McCONNELL Et Al. v. DEPARTMENT OF LABOR

787 S.E.2d 794, 337 Ga. App. 457

• Court: Court of Appeals of Georgia
• Decided: June 16, 2016
• Docket: A16A0655
• Status: Published

Opinion

Ellington, Presiding Judge.

Thomas McConnell filed this class action against the Georgia Department of Labor, alleging several tort claims in connection with the Department’s disclosure of personal information of McConnell and the proposed class members. After a hearing, the Superior Court of Cobb County granted the Department’s motion to dismiss McConnell’s complaint for failure to state a claim upon which relief can be granted. McConnell appeals, and for the reasons explained below, we affirm.

In ruling on a motion to dismiss, the trial court must accept as true all well-pled material allegations in the complaint and must resolve any doubts in favor of the plaintiff. As an appellate court, we review de novo a trial court’s determination that a pleading fails to state a claim upon which relief can be granted, construing the pleadings in the light most favorable to the plaintiff and with any doubts resolved in the plaintiff’s favor.

(Citations, punctuation and footnote omitted.) Wright v. Waterberg Big Game Hunting Lodge Otjahewita (PTY), 330 Ga. App. 508, 509 (767 SE2d 513) (2014).

McConnell’s amended complaint contained the following material allegations. In September 2012, the Department created a spreadsheet that listed the name, Social Security number, home phone number, e-mail address, and age of over 4,000 Georgians who had applied for unemployment benefits or other services administered by the Department. McConnell was among the Georgians whose personal information was included in the spreadsheet. A year later, a Department employee sent the spreadsheet by e-mail to approximately 1,000 of the Georgians on the list. To protect himself from the resulting risk of identity theft, McConnell enrolled in the “Life Lock” service, which currently costs $19 per month.

In January 2014, McConnell filed this class action, alleging claims, as amended, for negligence in disclosing “personal information” as defined under Georgia law, invasion of privacy (public dis closure of private facts), and breach of fiduciary duty. Under each theory of recovery, McConnell seeks damages, specifically, the fee for membership in Life Lock and other out-of-pocket costs related to credit monitoring and identity protection services, damages resulting from the impact to his credit score from the closing of accounts, and compensation for the continuing fear and anxiety of potential identity theft in the future. He does not allege that an act of identity theft has yet occurred. 1

The Department moved to dismiss McConnell’s complaint, arguing, inter alia, pursuant to OCGA § 9-11-12 (b) (6), that the complaint failed to state a claim upon which relief can be granted. The trial court granted the Department’s motion to dismiss, finding that each count failed to state a claim upon which relief can be granted. 2

1. McConnell contends that the trial court erred in ruling that he failed to state a claim for negligent disclosure of personal information, based, inter alia, on its determination that as a matter of law “there is no legal duty [under Georgia law] to safeguard personal information.”

In order to have a viable negligence action, a plaintiff must satisfy the elements of the tort, namely, the existence of a duty on the part of the defendant, a breach of that duty, causation of the alleged injury, and damages resulting from the alleged breach of the duty The legal duty is the obligation to conform to a standard of conduct under the law for the protection of others against unreasonable risks of harm. This legal obligation to the complaining party must be found, the observance of which would have averted or avoided the injury or damage; the innocence of the plaintiff is immaterial to the existence of the legal duty on the part of the defendant in that the plaintiff will not be entitled to recover unless the defendant did something that it should not have done, i.e., an action, or failed to do something that it should have done, i.e., an omission, pursuant to the duty owed the plaintiff under the law. The duty can arise either from a valid legislative enactment, that is, by statute, or be imposed by a common law principle recognized in the caselaw. . . . The existence of a legal duty is a question of law for the court.

(Citations and punctuation omitted.) Rasnick v. Krishna Hospital, Inc., 289 Ga. 565, 566-567 (713 SE2d 835) (2011). 3

McConnell acknowledges that a duty to safeguard and protect the personal information of another has not been expressly recognized in Georgia case law. 4 McConnell contends that such a common law duty exists nonetheless, citing two statutory sources, OCGA §§ 10-1-393.8 and 10-1-910. In OCGA § 10-1-910, the GeneralAssembly set out legislative findings underlying the Georgia Personal Identity Protection Act, OCGA §§ 10-1-910 through 10-1-915 (the “GPIPA”), enacted in 2005. 5 In the GPIPA, the GeneralAssembly found, inter alia, that “[t]he privacy and financial security of individuals is increasingly at risk, due to the ever more widespread collection of personal information by both the private and public sectors[,]” that “[i] dentity theft is one of the fastest growing crimes committed in this state[,]” and that “[i]dentity theft is costly to the marketplace and to consumers[.]” OCGA § 10-1-910 (1), (3), (6). Because “[v]ictims of identity theft must act quickly to minimize the damage [,] . . . expeditious notification of unauthorized acquisition and possible misuse of a person’s personal information is imperative.” OCGA § 10-1-910 (7). In line with these findings, the GPIPA requires that affected persons be given certain notice of a data breach. 6 McConnell contends that in codifying these findings the General Assembly demonstrated its intent to protect citizens from the adverse effects of disclosure of personal information and created a general duty to preserve and protect personal information. Notably, however, the GPIPA proscribes particular conduct only after a (known or suspected) data security breach has occurred. Because the GPIPA does not impose any standard of conduct in implementing and maintaining data security practices, it cannot serve as the source of a statutory duty to safeguard personal information. Wells Fargo Bank v. Jenkins, 293 Ga. 162, 165 (744 SE2d 686) (2013). 7

Similarly, we conclude that OCGA § 10-1-393.8, which is part of the Fair Business Practices Act of 1975 (the “FBPA”) as amended, 8 cannot serve as the source of such a statutory duty. That Code section provides that, except as otherwise provided, “a person, firm, or corporation shall not: . . . [p]ublicly post or publicly display in any manner an individual’s social security number. ... ‘[P]ublicly post’ or ‘publicly display’ means to intentionally communicate or otherwise make available to the general public[.]” OCGA § 10-1-393.8. As the trial court noted in the appealed order, the FBPA expressly prohibits intentionally communicating a person’s Social Security number, while McConnell alleges that the Department negligently disseminated his Social Security number by failing “to take the necessary precautions required to safeguard and protect the personal information from unauthorized disclosure.” Although the FBPA imposes a standard of conduct to refrain from intentionally and publicly posting or displaying Social Security numbers, 9 a legal duty to refrain from doing something intentionally is not equivalent to a duty to exercise a degree of care to avoid doing something unintentionally, which falls within the ambit of negligence. The trial court correctly concluded that McConnell’s complaint is premised on a duty of care to safeguard personal information that has no source in Georgia statutory law or case law and that his complaint therefore failed to state a claim of negligence. Diamond v. Dept. of Transp., 326 Ga. App. 189, 195-196 (2) (756 SE2d 277) (2014).

Given the General Assembly’s stated concern about the cost of identity theft to the marketplace and to consumers, as well as the fact that it created certain limited duties with regard to personal information (e.g., the duty to notify affected persons of data breaches and the duty not to intentionally communicate information such as Social Security numbers to the general public), it may seem surprising that our legislature has so far not acted to establish a standard of conduct intended to protect the security of personal information, as some other jurisdictions have done in connection with data protection and data breach notification laws. 10 It is beyond the scope of judicial authority, however, to move from aspirational statements of legislative policy to an affirmative legislative enactment sufficient to create a legal duty. 11

2. McConnell contends that the trial court erred in dismissing his breach of fiduciary duty claim for failure to state a claim upon which relief can be granted based on its determination that he had not shown that he had a particular relationship of trust or mutual confidence with the Department. “Establishing a claim for breach of fiduciary duty requires proof of three elements: (1) the existence of a fiduciary duty; (2) breach of that duty; and (3) damage proximately caused by the breach.” (Citation and punctuation omitted.) Wells Fargo Bank v. Cook, 332 Ga. App. 834, 842 (1) (b) (775 SE2d 199) (2015).

Any relationship shall be deemed confidential, whether arising from nature, created by law, or resulting from con tracts, where one party is so situated as to exercise a controlling influence over the will, conduct, and interest of another or where, from a similar relationship of mutual confidence, the law requires the utmost good faith, such as the relationship between partners, principal and agent, etc.

OCGA § 23-2-58.

McConnell argues that, because a fiduciary relationship, in addition to being created by statute or contract, may also be created by the facts of a particular case, a claim for breach of fiduciary duty is uniquely unsuitable for disposition via a motion to dismiss, when the plaintiff has not been able to conduct discovery. 12 In his complaint, McConnell alleged that a fiduciary duty arose when the Department required him to disclose confidential personal identification information in order to obtain services or benefits from the Department and that he reasonably placed his trust and confidence in the Department to safeguard and protect his information from public disclosure. He contends that the Department was “so situated as to exercise a controlling influence over . . . [his] interest” because, unless he provided his personal information to the Department, he would not receive unemployment benefits, resulting in a fiduciary relationship.

In a recent case, a bank employee gave a customer’s information to the employee’s husband, which allowed her husband to steal the customer’s identity. Jenkins v. Wachovia Bank, 314 Ga. App. 257 (724 SE2d 1) (2012), reversed in part on other grounds sub nom. Wells Fargo Bank v. Jenkins, 293 Ga. 162 (744 SE2d 686) (2013), and opinion vacated in part, 325 Ga. App. 376 (752 SE2d 633) (2013). The customer sued the bank, asserting claims that the bank negligently failed to protect his personal information, breached a duty of confidentiality, and invaded his privacy. 314 Ga. App. at 257. The customer alleged that the bank “falsely represented to its customers and members of the general public that it created and implemented a system to adequately protect the private and personal identifying information entrusted to it by its customers[.]” Id. Noting that the bank-customer relationship generally is not a confidential relationship under Georgia law, this Court held that the plaintiff had not pled “any special circumstances showing that he had a particular relationship of trust or mutual confidence with [the bank].” Id. at 262 (2). 13 In other words, the fact that the plaintiff gave the bank his personal information to receive services, and the bank promised to protect this information, did not create a confidential relationship under Georgia law. Likewise, in alleging in this case that he gave the Department his personal information as a prerequisite to receiving services, with the expectation that the Department would protect his information, McConnell failed to assert in his complaint facts showing that the Department owed him a confidential duty to protect that information. Id. at 261-262 (2). 14

3. McConnell contends that the trial court erred in ruling that he failed to state a claim upon which relief can be granted for invasion of privacy, public disclosure of private facts, based, inter alia, on its determination that the elements of that tort cannot be satisfied unless the facts at issue are embarrassing private facts. McConnell argues:

Georgia law recognizes a variety of information as private and not subject to public disclosure, including certain financial and banking records, medical records, certain police records (particularly records of juvenile crime) and records related to status as a victim of a crime (particularly sexual assault). The law recognizes a claim for unauthorized disclosure of private information in these circumstances.

Under Georgia law,

there are four disparate torts under the common name of invasion of privacy. These four torts maybe described briefly as: (1) intrusion upon the plaintiff’s seclusion or solitude, or into his private affairs; (2) public disclosure of embarrassing private facts about the plaintiff; (3) publicity which places the plaintiff in a false light in the public eye; and (4) appropriation, for the defendant’s advantage, of the plaintiff’s name or likeness.

(Citation and punctuation omitted.) Bullard v. MRA Holding, 292 Ga. 748, 751-752 (2) (740 SE2d 622) (2013). There are at least three necessary elements for recovery for

[p]ublie disclosure of embarrassing private facts about the plaintiff[,] . . . : (a) the disclosure of private facts must be a public disclosure; (b) the facts disclosed to the public must be private, secluded or secret facts and not public ones; (c) the matter made public must be offensive and objectionable to a reasonable man of ordinary sensibilities under the circumstances.

Cabaniss v. Hipsley, 114 Ga. App. 367, 372 (2) (151 SE2d 496) (1966). See also Thomason v. Times-Journal, 190 Ga. App. 601, 604 (4) (379 SE2d 551) (1989) (accord).

In Cumberland Contractors v. State Bank & Trust Co., the plaintiffs claimed that the defendant bank’s publication of their Social Security numbers could result in identify theft, credit card fraud, and other offenses that might damage them personally and financially We held that such allegations

do not fall within the causes of action for invasion of privacy because there is no allegation that [the defendant] (1) intruded into the [plaintiffs’] seclusion, (2) disclosed embarrassing private facts, (3) depicted the [plaintiffs] in a false light, or (4) appropriated the [plaintiffs’] name or likeness for [the defendant’s] own advantage.

Cumberland Contractors v. State Bank & Trust Co., 327 Ga.App. 121, 126 (2) (a) (755 SE2d 511) (2014). As a result, we held, the trial court properly dismissed the plaintiffs’ claim for invasion of privacy for failure to state a claim for relief under Georgia law. Id. The trial court in this case properly dismissed McConnell’s invasion of privacy claim for the same reason. Id.; Jenkins v. Wachovia Bank, 314 Ga. App. at 262-263 (3); 15 Cabaniss v. Hipsley, 114 Ga. App. at 372 (2).

Decided June 16, 2016 Cohen, Cooper, Estep & Allen, Scott A. Schweber, Jefferson M. Allen, for appellants. Samuel S. Olens, Attorney General, Kirsten S. Daughdril, Senior Assistant Attorney General, A. Ellen Cusimano, Assistant Attorney General, for appellee.

Judgment affirmed.

Branch and Mercier, JJ., concur.

1 We note that these factual allegations are not disputed. The Department admitted creating the spreadsheet and admitted that the spreadsheet included McConnell’s name, Social Security number, home phone number, age, and e-mail address. It admitted that its employee, in attempting to send the spreadsheet to another Department employee, inadvertently sent the spreadsheet via e-mail to approximately 1,000 recipients. In addition, the Department admitted that the information was “personal information” under Georgia law. See Division 1, infra.

2 As to McConnell’s claim for negligence, the trial court also determined that Georgia’s Tort Claims Act, OCGA § 50-21-20 et seq., does not waive the State’s sovereign immunity for the types of “loss” McConnell claims.

3 See OCGA § 51-1-6 (“When the law requires a person to perform an act for the benefit of another or to refrain from doing an act which may injure another, although no cause of action is given in express terms, the injured party may recover for the breach of such legal duty if he suffers damage thereby.”); OCGA § 51-1-8 (“Private duties may arise from statute or from relations created by contract, express or implied. The violation of a private duty, accompanied by damage, shall give a right of action.”); see also Wells Fargo Bank v. Jenkins, 293 Ga. 162, 164 (744 SE2d 686) (2013) (A legal duty that will support an actionable claim of negligence “cannot rest solely upon OCGA § 51-1-6 because this statute sets forth merely general principles of tort law. By its express terms, tort liability under OCGA § 51-1-6 mandates that the alleged tortfeasor[ ] ha[s] breached a legal duty to perform a beneficial act or to refrain from doing an injurious act. So, the legal duty to support [a plaintiff’s] negligence claim must be found in another legislative enactment” beside OCGA § 51-1-6.) (citation omitted); City of Douglasville v. Queen, 270 Ga. 770, 771 (1) (514 SE2d 195) (1999) (The first element of a cause of action for negligence is “[a] legal duty to conform to a standard of conduct raised by the law for the protection of others against unreasonable risks of harm [.] ”) (citation and punctuation omitted); Diamond v. Dept. of Transp., 326 Ga. App. 189, 195 (2) (756 SE2d 277) (2014) (“[D]uty arises either from statute or from a common law principle recognized in the case law.”) (citation omitted); Pulte Home v. Simerly, 322 Ga. App. 699, 705 (3) (746 SE2d 173) (2013) (“It is well-settled that Georgia law allows the adoption of a statute or regulation as a standard of conduct so that its violation becomes negligence per se. OCGA § 51-1-6 authorizes a plaintiff to recover damages for the breach of a legal duty even when that duty arises from a statute that does not provide a private cause of action. OCGA § 51-1-6 does not create a legal duty but defines a tort and authorizes damages when a legal duty is breached.”) (citation and punctuation omitted); Rockefeller v. Kaiser Foundation Health Plan of Georgia, 251 Ga. App. 699, 702-703 (1) (554 SE2d 623) (2001) (To determine whether the violation of a statute is negligence per se “it is necessary to examine the purposes of the legislation and decide (1) whether the injured person falls within the class of persons it was intended to protect and (2) whether the harm complained of was the harm it was intended to guard against.”) (citations, punctuation and footnote omitted).

4 In his appellate brief, McConnell avers that

data privacy and tort law related to disclosure of personal identifying information (“PH") js a new an(i emerging area of law. It is rare to find a prior court opinion “on all fours” with the facts of any given information disclosure case. However, when one views the facts of this case in light of general common-law principles of tort law, it is not difficult to see how and why the law does and should recognize tort causes of action where a defendant discloses PII without proper authorization or permission of the persons whose PII is disclosed.

We note that a federal district court recently stated:

Georgia recognizes a general duty to all the world not to subject them to an unreasonable risk of harm_The Court declines the Defendant’s invitation to hold that it had no legal duty to safeguard information even though it had warnings that its data security was inadequate and failed to heed them. To hold that no such duty existed would allow retailers to use outdated security measures and turn a blind eye to the ever-increasing risk of cyber attacks, leaving consumers with no recourse to recover damages even though the retailer was in a superior position to safeguard the public from such a risk.. . . Because this Court finds that a duty does exist, the [Defendant’s] motion to dismiss [the Plaintiffs’ negligence claim] on the ground that there was no duty should also be denied.

(Punctuation omitted.) In re: The Home Depot, Inc., Customer Data Security Breach Litigation, 2016 WL 2897520, Case No. 1:14-MD-2583-TWT (N.D. Ga., decided May 18, 2016), citing Bradley Center v. Wessner, 250 Ga. 199 (296 SE2d 693) (1982). In Bradley Center v. Wessner, the Supreme Court of Georgia found a legal duty “arising] out of the general duty one owes to all the world not to subject them to an unreasonable risk of harm. This has been expressed as follows: negligence is conduct which falls below the standard established by law for the protection of others against unreasonable risk of harm. Restatement, Torts, 2d, § 282.” (Punctuation omitted.) 250 Ga. at 201. Despite the expansive language regarding a general duty owed “to all the world” however, the issue presented in Bradley Center v. Wessner was quite narrow: “whether an individual other than the patient can recover for the alleged malpractice of the physician where that person is injured by the criminal conduct of the patient and there is no privity between the injured party and the physician.” 250 Ga. at 200. Noting that, “as a general rule, there is no duty to control the conduct of third persons to prevent them from causing physical harm to others [,] the Supreme Court held that one of the exceptions to that rule applied “because of the special relationship which existed between” the patient, who killed his wife and her paramour while on a weekend pass from a psychiatric hospital, and the physician, in a situation “where the course of treatment of a mental patient involve[d] an exercise of control over him by a physician who knows or should know that the patient is likely to cause bodily harm to others.” (Citations and punctuation omitted.) Id. at 201. See also City of Rome v. Jordan, 263 Ga. 26, 28-29 (1) (426 SE2d 861) (1993) (citing Bradley Center v. Wessner in analyzing whether there can be liability based on a municipality’s duty to protect the general public from criminal conduct and holdingthat “where there.is a special relationship between the individual and the municipality which sets the individual apart from the general public and engenders a special duty owed to that individual, the municipality may be subject to liability for the nonfeasance of its police department”) (footnote omitted; emphasis in original); City of Douglas v. Hudson, 315 Ga. App. 20, 22-23 (726 SE2d 496) (2012) (accord). There is no evidence of any such special relationship in this case. As for the recent federal case, In re: The Home Depot, Inc., Customer Data Security Breach Litigation, we are not bound to follow the district court’s interpretation of Georgia law. Moreover, the district court found a duty to protect the personal information of the defendant’s customers in the context of allegations that the defendant failed to implement reasonable security measures to combat a substantial data security risk of which it had received multiple warnings dating back several years and even took affirmative steps to stop its employees from fixing known security deficiencies. There are no such allegations in this case.

5 See Ga. L. 2007, p. 450 (Act 241), § 1 (for name designation).

6 The GPIPA requires a government entity (as a “data collector”) “that maintains computerized data that includes personal information of individuals” to give prompt notice to affected Georgia residents of any security breach, that is, acquisition of unencrypted personal information by any unauthorized person, and to notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the notices. OCGA § 10-1-912. See OCGA § 10-1-911 (1) (definition of a “breach of the security of the system”), (2) (definition of a “data collector”), (4) (definition of “notice”). The GPIPA’s definition of “personal information” includes an individual’s first andlast name incombination with the person’s Social Security number. OCGA § 10-1-911 (6). Another example is a person’s name in combination with a credit or debit card number, if under the circumstances the number could be used without a password or other information. Id.

7 In Wells Fargo Bank v. Jenkins, a bank customer based a claim of negligence on the bank’s failure to protect his personal information and asserted that the legal duty to support his negligence claim was found in the federal Gramm-Leach-Bliley Act, the “GLBA,” 15 USC § 6801 et seq. The Supreme Court of Georgia explained that, although the GLBA “expressly authorizes federal agencies ... to establish appropriate standards” for financial institutions “relating to administrative, technical, and physical safeguards,” including safeguards “to protect against unauthorized access to or use of [customers’] records or information which could result in substantial harm or inconvenience to any customer,” see 15 USC § 6801 (a), such “an aspirational statement of Congressional policy” should not be “misread... as establishing a legal duty, the alleged breach of which would give rise under the law of this State to a cause of action for negligence against financial institutions.” 293 Ga. at 164-165.

8 OCGA § 10-1-390 (OCGA §§ 10-1-390 through 10-1-408 shall be known as the “Fair Business Practices Act of 1975.”).

9 The trial court questioned whether the Department is “a person, firm, or corporation” subject to OCGA § 10-1-393.8. But the Department does not contend that it is not subject to the statute. See OCGA §§ 10-1-392 (24) (For purposes of the FBPA, including OCGA § 10-1-393.8, “ ‘[pjerson means a natural person, corporation, trust, partnership, incorporated or unincorporated association, or any other legal entity.”); 34-2-1 (“There is created and established a separate and independent administrative agency to be known as the Department of Labor.”); Foskey v. Vidalia City School, 258 Ga. App. 298, 301 (b) (574 SE2d 367) (2002) (“When a governmental entity or quasi-public entity has independent legal status as a public corporation, agency, or authority, the legislative act creating such governmental entity generally confers one or more of the power and authority to contract, hold property, eminent domain, or sue and be sued. The fact that a governmental entity may have sovereign immunity from a tort action does not prevent such entity from being a separate legal entity or an entity that may sue and be sued.”) (citations omitted).

10 See, e.g., Ark. Code Ann. § 4-110-104 (b) (In the Arkansas Personal Information Protection Act: “A person or business that acquires, owns, or licenses personal information about an Arkansas resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”); Cal. Civ. Code § 1798.81.5 (In the California Database Breach Act: “It is the intent of the Legislature to ensure that personal information about California residents is protected.... Abusiness that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”); Fla. Stat. Ann. § 501.171 (2) (“Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information.”); Md. Code Ann., Commercial Law § 14-3503 (In the Maryland Personal Information Protection Act: “To protect personal information from unauthorized access, use, modification, or disclosure, a business that owns or licenses personal information of an individual residing in the State shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned or licensed and the nature and size of the business and its operations.”); Md. Code Ann., State Government § 10-1304 (“To protect personal information from unauthorized access, use, modification, or disclosure, a [state government] unit that collects personal information of an individual shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information collected and the nature of the unit and its operations.”); Nev. Rev. Stat. Ann. § 603A.210 (1) (“A data collector that maintains records which contain personal information of a resident of this State shall implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure.”); Rhode Island Gen. Laws Ann. § 11-49.3-2 (a) (In the Rhode Island Identity Theft Protection Act of 2015: “A municipal agency, state agency or person that stores, collects, processes, maintains, acquires, uses, owns or licenses personal information about a Rhode Island resident shall implement and maintain a risk-based information security program that contains reasonable security procedures and practices appropriate to the size and scope of the organization; the nature of the information; and the purpose for which the information was collected in order to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve the confidentiality, integrity, and availability of such information.”).

11 See Wells Fargo Bank v. Jenkins, 293 Ga. at 165 (The judiciary must not misread “an aspirational statement of legislative policy” as an affirmative legislative enactment that establishes a legal duty, as that would usurp legislative authority.); Blotner v. Doreika, 285 Ga. 481, 481-482 (1) (678 SE2d 80) (2009) (Where a particular common law duty was not recognized in Georgia, the common law rule could be changed only by legislative act.); Perdue v. Baker, 277 Ga. 1, 14 (586 SE2d 606) (2003) (“The core legislative function is the establishment of public policy through the enactment of laws.”) (footnote omitted); Commonwealth Investment Co. v. Frye, 219 Ga. 498, 499 (134 SE2d 39) (1963) (Our appellate courts’ authority extends only to the correction of errors of law, and we have no legislative powers or functions. “[T]he legislature, and not the courts, is empowered by the Constitution to decide public policy, and to implement that policy by enacting laws; and the courts are bound to follow such laws if constitutional.”).

12 See Wright v. Apartment Investment & Mgmt. Co., 315 Ga. App. 587, 592 (2) (a) (726 SE2d 779) (2012) (“[SJince a confidential relationship may be found whenever one party is justified in reposing confidence in another, the existence of a confidential or fiduciary relationship is generally a factual matter for the jury to resolve.”).

13 See Jenkins v. Wachovia Bank, 325 Ga.App. 376, 377 (752 SE2d 633) (2013) (Because the Supreme Court in Wells Fargo Bank v. Jenkins, 293 Ga. 162, did not address or consider Division 2 of our earlier opinion in Jenkins v. Wachovia Bank, 314 Ga. App. 257 (724 SE2d 1) (2012), and because that portion of our earlier opinion was consistent with the Supreme Court’s opinion, that division remains binding.).

14 Cf. Daly v. Metropolitan Life Ins. Co., 4 Misc. 3d 887, 892 (782 NYS2d 530, 535) (N.Y. Sup. Ct. 2004) (When the plaintiff wished to purchase a life insurance policy from the defendant, she was required to, and agreed to supply the company with highly sensitive personal information including her full name, her Social Security number, and her date of birth. The trial court concluded that, under New York law, there was in this agreement an implied covenant of trust and confidence that the defendant would safeguard and protect the plaintiff’s personal information, as evidenced by the defendant’s privacy notice to its customers stating that they took great care in safeguarding customers’ personal information. The court noted, “[w]hile this concept has never before been applied to issues surrounding the protection of confidential personal information, perhaps in the absence of appropriate legislative action, it should.”).

15 See Jenkins v. Wachovia Bank, 325 Ga.App. at 377 (Because the Supreme Court in Wells Fargo Bank v. Jenkins, 293 Ga. 162, did not address or consider Division 3 of our earlier opinion in Jenkins v. Wachovia Bank, 314 Ga.App. 257, and because that portion of our earlier opinion was consistent with the Supreme Court’s opinion, that division remains binding.).