Dear Eugene;

This is a fascinating question- I may use it in teaching duty of care this semester! Under the current Australian approach to duty of care, there is a principle that still seems to be relevant which was referred to by McHugh J in D’Orta-Ekenaike v Victoria Legal Aid (2005) 223 CLR 1:

 

Ordinarily, people owe a duty of care to other persons when they know or ought reasonably to foresee that their conduct may cause physical damage to those persons or their property. Reasonable foreseeability of physical harm is generally enough to impose a duty of care on a person who knows or ought reasonably foresee that physical harm is a likely result of his or her conduct. (at 36-37)

 

A rough simplification of the law would seem to be: if you cause personal bodily injury to someone which you could have foreseen as a real possibility beforehand, then you will probably be liable for negligence unless

•          You were authorized to do so by some statute ;

•          The harm you caused resulted from a failure to do something (an omission [non-feasance] rather than a commission [misfeasance]);

•          The harm was caused by the actions of some other responsible actor whom you failed to control;

•          Holding you liable would cut across principles of liability in some other well-established area of liability.

 

These “policy” reasons for denying a duty do not seem to be present here, in that as you say it is not alleged that McKinsey failed to control the Saudis, simply that they revealed information which foreseeably led to a Saudi reaction. At least this would possibly apply to any direct physical harm caused to Mr Abdulaziz. However, there may be some other over-riding principles at stake- perhaps free speech? But that is not strongly protected in Australia. We do have a decision in Australia that even the common law doctrine of “act of state” (courts will not usually pass judgment on the actions of foreign governments) does not provide an immunity from suit where acts of torture are alleged: Habib v Commonwealth of Australia [2010] FCAFC 12 (25 February 2010) http://www.austlii.edu.au/cgi-bin/viewdoc/au/cases/cth/FCAFC/2010/12.html . So an argument could be made.

Regards

Neil

 

 

 

 

So the Second Circuit held yesterday in Abdulaziz v. McKinsey & Co., Inc., https://www.courthousenews.com/wp-content/uploads/2022/07/abdulaziz-mckinsey-ca2.pdf, concluding that McKinsey as a matter of law lacked a duty of care under New York law, largely on the grounds that “[g]enerally, there is no ‘duty to control the conduct of third persons to prevent them from causing injury to others.’”  (“Abdulaziz pled that, after receiving the report, the Saudi government responded by targeting him with assassination attempts and arrested, tortured, and harassed his family members and friends currently living in Saudi Arabia.”)

 

But I wonder whether this is quite right:  Plaintiff was suing McKinsey not for its failure to control the Saudi government, but for its own actions in providing information to the Saudi government that allegedly helped cause the injury to him.  The court deals with this by saying,

 

Other than the foreseeability of risk, Abdulaziz provides no reason why sharing the report was itself a breach of a cognizable duty of care running from McKinsey to Abdulaziz, and he fails to distinguish such a putative duty from similar ones rejected by New York courts. See Valeriano v. Rome Sentinel Co., 842 N.Y.S.2d 805, 806 (4th Dep’t 2007) (no duty not to publish another’s personal information absent a “statutory, contractual or fiduciary duty to protect the confidentiality of plaintiff’s personal information”). Thus, even if McKinsey knew or should have known that the Saudi government would target Abdulaziz after learning of his dissident activity from the report, Abdulaziz has not plausibly alleged a breach of a duty of care cognizable under New York law.

 

But Valeriano dealt only with the alleged harm of publishing personal information as such (New York doesn’t generally recognize privacy torts); here, the claim is of harm stemming from the alleged assassination attempts and physical injury to family members and friends – perhaps not recoverable under another theory, but not quite the same as Valeriano, I think.

 

My question:  If I give someone a gun, when I should have known that he was likely to use it for criminal purposes, I’d be guilty of negligence, under a negligent entrustment, theory.  If I give someone information, when I should have known that he was likely to use it for criminal purposes, wouldn’t this likewise be a presumptively valid negligence claim, though with a possible First Amendment defense, or a possible no-duty rule stemming from the special status of information, and not from a “no duty to control third parties” theory?  Or am I analyzing the case incorrectly?  Thanks,

 

Eugene Volokh

UCLA School of Law