Invasion of Privacy Damages Minnesota Businesses Face

What damages can a person recover from a business for invasion of privacy?

A plaintiff can seek damages for the invasion, which the Court of Appeals, citing a Restatement comment, described as closely resembling damages for defamation. Under Minnesota’s punitive-damages statutes, punitive damages require a later motion and proof of deliberate disregard. Where a privacy statute applies, the plaintiff may also claim statutory damages, multiplied damages, damages for mental anguish, or attorney fees.

The three privacy claims Minnesota recognizes date to Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231 (Minn. 1998). The defendants were a business and its workers: the plaintiffs sued “Wal-Mart Stores, Inc. and one or more as-yet unidentified Wal-Mart employees” after a photo-lab photograph circulated in their community. The court held: “we recognize a right to privacy present in the common law of Minnesota, including causes of action in tort for intrusion upon seclusion, appropriation, and publication of private facts, but we decline to recognize the tort of false light publicity.” On review of a dismissal for failure to state a claim, the court stated: “We reverse as to the claims of intrusion upon seclusion, appropriation, and publication of private facts, but affirm as to false light publicity.” Lake did not address the amount of damages.

The Court of Appeals addressed damages in passing in Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. App. 2009). It observed that “the damages calculation for invasion of privacy might be influenced” by how effective the publicity was, citing the Restatement (Second) of Torts and “explaining that damages recoverable under an invasion-of-privacy claim closely resemble damages recoverable for defamation.” It also held that “a determination that publicity occurred does not require a large actual audience.” For a business, how far private information actually traveled can bear on the amount, even when it does not defeat the claim. Punitive damages follow their own statute, covered below under Minn. Stat. § 549.20.

What must the plaintiff prove before any damages are owed?

No damages are owed unless the plaintiff proves every element of one recognized privacy tort. For intrusion upon seclusion, that means an intrusion that is highly offensive, into a matter where the person had a legitimate expectation of privacy. For publication of private facts, it means publicity given to a matter concerning the person’s private life, where “the publicity of the private information would be highly offensive to a reasonable person,” and “the matter is not of legitimate concern to the public.” The Minnesota Supreme Court defined publicity using the Restatement’s standard.

Intrusion upon seclusion. In Swarthout v. Mutual Service Life Insurance Co., 632 N.W.2d 741 (Minn. App. 2001), the Court of Appeals listed the three elements: an intrusion, that is highly offensive, into a matter in which the person has a legitimate expectation of privacy. The insurer there altered a customer’s signed release to collect medical records from sources he had not authorized, then sent the information to a database other insurers could use. The court would not rule, as a matter of law, that “the illicit obtaining, conveying, and publicizing of his private medical information” fell short of a highly offensive intrusion, and it sent the claim back for further proceedings. The same opinion noted that “Use of improper methods to obtain information does not necessarily satisfy the” highly offensive element when the information could have been obtained properly. More on the elements is in intrusion upon seclusion in Minnesota.

Publication of private facts. Yath, citing Bodah, lists three elements. The first is publicity given to a matter concerning the plaintiff’s private life. The others are that “the publicity of the private information would be highly offensive to a reasonable person,” and that “the matter is not of legitimate concern to the public.”

In Bodah v. Lakeville Motor Express, Inc., 663 N.W.2d 550 (Minn. 2003), the Minnesota Supreme Court adopted the Restatement definition: publicity means “the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.” An employer’s fax of 204 employees’ names and Social Security numbers to 16 terminal managers in six states did not meet that test. Posting is different. Yath held: “We hold that the publicity element of an invasion-of-privacy claim is satisfied when private information is posted on a publicly accessible Internet website.” A concurring judge would have reached the result on narrower grounds. The full elements are in public disclosure of private facts.

Appropriation and false light. Lake also recognized appropriation of a person’s name or likeness. It declined to recognize false light, observing that most “false light claims are actionable as defamation claims.”

How does a negligent infliction of emotional distress claim fare alongside a privacy claim?

A separate claim for negligent infliction of emotional distress can fail with the privacy claim. Minnesota generally limits that claim to people within a zone of danger of physical impact, with an exception for direct invasions of a person’s rights, and in Yath the court dismissed it “because the claim depends on the survival of the invasion-of-privacy claim.”

In Yath, the patient sued the clinic for negligent infliction of emotional distress. The Court of Appeals repeated the general rule that a plaintiff may recover on that theory only “when that plaintiff is within a zone of danger of physical impact, reasonably fears for his or her own safety, and consequently suffers severe emotional distress with resultant physical injury.” It also repeated the exception: a plaintiff “may recover damages for mental anguish or suffering for a direct invasion of his rights, such as defamation, malicious prosecution, or other willful, wanton or malicious conduct.”

The patient argued that her privacy claim was that kind of direct invasion. The court did not decide whether it was. Because her privacy claim against the clinic failed, her negligent-infliction claim against the clinic failed too. For a business, the practical point is that the negligent-infliction claim can rise or fall with the privacy claim, so the defense of the privacy elements is also the defense of that claim.

When is a business liable for an employee’s invasion of privacy?

A Minnesota business can be liable for an employee’s intentional privacy invasion when the harm is related to the employee’s duties and happens within work-related limits of time and place. Whether the misconduct was foreseeable is a question of fact, so the answer turns on evidence rather than on the employee’s motive.

The test comes from Fahrendorff v. North Homes, Inc., 597 N.W.2d 905, a 1999 Minnesota Supreme Court decision. Under it, an employer may be liable for intentional misconduct when “the source of the attack is related to the duties of the employee” and “the assault occurs within work-related limits of time and place” both hold. The court treated foreseeability, and the connection between the act and the job, as “a question of fact.” It also held that an employee’s personal motive, or an employer’s rule against the conduct, does not place the act outside the scope of employment as a matter of law.

Yath applied that test to a privacy claim. A medical assistant read a patient’s file five times without a business reason, and the information spread. The clinic avoided vicarious liability for the intentional torts because the patient “presented no evidence that the wrongful access and dissemination of private medical information by Tek was foreseeable.” The court did not decide vicarious liability under the health-records statute then in force, the predecessor of today’s sections 144.291 to 144.298; it “offered no opinion about the merits of that argument,” held that HIPAA did not preempt that statute, and reversed the dismissal of those claims and remanded them. The clinic’s audit trail let it confirm the access: the employee first denied it and recanted after the clinic manager, St. Sauver, “showed her a computer usage audit.” I suggest keeping access logs on any system holding customer or employee health, financial, or personnel information, because a log lets you confirm who looked, stop it, and show what you did when you found out.

Punitive damages against the business for an employee’s act face a separate, narrower test under Minn. Stat. § 549.20, subd. 2, covered next.

When can punitive damages be added to a privacy claim?

Under Minnesota’s punitive-damages statute, the complaint must not seek punitive damages when the case starts. The plaintiff must later move to add them, with affidavits showing the factual basis, and the court grants the motion if it finds prima facie evidence; the plaintiff must ultimately prove by clear and convincing evidence that the business acted with deliberate disregard for the rights or safety of others.

Under Minn. Stat. § 549.191, “the complaint must not seek punitive damages. After filing the suit a party may make a motion to amend the pleadings to claim punitive damages.” The court grants the motion “if the court finds prima facie evidence in support of the motion.” For a case in federal court, see also Fed. R. Civ. P. 15, which governs amended pleadings. Under Minn. Stat. § 549.20, subd. 1, “Punitive damages shall be allowed in civil actions only upon clear and convincing evidence that the acts of the defendant show deliberate disregard for the rights or safety of others.”

For a business sued over an employee’s conduct, subdivision 2 matters most. “Punitive damages can properly be awarded against a master or principal because of an act done by an agent only if” one of four things is true:

1. The business authorized the act and the way it was done.
2. The employee was unfit and the business deliberately disregarded a high probability of that unfitness.
3. The employee “was employed in a managerial capacity with authority to establish policy and make planning level decisions for the principal and was acting in the scope of that employment.”
4. The business, or a managerial agent, ratified or approved the act knowing its character and probable consequences.

If an award is made, subdivision 3 lists the factors that measure it. They include the duration of the misconduct and any concealment, the number and level of employees involved, the business’s financial condition, and “the attitude and conduct of the defendant upon discovery of the misconduct.” Under subdivision 4, any party can ask that the jury “first determine whether compensatory damages are to be awarded,” with evidence of the business’s finances kept out of that first phase.

Which Minnesota statutes set their own privacy damages?

Minnesota statutes on recorded communications, health records, drug and alcohol testing, and intimate images each give a person a privacy claim with damages set by the statute. Each statute creates its own civil claim, and each can carry multiplied damages, statutory amounts, civil penalties, or attorney fees.

• Recorded or intercepted communications. A person whose communication is intercepted, disclosed, or intentionally used in violation of chapter 626A may sue under Minn. Stat. § 626A.13. Subdivision 3(b) lets the court award the greater of “the sum of three times the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation” or “statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000.” Subdivision 2 adds “punitive damages in appropriate cases” and “a reasonable attorney’s fee and other litigation costs reasonably incurred.” The federal remedy, 18 U.S.C. § 2520(c)(2), uses the same statutory figures but actual damages rather than three times actual damages. Under Minn. Stat. § 626A.02, subd. 2, paragraph (d), “It is not unlawful under this chapter for a person not acting under color of law to intercept a wire, electronic, or oral communication where such person is a party to the communication or where one of the parties to the communication has given prior consent,” unless the communication is intercepted to commit a criminal or tortious act. Policies for recording employees at work should track that line, because recording outside it is the conduct that carries these damages.
• Health records. Under Minn. Stat. § 144.298, subd. 2, a person is “liable to the patient for compensatory damages caused by an unauthorized release or an intentional, unauthorized access, plus costs and reasonable attorney fees” if the person, among other acts, “forges a signature on a consent form or materially alters the consent form of another person without the person’s consent” or “obtains a consent form or the health records of another person under false pretenses.” In Swarthout, the court applied the predecessor health records statute to an insurer and held that it did not require a doctor-patient relationship. In one employer matter, I advised acting on an employee’s health information only through the employee’s written consent and the evaluating provider, and keeping what someone at the company had learned about the employee outside work out of every company document.
• Drug and alcohol test results. For private sector employees and job applicants, test result reports and other testing information are “private and confidential information” under Minn. Stat. § 181.954, subd. 2. That information “may not be disclosed by an employer or laboratory to another employer or to a third-party individual, governmental agency, or private organization without the written consent of the employee or job applicant tested.” Subdivision 3 allows a positive confirmatory test result to be used in a relevant arbitration, administrative hearing, or judicial proceeding, among other exceptions. Under Minn. Stat. § 181.956, subd. 2, a violating employer is liable “for any damages allowable at law.” The court may add reasonable attorney fees only “if the court finds that the employer knowingly or recklessly violated” the act. Under subdivision 1, an employee covered by a collective bargaining agreement must first exhaust “all applicable grievance procedures and arbitration proceeding requirements under a collective bargaining agreement.” The same subdivision adds that “an employee’s right to bring an action under this section is not affected by a decision of a collective bargaining agent not to pursue a grievance.” Minnesota’s drug testing rules for employers cover the rest of the act.
• Intimate images. Under Minn. Stat. § 604.31, subd. 3, a person who disseminates private sexual images without consent can owe “general and special damages, including all finance losses due to the dissemination of the image and damages for mental anguish,” any profit made, “a civil penalty awarded to the plaintiff of an amount up to $10,000,” and “court costs, fees, and reasonable attorney fees.” Subdivision 1 requires, among its elements, that “the image was obtained or created under circumstances in which the person depicted had a reasonable expectation of privacy.” Subdivision 6 lists exceptions, including dissemination “for the purpose of, or in connection with, the reporting of unlawful conduct,” and provides that the section “does not alter or amend the liabilities and protections granted by United States Code, title 47, section 230.”

How should a business respond when a privacy claim arrives?

A business facing a privacy claim should preserve its records, stop and document any continuing disclosure, give its liability insurer notice under the policy’s terms, and keep its response in writing. Each step affects the damages: lost evidence invites sanctions, and conduct after discovery is a listed factor in any punitive award.

1. Preserve evidence now. Yath states: “Sanctions for spoliation may be appropriate when a person knows or should have known that the evidence she destroyed was relevant to pending or future litigation.” I suggest suspending routine deletion of the relevant email, chat, camera footage, and access logs as soon as a claim is threatened, because the duty can arise before any lawsuit is filed.
2. Contain the disclosure and confirm it in writing. In Bodah, the company’s president wrote to employees that the terminal managers had been told to return or destroy the list and had done so. The complaint attached that letter, and the court called the allegation that the numbers were still being shared “mere speculation.”
3. Act as the business wants a jury to see it. Under Minn. Stat. § 549.20, subd. 3, “the attitude and conduct of the defendant upon discovery of the misconduct” is a factor in measuring punitive damages. Discipline, retraining, and a corrected policy are conduct upon discovery that a court can weigh. I suggest having written workplace monitoring policies in place before any claim, because they show what the company actually permitted.
4. Give your insurer notice under the policy’s terms. In one employment matter, the company’s employment practices liability policy required written notice to the carrier of a wrongful act before any claim arrived. The same policy treated any payment the company volunteered without the carrier’s written consent as the company’s own cost. I suggest reading the notice and consent conditions of each liability policy as soon as a claim is threatened, because a missed condition can cost coverage the company paid for.
5. Check the time limits. The interception statute sets its own limitations period in Minn. Stat. § 626A.13, subd. 5. That period runs from when “the claimant first has a reasonable opportunity to discover the violation.” I suggest checking the current text of any statute the claim relies on before treating the claim as timely or late, because periods differ from claim to claim.

Privacy Damages Against a Business

A common-law privacy claim against a Minnesota business turns first on whether the plaintiff can prove a recognized tort, then on whether the business answers for the person who acted, and only then on the amount. The statutes on recordings, health records, drug tests, and intimate images create separate claims of their own, with multiplied damages, penalties, and attorney fees. If you have received a privacy demand, or are planning a disclosure or a monitoring practice, I can analyze the facts and tell you which claims and damages apply and what to change. Email me at [email protected] with a brief description of the situation. More on how employers handle these matters is on the Minnesota employment law page.