Georgia Supreme Court Rules There is No Duty to Safeguard Personal Information Against Negligent Disclosure | Practical Law

Georgia Supreme Court Rules There is No Duty to Safeguard Personal Information Against Negligent Disclosure | Practical Law

In Georgia Dept. of Labor v. McConnell, the Georgia Supreme Court held that a government agency has no common law duty to safeguard personal information from a data breach under Georgia law.

Georgia Supreme Court Rules There is No Duty to Safeguard Personal Information Against Negligent Disclosure

by Practical Law Data Privacy Advisor
Published on 23 May 2019 • Georgia, USA (National/Federal)
In Georgia Dept. of Labor v. McConnell, the Georgia Supreme Court held that a government agency has no common law duty to safeguard personal information from a data breach under Georgia law.
On May 20, 2019, the Georgia Supreme Court issued an opinion in Georgia Dept. of Labor v. McConnell holding that there is no general duty to safeguard personal information against negligent disclosure under Georgia law ( (Ga. May 20, 2019)).
In September 2012, the Georgia Department of Labor compiled a spreadsheet containing personal information of 4,757 individuals seeking benefits, including the applicants' name, social security number, telephone number, email address, and age. Approximately one year later, a Department of Labor Employee inadvertently emailed the spreadsheet to approximately 1,000 recipients without the permission of the individuals named in the spreadsheet, including Thomas McConnell.
McConnell filed a complaint against the Department of Labor on behalf of himself and other the individuals named in the spreadsheet alleging negligence, breach of fiduciary duty, and invasion of privacy by public disclosure of private facts. The trial court granted the Department's motion to dismiss, holding that sovereign immunity barred the lawsuit and that the complaint failed to state a claim. The appellate court ultimately affirmed the trial court's result, holding that while the Department waived sovereign immunity under the Georgia Tort Claims Act, the complaint still failed to state a claim.
The Georgia Supreme Court affirmed the appellate court's finding that McConnell failed to state a claim, holding:
  • The Department had no legal duty to protect McConnell's personal information against negligent disclosure. Specifically, the court:
    • declared that dicta from the lead opinion in Bradley Center, Inc. v. Wessner suggesting that everyone owes a general duty not to subject others to an "unreasonable risk of harm" was an incorrect statement of the law (250 Ga. 199, 201 (Ga.1982)); and
    • held that the prohibition against public disclosures of social security numbers in Official Code of Georgia Annotated (OCGA) § 10-1-393.8 creates a duty to prevent intentional disclosures of social security numbers, but that duty does not extend to negligent disclosures.
  • The Department did not have a statutory fiduciary duty to protect McConnell's personal information against disclosure because:
    • the Georgia Constitution's Trustee Clause is only enforceable in tort when the complaint alleges that a public officer reaps personal financial gain at the expense of the public, which McConnell did not allege; and
    • the relationship between the Department and McConnell does not rise to the level of a "confidential relationship" sufficient to confer a statutory fiduciary duty to the plaintiff under OCGA § 23-2-58.
  • The invasion of privacy claim failed because the allegedly private information that the Department publicly disclosed was not offensive or objectionable, and did not otherwise affect McConnell's reputation.
This opinion highlights the obstacles data breach plaintiffs may face when pursuing a negligence theory under state common law.