McCONNELL Et Al. v. DEPARTMENT OF LABOR

FOURTH DIVISION
ELLINGTON, P. J.,
BRANCH and MERCIER, JJ.

NOTICE: Motions for reconsideration must be
physically received in our clerk’s office within ten
days of the date of decision to be deemed timely filed.
http://www.gaappeals.us/rules

June 16, 2016

In the Court of Appeals of Georgia
A16A0655. MCCONNELL et al. v. DEPARTMENT OF LABOR.

ELLINGTON, Presiding Judge.

Thomas McConnell filed this class action against the Georgia Department of

Labor, alleging several tort claims in connection with the Department’s disclosure of

personal information of McConnell and the proposed class members. After a hearing,

the Superior Court of Cobb County granted the Department’s motion to dismiss

McConnell’s complaint for failure to state a claim upon which relief can be granted.

McConnell appeals, and for the reasons explained below we affirm.

In ruling on a motion to dismiss, the trial court must accept as true all
well-pled material allegations in the complaint and must resolve any
doubts in favor of the plaintiff. As an appellate court, we review de novo
a trial court’s determination that a pleading fails to state a claim upon
which relief can be granted, construing the pleadings in the light most
 favorable to the plaintiff and with any doubts resolved in the plaintiff’s
favor.

(Citations, punctuation, and footnote omitted.) Wright v. Waterberg Big Game

Hunting Lodge Otjahewita (PTY), Ltd., 330 Ga. App. 508, 509 (767 SE2d 513)

(2014).

McConnell’s amended complaint contained the following material allegations.

In September 2012, the Department created a spreadsheet that listed the name, social

security number, home phone number, email address, and age of over 4,000

Georgians who had applied for unemployment benefits or other services administered

by the Department. McConnell was among the Georgians whose personal information

was included in the spreadsheet. A year later, a Department employee sent the

spreadsheet by email to approximately 1,000 of the Georgians on the list. To protect

himself from the resulting risk of identity theft, McConnell enrolled in the “Life

Lock” service, which currently costs $19 per month.

In January 2014, McConnell filed this class action, alleging claims, as

amended, for negligence in disclosing “personal information” as defined under

Georgia law, invasion of privacy (public disclosure of private facts), and breach of

fiduciary duty. Under each theory of recovery, McConnell seeks damages,

2
specifically, the fee for membership in Life Lock and other out-of-pocket costs

related to credit monitoring and identity protection services, damages resulting from

the impact to his credit score from the closing of accounts, and compensation for the

continuing fear and anxiety of potential identity theft in the future. He does not allege

that an act of identity theft has yet occurred.1

The Department moved to dismiss McConnell’s complaint, arguing, inter alia,

pursuant to OCGA § 9-11-12 (b) (6), that the complaint failed to state a claim upon

which relief can be granted. The trial court granted the Department’s motion to

dismiss, finding that each count failed to state a claim upon which relief can be

granted.2

1. McConnell contends that the trial court erred in ruling that he failed to state

a claim for negligent disclosure of personal information, based, inter alia, on its

1
We note that these factual allegations are not disputed. The Department
admitted creating the spreadsheet and admitted that the spreadsheet included
McConnell’s name, social security number, home phone number, age, and email
address. It admitted that its employee, in attempting to send the spreadsheet to another
Department employee, inadvertently sent the spreadsheet via email to approximately
1000 recipients. In addition, the Department admitted that the information was
“personal information” under Georgia law. See Division 1, infra.
2
As to McConnell’s claim for negligence, the trial court also determined that
Georgia’s Tort Claims Act, OCGA § 50-21-20 et seq., does not waive the State’s
sovereign immunity for the types of “loss” McConnell claims.

3
determination that as a matter of law “there is no legal duty [under Georgia law] to

safeguard personal information.”

In order to have a viable negligence action, a plaintiff must satisfy the
elements of the tort, namely, the existence of a duty on the part of the
defendant, a breach of that duty, causation of the alleged injury, and
damages resulting from the alleged breach of the duty. The legal duty is
the obligation to conform to a standard of conduct under the law for the
protection of others against unreasonable risks of harm. This legal
obligation to the complaining party must be found, the observance of
which would have averted or avoided the injury or damage; the
innocence of the plaintiff is immaterial to the existence of the legal duty
on the part of the defendant in that the plaintiff will not be entitled to
recover unless the defendant did something that it should not have done,
i.e., an action, or failed to do something that it should have done, i.e., an
omission, pursuant to the duty owed the plaintiff under the law. The
duty can arise either from a valid legislative enactment, that is, by
statute, or be imposed by a common law principle recognized in the
caselaw. The existence of a legal duty is a question of law for the court.

(Citations and punctuation omitted.) Rasnick v. Krishna Hospital, Inc., 289 Ga. 565,

566-567 (713 SE2d 835) (2011).3

3
See OCGA § 51-1-6 (“When the law requires a person to perform an act for
the benefit of another or to refrain from doing an act which may injure another,
although no cause of action is given in express terms, the injured party may recover
for the breach of such legal duty if he suffers damage thereby.”); OCGA § 51-1-8

4
 McConnell acknowledges that a duty to safeguard and protect the personal

information of another has not been expressly recognized in Georgia caselaw.4

(“Private duties may arise from statute or from relations created by contract, express
or implied. The violation of a private duty, accompanied by damage, shall give a right
of action.”); see also Wells Fargo Bank, N.A. v. Jenkins, 293 Ga. 162, 164 (744 SE2d
686) (2013) (A legal duty that will support an actionable claim of negligence “cannot
rest solely upon OCGA § 51-1-6 because this statute sets forth merely general
principles of tort law. By its express terms, tort liability under OCGA § 51-1-6
mandates that the alleged tortfeasor[ ] ha[s] breached a legal duty to perform a
beneficial act or to refrain from doing an injurious act. So, the legal duty to support
[a plaintiff’s] negligence claim must be found in another legislative enactment”
beside OCGA § 51-1-6.) (citation omitted); City of Douglasville v. Queen, 270 Ga.
770, 771 (1) (514 SE2d 195) (1999) (The first element of a cause of action for
negligence is “[a] legal duty to conform to a standard of conduct raised by the law for
the protection of others against unreasonable risks of harm[.]”) (citation and
punctuation omitted); Diamond v. Dept. of Transp., 326 Ga. App. 189, 195 (2) (756
SE2d 277) (2014) (“[D]uty arises either from statute or from a common law principle
recognized in the case law.”) (citation omitted); Pulte Home v. Simerly, 322 Ga. App.
699, 705-706 (3) (746 SE2d 173) (2013) (“It is well-settled that Georgia law allows
the adoption of a statute or regulation as a standard of conduct so that its violation
becomes negligence per se. OCGA § 51-1-6 authorizes a plaintiff to recover damages
for the breach of a legal duty even when that duty arises from a statute that does not
provide a private cause of action. OCGA § 51-1-6 does not create a legal duty but
defines a tort and authorizes damages when a legal duty is breached.”) (citation and
punctuation omitted); Rockefeller v. Kaiser Foundation Health Plan of Georgia, 251
Ga. App. 699, 702-703 (554 SE2d 623) (2001) (To determine whether the violation
of a statute is negligence per se “it is necessary to examine the purposes of the
legislation and decide (1) whether the injured person falls within the class of persons
it was intended to protect and (2) whether the harm complained of was the harm it
was intended to guard against.”) (citations, punctuation, and footnote omitted).
4
In his appellate brief, McConnell avers that “data privacy and tort law related
to disclosure of personal identifying information (‘PII’) is a new and emerging area

5
of law. It is rare to find a prior court opinion ‘on all fours’ with the facts of any given
information disclosure case. However, when one views the facts of this case in light
of general common-law principles of tort law, it is not difficult to see how and why
the law does and should recognize tort causes of action where a defendant discloses
PII without proper authorization or permission of the persons whose PII is disclosed.”
We note that a federal district court recently stated that “Georgia recognizes a general
duty to all the world not to subject them to an unreasonable risk of harm. . . . The
Court declines the Defendant’s invitation to hold that it had no legal duty to safeguard
information even though it had warnings that its data security was inadequate and
failed to heed them. To hold that no such duty existed would allow retailers to use
outdated security measures and turn a blind eye to the ever-increasing risk of cyber
attacks, leaving consumers with no recourse to recover damages even though the
retailer was in a superior position to safeguard the public from such a risk. . . .
Because this Court finds that a duty does exist, the [Defendant’s] motion to dismiss
[the Plaintiffs’ negligence claim] on the ground that there was no duty should also be
denied.” (Punctuation omitted.) In re: The Home Depot, Inc., Customer Data Security
Breach Litigation, Case No. 1:14-MD-2583-TWT, N. D. Ga., decided May 18, 2016
(2016 WL 2897520), citing Bradley Center Inc. v. Wessner, 250 Ga. 199 (296 SE2d
693) (1982). In Bradley Center Inc. v. Wessner, the Supreme Court of Georgia found
a legal duty “aris[ing] out of the general duty one owes to all the world not to subject
them to an unreasonable risk of harm. This has been expressed as follows: negligence
is conduct which falls below the standard established by law for the protection of
others against unreasonable risk of harm. Restatement, Torts, 2d, § 282.”
(Punctuation omitted.) 250 Ga. at 201. Despite the expansive language regarding a
general duty owed “to all the world” however, the issue presented in Bradley Center
Inc. v. Wessner was quite narrow: “whether an individual other than the patient can
recover for the alleged malpractice of the physician where that person is injured by
the criminal conduct of the patient and there is no privity between the injured party
and the physician.” 250 Ga. at 200. Noting that, “as a general rule, there is no duty
to control the conduct of third persons to prevent them from causing physical harm
to others[,]” the Supreme Court held that one of the exceptions to that rule applied
“because of the special relationship which existed between” the patient, who killed
his wife and her paramour while on a weekend pass from a psychiatric hospital, and
the physician, in a situation “where the course of treatment of a mental patient

6
McConnell contends that such a common law duty exists nonetheless, citing two

statutory sources, OCGA §§ 10-1-393.8 and 10-1-910. In OCGA § § 10-1-910, the

General Assembly set out legislative findings underlying the Georgia Personal

Identity Protection Act, OCGA §§ 10-1-910 through 10-1-915 (the “GPIPA”),

enacted in 2005.5 In the GPIPA, the General Assembly found, inter alia, that “[t]he

privacy and financial security of individuals is increasingly at risk, due to the ever

more widespread collection of personal information by both the private and public

involve[d] an exercise of control over him by a physician who knows or should know
that the patient is likely to cause bodily harm to others.” (Citations and punctuation
omitted.) Id. at 201-202. See also City of Rome v. Jordan, 263 Ga. 26, 28-29 (1) (426
SE2d 861) (1993) (citing Bradley Center Inc. v. Wessner in analyzing whether there
can be liability based on a municipality’s duty to protect the general public from
criminal conduct and holding that, “where there is a special relationship between the
individual and the municipality which sets the individual apart from the general
public and engenders a special duty owed to that individual, the municipality may be
subject to liability for the nonfeasance of its police department”) (footnote omitted;
emphasis in original); City of Douglas v. Hudson, 315 Ga. App. 20, 22-23 (726 SE2d
496) (2012) (accord). There is no evidence of any such special relationship in this
case. As for the recent federal case, In re: The Home Depot, Inc., Customer Data
Security Breach Litigation, we are not bound to follow the district court’s
interpretation of Georgia law. Moreover, the district court found a duty to protect the
personal information of the defendant’s customers in the context of allegations that
the defendant failed to implement reasonable security measures to combat a
substantial data security risk of which it had received multiple warnings dating back
several years and even took affirmative steps to stop its employees from fixing known
security deficiencies. There are no such allegations in this case.
5
See Ga. Laws 2007, p. 450 (Act 241), § 1 (for name designation).

7
sectors[,]” that ‘[i]dentity theft is one of the fastest growing crimes committed in this

state[,]” and that “[i]dentity theft is costly to the marketplace and to consumers[.]”

OCGA § 10-1-910 (1), (6). Because “[v]ictims of identity theft must act quickly to

minimize the damage[,] . . . expeditious notification of unauthorized acquisition and

possible misuse of a person’s personal information is imperative.” OCGA § 10-1-910

(7). In line with these findings, the GPIPA requires that affected persons be given

certain notice of a data breach.6 McConnell contends that in codifying these findings

the General Assembly demonstrated its intent to protect citizens from the adverse

effects of disclosure of personal information and created a general duty to preserve

and protect personal information. Notably, however, the GPIPA proscribes particular

conduct only after a (known or suspected) data security breach has occurred. Because

6
The GPIPA requires a government entity (as a “data collector”) “that
maintains computerized data that includes personal information of individuals” to
give prompt notice to affected Georgia residents of any security breach, that is,
acquisition of unencrypted personal information by any unauthorized person, and to
notify, without unreasonable delay, all consumer reporting agencies that compile and
maintain files on consumers on a nation-wide basis of the timing, distribution, and
content of the notices. OCGA §10-1-912. See OCGA § 10-1-911 (1) (definition of
a “breach of the security of the system”), (2) (definition of a “data collector”), (3)
(definition of “notice”). The GPIPA’s definition of “personal information” includes
an individual’s first and last name in combination with the person’s social security
number. OCGA § 10-1-911 (6). Another example is a person’s name in combination
with a credit or debit card number, if under the circumstances the number could be
used without a password or other information. Id.

8
the GPIPA does not impose any standard of conduct in implementing and maintaining

data security practices, it can not serve as the source of a statutory duty to safeguard

personal information. Wells Fargo Bank, N.A. v. Jenkins, 293 Ga. 162, 165 (744 SE2d

686) (2013).7

Similarly, we conclude that OCGA § 10-1-393.8, which is part of the Fair

Business Practices Act of 1975 (the “FBPA”) as amended,8 can not serve as the

source of such a statutory duty. That Code section provides that, except as otherwise

provided, “a person, firm, or corporation shall not: . . . [p]ublicly post or publicly

display in any manner an individual’s social security number. . . . ‘[P]ublicly post’ or

7
In Wells Fargo Bank, N.A. v. Jenkins, a bank customer based a claim of
negligence on the bank’s failure to protect his personal information and asserted that
the legal duty to support his negligence claim was found in the federal Gramm-Leach-
Bliley Act, the “GLBA,” 15 U. S. C. § 6801 et seq. The Supreme Court of Georgia
explained that, although the GLBA “expressly authorizes federal agencies . . . to
establish appropriate standards” for financial institutions “relating to administrative,
technical, and physical safeguards,” including safeguards “to protect against
unauthorized access to or use of [customers’] records or information which could
result in substantial harm or inconvenience to any customer,” see 15 U.S.C. § 6801
(a), such “an aspirational statement of Congressional policy” should not be “misread
. . . as establishing a legal duty, the alleged breach of which would give rise under the
law of this State to a cause of action for negligence against financial institutions.” 293
Ga. at 164-165.
8
OCGA § 10-1-390 (OCGA § 10-1-390 through 10-1-408 shall be known as
the “Fair Business Practices Act of 1975.”).

9
‘publicly display’ means to intentionally communicate or otherwise make available

to the general public[.]” OCGA § 10-1-393.8. As the trial court noted in the appealed

order, the FBPA expressly prohibits intentionally communicating a person’s social

security number, while McConnell alleges that the Department negligently

disseminated his SSN by failing “to take the necessary precautions required to

safeguard and protect the personal information from unauthorized disclosure.”

Although the FBPA imposes a standard of conduct to refrain from intentionally and

publicly posting or displaying SSNs,9 a legal duty to refrain from doing something

intentionally is not equivalent to a duty to exercise a degree of care to avoid doing

something unintentionally, which falls within the ambit of negligence. The trial court

9
The trial court questioned whether the Department is “a person, firm, or
corporation” subject to OCGA § 10-1-393.8. But the Department does not contend
that it is not subject to the statute. See OCGA §§ 10-1-392 (24) (For purposes of the
FBPA, including OCGA § 10-1-393.8, “‘[p]erson’ means a natural person,
corporation, trust, partnership, incorporated or unincorporated association, or any
other legal entity.”); 34-2-1 (“There is created and established a separate and
independent administrative agency to be known as the Department of Labor.”);
Foskey v. Vidalia City School, 258 Ga. App. 298, 301 (b) (574 SE2d 367) (2002)
(“When a governmental entity or quasi-public entity has independent legal status as
a public corporation, agency, or authority, the legislative act creating such
governmental entity generally confers one or more of the power and authority to
contract, hold property, eminent domain, or sue and be sued. The fact that a
governmental entity may have sovereign immunity from a tort action does not prevent
such entity from being a separate legal entity or an entity that may sue and be sued.”)
(citations omitted).

10
correctly concluded that McConnell’s complaint is premised on a duty of care to

safeguard personal information that has no source in Georgia statutory law or caselaw

and that his complaint therefore failed to state a claim of negligence. Diamond v.

Dept. of Transp., 326 Ga. App. 189, 195-196 (2) (756 SE2d 277) (2014).

Given the General Assembly’s stated concern about the cost of identity theft

to the marketplace and to consumers, as well as the fact that it created certain limited

duties with regard to personal information (e. g., the duty to notify affected persons

of data breaches and the duty not to intentionally communicate information such as

SSNs to the general public), it may seem surprising that our legislature has so far not

acted to establish a standard of conduct intended to protect the security of personal

information, as some other jurisdictions have done in connection with data protection

11
and data breach notification laws.10 It is beyond the scope of judicial authority,

10
See e.g. Ark. Code Ann. 4-110-104 (b) (In the Arkansas Personal
Information Protection Act: “A person or business that acquires, owns, or licenses
personal information about an Arkansas resident shall implement and maintain
reasonable security procedures and practices appropriate to the nature of the
information to protect the personal information from unauthorized access,
destruction, use, modification, or disclosure.”); Cal. Civ. Code § 1798.81.5 (In the
California Database Breach Act: “It is the intent of the Legislature to ensure that
personal information about California residents is protected. . . . A business that
owns, licenses, or maintains personal information about a California resident shall
implement and maintain reasonable security procedures and practices appropriate to
the nature of the information, to protect the personal information from unauthorized
access, destruction, use, modification, or disclosure.”); Fla. Stat. Ann. § 501.171 (2)
(“Each covered entity, governmental entity, or third-party agent shall take reasonable
measures to protect and secure data in electronic form containing personal
information.”); Md. Code Ann., Commercial Law § 14-3503 (In the Maryland
Personal Information Protection Act: “To protect personal information from
unauthorized access, use, modification, or disclosure, a business that owns or licenses
personal information of an individual residing in the State shall implement and
maintain reasonable security procedures and practices that are appropriate to the
nature of the personal information owned or licensed and the nature and size of the
business and its operations.”); Md. Code Ann., State Government § 10-1304 (“To
protect personal information from unauthorized access, use, modification, or
disclosure, a [state government] unit that collects personal information of an
individual shall implement and maintain reasonable security procedures and practices
that are appropriate to the nature of the personal information collected and the nature
of the unit and its operations.”); Nev. Rev. Stat. Ann. § 603A.210 (1) (“A data
collector that maintains records which contain personal information of a resident of
this State shall implement and maintain reasonable security measures to protect those
records from unauthorized access, acquisition, destruction, use, modification or
disclosure.”); Rhode Island Gen. Laws Ann. § 11-49.3-2 (a) (In the Rhode Island
Identity Theft Protection Act of 2015: “A municipal agency, state agency or person
that stores, collects, processes, maintains, acquires, uses, owns or licenses personal
information about a Rhode Island resident shall implement and maintain a risk-based

12
however, to move from aspirational statements of legislative policy to an affirmative

legislative enactment sufficient to create a legal duty.11

2. McConnell contends that the trial court erred in dismissing his breach of

fiduciary duty claim for failure to state a claim upon which relief can be granted

based on its determination that he had not shown that he had a particular relationship

of trust or mutual confidence with the Department. “Establishing a claim for breach

of fiduciary duty requires proof of three elements: (1) the existence of a fiduciary

information security program that contains reasonable security procedures and
practices appropriate to the size and scope of the organization; the nature of the
information; and the purpose for which the information was collected in order to
protect the personal information from unauthorized access, use, modification,
destruction, or disclosure and to preserve the confidentiality, integrity, and
availability of such information.”).
11
See Wells Fargo Bank, N.A. v. Jenkins, 293 Ga. at 165 (The judiciary must
not misread “an aspirational statement of legislative policy” as an affirmative
legislative enactment that establishes a legal duty, as that would usurp legislative
authority.); Blotner v. Doreika, 285 Ga. 481, 481-482 (1) (678 SE2d 80) (2009)
(Where a particular common law duty was not recognized in Georgia, the common
law rule could be changed only by legislative act.); Perdue v. Baker, 277 Ga. 1, 14
(586 SE2d 606) (2003) (“The core legislative function is the establishment of public
policy through the enactment of laws.”) (footnote omitted); Commonwealth Inv. Co.
v. Frye, 219 Ga. 498, 499 (2) (134 SE2d 39) (1963) (Our appellate courts’ “authority
extends only to the correction of errors of law, and we have no legislative powers or
functions. [T]he legislature, and not the courts, is empowered by the Constitution to
decide public policy, and to implement that policy by enacting laws; and the courts
are bound to follow such laws if constitutional.”) (citations and punctuation omitted).

13
duty; (2) breach of that duty; and (3) damage proximately caused by the breach.”

(Citation and punctuation omitted.) Wells Fargo Bank, N.A. v. Cook, 332 Ga. App.

834, 842 (1) (775 SE2d 199) (2015). “Any relationship shall be deemed confidential,

whether arising from nature, created by law, or resulting from contracts, where one

party is so situated as to exercise a controlling influence over the will, conduct, and

interest of another or where, from a similar relationship of mutual confidence, the law

requires the utmost good faith, such as the relationship between partners, principal

and agent, etc.” OCGA § 23-2-58.

McConnell argues that, because a fiduciary relationship, in addition to being

created by statute or contract, may also be created by the facts of a particular case, a

claim for breach of fiduciary duty is uniquely unsuitable for disposition via a motion

to dismiss, when the plaintiff has not been able to conduct discovery.12 In his

complaint, McConnell alleged that a fiduciary duty arose when the Department

required him to disclose confidential personal identification information in order to

obtain services or benefits from the Department and that he reasonably placed his

12
See Wright v. Apartment Investment & Mgmt. Co., 315 Ga. App. 587, 592 (2)
(726 SE2d 779) (2012) (“[S]ince a confidential relationship may be found whenever
one party is justified in reposing confidence in another, the existence of a confidential
or fiduciary relationship is generally a factual matter for the jury to resolve.”).

14
trust and confidence in the Department to safeguard and protect his information from

public disclosure. He contends that the Department was “so situated as to exercise a

controlling influence over . . . [his] interest” because, unless he provided his personal

information to the Department, he would not receive unemployment benefits,

resulting in a fiduciary relationship.

In a recent case, a bank employee gave a customer’s information to the

employee’s husband, which allowed her husband to steal the customer’s identity.

Jenkins v. Wachovia Bank, N.A., 314 Ga. App. 257 (724 SE2d 1) (2012), reversed in

part on other grounds sub nom. Wells Fargo Bank, N.A. v. Jenkins, 293 Ga. 162 (744

SE2d 686) (2013), and opinion vacated in part, 325 Ga. App. 376 (752 SE2d 633)

(2013). The customer sued the bank, asserting claims that the bank negligently failed

to protect his personal information, breached a duty of confidentiality, and invaded

his privacy. 314 Ga. App. at 257. The customer alleged that the bank “falsely

represented to its customers and members of the general public that it created and

implemented a system to adequately protect the private and personal identifying

information entrusted to it by its customers[.]” Id. Noting that the bank-customer

relationship generally is not a confidential relationship under Georgia law, this Court

held that the plaintiff had not pled “any special circumstances showing that he had a

15
particular relationship of trust or mutual confidence with [the bank].” Id. at 262 (2).13

ln other words, the fact that the plaintiff gave the bank his personal information to

receive services, and the bank promised to protect this information, did not create a

confidential relationship under Georgia law. Likewise, in alleging in this case that he

gave the Department his personal information as a prerequisite to receiving services,

with the expectation that the Department would protect his information, McConnell

failed to assert in his complaint facts showing that the Department owed him a

confidential duty to protect that information. Id. at 261-262 (2).14

13
See Jenkins v. Wachovia Bank, N.A., 325 Ga. App. 376, 377 (752 SE2d 633)
(2013) (Because the Supreme Court in Wells Fargo Bank, N.A. v. Jenkins, 293 Ga.
162 (744 SE2d 686) (2013), did not address or consider Division 2 of our earlier
opinion in Jenkins v. Wachovia Bank, N.A., 314 Ga. App. 257 (724 SE2d 1) (2012),
and because that portion of our earlier opinion was consistent with the Supreme
Court’s opinion, that division remains binding.).
14
Cf. Daly v. Metropolitan Life Ins. Co., 4 Misc. 3d 887, 892 (782 NYS2d 530,
535) (N. Y. Sup. Ct. 2004) (When the plaintiff wished to purchase a life insurance
policy from the defendant, she was required to, and agreed to supply the company
with highly sensitive personal information including her full name, her social security
number, and her date of birth. The trial court concluded that, under New York law,
there was in this agreement an implied covenant of trust and confidence that the
defendant would safeguard and protect the plaintiff’s personal information, as
evidenced by the defendant’s privacy notice to its customers stating that they took
great care in safeguarding customers’ personal information. The court noted, “[w]hile
this concept has never before been applied to issues surrounding the protection of
confidential personal information, perhaps in the absence of appropriate legislative
action, it should.”).

16
 3. McConnell contends that the trial court erred in ruling that he failed to state

a claim upon which relief can be granted for invasion of privacy, public disclosure

of private facts, based, inter alia, on its determination that the elements of that tort

cannot be satisfied unless the facts at issue are embarrassing private facts. McConnell

argues that

Georgia law recognizes a variety of information as private and not
subject to public disclosure, including certain financial and banking
records, medical records, certain police records (particularly records of
juvenile crime) and records related to status as a victim of a crime
(particularly sexual assault). The law recognizes a claim for
unauthorized disclosure of private information in these circumstances.

Under Georgia law,

there are four disparate torts under the common name of invasion of
privacy. These four torts may be described briefly as: (1) intrusion upon
the plaintiff’s seclusion or solitude, or into his private affairs; (2) public
disclosure of embarrassing private facts about the plaintiff; (3) publicity
which places the plaintiff in a false light in the public eye; and (4)
appropriation, for the defendant’s advantage, of the plaintiff’s name or
likeness.

17
(Citation and punctuation omitted.) Bullard v. MRA Holding, LLC, 292 Ga. 748, 751-

752 (2) (740 SE2d 622) (2013). There are at least three necessary elements for

recovery for

[p]ublic disclosure of embarrassing private facts about the plaintiff[,] .
. . : (a) the disclosure of private facts must be a public disclosure; (b) the
facts disclosed to the public must be private, secluded or secret facts and
not public ones; (c) the matter made public must be offensive and
objectionable to a reasonable man of ordinary sensibilities under the
circumstances.

Cabaniss v. Hipsley, 114 Ga. App. 367, 372 (2) (151 SE2d 496) (1966). See also

Thomason v. Times-Journal, 190 Ga. App. 601, 604 (4) (379 SE2d 551) (1989)

(accord).

In Cumberland Contractors, Inc. v. State Bank & Trust Co., the plaintiffs

claimed that the defendant bank’s publication of their social security numbers could

result in identify theft, credit card fraud, and other offenses that might damage them

personally and financially. We held that such allegations

do not fall within the causes of action for invasion of privacy because
there is no allegation that [the defendant] (1) intruded into the
[plaintiffs’] seclusion, (2) disclosed embarrassing private facts, (3)
depicted the [plaintiffs] in a false light, or (4) appropriated the
[plaintiffs’] name or likeness for [the defendant’s] own advantage.

18
Cumberland Contractors, Inc. v. State Bank & Trust Co., 327 Ga. App. 121, 126 (2)

(a) (755 SE2d 511) (2014). As a result, we held, the trial court properly dismissed the

plaintiffs’ claim for invasion of privacy for failure to state a claim for relief under

Georgia law. Id. The trial court in this case properly dismissed McConnell’s invasion

of privacy claim for the same reason. Id.; Jenkins v. Wachovia Bank, N.A., 314 Ga.

App. at 262-263 (3)15; Cabaniss v. Hipsley, 114 Ga. App. at 372 (2).

Judgment affirmed. Branch and Mercier, JJ., concur.

15
See Jenkins v. Wachovia Bank, N.A., 325 Ga. App. 376, 377 (752 SE2d 633)
(2013) (Because the Supreme Court in Wells Fargo Bank, N.A. v. Jenkins, 293 Ga.
162 (744 SE2d 686) (2013), did not address or consider Division 3 of our earlier
opinion in Jenkins v. Wachovia Bank, N.A., 314 Ga. App. 257 (724 SE2d 1) (2012),
and because that portion of our earlier opinion was consistent with the Supreme
Court’s opinion, that division remains binding.).

19