Notable Opinions: May 20

The Court issued notable opinions in three cases, two of which SCOGblog highlighted this past spring in Cases to Watch and Oral Argument Notes (McConnell v. GA. DOL) (Guyton v. Barrow) dealing with agency deference, data breach litigation, and mootness. 

City of Guyton v. Barrow

As we highlighted in march, oral arguments in City of Guyton, Case no. S18G0944 (2019 WL 2167460) gave the impression that skepticism of agency deference exists on the Georgia Supreme Court, and that, given the appropriate opportunity, the Court may go so far as to overrule the State analogues to familiar doctrines like Chevron and Auer deference. (See Oral Argument Analysis: Guyton v. Barrow). 

Along those lines, the introduction to Justice Peterson's opinion for the Court helpfully captures the Court's conclusion in the case:

"Some have argued that this doctrine is in tension with our role as the principal interpreter of Georgia law, and we granted certiorari here on that question. But any such tension could exist only in cases where we have exhausted all of our interpretive tools without determining a text’s meaning. This is not one of those cases."

The case arises from Craig Barrow's challenge to the Environmental Protection Division of the Georgia Department of Natural Resources's (“EPD”) decision to issue a permit to the City of Guyton to apply treated wastewater to a tract of land through spray irrigation. Barrow argued that EPD issued the permit in violation of a water quality standard, Ga. Comp. R. & Regs., r. 391-3-6-.03 (2) (b) (ii) (the “antidegradation rule”).

The Court of Appeals below concluded that the antidegradation rule unambiguously required EPD to perform the antidegradation analysis, and, therefore, that EPD’s internal guidelines to the contrary did not warrant deference. See Barrow v. Dunn, 344 Ga. App. 747 (812 SE2d 63) (2018). The Court unanimously reversed, agreeing that the text of the rule was unambiguous -- albeit in the opposite direction. 

While Court did not overrule or even apply agency deference in Guyton, it nonetheless signaled to lower courts a narrow vision for their application of the doctrine going forward. Justice Peterson wrote "[a]lthough our statement in Atlanta Journal [that an agency’s interpretation is 'controlling' unless 'it is plainly erroneous or inconsistent' with the regulation seemingly requires us to follow an agency interpretation so long as it is reasonable] placed no qualifiers on judicial deference to agency interpretations, it is clear that we are to defer to an agency’s interpretation only when we are unable to determine the meaning of the legal text at issue." In this sense, Guyton at least purports to rein in agency deference to only those cases in which the courts "have exhausted all tools of construction." (emphasis added). To drive home the point, Justice Peterson emphasized "[a]fter using all tools of construction, there are few statutes or regulations that are truly ambiguous," and therefore even where "the meaning of the applicable regulation is not obvious on its face, this does not mean the regulation is ambiguous." (emphasis added).

McConnell v. Georgia Department of Labor 

In March, we noted that oral argument in McConnell ("McConnell II") signaled changes might be coming in Georgia data breach litigation. 

Background:

Thomas McConnell filed a class action against the Georgia Department of Labor, alleging several tort claims in connection with the Department’s disclosure PII belonging to members of the proposed class. Specifically, McConnell alleges that a Department employee sent an e-mail to approximately 1,000 applicants for unemployment benefits including a spreadsheet that listed the name, social security number, home phone number, e-mail address, and age of over 4,000 Georgians who had registered for Department services.

Proceedings Below: 

McConnell's tort claims include negligent disclosure of PII, breach of fiduciary duty, and invasion of privacy. The complaint sought to recover out-of-pocket costs related to credit monitoring and identity protection services and damages resulting from the adverse impact to his credit score from the closing of accounts.  In 2017, the Supreme Court held that the Court of Appeals had erred in addressing the merits before deciding the threshold issue of sovereign immunity. McConnell v. Dept. of Labor, 302 Ga. 18, 19, 805 S.E.2d 79 (2017) ("McConnell I). On remand, the trial court held that sovereign immunity barred the claims; the Court of Appeals disagreed, but held in any event that McConnell’s had indeed failed to state a claim. See McConnell v. Dept. of Labor, 345 Ga. App. 669 (2018).

McConnell II: 

As anticipated, the Court held that the State had waived sovereign immunity as to McConnell's negligence claims, but that McConnell nonetheless failed to state a claim. In particular, the Court rejected the Plaintiffs' submission that, based on the the opinion of a divided Court in Bradley Center, Inc. v. Wessner, 250 Ga. 199, 201 (1982) (dealing with a doctor's duty to protect third parties against mental health patients who are or could be dangerous) Georgia law imposes a  general duty “to all the world not to subject them to an unreasonable risk of harm.” 2019 WL 2167323 at *3. 

Writing for the Court, Justice Boggs explained: 

the language in Bradley Center on which McConnell relies was not a holding concurred in by a majority of this Court, was not supported by the only authority that the lead opinion cited, was not a correct statement of the law, did not control the result in that case (which was based on a “special relationship” between the plaintiff and the defendant), and has never been endorsed in a decision of this Court that qualifies as precedent.

Id. Because no such special relationship existed between McConnell and the Department, and he could not point to any statute creating such a duty, the Court dismissed the complaint for failure to state a claim. See id. 

The Upshot: 

The upshot of McConnell II is that whether and when holders of personally identifiable information owe a duty to protect the information is not settled. This is because, despite disapproving Bradley Center, the Court did not take the opportunity to clarify the duty owed under Georgia law. While McConnell II does not necessarily stand for the proposition that holders of PII don't ever have any duty to safeguard the information, a unanimous dismissal of the complaint at a minimum makes clear that the Court does not take the existence of such a duty for granted. Indeed, Justice Nahmias noted during oral argument that there is little to distinguish accidental disclosure situations from criminal hacking if there is not an underlying duty to safeguard another's PII.  

Interestingly, a number of the data breach cases filed involving Georgia law currently pending in Federal Court expressly relied on Bradley Center to find the existence of a duty to safeguard.  (See below). While a number of these cases have been found to state a claim under Georgia law, with the decision in McConnell, there do not appear to be any Georgia cases which agree. See McConnell II (supra), Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13 (2018) (dismissing for failure to state a claim based on lack of legally cognizable damages); Finnerty v. State Bank and Trust Co., 301 Ga. App. 569, 687 S.E.2d 842 (2009). 

It will not be long, however, before the Court has more to say on data breach litigation. In late April, the Court granted cert in Collins v. Athens Orthopedic Clinic, asking whether the  Court of Appeals erred in dismissing a data breach complaint because the plaintiffs could not allege legally cognizable injury. That case is scheduled for the September 2019 oral argument calendar; for background on the case, see our post on the order granting cert. 

Also Referenced:

In Re Equifax Inc., Customer Data Security Breach Litigation, 362 F.Supp.3d 1295 (N.D.Ga. 2019)

In Re Arby's Restaurant Group Inc. Litig., No. 1:17-cv-1035-AT, 2018 WL 2128441 at *3-5 (N.D.Ga. March 5, 2018)

 In Re The Home Depot Inc., Customer Data Security Breach Litigation, No. 1:14-md-2583-TWT 2016 WL 2897520 *3-4 (N.D.Ga. May 18, 2016)

Murder Convictions/Life Sentences

CARTER V. THE STATE (S19A0440) 

CARTER V. THE STATE (S19A0409) 

COCHRAN V. THE STATE (S19A0149) 

DAVIS V. THE STATE (S19A0419) 

GOODEN V. THE STATE (S19A0173) 

GRIER V. THE STATE (S19A0634) 

MOSS V. THE STATE (S19A0443) 

SPELL V. THE STATE (S19A0066) 

STROTHER V. THE STATE (S19A0279) 

Disciplinary Matters

IN THE MATTER OF: RICHARD SCOTT THOMPSON (S19Y1076)