Carr v. Oklahoma Student Loan Authority

IN THE UNITED STATES DISTRICT COURT FOR THE

WESTERN DISTRICT OF OKLAHOMA

KATHLEEN CARR, individually and on )

Behalf of all similarly situated persons, )

)

Plaintiff, )

)

v. ) No. CIV-23-99-R

)

OKLAHOMA STUDENT LOAN )

AUTHORITY; and )

NELNET SERVICING, LLC, )

)

Defendants. )

ORDER

Before the Court is Defendant Nelnet Servicing, LLC’s Motion to Dismiss [Doc.

30] Plaintiffs’ Amended Class Action Complaint [Doc. 22] pursuant to Fed. R. Civ. P.

12(b)(6). Plaintiffs filed a Response [Doc. 42], and Defendants thereafter filed a Reply

[Doc. 44]. The motion is now ripe for adjudication. This Court GRANTS Defendant’s

Motion to Dismiss in part and DENIES the Motion in part for the reasons below.

I. Background

Plaintiffs Carr, Killory, and Powell bring this case individually and on behalf of

others similarly situated regarding a data breach related to student loan services they

received from Defendants Oklahoma Student Loan Authority (“OSLA”) and Nelnet

Servicing, LLC. Doc. 22 at 2, ¶ 2-3.1 Plaintiffs allege their personally identifiable

1 References to specific paragraphs of the Complaint [Doc. 22] will include a page number and a

paragraph number, as some paragraph numbers were inadvertently duplicated.

information (“PII”) was obtained by malicious actors in 2022 via a data breach of Nelnet’s

technology platform. Id. at 3, ¶ 5. Plaintiffs’ exposed PII included their names, addresses,

email addresses, phone numbers, and Social Security numbers. Id. at 13-14, ¶ 41. Plaintiffs

claim both Defendants, Nelnet and OSLA, acted negligently in protecting the PII

Defendants had been provided. Id. at 3, ¶ 8. Specifically, Plaintiffs bring the following

causes of action against Nelnet: negligence [Id. at 66-68], negligence per se [Id. at 68-71],

breach of third-party beneficiary contract [Id. at 74-75], declaratory and injunctive relief

[Id. at 75-77], and invasion of privacy [Id. at 80-83]. Defendant Nelnet moves to dismiss

Plaintiffs’ suit for failure to state a claim. Doc. 42 at 1-2.

II. Legal Standard

“To survive a motion to dismiss, a complaint must contain sufficient factual matter,

accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal,

556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007));

see also Fed. R. Civ. P. 8(a)(2) (“A pleading that states a claim for relief must contain . . .

a short and plain statement of the claim showing that the pleader is entitled to relief . . . .”).

While a complaint “need only give the defendant fair notice of what the claim is and the

grounds upon which it rests,” Khalik v. United Air Lines, 671 F.3d 1188, 1191–92 (10th

Cir. 2012) (ellipsis, internal quotation marks, and citations omitted), “[t]hreadbare recitals

of the elements of a cause of action, supported by mere conclusory statements, do not

suffice.” Iqbal, 556 U.S. at 678. “Thus, the mere metaphysical possibility that some

plaintiff could prove some set of facts in support of the pleaded claims is insufficient; the

complainant must give the court reason to believe that this plaintiff has a reasonable

likelihood of mustering factual support for these claims.” Ridge at Red Hawk, L.L.C. v.

Schneider, 493 F.3d 1174, 1177 (10th Cir. 2007). The court must draw on its “experience

and common sense” when evaluating whether a claim is plausible in a specific context.

Iqbal, 556 U.S. at 663-64.

III. Discussion

Plaintiffs bring six claims against Nelnet. Two sound in negligence, and the Court

denies Nelnet’s motion in respect to these. The Court also denies Nelnet’s motion to

dismiss the breach of contract claim and the declaratory and injunctive relief claim.

Plaintiffs’ final two claims are based in the general tort of invasion of privacy; the Court

grants Nelnet’s motion to dismiss these claims.

At the outset, the Court recognizes the likelihood of choice of law determinations

being necessary in this case. As Nelnet notes, however, choice of law analysis is a fact

intensive process which this Court is ill-equipped to engage in at this early stage of

litigation. Doc. 30 at 4 n.3. The Court agrees. See, e.g., Fed. Ins. Co. v. Indeck Power

Equip. Co., No. CIV-15-491, 2016 WL 3676803 at *2 (W.D. Okla. July 7, 2016)

(collecting cases finding a choice of law determination is premature at the motion to

dismiss stage).

However, some preliminary choice of law consideration, using the pleadings before

the Court, allows the Court to focus its inquiry into Defendant’s Motion. The Court will

apply Oklahoma’s choice of law rules. Pepsi-Cola Bottling Co. of Pittsburg, Inc. v.

PepsiCo, Inc., 431 F.3d 1241, 1255 (10th Cir. 2005) (“In a diversity action, we apply the

substantive law of the forum state, including its choice of law rules.”). Accordingly, the

Court will consider Plaintiffs’ tort claims under the laws of Nebraska, Oklahoma, New

Jersey, Massachusetts, and Indiana.2 The Court will evaluate Plaintiffs’ contract claim

under Nebraska and Oklahoma law.3 Unless Plaintiffs’ claims are implausible under the

laws of each of these states, Plaintiffs’ claims will be allowed to proceed.4

A. Negligence

Plaintiffs adequately allege the elements of a plausible negligence claim against

Nelnet. In Oklahoma, negligence requires (1) a duty of care owed by the defendant to the

plaintiff; (2) the failure of the defendant to meet that duty; and (3) an injury proximately

caused by that breach of duty.5 Franklin v. Toal, 19 P.3d 834, 837 (Okla. 2000). Defendant

Nelnet argues Plaintiffs fail to plausibly allege this claim because Plaintiffs had no

relationship with and never provided their PII to Nelnet; thus, Nelnet was under no duty to

safeguard Plaintiffs’ PII. Such an argument has no basis in the law of negligence.

2 Oklahoma uses the “most significant relationship” test to determine governing law in tort cases.

See Brickner v. Gooden, 525 P.2d 632, 637 (Okla. 1974). The four factors weighed, according to

their relative importance to the particular case, are (1) the place of the injury; (2) the place the

conduct causing the injury took place; (3) the domicile, residence, nationality, place of

incorporation, and place of business of the parties; and (4) the place where the relationship, if any,

between the parties occurred. Id. Each of the five states can claim a relationship to the suit under

these factors. Determining which state has the most significant relationship is imprudent at this

stage.

3 Oklahoma’s choice of law rule for contracts is prescribed by statute. 15 O.S. § 162 (“A contract

is to be interpreted according to the law and usage of the place where it is to be performed, or, if

it does not indicate a place of performance, according to the law and usage of the place where it is

made.”). The Court will consider the alleged contract claim under the law of Nebraska, the state

the contract was presumably performed in, and Oklahoma, the state in which the contract was

presumably made.

4 As such, it is unnecessary for the Court to address the plausibility of each claim under each state’s

law. Discussion will be limited to one state in which the claim is plausible; however, this does not

mean the claim is necessarily plausible or implausible in the other states.

5 The elements of negligence are essentially the same in each of the states. The Court analyzes this

claim under Oklahoma law.

Nelnet owed a duty to Plaintiffs, even in the absence of contractual privity, to act

reasonably in safeguarding the Plaintiffs’ PII. In Oklahoma, a duty need not be created by

statute. Wofford v. Eastern State Hosp., 795 P.2d 516, 519 (Okla. 1990). A duty arises

when a party “is put in such a position with regard to another that it is obvious that if he

did not use due care in his own conduct he will cause injury to the other[.]” Id. It is evident

and properly alleged that the exposure of a person’s social security number can cause

foreseeable injury. Doc. 22 at 15-19, ¶¶ 44-61. Thus, once Nelnet received Plaintiffs’

sensitive information, Nelnet was put in a position where harm to Plaintiffs could obviously

occur if Nelnet did not reasonably safeguard Plaintiffs’ PII.

Numerous courts that have addressed data breaches have found a similar common

law duty for the holder of sensitive information to safeguard it, regardless of the data

holder’s privity with the individual. Plaintiffs cite to many of these cases. Doc. 42 at 7-8;

see, e.g., Charlie v. Rehoboth McKinley Christian Health Care Servs., 598 F. Supp. 3d

1145, 1154-55 (D.N.M. 2022); In re Am. Med. Collection Agency, Inc. Customer Data Sec.

Breach Litig., No. CV 19-MD-2904, 2021 WL 5937742 at *15 (D.N.J. Dec. 16, 2021);

Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 914 (S.D. Cal. 2020) (finding

a common law duty to safeguard personal information was plausible even when defendant

was not in privity with plaintiffs).

Nelnet attempts to evade this conclusion by drawing a distinction between how

defendants in those cases were tasked with handling PII and how Nelnet merely provided

an online portal through which Plaintiffs’ PII passed. Doc. 44 at 1-2. It is a distinction

without a difference. If Nelnet had access to Plaintiffs’ PII such that vulnerabilities in its

online portal placed Plaintiffs at risk of foreseeable harm, Nelnet held a duty to Plaintiffs.

The Complaint adequately alleges such a duty exists. Doc. 22 at 2-4, 66-68, ¶¶ 3, 5, 10,

146-55. Therefore, Defendant Nelnet’s motion to dismiss Plaintiffs’ First Cause of Action

[Doc. 22 at 66] is DENIED.

B. Negligence Per Se

Plaintiffs allege a plausible claim of negligence per se against Nelnet for violating

Section 5 of the Federal Trade Commission Act6 (“FTC Act”); however, Plaintiffs do not

adequately allege a claim of negligence per se for violating the Oklahoma Office of

Management and Enterprise Services’ Information Security Policies, Procedures, and

Guidelines (“InfoSecPPG”).7 The determining factor in reaching this result is the class of

persons the statute and regulations seek to protect. Nelnet points out that a negligence per

se cause of action can only proceed under Oklahoma or Indiana law [Doc. 30 at 6] and

argues that Plaintiffs’ claims cannot proceed in either state. The Court disagrees.

In Oklahoma, a negligence per se claim requires three elements be shown: “(1) the

injury must have been caused by the violation; (2) the injury must be of a type intended to

be prevented by the statute; and (3) the injured party must be a member of the class intended

to be protected by the statute.” McGee v. El Patio, LLC, 524 P.3d 1283, 1286 (Okla. 2023).

Plaintiffs succeed in alleging plausible success on this claim with respect to the FTC Act,

but they fail with regard to InfoSecPPG.

6 15 U.S.C. § 45

7 State of Oklahoma Office of Management and Enterprise Services, Information Security Policy,

Procedures, Guidelines, Version 1.5, accesshttps://oklahoma.gov/omes/divisions/information-

services/about-information-services/policy-and-standards.html.

The fatal flaw for one of Plaintiffs’ negligence per se claims is that InfoSecPPG was

enacted to protect the State of Oklahoma, not the Plaintiffs. InfoSecPPG was created at the

directive of a state statute. 62 O.S. § 34.12(A). It establishes mandatory baseline standards

for state agencies and their contractors to protect the information assets of the state. See

InfoSecPPG [Doc. 43-1] at 7-9. InfoSecPPG’s purpose is repeatedly stated as “protection

of the information assets of the State of Oklahoma” and as applying to “State information.”

Doc. 43-1 at 7-9. Neither the policies themselves nor InfoSecPPG’s originating statute

refers to the protection of individuals’ information for the sake of the individuals; rather,

the statute and policies concern the design of systems protecting “information of the State.”

See 62 O.S. § 34.12; Doc. 43-1 at 10. While it could be argued that one of the “information

assets” InfoSecPPG protects is PII of people like Plaintiffs, the text of InfoSecPPG

indicates only that its data security policies are for the benefit of the State.

Plaintiffs provide no reason to depart from the plain text of InfoSecPPG. As Nelnet

points out, Plaintiffs point to no case using InfoSecPPG (or other similar state regulations)

for the purposes of demonstrating InfoSecPPG is a sound basis for their negligence per se

claim. Plaintiffs provide only that they “were within the class of persons that this statute

was designed to protect” without further explanation in their Complaint. Doc. 22 at 70,

¶ 165. This conclusory statement cannot be credited as true. Iqbal, 556 U.S. at 678. Thus,

the Court finds InfoSecPPG is not a proper basis for Plaintiffs’ Second Cause of Action,

and Nelnet’s motion to dismiss the claim with respect to InfoSecPPG is GRANTED.

Conversely, Plaintiffs succeed in alleging a plausible negligence per se claim

against Nelnet using Section 5 of the FTC Act. Plaintiffs adequately plead they are

consumers the FTC Act was designed to protect [Doc. 22 at 69, ¶ 159], suffered harm the

statute was designed to prevent [Id. at ¶ 160], and suffered harm because of Nelnet’s

violation of the statute [Id. at ¶ 161]. Nelnet argues the FTC Act does not provide for a

private right of action and, therefore, a negligence per se claim cannot lie. Nelnet cites to

cases from foreign jurisdictions holding Section 5 of the Act cannot be the predicate of a

negligence per se claim for this reason. However, this would contravene a direct holding

of the Oklahoma Supreme Court.

The absence of a private right of action in federal law does not prohibit a state

negligence per se claim based upon that law in Oklahoma. In Howard v. Zimmer, Inc.,

the Oklahoma Supreme Court responded to a certified question by the Tenth Circuit as to

whether a federal law, which required that all violations of it and its accompanying

regulations be prosecuted in the name of the United States, could form the basis of a

negligence per se claim in Oklahoma. 299 P.3d 463, 465 (Okla. 2013). The court

answered in the affirmative. Id. It distinguished private enforcement of the federal law

from a plaintiff using a violation of the Act to show a breach of the standard of care in a

negligence per se action. Id. at 469-71. It allowed a negligence per se claim to proceed

as a “parallel claim” to federal enforcement of the law. Id. at 471-73 (citing Medtronic,

Inc. v. Lohr, 518 U.S. 470 (1996)).

Here, Plaintiffs seek to use violation of the FTC Act, a federal statute, to show the

breach of a standard of care in their negligence per se claim. The Oklahoma Supreme Court

has approved such an approach. A district court in the Tenth Circuit has likewise allowed

a negligence per se claim to proceed under similar circumstances. See Charlie, 598 F.

Supp. 3d 1145, 1158-59 (applying New Mexico’s law to allow a negligence per se claim

founded on Section 5 of the FTC Act to proceed). Accordingly, Nelnet’s motion to dismiss

Plaintiffs’ Second Cause of Action [Doc. 22 at 68] with respect to the FTC Act is DENIED.

C. Breach of Third-Party Beneficiary Contract

Plaintiffs allege a plausible claim that Nelnet breached a contract to which

Plaintiffs were third-party beneficiaries. For an unnamed third-party to recover under a

contract in Nebraska,8 “it must appear by express stipulation or by reasonable intendment

that the rights and interest of such unnamed parties were contemplated and . . . the

right . . . to sue thereon must affirmatively appear from the language of the instrument[.]”

Podraza v. New Century Physicians of Nebraska, LLC, 789 N.W.2d 260, 267 (Neb.

2010). The complicating factor in this case is that Plaintiffs, upon information and belief,

can only allege the contract exists and contemplates their rights. Regardless, that is

enough at this stage.

In Nebraska, it is not necessary that Plaintiff be able to cite actual language from

the contract to properly allege a breach of contract claim. In BNSF Ry. Co. v. Seats, Inc.,

BNSF claimed it was a third-party beneficiary to a contract between General Electric

(“GE”) and Seats, Inc. for the installation of seats for engineers in BNSF’s locomotives.

361 F. Supp. 3d 947, 951 (D. Neb. 2019). BNSF alleged Seats, Inc. entered into a

contract with GE to supply seats that were suitable for their intended use and alleged

Seats, Inc. expected BNSF to receive the subject seats. Id. at 954. Notably, the court, in

8 Applying Nebraska contract law is plausibly appropriate because the alleged breaching party to

the contract performed its services in Nebraska. See 15 O.S. § 162.

ruling on Seats, Inc.’s motion to dismiss BNSF’s contract claim, did not have the alleged

agreement before it. Id. Despite its absence, the judge determined BNSF had sufficiently

alleged it was a third-party beneficiary under the strictures of Podraza and denied the

motion. Id.

Likewise, Plaintiffs in this case plead facts that plausibly state a claim they were

the intended third-party beneficiaries of services contemplated between Nelnet and

OSLA. Plaintiffs state “OSLA hired Nelnet to provide online technology services” that

provided Nelnet “access to the PII of Plaintiffs and Class.” Doc. 22 at 2, ¶ 3. Plaintiffs

allege the “sole purpose of the technology services Nelnet provided” was to provide a

secure customer website portal for Plaintiffs. Id. at 75, ¶ 194. Finally, they plead that

proper performance would have prevented their injuries, and thus, Plaintiffs are entitled

to sue upon the contract. Id. at ¶¶ 197-99.

Plaintiffs’ claim may be tenuous, but, using this Court’s “experience and common

sense,” it is plausible Plaintiffs have a cause of action as third-party beneficiaries to a

contract only Defendants can provide to this Court. Given the plausibility, Plaintiffs’

claim must be allowed to proceed. Nelnet may be able to easily disprove this claim at

later stages of litigation, if no such contract exists or if its terms so dictate, but dismissal

at this stage is premature. Therefore, Nelnet’s motion to dismiss Plaintiffs’ Fifth Cause of

Action [Doc. 22 at 74] is DENIED.

D. Declaratory and Injunctive Relief

Plaintiffs adequately state a claim for declaratory and injunctive relief under the

Declaratory Judgment Act (DJA). 28 U.S.C. § 2201. “Basically, the question in each

[DJA] case is whether the facts alleged . . . show there is a substantial controversy,

between parties having adverse legal interests, of sufficient immediacy and reality to

warrant the issuance of a declaratory judgment.” Maryland Cas. Co. v. Pac. Coal & Oil

Co., 312 U.S. 270, 273 (1941). The DJA creates an “opportunity, rather than a duty, to

grant a new form of relief to qualifying litigants[,]” and this Court is able to, in its

discretion, “dismiss an action seeking a declaratory judgment before trial or after all

arguments have drawn to a close.” Id. at 288.

Nelnet argues that Plaintiffs are not qualified litigants under the DJA and moves

the Court to dismiss the cause of action; this Court disagrees and declines to do so.

Nelnet’s opposition boils down to two points: (1) the DJA creates only a remedy, not a

cause of action; and (2) Plaintiffs fail to identify a forward-looking harm that injunctive

relief could remedy. Doc. 30 at 12. Both arguments fail to convince the Court.

Plaintiffs do not rely on the DJA to provide jurisdiction because they validly

allege subject matter jurisdiction under 28 U.S.C. § 1332(d). Doc. 22 at 7, ¶ 19. The

“Declaratory Judgment Act is not an independent source of federal jurisdiction” because

the availability of injunctive relief assumes the prior existence of a judicially remediable

right. Schilling v. Rogers, 363 U.S. 666, 677 (1960). Nelnet misapprehends the case it

cites to support its argument Plaintiffs’ DJA claim is inappropriate. Kraft v. Office of the

Comptroller of Currency, 20-CV-04111, 2021 WL 1251393 (D.S.D. Apr. 5, 2021).

There, the district court dismissed a plaintiffs’ claim under the DJA as a “nonstarter”

because the plaintiff attempted to use the DJA as the basis for the federal court’s

jurisdiction. Id. at *9. In that context, the DJA “creates a remedy, not a cause of action.”

Id. In this case, the DJA serves as a valid cause of action because Plaintiffs’ case has

subject matter jurisdiction independent of the Act.

Plaintiffs also adequately allege impending future harm injunctive relief could

remedy. Plaintiffs allege that Nelnet remains in possession of their PII and that, absent

injunctive relief from this Court, their PII remains at risk of further breach and they

remain at risk of further harm. Doc. 22 at 76, ¶¶ 202-04. Nelnet does not dispute this in

its Motion to Dismiss and argues only that the requested relief “would have no impact on

the Data Security Incident that already occurred.” Doc. 30 at 13. Nelnet is right.

Prospective relief would not remedy Plaintiffs’ alleged injuries. However, injunctive and

declaratory relief could prevent further harm if the Plaintiffs’ PII is still in Nelnet’s

possession.

Plaintiffs are qualified to ask this Court for declaratory and injunctive relief

because they allege all necessary elements and have a separate basis for subject matter

jurisdiction. It is within this Court’s discretion to grant this relief if it finds it proper to do

so. Nelnet may refute the need for this type of relief at a later stage of litigation. Nelnet’s

motion to dismiss Plaintiffs’ Sixth Cause of Action [Doc. 22 at 75] is DENIED.

E. Invasion of Privacy

The states of Oklahoma, Nebraska, New Jersey, Indiana, and Massachusetts either

explicitly or implicitly recognize the tort of invasion of privacy in accord with the four

categories defined in the Second Restatement of Torts.9 See, e.g., McCormack v. Oklahoma

9 RESTATEMENT (SECOND) OF TORTS §§ 652A – E (AM. LAW INST. 1977).

Pub. Co., 613 P.2d 737, 740 (Okla. 1980); Whipps Land & Cattle Co. v. Level 3 Commc'ns,

LLC, 658 N.W.2d 258, 269-70 (Neb. 2003); Hennessey v. Coastal Eagle Point Oil Co.,

609 A.2d 11, 17 (N.J. 1992); Cullison v. Medley, 570 N.E.2d 27, 31 (Ind. 1991); Polay v.

McMahon, 10 N.E.3d 1122, 1126-28 (Mass. 2014) (tracing development of Massachusetts

case law interpreting a statutory right to privacy and citing the Restatement favorably).10

Plaintiffs bring a cause of action under two of the Restatement’s categories: Intrusion upon

Seclusion and Publicity Given to a Private Life. The Court finds Plaintiffs do not state a

claim upon which relief can be granted in either category. Accordingly, Nelnet’s motion to

dismiss is GRANTED with respect to Plaintiffs’ Eighth Cause of Action [Doc. 22 at 80].

i. Intrusion upon Seclusion

Plaintiffs’ claim cannot proceed because it is not plausible Nelnet engaged in the

intentional conduct required to establish a claim for Intrusion upon Seclusion. To prevail

on this claim, Plaintiffs must show (1) a nonconsensual intrusion occurred that (2) was

highly offensive to the reasonable person. Gilmore v. Enogex, Inc., 878 P.2d 360, 366

(Okla. 1994); see also Munley v. ISC Fin. House, Inc., 584 P.2d 1336, 1339-40 (Okla.

1978) (“One who intentionally intrudes, physically or otherwise . . . is subject to liability .

. . .”). “[A]n intrusion occurs when an actor believes, or is substantially certain, that he

lacks the necessary legal or personal permission to commit the intrusive act.” Dubbs v.

Head Start, Inc., 336 F.3d 1194, 1221 (10th Cir. 2003) (analyzing Oklahoma’s tort of

10 The Court finds no material differences in the respective states’ laws that varies its analysis. The

Court will discuss Plaintiffs’ claims using examples from Oklahoma and the Restatement.

Intrusion upon Seclusion). Furthermore, parties agree that intentional conduct is required

for the commission of this tort in all states in which the claim could lie. Doc. 42 at 17.

The only intentional acts Plaintiffs allege Nelnet undertook with respect to

Plaintiffs’ PII were neither intentionally intrusive nor highly offensive to a reasonable

person. Plaintiffs state they “shared PII with Defendants[.]” Doc. 22 at 80, ¶ 220. Thus,

Plaintiffs willingly provided Nelnet with their PII. Even if Plaintiffs were unaware Nelnet

would end up in possession of their PII, Nelnet could not plausibly have had the requisite

belief it had Plaintiffs’ PII without “the necessary legal or personal permission.” Dubbs at

1221.

Plaintiffs attempt to ascribe the intentional and highly offensive acts of hackers to

Nelnet. Inconsistently, however, Plaintiffs expressly attribute the data breach—the

intrusive act—to Nelnet’s negligence. Doc. 42 at 20 (“As a result, Nelnet’s intentional

choice to negligently provide inadequate data security . . . .”). While Plaintiffs are entitled

to pursue alternative theories of the case, Plaintiffs do not plausibly allege the necessary

intentional conduct by Nelnet. Accordingly, Plaintiffs’ remedy against Nelnet only

properly sounds in negligence, not an intentional tort.

ii. Publicity Given to a Private Life

Plaintiffs’ claim for Publicity Given to a Private Life fails for similar reasons. Nelnet

did not give publicity to Plaintiffs’ PII; the unidentified hackers did. The tort has “three

constituent elements: (1) publicity (2) which is unreasonable and (3) is given as a private

fact.” Eddy v. Brown, 715 P.2d 74, 77 (Okla. 1986). “Publicity . . . means that the matter

is made public, by communicating it to the public at large, or to so many persons that the

matter must be regarded as substantially certain to become one of public knowledge.” Jd.

at 78 (quoting RESTATEMENT (SECOND) OF TORTS § 652D),.

Once again, Plaintiffs conflate the malicious actions of the unidentified hackers with

the unintentional actions of the Defendant. Nelnet did not communicate Plaintiffs’ PI to

anyone; it was taken from Nelnet. Plaintiffs plead as much. Doc. 22 at 12-13, 4§ 35, 40.

They do not allege Nelnet intentionally shared their data with anyone. In fact, Plaintiffs

expressly argue Nelnet’s negligence is the cause of their PII being accessible on the dark

web. Doc. 42 at 21 (“[Plaintiffs’] PII is available to the public due to Nelnet’s [] negligence

and shortcomings, is on the dark web, and is being used for nefarious purposes.’’). Parties

dispute whether publication of matter on the dark web is sufficient to satisfy the publicity

element of the tort; the Court need not decide whether it is because Nelnet’s intentional

actions are not the cause of the PII’s publication. Plaintiffs’ claim sounds in negligence.

IV. Conclusion

Plaintiffs properly state claims against Defendant Nelnet for negligence, negligence

per se, breach of third-party beneficiary contract, and declaratory and injunctive relief.

Their claims for Intrusion upon Seclusion, and Publicity Given as a Private Fact fail for the

reasons set forth above. Accordingly, the Court GRANTS Defendant’s Motion to Dismiss

with respect to Plaintiffs’ Eighth Cause of Action. The Court DENIES Defendant’s Motion

with respect to Plaintiffs’ First, Second, Fifth, and Sixth Causes of Action.

IT IS SO ORDERED this 19th day of October 2023.

UNITED STATES DISTRICT JUDGE

15