Adams v. Congress Auto Insurance Agency, Inc.

NOTICE: All slip opinions and orders are subject to formal

revision and are superseded by the advance sheets and bound

volumes of the Official Reports. If you find a typographical

error or other formal error, please notify the Reporter of

Decisions, Supreme Judicial Court, John Adams Courthouse, 1

Pemberton Square, Suite 2500, Boston, MA, 02108-1750; (617) 557-

1030; SJCReporter@sjc.state.ma.us

15-P-452 Appeals Court

MARK ADAMS vs. CONGRESS AUTO INSURANCE AGENCY, INC.

No. 15-P-452.

Middlesex. March 10, 2016. - December 21, 2016.

Present: Kafker, C.J., Vuono, & Henry, JJ.

Negligence, Insurance company, Employer, Foreseeability of harm,

Causation, Retention of employee, Entrustment, Emotional

distress. Damages, Emotional distress. Consumer

Protection Act, Responsibility of employer. Practice,

Civil, Summary judgment, Motion to amend.

Civil action commenced in the Superior Court Department on

April 16, 2013.

Motions for summary judgment and to amend the complaint

were heard by Peter B. Krupp, J.

Henry P. Sorett for the plaintiff.

Jeffrey S. Robbins for the defendant.

HENRY, J. This case arose from an employee's improper use

of confidential information accessed through her workplace

computer. The employee gave that information to her boy friend,

who used it to intimidate a witness, Mark Adams. Adams brought

2

this action against the employer, Congress Auto Insurance

Agency, Inc. (Congress Agency or agency). A Superior Court

judge dismissed four of his five claims. The case proceeded to

discovery on the remaining claim against the agency that alleged

negligent failure to safeguard Adams's personal information.

The same judge subsequently granted the agency's motion for

summary judgment on the remaining count and in the same

memorandum and order denied Adams's motion to amend his

complaint to reinstate the dismissed claims and to add a claim

for violation of 18 U.S.C. §§ 2721-2725. Adams appealed. We

affirm in part and reverse in part.

1. Summary judgment. "The standard of review of a grant

of summary judgment is whether, viewing the evidence in the

light most favorable to the nonmoving party, all material facts

have been established and the moving party is entitled to

judgment as a matter of law." Lev v. Beverly Enterprises-

Massachusetts, Inc., 457 Mass. 234, 237 (2010) (Lev), quoting

from Cargill, Inc. v. Beaver Coal & Oil Co., 424 Mass. 356, 358

(1997). The burden rests on the defendant, as the moving party,

to affirmatively demonstrate the absence of a genuine issue of

material fact on every relevant issue. Ibid.

a. Facts. Viewed in the light most favorable to Adams, as

required at this stage of the proceedings, the summary judgment

record discloses the following facts. The Congress Agency hired

3

Elizabeth Burgos in August, 2003, as a customer service

representative, promoting her to customer service manager in

2010. Burgos, through her work computer, had access to the data

systems of Safety Insurance Company (Safety), and, through

Safety's internet portal, to records maintained by the Registry

of Motor Vehicles (RMV). Safety insures Burgos's vehicle.

In 2010, the Congress Agency, by its president and owner,

Gordon Owades, drafted a data security plan for ensuring the

protection of personal information of the residents of the

Commonwealth. Owades trained all agents, including Burgos, on

the data security policies. One company policy prohibited

employees from accessing or using a driver's personal

information, obtained in the course of the employee's work, for

personal purposes. In addition, each time a Congress Agency

employee wished to access the RMV database through the Safety

portal, Safety required the agent to affirmatively agree to use

the information obtained for one of four limited purposes:

claims investigation activities, anti-fraud activities, rating,

and underwriting.1

On July 13, 2012, Burgos's boy friend, Daniel Thomas,

engaged in a high-speed flight from police while driving

1

Safety referenced the provisions of the Federal Drivers

Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721-2725, and

warned agents about the consequences of the improper use of

personal information obtained from the RMV's records.

4

Burgos's Mercedes automobile. At that time, Thomas was on

supervised release for a Federal firearm violation, and was

driving without a valid license. During his flight, Thomas

struck a vehicle operated by the plaintiff, Mark Adams. Thomas

abandoned the Mercedes and fled.

On July 24, 2012, Adams, who had filed a claim against

Burgos's automobile policy, gave a statement to a Safety claims

adjuster investigating the accident. He informed the adjuster

that he could identify the driver of the Mercedes and provided

his contact information, including his cell phone number and

home address.

Meanwhile, Burgos reported her vehicle stolen to the

police, and subsequently filed her own insurance claim for the

loss with Safety. Burgos, using her access to confidential data

through the agency, obtained information about her own claim,

and learned Adams's identity as the individual who had filed a

claim against her Safety insurance policy and his contact

information. The next day, Adams received a threating telephone

call from Thomas.2 Adams immediately reported the threat to the

authorities.

2

Thomas claimed to be a Massachusetts State police officer.

Thomas told Adams that the driver of the car that struck his was

a "very, very dangerous man with very dangerous friends."

Thomas warned Adams to "do [himself] a favor. Shut the F up and

get your car fixed or you will have issues."

5

The Massachusetts State police visited the agency's office

on August 28, 2012; Burgos refused to speak with them. The

Congress Agency continued to provide Burgos access to the Safety

databases and to the RMV records. On December 13, 2012, Owades

terminated Burgos for "her serious misuse of access to

confidential information."

On January 9, 2013, in the Boston Municipal Court (BMC),

Burgos and Thomas admitted to sufficient facts and pleaded

guilty to witness intimidation and conspiracy in connection with

the threat made to Adams. In particular, Burgos admitted that

she had used her position at the agency to obtain Adams's date

of birth, address, and cell phone number.

Discovery in this matter provided additional information

about an earlier incident when Burgos engaged in criminal

behavior with, or to protect, her boy friend. Specifically, on

June 19, 2010, while Thomas and Burgos were driving cross

country, the Iowa State police stopped the vehicle for speeding.

In the vehicle the police discovered two loaded semi-automatic

firearms concealed in Burgos's purse, ammunition, a receipt for

the purchase of additional ammunition in Burgos's day book, a

half-face mask, and a police scanner. One handgun was stolen;

the other had its serial number defaced. Thomas claimed he knew

nothing about the weapons and ammunition, while Burgos admitted

to the police that they were hers. Burgos and Thomas were

6

arrested and eventually indicted for possession of a firearm

with an obliterated serial number.

After Burgos was released on bail, she returned to

Massachusetts and continued to work at the Congress Agency. On

October 21, 2010, the United States Marshals Service arrested

Burgos at the agency's office. The office manager notified

Owades of Burgos's arrest. Upon her return to work four days

later, Burgos explained to Owades that there was "a

misunderstanding as to who was in possession of the firearm at

the time of the incident in Iowa;" the gun belonged to her boy

friend; she did not know it was present in the vehicle prior to

its discovery by the police; its presence was frankly a "shock"

to her; "ultimately, she would be exonerated"; and "[the

misunderstanding] was not going to affect her ability to work."

Burgos informed Owades that Thomas went to jail. Owades

conducted no independent investigation into the circumstances of

her arrest because he "did not at the time think it was germane

to her employment."

Burgos subsequently told Owades that she had some legal

"arrangement" with the authorities that would last a year.3 At

3

Burgos entered into an agreement with the United States

Attorney for the Southern District of Iowa to participate in the

pretrial diversion program, an alternative to criminal

prosecution. As a condition of participation in the diversion

program, an offender is not asked to admit guilt, but must

acknowledge responsibility for the behavior.

7

the end of that time period, Burgos informed Owades that the

matter was resolved. In fact, following her completion of the

diversion program, the United States Attorney dismissed the

indictment on May 24, 2012.4 Approximately seven weeks later,

Thomas struck Adams's vehicle.

b. Discussion. A plaintiff must prove four elements in

order to prevail on a negligence claim: (1) duty; (2) breach of

duty; (3) a causal connection between the breach of duty and

damages; and (4) damages. See Jupin v. Kask, 447 Mass. 141, 146

(2006). In its motion for summary judgment, the agency

challenged Adams's ability to satisfy each of these elements of

the tort of negligent failure to safeguard personal information.

The motion judge agreed, ruling that expert testimony was

required to establish whether the agency owed a duty to Adams to

safeguard his personal information, what that duty entailed, and

whether the agency breached that duty. The motion judge also

found that Adams was unable to prove that the agency's

negligence was the proximate cause of injury to Adams.

The existence of a legal duty is a question of law

determined "by reference to existing social values and customs

and appropriate social policy." See id. at 143, quoting from

4

Thomas pleaded guilty to the Federal weapon charge, and

was sentenced to prison followed by supervised release.

8

Cremins v. Clancy, 415 Mass. 289, 292 (1993). The other three

elements ordinarily are questions of fact for the jury. See id.

at 146.

i. Legal duty. As a general rule, a party has no duty to

control another person's conduct to prevent that person from

causing harm to a third person. See Leavitt v. Brockton Hosp.,

Inc., 454 Mass. 37, 40-41 (2009) (Leavitt). Well-established

exceptions to that rule are recognized in the employment

context. At common law, an employer owed the duty to exercise

reasonable care in the selection and retention of employees that

have contact with members of the public. See Carson v. Canning,

180 Mass. 461, 462 (1902); Foster v. The Loft, Inc., 26 Mass.

App. Ct. 289, 290-291 (1988) (Foster). More recently, courts

have recognized a potential duty of care owed by employers where

the employment facilitates the employee's causing harm to third

parties. See Restatement (Third) of Torts: Liability for

Physical and Emotional Harm § 41 (2012). See also Leavitt,

supra at 41 & n.10; Lev, 457 Mass. at 242-244; Roe No. 1 v.

Children's Hosp. Med. Center, 469 Mass. 710, 714 & n.7 (2014);

Doe v. Boston Med. Center Corp., 88 Mass. App. Ct. 289, 291

(2015).

In deciding whether a special relationship exists between a

particular plaintiff and defendant, our foremost consideration

is whether "a defendant reasonably could foresee that he would

9

be expected to take affirmative action to protect the plaintiff

and could anticipate harm to the plaintiff from the failure to

do so." Irwin v. Ware, 392 Mass. 745, 756 (1984). "All the

circumstances are examined in defining the scope of a duty of

care based on the reasonable foreseeability of harm." Whittaker

v. Saraceno, 418 Mass. 196, 199 (1994).

In the circumstances of this case, we conclude that the

agency had a legal duty to Adams, a member of a large but

clearly defined class of third parties, to prevent its

employee's foreseeable misuse of the information that Adams

provided to process his automobile insurance claim.5

ii. Breach of duty. We hold that a jury reasonably could

find that the Congress Agency breached its legal duty to Adams

under two possible theories: the conflict of interest inherent

5

In fact, the Legislature has established statutory and

regulatory duties to take adequate measures to safeguard the

confidentiality of the personal information of all Massachusetts

residents. See G. L. c. 93H, § 2(a), added by St. 2007, c. 82,

§ 16 and 201 Code Mass. Regs. §§ 17.00 - 17.05 (2009) (standards

for the protection of the personal information of residents of

the Commonwealth). "Personal information" is defined as "a

resident's first name and last name or first initial and last

name in combination with any [one] or more of the following data

elements that relate to such resident: (a) Social Security

number; (b) driver's license number or state-issued

identification card number; or (c) financial account number, or

credit or debit card number, with or without any required

security code, access code, personal identification number or

password, that would permit access to a resident's financial

account." G. L. c. 93H, § 1(a). See also 201 Code Mass. Regs.

§ 17.02.

10

in allowing Burgos unrestricted access to information relating

to a claim against her own insurance policy; and the failure to

investigate Burgos's continuing fitness for access to the

confidential information of others available through her

employment.

First, a jury reasonably could find that the agency

breached its duty to protect the confidential information

entrusted to it or Safety by failing to prevent a conflict of

interest that arises from its employees having unrestricted

access to their own claim information. In this case, Burgos was

able to retrieve information about the pending claim by Adams

against her policy, including the notes from the Safety claims

adjuster that contained Adams's identity and contact

information. Allowing employees to access the confidential

information of claimants against them during the adjustment

process potentially creates a conflict of interest, and a jury

reasonably could find the agency negligent without the necessity

of expert testimony. See Herbert A. Sullivan, Inc. v. Utica

Mut. Ins. Co., 439 Mass. 387, 402-403 (2003) ("The test for

determining whether a particular matter is a proper one for

expert testimony is whether the testimony will assist the jury

in understanding issues of fact beyond their common

experience").

11

Second, a jury could find that the Congress Agency was

negligent when it accepted Burgos's version of her criminal

involvement in the Federal firearms indictment without

independent investigation. An employer may be held liable for

negligence if it "becomes aware or should have become aware of

problems with an employee that indicated [her] unfitness, and

the employer fails to take further action such as investigating,

discharge or reassignment." Foster supra at 291, quoting from

Garcia v. Duffy, 492 So.2d 435, 438-439 (Fla. Dist. Ct. App.

1986). The scope of an employer's duty to undertake prudent

investigation into the fitness of an employee "is directly

related to the severity of risk third parties are subjected to

by [the] employee." Heng Or v. Edwards, 62 Mass. App. Ct. 475,

488 (2004) (Heng Or), quoting from Ponticas v. K.M.S. Invs., 331

N.W.2d 907 (Minn. 1983).6

Here, the access to confidential personal information of

the citizens of the Commonwealth and others inherent in Burgos's

employment heightened the potential risk that she posted to

third parties. Just as those with physical keys to the homes of

6

An employer's knowledge of an employee's past conviction

of the same or similar crime is one circumstance that may

support liability for negligent hiring or retention. See Foster

supra at 294-295 & n.7. Where the crimes are entirely

unrelated, however, such as a conviction of larceny by check

followed by a rape of a customer, the employee's criminal

record, standing alone, would not establish negligence. See id.

at 294 n.7.

12

others have a duty of reasonable care to preserve their

security, companies whose employees have access to the

confidential data of others have a duty to take reasonable

measures to protect against the misuse of that data. Reviewing

the record in the light most favorable to Adams, as we must at

this stage, if the Congress Agency had investigated, it could

have discovered facts that called into question Burgos's honesty

and fitness for access to other people's personal information.

An investigation by the agency could have revealed that Burgos

was not forthright with Odwades, that at a minimum she had been

involved with illegal firearms, and that she either concealed

her own involvement or lied at her own peril to protect her boy

friend. A jury could find that these facts would have placed

the agency on notice that its employee was sufficiently

untruthful as to merit further consideration of whether she

should continue to have access to databases containing

confidential information.

In reaching this conclusion, we consider Heng Or, supra, to

be particularly instructive. In Heng Or, the defendant, the

owner of an apartment building, gave several apartment keys to a

handyman, Vao Sok. See id. at 479-480. At the time of the

entrustment, the defendant knew that Sok was a jobless, homeless

drifter with addiction problems. See id. at 482. Without

further inquiry, the defendant accepted Sok's inaccurate report

13

of his legal troubles. See id. at 481. The defendant could

have learned that Sok had an uncontrollable temper; tenants in

the building feared him and would not leave their children alone

with him; and, prior to the time Edwards entrusted Sok with the

keys, that Sok stood indicted for kidnapping and raping a young

girl. See id. at 481-482. Sok raped and asphyxiated a young

child in one of the apartments to which the keys gave him

access. On this evidence, this court concluded the defendant

was fairly found liable in negligence for hiring and entrusting

the keys to an unfit individual. See id. at 476. The court

also concluded that the jury was warranted in finding that the

violent attack fell within the range of reasonably foreseeable

harms created by the failure to make due inquiries about Sok in

combination with the entrustment of keys. See id. at 487-488.

It is a question for a jury whether, based on the

information it knew or could have known at the time, the agency

should have continued to allow Burgos continued access to

confidential information.

iii. Proximate cause. The motion judge concluded that the

Congress Agency was entitled to summary judgment based on the

intervening, superseding criminal acts of Burgos and Thomas.7 We

7

The agency's argument that Adams has waived this point is

unpersuasive. Adams did in fact address the judge's ruling on

causation in his brief. Although Adams did not address the

judge's footnote disposition of the element of harm as matter of

14

disagree. The necessary causal connection may be found "[if]

the injury to the plaintiff was a foreseeable result of the

defendant's negligent conduct." Kent v. Commonwealth, 437 Mass.

312, 320 (2002). "Where the intervening occurrence was

foreseeable by a defendant, the causal chain of events remains

intact and the original negligence remains a proximate cause [of

the plaintiff's injury]."8 Zinck v. Gateway Country Store, Inc.,

72 Mass. App. Ct. 571, 578 (2008), quoting from Delaney v.

Reynolds, 63 Mass. App. Ct. 239, 242 (2005).

The intervening acts of Burgos here were not so improbable

as to remove the foreseeability question from the special

province of the jury. See id. at 578-579. Nor was the harm

sustained by Adams so "highly extraordinary" as to relieve the

agency of liability. Id. at 578, quoting from Heng Or, supra at

486. A jury could conclude that the Congress Agency was put on

notice that Burgos should not have been entrusted with access to

law, we decline to apply a strict rule of waiver where the

ground did not support the entry of summary judgment as the

agency maintains, and the cases relied upon by it to support

waiver are distinguishable in material respect.

8

A separate theory of liability arising from the agency's

failure to report Burgos's arrest to the Division of Insurance

in violation of G. L. c. 175, § 162V(b) was inadequately argued

and thus waived. See Mass.R.A.P. 16(a)(4), as amended, 428

Mass. 1603 (1999); Electronic Data Sys. Corp. v. Attorney Gen.,

454 Mass. 63, 65 n.5 (2009). In any event, it is far from clear

that the statute applied in this case where Burgos entered into

a diversion agreement in lieu of prosecution.

15

the confidential information of others, especially where that

information could involve a claim against her or her boy friend.

The agency knew of the weapons charge and it could have learned

of Burgos's misrepresentation about that charge to Owades, that

the weapons charge involved concealment and possible violence,

and of Burgos's willingness to commit a crime with, or to

protect, her boy friend.

The Congress Agency's reliance on Coughlin v. Titus & Bean

Graphics, Inc., 54 Mass. App. Ct. 633 (2002) (Coughlin), to show

the absence of negligence is misplaced, as it is distinguishable

on the facts. In that case, the employer, a small company in

the business of manufacturing signs, took a chance by hiring

Michael Kelley, a released sexually dangerous person with a long

criminal record. See Id. at 636-637. At the time of hiring,

the employer knew Kelley had been incarcerated for fourteen

years for committing a violent crime. See id. at 637. The

employer placed precautionary limitations on the position; it

assigned Kelley to work alone in a warehouse away from contact

with its customers and other employees and did not provide him

with keys to the warehouse. See id. at 637 & n.6. A background

check would have revealed favorable professional opinions

supporting Kelley's parole. See id. at 640 & n.9. Four days

into his employment, Kelley, who had a set of keys in his

possession, lured a passerby into the warehouse and murdered her

16

before his scheduled shift. See id. at 637-638. In contrast to

this case, Coughlin is a case where the employer assessed the

risk and took significant steps to limit risk of harm to others.

Here, as there was a genuine issue of material fact on the

question of foreseeability, summary judgment was inappropriate.9

iv. Damages. The Congress Agency's argument that Adams's

proof of emotional distress damages was inadequate suffered from

the same infirmity as the judge's analysis: it was based on an

improper view of the facts more favorable to the agency than

warranted by the summary judgment record.

The facts contained within the summary judgment record

contain sufficient evidence of Adams's worsening physical

symptoms to warrant the submission of the claim to the jury.

See Sullivan v. Boston Gas Co., 414 Mass. 129, 137-140 (1993).

While Adams admitted that he had longstanding emotional and

sleep problems, he claimed that they worsened over time

following Thomas's threat. On February 14, 2013, shortly after

the BMC plea hearing, Dr. Andrew Lenhardt, Adams's primary care

physician, first prescribed Temazepam, a medication used for

sleep problems related to psychological reasons, for Adams.

9

We do, however, conclude that Adams's theory that the

agency should have instituted an employee keystroke monitoring

program similar to Safety's was properly dismissed due to the

lack of expert testimony on industry standards and of any

triable issue of proximate causation. See Hebert v. Enos, 60

Mass. App. Ct. 817, 820-822 (2004).

17

There was also expert testimony submitted by Adams from Dr.

Stephanie Sydney, a licensed clinical psychologist, that Adams's

trauma symptoms included repeated nightmares about the phone

call (that could not have predated it), high anxiety, intrusive

thoughts, racing hot flushes, and feelings of detachment.

2. Denial of motion to amend.10 After discovering that the

Congress Agency had actual knowledge of Burgos's 2010 arrest,

Adams moved to amend his complaint, seeking to revive the four

dismissed claims and to add a new Federal law claim. The

specific factual allegations in the proposed amended complaint

would have supported a claim for negligent retention and

supervision if included in the original complaint. Here, our

conclusion that summary judgment should not have entered

obviates much of the judge's reasoning for the denial of the

motion to amend. Given our conclusion that the agency owed a

legal duty to Adams, the denial of Adams's motion to amend on

10

To the extent the agency challenges the adequacy of the

record, the supplemental appendix permits us to conduct a

meaningful review. We reach the merits.

18

the grounds of futility is rendered moot.11 See Lipsitt v.

Plaud, 466 Mass. 240, 254-255 (2013).12

However, we discern no abuse of discretion with respect to

the judgment on the remaining common law and statutory claims.

See North Am. Expositions Co. Ltd. Partnership v. Corcoran, 452

Mass. 852, 871-872 (2009). As to these claims, the first

amended complaint, like the original complaint, contained

insufficient factual allegations to plausibly suggest

entitlement to relief. See Jessie v. Boynton, 372 Mass. 293,

295 (1977); Iannacchino v. Ford Motor Co., 451 Mass. 623, 636

(2008) (Iannacchino).

Specifically as to Adams's G. L. c. 93A claim, to the

extent it was predicated on negligence alone, it necessarily

failed. See Klairmont v. Gainsboro Restaurant, Inc., 465 Mass.

165, 176-177 (2013) (Klairmont) ("in the absence of conduct that

qualifies as unfair or deceptive, a negligent act or negligent

acts, alone, do not violate [G. L.] c. 93A"). The other alleged

basis for c. 93A relief was the agency's failure "to meet the

11

The judge noted that Adams's motion to amend his

complaint "might be considered unduly delayed or dilatory" but

found the futility of the amendment to be determinative. As

the motion was not decided based on delay, we do not address the

issue here.

12

In light of our resolution of Adams's challenge to the

order denying his motion to amend that sought to reinstate the

dismissed claims, see infra at - , we need not review

the order allowing the motion to dismiss those claims.

19

Commonwealth's standards regarding the protection of

confidential personal information for residents of the

Commonwealth." In certain circumstances, a statutory or

regulatory violation may rise to the level of an unfair or

deceptive act or practice for purposes of a c. 93A claim. See

Klairmont, supra at 173-177. The "standards" to which Adams

refers in his proposed amended complaint are not identified. To

the extent that the claim was based on the agency's alleged

violations of G. L. c. 93H and the regulations promulgated

thereunder, we conclude, as did the motion judge, that the claim

was factually insufficient. See G. L. c. 93H, §§ 1-6, added by

St. 2007, c. 82, § 16 (governing data breaches) and 201 Code

Mass. Regs. §§ 17.00-17.05 (standards for the protection of the

personal information of residents of the Commonwealth).

As the motion judge noted, the complaint did not allege

that Burgos accessed "personal information" as that term is

specially defined in c. 93H, and did not identify the required

safeguards and procedures that the agency failed to employ.13

See 201 Code Mass. Regs. §§ 17.03 (standards for protecting

personal information) and 17.04 (computer system security

requirements). Compare the much more specific allegations of

government safety standard noncompliance found insufficient in

Iannacchino, supra at 626-633. As Adams had not alleged

13

See footnote 5, supra.

20

sufficient facts to state a plausible c. 93A claim on any

theory, we discern no abuse of discretion in the denial of so

much of the motion seeking to reinstate count V.14

Conclusion. The order allowing the agency's motion for

summary judgment with respect to count IV is vacated. The order

denying Adams's motion to amend his complaint is vacated with

respect to counts II and III of the proposed first amended

complaint and is otherwise affirmed. The case is remanded for

further proceedings consistent with this opinion.

So ordered.

14

In addition to the defective pleading, Adams's one new

claim for violation of DPPA failed for the added reason that the

agency, as matter of law, could not be held vicariously liable

for the tortious acts of Burgos. Her improper disclosure of

that information to Thomas and its use in a criminal conspiracy

were plainly acts committed outside the scope of her employment.

See Lev, supra at 238-239. The fact that plaintiff shifted his

theories of liability repeatedly may have contributed to the

result below. This loss in the trial court and delay in

resolution of the matter should be a cautionary note for such

strategy.