VEST MONROE, LLC v. DOE

A man identified as John Doe received treatment at Ridgeview Institute, a behavioral health facility, and later learned that a former employee had improperly taken and disclosed patient records. Doe sued the facility's owners and operators, seeking damages for himself and trying to represent a broader class of nearly 2,000 affected patients. A trial court refused to certify the class, finding Doe had not shown that his claims were typical of, or shared common questions with, the rest of the group, because some patients had highly sensitive clinical and diagnosis information exposed while only basic administrative information about Doe was disclosed. Doe appealed, and the Court of Appeals of Georgia reversed, saying everyone's claims arose from the same leak and legal theories. The Supreme Court of Georgia disagreed, holding that the trial court's decision was a reasonable exercise of its discretion given the real factual differences between Doe's disclosed information and that of other patients, so the Court of Appeals' reversal was itself wrong.

A class representative's claims are not typical under OCGA § 9-11-23(a)(3) when the type and sensitivity of information disclosed about the representative differs qualitatively, not just in degree, from that disclosed about other class members, and a trial court does not abuse its discretion by denying certification on that basis when its findings are factually supported and legally sound.

The ruling reaffirms that Georgia trial judges have wide latitude to deny class certification when plaintiffs' injuries differ in kind, not just degree. This affects future data-breach and privacy lawsuits, making it harder to combine patients or consumers with varying levels of harm into a single class action.

Judgment of the Court of Appeals reversed

1. The court explained that class actions are an exception to normal individual litigation and are allowed only when a plaintiff proves, through actual evidence, that all four requirements of Georgia's class-action statute (OCGA § 9-11-23(a)), including typicality, are satisfied.
2. It described typicality as requiring a 'sufficient nexus' between the class representative's claims and the class's claims, meaning they arise from the same conduct and legal theory, though the claims need not be identical unless the representative's factual situation markedly differs from the group's.
3. Applying the deferential abuse-of-discretion standard, the court found the trial judge correctly stated the legal rule for typicality and relied on accurate, undisputed facts, including that Doe's disclosed information was limited to basic administrative records while hundreds of other patients had sensitive clinical, diagnosis, or treatment information exposed.
4. The court reasoned that this was a qualitative difference in the kind of injury and proof required, not just a difference in the amount of harm, meaning resolving Doe's claims would not necessarily resolve the claims of patients whose more sensitive records were leaked.
5. Because the trial court's typicality finding fell within the range of reasonable outcomes on which experienced judges could differ, the Supreme Court of Georgia held there was no abuse of discretion, and the Court of Appeals of Georgia was wrong to reverse that finding.
6. Since a lack of typicality alone is enough to defeat class certification, the court did not need to separately review the trial court's related finding that commonality was also lacking.

• class action certification
• patient data breach
• medical privacy
• Ridgeview Institute
• typicality requirement