Oral Argument Analysis: No Duty to Safegaurd Another's Personal Information?

Last week we identified McConnell v. Georgia Department of Labor (S18C1316-17) as a case to watch for a potential statement the Court might make on the "duty to safeguard" another's personally identifiable information ("PII"). With the benefit of oral argument, it seems changes may be coming in data breach litigation involving Georgia companies and consumers.


Background:


Thomas McConnell filed a class action against the Georgia Department of Labor, alleging several tort claims in connection with the Department’s disclosure PII belonging to members of the proposed class. Specifically, McConnell alleges that a Department employee sent an e-mail to approximately 1,000 applicants for unemployment benefits including a spreadsheet that listed the name, social security number, home phone number, e-mail address, and age of over 4,000 Georgians who had registered for Department services.

Proceedings Below: 

McConnell's tort claims include negligent disclosure of PII, breach of fiduciary duty, and invasion of privacy. The complaint seeks to recover out-of-pocket costs related to credit monitoring and identity protection services and damages resulting from the adverse impact to his credit score from the closing of accounts. 

The Superior Court of Cobb County granted the Department’s motion to dismiss McConnell’s complaint for failure to state a claim. McConnell appealed, and, in McConnell v. Dept. of Labor, 337 Ga. App. 457, 787 S.E.2d 794 (2016), the Court of Appeals. The Supreme Court granted cert and held that the Court of Appeals erred in addressing the merits before deciding the threshold issue of sovereign immunity. McConnell v. Dept. of Labor, 302 Ga. 18, 19, 805 S.E.2d 79 (2017). On remand, the trial court held that sovereign immunity barred the claims. The Court of Appeals disagreed, but held in any event that McConnell’s had indeed failed to state a claim. See McConnell v. Dept. of Labor, 345 Ga. App. 669 (2018).

Oral Argument Notes:

As a threshold matter it appears the Court will affirm the Court of Appeals statement that the claims were barred by sovereign immunity. The Georgia Tort claims act says plaintiffs can only recover for a "loss" as defined at 50-21-22(3), notably including "lost wages and economic loss." The "catchall" provision of the Tort Claims Act applies to "any other element of actual damages recoverable in actions for negligence." 

The justices appeared to roundly reject  the State's argument that the "catchall" provision did not include the type of economic harms McConnell alleged in claims for things like negligence and breach of fiduciary duty. Making a point echoed in questions from Justices Blackwell, Boggs, and Bethel, Justice Nahmias framed the problem: "I don't understand it that we look at the merits to decide if there is an actual negligence claim, then we look back and say 'ok well there is no actual negligence claim on the merits, so now there's sovereign immunity'; my understanding is if you allege negligence, that waives sovereign immunity, and then you go look to the merits of the problem."

The merits argument, on the other hand, did not bode as well for Georgia data breach plaintiffs. 

While the government was careful to distinguish McConnell's claims from recent data breach cases in Federal Courts for the Northern District of Georgia, see In Re Arby's Restaurant Group Inc. Litig., No. 1:17-cv-1035-AT, 2018 WL 2128441 at *3-5 (N.D.Ga. March 5, 2018) and In Re The Home Depot Inc., Customer Data Security Breach Litigation, No. 1:14-md-2583-TWT 2016 WL 2897520 *3-4 (N.D.Ga. May 18, 2016), which dealt with a duty to safeguard personal information against criminal hacking, the Court was more concerned with the underlying question of "are those cases [even] correct?" (government initially answered yes)

In particular, the Court clearly rejected the Plaintiffs' submission, based on the the opinion of a divided Court in Bradley Center, Inc. v. Wessner, 250 Ga. 199, 201 (1982) (dealing with a doctor's duty to protect third parties against mental health patients who are or could be dangerous) that Georgia law imposes a  general duty “to all the world not to subject them to an unreasonable risk of harm.” While Bradley Center has been cited in Arby's and Home Depot by federal courts to find a duty to safeguard PII, the relevant portion of the opinion in Bradley Center was joined by only two members of the (then 7 member) Court, and did not cite to any prior Georgia law. See id. Justice Nahmias, in particular, openly stated that he did not believe Bradley Center represents an authoritative statement of the scope of duty in Georgia.

The Justices seemed similarly skeptical of the idea that, because there are Georgia statutes touching on the privacy interests individuals have in PII (e.g. the Georgia Personal Identity Protection Act of 2007 (O.C.G.A. 10-1-910 et seq.), the law therefore imposes a duty to safeguard it via the force of those statutes or some overarching common law principle.

Interestingly, Chief Justice Melton did ask Senior Assistant Attorney General Loretta Pinkston-Pope "is the net effect that the State that collects sensitive personal identifying information has no duty to maintain the security of that information?" But if the Chief Justice was sufficiently troubled by the possibility to disagree with other members of the Court as to the overarching "duty" question, he did not signal it at any point during the argument. 


The upshot 

The outcome in  McConnell seems fairly clear: the Court will probably affirm the Court of Appeals decision that (1) while the Tort Claims Act does not bar McConnell's claims (2) dismissal on the merits was proper.

Less clear is exactly what, and how much, the Court will say about the broader duty to safeguard personally identifiable information in data breach cases. The Court might frame the issue narrowly, and simply say that the Department of Labor did not owe the plaintiff class any duty because no statutory or common law principle covers the type of accidental disclosure alleged in the case. After all, McConnell is not a typical "data breach" case in the sense that, unlike in Arby's and Home Depot, the data was compromised by accidental disclosure rather than criminal hacking. See also Collins v. Athens Orthopedic Clinic,  347 Ga. App. 13 (2018). 

Even so, the Court might choose to go further; as Justice Nahmias pointed out during argument, there is little to distinguish accidental disclosure situations from criminal hacking if there is not an underlying duty to safeguard another's PII. If the opinion tracks the tenor of the argument the Court may go so far as to say that, barring some special relationship or contractual agreement, no duty to safeguard exists under Georgia law. 

Oral Argument Analysis: City of Guyton v. Barrow and the swan song of agency deference in Georgia

Agency deference may not be long for the world in Georgia.

In City of Guyton et al. v. Barrow, S18C0944, the Court asked the parties to address two questions. One question dealt with the Georgia Department of Natural Resources, Environmental Protection Division's "antidegradation rule," Ga. Comp. R. & Regs. r. 391-3-6-.03(2)(b)(ii); specifically, does the rule "require an antidegradation analysis before issuing a permit to a facility that will discharge pollutants from a nonpoint source into the waters of this State?"

The other, and more significant, asked "[w]hat level of judicial deference should be afforded to a state agency in its interpretation of its own internal rules and regulations?" Those familiar with doctrines of agency deference like Chevron and Auer might be interested to know that, despite the traditional analytical framework of deference doctrines, the Court's first question in the order granting cert was about appropriate deference, and its second question was about statutory interpretation.

Inferring that the Court was therefore more concerned with the deference question than the interpretive question is just one way of looking at the cert petition, but there are reasons to think it is the right one.

First, It is no secret that skepticism of agency deference has picked up speed in recent years, fueled mainly by arguments that deferring to agency interpretations of ambiguous statutes and regulations threatens the separation of powers by ceding to the executive branch a task properly reserved for the judiciary: saying "what the law is." See, e.g., Gutierrez-Brizuela v. Lynch, 834 F.3d 1142 (2016) (Gorsuch, Circuit Judge, concurring) (citing Marbury v. Madison, 5 U.S. 137, 167 (1803)).

Second, oral arguments in City of Guyton gave the impression that such skepticism exists on the Georgia Supreme Court, and that, given the appropriate opportunity, that this skepticism may translate into overruling the State analogues to Chevron and Auer.  Justice Peterson pointedly asked "how is deference of this sort even remotely consistent with  Chief Justice Marshall's observation in Marbury v. Madison that it is the duty of the judicial branch to declare what the law is?" Responding to arguments that deference to agency expertise may be an appropriate response to truly ambiguous text, Justice Peterson expressed doubts as to whether ambiguity could "change our obligation to declare what the law is," or whether "subject matter expertise [could] better empower an agency to know what words mean." Justice Nahmias expressed similar skepticism of deference, pointing out the normal "tiebreaker" in ambiguous statutory text is that ambiguity cannot regulate people. 

Viewing the case as a whole, it is possible, perhaps even likely, that City of Guyton will not be the death of agency deference in Georgia. The State's interpretation-based arguments are strong, and the Justices appeared at least somewhat receptive to them. Further, City of Guyton is an unusual deference case because the agency's interpretation of the antidegradation purports to regulate less, rather than more conduct. This is significant because one of the more powerful interpretive canons is that the government cannot regulate with ambiguous text, i.e. that ambiguous text does not regulate. In such a case, deferring to an agency's interpretation of its own regulations produces much the same result as if the courts did not defer at all. 

Even so, it seems that the days are numbered for agency deference in Georgia. The end may come in City of Guyton; the Court may wait for a case where the agency's reading of the relevant text is not the best interpretation, or where deference would impose more rather than less regulation; the Court may even wait to take the lead of the United States Supreme Court, which is poised to decide an agency deference case in Kisor v. Wilkie ("Whether the Supreme Court should overrule Auer v. Robbins and Bowles v. Seminole Rock & Sand Co., which direct courts to defer to an agency’s reasonable interpretation of its own ambiguous regulation?"). But, one way or the other, City of Guyton may signal the impending doom of agency deference in Georgia.


Other Referenced cases/materials

• Order Granting Certiorari, case no. S18C0944 (available at https://www.gasupreme.us/wp-content/uploads/2018/08/s18c0944.pdf)
• Chevron U.S.A. Inc. v. Nautral Resources Defense Council, Inc., 467 U.S. 837 (1984)
• Auer v. Robbins, 519 U.S. 542 (1996)
• Oral Argument, City of Guyton v. Barrow (available at https://scgtv.new.swagit.com/videos/23457)
•  Ga. Dept. of Revenue v. Owens Corning, 283 Ga. 489, 490, 660 S.E.2d 719 (2008) (Ordinarily, “the interpretation of a statute by an administrative agency which has the duty of enforcing or administering it is to be given great weight and deference.”)
• Schrenko v. DeKalb County School Dist., 276 Ga. 786, 792(2), 582 S.E.2d 109 (2003). (“Although this Court is ‘not bound to blindly follow’ an agency's interpretation, we defer to an agency's interpretation when it reflects the meaning of the statute and comports with legislative intent.”)