The case of Abdulaziz v. McKinsey & Co., Inc. is fascinating. In February 2021, the plaintiff, Omar Abdulaziz, filed a complaint in the New York Supreme Court alleging claims against the defendant, McKinsey & Company, for the negligent infliction of emotional distress. Abdulaziz’s allegations stem from a report prepared by McKinsey identifying him as one of the three most influential critics of the Kingdom of Saudi Arabia (“KSA”) and Mohammad Bin Salman (“MBS”). The plaintiff is a political dissident from the Kingdom of Saudi Arabia who was granted political asylum in Canada because he faces persecution following the murder of his friend Jamal Khashoggi. While studying in Montreal, the plaintiff began using Twitter and other social media platforms to post political commentary about Saudi Arabia. Frequent topics of the plaintiff’s criticism include the regime’s governance of the country, rampant human rights violations, the royal family, corruption, and misguided foreign policy.
On the other hand, McKinsey has a long history of providing regular and extensive consulting services to Saudi Arabian government agencies, to the point that the country’s Ministry of Planning has been nicknamed the “Ministry of McKinsey” by some Saudis, including the royal court. In late 2016, McKinsey prepared a report in the form of a PowerPoint presentation that identified the three most influential dissidents using Twitter to criticize Crown Prince Mohammad Bin Salman’s austerity plan (“McKinsey Report”). The plaintiff was one of the three individuals McKinsey identified in its report. The plaintiff, Abdulaziz, alleged that, after receiving the report, the Saudi government responded with assassination attempts and arrested, tortured, and harassed his family members and friends who currently live in Saudi Arabia.
In September 2021, the district court dismissed the complaint in its entirety. Abdulaziz appealed the decision, and in July 2022, the Second Circuit of the United States Court of Appeals concluded that McKinsey lacked a duty of care under New York law, largely based on the fact that “generally, there is no duty to control the conduct of third parties to prevent them from causing harm to others.”
Does McKinsey have a review or risk management process to assess potential business projects with foreign governments that could lead to potential human rights abuses or other adverse consequences? The plaintiff was suing McKinsey not for its failure to control the Saudi government, but for its own actions in providing information to the Saudi government that allegedly helped cause harm to him. The court addressed this by concluding that, aside from the foreseeability of the risk, Abdulaziz failed to provide any reason why sharing the report was in itself a breach of a recognizable duty of care owed by McKinsey to Abdulaziz, compounded by the fact that the plaintiff failed to distinguish this alleged duty from similar ones that had been rejected by New York courts. In this regard, the precedent Valeriano v. Rome Sentinel Co.[1] (“no duty not to publish another person’s personal information, no statutory, contractual, or fiduciary duty to protect the confidentiality of the plaintiff’s personal information”). Thus, even if McKinsey knew or should have known that the Saudi government would target Abdulaziz after learning of his dissident activity in the report, Abdulaziz did not plausibly allege a breach of a recognizable duty of care under New York law.
However, the “Valeriano” precedent dealt only with the alleged harm resulting from the publication of the plaintiff’s personal information, and New York courts generally do not recognize privacy torts. However, in Abdulaziz v. McKinsey & Co., the claim concerns damages resulting from alleged assassination attempts and physical harm to family members and friends.
We are dealing with a category of cases involving the act of facilitating or inducing the wrongdoing of others. Hence, we ask: if I give a gun to someone, when I should have known that they would likely use it for criminal purposes, would I be guilty of negligence? If I give information to someone, when I should have known that they would likely use it for criminal purposes, wouldn’t that also constitute a presumably valid claim of negligence—or a possible “no-duty” rule arising from the special status of the information, rather than from a “no duty to control third parties” theory?
Incidentally, in the case of Remsburg v. Docusearch[2], the court allowed a negligence suit against a private investigator who uncovered information that a stalker used to kill his target: “A party who realizes or ought to realize that its conduct has created a condition involving an unreasonable risk of harm to another has a duty to exercise reasonable care to prevent that risk from occurring. The exact occurrence or specific injuries need not have been foreseeable. Thus, if the disclosure of information by a private investigator or information broker to a client creates a foreseeable risk of criminal misconduct against the third party about whom the information was disclosed, the investigator has a duty to exercise reasonable care not to subject that third party to an unreasonable risk of harm.”
In other words, people generally have a duty to care for others when they know or should reasonably foresee that their conduct may cause physical harm to those people or their property. The reasonable foreseeability of physical harm is generally sufficient to impose a duty of care on a person who knows or ought reasonably to foresee that physical harm is a likely result of their conduct. In the case of Abdulaziz v. McKinsey & Co, it was possible—though not typical—that the disclosure of the information would lead to unjust harm. The harm was foreseeable, but is it reasonably foreseeable? I believe that negligently entrusting a weapon to someone involves a greater likelihood of harm.
But if that were truly the case, would there be a duty to avoid doing business with or providing services to dishonest governments? Would a supplier of weapons to the Saudis face—or should it be held liable for—the plight of an unfortunate Yemeni citizen in the capital, Sana’a? Or, if one friend tells another that his wife is cheating on him, and he predictably attacks her (or her lover). Would I be liable for negligence? Or, say, a woman tells her boyfriend that someone raped her (or otherwise abused her), and he predictably attacks the assailant. Would she be liable for negligence?
However, wouldn’t the justification for this have to be a limitation of duty, rather than foreseeability? After all, if I’m violating a traffic law and get into an accident, the accident would be considered foreseeable, even though I’m likely to get into an accident only a small fraction of the times I’ve violated a traffic law. Wouldn’t the probability that a man informed of his wife’s infidelity would attack her lover be even greater? Note that I just wrote “attack” and not “kill”—for foreseeability to be considered, there would have to be a sufficient probability of some physical attack. Obviously, I’d like to think that you’d be more careful about telling a tyrannical regime that I’m a dissident than about telling my spouse that I’m having an affair. But the difficult question in these cases is whether it is right (legally) to be as careless as you want, because you have no duty of care in the first place.
A rough simplification of the scenario seems to be as follows: if you cause bodily harm to another person that you could have foreseen as a real possibility beforehand, you will likely be liable for negligence, unless: a) You were legally authorized to do so; b) The harm you caused resulted from a failure to act (an omission) rather than an act; c) The harm was caused by the actions of some other liable party whom you were unable to control;
These “policy” reasons for denying a duty do not appear to be present in this case, as it is not alleged that McKinsey was unable to control the Saudis, but simply that they disclosed information that predictably led to a Saudi reaction. This might apply to any direct physical harm caused to Abdulaziz.
Civil liability in the U.S. has two basic ways of conceiving of foreseeability. One is the “Hand Formula.” Foreseeability is simply the probability of an event occurring—for some reference class that, intuitively, we think we know. But there is another, older—yet still vibrant—way of thinking about foreseeability. This other approach is embodied in the “reasonably prudent person” doctrine and asks, essentially, what we expect to happen. In this case, it asks how we expect an informed spouse to react. This tends to anchor the inquiry into foreseeability around what “normally happens.” I can imagine a court saying that “normally, a spouse informed of their spouse’s infidelity does not physically assault their spouse or their lover.” This might lead them to say “not foreseeable as a matter of law.” In any case, the point is the same: what is foreseeable looks different when viewed through the lens of the ARP (average reasonable person) doctrine, rather than through the lens of the Hand formula.
Underlying this discussion is the issue of communication. Speech always raises a special question of liability. The person being spoken to must act in accordance with what is said. In principle, you might think that someone who merely says something to another person is never liable for subsequent damages caused by the person being spoken to. In other words, we treat the decision of the person being spoken to as a superseding cause of harm in all cases. However, sometimes the information seems more like an instrument that enables someone to do something wrong than a tool that allows them to decide for themselves what they wish to do. The agency of the person being spoken to does not arise as a significant issue when the information is merely a tool that enables that person to commit a wrongful act they intend to commit but otherwise could not. Nevertheless, between “information to be processed by the person being addressed” and “instrument” lie cases of intentionally or negligently inducing someone to do something harmful to themselves or others.
Contrary to the communicative aspect, other arguments can be put forward. By way of illustration, the case is analogous to the liability of social hosts for the drunk driving of those to whom they served alcohol, as in Childs v. Desormeaux[3]. A dominant academic approach in the common law is to focus on the defendant: Did the defendant, through his negligent act, reasonably cause the plaintiff’s injury? Yes. End of story. Another way to address the issue is to ask: What harm did the plaintiff suffer? He was struck by a drunk driver [social host], shot [gun seller], or subjected to attempted murder or torture of family members and friends [Abdulaziz v. McKinsey].
If A acquires, authorizes, or ratifies B’s actions, or conspires with B to commit a tort, B’s wrongful conduct will be attributed to A. However, if A merely facilitates B’s actions, this is insufficient to hold A liable. Social hosts, arms dealers, and the consulting firm McKinsey all fall into the category of facilitation. Is this sufficient to hold them liable for the wrongs of others? Was the action that constituted the wrongful act the defendant’s own action?
If we consider that the tort consists of exposing others to the risk of injury, then the social host, the arms dealer, and McKinsey have committed a tort. So have the driver, the shooter, and the Saudi government. However, if we believe that the wrongful act consists of the injury itself (being run over, being shot, etc.), this gives us a different answer, since the social host, the arms dealer, and McKinsey did not do those things. Instead, they did something that led another person to do those things. In any case, from both perspectives, there may be another type of wrongdoing consisting of a breach of a supposed duty of care.
Perhaps the difference in positions is largely semantic. For those who emphasize the causal link, in a case where the defendant negligently creates a danger, but the plaintiff recklessly exposes himself to that danger and suffers damages, the courts exempt the defendant from liability because the sole legal cause of the damage was the victim’s own exclusive act. The same reasoning applies to negligent third parties.
Finally, returning to the case at hand, did McKinsey have a duty toward Abdulaziz not to place him in danger by identifying him as one of Saudi Arabia’s three most effective critics? It may be that the New York court’s response was to establish a “no-duty” rule based on public policy. The defendant’s actions predictably caused harm to the plaintiff, but for various reasons we may conclude that the defendant should nevertheless be immune. This is how we conceptualize the American rule against social host liability—for reasons of public policy, we do not want to put ordinary people in a position where they have to police their guests’ alcohol consumption. Similarly, there may be similar public policy reasons why we do not want to prevent people from telling their friends about events in their lives, even when they know that their friends might get angry and hurt someone as a result.
In short, there may be some other fundamental principle at play—specifically, freedom of speech. Especially in U.S. law, concerns about freedom of speech can be incorporated into the framework of torts. Here is an excerpt from the commentary to the Restatement (Third) of Torts (Physical & Emotional Harm, sec. 7) that articulates the Second Circuit’s analysis well: “Comment c. Conflicts with Social Norms Regarding Liability. When deciding whether to adopt a no-duty rule, courts generally rely on general social norms of liability. For example, many courts have held that commercial establishments serving alcoholic beverages have a duty to exercise reasonable care to prevent harm to others who might be injured by an intoxicated patron, but that social hosts do not have a similar duty toward those who might be injured. ... No-duty rules are appropriate only when a court can enact relatively clear, categorical, and unambiguous rules of law applicable to a general class of cases.”
In short, the controversy involves a number of nuances and demonstrates just how complex the task of civil liability is in resolving social conflicts.
----------
- 842 N.Y.S.2d 805, 806 (4th Dep't 2007)
- 149 N.H. 148 (2003): “The risk of criminal misconduct is sufficiently foreseeable that an investigator has a duty to exercise reasonable care in disclosing a third party’s personal information to a client. And we so hold. This is especially true when, as in this case, the investigator does not know the client or the client’s purpose in seeking the information.”
- https://www.stevehedley.com/odg/admin/2006.htm