Georgia Supreme Court Looking at Data Breach Liability

Data breaches and the unintentional disclosure of personal information are much in the news. Whether such events give rise to tort liability is an issue being looked at by the Georgia Supreme Court.

Georgia Department of Labor v. McConnell, Case Nos. S18G1316 and S18G1317 (decided May 20, 2019), involved an unintentional disclosure by the Georgia Department of Labor of the personal information of applicants for unemployment benefits and other Department services.  A Department employee had sent an email to approximately 1000 recipients that included a spreadsheet containing the personal information, including social security numbers, of over 4500 applicants.  One individual whose information was disclosed filed a proposal class action on behalf of all of the affected applicants.

In finding no tort liability, the Court held that no Georgia statute created liability for an unintentional disclosure.  Opinion, pp. 10-11.  The Court disapproved of language in one of its earlier decisions that referenced the existence of a general legal duty “to all the world not to create an unreasonable risk of harm.”  Opinion, pp. 9-10.  The Court further held that the disclosure could not fit within case law addressing the disclosure of embarrassing private facts.  The personal information disclosed (home addresses, phone numbers, social security number) was not “embarrassing” or defamatory.  Opinion, pp. 15-17.

In late April, the Georgia Supreme Court agreed to review the decision of the Georgia Court of Appeals in Collins v. Athens Orthopedic Clinic, P.A., 347 Ga. App. 13 (2018).  In that case, the Court of Appeals held that a healthcare provider’s inadvertent disclosure of patient personal information did not give rise to a cause of action when the affected persons suffered no direct economic loss.  The disclosure, in itself, was not an injury to the plaintiff that created standing to sue.  Reviewing that decision will give the Georgia Supreme Court another chance to look at the liability attendant to a data breach

The McConnell opinion is available here.

Related Capabilities

Media Contact

Public Relations Contact
Kate Lenders
Senior Marketing Manager
klenders@sgrlaw.com
312-360-6478