Jerry STACY, Emily Stacy, Theresa Anders, Aja Smallwood, Jennifer To-maszewski and Cynthia Tlucek, Plaintiffs-Appellants, v. HRB TAX GROUP, INC., Defendant-Appellee, 516 F. App'x 588

HELENE N. WHITE, Circuit Judge. In this diversity case, Plaintiffs, clients of Defendant HRB Tax Group who had their identities stolen by a tax preparer HRB hired, appeal the grant of

summary judgment to HRB on their three-count complaint. We AFFIRM the dismissal of the gross-negligence claim, and REVERSE the dismissal of the negligent-safeguarding-of-information and negligent hiring/supervision claims. I. The facts viewed in a light most favorable to Plaintiffs are that in 2007, Sophia Quill, a tax preparer HRB hired, utilized the unfettered access HRB tax preparers have to clients’ past tax returns to complete and submit 2006 tax returns in Plaintiffs’ names, without Plaintiffs’ knowledge or authorization, and to collect the tax refunds.

Quill worked as a tax-preparer at various HRB offices in Michigan. HRB conducted no criminal-background checks, credit checks, or checks of any kind when hiring tax-preparers, including Quill; rather, it relied on their employment applications and answers to interview questions. Quill’s employment application stated that she had no prior convictions when, in fact, she had multiple convictions in Michigan for identity theft and using computers to commit a crime.

See R. 66 at 15 and penultimate exhibit (a Michigan Department of Corrections Online Offender Search listing Quill’s multiple convictions pre-dating her employment with HRB, including for identity theft, using computers to commit a crime, and embezzlement, and listing more than 20 aliases). Quill testified on deposition that her interviewer filled out her employment application for her and did not ask if she had a criminal record.

HRB would have easily discovered Quill’s convictions had it conducted a minimal investigation, e.g., by running (at no cost) an offender search through the Michigan Department of Corrections’ free website, http://mdocweb. state.mi.us/OTIS2/otis2.aspx. Regarding HRB’s supervision of its tax preparers, Quill testified on deposition that no supervisor ever sat down with her or supervised her preparation of tax returns. Plaintiffs filed a three-count complaint in state court, alleging negligent hiring/supervision, negligent safeguarding of private information and gross negligence.

HRB removed the case to federal court and moved for

summary judgment. The district court dismissed Plaintiffs’ negligent hiring/supervision claim for failure to allege a physical injury or act; the negligent-safeguarding-of-private-information claim on the basis that it was “simply an additional negligent hiring/supervision claim in disguise”; and the gross-negligence claim for failure to state a cognizable claim. II. This court reviews de novo the district court’s grant of

summary judgment, assessing the evidence, facts, and inferences therefrom in the light most favorable to the nonmoving party. Bazzi v. City of Dearborn, 658 F.3d 598, 602 (6th Cir.2011). In diversity cases, federal courts must apply state law in accordance with the then-controlling decisions of the highest state court. Ziegler v. IBP Hog Market, Inc., 249 F.3d 509, 517 (6th Cir.2001) (internal quotations and citations omitted).

If the state’s highest court has not spoken on a precise issue, which is the case here, a federal court may not disregard a decision of the state appellate court on point, published or unpublished, unless it is convinced by other persuasive data that the highest court of the state would decide the issue otherwise. Id. Under Michigan law, a plaintiff must prove four elements to prevail in a negligence claim: a duty owed by the defendant, a breach of that duty, causation, and damages. Case v. Consumers Power Co., 463 Mich. 1, 615 N.W.2d 17, 20 (2000) (citing Schultz v.

Consumers Power Co., 443 Mich. 445, 506 N.W.2d 175, 177 (1993)). Whether a duty exists is for the court to decide as a matter of law. Graves v. Warner Bros., 253 Mich.App. 486, 656 N.W.2d 195, 200 (2002). [A] negligence action may be maintained only if a legal duty exists that requires the defendant to conform to a particular standard of conduct in order to protect others against unreasonable risks of harm. This analysis requires a determination whether the relationship of the parties is the sort that a legal obligation should be imposed on one for the benefit of another. Id. (internal citations omitted).

Because criminal activity by its deviant nature is normally unforeseeable, generally, there is no duty to protect another from the criminal acts of a third party in the absence of a special relationship between the defendant and the plaintiff or the defendant and the third party. Id. Examples of the “special relationships” Michigan law recognizes include: landlord-tenant, proprietor-patron, employer-employee, residential invitor-in-vitee, carrier-passenger, innkeeper-guest, and doctor-patient. Id. at 201.

To determine whether there is a special relationship giving rise to a legal duty, Michigan courts consider: 1) the societal interests involved, 2) the severity of the risk, 3) the burden on the defendant, 4) the likelihood of occurrence of the risk, and 5) the relationship between the parties. Murdock v. Higgins, 208 Mich.App. 210, 527 N.W.2d 1, 3 (1994) (citing Dykema v. Gus Macker Enters., Inc., 196 Mich.App. 6, 492 N.W.2d 472, 474 (1992)).

Other factors that may give rise to a duty include the foreseeability of the harm, the defendant’s ability to comply with the duty, the victim’s inability to protect himself, the cost of providing protection, and whether the victim bestowed any economic benefit on the defendant. HI. A. Plaintiffs argue that physical injury is not a requirement of the negligence claims they assert because they can establish a special relationship such that HRB owed them a duty to safeguard their personal information and that the cases that HRB and the district court relied on do not foreclose them from doing so. HRB argues that

summary judgment was proper not only because Michigan courts do not recognize negligence claims for purely economic injury but also because Plaintiffs cited no authority extending the tort to claims for purely economic injury or suggesting an inclination for such an extension of state law and because it is not for this court to do so absent some authoritative signal to that effect from the Michigan legislature or courts. HRB overlooks several such authoritative signals-first, by the Michigan Court of Appeals in Bell v. Mich. Council 25 of Am. Fed’n of State, Cnty., and Mun.

Emps., No. 246684, 2005 WL 356306 (Mich.Ct. App. Feb. 15, 2005) (unpublished decision), perm, to appeal denied, 474 Mich. 989, 707 N.W.2d 597 (2005), and second, by the Michigan legislature’s 2004 enactment of the Social Security Number Privacy Act (SSNPA), Mich. Comp. Laws Ann. § 445.81 et seq. (West 2013). B. Bell As the Michigan Supreme Court has not spoken on the precise issue presented here, we look to and apply the Michigan state appellate courts’ decisions on point. Ziegler, 249 F.3d at 517.

The Michigan Court of Appeals in Bell held that under certain circumstances, a special relationship can exist between a defendant and plaintiffs such that the defendant does owe the plaintiffs a duty to protect them from identity theft by providing some safeguards to ensure the security of their most essential confidential identifying information, information which easily could be used to appropriate a person’s identity.

Bell, 2005 WL 356306, at *5 (holding that a duty to protect personal information arose where union was entrusted with union members’ personal information because relationship was similar to a fiduciary relationship between a financial institution and its clients). Having considered the matter and reasoning from the decision in Bell, we conclude that the Michigan courts would also determine that HRB owed a duty of care to safeguard the plaintiffs’ confidential identifying information in this instance because of the special relationship between taxpayer and tax preparer.

Further, we reason from Bell that the Michigan courts are prepared to recognize that economic and emotional injuries allegedly occasioned by reasonably foreseeable instances of identity theft that result from an employee’s actions may serve as the basis for recovery in these types of cases, even in the absence of a physical injury. In this vein, we note that two of the cases on which HRB has relied for the proposition that negligent hiring and supervision claims are limited to those where physical acts and injuries are involved pre-date Bell, see Bean v.

Directions Unlimited, Inc., 462 Mich. 24, 609 N.W.2d 567 (2000); Vennittilli v. Primerica, Inc., 943 F.Supp. 793 (E.D.Mich.1996), and that neither Bean nor a third case relied on, and the only one that post-dates Bell, Dudley v. Thomas, No. 08-14017, 2009 WL 1620413 (E.D.Mich. June 9, 2009), expressly relegate negligent hiring/supervision claims to those involving a physical act and injury. Accordingly we are not persuaded that the Michigan courts would foreclose relief to Plaintiffs because of the economic and emotional, rather than physical, nature of the damages alleged. IV.

The district court properly dismissed the gross negligence claim, as Plaintiffs did not present sufficient evidence such that reasonable minds could differ regarding whether HRB’s conduct was so reckless as to demonstrate a substantial lack of concern for whether an injury resulted. See Xu v. Gay, 257 Mich.App. 263, 668 N.W.2d 166, 170 (2003) (citing Vermilya v. Dunham, 195 Mich.App. 79, 489 N.W.2d 496, 499 (1992)). y.

For these reasons, we AFFIRM the dismissal of Plaintiffs’ gross negligence claim, and REVERSE the dismissal of Plaintiffs’ negligent-safeguarding-of-information and negligent hiring/supervision claims. . Both the Bell majority and dissenting judge cited the SSNPA, see Bell v. Mich. Council 25 of Am. Fed'n of State, Cnty., and Mun. Emps., No. 246684, 2005 WL 356306, at *6 n. 3 & *12 (Murray, J., dissenting), which provides in part: Sec. 4.

(1) Beginning January 1, 2006, a person who obtains 1 or more social security numbers in the ordinary course of business shall create a privacy policy that does at least all of the following concerning the social security numbers the person possesses or obtains: (

a) Ensures to the extent practicable the confidentiality of the social security numbers. (

b) Prohibits unlawful disclosure of the social security numbers. (

c) Limits who has access to information or documents that contain the social security numbers. (

d) Describes how to properly dispose of documents that contain the social security numbers. (

e) Establishes penalties for violation of the privacy policy. Mich. Comp. Laws Ann. § 445.84 (West 2013). The SSNPA authorizes civil actions (as well as criminal): An individual may bring a civil action against a person who violates

section 3 and may recover actual damages. If the person knowingly violates

section 3, an individual may recover actual damages or $1,000.00, whichever is greater. If the person knowingly violates

section 3, an individual may also recover reasonable attorney fees.... Id. at § 445.86(2). . We are not persuaded by HRB’s post-argument supplemental briefing on Bell, in which it contends that "Bell’s relevance to this case is marginal, at best.”