Georgia Supreme Court Holds That Gramm-Leach-Bliley Statutory Policy Statement Does Not Create Legal Duty Under State Negligence Law

The Georgia Supreme Court recently reversed a plaintiff’s state law claim for negligence against a bank premised upon an alleged Gramm-Leach-Bliley violation, concluding that the statutory provision used as the basis for the claim does not provide a legal duty under Georgia negligence law. Wells Fargo Bank, N.A. v. Jenkins, No. S12G1110, 2013 WL 2927096 (Ga. June 17, 2013).

In the case, the plaintiff alleged that a bank teller disclosed the plaintiff’s confidential information to the teller’s husband, causing the plaintiff to suffer identity theft. The plaintiff sued the bank for negligence, pointing to 15 U.S.C. § 6801(a), part of the Gramm-Leach-Bliley Act (“GLBA”), to establish a legal duty. That provision states:

It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information.

The Georgia Supreme Court concluded that this provision of GLBA does not support a negligence claim under Georgia law because “there must be the alleged breach of a legal duty with some ascertainable standard of conduct.” The court concluded that this GLBA section was merely a policy statement that “does not provide for certain duties or the performance of or refraining from any specific acts on the part of financial institutions, nor does it articulate or imply a standard of conduct or care, ordinary or otherwise. “

Plaintiffs sometimes seek to allege negligence or other state law claims (e.g., unfair business practices) premised upon federal statutes, such as GLBA (as was the case in Jenkins) and HIPAA, neither of which independently provide a private right of action. Although several states permit a plaintiff to borrow from another law (including federal laws with no private right of action) to plead a state law claim, the existence of federal laws do not guarantee that the plaintiff can successfully plead a cause of action – as seen in this Georgia case and in an Illinois case involving HIPAA that we’ve previously blogged about. Companies facing state law claims premised upon the violation of a policy statement found in a federal statute might want to keep the citation to Jenkins at hand.