Guin v. Brazos Higher Education Service Corp.

Brazos Higher Education Service Corporation, Inc. (Brazos) (defendant) was a nonprofit that originated and serviced student loans. Brazos had a privacy policy in place. Stacy Guin (plaintiff) obtained a student loan through Brazos. One of Brazos’s employees was a financial analyst who determined risk in certain loan portfolios. To perform the risk analysis, the employee needed individual-loan information, which included personal information. This information was on the employee’s laptop, which stayed in his home because the employee worked remotely. The employee’s home was burglarized, and the laptop was lost and never recovered. Although Brazos officials knew that the laptop had stored personal information, it was unable to determine which individual-student-loan borrowers’ information was on the laptop. Brazos eventually sent all its customers a letter notifying them that their personal information may have been inappropriately accessed by a third party. The letter also informed the borrowers of how to take steps that could protect against identity theft. Guin never received any information that his personal information was actually accessed by a third party or that he was the victim of an identify theft. Nonetheless, Guin sued Brazos for (among other things) negligently controlling his personal information. Specifically, Guin claimed that Brazos breached a duty of care owed to him under the Gramm-Leach-Bliley Act (GLBA) and Brazos’s privacy policy. Brazos moved for summary judgment, arguing that it did not breach any duty owed under the GLBA.