This Court granted certiorari to the Court of Appeals in Jenkins v. Wachovia Bank, N.A.,
The relevant facts as found by the Court of Appeals are the following. Stephen Kale Jenkins brought a tort action against Wachovia Bank, N.A., Wells Fargo Bank, N.A., and all predecessor and successor entities and John Doe corporations (collectively, “Bank”), in which he alleged that a Bank teller had improperly accessed Jenkins’s confidential information and given it to her husband, allowing the husband to steal Jenkins’s identity. Jenkins asserted claims that the Bank negligently failed to protect the information, breached a duty of confidentiality, and invaded his privacy. The trial court granted the Bank’s motion for judgment on the pleadings. The Court of Appeals reversed the judgment on the pleadings as to Jenkins’s negligence claim after finding that the allegations of his complaint established the elements of negligence.
To maintain a viable negligence action, a plaintiff must satisfy the elements of the tort: the existence of a duty on the part of the defendant, a breach of such duty, causation of the injury alleged, and damages as a result of the alleged breach of duty. Rasnick v. Krishna Hospitality,
It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.
The Court of Appeals determined that the GLBA’s language made plain that financial institutions have a duty to protect certain information of their customers. Jenkins v. Wachovia Bank, N.A., supra at 259 (1) (a). It further cited OCGA § 51-1-6
As acknowledged by the Court of Appeals, there is no private right of action for an alleged violation of the terms of the GLBA. Finnerty v. State Bank and Trust Co.,
A duty in this case cannot rest solely upon OCGA § 51-1-6 because this statute sets forth merely general principles of tort law. Reilly v. Alcan Aluminum Corp.,
Certainly, 15 USC § 6801 (a) of the GLBA expresses the goal that financial institutions respect the privacy, security, and confidentiality of customers. While this is a clear Congressional policy statement, it is just that. It does not provide for certain duties or the performance of or refraining from any specific acts on the part of financial institutions, nor does it articulate or imply a standard of conduct or care, ordinary or otherwise. See Central Anesthesia Associates, P.C. v. Worthy,
establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards-
(1) to insure the security and confidentiality of customer records and information;
(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and
(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.
There is no finding by the Court of Appeals of a violation of any regulation, directive, or standard authorized by 15 USC § 6801 (b), to support Jenkins’s claim of the Bank’s negligence.
Judgment reversed and case remanded.
Notes
The Court of Appeals also determined that Jenkins failed to assert in his complaint facts showing that the Bank owed him a confidential duty or invaded his privacy, so it affirmed the grant of judgment on the pleadings as to the remaining claims. Those claims are not at issue in this appeal.
OCGA § 51-1-6 states:
When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.
Jenkins points to certain provisions of the Code of Federal Regulations in support of the finding of a duty under 15 USC § 6801 (a), specifically 16 CFR § 314.1; however, the regulation was not part of the Court of Appeals analysis or its finding of duty under the GLBA. Furthermore, 16 CFR § 314.1 (a) expressly implements only sections 501 and 505 (b) (2) of the GLBA and applies to those financial institutions over which the Federal Trade Commission has jurisdiction. 16 CFR § 314.1 (b).
Jenkins contends that neither the issue of the existence of a duty under 15 USC § 6801 (a), nor a “separation of powers” argument by the Bank is properly before this Court because of the Bank’s alleged failure to raise them before the trial court or the Court of Appeals. However, the question of a legal duty under the cited provision of the GLBA is the linchpin of the Court of Appeals holding at issue and is the precise question on certiorari. As for the Bank’s argument of a violation of the doctrine of separation of powers, this Court’s determination of the lack of a found legal duty makes it unnecessary to address such argument.