JOHN DOE-1 v. LEXISNEXIS RISK SOLUTIONS, INC.

• Court: District Court, D. New Jersey
• Decided: January 27, 2025
• Docket: 1:24-cv-04566
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY

JOHN DOE-1, et al. : CIVIL ACTION : v. : : LEXISNEXIS RISK SOLUTIONS, : NO. 24-4566 INC., et al. :

MEMORANDUM Bartle, J. January 27, 2025 Plaintiffs John Doe and Jane Doe bring this putative class action against defendant LexisNexis Risk Solutions, Inc. (“LexisNexis”) for improperly imposing a “credit freeze” on their accounts in violation of the New Jersey Identity Theft Protection Act, N.J. Stat. Ann. §§ 56:11-44, et seq. (“NJITPA”) (Count I). Plaintiffs also claim intentional interference with contractual and prospective relations (Count II) and have a separate count for declaratory relief (Count III).1 Their “prayer for relief” requests actual and punitive damages, injunctive relief as well as declaratory relief. Subject matter jurisdiction exists under 28 U.S.C. § 1332(a) as plaintiffs are

1. Although plaintiffs identify declaratory relief as its own cause of action, a request for relief in the form of declaratory judgment is not an independent cause of action. See In re Joint E. & S. Dist. Asbestos Litig., 14 F.3d 726, 731 (2d Cir. 1993) (citing Skelly Oil Co. v. Phillips Petroleum Co., 339 U.S. 667, 671-72 (1950)); see also Mutasa v. U.S. Citizenship & Immigr. citizens of New Jersey and the named defendant was incorporated in Florida and has its principal place of business in New York.2 Before the court is the motion of defendant LexisNexis to dismiss the amended complaint under Rule 12(b)(6) of the Federal Rules of Civil Procedure for failure to state a claim on which relief can be granted (Doc. # 51). I

For present purposes, the Court must accept as true all well-pleaded facts in plaintiffs’ amended complaint. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). The Court may also consider “exhibits attached to the complaint and matters of public record.” Pension Benefit Guar. Corp. v. White Consol. Indus., Inc., 998 F.2d 1192, 1196 (3d Cir. 1993) (citing 5A Charles Allen Wright & Arthur R. Miller, Federal Practice and Procedure § 1357 (2d ed. 1990)). When there is a document “integral to or explicitly relied upon in the complaint,” it may also be considered as there is no concern of lack of notice to the plaintiff. See Schmidt v. Skolas, 770 F.3d 241, 249 (3d

Cir. 2014) (quoting In re Burlington Coat Factory Secs. Litig., 114 F.3d 1410, 1426 (3d Cir. 1993) (quotation marks omitted)). The amended complaint must plead more than “labels and conclusions.” Twombly, 550 U.S. 545. It must plead more than

2. While the amended complaint does not state the citizenship of LexisNexis, the parties stipulated in open court as to its citizenship. “a formulaic recitation of the elements of a cause of action” or “naked assertions devoid of further factual enhancement.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 555) (internal quotations and alterations omitted). Instead, it must recite sufficient factual content to state a claim that is plausible on its face. Id. at 678. II

The well-pleaded facts as stated in the amended complaint are as follows. Plaintiff John Doe (“Doe-1”) is a former police officer with the South Plainfield, New Jersey police department. Plaintiff Jane Doe (“Doe-2”) is a retired New Jersey police officer who suffers from multiple sclerosis. On January 2, 2024, Officer Doe-1 sent a request to LexisNexis pursuant to a New Jersey statute known as Daniel’s Law.3 Officer Doe-2 sent the same request to LexisNexis on January 1, 2024. Daniel’s Law provides that judges, prosecutors and other law enforcement officials as well as their immediate family members may submit a written notice to any person,

business, or association (“entity”) not to disclose or otherwise make available their home addresses and unpublished personal telephone numbers. The entity must comply within 10 business

3. Daniel’s Law, as amended, is codified as follows: N.J. Stat. Ann. §§ 2C:20-31.1, 17:46B-1.1, 19:31-18:1, 46:26A–12, 47:1-17, 47:1A-1.1, 47:1A-5, 47:1B-1, 47:1B-2, 47:1B-3, 47:1B–4, 56:8-166.1, 56:8-166.3. days. The law creates a civil remedy for damages and injunctive relief as well as criminal penalties for noncompliance. In January 2024, each plaintiff sent the following request to LexisNexis: To Whom It May Concern:

I Am a “Covered Person” as defined by New Jersey law P.L. 2023, c. 113, P.L. 2021, c. 371 (as amended, the “Act”). Pursuant to the Act and Section 3 of New Jersey P.L. 2015, c.226 (C.56:8-166.1) (as amended), I hereby request that you not disclose or re- disclose on the Internet or otherwise make available, the following protected information:

Name: [plaintiff’s name was inserted]

Home Address: [plaintiff’s home address was inserted] As a result, LexisNexis imposed a security freeze on plaintiffs’ entire files, not just as to their home addresses and unlisted phone numbers. LexisNexis sent letters to Officer Doe-1 and Officer Doe-2, which stated in relevant part: RE: Security Freeze Confirmation

Thank you for your request to place a security freeze on your file with LexisNexis Risk Solutions. (“LexisNexis”) as provided by law in your state of residence. This letter is to confirm that a security freeze has been placed on your file.

Security freezes will be placed based on your state of residency and the customers use case. Based on this information, LexisNexis may not release your report(s) or score(s) derived for those use cases. You should be aware that applying a security freeze to your file may delay, interfere with, or prohibit the timely approval of applications you make for items such as credit, benefits, or insurance underwriting. WARNING TO PERSONS SEEKING A CREDIT FREEZE AS PERMITTED BY THE CREDIT REPORT PROTECTION ACT: YOU MAY BE DENIED CREDIT AS A RESULT OF A FREEZE PLACED ON YOUR CREDIT FILE. A security freeze does not apply to certain users of consumer reports, including those with whom you already have an existing account. These users request your file for the purpose of reviewing that account.

This security freeze is being placed on your file pursuant to the security freeze laws in your state of residence, NJ, specifically, N.J. Stat. Ann. § 56:11-30, 56:11-46, 13:45F-2.7, 18:45F-5.1 as of the date of this letter. . . . This security freeze will remain in place indefinitely until you decide to temporarily or permanently remove the security freeze. Below you will find a unique Personal Identification Number (PIN) that you will need in the event that you choose to temporarily or permanently remove the security freeze.

[plaintiff’s PIN is inserted]

Should you wish to remove your security freeze, you must contact us and provide proper identification and your PIN number.

. . .

If you have any further questions, you may contact the LexisNexis Consumer Center via email at consumer.documents@LexisNexisRisk.com or by phone at 800-456-1244.

LexisNexis Consumer Center According to the amended complaint, Doe-1 attempted to have LexisNexis remove this freeze on multiple occasions, but it has not complied. Its letter requested him to use his PIN, but his pleading does not say that he did so. Officer Doe-2, according to the amended complaint, has not attempted to remove the freeze due to her serious medical condition. Information about plaintiffs was still available on

LexisNexis’ “people search” function after the 10-day period had expired under Daniel’s Law. Officer Doe-2 avers that due to her multiple sclerosis, she requires “unfettered access to sophisticated and expensive treatments to moderate her medical conditions” which “requires equally unfettered access to credit on an ongoing basis.” III Plaintiffs articulate two violations of the NJITPA: (1) LexisNexis imposed a security freeze without plaintiffs’ direct request; and (2) LexisNexis failed to lift the security freeze upon their request.4 LexisNexis argues that plaintiffs

4. Plaintiffs argue in their brief in opposition to defendant’s motion to dismiss that they also state a claim that LexisNexis disclosed their personal information without authorization in violation of the NJITPA. In support of their contention, they cite Boone v. T-Mobile USA Inc. for the proposition that New Jersey state law “provides a right of action” for the unauthorized disclosure of personal information. See Civ. A. No. 17-378, 2018 WL 588927, at *8 (D.N.J. Jan. 29, 2018). However, plaintiffs in Boone brought their claims under Sections 31a and 40 of the New Jersey Fair Credit Reporting Act, fail to state a claim under the NJITPA for either of these claims. The New Jersey Identity Theft Protection Act was enacted in 2005 to amend and supplement the New Jersey Fair Credit Reporting Act (“NJFCRA”). See Reed v. Swatch Grp. (US), Inc., Civ. A. No. 14-896, 2014 WL 7370031, at *6 n.2 (D.N.J. Dec. 29, 2014). Its purpose is to protect consumers from

identity theft and to “enact certain other protections and remedies related thereto and thereby further the public safety.” N.J. Stat. Ann. 56:11-45(h). Similar to the federal Fair Credit Reporting Act, the statute is remedial and therefore should be constructed liberally in order to achieve its “consumer oriented objectives.” See Long v. Se. Pa. Transp. Auth., 903 F.3d 312, 318-19 (3d Cir. 2018) (quoting Cortez v. Trans Union, LLC, 617 F.3d 688, 706 (3d Cir. 2010)). The NJITPA allows a consumer to compel a consumer reporting agency such as LexisNexis to impose a security freeze on his or her consumer report.5 When a security freeze is placed

not cite to those subsections and only allege in their amended complaint that LexisNexis violated N.J. Stat. Ann. § 56:11-46. As plaintiffs do not allege that it also violated N.J. Stat. Ann. § 56:11-31a or 40, they may not belatedly maintain in an opposing brief that they adequately allege that LexisNexis disclosed their personal information without authorization under that statute. 5. A consumer report is [A]ny written, oral or other communication on a consumer’s report, a consumer reporting agency is prohibited from releasing the report or any information within it “without the express authorization of the consumer.” N.J. Stat. Ann. § 56:11-30.6 The NJITPA provides that: a. A consumer may elect to place a security freeze on his consumer report by: (1) making a request in writing by certified mail or overnight mail to a consumer reporting agency; or (2) making a request directly to the consumer reporting agency through a secure electronic mail connection, if an electronic mail connection is provided by the consumer reporting agency.

agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for: (a) credit or insurance to be used primarily for personal, family or household purposes; (b) employment purposes; or (c) any other purpose [authorized under the New Jersey Fair Credit Reporting Act]. N.J. Stat. Ann. 56:11-30. 6. While a security freeze placed on a consumer’s consumer report “prohibits the consumer reporting agency from releasing the report or any information from it without the express authorization of the consumer,” it “does not prevent a consumer reporting agency from advising a third party that a security freeze is in effect with respect to the consumer report.” Id. b. A consumer reporting agency shall place a security freeze on a consumer report no later than five business days after receiving a written request from the consumer. . . . j. A security freeze shall remain in place until the consumer requests that the security freeze be removed. A consumer reporting agency shall remove a security freeze within three business days of receiving a request for removal from the consumer, who provides the following: (1) Proper identification; and (2) The unique personal identification number or password provided by the consumer reporting agency pursuant to subsection c. of this section. N.J. Stat. Ann. § 56:11-46 (emphasis added). Section 56:11-50 of the NJITPA provides a civil remedy for failure to comply with the above requirements: a. Any person who willfully fails to comply with the requirements [Section 56:11-46] shall be liable to a consumer as provided in [Section 56:11-38]. b. Any person who is negligent in failing to comply with the requirements of [Section 56:11-46] shall be liable to a consumer as provided in [Section 56:11- 39]. Sections 56:11-38 and 11-39 are contained within the NJFCRA. Plaintiffs argue that their emails to LexisNexis were not requests to freeze their credit but rather narrow requests pursuant to Daniel’s Law simply not to disclose or make available their home addresses or unlisted phone numbers.7 While plaintiffs’ requests to LexisNexis do not use the term “Daniel’s Law,” they do cite the relevant sections of the New Jersey statute. The NJITPA permits a consumer to elect to impose a security freeze by making a written request that the consumer reporting agency do so. Section 56:11-50 provides that a

violation occurs when a person negligently or willfully fails “to comply with the requirements” of Section 56:11-46, which deals with security freezes. LexisNexis maintains that it may be held liable only for failing to implement a freeze when asked to do so but not, as occurred here, for mistakenly imposing a freeze without a request to do so. The court construes the NJITPA as allowing a consumer reporting agency to implement a freeze only when the consumer makes the request. The statute provides for only one procedure to obtain a security freeze of a consumer credit report. It necessitates a request by the consumer among other steps. The

one specific procedure outlined in the NJITPA to obtain a freeze necessarily eliminates all other means for obtaining or implementing a freeze. The inclusion of one is the exclusion of another (expressio unius est exclusio alterius). See Jacobsen

7. Daniel’s Law does not require the imposition of a credit freeze. v. Dara, 62 A.3d 942, 945 (N.J. Super. Ct. 2011); see also United States v. Giordano, 416 U.S. 505, 513-15 (1974). Here it is alleged that LexisNexis implemented a freeze even though plaintiffs did not request one. If LexisNexis did so, it acted contrary to the prescribed statutory procedure. The exception LexisNexis urges would also create a giant loophole in the NJITPA. LexisNexis’ reading of the statute would run counter to

the statute’s liberal construction to achieve consumer-oriented objectives. See Young v. Schering Corp., 660 A.2d 1153, 1158 (Pa. 1995); see also Long, 903 F.3d at 318. Plaintiffs have stated a claim that LexisNexis has violated the NJITPA by imposing credit freezes without their direction for such a result. LexisNexis further argues that Officer Doe-1 has failed to state a claim based on its failure to lift the security freeze upon his request. It maintains that Officer Doe-1 does not allege he followed the required statutory procedure to vitiate a security freeze. As noted above, the

agency must do so within three business days after receipt of the consumer’s “proper identification” and “[t]he unique personal identification number or password provided by the consumer reporting agency.” N.J. Stat. Ann. § 56:11-46(j). While Officer Doe-1 avers that he made multiple attempts to lift the security freeze, the amended complaint states only that he included “the same personal information contained in those initial requests.” He does not allege that he provided his personal identification number, that is his PIN, to LexisNexis as required under the NJITPA in order to remove the freeze. This PIN was not provided to him until after he made his initial request under Daniel’s Law, that is not until LexisNexis sent its letter, which he received on or about January 17, 2024 and

which is quoted in the amended complaint. Since his request to remove the freeze did not include his PIN, his claim that LexisNexis violated Section 56:11-46(j) of the NJITPA in failing to lift the freeze is fatally deficient. In plaintiffs’ opposing brief, Officer Doe-2 maintains that she also alleges a claim under Section 56:11-46(j) and that LexisNexis did not lift a security freeze upon her request. However, Officer Doe-2 fails to state in the amended complaint that she made any attempt to lift the security freeze on her credit. On the contrary, she alleges she has chosen not to attempt to lift the security freeze on her file. To the extent

that Officer Doe-2 pleads a violation of Section 56:11-46(j), her claim also fails. IV LexisNexis next argues that plaintiffs fail to state a claim for intentional interference with contractual and prospective contractual relations under New Jersey law (Count II). It asserts that this is an “amalgam” of two separate common-law claims: tortious interference with contract and tortious interference with prospective contractual relations. The elements of tortious interference with a contract under New Jersey law are: (1) actual interference with a contract; (2) that the interference was inflicted intentionally by a defendant who is not a party to the contract; (3) that the interference was without justification; and (4) that the interference caused damage. Dello Russo v. Nagel, 817 A.2d 426, 434 (N.J. Super. Ct. 2003) (citing 214 Corp. v. Casino Reinvestment Dev. Auth., 656 A.2d 70, 72 (N.J. Super. Ct. 1994)). To succeed on a claim for intentional interference with a contractual relationship under New Jersey law, the tortfeasor’s interference must be “knowing, intentional, and wrongful.” Mylan Inc. v. SmithKline Beecham Corp., 723 F.3d 413, 422 (3d Cir. 2013). According to Mylan, “[a]ctual knowledge of the contract with which a defendant supposedly interfered is a prerequisite to making out a claim for tortious interference.” Id. The tortfeasor must have actual knowledge of the “specific contractual right.” Id. Simply having “[g]eneral knowledge of a business relationship is not sufficient.” DiGiorgio Corp. v. Mendez & Co., 230 F. Supp. 2d 552, 564 (D.N.J. 2002); see also Restatement (Second) Torts § 766, cmt. i (Am. L. Inst. 1979). The amended complaint does not allege that LexisNexis had actual knowledge of any contractual relationship of plaintiffs. They simply rely on the response of LexisNexis to their request that certain personal information not be disclosed or otherwise made available. In applying the security freeze, LexisNexis wrote: You should be aware that applying a security freeze to your file may delay, interfere with, or prohibit the timely approval of applications you make for items such as credit, benefits, or insurance underwriting. The argument that this suffices as pleading actual knowledge by LexisNexis of specific contractual rights of plaintiffs falls far short. The response by LexisNexis merely advises plaintiffs of what the consequences may be if a security freeze is imposed. It says nothing about its actual knowledge of specific contracts to which plaintiffs are a party. Even if it can be inferred that LexisNexis had some general knowledge of business relationships plaintiffs may have with vendors, it is not reasonable to infer that it had any specific information about those relationships. Plaintiffs have failed to meet the plausibility pleading standard under Iqbal and Twombly, supra. Conclusory allegations will not do. To state a claim for intentional interference with prospective economic relations, plaintiff must allege: (1) that plaintiff had a “reasonable expectation of economic advantage;” (2) which plaintiff interfered with intentionally and with malice; and (3) that such interference led to the “loss of the prospective gain.” MacDougall v. Weichert, 677 A.2d 162, 174 (N.J. 1996) (citing Printing Mart-Morristown v. Sharp Elecs. Corp., 563 A.2d 31, 37 (Pa. 1989) (per curiam)). A plaintiff need not allege the existence of a “formal, binding contract” but must demonstrate a specific protectable interest. See

Printing Mart-Morristown, 563 A.2d at 39. A plaintiff’s claim will be dismissed if plaintiff, for example, merely alleges the loss of unknown customers. Austar Int’l Ltd. V. AustarPharma LLC, 425 F. Supp. 3d 336, 359 (D.N.J. 2019) (citing Harmon v. Borough of Belmar, No. 17-2437, 2018 WL 6068216, at *8 (D.N.J. Nov. 29, 2018)). In this action, the amended complaint states that Officer Doe-1 had “prospective relationships in the future.” It gives no further detail. This allegation is insufficient as it does not identify a specific prospective contract that LexisNexis frustrated by the imposition of the credit freezes.

Again, plaintiffs allegations do not meet the plausibility requirement of Iqbal and Twombly. Officer Doe-2 alleges that LexisNexis interfered with her “unfettered access to [treatments for multiple sclerosis]” by denying her “unfettered access to credit on an ongoing basis.” The amended complaint does not allege that LexisNexis had any knowledge of her medical condition or her need for continued medical treatment. Nor is there any allegation that it knew of any relevant specific contractual or prospective contractual relationships. Neither plaintiff has stated a claim for intentional interference with contractual relations or a claim for intentional interference with prospective contractual relations.

V LexisNexis next argues that even if plaintiffs have alleged valid claims under state law, their claims are preempted by the Fair Credit Reporting Act, 15 U.S.C. § 1671, et seq. (“FCRA”). Preemption is an affirmative defense and therefore, dismissal under Rule 12(b)(6) is only justified when defendant can show that preemption is “manifest in the complaint itself.” Lupian v. Joseph Cory Holdings LLC, 905 F.3d 127, 130-31 (3d Cir. 2018). The FCRA preempts some but not all actions brought pursuant to related state laws such as the NJITPA. See 15

U.S.C. § 1681t(a). It specifically preempts state law to the extent that state law makes any “requirement or prohibition” “with respect to any subject matter under . . . subsections (i) and (j) of section 1681c-1” relating to security freezes. Id. at § 1681t(b)(1)(J). Subsections 1681c-1(i) and (j) detail the process by which a consumer reporting agency8 shall place a security freeze on a consumer’s credit file after a request by a protected consumer or his or her representative. It must do so only upon the consumer’s “direct request . . . upon receiving proper identification from the consumer[.]” See 15 U.S.C. § 1681c- 1(i)(2)(A).

Similar to the FCRA, the NJIPTA sets forth how a consumer may place a security freeze on his consumer report. A consumer reporting agency is directed to place a security freeze after receiving a request directly from a consumer. N.J. Stat. Ann. § 56:11-46(a). Both statutes require that the consumer reporting agency comply with the request within a certain time period. See N.J. Stat. Ann. § 56:11-46(b); see also 15 U.S.C. § 1681t(i)(2)(A). Within five days, both the FCRA and the NJITPA require a consumer reporting agency provide the consumer with written confirmation of the requested freeze. See id. at (b); see also 15 U.S.C. § 16681t(i)(2)(B). Like the FRCA, the

NJITPA directs consumer reporting agencies to lift a credit freeze upon a consumer’s request only after it is provided with

8. A consumer reporting agency is an entity that “regularly engages in the practice of assembling or evaluating, and maintaining [public record and credit account information], for the purpose of furnishing consumer reports to third parties bearing on a consumer’s credit worthiness, credit standing, or credit capacity . . . .” 15 U.S.C. § 1681a(p). “proper identification.” Compare N.J. Stat. Ann. § 56:11-46(j), (k) with 15 U.S.C. § 1681c-1(i)(3)(C). The NJITPA, however, imposes a requirement not included in the FCRA. Before a consumer may lift a security freeze under the NJITPA, he or she must also provide the consumer reporting agency with his or her personal identification number (PIN), which the consumer reporting agency is required to provide upon the imposition of

the freeze. See N.J. Stat. Ann. § 56:11-46(c), (j)(2). It also provides that when a reporting agency removes a security freeze because it was placed “due to a material misrepresentation of fact by the consumer,” the agency must notify the consumer in writing at least five business days prior to removing the freeze. Id. at (g)(2). But see 15 U.S.C. § 1681c- 1(i)(3)(A)(ii). As noted by plaintiffs, the FCRA also regulates “national security freezes,” while the NJITPA contains no such qualifier. Plaintiffs maintain that their claims are not preempted despite the express preemption of claims within

subsections 1681c-1(i) and (j) of the FCRA. In support of their contention, they cite an interpretive rule which clarifies that states are free to enact “laws that are more protective” than the FRCA. See The Fair Credit Reporting Act’s Limited Preemption of State Laws, 87 Fed. Reg. 41042 (July 11, 2022). They also cite several decisions in other circuits that narrowly construed the FRCA’s express preemption provisions and held that additional state regulation is permissible. See, e.g., Consumer Data Indus. Ass’n v. Frey, 26 F.4th 1, 6 (1st Cir. 2022); Galper v. JP Morgan Chase Bank, 802 F.3d 437, 447 (2d Cir. 2015). In each case identified by plaintiffs, the courts permitted plaintiffs to proceed with their state law claim because the subject matter was not one the FCRA expressly

preempted. For example, in Consumer Data Industry Association v. Platkin, the court considered whether New Jersey could require, via the NJFCRA, consumer reporting agencies to provide credit file disclosures in twelve or more languages. Civ. A. No. 19-19054, 2024 WL 1299256, at *1 (D.N.J. Mar. 27, 2024).9 The credit reporting agencies argued that Section 1681t(b)(5)(B) and (E) of the FCRA prohibited the application of this requirement. Platkin, 2024 WL 1299256, at *17. Those subsections bar a state’s imposition of requirements or prohibitions relating to Sections 1681c-1 and 1681j(a), which concern, respectively, identity theft protection and the free

annual disclosures that consumers are entitled to under the FCRA. Id. The court concluded that because neither section of

9. The court severed this requirement from the NJFCRA on First Amendment grounds, and plaintiff Consumer Data Industry Association appealed this decision on May 6, 2024. On October 17, 2024, the parties stipulated to dismiss the action without prejudice and without costs against any party. Stipulation of Dismissal, Consumer Data Indus. Ass’n v. Platkin, No. 24-1810 (3d Cir. Oct. 17, 2024). the FCRA “addressed the language file disclosures should be made in,” the federal FCRA did not preempt this provision of the NJFCRA. Id. at *18. Again, plaintiffs’ remaining claim is that LexisNexis imposed a security freeze without first receiving a consumer’s direct request to do so. This is a violation of Sections 56:11- 46(a), (b) and (c) of the NJITPA. While those sections of the

NJITPA are not more protective than Section 1681c-1(i)(2) of the FCRA, they regulate the same conduct. Both statutes require that a consumer reporting agency not only impose a freeze upon the direct request of a consumer within a specific time period but also send a confirmation that the security freeze has been placed. Nonetheless, the FCRA expressly preempts plaintiffs’ NJITPA claim related to the imposition of a security freeze. Plaintiffs also argue that preemption is not appropriate because Daniel’s Law, which prohibits the disclosure of the home addresses and unlisted phone numbers of covered persons is not preempted by Section 1681t(b)(1)(J) of the FCRA.

They maintain that neither home addresses nor unlisted phone numbers are necessary components of a security freeze and so therefore, their claim is not preempted by the FCRA. The question whether Daniel’s Law is preempted by the FCRA is not germane because plaintiffs bring a claim under the NJITPA. The correct inquiry is whether the NJITPA, and not Daniel’s Law, is preempted by the federal FCRA.10 Plaintiffs may pursue their claims relating to security freezes under the FCRA but not under the NJITPA. VI Plaintiffs’ claims under the NJITPA are expressly preempted by the Fair Credit Reporting Act. Further, plaintiffs

have not stated viable claims under the New Jersey common law. Accordingly, the court will dismiss the amended complaint with leave to file a second amended complaint on or before February 6, 2025 under the Fair Credit Reporting Act only. BY THE COURT:

_/s/ Harvey Bartle III___ J.

10. Finally, plaintiffs contend that LexisNexis should be estopped from arguing that the security freezes “were somehow mandated under the FCRA” upon plaintiffs’ request under Daniel’s Law. Plaintiffs maintain that this is a course change from its prior statements that identifying information such as a consumer’s name, phone number, or address were not characteristics “enumerated in the definition of a ‘consumer report’ in the FCRA.” At this stage of the litigation, the court cannot determine this issue as a matter of law.