals is inapplicable for two reasons.

“It is well established that to recover for injuries caused by another‘s negligence, a plaintiff must show four elements: a duty, a breach of that duty, causation[,] and damages.” (citation and punctuation omitted). In other words, “before an action for a tort will liе, the plaintiff must show he sustained injury or damage as a result of the negligent act or omission to act in some duty owed to him.” ; see also OCGA § 51-1-6 (“When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.” (emphasis added)); OCGA § 51-1-8 (“The violation of a private duty, accompanied by damage, shall give a right of action.” (emphasis added)); OCGA § 51-12-4 (“Damages are given as compensation for injury; generally, such compensation is the measure of damages where an injury is of a character capable of being estimated in money.“).

[A] wrongdoer is not responsible for a consequence which is merely possible, according to occasional experience, but only for a consequence which is probable, according to ordinary and usual experience. . . . A fear of future damages is too speculative to form the basis for recovery.

(citation and punctuation omitted), disapproved of on other grounds by ; see also OCGA § 51-12-8 (“If the damage incurred by the plaintiff is only the imaginary or possible result of a tortious act or if other and contingent circumstances preponderate in causing the injury, such damage is too remote to be the basis of recovery against the wrongdoer.“).

Concluding that the plaintiffs had not sufficiently pleaded injury here, the Court of Appeals relied on two of its opinions ‍​​‌‌‌‌‌‌​‌​​​​‌​​‌​​‌‌​‌​‌​​‌‌‌​​​‌​‌‌‌‌‌‌‌‌‌​‌‌‍addressing the exposure of sensitive personal information, Finnerty and . In Finnerty, the matter came before the Court of Appeals on the grant of summary judgment against a civil case defendant who complained that the plaintiff bank had included his social security number in an exhibit to the civil complaint. . As one of several alternative bases for affirming the summary judgment order, the Court of Appeals concluded that the defendant‘s state law counterclaims alleging that the bank‘s action caused him injuries were “wholly speculative.” . The court noted that the defendant had “failed to demonstrate that the Bank‘s purported unlawful disclosure made it ‘probable’ that he would suffer any identity theft or that any specific persons actually have accessed his confidential personal information as a result of the purported unlawful disclosure.” And in Rite Aid, the Court of Appeals reversed a grant of class certification in a case arising from the defendant pharmacy‘s sale of its customers’ medication information to another pharmacy, concluding the trial court erred in finding that the named plaintiff and the proposed class of customers shared common questions of law and fact and that the named plaintiff was a sufficiently typical class representative. In particular, the Court of Appeals noted that the named plaintiff could only speculate that a criminal might associate with an employee of the new pharmacy whо had access to his prescription information. .

The Court of Appeals in this case also relied on its prior opinion in , overruled on other grounds by , in which the Court of Appeals affirmed a grant of partial summary judgment to the defendant pest control company on the plaintiffs’ suit alleging that the negligent application of pesticide in their home subjected their children to an increased risk of cancer. In particular, the Boyd court rejected the notion that the plaintiffs could recover for an alleged increased risk of cancer as a result of the pest treatments, because, although the plaintiffs produced testimony that their children would require monitoring in the future to determine whether they developed health problems due to their exposure, they had fallen “far short” of establishing to a “reasonable medical certainty” that such consequences would occur. (citation and punctuation omitted). Although the plaintiffs in Boyd pointed to the presence of elevated levels of a certain metabolite in the children‘s bloodstream, the record in that case provided no “indication that the presence of these metabolites had caused or would eventually cause actual disease, pain, or impairment of some kind[.]” .

The Court of Appeals here relied on Finnerty and Rite Aid to conclude that “the fact of compromised data is not a compensable injury by itself in the absence of some loss or damage flowing to the plaintiff‘s legally protected interest as a result of the alleged breach of the legal duty[,]” and therefore the plaintiffs here do not allege a legally cognizable injury. (citation and punctuation omitted). And the court said that Boyd was a “fitting analogue” to this case, given that in both this case and Boyd, “the defеndant‘s alleged negligence exposed Plaintiffs to a risk of harm which may or may not occur.” .2 But there are two fundamental differences between those cases and this one.

(a) The key Georgia decisions relied on by the Court of Appeals were not issued in the context of a motion to dismiss.

First, neither Finnerty, nor Rite Aid, nor Boyd was decided in the context of a motion to dismiss. Finnerty and Boyd were summary judgment cases, and Rite Aid involved a question of class certification. To avoid dismissal on summary judgment, a plaintiff must present evidence that raises a genuine issue of material fact. See . And to prevail on a request for class certification, a plaintiff must show with evidence that the requirements for certification are satisfied. See . Therefore, it was not enough for the claimants in Finnerty and Rite Aid merely to allege that identity theft was a possible, or even likely, result of the opposing party‘s actions. And it was not enough for the plaintiffs in Boyd merely to allege that it was possible, or even likely, that their children would develop cancer as a result of the pesticide application. Given the stages in which those cases presented themselves to the Court of Appeals, evidence beyond mere allegations was required in order for the claimants to prevail.

Not so here. This case comes before us as an appeal from the grant of a motion to dismiss for failure to state a claim under OCGA § 9-11-12 (b) (6). Such a motion is properly granted when the plaintiff “would not be entitled to relief under any state of provable facts asserted in support” of the allegations in the complaint and “could not possibly introduce evidence within the framework of the complaint sufficient to warrant a grant of the relief sought.” (citation and punctuation omitted). In deciding such a motion, any doubts ‍​​‌‌‌‌‌‌​‌​​​​‌​​‌​​‌‌​‌​‌​​‌‌‌​​​‌​‌‌‌‌‌‌‌‌‌​‌‌‍regarding the complaint must be construed in favor of the plaintiff. .3

Here, the plaintiffs allege that criminals are now able to assume their identities fraudulently and that the risk of such identity theft is “imminent and substantial.” This amounts to a factual allegation about the likelihood that any given class member will have her identity stolen as a result of the data breach. As this cаse comes before us on a motion to dismiss, we must accept this factual allegation as true.

(b) The Court of Appeals‘s prior cases involved a sort of exposure of data fundamentally different than the actual data theft in this case.

In addition to the differences in procedural posture, the facts of Finnerty and Rite Aid put them in a category different from that of this case. In neither Finnerty nor Rite Aid was there any reason to believe that the data in question had in fact fallen into a criminal‘s hands; here, plaintiffs allege that their data was stolen by a criminal whosе alleged purpose was to sell the data to other criminals. To conclude that the claimants in Finnerty and Rite Aid would likely suffer identity theft as a result of the opposing parties’ actions would have required a long series of speculative inferences, including that someone with malicious intent would obtain the data in the first place, that this person would attempt to use the data to steal the claimant‘s identity or make the data available to someone who would attempt to do so, and that the would-be identity thief would succeed in fraudulent usage of the claimant‘s identity. See also (where box containing backup tapes of electronic banking data was lost or stolen from truck with broken lock — with no indication that box was stolen for the data it contained — no injury under Connecticut tort law, as tapes “could have been inadvertently discarded or destroyed,” or “collecting dust in some forgotten warehouse,” and it “is only through speculation that one concludes that they are in possession of an individual who is driven to maliciously mine the tapes for the persоnal data that they contain“). Those cases are far different from this one.

Here, the plaintiffs alleged that (1) a thief stole a large amount of personal data by hacking into a business‘s computer databases and demanded a ransom for the data‘s return, (2) the thief offered at least some of the data for sale, and (3) all class members now face the “imminent and substantial risk” of identity theft given criminals’ ability to use the stolen data to assume the class members’ identities and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts in their names. Assuming the truth of these allegations, as we must at this stage, we must presume that a criminal actor has maliciously accessed the plaintiffs’ data and has at least attempted to sell at least some of the data to other wrongdoers. Moreover, an important part of the value of that data to anyone who would buy it in that fashion is its utility in committing identity theft. See (“[I]t is plausible to infer that the plaintiffs have shown a substantial risk of harm from the . . . data breach. Why else would hackers break into a store‘s datаbase and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.“).4 Thus, we are much further along in the chain of inferences that one must

draw in order to conclude that the plaintiffs here likely will suffer identity theft.5

As explained above, showing injury as a result of the exposure of data is easier in a case like this, where the data exposure occurs as a result of an act by a criminal whose likely motivation is to sell the data to others. But that easier showing of injury may well be offset by a more difficult showing of breach of duty.6 Cf. (plaintiff failed to show that state agency owed him duty

under either OCGA § 10-1-393.8, OCGA § 10-1-910, or purported common law duty “to all the world not to subject others to an unreasonable risk of harm” — to protect his personal information from inadvertent, negligent disclosure (citation and punctuation omitted)). This case is at the motion to dismiss stage, and the Court of Appeals‘s decision did not turn on this issue, so we leave it for another day.7

  1. The plaintiffs’ negligence claim should not have been dismissed for failure to allege a cognizable injury.

Construing the plaintiffs’ allegations — particularly that criminals are able to assume their identities fraudulently as a result of the data breach and that the risk of such identity theft is “imminent and substantial” — in the light most favorable to the plaintiffs, we cannot say that the plaintiffs will not be able to introduce sufficient evidence of injury within the framework of the complaint. The plaintiffs allege that their personal data has been stolen on a mass scale by a criminal, who in turn has offered it for sale to other criminals. They also allege that, as a result, criminals are able to assume their identities and fraudulently оbtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts in their names. These allegations raise more than a mere specter of harm. See (“No long sequence of uncertain contingencies involving multiple independent actors has to occur before the plaintiffs in this case will suffer any harm; a substantial risk of harm exists already, simply by virtue of the hack and the nature of the data that the plaintiffs allege was taken.“). These allegations are sufficient to survive a motion to dismiss the plаintiffs’ negligence claims.

Our conclusion that dismissal of the negligence claims for lack of injury is not warranted at this stage does not depend on the plaintiffs’ allegations that the breach has caused them to spend money attempting to mitigate the consequences of the breach by avoiding actual identity theft. Although this may represent all or some measure of the plaintiffs’ damages to date, their allegation that the criminal theft of their personal data has left them at an imminent and substantial risk of identity theft is sufficient at this stage of the litigation.8

  1. Our conсlusion is consistent with recent ‍​​‌‌‌‌‌‌​‌​​​​‌​​‌​​‌‌​‌​‌​​‌‌‌​​​‌​‌‌‌‌‌‌‌‌‌​‌‌‍federal decisions applying Georgia law.

Recent persuasive federal district court decisions applying Georgia law in similar cases are consistent with our conclusion that the plaintiffs have pleaded a legally cognizable injury here. In litigation arising from hackers’ theft of the credit cardholder information of Arby‘s customers, a district court rejected the defendant‘s argument that the consumer plaintiffs’ negligence claims should be dismissed because they had not suffered “any out-of-pocket loss.” See . Although the plaintiffs had alleged unauthorized charges on their credit card accounts — i.e., actual identity theft — the court also pointed to alleged costs associated with detection and prevention of identity theft in concluding that the allegations of injury were sufficient. (“While Arby‘s is correct that a plaintiff may not recover for injuries that are purely speculative, such as the potential risk of future identity theft, Plaintiffs’ Complaint alleges costs associated with actual data theft.” (emphasis added)).9

In another federal case over theft of consumers’ personal data by hackers, a district court also rejected the defendants’ argument that the plaintiffs’ Georgia tort claims failed because they had not pleaded a legally cognizable injury. See . Again, although the plaintiffs’ allegations in that case included allegations that some members of the class had suffered actual identity theft, the district court also pointed to the allegations about a risk of identity theft, as well as measures to mitigate that risk, in concluding that the allegation of injury was sufficient:

Plaintiffs here have alleged that they have been harmed by having to take measures to combat the risk of identity theft, by identity theft that has already occurred to some members of the class, by expending time and effort to monitor their credit and identity, and that they all face a serious and imminent risk of fraud and identity theft due to the Data Breach. These allegations of actual injury are sufficient to support a claim for relief.

.10

Although ultimately this Court is the final arbiter of the meaning of Georgia law, the district courts’ conclusions in these cases are somewhat more persuаsive because, although those cases also came before district courts on motions to dismiss, they were subject to the more stringent pleading standards governing federal cases. Compare (under federal law, legal conclusions recited in complaint “must be supported by factual allegations” that “plausibly give rise to an entitlement to relief“), with (under

Georgia law, complaint need only “give the defendant fair notice of what the claim is and a general indication of the type of litigation involved; the discovery process bears the burden of filling in details“).

Because the Court of Appeals erred in concluding that the trial court properly dismissed the plaintiffs’ negligence claims due to failure to plead a legally cognizable injury, we reverse that holding. Because that error may have affected the Court of Appeals‘s other holdings, we vacate those other holdings and remand the case.

Judgment reversed in part and vacated in part, and case remanded. All the Justices concur.

13.

DECIDED DECEMBER 23, 2019.

Certiorari to the Court of Appeals of Georgia — 347 Ga. App. 13.

David A. Bain; Goldman Scarlato & Penny, Mark S. Goldman, Douglas J. Bench, for appellants.

Chilivis, Cochran, Larkins & Bever, John D. Dalbey, for appellee.

Notes

1
The Court of Apрeals majority explicitly held that the plaintiffs’ claim for breach of implied contract failed for the same reason that their negligence claim failed — they had not sufficiently alleged a cognizable injury. See . The majority‘s incorrect resolution of the question of whether the plaintiffs had sufficiently pleaded a cognizable injury for negligence purposes may have affected its consideration of other claims, as well. The majority held that the declaratory judgment claim failed because the pleadings do not show any uncertаinty that a court declaration would resolve; that the UDTPA claim was properly dismissed because the plaintiffs did not allege any future, nonspeculative harm that an injunction would remedy; and that the unjust enrichment claim failed because it was not pleaded as an alternate theory of recovery based on a failed contract. . These holdings should be revisited on remand.
2
The Court of Appeals also cited two other cases we need not address at length. First, it cited an unpublished Eleventh Circuit opinion surmising that Boyd “suggests that Georgia would not recognize” a claim for “recovery оf medical monitoring costs in the absence of a current physical injury.” . That type of claim is not before us, and we express no opinion on the ‍​​‌‌‌‌‌‌​‌​​​​‌​​‌​​‌‌​‌​‌​​‌‌‌​​​‌​‌‌‌‌‌‌‌‌‌​‌‌‍viability of such a claim. And second, it cited its own decision in . But that summary opinion cited no authority for its conclusory analysis, and had never been cited until the decision below. We decline to extend that decision beyond its facts.
3
We note, as did then-Presiding Judge McFadden, that the Clinic‘s motion also sought dismissal for lack of subject matter jurisdiction under OCGA § 9-11-12 (b) (1), on the basis that the plaintiffs lacked standing to bring any claim against it, and thе trial court‘s order did not specify under which basis it granted the Clinic‘s motion. See (McFadden, P. J., concurring in part and dissenting in part). A motion to dismiss for lack of subject matter jurisdiction may entail a “factual challenge” that requires consideration of evidence beyond the face of the complaint. See . Although the Clinic‘s motion included a link to a news article about the data breach, no evidence was introduced at the trial court‘s hearing on the motion. Of course, a court cannot skip past a jurisdictional issue to resolve simpler merits quеstions, but has the duty to “raise the question of jurisdiction on its own motion whenever there may be any doubt as to its existence.” . But we conclude that the allegations that we determine are enough here to plead a legally cognizable injury are also sufficient in this procedural posture to satisfy the injury-in-fact element of standing.
4
Some of the federal authorities we cite in this opinion address whether there is injury in fact for purposes of standing under Article III of the United States Constitution. That analysis may well be different than whether a legally cognizable injury has beеn pled as a matter of Georgia tort law, but the question here is similar enough that these federal cases are still useful.
5
As the case proceeds beyond the motion to dismiss stage, the plaintiffs will need to support their claim of injury with evidence about the extent to which they face an imminent and substantial risk of identity theft. Moreover, that risk may become either easier or more difficult to prove as time goes on and the plaintiffs do or do not experience actual identity theft.
6
Proving that the plaintiffs injuries were proximately caused by the breаch may also be more difficult. See (trial court should have granted dental practice‘s motion for directed verdict, as practice could not have foreseen that independent contractor nurse anesthetist would molest plaintiff patient, and thus proximate causation could not be shown); see also (William Pryor, J., dissenting) (arguing that Florida law claims filed in federal court should have been dismissed under applicable federal pleading standard, as plaintiffs failed to plead facts rendering plausible their allegation that identity thievеs obtained sensitive information as a result of theft of defendant‘s computers, as opposed to from a third party).
7
We recognize that this case involves a fairly new kind of injury. As a court, we discharge our duty to apply traditional tort law to that injury. But that traditional tort law is a rather blunt instrument for resolving all of the complex tradeoffs at issue in a case such as this, tradeoffs that may well be better resolved by the legislative process.
8
Our conclusion also does not depend on the allegation that one named plaintiff already has experiеnced identity theft. The Court of Appeals implicitly rejected a negligence claim based on this allegation, citing a failure to allege that the fraudulent charges were related to or caused by the data breach. . And although the plaintiffs sought review of this aspect of the Court of Appeals decision, we did not grant certiorari on issues of causation, and we express no opinion on those issues. We note, however, that the Clinic‘s counsel acknowledged at oral argument before this Court that “a general allegation of causation is usually sufficient to carry the plaintiffs burden” at the motion to dismiss stage.
9
The district court noted that the plaintiffs’ alleged monetary losses meant that it did not need to consider whether the plaintiffs’ other alleged injuries — for loss of use of funds and accounts, loss of productivity, time and effort in remediating the breach, and inability to receive card rewards — were cognizable under Georgia law. . But, noting a lack of authority cited by the parties on that question, the court added its view that “a consumer‘s time and effort to remediate the effects of а breach is not an abstract notion of actual damage and one that is susceptible to proof and valuation by a jury.” We express no opinion on that issue.
10
The district court in Equifax attempted to distinguish the Court of Appeals‘s decision here on the basis that here “the plaintiffs alleged only an ‘increased risk of harm’ associated with taking precautionary measures,” whereas the Equifax plaintiffs “alleged a substantial and imminent risk of impending identity fraud due to the vast amount of information that was obtained in the Data Breach.” (citing ). The district court noted that the Equifax plaintiffs also had “alleged that they have already incurred significant costs in response to the Dаta Breach” and many had “also already suffered forms of identity theft.” This attempt to distinguish the Court of Appeals‘s decision here is perplexing and ultimately unconvincing, however. Although the Court of Appeals used the phrase “increased risk of harm” to describe the plaintiffs’ allegations, , the plaintiffs here, like the Equifax plaintiffs, in fact have pleaded an “imminent and substantial risk” of identity theft. And the district court in Equifax specifically relied on the sort of allegations of credit monitoring made here in concluding that the plaintiffs had adequately pleaded both that they had suffered an injury, , and that the injury was proximately ‍​​‌‌‌‌‌‌​‌​​​​‌​​‌​​‌‌​‌​‌​​‌‌‌​​​‌​‌‌‌‌‌‌‌‌‌​‌‌‍caused by the data breach, .
Read the detailed case summary