Collins v. Athens Orthopedic Clinic, P.A.

Citation837 S.E.2d 310,307 Ga. 555
Decision Date23 December 2019
Docket NumberS19G0007
Parties COLLINS et al. v. ATHENS ORTHOPEDIC CLINIC, P.A.
CourtSupreme Court of Georgia

David Andrew Bain, Law Offices of David A. Bain, LLC, 1230 Peachtree St., NE, Suite 1050, Atlanta, Georgia 30309, Mark S. Goldman, Douglas J. Bench, Goldman Scarlato & Penny, P.C., 8 Tower Bridge, Suite 1025, 161 Washington Street, Conshohocken, Pennsylvania 19428, for Appellant.

John Durand Dalbey, Chilivis, Cochran, Larkins & Bever, LLP, 3127 Maple Drive, N.E., Atlanta, Georgia 30305-2503, for Appellee.

PETERSON, Justice.

When a criminal steals consumers’ sensitive personal data, what do those consumers have to plead against the allegedly negligent business from whom the data was stolen to show a legally cognizable injury under Georgia tort law? The Court of Appeals has held in cases involving the exposure of personal information that the failure to show that the information had actually fallen into criminal hands, let alone that the information was used to the consumers’ detriment, meant that plaintiffs had failed to show a legally cognizable injury. But this case, which was dismissed on the pleadings despite allegations of large-scale criminal activity, falls into a different category of data-exposure cases. The plaintiffs here, current or former patients of the defendant medical clinic, brought a putative class action after the clinic informed them that a hacker had stolen their personal data from the clinic. We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable. Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligence claims, we reverse that holding. Because that error may have affected the Court of Appeals’s other holdings, we vacate those other holdings and remand the case.

1. Background

The complaint, verified by each of the named plaintiffs, alleges that in June 2016 an anonymous hacker stole the personally identifiable information, including Social Security numbers, addresses, birth dates, and health insurance details, of at least 200,000 current and former patients of Athens Orthopedic Clinic ("the Clinic") from the Clinic’s computer databases. Those current and former patients included named plaintiffs Christine Collins, Paulette Moreland, and Kathryn Strickland. According to the allegations contained in the complaint, the hacker demanded a ransom, but the Clinic refused to pay. The hacker offered at least some of the stolen personal data for sale on the so-called "dark web," and some of the information was made available, at least temporarily, on Pastebin, a data-storage website. The Clinic notified the plaintiffs of the breach in August 2016.

The plaintiffs allege that because their personal data has been "compromised and made available to others on the dark web, criminals are now able to assume Class Members’ identit[ies] and fraudulently obtain credit cards, issue fraudulent checks, file tax refund returns, liquidate bank accounts, and open new accounts, all in Class Members’ names." Each named plaintiff alleges that she has "spent time calling a credit reporting agency and placing a fraud or credit alert on her credit report to try to contain the impact of the data breach and anticipates having to spend more time and money in the future on similar activities." Collins also alleges that fraudulent charges to her credit card were made "[s]hortly" after the data breach and that she spent time getting the charges reversed by the card issuer. And the complaint alleges that "[e]ven Class Members who have not yet experienced identity theft or are not yet aware of it nevertheless face the imminent and substantial risk of future injury."

In their suit against the Clinic, the plaintiffs sought class certification and asserted claims for negligence, breach of implied contract, and unjust enrichment. They sought damages based on costs related to credit monitoring and identity theft protection, as well as attorneys’ fees. They also sought injunctive relief under the Georgia Uniform Deceptive Trade Practices Act, OCGA § 10-1-370 et seq. ("UDTPA"), and a declaratory judgment to the effect that the Clinic must take certain actions to ensure the security of class members’ personal data in the future. The Clinic filed a motion to dismiss based on both OCGA § 9-11-12 (b) (1) and OCGA § 9-11-12 (b) (6), which the trial court granted summarily.

A divided panel of the Court of Appeals affirmed. See Collins v. Athens Orthopedic Clinic , 347 Ga. App. 13, 815 S.E.2d 639 (2018). The Court of Appeals concluded that the plaintiffs’ negligence claim was properly dismissed because the plaintiffs "seek only to recover for an increased risk of harm." Id. at 18 (2) (a), 815 S.E.2d 639. The majority concluded that although the credit monitoring and other precautionary measures alleged by the plaintiffs were "undoubtedly prudent," they were "designed to ward off exposure to future, speculative harm" and thus "insufficient to state a cognizable claim under Georgia law." Id.1

Then-Presiding Judge McFadden dissented from that holding, concluding that the plaintiffs had standing to bring their claims given that their allegations of future injury show a substantial risk that harm will occur. Id. at 22-25 (1)-(2), 815 S.E.2d 639 (McFadden, P.J., concurring in part and dissenting in part). We granted the plaintiffspetition for certiorari to consider whether the Court of Appeals erred in holding that the plaintiffs failed to allege a legally cognizable injury. We conclude that the plaintiffs did allege a cognizable injury.

2. The Georgia case law relied on by the Court of Appeals is inapplicable for two reasons.

"It is well established that to recover for injuries caused by another’s negligence, a plaintiff must show four elements: a duty, a breach of that duty, causation[,] and damages." Goldstein, Garber & Salama, LLC v. J.B. , 300 Ga. 840, 841 (1), 797 S.E.2d 87 (2017) (citation and punctuation omitted). In other words, "before an action for a tort will lie, the plaintiff must show he sustained injury or damage as a result of the negligent act or omission to act in some duty owed to him." Whitehead v. Cuffie , 185 Ga. App. 351, 353 (2), 364 S.E.2d 87 (1987) ; see also OCGA § 51-1-6 ("When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby ." (emphasis added)); OCGA § 51-1-8 ("The violation of a private duty, accompanied by damage , shall give a right of action." (emphasis added)); OCGA § 51-12-4 ("Damages are given as compensation for injury; generally, such compensation is the measure of damages where an injury is of a character capable of being estimated in money.").

[A] wrongdoer is not responsible for a consequence which is merely possible, according to occasional experience, but only for a consequence which is probable, according to ordinary and usual experience. ... A fear of future damages is too speculative to form the basis for recovery.

Finnerty v. State Bank & Trust Co. , 301 Ga. App. 569, 572 (4), 687 S.E.2d 842 (2009) (citation and punctuation omitted), disapproved of on other grounds by Cumberland Contractors, Inc. v. State Bank & Trust Co ., 327 Ga. App. 121, 125 (2) n.4, 755 S.E.2d 511 (2014) ; see also OCGA § 51-12-8 ("If the damage incurred by the plaintiff is only the imaginary or possible result of a tortious act or if other and contingent circumstances preponderate in causing the injury, such damage is too remote to be the basis of recovery against the wrongdoer.").

Concluding that the plaintiffs had not sufficiently pleaded injury here, the Court of Appeals relied on two of its opinions addressing the exposure of sensitive personal information, Finnerty and Rite Aid of Georgia v. Peacock , 315 Ga. App. 573, 726 S.E.2d 577 (2012). In Finnerty , the matter came before the Court of Appeals on the grant of summary judgment against a civil case defendant who complained that the plaintiff bank had included his social security number in an exhibit to the civil complaint. 301 Ga. App. at 569, 687 S.E.2d 842. As one of several alternative bases for affirming the summary judgment order, the Court of Appeals concluded that the defendant’s state law counterclaims alleging that the bank’s action caused him injuries were "wholly speculative." Id. at 572 (4), 687 S.E.2d 842. The court noted that the defendant had "failed to demonstrate that the Bank’s purported unlawful disclosure made it ‘probable’ that he would suffer any identity theft or that any specific persons actually have accessed his confidential personal information as a result of the purported unlawful disclosure." Id. And in Rite Aid , the Court of Appeals reversed a grant of class certification in a case arising from the defendant pharmacy’s sale of its customers’ medication information to another pharmacy, concluding the trial court erred in finding that the named plaintiff and the proposed class of customers shared common questions of law and fact and that the named plaintiff was a sufficiently typical class representative. In particular, the Court of Appeals noted that the named plaintiff could only speculate that a criminal might associate with an employee of the new pharmacy who had access to his prescription information. 315 Ga. App. at 576-577 (1) (a) (i), 726 S.E.2d 577.

The Court of Appeals in this case also relied on its prior opinion in Boyd v. Orkin Exterminating Co ., 191 Ga. App. 38, 381 S.E.2d 295 (1989), overruled on other grounds by Hanna v. McWilliams , 213 Ga. App. 648, 651 (2), 446 S.E.2d 741 1994, in which the Court of Appeals affirmed a grant of partial summary judgment to the defendant pest control company on the plaintiffs’ suit alleging that the negligent application of pesticide in their home subjected...

To continue reading

Request your trial
30 cases
  • Collins v. Clinic
    • United States
    • Georgia Court of Appeals
    • September 25, 2020
    ...negligence that was not merely speculative, and thus, it was error to dismiss the negligence claim. Collins v. Athens Orthopedic Clinic , 307 Ga. 555, 563-564 (3), 837 S.E.2d 310 (2019). The Court then directed this Court to reconsider the remaining claims in light of this ruling. Id. at 55......
  • Maynard v. Snapchat, Inc.
    • United States
    • Georgia Supreme Court
    • March 15, 2022
    ...a duty for Snap to use reasonable care in designing the product in light of that risk. See Collins v. Athens Orthopedic Clinic, P.A. , 307 Ga. 555, 560 (2) (a), 837 S.E.2d 310 (2019) (noting that a motion to dismiss for failure to state a claim cannot be granted unless "the plaintiff would ......
  • Moody v. State
    • United States
    • Georgia Supreme Court
    • May 16, 2023
  • Norman v. Xytex Corp.
    • United States
    • Georgia Supreme Court
    • September 28, 2020
    ...test, because the federal test imposes on plaintiffs a "more stringent pleading standard[ ]." Collins v. Athens Orthopedic Clinic, P.A. , 307 Ga. 555, 565 (4), 837 S.E.2d 310 (2019) ("Compare Ashcroft v. Iqbal , 556 U.S. 662, 679, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (under federal law, l......
  • Request a trial to view additional results
1 firm's commentaries
  • Always Liability Increases (ALI)? Not Yet with Medical Monitoring.
    • United States
    • LexBlog United States
    • May 25, 2023
    ...taking a position on medical monitoring because “that type of claim is not before us,” Collins v. Athens Orthopedic Clinic, P.A., 837 S.E.2d 310, 314 n.2 (Ga. 2019), in preference to a published intermediate appellate state court decision and three federal decisions (two of which were affir......
4 books & journal articles
  • American Law Institute Proposes Controversial Medical Monitoring Rule in Final Part of Torts Restatement.
    • United States
    • Defense Counsel Journal Vol. 87 No. 4, October 2020
    • October 1, 2020
    ...to ward off exposure to future, speculative harm, are insufficient to state a cognizable claim under Georgia law."), rev'd in part, 837 S.E.2d 310 (Ga. 2019) (expressing no opinion on claim for monitoring costs because claim not before (xi) In re Haw. Federal Asbestos Cases, 734 F. Supp. 15......
  • Commercial Transportation
    • United States
    • Mercer University School of Law Mercer Law Reviews No. 72-1, September 2020
    • Invalid date
    ...Railway Co., 307 Ga. at 572, 837 S.E.2d at 309 (quoting POM Wonderful, 573 U. S. at 115, 134 S. Ct. at 2228).75. Id.76. Id. at 573, 837 S.E.2d at 310.77. Ga Comp. R. & Regs. r. 570-38-5-.01 (May 11, 2020).78. Ga Comp. R. & Regs. r. 570-38-5-.01 through 570-38-5-.0779. O.C.G.A. § 40-1-151 (2......
  • The Lawyer's Duty of Tech Competence Post-covid: Why Georgia Needs a New Professional Rule Now—more Than Ever
    • United States
    • Georgia State University College of Law Georgia State Law Reviews No. 39-2, January 2023
    • Invalid date
    ...[https ://perma.cc/9WL6-P2XD].160. Collins v. Athens Orthopedic Clinic, P.A., 837 S.E.2d 310, 311-12 (Ga. 2019).161. Id. at 311; see In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1314-17 (N.D. Ga. 2019). 162. Eric James Hertz & Mark D. Link, Georgia Law of Dam......
  • AMERICAN PRIVACY LAW AT THE DAWN OF A NEW DECADE (AND THE CCPA AND COVID19): OVERVIEW AND PRACTITIONER CRITIQUE.
    • United States
    • Marquette Intellectual Property Law Review Vol. 24 No. 2, June 2020
    • June 22, 2020
    ...61-63. (19.) E.g., Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826, (7th Cir. 2018); Collins v. Athens Orthopedic Clinic, P.A., 307 Ga. 555 (2019). Both cases preliminarily allowed class actions to proceed based upon a finding of shared, cognizable (20.) A description of the rationale......

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT