Adams v. Cong. Auto Ins. Agency, Inc.

• Citation: 65 N.E.3d 1229,90 Mass.App.Ct. 761
• Decision Date: 21 December 2016
• Docket Number: No. 15–P–452.,15–P–452.
• Parties: Mark ADAMS v. CONGRESS AUTO INSURANCE AGENCY, INC.
• Court: Appeals Court of Massachusetts

90 Mass.App.Ct. 761

65 N.E.3d 1229

Mark ADAMS

v.CONGRESS AUTO INSURANCE AGENCY, INC.

No. 15–P–452.

Appeals Court of Massachusetts, Middlesex.

Argued March 10, 2016.

Decided Dec. 21, 2016.

Henry P. Sorett, Boston, for the plaintiff.

Jeffrey S. Robbins, Boston, for the defendant.

Present: KAFKER, C.J., VUONO, & HENRY, JJ.

HENRY, J.

This case arose from an employee's improper use of confidential information accessed through her workplace computer.

The employee gave that information to her boy friend, who used it to intimidate a witness, Mark Adams. Adams brought this action against the employer, Congress Auto Insurance Agency, Inc. (Congress Agency or agency). A Superior Court judge dismissed four of his five claims. The case proceeded to discovery on the remaining claim against the agency that alleged negligent failure to safeguard Adams's personal information. The same judge subsequently granted the agency's motion for summary judgment on the remaining count and in the same memorandum and order denied Adams's motion to amend his complaint to reinstate the dismissed claims and to add a claim for violation of 18 U.S.C. §§ 2721 –2725. ADAMS APPEALED. WE AFFIRM IN PART AND REVERSE IN PART.

1. Summary judgment. "The standard of review of a grant of summary judgment is whether, viewing the evidence in the light most favorable to the nonmoving party, all material facts have been established and the moving party is entitled to judgment as a matter of law." Lev v. Beverly Enterprises–Massachusetts, Inc., 457 Mass. 234, 237, 929 N.E.2d 303 (2010) (Lev ), quoting from Cargill, Inc. v. Beaver Coal & Oil Co., 424 Mass. 356, 358, 676 N.E.2d 815 (1997). The burden rests on the defendant, as the moving party, to affirmatively demonstrate the absence of a genuine issue of material fact on every relevant issue. Ibid.

a. Facts. Viewed in the light most favorable to Adams, as required at this stage of the proceedings, the summary judgment record discloses the following facts. The Congress Agency hired Elizabeth Burgos in August, 2003, as a customer service representative, promoting her to customer service manager in 2010. Burgos, through her work computer, had access to the data systems of Safety Insurance Company (Safety), and, through Safety's internet portal, to records maintained by the Registry of Motor Vehicles (RMV). Safety insures Burgos's vehicle.

In 2010, the Congress Agency, by its president and owner, Gordon Owades, drafted a data security plan for ensuring the protection of personal information of the residents of the Commonwealth. Owades trained all agents, including Burgos, on the data security policies. One company policy prohibited employees from accessing or using a driver's personal information, obtained in the course of the employee's work, for personal purposes. In addition, each time a Congress Agency employee wished to access the RMV database through the Safety portal, Safety required the agent to affirmatively agree to use the information obtained for one of four limited purposes: claims investigation activities, anti-fraud activities, rating, and underwriting.¹

On July 13, 2012, Burgos's boy friend, Daniel Thomas, engaged in a high-speed flight from police while driving Burgos's Mercedes automobile. At that time, Thomas was on supervised release for a Federal firearm violation, and was driving without a valid license. During his flight, Thomas struck a vehicle operated by the plaintiff, Mark Adams. Thomas abandoned the Mercedes and fled.

On July 24, 2012, Adams, who had filed a claim against Burgos's automobile policy, gave a statement to a Safety claims adjuster investigating the accident. He informed the adjuster that he could identify the driver of the Mercedes and provided his contact information, including his cell phone number and home address.

Meanwhile, Burgos reported her vehicle stolen to the police, and subsequently filed her own insurance claim for the loss with Safety. Burgos, using her access to confidential data through the agency, obtained information about her own claim, and learned Adams's identity as the individual who had filed a claim against her Safety insurance policy and his contact information. The next day, Adams received a threatening telephone call from Thomas.² Adams immediately reported the threat to the authorities.

The Massachusetts State police visited the agency's office on August 28, 2012; Burgos refused to speak with them. The Congress Agency continued to provide Burgos access to the Safety databases and to the RMV records. On December 13, 2012, Owades terminated Burgos for "her serious misuse of access to confidential information."

On January 9, 2013, in the Boston Municipal Court (BMC), Burgos and Thomas admitted to sufficient facts and pleaded guilty to witness intimidation and conspiracy in connection with the threat made to Adams. In particular, Burgos admitted that she had used her position at the agency to obtain Adams's date of birth, address, and cell phone number.

Discovery in this matter provided additional information about an earlier incident when Burgos engaged in criminal behavior with, or to protect, her boy friend. Specifically, on June 19, 2010, while Thomas and Burgos were driving cross country, the Iowa State police stopped the vehicle for speeding. In the vehicle the police discovered two loaded semi-automatic firearms concealed in Burgos's purse, ammunition, a receipt for the purchase of additional ammunition in Burgos's day book, a half-face mask, and a police scanner. One handgun was stolen; the other had its serial number defaced. Thomas claimed he knew nothing about the weapons and ammunition, while Burgos admitted to the police that they were hers. Burgos and Thomas were arrested and eventually indicted for possession of a firearm with an obliterated serial number.

After Burgos was released on bail, she returned to Massachusetts and continued to work at the Congress Agency. On October 21, 2010, the United States Marshals Service arrested Burgos at the agency's office. The office manager notified Owades of Burgos's arrest. Upon her return to work four days later, Burgos explained to Owades that there was "a misunderstanding as to who was in possession of the firearm at the time of the incident in Iowa;" the gun belonged to her boy friend; she did not know it was present in the vehicle prior to its discovery by the police; its presence was frankly a "shock" to her; "ultimately, she would be exonerated"; and "[the misunderstanding] was not going to affect her ability to work." Burgos informed Owades that Thomas went to jail. Owades conducted no independent investigation into the circumstances of her arrest because he "did not at the time think it was germane to her employment."

Burgos subsequently told Owades that she had some legal "arrangement" with the authorities that would last a year.³ At the end of that time period, Burgos informed Owades that the matter was resolved. In fact, following her completion of the diversion program, the United States Attorney dismissed the indictment on May 24, 2012.⁴ Approximately seven weeks later, Thomas struck Adams's vehicle.b. Discussion. A plaintiff must prove four elements in order to prevail on a negligence claim: (1) duty; (2) breach of duty; (3) a causal connection between the breach of duty and damages; and (4) damages. See Jupin v. Kask, 447 Mass. 141, 146, 849 N.E.2d 829 (2006). In its motion for summary judgment, the agency challenged Adams's ability to satisfy each of these elements of the tort of negligent failure to safeguard personal information. The motion judge agreed, ruling that expert testimony was required to establish whether the agency owed a duty to Adams to safeguard his personal information, what that duty entailed, and whether the agency breached that duty. The motion judge also found that Adams was unable to prove that the agency's negligence was the proximate cause of injury to Adams.

The existence of a legal duty is a question of law determined "by reference to existing social values and customs and appropriate social policy." See id. at 143, 849 N.E.2d 829, quoting from Cremins v. Clancy, 415 Mass. 289, 292, 612 N.E.2d 1183 (1993). The other three elements ordinarily are questions of fact for the jury. See id. at 146, 849 N.E.2d 829.

i. Legal duty. As a general rule, a party has no duty to control another person's conduct to prevent that person from causing harm to a third person. See Leavitt v. Brockton Hosp., Inc., 454 Mass. 37, 40–41, 907 N.E.2d 213 (2009) (Leavitt ). Well-established exceptions to that rule are recognized in the employment context. At common law, an employer owed the duty to exercise reasonable care in the selection and retention of employees that have contact with members of the public. See Carson v. Canning, 180 Mass. 461, 462, 62 N.E. 964 (1902) ; Foster v. The Loft, Inc., 26 Mass.App.Ct. 289, 290–291, 526 N.E.2d 1309 (1988) (Foster ). More recently, courts have recognized a potential duty of care owed by employers where the employment facilitates the employee's causing harm to third parties. See Restatement (Third) of Torts: Liability for Physical and Emotional Harm § 41 (2012). See also Leavitt, supra at 41 & n. 10, 907 N.E.2d 213 ; Lev, 457 Mass. at 242–244, 929 N.E.2d 303 ; Roe No. 1 v. Children's Hosp. Med. Center, 469 Mass. 710, 714 & n. 7, 16 N.E.3d 1044 (2014) ; Doe v. Boston Med. Center Corp.,

88 Mass.App.Ct. 289, 291, 36 N.E.3d 1258 (2015).

In deciding whether a special relationship exists between a particular plaintiff and defendant, our foremost consideration is whether "a defendant reasonably could foresee that he would be expected to take affirmative action to protect the plaintiff and could anticipate harm to the plaintiff from the failure to do so." Irwin v. Ware, 392 Mass. 745, 756, 467 N.E.2d 1292 (1984). "All the circumstances are examined in defining the scope of a duty of care based on the reasonable foreseeability of harm." Whittaker v. Saraceno, ...