Georgia Supreme Court Rejects Lawsuit Over Accidental Disclosure of Citizens’ Personal Information

Personal injury claims are not always about car accidents or even physical injuries. Negligence can affect victims in many other ways, such as forcing them to incur a financial loss or depriving them of some other intrinsic right. That said, a plaintiff can only recover damages when the negligence was rooted in some legal duty owed him or her by the defendant.

Georgia Department of Labor v. McConnell

For example, the Supreme Court of Georgia recently issued an opinion, Georgia Department of Labor v. McConnell addressing the question of whether state officials owe a legal duty to protect the personal information of individuals from unauthorized disclosure. The background for this case was a 2013 incident in which an employee of the Georgia Department of Labor accidentally emailed a spreadsheet containing the personal information of over 4,700 residents of Cherokee, Cobb, and Fulton Counties to approximately 1,000 recipients.

One of the persons whose information was contained on that spreadsheet subsequently filed a class action complaint in Georgia state court against the Department. The lawsuit specifically alleged “negligence, breach of fiduciary duty, and invasion of privacy by public disclosure of private facts.” The Department moved to dismiss the complaint on sovereign immunity grounds. The trial judge granted the motion, holding that the type of “losses” alleged by the plaintiff were not covered by the state’s legislative waiver of sovereign immunity in tort cases.

On that point, the Georgia Supreme Court disagreed. It held the Georgia Tort Claims Act (GTCA) served to waive sovereign immunity in all cases involving alleged torts committed by state employees “while acting within the scope of their employment.” Although there are certain exceptions and limitations to this waiver, none of them applied in this case, the Court said. Indeed, the legislature deliberately made the waiver broad to cover most “actual damages recoverable in actions for negligence.”

However, the Supreme Court went on to say this particular lawsuit lacked merit. With respect to the plaintiff’s negligence allegation, the Court said nothing in Georgia law created an enforceable duty on the part of the Department to protect the plaintiff’s personal information from “negligent disclosure.” Nor does the Georgia Constitution–which imposes a general duty on public officials to act as “trustees” of the people–create a specific duty to individual citizens. (In fact, the Court observed this part of the Constitution only applied to situations in which public officials profited at the public’s expense, which was not the case here.)

Finally, the Supreme Court rejected the plaintiff’s suggestion the Department owed a “fiduciary duty” him and the other individuals whose data was compromised. A fiduciary duty only exists when there is a confidential relationship–such as between a lawyer and a client–and not the everyday relationship that exists between government employees and the public. Accordingly, the Supreme Court held the plaintiff’s complaint was properly dismissed by the lower courts.