Dumping Paper Tax Returns Did Not Violate Louisiana Breach Notification Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law Guide.

An individual's claims against Jackson Hewitt Tax Service and one of its Louisiana franchisees (Jackson Hewitt) for negligence, breach of contract, and violations of the Louisiana Database Security Breach Notification Act and Unfair Trade Practices Act by mishandling her personal information have been dismissed without prejudice by the federal district court in New Orleans. The individual could go forward, however, with her claim that Jackson Hewitt's conduct constituted common-law invasion of privacy.

The individual alleged that she visited the Jackson Hewitt franchise in 2006 to have her 2005 federal and state tax returns prepared and electronically filed. She signed Jackson Hewitt's privacy policy, which stated that it had physical, electronic, and procedural safeguards in place to protect customers' private information.

Sometime in 2008, Jackson Hewitt allegedly disposed of the individual's tax returns in a public dumpster. A third party found the returns, as well as those of more than 100 other people, and contacted the police and a local television station. The returns were in readable form and had not been burned, shredded, or pulverized.

Security Breach Notification

The individual's claims under the Louisiana Database Security Breach Notification Law failed because that law only applied to computerized data, the court ruled. The individual did not allege that computerized records were compromised, only that her paper tax returns were thrown in the dumpster and that they had not been rendered unreadable.

Furthermore, she failed to allege an actual injury from any breach. She could not base her claim on the speculative injury of increased risk of identity theft, the court said.

Negligence

The speculative damages asserted by the individual could not support negligence claims. She did not allege that any third party accessed her information and stole her identity. The mere possibility that her personal information was placed at risk by Jackson Hewitt did not constitute actual injury.

In addition, she could not seek general damages for anxiety, embarrassment, and other forms of emotional distress because Louisiana law did not allow recovery in negligence cases for emotional damage absent physical injury.

Breach of Contract

Breach of contract claims against Jackson Hewitt also failed because of the lack of actual damages. The individual asserted that she had relied on the company's privacy policy in deciding to turn over her information to the service. She did not, however, allege that she sustained a pecuniary loss as a result of this reliance.
Emotional damages could not be recovered because the contract to prepare the individual's taxes was not intended to gratify a nonpecuniary interest. Although the individual alleged that Jackson Hewitt intentionally breached the contract and acted in bad faith, she did not allege that the motivating factor behind the breach was the desire to aggrieve her feelings.

She was not entitled to seek damages for the cost of credit monitoring and credit insurance because expenses related to guarding against the risk of future identity theft were not compensable damages. The asserted expenditures were not the result of a present injury but, rather, the anticipation of future injury that had not materialized, in the court's view.

Unfair Trade Practices

The individual stated a sufficient injury to pursue claims under the Louisiana Unfair Trade Practices Act, according to the court. Jackson Hewitt's allegedly deceptive act was its misrepresentation of its privacy policy, and the fees the individual paid in reliance on the misrepresentation could constitute actual damages. However, the pleadings lacked the requisite specificity for fraud claims under Federal Rule of Civil Procedure 9(b). The individual did not allege how or why Jackson Hewitt’s alleged statements were misleading. Thus, the claims were dismissed without prejudice, with leave to amend.

Invasion of Privacy

In the context of a motion to dismiss, the individual adequately stated a claim that Jackson Hewitt had engaged in invasion of privacy under Louisiana common law, the court decided. She asserted that the improper disposal of her tax returns constituted an unreasonable disclosure of private facts.

The decision is Pinero v. Jackson Hewitt Tax Service Inc., CCH Privacy Law in Marketing ¶60,286.