John Amabile (from left), Michael Binns and David Pardue of Parker Poe's Atlanta office. (Courtesy photos)

Data breach lawsuits remain an issue of high concern for businesses in 2020. Surveys indicate that many CEOs, including those of mid-market companies, rank the risk of data breaches as among their highest risk concerns for the foreseeable future. (These surveys occurred before the COVID-19 crisis.)

In Georgia, the state Supreme Court late last year issued a ruling that will significantly raise the risks of data breach litigation for companies that have suffered a security breach and, in turn, will likely come with an increase in legal spend associated with defending such lawsuits. It also might serve to make Georgia state courts a favored venue for bringing data breach litigation.

The Georgia Supreme Court issued a ruling on Dec. 23 making it significantly easier for a plaintiff to sue a company that was the victim of a hacker's attack resulting in the loss of personally identifiable information. In Collins v. Athens Orthopedic Clinic, a medical clinic was a victim of a security breach and ransom effort, which it refused to pay. It notified patients that their personal information had been compromised. A class action was filed against the clinic by two of the individuals whose information was stolen. The clinic moved to dismiss the complaint on the grounds that the plaintiffs did not have the type of substantiated harm sufficient to state a claim for relief. This is standard operating procedure in lawsuits alleging harm arising from breaches of a company's data security, although the issue has created a split among federal appellate courts that will likely lead to review by the U.S. Supreme Court at some point.

The Georgia Supreme Court weighed in on the side of the plaintiffs, holding that a complaint merely alleging that an individual's private information was compromised, creating an "imminent and substantial" risk of identity theft, permitted the lawsuit to proceed. The decision is interesting in many respects, not the least of which was the court's tacit acknowledgment that it did not particularly like the outcome. On the one hand, the court took pains to make clear that it was basing its ruling only on the grounds that this was simply a motion to dismiss and the standard is intended to be a low bar. A plaintiff must only be able to show that it could succeed "under any provable facts" which could be asserted to support the claim. In that respect, the court was obviously swayed by the verified allegation that personal information had actually been obtained by bad actors and that the risk of identity theft was "imminent and substantial."

On the other hand, the court also made the point in several spots that this was not a motion for summary judgment or a motion to certify a class, motions for which a plaintiff would have to provide some evidence to permit the claim to advance. The decision also could be read as providing not only a road map for how to plead a complaint that will survive a motion to dismiss, but also as guidance on how to successfully defend against such claims on the merits.

In short, the court seems to acknowledge both that it is possible for a plaintiff to state a claim for damages arising from having his or her private information stolen while also acknowledging the plaintiff may not be likely to succeed on the ultimate merits of the claim.

The potential impact of this ruling on companies doing business in Georgia, however, cannot be understated. This decision makes it more likely that a motion to dismiss for failure to state a claim will not be a quick exit ramp for a company who is sued because it suffered a security breach. This will directly result in a defendant company incurring significant legal expenses having to defend the lawsuit. That, of course, is exactly the type of scenario where a company who suffers a data breach will have to balance potential expenses of litigation against reasonable efforts to resolve the dispute, a less than ideal place for business to be.

And it will likely result in Georgia state courts and those companies doing business in Georgia seeing an uptick in data security litigation, at least until the U.S. Supreme Court weighs in on the type of substantiated harm sufficient to state a claim for relief.

John Amabile, Micheal Binns, and David Pardue are litigators in Parker Poe's Atlanta office.