MCCONNELL et al.
GEORGIA DEPARTMENT OF LABOR.
ELLINGTON, P. J., MERCIER, J., and SENIOR APPELLATE JUDGE
Ellington, Presiding Judge.
McConnell filed this class action against the Georgia
Department of Labor, alleging several tort claims in
connection with the Department's disclosure of personal
information of McConnell and the proposed class members.
After a hearing, the Superior Court of Cobb County granted
the Department's motion to dismiss McConnell's
complaint for failure to state a claim upon which relief can
be granted. McConnell appealed, and, in McConnell v. Ga.
Dept. of Labor, 337 Ga.App. 457 (787 S.E.2d 794) (2016),
we affirmed. The Supreme Court of Georgia granted a writ of
certiorari to consider, inter alia, whether this Court erred
"in not addressing the trial court's holding that
McConnell's tort claims were barred by sovereign
immunity, which is a jurisdictional issue, before addressing
the merits of those claims." The Supreme Court held that
we did err in this manner, vacated our decision, and remanded
with direction that we "make the threshold determination
of whether the trial court erred in its holding that
McConnell's claims are barred by sovereign
immunity." McConnell v. Ga. Dept. of Labor, _
Ga. _ (805 S.E.2d 79) (2017). For the reasons explained below
in Division 1, we conclude that the trial court did err in so
holding and reverse the judgment in relevant part. Because
the trial court did not err in dismissing McConnell's
complaint on the basis that it fails to state a claim upon
which relief can be granted, as explained below in Divisions
2 through 4, we affirm the judgment in part in this regard.
complaint, McConnell alleges that a Department employee,
while acting within the scope of his official duties or
employment, sent an email to approximately 1, 000 Georgians
who had applied for unemployment benefits or other services
administered by the Department. The email included a
spreadsheet that listed the name, social security number,
home phone number, email address, and age of over 4, 000
Georgians who had registered for Department services,
including McConnell.McConnell alleges that the employee's
conduct constituted the torts of negligently disclosing
"personal information" as defined under Georgia
law, breach of fiduciary duty, and invasion of privacy
(public disclosure of private facts). McConnell seeks
economic damages, specifically, out-of-pocket costs related
to credit monitoring and identity protection services and
damages resulting from the adverse impact to his credit score
from the closing of accounts. In addition, he seeks damages
for the "fear, upset, anxiety and injury to peace and
happiness related to the disclosure of [his] personal
identifying information, as the disclosure of personal
identifying information had provided all the raw material
necessary to facilitate the theft of [his identity] and
unauthorized charges upon [his] credit or bank
accounts." He does not allege that an act of identity
theft has yet occurred.
McConnell contends that the trial court erred in holding that
the state has not waived its sovereign immunity pursuant to
the Georgia Tort Claims Act, OCGA §§ 50-21-20
through 50-21-37, for the type of losses that he alleges in
regard to tort claims against the state, the General Assembly
adopted the Act for the express purpose of "balanc[ing]
strict application of the doctrine of sovereign immunity,
" which, in its breadth,  "may produce inherently
unfair and inequitable results, against the need for limited
exposure of the state treasury to tort liability."
(Citation and punctuation omitted.) Bd. of Regents of
Univ. Sys. of Ga. v. Myers, 295 Ga. 843, 845 (764 S.E.2d
543) (2014). Under the Act, the state waives its
sovereign immunity with respect to actions brought in Georgia
courts "for the torts of state officers and employees
while acting within the scope of their official duties or
employment and shall be liable for such torts in the same
manner as a private individual or entity would be liable
under like circumstances[, ]" subject to exceptions and
limitations set forth in the Act. OCGA § 50-21-23 (a). A
"claim" under the Act is defined as "any
demand against the State of Georgia for money only on account
of loss caused by the tort of any state officer or employee
committed while acting within the scope of his or her
official duties or employment." OCGA § 50-21-22
(1). OCGA § 50-21-22 (3) provides: "'Loss'
means personal injury; disease; death; damage to tangible
property, including lost wages and economic loss to the
person who suffered the injury, disease, or death; pain and
suffering; mental anguish; and any other element of actual
damages recoverable in actions for negligence."
sovereign immunity is not an affirmative defense, but rather
a privilege that is subject to waiver by the State, the party
seeking to benefit from that waiver has the burden of
establishing the waiver of sovereign immunity."
(Citations and footnote omitted.) Williams v. Ga. Dept.
of Corrections, 338 Ga.App. 719, 720 (1) (791 S.E.2d
606) (2016). "We review de novo a trial court's
denial of a motion to dismiss based on sovereign immunity
grounds, which is a matter of law." (Citation and
punctuation omitted.) Ga. Dept. of Transp. v. King,
341 Ga.App. 102, 103 (798 S.E.2d 492) (2017).
Economic damages/financial harm. With regard to
McConnell's alleged economic damages, the Department
argues that sovereign immunity is waived under the Act only
for a "loss" as that term is defined in the Act and
that McConnell has not suffered such a loss. Specifically,
the Department argues, based on the definition of
"loss" in OCGA § 50-21-22 (3), that the Act
"expressly limits the recovery of economic damages to a
plaintiff who has also suffered a personal injury, disease,
death." Because McConnell alleges that he suffered
economic damages as a result of the Department's email
disclosure, but does not allege that the email disclosure
"caused him to suffer a disease, death, or injury to his
person[, ]" the Department contends, McConnell cannot
recover economic losses under the Act.
Department's strained reading of OCGA § 50-21-22 (3)
cannot be supported because the subsection, after giving
specific examples of injuries that are actionable,
expansively adds "any other element of actual damages
recoverable in actions for negligence." In Dept. of
Transp. v. Montgomery Tank Lines, Inc., 276 Ga. 105 (575
S.E.2d 487) (2003), the Supreme Court of Georgia considered
the effect of that "broad last clause in § 50-21-22
(3)" and rejected the agency's proposed narrow
reading. Id. at 107-108 (1). The Supreme Court found
that, notwithstanding that the losses specifically listed
(personal injury; disease; death; damage to tangible
property; pain and suffering; and mental anguish) are all
so-called "first-party losses, " the "term of
enlargement" (that is, the phrase "any other
element of actual damages recoverable in actions for
negligence") is "specific and unambiguous and
requires a broader meaning than that attributed to it"
by the agency. Id. at 107 (1). The Supreme Court
explained: "[c]learly, an action for contribution and
indemnification is an action for negligence, and the damages
that the contribution plaintiffs seek to recover are
unquestionably an element of actual damages[.]"
Id. at 107 (1). The Supreme Court found that the
concluding phrase of the "loss" definition means
that sovereign immunity is not waived only for a person who
directly suffers the personal injury, disease, death, or
other loss but is broad enough to include claims for
contribution and indemnification. Id. at 108 (1).
Furthermore, the Supreme Court concluded, the fact that the
waiver of sovereign immunity is subject to specific
"exceptions" set forth in OCGA § 50-21-24, and
that contribution and indemnity actions are not listed as
exceptions, "further buttresses the conclusion that such
actions against the State are not categorically precluded by
the [Act]." Id.
we conclude in this case that the catch-all phrase, "any
other element of actual damages recoverable in actions for
negligence, " requires a broader meaning than that
attributed to it by the Department. See Dept. of Transp.
v. Montgomery Tank Lines, Inc., 276 Ga. at 107-108 (1).
The General Assembly certainly could have modified "any
other element of actual damages recoverable in actions for
negligence" with "sustained by a person who
suffered injury, disease, or death" if it had intended
to limit the final phrase in this way. Based on the
express terms of OCGA § 50-21-22 (3) and the cases cited
herein, we conclude that losses under the Act may include
economic losses suffered by a plaintiff who has not also
suffered a personal injury, disease, or death.
related vein, the Department contends that any time, effort,
and money that McConnell allegedly spent monitoring his
credit is not an actual injury that is recoverable in
negligence cases. Acknowledging that Georgia courts have not
addressed whether obtaining credit monitoring services after
the disclosure of confidential information constitutes a
cognizable injury, the Department contends that courts in
other jurisdictions have rejected such claims. In addition,
the Department contends that McConnell cannot recover for an
increased risk of future identity theft because such risk
does not constitute an element of actual damages that is
recoverable under Georgia law. Because McConnell alleged damages
resulting in part from the adverse impact to his credit score
from the closing of accounts, we cannot say that he seeks
compensation only for credit-monitoring expenses or the risk
of future economic damages from identity theft.
Whether McConnell can prove that he has suffered financial
harm as a result of the adverse impact to his credit score
from the closing of accounts is not a question to be resolved
at this threshold. See Upper Oconee Basin Water Auth. v.
Jackson County, 305 Ga.App. 409, 412 (1) (699 S.E.2d
605) (2010) ("A motion to dismiss asserting sovereign
immunity is based upon the trial court's lack of subject
matter jurisdiction, rather than the merits of the
plaintiff's claim.") (citation and punctuation
omitted); Dept. of Transp. v. Dupree, 256 Ga.App.
668, 671 (1) (570 S.E.2d 1) (2002) (accord).
Mental anguish. With regard to McConnell's
claims for damages for his continuing fear and anxiety of
potential identity theft in the future, the Department
invokes Georgia's so-called "impact rule, "
arguing that "[t]he 'impact rule' states that
'[i]n a claim concerning negligent conduct, a recovery
for emotional distress is allowed only where there is some
impact on the plaintiff, and that impact must be a physical
injury[, ]'" quoting Ryckeley v. Callaway,
261 Ga. 828 (412 S.E.2d 826 (1992). To the extent the
Department suggests that the impact rule applies to
any claim concerning negligent conduct, this is
incorrect. To the contrary, the impact rule applies
specifically to claims for negligent infliction of emotional
distress. See Coon v. Medical Center, Inc., 300 Ga.
722, 734 (4) (797 S.E.2d 828) (2017); Bruscato v.
O'Brien, 307 Ga.App. 452, 457 (1) (705 S.E.2d 275)
(2010), aff'd, 289 Ga. 739, 715 S.E.2d 120 (2011);
Clarke v. Freeman, 302 Ga.App. 831, 836 (1) (692
S.E.2d 80) (2010); Charles R. Adams, Ga. Law of Torts §
29:2 (b) (updated December 2017). The Department has not
shown that Georgia law requires proof that a plaintiff
suffered a physical impact and a physical injury in order to
recover for the claims McConnell alleges - negligent
disclosure of personal information, invasion of privacy, and
breach of fiduciary duty - even where the alleged
damages include emotional harm.
found no merit in any of the Department's arguments, as
explained above, we conclude that McConnell carried his
burden of showing that the trial court had subject matter
jurisdiction over his claims for negligently disclosing
personal information, breach of fiduciary duty, and invasion
of privacy, which are tort claims that are not excepted from
the waiver of sovereign immunity for tort claims pursuant to
the Act,  and which are based on the conduct of
state officers and employees while acting within the scope of
their official duties or employment. Accordingly, the trial
court erred in granting the Department's motion to
dismiss McConnell's claims on the basis of the bar of
sovereign immunity. The judgment is therefore reversed in
relevant part. McCoy v. Ga. Dept. of Admin. Svcs.,
326 Ga.App. 853, 858 (755 S.E.2d 362) (2014); Williamson
v. Dept. of Human Resources, 258 Ga.App. 113, 116 (1)
(572 S.E.2d 678) (2002); McCrary Engineering Corp. v.
City of Bowdon, 170 Ga.App. 462, 466 (1) (317 S.E.2d
the threshold issue of sovereign immunity is decided in favor
of the trial court having had subject matter jurisdiction, we
must again consider the merits of McConnell's claims.
McConnell contends that the trial court erred in ruling that
he failed to state a claim for negligent disclosure of
personal information, based, inter alia, on its determination
that as a matter of law "there is no legal duty [under
Georgia law] to safeguard personal information."
[A] motion to dismiss for failure to state a claim upon which
relief may be granted should not be sustained unless (1) the
allegations of the complaint disclose with certainty that the
claimant would not be entitled to relief under any state of
provable facts asserted in support thereof; and (2) the
movant establishes that the claimant could not possibly
introduce evidence within the framework of the complaint
sufficient to warrant a grant of the relief sought. If,
within the framework of the complaint, evidence may be
introduced which will sustain a grant of the relief sought by
the claimant, the complaint is sufficient and a motion to
dismiss should be denied. In deciding a motion to dismiss,
all pleadings are to be construed most favorably to the party
who filed them, and all doubts regarding such pleadings must
be resolved in the filing party's favor. On appeal, a
trial court's ruling on a motion to dismiss for failure
to state a claim for which relief may be granted is reviewed
(Citation and punctuation omitted.) RES-GA McDonough, LLC
v. Taylor English Duma LLP, _ Ga. _ (Case No.
S17A1125, decided October 30, 2017).
In order to have a viable negligence action, a plaintiff must
satisfy the elements of the tort, namely, the existence of a
duty on the part of the defendant, a breach of that duty,
causation of the alleged injury, and damages resulting from
the alleged breach of the duty. The legal duty is the
obligation to conform to a standard of conduct under the law
for the protection of others against unreasonable risks of
harm. This legal obligation to the complaining party must be
found, the observance of which would have averted or avoided
the injury or damage; the innocence of the plaintiff is
immaterial to the existence of the legal duty on the part of
the defendant in that the plaintiff will not be entitled to
recover unless the defendant did something that it should not
have done, i.e., an action, or failed to do something that it
should have done, i.e., an omission, pursuant to the duty
owed the plaintiff under the law. The duty can arise either
from a valid legislative enactment, that is, by statute, or
be imposed by a common law principle recognized in the
caselaw. The existence of a legal duty is a question of law
for the court.
(Citations and punctuation omitted.) Rasnick v. Krishna
Hospital, Inc., 289 Ga. 565, 566-567 (713 S.E.2d 835)
contends that a common law duty exists to safeguard and
protect the personal information of another and argues that
OCGA §§ 10-1-393.8 and 10-1-910 help establish the
duty of care to be exercised by those who collect or hold
personal information. In OCGA §§ 10-1-910, the
General Assembly set out legislative findings underlying the
Georgia Personal Identity Protection Act, OCGA §§
10-1-910 through 10-1-915 (the "GPIPA"), enacted in
2005. In the GPIPA, the General Assembly
found, inter alia, that "[t]he privacy and financial
security of individuals is increasingly at risk, due to the
ever more widespread collection of personal information by
both the private and public sectors[, ]" that
'[i]dentity theft is one of the fastest growing crimes
committed in this state[, ]" and that "[i]dentity
theft is costly to the marketplace and to consumers[.]"
OCGA § 10-1-910 (1), (6). Because "[v]ictims of
identity theft must act quickly to minimize the damage[, ] .
. . expeditious notification of unauthorized acquisition and
possible misuse of a person's personal ...