Georgia Supreme Court: The State Is Not Its Citizens' Data Keeper

Author:Mr Theodore F. Claypoole, Taylor Ey and Tom Kierner
Profession:Womble Bond Dickinson

According to the highest court in the state, Georgia state government does not have an inherent obligation to protect citizens' personal or sensitive data like social security numbers or status on the unemployment rolls. This decision was taken without consideration of damage to the plaintiff citizens whose data was negligently distributed.

On May 20, 2019, the Georgia Supreme Court issued a landscape-changing privacy decision which, in the absence of a special relationship, rids Georgia governmental entities of the general duty to safeguard personal information given to them. Now, entities must be careful when contracting with Georgia governmental entities if sharing personal information. Companies should also consider contractual protections addressing exchanges of personal information going to the government, and mandate that information is kept according to certain information security practices.

This case arose because the Georgia Department of Labor (the "Department") created a spreadsheet containing personal information (some of which is considered "sensitive information") and shared it without permission of the individuals whose information was in the spreadsheet. Specifically, the spreadsheet contained the name, social security number, home telephone number, e-mail address, and age of 4,757 individuals who applied for unemployment benefits and other services administered by the Department. The Department mistakenly sent that spreadsheet to 1,000 recipients without the individuals' permission. The individuals sued the Department, alleging the Department was negligent and breached its fiduciary duty, among other privacy tort claims.

Plaintiffs argued that the Department owed a common law duty, a statutory duty, and a fiduciary duty. According to Plaintiffs, the Department owed a duty to all the individuals who applied for state benefits to safeguard and protect their personal information because, citing a Georgia Supreme Court case, there is "a general duty one owes to all the world not to subject them to an unreasonable risk of harm." Bradley Ctr., Inc. v. Wessner, 250 Ga. 199, 201 (1982), disapproved of by Georgia Dep't of Labor v. McConnell, No. S18G1316, 2019...

To continue reading