Collins v. Athens Orthopedic Clinic, P.A.

307 Ga. 555

837 S.E.2d 310

COLLINS et al.

v.ATHENS ORTHOPEDIC CLINIC, P.A.

S19G0007

Supreme Court of Georgia.

Decided: December 23, 2019

David Andrew Bain, Law Offices of David A. Bain, LLC, 1230 Peachtree St., NE, Suite 1050, Atlanta, Georgia 30309, Mark S. Goldman, Douglas J. Bench, Goldman Scarlato & Penny, P.C., 8 Tower Bridge, Suite 1025, 161 Washington Street, Conshohocken, Pennsylvania 19428, for Appellant.

John Durand Dalbey, Chilivis, Cochran, Larkins & Bever, LLP, 3127 Maple Drive, N.E., Atlanta, Georgia 30305-2503, for Appellee.

PETERSON, Justice.

When a criminal steals consumers’ sensitive personal data, what do those consumers have to plead against the allegedly negligent business from whom the data was stolen to show a legally cognizable injury under Georgia tort law? The Court of Appeals has held in cases involving the exposure of personal information that the failure to show that the information had actually fallen into criminal hands, let alone that the information was used to the consumers’ detriment, meant that plaintiffs had failed to show a legally cognizable injury. But this case, which was dismissed on the pleadings despite allegations of large-scale criminal activity, falls into a different category of data-exposure cases. The plaintiffs here, current or former patients of the defendant medical clinic, brought a putative class action after the clinic informed them that a hacker had stolen their personal data from the clinic. We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable. Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligence claims, we reverse that holding. Because that error may have affected the Court of Appeals’s other holdings, we vacate those other holdings and remand the case.

1. Background

The complaint, verified by each of the named plaintiffs, alleges that in June 2016 an anonymous hacker stole the personally identifiable information, including Social Security numbers, addresses, birth dates, and health insurance details, of at least 200,000 current and former patients of Athens Orthopedic Clinic ("the Clinic") from the Clinic’s computer databases. Those current and former patients included named plaintiffs Christine Collins, Paulette Moreland, and Kathryn Strickland. According to the allegations contained in the complaint, the hacker demanded a ransom, but the Clinic refused to pay. The hacker offered at least some of the stolen personal data for sale on the so-called "dark web," and some of the information was made available, at least temporarily, on Pastebin, a data-storage website. The Clinic notified the plaintiffs of the breach in August 2016.

The plaintiffs allege that because their personal data has been "compromised and made available to others on the dark web, criminals are now able to assume Class Members’ identit[ies] and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts, all in Class Members’ names." Each named plaintiff alleges that she has "spent time calling a credit reporting agency and placing a fraud or credit alert on her credit report to try to contain the impact of the data breach and anticipates having to spend more time and money in the future on similar activities." Collins also alleges that fraudulent charges to her credit card were made "[s]hortly" after the data breach and that she spent time getting the charges reversed by the card issuer. And the complaint alleges that "[e]ven Class Members who have not yet experienced identity theft or are not yet aware of it nevertheless face the imminent and substantial risk of future injury."

In their suit against the Clinic, the plaintiffs sought class certification and asserted claims for negligence, breach of implied contract, and unjust enrichment. They sought damages based on costs related to credit monitoring and identity theft protection, as well as attorneys’ fees. They also sought injunctive relief under the Georgia Uniform Deceptive Trade Practices Act, OCGA § 10-1-370 et seq. ("UDTPA"), and a declaratory judgment to the effect that the Clinic must take certain actions to ensure the security of class members’ personal data in the future. The Clinic filed a motion to dismiss based on both OCGA § 9-11-12 (b) (1) and OCGA § 9-11-12 (b) (6), which the trial court granted summarily.

A divided panel of the Court of Appeals affirmed. See Collins v. Athens Orthopedic Clinic , 347 Ga. App. 13, 815 S.E.2d 639 (2018). The Court of Appeals concluded that the plaintiffs’ negligence claim was properly dismissed because the plaintiffs "seek only to recover for an increased risk of harm." Id. at 18 (2) (a), 815 S.E.2d 639. The majority concluded that although the credit monitoring and other precautionary measures alleged by the plaintiffs were "undoubtedly prudent," they were "designed to ward off exposure to future, speculative harm" and thus "insufficient to state a cognizable claim under Georgia law." Id.¹

Then-Presiding Judge McFadden dissented from that holding, concluding that the plaintiffs had standing to bring their claims given that their allegations of future injury show a substantial risk that harm will occur. Id. at 22-25 (1)-(2), 815 S.E.2d 639 (McFadden, P.J., concurring in part and dissenting in part). We granted the plaintiffs’ petition for certiorari to consider whether the Court of Appeals erred in holding that the plaintiffs failed to allege a legally cognizable injury. We conclude that the plaintiffs did allege a cognizable injury.

2. The Georgia case law relied on by the Court of Appeals is inapplicable for two reasons.

"It is well established that to recover for injuries caused by another’s negligence, a plaintiff must show four elements: a duty, a breach of that duty, causation[,] and damages." Goldstein, Garber & Salama, LLC v. J.B. , 300 Ga. 840, 841 (1), 797 S.E.2d 87 (2017) (citation and punctuation omitted). In other words, "before an action for a tort will lie, the plaintiff must show he sustained injury or damage as a result of the negligent act or omission to act in some duty owed to him." Whitehead v. Cuffie , 185 Ga. App. 351, 353 (2), 364 S.E.2d 87 (1987) ; see also OCGA § 51-1-6 ("When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby ." (emphasis added)); OCGA § 51-1-8 ("The violation of a private duty, accompanied by damage , shall give a right of action." (emphasis added)); OCGA § 51-12-4 ("Damages are given as compensation for injury; generally, such compensation is the measure of damages where an injury is of a character capable of being estimated in money.").

[A] wrongdoer is not responsible for a consequence which is merely possible, according to occasional experience, but only for a consequence which is probable, according to ordinary and usual experience. ... A fear of future damages is too speculative to form the basis for recovery.

Finnerty v. State Bank & Trust Co. , 301 Ga. App. 569, 572 (4), 687 S.E.2d 842 (2009) (citation and punctuation omitted), disapproved of on other grounds by Cumberland Contractors, Inc. v. State Bank & Trust Co ., 327 Ga. App. 121, 125 (2) n.4, 755 S.E.2d 511 (2014) ; see also OCGA § 51-12-8 ("If the damage incurred by the plaintiff is only the imaginary or possible result of a tortious act or if other and contingent circumstances preponderate in causing the injury, such damage is too remote to be the basis of recovery against the wrongdoer.").

Concluding that the plaintiffs had not sufficiently pleaded injury here, the Court of Appeals relied on two of its opinions addressing the exposure of sensitive personal information, Finnerty and Rite Aid of Georgia v. Peacock , 315 Ga. App. 573, 726 S.E.2d 577 (2012). In Finnerty , the matter came before the Court of Appeals on the grant of summary judgment against a civil case defendant who complained that the plaintiff bank had included his social security number in an exhibit to the civil complaint. 301 Ga. App. at 569, 687 S.E.2d 842. As one of several alternative bases for affirming the summary judgment order, the Court of Appeals concluded that the defendant’s state law counterclaims alleging that the bank’s action caused him injuries were "wholly speculative." Id. at 572 (4), 687 S.E.2d 842. The court noted that the defendant had "failed to demonstrate that the Bank’s purported unlawful disclosure made it ‘probable’ that he would suffer any identity theft or that any specific persons actually have accessed his confidential personal information as a result of the purported unlawful disclosure." Id. And in Rite Aid , the Court of Appeals reversed a grant of class certification in a case arising from the defendant pharmacy’s sale of its customers’ medication information to another pharmacy, concluding the trial court erred in finding that the named plaintiff and the proposed class of customers shared common questions of law and fact and that the named plaintiff was a sufficiently typical class representative. In particular, the Court of Appeals noted that the named plaintiff could only speculate that a criminal might associate with an employee of the new pharmacy who had access to his prescription information. 315 Ga. App. at 576-577 (1) (a) (i), 726 S.E.2d 577.

The Court of Appeals in this case also relied on its prior opinion in Boyd v. Orkin Exterminating Co ., 191 Ga. App. 38, 381 S.E.2d 295 (1989), overruled on other grounds by Hanna v. McWilliams , 213 Ga. App. 648, 651 (2), 446 S.E.2d 741 1994, in which the Court of Appeals affirmed a grant of partial summary judgment to the defendant pest control company on the plaintiffs’ suit alleging that the negligent application of pesticide in their home subjected...