## Facts

- Brazos Higher Education Service Corporation serviced Stacy Lawton Guin’s student loan and maintained a consumer privacy policy.
- Brazos employed John Wright, a financial analyst working from home, who used a company-issued laptop to analyze loan portfolios and sometimes received databases containing borrowers’ nonpublic personal information.
- Wright’s home was burglarized on September 24, 2004, and the laptop was stolen; police and a private investigative firm failed to recover it.
- Brazos determined that Wright had received databases containing borrower personal information on multiple occasions but could not identify which specific borrowers’ data were stored on the missing laptop.
- Brazos notified potentially affected borrowers that their personal information may have been accessed and provided guidance to reduce identity-theft risk.
- Guin alleged Brazos negligently permitted unencrypted storage of customer data on the laptop, asserting duties based on the Gramm–Leach–Bliley Act (GLBA), related regulations, and Brazos’s privacy policy.
- Guin produced no evidence that his information was accessed or misused, that identity theft occurred, or that any fraudulent accounts were opened in his name.

## Issues

1. Whether GLBA and its implementing regulations create a private right of action or supply a judicially enforceable duty/standard of care for a consumer’s negligence claim.
2. Whether Brazos breached any cognizable duty under Minnesota negligence law by allowing borrower information to be stored on an employee’s laptop later stolen in a burglary.
3. Whether a plaintiff can show causation and compensable damages based on the theft alone, absent evidence of actual data misuse or concrete financial harm.

## Decision

- The court granted Brazos’s motion for summary judgment and dismissed all claims.
- The court held GLBA and related regulations are enforced by regulators and do not provide a private civil remedy for consumers.
- The court declined to treat GLBA obligations (or the Safeguards Rule) as automatically establishing a tort standard of care enforceable in a negligence action on this record.
- The court found Guin failed to present evidence of actual misuse of his information or non-speculative damages causally linked to the theft.

## Legal Principles

- GLBA and its implementing regulations do not create a private right of action for consumers; enforcement is administrative/regulatory.
- A negligence claim requires proof of a legally cognizable duty, breach, causation, and actual damages; speculative future harm is insufficient.
- The mere theft of a device that may contain personal information, without evidence the information was accessed or used and without concrete loss, does not establish compensable damages.
- A company privacy policy does not, without more, make the company a guarantor against losses from third-party criminal acts or substitute for proof of breach and injury.

## Conclusion

The court entered judgment for the loan servicer because federal financial-privacy law did not authorize the borrower’s suit, and the borrower’s negligence theory failed on proof of breach and damages where the record showed only a stolen laptop and speculative risk, not actual misuse or loss.


Guin v. Brazos Higher Educ. Serv. Corp., 2006 WL 288483 (D. Minn. Feb. 7, 2006)