NOTICE: All slip opinions and orders are subject to formal
revision and are superseded by the advance sheets and bound
volumes of the Official Reports. If you find a typographical
error or other formal error, please notify the Reporter of
Decisions, Supreme Judicial Court, John Adams Courthouse, 1
Pemberton Square, Suite 2500, Boston, MA, 02108-1750; (617) 557-
1030; SJCReporter@sjc.state.ma.us
15-P-452 Appeals Court
MARK ADAMS vs. CONGRESS AUTO INSURANCE AGENCY, INC.
No. 15-P-452.
Middlesex. March 10, 2016. - December 21, 2016.
Present: Kafker, C.J., Vuono, & Henry, JJ.
Negligence, Insurance company, Employer, Foreseeability of harm,
Causation, Retention of employee, Entrustment, Emotional
distress. Damages, Emotional distress. Consumer
Protection Act, Responsibility of employer. Practice,
Civil, Summary judgment, Motion to amend.
Civil action commenced in the Superior Court Department on
April 16, 2013.
Motions for summary judgment and to amend the complaint
were heard by Peter B. Krupp, J.
Henry P. Sorett for the plaintiff.
Jeffrey S. Robbins for the defendant.
HENRY, J. This case arose from an employee's improper use
of confidential information accessed through her workplace
computer. The employee gave that information to her boy friend,
who used it to intimidate a witness, Mark Adams. Adams brought
2
this action against the employer, Congress Auto Insurance
Agency, Inc. (Congress Agency or agency). A Superior Court
judge dismissed four of his five claims. The case proceeded to
discovery on the remaining claim against the agency that alleged
negligent failure to safeguard Adams's personal information.
The same judge subsequently granted the agency's motion for
summary judgment on the remaining count and in the same
memorandum and order denied Adams's motion to amend his
complaint to reinstate the dismissed claims and to add a claim
for violation of 18 U.S.C. §§ 2721-2725. Adams appealed. We
affirm in part and reverse in part.
1. Summary judgment. "The standard of review of a grant
of summary judgment is whether, viewing the evidence in the
light most favorable to the nonmoving party, all material facts
have been established and the moving party is entitled to
judgment as a matter of law." Lev v. Beverly Enterprises-
Massachusetts, Inc., 457 Mass. 234, 237 (2010) (Lev), quoting
from Cargill, Inc. v. Beaver Coal & Oil Co., 424 Mass. 356, 358
(1997). The burden rests on the defendant, as the moving party,
to affirmatively demonstrate the absence of a genuine issue of
material fact on every relevant issue. Ibid.
a. Facts. Viewed in the light most favorable to Adams, as
required at this stage of the proceedings, the summary judgment
record discloses the following facts. The Congress Agency hired
3
Elizabeth Burgos in August, 2003, as a customer service
representative, promoting her to customer service manager in
2010. Burgos, through her work computer, had access to the data
systems of Safety Insurance Company (Safety), and, through
Safety's internet portal, to records maintained by the Registry
of Motor Vehicles (RMV). Safety insures Burgos's vehicle.
In 2010, the Congress Agency, by its president and owner,
Gordon Owades, drafted a data security plan for ensuring the
protection of personal information of the residents of the
Commonwealth. Owades trained all agents, including Burgos, on
the data security policies. One company policy prohibited
employees from accessing or using a driver's personal
information, obtained in the course of the employee's work, for
personal purposes. In addition, each time a Congress Agency
employee wished to access the RMV database through the Safety
portal, Safety required the agent to affirmatively agree to use
the information obtained for one of four limited purposes:
claims investigation activities, anti-fraud activities, rating,
and underwriting.1
On July 13, 2012, Burgos's boy friend, Daniel Thomas,
engaged in a high-speed flight from police while driving
1
Safety referenced the provisions of the Federal Drivers
Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721-2725, and
warned agents about the consequences of the improper use of
personal information obtained from the RMV's records.
4
Burgos's Mercedes automobile. At that time, Thomas was on
supervised release for a Federal firearm violation, and was
driving without a valid license. During his flight, Thomas
struck a vehicle operated by the plaintiff, Mark Adams. Thomas
abandoned the Mercedes and fled.
On July 24, 2012, Adams, who had filed a claim against
Burgos's automobile policy, gave a statement to a Safety claims
adjuster investigating the accident. He informed the adjuster
that he could identify the driver of the Mercedes and provided
his contact information, including his cell phone number and
home address.
Meanwhile, Burgos reported her vehicle stolen to the
police, and subsequently filed her own insurance claim for the
loss with Safety. Burgos, using her access to confidential data
through the agency, obtained information about her own claim,
and learned Adams's identity as the individual who had filed a
claim against her Safety insurance policy and his contact
information. The next day, Adams received a threating telephone
call from Thomas.2 Adams immediately reported the threat to the
authorities.
2
Thomas claimed to be a Massachusetts State police officer.
Thomas told Adams that the driver of the car that struck his was
a "very, very dangerous man with very dangerous friends."
Thomas warned Adams to "do [himself] a favor. Shut the F up and
get your car fixed or you will have issues."
5
The Massachusetts State police visited the agency's office
on August 28, 2012; Burgos refused to speak with them. The
Congress Agency continued to provide Burgos access to the Safety
databases and to the RMV records. On December 13, 2012, Owades
terminated Burgos for "her serious misuse of access to
confidential information."
On January 9, 2013, in the Boston Municipal Court (BMC),
Burgos and Thomas admitted to sufficient facts and pleaded
guilty to witness intimidation and conspiracy in connection with
the threat made to Adams. In particular, Burgos admitted that
she had used her position at the agency to obtain Adams's date
of birth, address, and cell phone number.
Discovery in this matter provided additional information
about an earlier incident when Burgos engaged in criminal
behavior with, or to protect, her boy friend. Specifically, on
June 19, 2010, while Thomas and Burgos were driving cross
country, the Iowa State police stopped the vehicle for speeding.
In the vehicle the police discovered two loaded semi-automatic
firearms concealed in Burgos's purse, ammunition, a receipt for
the purchase of additional ammunition in Burgos's day book, a
half-face mask, and a police scanner. One handgun was stolen;
the other had its serial number defaced. Thomas claimed he knew
nothing about the weapons and ammunition, while Burgos admitted
to the police that they were hers. Burgos and Thomas were
6
arrested and eventually indicted for possession of a firearm
with an obliterated serial number.
After Burgos was released on bail, she returned to
Massachusetts and continued to work at the Congress Agency. On
October 21, 2010, the United States Marshals Service arrested
Burgos at the agency's office. The office manager notified
Owades of Burgos's arrest. Upon her return to work four days
later, Burgos explained to Owades that there was "a
misunderstanding as to who was in possession of the firearm at
the time of the incident in Iowa;" the gun belonged to her boy
friend; she did not know it was present in the vehicle prior to
its discovery by the police; its presence was frankly a "shock"
to her; "ultimately, she would be exonerated"; and "[the
misunderstanding] was not going to affect her ability to work."
Burgos informed Owades that Thomas went to jail. Owades
conducted no independent investigation into the circumstances of
her arrest because he "did not at the time think it was germane
to her employment."
Burgos subsequently told Owades that she had some legal
"arrangement" with the authorities that would last a year.3 At
3
Burgos entered into an agreement with the United States
Attorney for the Southern District of Iowa to participate in the
pretrial diversion program, an alternative to criminal
prosecution. As a condition of participation in the diversion
program, an offender is not asked to admit guilt, but must
acknowledge responsibility for the behavior.
7
the end of that time period, Burgos informed Owades that the
matter was resolved. In fact, following her completion of the
diversion program, the United States Attorney dismissed the
indictment on May 24, 2012.4 Approximately seven weeks later,
Thomas struck Adams's vehicle.
b. Discussion. A plaintiff must prove four elements in
order to prevail on a negligence claim: (1) duty; (2) breach of
duty; (3) a causal connection between the breach of duty and
damages; and (4) damages. See Jupin v. Kask, 447 Mass. 141, 146
(2006). In its motion for summary judgment, the agency
challenged Adams's ability to satisfy each of these elements of
the tort of negligent failure to safeguard personal information.
The motion judge agreed, ruling that expert testimony was
required to establish whether the agency owed a duty to Adams to
safeguard his personal information, what that duty entailed, and
whether the agency breached that duty. The motion judge also
found that Adams was unable to prove that the agency's
negligence was the proximate cause of injury to Adams.
The existence of a legal duty is a question of law
determined "by reference to existing social values and customs
and appropriate social policy." See id. at 143, quoting from
4
Thomas pleaded guilty to the Federal weapon charge, and
was sentenced to prison followed by supervised release.
8
Cremins v. Clancy, 415 Mass. 289, 292 (1993). The other three
elements ordinarily are questions of fact for the jury. See id.
at 146.
i. Legal duty. As a general rule, a party has no duty to
control another person's conduct to prevent that person from
causing harm to a third person. See Leavitt v. Brockton Hosp.,
Inc., 454 Mass. 37, 40-41 (2009) (Leavitt). Well-established
exceptions to that rule are recognized in the employment
context. At common law, an employer owed the duty to exercise
reasonable care in the selection and retention of employees that
have contact with members of the public. See Carson v. Canning,
180 Mass. 461, 462 (1902); Foster v. The Loft, Inc., 26 Mass.
App. Ct. 289, 290-291 (1988) (Foster). More recently, courts
have recognized a potential duty of care owed by employers where
the employment facilitates the employee's causing harm to third
parties. See Restatement (Third) of Torts: Liability for
Physical and Emotional Harm § 41 (2012). See also Leavitt,
supra at 41 & n.10; Lev, 457 Mass. at 242-244; Roe No. 1 v.
Children's Hosp. Med. Center, 469 Mass. 710, 714 & n.7 (2014);
Doe v. Boston Med. Center Corp., 88 Mass. App. Ct. 289, 291
(2015).
In deciding whether a special relationship exists between a
particular plaintiff and defendant, our foremost consideration
is whether "a defendant reasonably could foresee that he would
9
be expected to take affirmative action to protect the plaintiff
and could anticipate harm to the plaintiff from the failure to
do so." Irwin v. Ware, 392 Mass. 745, 756 (1984). "All the
circumstances are examined in defining the scope of a duty of
care based on the reasonable foreseeability of harm." Whittaker
v. Saraceno, 418 Mass. 196, 199 (1994).
In the circumstances of this case, we conclude that the
agency had a legal duty to Adams, a member of a large but
clearly defined class of third parties, to prevent its
employee's foreseeable misuse of the information that Adams
provided to process his automobile insurance claim.5
ii. Breach of duty. We hold that a jury reasonably could
find that the Congress Agency breached its legal duty to Adams
under two possible theories: the conflict of interest inherent
5
In fact, the Legislature has established statutory and
regulatory duties to take adequate measures to safeguard the
confidentiality of the personal information of all Massachusetts
residents. See G. L. c. 93H, § 2(a), added by St. 2007, c. 82,
§ 16 and 201 Code Mass. Regs. §§ 17.00 - 17.05 (2009) (standards
for the protection of the personal information of residents of
the Commonwealth). "Personal information" is defined as "a
resident's first name and last name or first initial and last
name in combination with any [one] or more of the following data
elements that relate to such resident: (a) Social Security
number; (b) driver's license number or state-issued
identification card number; or (c) financial account number, or
credit or debit card number, with or without any required
security code, access code, personal identification number or
password, that would permit access to a resident's financial
account." G. L. c. 93H, § 1(a). See also 201 Code Mass. Regs.
§ 17.02.
10
in allowing Burgos unrestricted access to information relating
to a claim against her own insurance policy; and the failure to
investigate Burgos's continuing fitness for access to the
confidential information of others available through her
employment.
First, a jury reasonably could find that the agency
breached its duty to protect the confidential information
entrusted to it or Safety by failing to prevent a conflict of
interest that arises from its employees having unrestricted
access to their own claim information. In this case, Burgos was
able to retrieve information about the pending claim by Adams
against her policy, including the notes from the Safety claims
adjuster that contained Adams's identity and contact
information. Allowing employees to access the confidential
information of claimants against them during the adjustment
process potentially creates a conflict of interest, and a jury
reasonably could find the agency negligent without the necessity
of expert testimony. See Herbert A. Sullivan, Inc. v. Utica
Mut. Ins. Co., 439 Mass. 387, 402-403 (2003) ("The test for
determining whether a particular matter is a proper one for
expert testimony is whether the testimony will assist the jury
in understanding issues of fact beyond their common
experience").
11
Second, a jury could find that the Congress Agency was
negligent when it accepted Burgos's version of her criminal
involvement in the Federal firearms indictment without
independent investigation. An employer may be held liable for
negligence if it "becomes aware or should have become aware of
problems with an employee that indicated [her] unfitness, and
the employer fails to take further action such as investigating,
discharge or reassignment." Foster supra at 291, quoting from
Garcia v. Duffy, 492 So.2d 435, 438-439 (Fla. Dist. Ct. App.
1986). The scope of an employer's duty to undertake prudent
investigation into the fitness of an employee "is directly
related to the severity of risk third parties are subjected to
by [the] employee." Heng Or v. Edwards, 62 Mass. App. Ct. 475,
488 (2004) (Heng Or), quoting from Ponticas v. K.M.S. Invs., 331
N.W.2d 907 (Minn. 1983).6
Here, the access to confidential personal information of
the citizens of the Commonwealth and others inherent in Burgos's
employment heightened the potential risk that she posted to
third parties. Just as those with physical keys to the homes of
6
An employer's knowledge of an employee's past conviction
of the same or similar crime is one circumstance that may
support liability for negligent hiring or retention. See Foster
supra at 294-295 & n.7. Where the crimes are entirely
unrelated, however, such as a conviction of larceny by check
followed by a rape of a customer, the employee's criminal
record, standing alone, would not establish negligence. See id.
at 294 n.7.
12
others have a duty of reasonable care to preserve their
security, companies whose employees have access to the
confidential data of others have a duty to take reasonable
measures to protect against the misuse of that data. Reviewing
the record in the light most favorable to Adams, as we must at
this stage, if the Congress Agency had investigated, it could
have discovered facts that called into question Burgos's honesty
and fitness for access to other people's personal information.
An investigation by the agency could have revealed that Burgos
was not forthright with Odwades, that at a minimum she had been
involved with illegal firearms, and that she either concealed
her own involvement or lied at her own peril to protect her boy
friend. A jury could find that these facts would have placed
the agency on notice that its employee was sufficiently
untruthful as to merit further consideration of whether she
should continue to have access to databases containing
confidential information.
In reaching this conclusion, we consider Heng Or, supra, to
be particularly instructive. In Heng Or, the defendant, the
owner of an apartment building, gave several apartment keys to a
handyman, Vao Sok. See id. at 479-480. At the time of the
entrustment, the defendant knew that Sok was a jobless, homeless
drifter with addiction problems. See id. at 482. Without
further inquiry, the defendant accepted Sok's inaccurate report
13
of his legal troubles. See id. at 481. The defendant could
have learned that Sok had an uncontrollable temper; tenants in
the building feared him and would not leave their children alone
with him; and, prior to the time Edwards entrusted Sok with the
keys, that Sok stood indicted for kidnapping and raping a young
girl. See id. at 481-482. Sok raped and asphyxiated a young
child in one of the apartments to which the keys gave him
access. On this evidence, this court concluded the defendant
was fairly found liable in negligence for hiring and entrusting
the keys to an unfit individual. See id. at 476. The court
also concluded that the jury was warranted in finding that the
violent attack fell within the range of reasonably foreseeable
harms created by the failure to make due inquiries about Sok in
combination with the entrustment of keys. See id. at 487-488.
It is a question for a jury whether, based on the
information it knew or could have known at the time, the agency
should have continued to allow Burgos continued access to
confidential information.
iii. Proximate cause. The motion judge concluded that the
Congress Agency was entitled to summary judgment based on the
intervening, superseding criminal acts of Burgos and Thomas.7 We
7
The agency's argument that Adams has waived this point is
unpersuasive. Adams did in fact address the judge's ruling on
causation in his brief. Although Adams did not address the
judge's footnote disposition of the element of harm as matter of
14
disagree. The necessary causal connection may be found "[if]
the injury to the plaintiff was a foreseeable result of the
defendant's negligent conduct." Kent v. Commonwealth, 437 Mass.
312, 320 (2002). "Where the intervening occurrence was
foreseeable by a defendant, the causal chain of events remains
intact and the original negligence remains a proximate cause [of
the plaintiff's injury]."8 Zinck v. Gateway Country Store, Inc.,
72 Mass. App. Ct. 571, 578 (2008), quoting from Delaney v.
Reynolds, 63 Mass. App. Ct. 239, 242 (2005).
The intervening acts of Burgos here were not so improbable
as to remove the foreseeability question from the special
province of the jury. See id. at 578-579. Nor was the harm
sustained by Adams so "highly extraordinary" as to relieve the
agency of liability. Id. at 578, quoting from Heng Or, supra at
486. A jury could conclude that the Congress Agency was put on
notice that Burgos should not have been entrusted with access to
law, we decline to apply a strict rule of waiver where the
ground did not support the entry of summary judgment as the
agency maintains, and the cases relied upon by it to support
waiver are distinguishable in material respect.
8
A separate theory of liability arising from the agency's
failure to report Burgos's arrest to the Division of Insurance
in violation of G. L. c. 175, § 162V(b) was inadequately argued
and thus waived. See Mass.R.A.P. 16(a)(4), as amended, 428
Mass. 1603 (1999); Electronic Data Sys. Corp. v. Attorney Gen.,
454 Mass. 63, 65 n.5 (2009). In any event, it is far from clear
that the statute applied in this case where Burgos entered into
a diversion agreement in lieu of prosecution.
15
the confidential information of others, especially where that
information could involve a claim against her or her boy friend.
The agency knew of the weapons charge and it could have learned
of Burgos's misrepresentation about that charge to Owades, that
the weapons charge involved concealment and possible violence,
and of Burgos's willingness to commit a crime with, or to
protect, her boy friend.
The Congress Agency's reliance on Coughlin v. Titus & Bean
Graphics, Inc., 54 Mass. App. Ct. 633 (2002) (Coughlin), to show
the absence of negligence is misplaced, as it is distinguishable
on the facts. In that case, the employer, a small company in
the business of manufacturing signs, took a chance by hiring
Michael Kelley, a released sexually dangerous person with a long
criminal record. See Id. at 636-637. At the time of hiring,
the employer knew Kelley had been incarcerated for fourteen
years for committing a violent crime. See id. at 637. The
employer placed precautionary limitations on the position; it
assigned Kelley to work alone in a warehouse away from contact
with its customers and other employees and did not provide him
with keys to the warehouse. See id. at 637 & n.6. A background
check would have revealed favorable professional opinions
supporting Kelley's parole. See id. at 640 & n.9. Four days
into his employment, Kelley, who had a set of keys in his
possession, lured a passerby into the warehouse and murdered her
16
before his scheduled shift. See id. at 637-638. In contrast to
this case, Coughlin is a case where the employer assessed the
risk and took significant steps to limit risk of harm to others.
Here, as there was a genuine issue of material fact on the
question of foreseeability, summary judgment was inappropriate.9
iv. Damages. The Congress Agency's argument that Adams's
proof of emotional distress damages was inadequate suffered from
the same infirmity as the judge's analysis: it was based on an
improper view of the facts more favorable to the agency than
warranted by the summary judgment record.
The facts contained within the summary judgment record
contain sufficient evidence of Adams's worsening physical
symptoms to warrant the submission of the claim to the jury.
See Sullivan v. Boston Gas Co., 414 Mass. 129, 137-140 (1993).
While Adams admitted that he had longstanding emotional and
sleep problems, he claimed that they worsened over time
following Thomas's threat. On February 14, 2013, shortly after
the BMC plea hearing, Dr. Andrew Lenhardt, Adams's primary care
physician, first prescribed Temazepam, a medication used for
sleep problems related to psychological reasons, for Adams.
9
We do, however, conclude that Adams's theory that the
agency should have instituted an employee keystroke monitoring
program similar to Safety's was properly dismissed due to the
lack of expert testimony on industry standards and of any
triable issue of proximate causation. See Hebert v. Enos, 60
Mass. App. Ct. 817, 820-822 (2004).
17
There was also expert testimony submitted by Adams from Dr.
Stephanie Sydney, a licensed clinical psychologist, that Adams's
trauma symptoms included repeated nightmares about the phone
call (that could not have predated it), high anxiety, intrusive
thoughts, racing hot flushes, and feelings of detachment.
2. Denial of motion to amend.10 After discovering that the
Congress Agency had actual knowledge of Burgos's 2010 arrest,
Adams moved to amend his complaint, seeking to revive the four
dismissed claims and to add a new Federal law claim. The
specific factual allegations in the proposed amended complaint
would have supported a claim for negligent retention and
supervision if included in the original complaint. Here, our
conclusion that summary judgment should not have entered
obviates much of the judge's reasoning for the denial of the
motion to amend. Given our conclusion that the agency owed a
legal duty to Adams, the denial of Adams's motion to amend on
10
To the extent the agency challenges the adequacy of the
record, the supplemental appendix permits us to conduct a
meaningful review. We reach the merits.
18
the grounds of futility is rendered moot.11 See Lipsitt v.
Plaud, 466 Mass. 240, 254-255 (2013).12
However, we discern no abuse of discretion with respect to
the judgment on the remaining common law and statutory claims.
See North Am. Expositions Co. Ltd. Partnership v. Corcoran, 452
Mass. 852, 871-872 (2009). As to these claims, the first
amended complaint, like the original complaint, contained
insufficient factual allegations to plausibly suggest
entitlement to relief. See Jessie v. Boynton, 372 Mass. 293,
295 (1977); Iannacchino v. Ford Motor Co., 451 Mass. 623, 636
(2008) (Iannacchino).
Specifically as to Adams's G. L. c. 93A claim, to the
extent it was predicated on negligence alone, it necessarily
failed. See Klairmont v. Gainsboro Restaurant, Inc., 465 Mass.
165, 176-177 (2013) (Klairmont) ("in the absence of conduct that
qualifies as unfair or deceptive, a negligent act or negligent
acts, alone, do not violate [G. L.] c. 93A"). The other alleged
basis for c. 93A relief was the agency's failure "to meet the
11
The judge noted that Adams's motion to amend his
complaint "might be considered unduly delayed or dilatory" but
found the futility of the amendment to be determinative. As
the motion was not decided based on delay, we do not address the
issue here.
12
In light of our resolution of Adams's challenge to the
order denying his motion to amend that sought to reinstate the
dismissed claims, see infra at - , we need not review
the order allowing the motion to dismiss those claims.
19
Commonwealth's standards regarding the protection of
confidential personal information for residents of the
Commonwealth." In certain circumstances, a statutory or
regulatory violation may rise to the level of an unfair or
deceptive act or practice for purposes of a c. 93A claim. See
Klairmont, supra at 173-177. The "standards" to which Adams
refers in his proposed amended complaint are not identified. To
the extent that the claim was based on the agency's alleged
violations of G. L. c. 93H and the regulations promulgated
thereunder, we conclude, as did the motion judge, that the claim
was factually insufficient. See G. L. c. 93H, §§ 1-6, added by
St. 2007, c. 82, § 16 (governing data breaches) and 201 Code
Mass. Regs. §§ 17.00-17.05 (standards for the protection of the
personal information of residents of the Commonwealth).
As the motion judge noted, the complaint did not allege
that Burgos accessed "personal information" as that term is
specially defined in c. 93H, and did not identify the required
safeguards and procedures that the agency failed to employ.13
See 201 Code Mass. Regs. §§ 17.03 (standards for protecting
personal information) and 17.04 (computer system security
requirements). Compare the much more specific allegations of
government safety standard noncompliance found insufficient in
Iannacchino, supra at 626-633. As Adams had not alleged
13
See footnote 5, supra.
20
sufficient facts to state a plausible c. 93A claim on any
theory, we discern no abuse of discretion in the denial of so
much of the motion seeking to reinstate count V.14
Conclusion. The order allowing the agency's motion for
summary judgment with respect to count IV is vacated. The order
denying Adams's motion to amend his complaint is vacated with
respect to counts II and III of the proposed first amended
complaint and is otherwise affirmed. The case is remanded for
further proceedings consistent with this opinion.
So ordered.
14
In addition to the defective pleading, Adams's one new
claim for violation of DPPA failed for the added reason that the
agency, as matter of law, could not be held vicariously liable
for the tortious acts of Burgos. Her improper disclosure of
that information to Thomas and its use in a criminal conspiracy
were plainly acts committed outside the scope of her employment.
See Lev, supra at 238-239. The fact that plaintiff shifted his
theories of liability repeatedly may have contributed to the
result below. This loss in the trial court and delay in
resolution of the matter should be a cautionary note for such
strategy.