Hunter v. Securly, Inc.

• Court: District Court, D. Minnesota
• Decided: December 4, 2024
• Docket: 0:24-cv-02159
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA

Nicole Hunter, on behalf of her minor Civil No. 24-2159 (DWF/DLM) child S.M., individually and on behalf of all others similarly situated,

Plaintiff, MEMORANDUM v. OPINION AND ORDER

Securly, Inc.,

Defendant.

INTRODUCTION This matter is before the Court on Defendant Securly, Inc.’s (“Securly”) motion to strike immaterial allegations from the amended complaint, motion to dismiss the amended complaint for lack of standing, and motion to dismiss the amended complaint for failure to state a claim. (Doc. No. 32.) Plaintiff Nicole Hunter, on behalf of her minor child S.M. and others similarly situated, opposes all motions. (Doc. No. 40.) For the reasons set forth below, the Court grants the motion to dismiss for lack of standing and denies other motions as moot. BACKGROUND Hunter is the mother of S.M., a middle school student enrolled in Saint Paul Public Schools (“SPPS”). (Doc. No. 30 (“Am. Compl.”) ¶¶ 8, 14.) Securly is a company which provides schools with software that monitors for inappropriate materials. (Id. ¶ 2.) Securly supplied SPPS with monitoring software, which was installed on SPPS students’ school-issued iPads. (Id. ¶¶ 15-16.) Hunter brings a complaint against Securly, on behalf of S.M. and others similarly situated, for violations of the Minnesota Government Data Practices Act (“MGDPA”). (Id. ¶ 1.)

SPPS has used Securly’s content filtering since before 2022.1 (Id. ¶ 20.) SPPS purchased two Securly products: Filter and Home. (See id. ¶¶ 3, 20.) The Filter product is a “cloud-based web filter designed specifically for schools” which “block[s] inappropriate sites instantly.” (Id. ¶ 24.) The Home product “offers schools the ability to customize parents’ control over their child’s school device when it goes home.” (Id. ¶ 3.)

Between these products, Securly tracks, among other things, a student’s “geolocation, keystrokes and web searches, websites visited, and videos watched.” (Id. ¶ 16.) This tracking is done each time the school-issued device is accessed, both when the device is on the school’s campus and when it is elsewhere. (Id. ¶¶ 27, 30.) Any data collected through these services belongs to the school with which Securly contracts. (Id. ¶¶ 32-33.)

S.M. was issued an iPad by SPPS “for school and personal use at home and on campus.” (Id. ¶ 8.) S.M. used that device for personal and educational searches. (Id.) Neither Hunter nor S.M. were aware that SPPS had installed Securly’s software on the device.2 (Id. ¶ 16.) Hunter was never provided with a disclosure that S.M.’s device data would be collected by Securly. (Id. ¶ 18.)

1 The exact timeline of Securly’s relationship with SPPS is unclear from the pleadings. SPPS’s email to parents on September 26, 2022, informed parents that SPPS had used Securly “for a few years” but no specific date is given. (Am. Compl. ¶ 20.) 2 There is some debate between the parties on what information the parents had access to about SPPS’s use of Securly. Both parties request that the Court take judicial Hunter became aware of Securly’s data monitoring activities on September 16, 2022, when Securly emailed Hunter S.M.’s activity report. (Id. ¶¶ 18-19.) These activity report emails “summarize the content of [a] child’s school-issued device activity.” (Id.

¶ 29.) The exact content of these emails is determined by the school with which Securly contracts. (Id. ¶ 32.) The email received by Hunter included both school-related searches and personal activities. (Id. ¶ 39.) Hunter further describes these emails as “teaser[s]” because they encourage the parent-recipient to download Securly’s mobile app. (Id. ¶ 37.) While these emails were supposed to end in October 2023, when SPPS

turned on Securly’s Enhanced Privacy Mode feature, Hunter received an activity report email in November 2023. (Id. ¶ 45.) Hunter brings the current action alleging that Securly unlawfully disclosed S.M. and other similar students’ educational data in violation of MGDPA. (Id. ¶¶ 55-73.) Hunter also seeks punitive damages, alleging that Securly deliberately disregarded the

rights and safety of the SPPS students. (Id. ¶¶ 74-76.) DISCUSSION Securly moves to dismiss the amended complaint under Rules 12(b)(1) and 12(b)(6) and moves to strike material from the amended complaint under Rule 12(f). (Doc. No. 32.)

notice of the contents of various SPPS webpages to shed light on the understanding between SPPS, Securly, and the parents and students. (Doc. Nos. 47 & 48.) The materials requested to be noticed are unnecessary to resolve the motions at hand. The Court declines to take judicial notice at this time. I. Defendant’s Motion to Dismiss Under Rule 12(b)(1) A. Legal Standard A motion to dismiss under Federal Rules of Civil Procedure 12(b)(1) challenges

the Court’s subject matter jurisdiction. Fed. R. Civ. P. 12(b)(1). To survive a motion under Rule 12(b)(1), the party asserting jurisdiction has the burden of proving jurisdiction. V S Ltd. P’ship v. Dep’t of Hous. & Urb. Dev., 235 F.3d 1109, 1112 (8th Cir. 2000). “Subject-matter jurisdiction is a threshold requirement which must be assured in every federal case.” Kronholm v. Fed. Deposit Ins. Corp., 915 F.2d 1171, 1174 (8th

Cir. 1990). A Rule 12(b)(1) motion may challenge a plaintiff’s complaint either on its face or on factual truthfulness of its averments. Osborn v. United States, 918 F.2d 724, 729 n.6 (8th Cir. 1990); see also Fairview Health Servs. v. Armed Forces Off. of the Royal Embassy of Saudi Arabia, No. 21-cv-2666, 2023 WL 4203035, at *2 (D. Minn. June 27,

2023). When a defendant brings a factual challenge, the court may consider matters outside the pleadings and weigh the accuracy of the allegations. Titus v. Sullivan, 4 F.3d 590, 593 (8th Cir. 1993). Article III limits the federal judicial power to “Cases” and “Controversies.” U.S. Const. art. III, § 2. “For there to be a case or controversy under Article III, the plaintiff

must have ‘a personal stake’ in the case—in other words, standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). “[T]o establish standing, a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992)). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected

interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (quoting Lujan, 504 U.S. at 560). Plaintiffs, who are invoking the Court’s jurisdiction, bear the burden of establishing standing. Id. at 338. B. Analysis

Securly asserts that Hunter’s amended complaint must be dismissed because Hunter lacks standing to bring the case. (Doc. No. 34 at 19.) Hunter alleges two injuries: nuisance and intrusion upon seclusion. (Am. Compl. ¶ 47.) Securly challenges Hunter’s amended complaint on factual grounds, asserting that Hunter’s alleged injuries are not concrete nor actionable. (Doc. No. 34 at 21.)

1. Nuisance Hunter references cases finding eavesdropping and wiretapping to be privacy violations to support her allegation of nuisance. (Doc. No. 40 at 21.) However, the amended complaint fails to allege either of those specific harms. A general claim of nuisance without allegation of the specific harm fails to establish the concrete and

particularized harm required to establish standing. In George D. v. NCS Pearson, Inc., the Court dismissed a claim of invasion of privacy for lack of Article III standing because the plaintiff failed to identify the basis of the claim in the complaint and only tried to correct that error in the opposition memorandum. No. 19-cv-2814, 2020 WL 3642325, at *2 n.1 (D. Minn. July 6, 2020). Hunter’s claim fails in the same manner. Hunter did not sufficiently allege harm by simply claiming nuisance in her amended complaint and later referencing eavesdropping in an opposition memorandum.

2. Intrusion upon Seclusion In Minnesota, intrusion upon seclusion requires a demonstration of three elements: (1) an intrusion; (2) that is highly offensive; (3) into some matter in which a person has a legitimate expectation of privacy. Swarthout v. Mut. Serv. Life Ins. Co., 632 N.W.2d 741, 744 (Minn. Ct. App. 2001).

Securly asserts that Hunter did not adequately plead a legitimate expectation of privacy and emphasizes that “students have no reasonable expectation of privacy in their school computer usage.” (Doc. No. 34 at 23-24.) Hunter disagrees and asserts that “S.M. has a reasonable expectation of privacy in her personal, online activity.” (Doc. No. 40 at 18.) At oral argument, Hunter went so far as to assert that children have a right of

privacy at a level equivalent to adults. (Doc. No. 51 (“Hr’g Tr.”) at 31:11-12 (“[T]hese children have the same right of privacy as Your Honor and I. They have a right of privacy.”); id. at 33:24-25 (“But children don’t surrender their right to privacy [any more] than adults do.”).) Hunter’s misplaced notions3 about a child’s general right to privacy

3 One example in support of a child’s right to privacy offered by Hunter at oral argument was a child’s right to receive reproductive healthcare in school without parental consent. (Hr’g Tr. at 49:18-25.) This analogy fails to consider that a child’s right to reproductive healthcare without parental consent is an exception, not the rule. Minn. Stat. § 144.343 allows a minor to consent to healthcare in certain circumstances without parental consent. But this is an explicit exception to the general rule that minors must have parental consent for healthcare services. See Elisabeth Klarqvist, Minors’ Consent aside, Hunter makes no argument that a child’s right to privacy in a school is legitimate. Instead, Hunter focuses on personal privacy. Hunter had the burden to establish the element of a legitimate expectation of privacy in the school setting and failed to do so.

Because Hunter’s pleading is insufficient on the expectation of privacy element of intrusion upon seclusion injury in fact, Hunter lacks standing to bring this claim. The Court need not opine on the issue of whether the monitoring is highly offensive. Hunter has not met her burden of establishing standing. Hunter has failed to adequately allege harm, either nuisance or intrusion upon seclusion. Securly’s motion to

dismiss under Rule 12(b)(1) is granted and the amended complaint is dismissed without prejudice. II. Remaining Motions The dismissal under Rule 12(b)(1) renders moot the motion to dismiss under Rule 12(b)(6)4 and the motion to strike under Rule 12(f).5

for Health Care, MN House Rsch. (Aug. 2023), https://www.house.mn.gov/hrd/pubs/ss/ssminorhc.pdf. 4 Securly asserts that Hunter fails to state a claim for both the alleged violations of MGDPA and for the request for punitive damages. (Doc. No. 34 at 26, 31.) The Court makes no decision on these issues but notes a few discrepancies that should be addressed if Hunter files a new complaint. The Court fails to see how the alleged sharing of non-educational data (see Doc. No. 40 at 23) supports a claim for a violation of Minn. Stat. § 13.32, subd. 13(e), which applies to “educational data.” The Court also fails to see how the alleged use of parents’ data for marketing (see Doc. No. 40 at 16) supports a claim for a violation of Minn. Stat. § 13.32, subd. 13(f), which extends only to data “which relates to a student.” Minn. Stat. § 13.32, subd. 1(a) (2024) (defining “educational data”). CONCLUSION The Court grants Securly’s motion to dismiss under Rule 12(b)(1). To meet Article III’s standing requirements, a plaintiff must establish injury in fact. Hunter fails

to do so, meaning that the Court does not have subject matter jurisdiction over Hunter’s claims. Securly’s motion to dismiss under Rule 12(b)(6) and motion to strike under Rule 12(f) are therefore rendered moot. ORDER Based upon the foregoing, and the files, records, and proceedings herein, IT IS

HEREBY ORDERED that: 1. Defendant Securly, Inc.’s motion to dismiss under Rule 12(b)(1) (Doc. No. [32]) is GRANTED. 2. Defendant Securly, Inc.’s motion to dismiss under Rule 12(b)(6) (Doc. No. [32]) is DENIED AS MOOT.

3. Defendant Securly, Inc.’s motion to strike under Rule 12(f) (Doc. No. [32]) is DENIED AS MOOT.

On the issue of punitive damages, the parties disagree on the application of Minnesota’s Gatekeeper Statute, Minn. Stat. § 549.20. (Compare Doc. No. 34 at 31-34, with Doc. No. 40 at 33-34.) The Court’s recent decision in Hormozi v. Neist Media LLC resolves this conflict. No. 24-cv-3241, 2024 WL 4772462 (D. Minn. Nov. 13, 2024). The Court held that the federal rules conflict with the Gatekeeper Statute and that the rules are valid, therefore the Court must follow the federal rules. Id. at *8. 5 Securly moves to strike any reference to Securly’s Aware product from the pleadings because such references are irrelevant and risk prejudice against Securly. (See Doc. No. 34 at 17-19.) The Court is inclined to agree, as Hunter puts forth no evidence that SPPS purchased or used Securly’s Aware product on the school-issued devices. 4. Plaintiff Nicole Hunter’s amended complaint against Defendant Securly, Inc. (Doc. No. [30]) is DISMISSED WITHOUT PREDJUDICE. LET JUDGMENT BE ENTERED ACCORDINGLY.

Dated: December 4, 2024 s/Donovan W. Frank DONOVAN W. FRANK United States District Judge