Wells Fargo Bank, N.A. v. Jenkins

Hines, Justice.

This Court granted certiorari to the Court of Appeals in Jenkins v. Wachovia Bank, N.A., 314 Ga. App. 257 (724 SE2d 1) (2012), to consider whether the Court of Appeals erred in holding that a violation of an alleged duty imposed by 15 USC § 6801 (a), which is part of the Gramm-Leach-BlileyAct (“GLBA”), 15 USC § 6801 et seq., gives rise to a cause of action for negligence under OCGA § 51-1-6. For the reasons that follow, we conclude that the holding was in error, and we reverse that portion of the judgment of the Court of Appeals.

The relevant facts as found by the Court of Appeals are the following. Stephen Kale Jenkins brought a tort action against Wachovia Bank, N.A., Wells Fargo Bank, N.A., and all predecessor and successor entities and John Doe corporations (collectively, “Bank”), in which he alleged that a Bank teller had improperly accessed Jenkins’s confidential information and given it to her husband, allowing the husband to steal Jenkins’s identity. Jenkins asserted claims that the Bank negligently failed to protect the information, breached a duty of confidentiality, and invaded his privacy. The trial court granted the Bank’s motion for judgment on the pleadings. The Court of Appeals reversed the judgment on the pleadings as to Jenkins’s negligence claim after finding that the allegations of his complaint established the elements of negligence.¹

To maintain a viable negligence action, a plaintiff must satisfy the elements of the tort: the existence of a duty on the part of the defendant, a breach of such duty, causation of the injury alleged, and damages as a result of the alleged breach of duty. Rasnick v. Krishna Hospitality, 289 Ga. 565, 566 (713 SE2d 835) (2011). Jenkins’s allegation of negligence by the Bank was premised upon its violation of a legal duty to protect his confidential personal information imposed by the GLBA, specifically 15 USC § 6801 (a) which provides:

It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.

The Court of Appeals determined that the GLBA’s language made plain that financial institutions have a duty to protect certain information of their customers. Jenkins v. Wachovia Bank, N.A., supra at 259 (1) (a). It further cited OCGA § 51-1-6² as authorizing “a plaintiff to recover damages for the breach of a legal duty even when that duty arises from a statute that does not provide a private cause of action.” Id. The Court of Appeals concluded that the GLBA in the context of OCGA § 51-1-6 gave rise to a cause of action for negligence under Georgia law. However, such conclusion was in error.

As acknowledged by the Court of Appeals, there is no private right of action for an alleged violation of the terms of the GLBA. Finnerty v. State Bank and Trust Co., 301 Ga. App. 569, 570 (2) (687 SE2d 842) (2009). Therefore, Jenkins’s cause of action for negligence must be considered in the context of the general principles of the tort under Georgia law. As noted, underlying an actionable claim of negligence is the existence of a legal duty. Rasnick v. Krishna Hospitality, supra at 566. Such a duty can arise either by statute or be imposed by a common law principle recognized in the caselaw. Id.

A duty in this case cannot rest solely upon OCGA § 51-1-6 because this statute sets forth merely general principles of tort law. Reilly v. Alcan Aluminum Corp., 272 Ga. 279, 280 (1) (528 SE2d 238) (2000). By its express terms, tort liability under OCGA § 51-1-6 mandates that the alleged tortfeasors have breached a legal duty to perform a beneficial act or to refrain from doing an injurious act. So, the legal duty to support Jenkins’s negligence claim must be found in another legislative enactment, which he asserts is the GLBA.

Certainly, 15 USC § 6801 (a) of the GLBA expresses the goal that financial institutions respect the privacy, security, and confidentiality of customers. While this is a clear Congressional policy statement, it is just that. It does not provide for certain duties or the performance of or refraining from any specific acts on the part of financial institutions, nor does it articulate or imply a standard of conduct or care, ordinary or otherwise. See Central Anesthesia Associates, P.C. v. Worthy, 254 Ga. 728, 731-732 (2) (333 SE2d 829) (1985). In order for a plaintiff to invoke OCGA § 51-1-6, there must be the alleged breach of a legal duty with some ascertainable standard of conduct. See Cruet v. Emory Univ., 85 FSupp.2d 1353, 1355 (N.D. Ga. 2000). And, 15 USC § 6801 (a) does not provide one. Indeed, subsection (b) of 15 USC § 6801 confirms that subsection (a) is not intended to provide a standard of conduct or care by financial institutions as it expressly authorizes federal agencies “[i]n furtherance of the policy in subsection (a) [of § 6801]” to:

establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards-

(1) to insure the security and confidentiality of customer records and information;

(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and

(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

Decided June 17, 2013. Schiff Hardin, SamuelD. Almon, Kimberly R. Bourroughs, Leah Ward Sears, Womble, Carlyle & Sandridge, John G. Perry, Robert R. Ambler, Jr., for appellants. Mann & Kytle, James W. Kytle, Humphreys, Wallace & Humphreys, David Humphreys, Luke Wallace, Paul Catalano, for appellee.

There is no finding by the Court of Appeals of a violation of any regulation, directive, or standard authorized by 15 USC § 6801 (b), to support Jenkins’s claim of the Bank’s negligence.³ Compare McLain v. Mariner Health Care, 279 Ga. App. 410 (631 SE2d 435) (2006); Dupree v. Keller Industries, 199 Ga. App. 138 (404 SE2d 291) (1991). Simply, the Court of Appeals has misread an aspirational statement of Congressional policy expressed in 15 USC § 6801 (a) as establishing a legal duty, the alleged breach of which would give rise under the law of this State to a cause of action for negligence against financial institutions. Congress did not see fit to impose such a duty under 15 USC § 6801 (a), and this Court will not usurp legislative authority by inferring or supplying one. Consequently, the determination to the contrary by the Court of Appeals cannot stand.⁴

Judgment reversed and case remanded.

All the Justices concur.

1 The Court of Appeals also determined that Jenkins failed to assert in his complaint facts showing that the Bank owed him a confidential duty or invaded his privacy, so it affirmed the grant of judgment on the pleadings as to the remaining claims. Those claims are not at issue in this appeal.

2 OCGA § 51-1-6 states:

When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.

3 Jenkins points to certain provisions of the Code of Federal Regulations in support of the finding of a duty under 15 USC § 6801 (a), specifically 16 CFR § 314.1; however, the regulation was not part of the Court of Appeals analysis or its finding of duty under the GLBA. Furthermore, 16 CFR § 314.1 (a) expressly implements only sections 501 and 505 (b) (2) of the GLBA and applies to those financial institutions over which the Federal Trade Commission has jurisdiction. 16 CFR § 314.1 (b).

4 Jenkins contends that neither the issue of the existence of a duty under 15 USC § 6801 (a), nor a “separation of powers” argument by the Bank is properly before this Court because of the Bank’s alleged failure to raise them before the trial court or the Court of Appeals. However, the question of a legal duty under the cited provision of the GLBA is the linchpin of the Court of Appeals holding at issue and is the precise question on certiorari. As for the Bank’s argument of a violation of the doctrine of separation of powers, this Court’s determination of the lack of a found legal duty makes it unnecessary to address such argument.