The Gramm-Leach-Bliley Act, which regulates financial institutions, includes a provision that provides that it is “the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.”  In Wells Fargo Bank, N.A. v. Jenkins, Case No. S12G1110 (decided June 17, 2013), the Georgia Supreme Court held that a bank customer could not rely upon that statutory statement of policy to create a private right of action under Georgia tort law for an alleged breach of a duty to maintain personal information as confidential.

The Georgia Court of Appeals had previously held that a bank customer could rely upon that provision in federal law to assert a negligence claim against a bank.  However, the Georgia Supreme Court reversed.  The Georgia Supreme Court held that the above-quoted provision in federal law was merely a policy statement and did not create specific duties or articulate specific standards of conduct or care for financial institutions.  Consequently, the statute created no duty that could form the basis of a claim for damages.

This decision should remove some uncertainty in a difficult area of the law for financial institutions.  Georgia courts will recognize a right to sue for money damages only if the relevant law expressly creates such a right.