Georgia “data breach as unfair trade practice” claim fails

Collins v. Athens Orthopedic Clinic, 849 S.E.2d 213, A18A0296
(Ga. Ct. App. 2020)

Former and current patients filed a putative class action
against the Athens Orthopedic Clinic for negligence, breach of implied
contract, unjust enrichment, attorney fees, injunctive relief under Georgia’s
Uniform Deceptive Trade Practices Act (UDTPA), and declaratory judgment
stemming from a data breach of their personal information. An anonymous hacker
stole the personally identifiable information, including social security
numbers, birthdates, addresses, and health insurance information, of
approximately 200,000 current and former Clinic patients. The hacker demanded
ransom, but the Clinic refused to pay, and the hacker sold the information on
the “dark web.”

The trial court dismissed all claims, but the Georgia
Supreme Court ultimately held that the allegations in the complaint
sufficiently stated a claim for negligence that was not merely speculative and
remanded to reconsider the remaining claims in light of that ruling. On remand,
the court of appeals affirmed the dismissal of the unjust enrichment, declaratory
relief, and UDTPA claims.

The Georgia UDTPA allows only prospective relief, but not
redress for past harm. Thus, standing requires likely future damage by an
unfair trade practice.  Here, “an
injunction would serve no purpose at this point because, as alleged, their
personal information was already sold and is available on the dark web. As
such, the plaintiffs have failed to allege a future harm caused by the unfair
practice, as required by the UDTPA, and the trial court properly dismissed this

The Chief Judge would have reached the same result on the
UDTPA but for a different reason: there was no alleged deceptive trade
practice. Athens Orthopedic allegedly violated the Act by failing to inform the
plaintiffs that it did not have adequate computer systems and data security
practices, but there was no allegation that it knew of the inadequacy, so there
was no false advertising.

from Blogger

This entry was posted in Uncategorized and tagged . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s