Adams v. Congress Auto Insurance Agency, Inc.

Henry, I. This case arose from an employee’s improper use of confidential information accessed through her workplace com *762 puter. The employee gave that information to her boy friend, who used it to intimidate a witness, Mark Adams. Adams brought this action against the employer, Congress Auto Insurance Agency, Inc. (Congress Agency or agency). A Superior Court judge dismissed four of his five claims. The case proceeded to discovery on the remaining claim against the agency that alleged negligent failure to safeguard Adams’s personal information. The same judge subsequently granted the agency’s motion for summary judgment on the remaining count and in the same memorandum and order denied Adams’s motion to amend his complaint to reinstate the dismissed claims and to add a claim for violation of 18 U.S.C. §§ 2721-2725. Adams appealed. We affirm in part and reverse in part. 1. Summary judgment. “The standard of review of a grant of summary judgment is whether, viewing the evidence in the light most favorable to the nonmoving party, all material facts have been established and the moving party is entitled to judgment as a matter of law.” Lev v. Beverly Enterprises-Mass., Inc., 457 Mass. 234, 237 (2010) (Lev), quoting from Cargill, Inc. v. Beaver Coal & Oil Co., 424 Mass. 356, 358 (1997). The burden rests on the defendant, as the moving party, to affirmatively demonstrate the absence of a genuine issue of material fact on every relevant issue. Ibid. a. Facts. Viewed in the light most favorable to Adams, as required at this stage of the proceedings, the summary judgment record discloses the following facts. Congress Agency hired Elizabeth Burgos in August, 2003, as a customer service representative, promoting her to customer service manager in 2010. Burgos, through her work computer, had access to the data systems of Safety Insurance Company (Safety) and, through Safety’s Internet portal, to records maintained by the registry of motor vehicles (RMV). Safety insures Burgos’s vehicle. In 2010, Congress Agency, by its president and owner, Gordon Owades, drafted a data security plan for ensuring the protection of personal information of the residents of the Commonwealth. Owades trained all agents, including Burgos, on the data security policies. One company policy prohibited employees from accessing or using a driver’s personal information, obtained in the course of the employee’s work, for personal purposes. In addition, each time a Congress Agency employee wished to access the RMV database through the Safety portal, Safety required the agent to affirmatively agree to use the information obtained for one of four limited purposes: claims investigation *763 activities, anti-fraud activities, rating, and underwriting. 1 On July 13, 2012, Burgos’s boy friend, Daniel Thomas, engaged in a high-speed flight from police while driving Burgos’s Mercedes automobile. At that time, Thomas was on supervised release for a Federal firearm violation, and was driving without a valid license. During his flight, Thomas struck a vehicle operated by the plaintiff, Mark Adams. Thomas abandoned the Mercedes and fled. On July 24, 2012, Adams, who had filed a claim against Burgos’s automobile policy, gave a statement to a Safety claims adjuster investigating the accident. He informed the adjuster that he could identify the driver of the Mercedes and provided his contact information, including his cellular telephone number and home address. Meanwhile, Burgos reported her vehicle stolen to the police, and subsequently filed her own insurance claim for the loss with Safety. Burgos, using her access to confidential data through the agency, obtained information about her own claim, and learned Adams’s identity as the individual who had filed a claim against her Safety insurance policy and his contact information. The next day, Adams received a threatening telephone call from Thomas. 2 Adams immediately reported the threat to the authorities. The State police visited the agency’s office on August 28, 2012; Burgos refused to speak with them. Congress Agency continued to provide Burgos access to the Safety databases and to the RMV records. On December 13, 2012, Owades terminated Burgos for “her serious misuse of access to confidential information.” On January 9, 2013, in the Boston Municipal Court (BMC), Burgos and Thomas admitted to sufficient facts and pleaded guilty to witness intimidation and conspiracy in connection with the threat made to Adams. In particular, Burgos admitted that she had used her position at the agency to obtain Adams’s date of birth, address, and cellular telephone number. *764 Discovery in this matter provided additional information about an earlier incident when Burgos engaged in criminal behavior with, or to protect, her boy friend. Specifically, on June 19, 2010, while Thomas and Burgos were driving cross country, the Iowa State police stopped the vehicle for speeding. In the vehicle the police discovered two loaded semiautomatic firearms concealed in Burgos’s purse, ammunition, a receipt for the purchase of additional ammunition in Burgos’s day book, a half-face mask, and a police scanner. One handgun was stolen; the other had its serial number defaced. Thomas claimed he knew nothing about the weapons and ammunition, while Burgos admitted to the police that they were hers. Burgos and Thomas were arrested and eventually indicted for possession of a firearm with an obliterated serial number. After Burgos had been released on bail, she returned to Massachusetts and continued to work at Congress Agency. On October 21, 2010, the United States Marshals Service arrested Burgos at the agency’s office. The office manager notified Owades of Bur-gos’s arrest. Upon her return to work four days later, Burgos explained to Owades that there had been “a misunderstanding as to who was in possession of the firearm at the time of the incident in Iowa”; the gun belonged to her boy friend; she had not known it was present in the vehicle prior to its discovery by the police; its presence was frankly a “shock” to her; “ultimately, she would be exonerated”; and “[the misunderstanding] was not going to affect her ability to work.” Burgos informed Owades that Thomas had gone to jail. Owades conducted no independent investigation into the circumstances of her arrest because he “did not at the time think it was germane to her employment.” Burgos subsequently told Owades that she had some legal “arrangement” with the authorities that would last a year. 3 At the end of that time period, Burgos informed Owades that the matter had been resolved. In fact, following her completion of the diversion program, the United States Attorney dismissed the indictment on May 24, 2012. 4 Approximately seven weeks later, Thomas struck Adams’s vehicle. *765 b. Discussion. A plaintiff must prove four elements in order to prevail on a negligence claim: (1) duty; (2) breach of duty; (3) a causal connection between the breach of duty and damages; and (4) damages. See Jupin v. Kask, 447 Mass. 141, 146 (2006). In its motion for summary judgment, the agency challenged Adams’s ability to satisfy each of these elements of the tort of negligent failure to safeguard personal information. The motion judge agreed, ruling that expert testimony was required to establish whether the agency owed a duty to Adams to safeguard his personal information, what that duty entailed, and whether the agency breached that duty. The motion judge also found that Adams was unable to prove that the agency’s negligence was the proximate cause of injury to Adams. The existence of a legal duty is a question of law determined “by reference to existing social values and customs and appropriate social policy.” See id. at 143, quoting from Cremins v. Clancy, 415 Mass. 289, 292 (1993). The other three elements ordinarily are questions of fact for the jury. See id. at 146. i. Legal duty. As a general rule, a party has no duty to control another person’s conduct to prevent that person from causing harm to a third person. See Leavitt v. Brockton Hosp., Inc., 454 Mass. 37, 40-41 (2009) (Leavitt). Well-established exceptions to that rule are recognized in the employment context. At common law, an employer owed the duty to exercise reasonable care in the selection and retention of employees that have contact with members of the public. See Carson v. Canning, 180 Mass. 461, 462 (1902); Foster v. The Loft, Inc., 26 Mass. App. Ct. 289, 290-291 (1988) (Foster). More recently, courts have recognized a potential duty of care owed by employers where the employment facilitates the employee’s causing harm to third parties. See Restatement (Third) of Torts: Liability for Physical and Emotional Harm § 41 (2012). See also Leavitt, supra at 41 & n.10; Lev, 457 Mass. at 242-244; Roe No. 1 v. Children’s Hosp. Med. Center, 469 Mass. 710, 714 & n.7 (2014); Doe v. Boston Med. Center Corp., 88 Mass. App. Ct. 289, 291 (2015). In deciding whether a special relationship exists between a particular plaintiff and defendant, our foremost consideration is whether “a defendant reasonably could foresee that he would be expected to take affirmative action to protect the plaintiff and could anticipate harm to the plaintiff from the failure to do so.” Irwin v. Ware, 392 Mass. 745, 756 (1984). “All the circumstances are examined in defining the scope of a duty of care based on the *766 reasonable foreseeability of harm.” Whittaker v. Saraceno, 418 Mass. 196, 199 (1994). In the circumstances of this case, we conclude that the agency had a legal duty to Adams, a member of a large but clearly defined class of third parties, to prevent its employee’s foreseeable misuse of the information that Adams provided to process his automobile insurance claim. 5 ii. Breach of duty. We hold that a jury reasonably could find that Congress Agency breached its legal duty to Adams under two possible theories: the conflict of interest inherent in allowing Burgos unrestricted access to information relating to a claim against her own insurance policy; and the failure to investigate Burgos’s continuing fitness for access to the confidential information of others available through her employment. First, a jury reasonably could find that the agency breached its duty to protect the confidential information entrusted to it or Safety by failing to prevent a conflict of interest that arises from its employees having unrestricted access to their own claim information. In this case, Burgos was able to retrieve information about the pending claim by Adams against her policy, including the notes from the Safety claims adjuster that contained Adams’s identity and contact information. Allowing employees to access the confidential information of claimants against them during the adjustment process potentially creates a conflict of interest, and a jury reasonably could find the agency negligent without the necessity of expert testimony. See Herbert A. Sullivan, Inc. v. Utica Mut. Ins. Co., 439 Mass. 387, 402-403 (2003) (“The test for determining whether a particular matter is a proper one for expert testimony is whether the testimony will assist the jury in understanding issues of fact beyond their common experience”). *767 Second, a jury could find that Congress Agency was negligent when it accepted Burgos’s version other criminal involvement in the Federal firearms indictment without independent investigation. An employer may be held liable for negligence if it “becomes aware or should have become aware of problems with an employee that indicated [her] unfitness, and the employer fails to take further action such as investigating, discharge or reassignment.” Foster, 26 Mass. App. Ct. at 291, quoting from Garcia v. Duffy, 492 So. 2d 435, 438-439 (Fla. Dist. Ct. App. 1986). The scope of an employer’s duty to undertake prudent investigation into the fitness of an employee “is directly related to the severity of risk third parties are subjected to by [the] employee.” Heng Or v. Edwards, 62 Mass. App. Ct. 475, 488 (2004) (Heng Or), quoting from Ponticas v. K.M.S. Invs., 331 N.W.2d 907 (Minn. 1983). 6 Here, the access to confidential personal information of the citizens of the Commonwealth and others inherent in Burgos’s employment heightened the potential risk that she posed to third parties. Just as those with physical keys to the homes of others have a duty of reasonable care to preserve their security, companies whose employees have access to the confidential data of others have a duty to take reasonable measures to protect against the misuse of that data. Reviewing the record in the light most favorable to Adams, as we must at this stage, if Congress Agency had investigated, it could have discovered facts that called into question Burgos’s honesty and fitness for access to other people’s personal information. An investigation by the agency could have revealed that Burgos was not forthright with Owades, that at a minimum she had been involved with illegal firearms, and that she either concealed her own involvement or lied at her own peril to protect her boy friend. A jury could find that these facts would have placed the agency on notice that its employee was sufficiently untruthful to merit further consideration whether she should continue to have access to databases containing confidential information. In reaching this conclusion, we consider Heng Or, supra, to be particularly instructive. In Heng Or, the defendant, the owner of *768 an apartment building, gave several apartment keys to a handyman, Vao Sok. See id. at 479-480. At the time of the entrustment, the defendant knew that Sok was a jobless, homeless drifter with addiction problems. See id. at 482. Without further inquiry, the defendant accepted Sok’s inaccurate report of his legal troubles. See id. at 481. The defendant could have learned that Sok had an uncontrollable temper; that tenants in the building feared him and would not leave their children alone with him; and that, prior to the time Edwards entrusted Sok with the keys, Sok stood indicted for kidnapping and raping a young girl. See id. at 481-482. Sok raped and asphyxiated a young child in one of the apartments to which the keys gave him access. On this evidence, this court concluded the defendant was fairly found liable in negligence for hiring and entrusting the keys to an unht individual. See id. at 476. The court also concluded that the jury were warranted in hnding that the violent attack fell within the range of reasonably foreseeable harms created by the failure to make due inquiries about Sok in combination with the entrustment of keys. See id. at 487-488. It is a question for a jury whether, based on the information it knew or could have known at the time, the agency should have continued to allow Burgos continued access to conhdential information. iii. Proximate cause. The motion judge concluded that Congress Agency was entitled to summary judgment based on the intervening, superseding criminal acts of Burgos and Thomas. 7 We disagree. The necessary causal connection may be found “[if] the injury to the plaintiff was a foreseeable result of the defendant’s negligent conduct.” Kent v. Commonwealth, 437 Mass. 312, 320 (2002). “Where the intervening occurrence was foreseeable by a defendant, the causal chain of events remains intact and the original negligence remains a proximate cause [of the plaintiffs injury].” 8 Zinck v. Gateway Country Store, Inc., 72 Mass. App. Ct. 571, 578 (2008), quoting from Delaney v. Reynolds, 63 Mass. *769 App. Ct. 239, 242 (2005). The intervening acts of Burgos here were not so improbable as to remove the foreseeability question from the special province of the jury. See id. at 578-579. Nor was the harm sustained by Adams so “highly extraordinary” as to relieve the agency of liability. Id. at 578, quoting from Heng Or, 62 Mass. App. Ct. at 486. A jury could conclude that Congress Agency was put on notice that Burgos should not have been entrusted with access to the confidential information of others, especially where that information could involve a claim against her or her boy friend. The agency knew of the weapons charge and it could have learned of Burgos’s misrepresentation about that charge to Owades, that the weapons charge involved concealment and possible violence, and of Burgos’s willingness to commit a crime with, or to protect, her boy friend. Congress Agency’s reliance on Coughlin v. Titus & Bean Graphics, Inc., 54 Mass. App. Ct. 633 (2002) (Coughlin), to show the absence of negligence is misplaced, as it is distinguishable on the facts. In that case, the employer, a small company in the business of manufacturing signs, took a chance by hiring Michael Kelley, a released sexually dangerous person with a long criminal record. See id. at 636-637. At the time of hiring, the employer knew Kelley had been incarcerated for fourteen years for committing a violent crime. See id. at 637. The employer placed precautionary limitations on the position; it assigned Kelley to work alone in a warehouse away from contact with its customers and other employees and did not provide him with keys to the warehouse. See id. at 637 & n.6. A background check would have revealed favorable professional opinions supporting Kelley’s parole. See id. at 640 & n.9. Four days into his employment, Kelley, who had a set of keys in his possession, lured a passerby into the warehouse and murdered her before his scheduled shift. See id. at 637-638. In contrast to this case, Coughlin is a case where the employer assessed the risk and took significant steps to limit risk of harm to others. Here, as there was a genuine issue of material fact on the question of foreseeability, summary judgment was inappropriate. 9 *770 iv. Damages. Congress Agency’s argument that Adams’s proof of emotional distress damages was inadequate suffered from the same infirmity as the judge’s analysis: it was based on an improper view of the facts more favorable to the agency than warranted by the summary judgment record. The facts contained within the summary judgment record contain sufficient evidence of Adams’s worsening physical symptoms to warrant the submission of the claim to the jury. See Sullivan v. Boston Gas Co., 414 Mass. 129, 137-140 (1993). While Adams admitted that he had long-standing emotional and sleep problems, he claimed that they worsened over time following Thomas’s threat. On February 14, 2013, shortly after the BMC plea hearing, Dr. Andrew Lenhardt, Adams’s primary care physician, first prescribed temazepam, a medication used for sleep problems related to psychological reasons, for Adams. There was also expert testimony submitted by Adams from Dr. Stephanie Sydney, a licensed clinical psychologist, that Adams’s trauma symptoms included repeated nightmares about the telephone call (that could not have predated it), high anxiety, intrusive thoughts, racing hot flushes, and feelings of detachment. 2. Denial of motion to amend. 10 After discovering that Congress Agency had actual knowledge of Burgos’s 2010 arrest, Adams moved to amend his complaint, seeking to revive the four dismissed claims and to add a new Federal law claim. The specific factual allegations in the proposed amended complaint would have supported a claim for negligent retention and supervision if included in the original complaint. Here, our conclusion that summary judgment should not have entered obviates much of the judge’s reasoning for the denial of the motion to amend. Given our conclusion that the agency owed a legal duty to Adams, the denial of Adams’s motion to amend on the grounds of futility is rendered moot. 11 See Lipsitt v. Plaud, 466 Mass. 240, *771 254-255 (2013). 12 However, we discern no abuse of discretion with respect to the judgment on the remaining common-law and statutory claims. See North Am. Expositions Co. Ltd. Partnership v. Corcoran, 452 Mass. 852, 871-872 (2009). As to these claims, the first amended complaint, like the original complaint, contained insufficient factual allegations to plausibly suggest entitlement to relief. See Jessie v. Boynton, 372 Mass. 293, 295 (1977); Iannacchino v. Ford Motor Co., 451 Mass. 623, 636 (2008) (Iannacchino). Specifically as to Adams’s G. L. c. 93A claim, to the extent it was predicated on negligence alone, it necessarily failed. See Klairmont v. Gainsboro Restaurant, Inc., 465 Mass. 165, 176-177 (2013) (Klairmont) (“in the absence of conduct that qualifies as unfair or deceptive, a negligent act or negligent acts, alone, do not violate [G. L.] c. 93A”). The other alleged basis for c. 93A relief was the agency’s failure “to meet the Commonwealth’s standards regarding the protection of confidential personal information for residents of the Commonwealth.” In certain circumstances, a statutory or regulatory violation may rise to the level of an unfair or deceptive act or practice for purposes of a c. 93A claim. See Klairmont, supra at 173-177. The “standards” to which Adams refers in his proposed amended complaint are not identified. To the extent that the claim was based on the agency’s alleged violations of G. L. c. 93H and the regulations promulgated thereunder, we conclude, as did the motion judge, that the claim was factually insufficient. See G. L. c. 93H, §§ 1-6, added by St. 2007, c. 82, § 16 (governing data breaches) and 201 Code Mass. Regs. §§ 17.00-17.05 (standards for the protection of the personal information of residents of the Commonwealth). As the motion judge noted, the complaint did not allege that Burgos accessed “personal information” as that term is specially defined in c. 93H, and did not identify the required safeguards and procedures that the agency failed to employ. 13 See 201 Code Mass. Regs. §§ 17.03 (standards for protecting personal information) and 17.04 (computer system security requirements). Compare the much more specific allegations of government safety standard noncompliance found insufficient in Iannacchino, supra *772 at 626-633. As Adams had not alleged sufficient facts to state a plausible c. 93A claim on any theory, we discern no abuse of discretion in the denial of so much of the motion seeking to reinstate count V. 14 Conclusion. The order allowing the agency’s motion for summary judgment with respect to count IV is vacated. The order denying Adams’s motion to amend his complaint is vacated with respect to counts II and III of the proposed first amended complaint and is otherwise affirmed. The case is remanded for further proceedings consistent with this opinion. So ordered. Footnotes [1] Safety referenced the provisions of the Federal Drivers Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721-2725, and warned agents about the consequences of the improper use of personal information obtained from the RMV’s records. [2] Thomas claimed to be a State police officer. Thomas told Adams that the driver of the car that struck his was a “very, very dangerous man with very dangerous friends.” Thomas warned Adams to “do [himself] a favor. Shut the F up and get your car fixed or you will have issues.” [3] Burgos entered into an agreement with the United States Attorney for the Southern District of Iowa to participate in the pretrial diversion program, an alternative to criminal prosecution. As a condition of participation in the diversion program, an offender is not asked to admit guilt, but must acknowledge responsibility for the behavior. [4] Thomas pleaded guilty to the Federal weapon charge, and was sentenced to prison followed by supervised release. [5] In fact, the Legislature has established statutory and regulatory duties to take adequate measures to safeguard the confidentiality of the personal information of all Massachusetts residents. See G. L. c. 93H, § 2(a). added by St. 2007, c. 82, § 16 and 201 Code Mass. Regs. §§ 17.00-17.05 (2009) (standards for the protection of the personal information of residents of the Commonwealth). “Personal information” is defined as “a resident’s first name and last name or first initial and last name in combination with any [one] or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver’s license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account.” G. L. c. 93H, § 1(u). See 201 Code Mass. Regs. § 17.02. [6] An employer’s knowledge of an employee’s past conviction of the same or similar crime is one circumstance that may support liability for negligent hiring or retention. See Foster, 26 Mass. App. Ct. at 294-295 & n.7. Where the crimes are entirely unrelated, however, such as a conviction of larceny by check followed by a rape of a customer, the employee’s criminal record, standing alone, would not establish negligence. See id. at 294 n.7. [7] The agency’s argument that Adams has waived this point is unpersuasive. Adams did in fact address the judge’s ruling on causation in his brief. Although Adams did not address the judge’s footnote disposition of the element of harm as matter of law, we decline to apply a strict rule of waiver where the ground did not support the entry of summary judgment as the agency maintains, and the cases relied upon by it to support waiver are distinguishable in material respect. [8] A separate theory of liability arising from the agency’s failure to report Burgos’s arrest to the Division of Insurance in violation of G. L. c. 175, § 162V(b). was inadequately argued and thus waived. See Mass.R.A.P. 16(a)(4), *769 as amended, 428 Mass. 1603 (1999); Electronic Data Sys. Corp. v. Attorney Gen., 454 Mass. 63, 65 n.5 (2009). In any event, it is far from clear that the statute applied in this case where Burgos entered into a diversion agreement in lieu of prosecution. [9] We do, however, conclude that Adams’s theory that the agency should have instituted an employee keystroke monitoring program similar to Safety’s was *770 properly dismissed due to the lack of expert testimony on industry standards and of any triable issue of proximate causation. See Hebert v. Enos, 60 Mass. App. Ct. 817, 820-822 (2004). [10] To the extent the agency challenges the adequacy of the record, the supplemental appendix permits us to conduct a meaningful review. We reach the merits. [11] The judge noted that Adams’s motion to amend his complaint “might be considered unduly delayed or dilatory” but found the futility of the amendment to be determinative. As the motion was not decided based on delay, we do not address the issue here. [12] In light of our resolution of Adams’s challenge to the order denying his motion to amend that sought to reinstate the dismissed claims, see infra, we need not review the order allowing the motion to dismiss those claims. [13] See note 5, supra. [14] In addition to the defective pleading, Adams’s one new claim for violation of DPPA failed for the added reason that the agency, as matter of law, could not be held vicariously liable for the tortious acts of Burgos. Her improper disclosure of that information to Thomas and its use in a criminal conspiracy were plainly acts committed outside the scope of her employment. See Lev, 457 Mass. at 238-239. The fact that plaintiff shifted his theories of liability repeatedly may have contributed to the result below. This loss in the trial court and delay in resolution of the matter should be a cautionary note for such strategy.