1. The underlying facts are essentially undisputed. In September 2012, the Georgia Department of Labor created a spreadsheet containing the name, social security number, home telephone number, email address, and age of 4,757 individuals over the age of 55 in Cherokee, Cobb, and Fulton counties who had applied for unemployment benefits or other services administered by the Department, including McConnell. Almost a year later, a Department employee inadvertently sent an email with the spreadsheet attached
On January 17, 2014, McConnell filed a complaint, which he later amended on March 12, 2014, against the Department on behalf of himself and a proposed class of all individuals whose information was contained in the spreadsheet, alleging negligence, breach of fiduciary duty, and invasion of privacy by public disclosure of private facts. The complaint alleged that, as a result of the Department's negligent disclosure of McConnell's and the other proposed class members' personal information, they were required to place freezes and alerts with credit reporting agencies, close or modify financial accounts, and closely review and monitor their credit reports and accounts for unauthorized activity. The complaint further alleged that McConnell and others whose information had been disclosed incurred out-of-pocket costs related to credit monitoring and identity protection services and suffered adverse impacts to their credit scores related to the closure of credit accounts. In addition, the complaint alleged that the affected individuals experienced, and would continue to experience, fear, upset, anxiety, and injury to peace and happiness, as the disclosure of their personal identifying information provided the material necessary to facilitate identity theft and unauthorized charges on their credit and bank accounts. The complaint did not allege that any identity theft or resulting unauthorized charges actually had occurred. Nor did the complaint allege that the personal identifying information had been disclosed by or for criminal conduct.
The Department filed a motion to dismiss, which the trial court granted, ruling that sovereign immunity barred the lawsuit because the GTCA did not waive the State's immunity for the type of "loss" that McConnell alleged. OCGA § 50-21-22 (3).
McConnell appealed, and the Court of Appeals affirmed, pretermitting a decision on sovereign immunity and addressing only the trial court's ruling that each count of the complaint failed to state a claim. See McConnell v. Dept. of Labor ,
On remand, the Court of Appeals first held that the trial court erred in concluding that sovereign immunity barred McConnell's claims. See McConnell v. Dept. of Labor ,
2. The Department argues that the definition of "loss" set forth in OCGA § 50-21-22 (3) limits the waiver of sovereign immunity in OCGA § 50-21-23 (a) to claims where a plaintiff also has suffered a personal "injury, disease, or death," which the complaint did not allege. We disagree.
The complaint alleged that a Department employee, acting within the scope of his employment, committed the torts of negligence, breach of fiduciary duty, and invasion of privacy against McConnell and the other proposed class members. And OCGA § 50-21-23 (a) says that "[t]he state waives its sovereign immunity for the torts of state ... employees while acting within the scope of their ... employment," subject to the exceptions and limitations set forth in the rest of the GTCA. Thus, absent some express "exception[ ] or limitation[ ] set forth in [the GTCA]," the State waived its sovereign immunity from McConnell's lawsuit. See OCGA § 50-21-23 (a). The Department does not argue that the conduct alleged in the complaint is included in any of the exceptions or limitations listed in OCGA §§ 50-21-24 (1) - (13) and 50-21-24.1.
The Department instead contends that OCGA § 50-21-22 (3) provides an exception or limitation in its definition of "loss." But OCGA § 50-21-23 (a), which waives the State's sovereign immunity from tort claims "in broad language," see Dept. of Transp. v. Montgomery Tank Lines ,
The Department's other arguments - that McConnell's lawsuit does not fit within OCGA § 50-21-22 (3)'s catch-all phrase because Georgia does not recognize as a cognizable injury his alleged economic damages, and that Georgia's "impact rule" bars McConnell's claims for emotional damages - actually are arguments about the validity of McConnell's claims and are irrelevant to the threshold question of whether the State has waived its sovereign immunity from McConnell's lawsuit. See Upper Oconee Basin Water Auth. v. Jackson County ,
Accordingly, because McConnell's claims for negligence, breach of fiduciary duty, and invasion of privacy sound in tort, are based on the conduct of a state employee while acting within the employee's scope of employment, and do not fall within an express exception or limitation in the GTCA, we agree with the Court of Appeals and conclude that the GTCA waived the State's sovereign immunity from McConnell's lawsuit. Thus, McConnell has carried his burden of showing that the trial court had subject matter
3. McConnell contends that the Court of Appeals erred in holding that his complaint failed to state a claim upon which relief could be granted. The complaint contained counts for negligence, breach of fiduciary duty, and invasion of privacy. We consider each count in turn.
(a) Negligence is premised on, among other things, a duty owed by the defendant to the plaintiff. See Rasnick v. Krishna Hospitality, Inc. ,
In Bradley Center , the lead opinion, which only two Justices joined, said that everyone owes a general duty not to subject others to an "unreasonable risk of harm" and may be liable for any breach of
McConnell also argues that two statutes, OCGA §§ 10-1-910 and 10-1-393.8, created a legal duty on the part of the Department to safeguard his and the other proposed class members' personal information. But OCGA § 10-1-910 does not explicitly establish any duty, nor does it prohibit or require any conduct at all. Rather, the statute recites a series of legislative findings about the vulnerability of personal information and the risk of identity theft. And while OCGA § 10-1-393.8 (a) (1) says that no "person, firm, or corporation" shall "[p]ublicly post or publicly display in any manner an individual's social security number," the statute then immediately adds, "As used in this Code section, 'publicly post' or 'publicly display' means to intentionally communicate or otherwise make available to the general public." The complaint alleged only a negligent disclosure, not an intentional one. Even assuming that OCGA § 10-1-393.8 (a) (1) creates a duty enforceable in tort to refrain from intentionally disclosing social security numbers, McConnell has not shown that the Department owed him or the other proposed class members a duty to protect their information against negligent disclosure. Accordingly, the Court of Appeals correctly held that the complaint failed to state a claim for negligence.
(b) McConnell contends that the Court of Appeals erred in holding that the breach of fiduciary duty count failed to state a claim upon which relief could be granted. Specifically, McConnell argues that Department employees are public officers and that, under the
McConnell also argues that the particular facts of this case created a confidential relationship that imposed a fiduciary duty on the Department to McConnell and the proposed class members. The complaint alleged that a fiduciary duty arose when the Department required McConnell and the other proposed class members to disclose their confidential personal information in order to obtain services or benefits from the Department because they reasonably placed trust and confidence in the Department that the Department would safeguard and protect the information from public disclosure. This argument is without merit.
OCGA § 23-2-58 defines a confidential relationship as a relationship in which "one party is so situated as to exercise a controlling influence over the will, conduct, and interest of another or where, from a similar relationship of mutual confidence, the law requires the utmost good faith, such as the relationship between partners, principal and agent, etc." The complaint did not allege any particular circumstances showing that McConnell or any of the other proposed class members had a special relationship of trust or mutual confidence with the Department or any Department employee. As the Court of Appeals noted, the complaint alleged merely that the Department, as the gatekeeper to unemployment benefits, required McConnell and the others to
(c) Finally, McConnell asserts that the Court of Appeals erred in holding that his allegations of invasion of privacy failed to state a claim. Under Georgia law,
there are four disparate torts under the common name of invasion of privacy. These four torts may be described briefly as: (1) intrusion upon the plaintiff's seclusion or solitude, or into his private affairs; (2) public disclosure of embarrassing private facts about the plaintiff; (3) publicity which places the plaintiff in a false light in the public eye; and (4) appropriation, for the defendant's advantage, of the plaintiff's name or likeness.
(Citation and punctuation omitted.) Bullard v. MRA Holding, LLC ,
There are at least three necessary elements for recovery under this theory: (a) the disclosure of private facts must be a public disclosure; (b) the facts disclosed to the public must be private, secluded or secret facts and not public ones; [and] (c) the matter made public must be offensive and objectionable to a reasonable man of ordinary sensibilities under the circumstances. The interest protected is that of reputation, with the same overtones of mental distress that are present in libel and slander. It is in reality an extension of defamation into the field of publications that do not fall within the narrow limits of the old torts, with the elimination of the defense of truth.
(Citation omitted.) Cottrell v. Smith ,
The Court of Appeals did not err. The complaint alleged that the matter disclosed
And even if the information were of the kind that affected reputation, the complaint would still not state a claim here because the matters disclosed were not offensive and objectionable. See, e.g., Dortch v. Atlanta Journal ,
Each count of the complaint failed to state a claim upon which relief could be granted. The Court of Appeals therefore properly affirmed the dismissal of the complaint.
Judgment affirmed.
All the Justices concur, except Peterson, Warren, and Ellington, JJ., disqualified.
Notes
OCGA § 50-21-23 (a) says:
The state waives its sovereign immunity for the torts of state officers and employees while acting within the scope of their official duties or employment and shall be liable for such torts in the same manner as a private individual or entity would be liable under like circumstances; provided, however, that the state's sovereign immunity is waived subject to all exceptions and limitations set forth in this article. The state shall have no liability for losses resulting from conduct on the part of state officers or employees which was not within the scope of their official duties or employment.
OCGA § 50-21-22 (3) defines "loss" as: "personal injury; disease; death; damage to tangible property, including lost wages and economic loss to the person who suffered the injury, disease, or death; pain and suffering; mental anguish; and any other element of actual damages recoverable in actions for negligence."
As noted above, the second sentence of OCGA § 50-21-23 (a) says: "The state shall have no liability for losses resulting from conduct on the part of state officers or employees which was not within the scope of their official duties or employment." (Emphasis added.)
Court of Appeals cases relying on Bradley Center 's language are overruled, see, e.g., Lowry v. Cochran ,
Because the disclosure was not intentional, we need not decide whether the information disclosed was "ma[d]e available to the general public." We also do not consider whether a duty might arise on these or other facts from any other statutory or common law source, as no such argument has been made here.
Cf. Deal v. Coleman ,
For example, the subject matter of other cases involving this tort includes the disclosure of extramarital affairs, see Cottrell ,
We therefore need not decide if the other elements of the tort were satisfied.