WELLS FARGO BANK v. JENKINS (2013)

This Court granted certiorari to the Court of Appeals in Jenkins v. Wachovia Bank, N.A., 314 Ga.App. 257, 724 S.E.2d 1 (2012), to consider whether the Court of Appeals erred in holding that a violation of an alleged duty imposed by 15 USC § 6801(a), which is part of the Gramm–Leach–Bliley Act (“GLBA”), 15 USC § 6801 et seq., gives rise to a cause of action for negligence under OCGA § 51–1–6. For the reasons that follow, we conclude that the holding was in error, and we reverse that portion of the judgment of the Court of Appeals.

The relevant facts as found by the Court of Appeals are the following. Stephen Kale Jenkins brought a tort action against Wachovia Bank, N.A., Wells Fargo Bank, N.A., and all predecessor and successor entities and John Doe corporations (collectively, “Bank”), in which he alleged that a Bank teller had improperly accessed Jenkins's confidential information and given it to her husband, allowing the husband to steal Jenkins's identity. Jenkins asserted claims that the Bank negligently failed to protect the information, breached a duty of confidentiality, and invaded his privacy. The trial court granted the Bank's motion for judgment on the pleadings. The Court of Appeals reversed the judgment on the pleadings as to Jenkins's negligence claim after finding that the allegations of his complaint established the elements of negligence.¹

To maintain a viable negligence action, a plaintiff must satisfy the elements of the tort: the existence of a duty on the part of the defendant, a breach of such duty, causation of the injury alleged, and damages as a result of the alleged breach of duty. Rasnick v. Krishna Hospitality, 289 Ga. 565, 566, 713 S.E.2d 835 (2011). Jenkins's allegation of negligence by the Bank was premised upon its violation of a legal duty to protect his confidential personal information imposed by the GLBA, specifically 15 USC § 6801(a) which provides:

It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.

The Court of Appeals determined that the GLBA's language made plain that financial institutions have a duty to protect certain information of their customers. Jenkins v. Wachovia Bank, N.A., supra at 259(1)(a), 724 S.E.2d 1. It further cited OCGA § 51–1–6² as authorizing “a plaintiff to recover damages for the breach of a legal duty even when that duty arises from a statute that does not provide a private cause of action.” Id. The Court of Appeals concluded that the GLBA in the context of OCGA § 51–1–6 gave rise to a cause of action for negligence under Georgia law. However, such conclusion was in error.

As acknowledged by the Court of Appeals, there is no private right of action for an alleged violation of the terms of the GLBA. Finnerty v. State Bank and Trust Co., 301 Ga.App. 569, 570(2), 687 S.E.2d 842 (2009). Therefore, Jenkins's cause of action for negligence must be considered in the context of the general principles of the tort under Georgia law. As noted, underlying an actionable claim of negligence is the existence of a legal duty. Rasnick v. Krishna Hospitality, supra at 566, 713 S.E.2d 835. Such a duty can arise either by statute or be imposed by a common law principle recognized in the caselaw. Id.

A duty in this case cannot rest solely upon OCGA § 51–1–6 because this statute sets forth merely general principles of tort law. Reilly v. Alcan Aluminum Corp., 272 Ga. 279, 280(1), 528 S.E.2d 238 (2000). By its express terms, tort liability under OCGA § 51–1–6 mandates that the alleged tortfeasors have breached a legal duty to perform a beneficial act or to refrain from doing an injurious act. So, the legal duty to support Jenkins's negligence claim must be found in another legislative enactment, which he asserts is the GLBA.

Certainly, § 6801(a) of the GLBA expresses the goal that financial institutions respect the privacy, security, and confidentiality of customers. While this is a clear Congressional policy statement, it is just that. It does not provide for certain duties or the performance of or refraining from any specific acts on the part of financial institutions, nor does it articulate or imply a standard of conduct or care, ordinary or otherwise. See Central Anesthesia Associates, P.C. v. Worthy, 254 Ga. 728, 731–732(2), 333 S.E.2d 829 (1985). In order for a plaintiff to invoke OCGA § 51–1–6, there must be the alleged breach of a legal duty with some ascertainable standard of conduct. See Cruet v. Emory University, 85 F.Supp.2d 1353, 1355 (N.D.Ga.,2000). And, 15 USC § 6801(a) does not provide one. Indeed, subsection (b) of 15 USC § 6801 confirms that subsection (a) is not intended to provide a standard of conduct or care by financial institutions as it expressly authorizes federal agencies “[i]n furtherance of the policy in subsection (a) of [§ 6801]” to:

establish appropriate standards for the financial institutions subject to their jurisdiction relating to administrative, technical, and physical safeguards—

(1) to insure the security and confidentiality of customer records and information;

(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and

(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

There is no finding by the Court of Appeals of a violation of any regulation, directive, or standard authorized by 15 USC § 6801(b), to support Jenkins's claim of the Bank's negligence.³ Compare McLain v. Mariner Health Care, 279 Ga.App. 410, 631 S.E.2d 435 (2006); Dupree v. Keller Industries, 199 Ga.App. 138, 404 S.E.2d 291 (1991). Simply, the Court of Appeals has misread an aspirational statement of Congressional policy expressed in 15 USC § 6801(a) as establishing a legal duty, the alleged breach of which would give rise under the law of this State to a cause of action for negligence against financial institutions. Congress did not see fit to impose such a duty under § 6801(a), and this Court will not usurp legislative authority by inferring or supplying one. Consequently, the determination to the contrary by the Court of Appeals cannot stand.⁴

Judgment reversed and case remanded.

HINES, Justice.

All the Justices concur.