McCONNELL Et Al. v. DEPARTMENT OF LABOR
337 Ga. App. 457
Ga. Ct. App.
2016
Check Treatment

MCCONNELL et al. v. DEPARTMENT OF LABOR

A16A0655

Court of Appeals of Georgia

JUNE 16, 2016

787 SE2d 794

ELLINGTON, Presiding Judge.

Herbert E. Franklin, Jr., District Attorney, Matthew C. Brown, Assistant District Attorney, for appellee.

ELLINGTON, Presiding Judge.

Thomas McConnell filed this class action against the Georgia Department of Labor, alleging several tort claims in connection with the Department‘s disclosure of personal information of McConnell and the proposed class members. After a hearing, the Superior Court of Cobb County granted the Department‘s motion to dismiss McConnell‘s complaint for failure to state a claim upon which relief can be granted. McConnell appeals, and for the reasons explained below, we affirm.

In ruling on a motion to dismiss, the trial court must accept as true all well-pled material allegations in the complaint and must resolve any doubts in favor of the plaintiff. As an appellate court, we review de novo a trial court‘s determination that a pleading fails to state a claim upon which relief can be granted, construing the pleadings in the light most favorable to the plaintiff and with any doubts resolved in the plaintiff‘s favor.

(Citations, punctuation and footnote omitted.) .

McConnell‘s amended complaint contained the following material allegations. In September 2012, the Department created a spreadsheet that listed the name, Social Security number, home phone number, e-mail address, and age of over 4,000 Georgians who had applied for unemployment benefits or other services administered by the Department. McConnell was among the Georgians whose personal information was included in the spreadsheet. A year later, a Department employee sent the spreadsheet by e-mail to approximately 1,000 of the Georgians on the list. To protect himself from the resulting risk of identity theft, McConnell enrolled in the “Life Lock” service, which currently costs $19 per month.

In January 2014, McConnell filed this class action, alleging claims, as amended, for negligence in disclosing “personal information” as defined under Georgia law, invasion of privacy (public dis-closure of private facts), and breach of fiduciary duty. Under each theory of recovery, McConnell seeks damages, specifically, the fee for membership in Life Lock and other out-of-pocket costs related to credit monitoring and identity protection services, damages resulting from the impact to his credit score from the closing of accounts, and compensation for the continuing fear and anxiety of potential identity theft in the future. He does not allege that an act of identity theft has yet occurred.1

The Department moved to dismiss McConnell‘s complaint, arguing, inter alia, pursuant to OCGA § 9-11-12 (b) (6), that the complaint failed to state a claim upon which relief can be granted. The trial court granted the Department‘s motion to dismiss, finding that each count failed to state a claim upon which relief can be granted.2

1. McConnell contends that the trial court erred in ruling that he failed to state a claim for negligent disclosure of personal information, based, inter alia, on its determination that as a matter of law “there is no legal duty [under Georgia law] to safeguard personal information.”

In order to have a viable negligence action, a plaintiff must satisfy the elements of the tort, namely, the existence of a duty on the part of the defendant, a breach of that duty, causation of the alleged injury, and damages resulting from the alleged breach of the duty. The legal duty is the obligation to conform to a standard of conduct under the law for the protection of others against unreasonable risks of harm. This legal obligation to the complaining party must be found, the observance of which would have averted or avoided the injury or damage; the innocence of the plaintiff is immaterial to the existence of the legal duty on the part of the defendant in that the plaintiff will not be entitled to recover unless the defendant did something that it should not have done, i.e., an action, or failed to do something that it should have done, i.e., an omission, pursuant to the duty owed the plaintiff under the law. The duty can arise either from a valid legislative enactment, that is, by statute, or be imposed by a common law principle recognized in the caselaw. . . . The existence of a legal duty is a question of law for the court.

(Citations and punctuation omitted.) .3

McConnell acknowledges that a duty to safeguard and protect the personal information of another has not been expressly recognized in Georgia case law.4 McConnell contends that such a common

law duty exists nonetheless, citing two statutory sources, OCGA §§ 10-1-393.8 and 10-1-910. In OCGA § 10-1-910, the General Assembly set out legislative findings underlying the Georgia Personal Identity Protection Act, OCGA §§ 10-1-910 through 10-1-915 (the “GPIPA“), enacted in 2005.5 In the GPIPA, the General Assembly found, inter alia, that “[t]he privacy and financial security of individuals is increasingly at risk, due to the ever more widespread collection of personal information by both the private and public sectors[,]” that “[i]dentity theft is one of the fastest growing crimes committed in this state[,]” and that “[i]dentity theft is costly to the marketplace and to consumers[.]” OCGA § 10-1-910 (1), (3), (6). Because “[v]ictims of identity theft must act quickly to minimize the damage[,] . . . expeditious

notification of unauthorized acquisition and possible misuse of a person‘s personal information is imperative.” OCGA § 10-1-910 (7). In line with these findings, the GPIPA requires that affected persons be given certain notice of a data breach.6 McConnell contends that in codifying these findings the General Assembly demonstrated its intent to protect citizens from the adverse effects of disclosure of personal information and created a general duty to preserve and protect personal information. Notably, however, the GPIPA proscribes particular conduct only after a (known or suspected) data security breach has occurred. Because the GPIPA does not impose any standard of conduct in implementing and maintaining data security practices, it cannot serve as the source of a statutory duty to safeguard personal information. .7

Similarly, we conclude that OCGA § 10-1-393.8, which is part of the Fair Business Practices Act of 1975 (the “FBPA“) as amended,8 cannot serve as the source of such a statutory duty. That Code section provides that, except as otherwise provided, “a person, firm, or corporation shall not: . . . [p]ublicly post or publicly display in any manner an individual‘s social security number. . . . ‘[P]ublicly post’ or ‘publicly display’ means to intentionally communicate or otherwise make available to the general public[.]” OCGA § 10-1-393.8. As the trial court noted in the appealed order, the FBPA expressly prohibits

intentionally communicating a person‘s Social Security number, while McConnell alleges that the Department negligently disseminated his Social Security number by failing “to take the necessary precautions required to safeguard and protect the personal information from unauthorized disclosure.” Although the FBPA imposes a standard of conduct to refrain from intentionally and publicly posting or displaying Social Security numbers,9 a legal duty to refrain from doing something intentionally is not equivalent to a duty to exercise a degree of care to avoid doing something unintentionally, which falls within the ambit of negligence. The trial court correctly concluded that McConnell‘s complaint is premised on a duty of care to safeguard personal information that has no source in Georgia statutory law or case law and that his complaint therefore failed to state a claim of negligence. .

Given the General Assembly‘s stated concern about the cost of identity theft to the marketplace and to consumers, as well as the fact that it created certain limited duties with regard to personal information (e.g., the duty to notify affected persons of data breaches and the duty not to intentionally communicate information such as Social Security numbers to the general public), it may seem surprising that our legislature has so far not acted to establish a standard of conduct intended to protect the security of personal information, as some other jurisdictions have done in connection with data protection and data breach notification laws.10 It is beyond the scope of judicial authority,

however, to move from aspirational statements of legislative policy to an affirmative legislative enactment sufficient to create a legal duty.11

2. McConnell contends that the trial court erred in dismissing his breach of fiduciary duty claim for failure to state a claim upon which relief can be granted based on its determination that he had not shown that he had a particular relationship of trust or mutual confidence with the Department. “Establishing a claim for breach of fiduciary duty requires proof of three elements: (1) the existence of a fiduciary duty; (2) breach of that duty; and (3) damage proximately caused by the breach.” (Citation and punctuation omitted.) .

Any relationship shall be deemed confidential, whether arising from nature, created by law, or resulting from con-tracts, where one party is so situated as to exercise a controlling influence over the will, conduct, and interest of another or where, from a similar relationship of mutual confidence, the law requires the utmost good faith, such as the relationship between partners, principal and agent, etc.

OCGA § 23-2-58.

McConnell argues that, because a fiduciary relationship, in addition to being created by statute or contract, may also be created by the facts of a particular case, a claim for breach of fiduciary duty is uniquely unsuitable for disposition via a motion to dismiss, when the plaintiff has not been able to conduct discovery.12 In his complaint, McConnell alleged that a fiduciary duty arose when the Department required him to disclose confidential personal identification information in order to obtain services or benefits from the Department and that he reasonably placed his trust and confidence in the Department to safeguard and protect his information from public disclosure. He contends that the Department was “so situated as to exercise a controlling influence over [his] interest” because, unless he provided his personal information to the Department, he would not receive unemployment benefits, resulting in a fiduciary relationship.

In a recent case, a bank employee gave a customer‘s information to the employee‘s husband, which allowed her husband to steal the customer‘s identity. , reversed in part on other grounds sub nom. , and opinion vacated in part, . The customer sued the bank, asserting claims that the bank negligently failed to protect his personal information, breached a duty of confidentiality, and invaded his privacy. . The customer alleged that the bank “falsely represented to its customers and members of the general public that it created and implemented a system to adequately protect the private and personal identifying information entrusted to it by its customers[.]” Noting that the bank-customer relationship generally is not a confidential relationship under Georgia law, this Court held that the plaintiff had not pled “any special circumstances showing that he had a particular relationship of trust or mutual confidence with [the bank].” (2).13 In other words, the fact that the plaintiff gave the bank his personal information to receive services, and the bank promised to protect this information, did not create a confidential relationship under Georgia law. Likewise, in alleging in this case that he gave the Department his personal information as a prerequisite to receiving services, with the expectation that the Department would protect his information, McConnell failed to assert in his complaint facts showing that the Department owed him a confidential duty to protect that information. .14

3. McConnell contends that the trial court erred in ruling that he failed to state a claim upon which relief can be granted for invasion of privacy, public disclosure of private facts, based, inter alia, on its determination that the elements of that tort cannot be satisfied unless the facts at issue are embarrassing private facts. McConnell argues:

Georgia law recognizes a variety of information as private and not subject to public disclosure, including certain financial and banking records, medical records, certain police records (particularly records of juvenile crime) and records related to status as a victim of a crime (particularly sexual assault). The law recognizes a claim for unauthorized disclosure of private information in these circumstances.

Under Georgia law,

there are four disparate torts under the common name of invasion of privacy. These four torts may be described briefly as: (1) intrusion upon the plaintiff‘s seclusion or solitude, or into his private affairs; (2) public disclosure of embarrassing private facts about the plaintiff; (3) publicity which places the plaintiff in a false light in the public eye; and (4) appropriation, for the defendant‘s advantage, of the plaintiff‘s name or likeness.

(Citation and punctuation omitted.) . There are at least three necessary elements for recovery for

[p]ublic disclosure of embarrassing private facts about the plaintiff[,] . . . : (a) the disclosure of private facts must be a public disclosure; (b) the facts disclosed to the public must be private, secluded or secret facts and not public ones; (c) the matter made public must be offensive and objectionable to a reasonable man of ordinary sensibilities under the circumstances.

. See also (accord).

In , the plaintiffs claimed that the defendant bank‘s publication of their Social Security numbers could result in identify theft, credit card fraud, and other offenses that might damage them personally and financially. We held that such allegations

do not fall within the causes of action for invasion of privacy because there is no allegation that [the defendant] (1) intruded into the [plaintiffs‘] seclusion, (2) disclosed embarrassing private facts, (3) depicted the [plaintiffs] in a false light, or (4) appropriated the [plaintiffs‘] name or likeness for [the defendant‘s] own advantage.

. As a result, we held, the trial court properly dismissed the plaintiffs’ claim for invasion of privacy for failure to state a claim for relief under Georgia law. The trial court in this case properly dismissed McConnell‘s invasion of privacy claim for the same reason. ; ;15 .

Judgment affirmed. Branch and Mercier, JJ., concur.

DECIDED JUNE 16, 2016

Cohen, Cooper, Estep & Allen, Scott A. Schweber, Jefferson M. Allen, for appellants.

Samuel S. Olens, Attorney General, Kirsten S. Daughdril, Senior Assistant Attorney General, A. Ellen Cusimano, Assistant Attorney General, for appellee.

Notes

1
We note that these factual allegations are not disputed. The Department admitted creating the spreadsheet and admitted that the spreadsheet included McConnell‘s name, Social Security number, home phone number, age, and e-mail address. It admitted that its employee, in attempting to send the spreadsheet to another Department employee, inadvertently sent the spreadsheet via e-mail to approximately 1,000 recipients. In addition, the Department admitted that the information was “personal information” under Georgia law. See Division 1, infra.
2
As to McConnell‘s claim for negligence, the trial court also determined that Georgia‘s Tort Claims Act, OCGA § 50-21-20 et seq., does not waive the State‘s sovereign immunity for the types of “loss” McConnell claims.
3
See OCGA § 51-1-6 (“When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.“); OCGA § 51-1-8 (“Private duties may arise from statute or from relations created by contract, express or implied. The violation of a private duty, accompanied by damage, shall give a right of action.“); see also (A legal duty that will support an actionable claim of negligence “cannot rest solely upon OCGA § 51-1-6 because this statute sets forth merely general principles of tort law. By its express terms, tort liability under OCGA § 51-1-6 mandates that the alleged tortfeasor[] ha[s] breached a legal duty to perform a beneficial act or to refrain from doing an injurious act. So, the legal duty to support [a plaintiff‘s] negligence claim must be found in another legislative enactment” beside OCGA § 51-1-6.) (citation omitted); (The first element of a cause of action for negligence is “[a] legal duty to conform to a standard of conduct raised by the law for the protection of others against unreasonable risks of harm[.]“) (citation and punctuation omitted); (“[D]uty arises either from statute or from a common law principle recognized in the case law.“) (citation omitted); (“It is well-settled that Georgia law allows the adoption of a statute or regulation as a standard of conduct so that its violation becomes negligence per se. OCGA § 51-1-6 authorizes a plaintiff to recover damages for the breach of a legal duty even when that duty arises from a statute that does not provide a private cause of action. OCGA § 51-1-6 does not create a legal duty but defines a tort and authorizes damages when a legal duty is breached.“) (citation and punctuation omitted); (To determine whether the violation of a statute is negligence per se “it is necessary to examine the purposes of the legislation and decide (1) whether the injured person falls within the class of persons it was intended to protect and (2) whether the harm complained of was the harm it was intended to guard against.“) (citations, punctuation and footnote omitted).
4
In his appellate brief, McConnell avers that data privacy and tort law related to disclosure of personal identifying information (“PII“) is a new and emerging area of law. It is rare to find a prior court opinion “on all fours” with the facts of any given information disclosure case. However, when one views the facts of this case in light of general common-law principles of tort law, it is not difficult to see how and why the law does and should recognize tort causes of action where a defendant discloses PII without proper authorization or permission of the persons whose PII is disclosed. We note that a federal district court recently stated: Georgia recognizes a general duty to all the world not to subject them to an unreasonable risk of harm. . . . The Court declines the Defendant‘s invitation to hold that it had no legal duty to safeguard information even though it had warnings that its data security was inadequate and failed to heed them. To hold that no such duty existed would allow retailers to use outdated security measures and turn a blind eye to the ever-increasing risk of cyber attacks, leaving consumers with no recourse to recover damages even though the retailer was in a superior position to safeguard the public from such a risk. . . . Because this Court finds that a duty does exist, the [Defendant‘s] motion to dismiss [the Plaintiffs’ negligence claim] on the ground that there was no duty should also be denied. (Punctuation omitted.) , citing . In , the Supreme Court of Georgia found a legal duty “aris [ing] out of the general duty one owes to all the world not to subject them to an unreasonable risk of harm. This has been expressed as follows: negligence is conduct which falls below the standard established by law for the protection of others against unreasonable risk of harm. Restatement, Torts, 2d, § 282.” (Punctuation omitted.) . Despite the expansive language regarding a general duty owed “to all the world” however, the issue presented in was quite narrow: “whether an individual other than the patient can recover for the alleged malpractice of the physician where that person is injured by the criminal conduct of the patient and there is no privity between the injured party and the physician.” . Noting that, “as a general rule, there is no duty to control the conduct of third persons to prevent them from causing physical harm to others[,]” the Supreme Court held that one of the exceptions to that rule applied “because of the special relationship which existed between” the patient, who killed his wife and her paramour while on a weekend pass from a psychiatric hospital, and the physician, in a situation “where the course of treatment of a mental patient involve[d] an exercise of control over him by a physician who knows or should know that the patient is likely to cause bodily harm to others.” (Citations and punctuation omitted.) . See also (citing in analyzing whether there can be liability based on a municipality‘s duty to protect the general public from criminal conduct and holding that “where there is a special relationship between the individual and the municipality which sets the individual apart from the general public and engenders a special duty owed to that individual, the municipality may be subject to liability for the nonfeasance of its police department“) (footnote omitted; emphasis in original); (accord). There is no evidence of any such special relationship in this case. As for the recent federal case, , we are not bound to follow the district court‘s interpretation of Georgia law. Moreover, the district court found a duty to protect the personal information of the defendant‘s customers in the context of allegations that the defendant failed to implement reasonable security measures to combat a substantial data security risk of which it had received multiple warnings dating back several years and even took affirmative steps to stop its employees from fixing known security deficiencies. There are no such allegations in this case.
5
See Ga. L. 2007, p. 450 (Act 241), § 1 (for name designation).
6
The GPIPA requires a government entity (as a “data collector“) “that maintains computerized data that includes personal information of individuals” to give prompt notice to affected Georgia residents of any security breach, that is, acquisition of unencrypted personal information by any unauthorized person, and to notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the notices. OCGA § 10-1-912. See OCGA § 10-1-911 (1) (definition of a “breach of the security of the system“), (2) (definition of a “data collector“), (4) (definition of “notice“). The GPIPA‘s definition of “personal information” includes an individual‘s first and last name in combination with the person‘s Social Security number. OCGA § 10-1-911 (6). Another example is a person‘s name in combination with a credit or debit card number, if under the circumstances the number could be used without a password or other information. Id.
7
In , a bank customer based a claim of negligence on the bank‘s failure to protect his personal information and asserted that the legal duty to support his negligence claim was found in the federal Gramm-Leach-Bliley Act, the “GLBA,” 15 USC § 6801 et seq. The Supreme Court of Georgia explained that, although the GLBA “expressly authorizes federal agencies to establish appropriate standards” for financial institutions “relating to administrative, technical, and physical safeguards,” including safeguards “to protect against unauthorized access to or use of [customers‘] records or information which could result in substantial harm or inconvenience to any customer,” see 15 USC § 6801 (a), such “an aspirational statement of Congressional policy” should not be “misread . . . as establishing a legal duty, the alleged breach of which would give rise under the law of this State to a cause of action for negligence against financial institutions.” .
8
OCGA § 10-1-390 (OCGA §§ 10-1-390 through 10-1-408 shall be known as the “Fair Business Practices Act of 1975.“).
9
The trial court questioned whether the Department is “a person, firm, or corporation” subject to OCGA § 10-1-393.8. But the Department does not contend that it is not subject to the statute. See OCGA §§ 10-1-392 (24) (For purposes of the FBPA, including OCGA § 10-1-393.8, “‘[p]erson’ means a natural person, corporation, trust, partnership, incorporated or unincorporated association, or any other legal entity.“); 34-2-1 (“There is created and established a separate and independent administrative agency to be known as the Department of Labor.“); (“When a governmental entity or quasi-public entity has independent legal status as a public corporation, agency, or authority, the legislative act creating such governmental entity generally confers one or more of the power and authority to contract, hold property, eminent domain, or sue and be sued. The fact that a governmental entity may have sovereign immunity from a tort action does not prevent such entity from being a separate legal entity or an entity that may sue and be sued.“) (citations omitted).
10
See, e.g., Ark. Code Ann. § 4-110-104 (b) (In the Arkansas Personal Information Protection Act: “A person or business that acquires, owns, or licenses personal information about an Arkansas resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.“); Cal. Civ. Code § 1798.81.5 (In the California Database Breach Act: “It is the intent of the Legislature to ensure that personal information about California residents is protected. . . . A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.“); Fla. Stat. Ann. § 501.171 (2) (“Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information.“); Md. Code Ann., Commercial Law § 14-3503 (In the Maryland Personal Information Protection Act: “To protect personal information from unauthorized access, use, modification, or disclosure, a business that owns or licenses personal information of an individual residing in the State shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned or licensed and the nature and size of the business and its operations.“); Md. Code Ann., State Government § 10-1304 (“To protect personal information from unauthorized access, use, modification, or disclosure, a [state government] unit that collects personal information of an individual shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information collected and the nature of the unit and its operations.“); Nev. Rev. Stat. Ann. § 603A.210 (1) (“A data collector that maintains records which contain personal information of a resident of this State shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure.“); Rhode Island Gen. Laws Ann. § 11-49.3-2 (a) (In the Rhode Island Identity Theft Protection Act of 2015: “A municipal agency, state agency or person that stores, collects, processes, maintains, acquires, uses, owns or licenses personal information about a Rhode Island resident shall implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve the confidentiality, integrity, and availability of such information.“).
11
See (The judiciary must not misread “an aspirational statement of legislative policy” as an affirmative legislative enactment that establishes a legal duty, as that would usurp legislative authority.); (Where a particular common law duty was not recognized in Georgia, the common law rule could be changed only by legislative act.); (“The core legislative function is the establishment of public policy through the enactment of laws.“) (footnote omitted); (Our appellate courts’ authority extends only to the correction of errors of law, and we have no legislative powers or functions. “[T]he legislature, and not the courts, is empowered by the Constitution to decide public policy, and to implement that policy by enacting laws; and the courts are bound to follow such laws if constitutional.“).
12
See (“[S]ince a confidential relationship may be found whenever one party is justified in reposing confidence in another, the existence of a confidential or fiduciary relationship is generally a factual matter for the jury to resolve.“).
13
See (Because the Supreme Court in , did not address or consider Division 2 of our earlier opinion in , and because that portion of our earlier opinion was consistent with the Supreme Court‘s opinion, that division remains binding.).
14
Cf. (When the plaintiff wished to purchase a life insurance policy from the defendant, she was required to, and agreed to supply the company with highly sensitive personal information including her full name, her Social Security number, and her date of birth. The trial court concluded that, under New York law, there was in this agreement an implied covenant of trust and confidence that the defendant would safeguard and protect the plaintiff‘s personal information, as evidenced by the defendant‘s privacy notice to its customers stating that they took great care in safeguarding customers’ personal information. The court noted, “[w]hile this concept has never before been applied to issues surrounding the protection of confidential personal information, perhaps in the absence of appropriate legislative action, it should.“).
15
See (Because the Supreme Court in , did not address or consider Division 3 of our earlier opinion in , and because that portion of our earlier opinion was consistent with the Supreme Court‘s opinion, that division remains binding.).
Read the detailed case summary