OPINION *
Pro se appellant Darren Eades appeals the District Courts order dismissing his complaint. We will affirm the District Courts judgment.
Eades, a prisoner at SCI-Smithfield, alleged that a variety of prison officials violated his constitutional right to privacy and his rights under the Fair Credit Reporting Act (FCRA) by disclosing his medical information and his Social Security number to Accreditation, Audit & Risk Management Security, LLC (AARMS), which then suffered a data breach in which his information may have been stolen. Eades alleged that this data breach affected more than 13,000 inmates. He further alleged that the defendants never informed him that they would be supplying his private information to AARMS.
On the defendants’ motion under Fed. R. Civ. P. 12(b)(6), the District Court dismissed the complaint. The Court concluded that the defendants were entitled to qualified immunity as to Eadess right-to-privacy claims and that Eades had failed to state a claim under the FCRA. Eades filed a timely notice of appeal.
We have jurisdiction under 28 U.S.C. § 1291. We exercise plenary review over the District Courts dismissal order. See Fleisher v. Standard Ins. Co., 679 F.3d 116, 120 (3d Cir. 2012). In reviewing a dismissal under Rule 12(b)(6), “we accept all factual allegations as true [and] construe the complaint in the light most favorable to the plaintiff.” Pinker v. Roche Holdings Ltd., 292 F.3d 361, 374 n.7 (3d Cir. 2002). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)).
We agree with the District Courts disposition of this case. Turning first to Eadess FCRA claim, even assuming that the defendants can qualify as “furnishers of information” under the FCRA, “15 U.S.C. § 1681s–2(b) [is] the only section that can be enforced by a private citizen seeking to recover damages caused by a furnisher of information.” SimmsParris v. Countrywide Fin. Corp., 652 F.3d 355, 358 (3d Cir. 2011). This subsection imposes certain duties on a furnisher “[a]fter receiving notice ․ of a dispute with regard to the completeness or accuracy of any information provided by a person to a consumer reporting agency.” § 1681s–2(b)(1). Under this subsection, notice “must be given by a credit reporting agency, and cannot come directly from the consumer.” SimmsParris, 652 F.3d at 358. As the District Court ruled, Eadess claim fails because he has not alleged that AARMS gave notice to the defendants of any “dispute with regard to the completeness or accuracy of any information.” See id. Accordingly, we will affirm this part of the District Courts order.
We likewise discern no error in the District Courts dismissal of Eadess right-to-privacy claims on the ground that the defendants were protected by qualified immunity. Qualified immunity “shields officials from civil liability so long as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.” James v. N.J. State Police, 957 F.3d 165, 169 (3d Cir. 2020) (quoting Mullenix v. Luna, 577 U.S. 7, 11, 136 S.Ct. 305, 193 L.Ed.2d 255 (2015)).
1
“[C]learly established rights are derived either from binding Supreme Court and Third Circuit precedent or from a robust consensus of cases of persuasive authority in the Courts of Appeals.” Id. at 170 (quoting Bland v. City of Newark, 900 F.3d 77, 84 (3d Cir. 2018)).
The District Court did not err in dismissing Eadess claim concerning the defendants’ distribution of his Social Security number. This Court has not addressed the issue in a precedential opinion, and other Courts of Appeals have held that “the Constitution does not provide a right to privacy in ones SSN.” Cassano v. Carb, 436 F.3d 74, 75 (2d Cir. 2006) (per curiam); see also Barber v. Overton, 496 F.3d 449, 456 (6th Cir. 2007); McElrath v. Califano, 615 F.2d 434, 441 (7th Cir. 1980). Eades therefore cannot show that he had a clearly established constitutional right to privacy in his Social Security number.
Eadess claim concerning the disclosure of his medical records meets the same fate. This Court has held “that the Fourteenth Amendment protects an inmates right to medical privacy, subject to legitimate penological interests.” Doe v. Delie, 257 F.3d 309, 311 (3d Cir. 2001); see also Doe v. Luzerne Cty., 660 F.3d 169, 176 (3d Cir. 2011); Malleus v. George, 641 F.3d 560, 565 (3d Cir. 2011). Nevertheless, this Court has not applied this general rule to delineate the circumstances in which the disclosure of a prisoners medical information will violate his constitutional rights, and we have found no authority from this Court or elsewhere addressing whether providing medical records to an auditor like AARMS is reasonably related to a legitimate penological interest. See generally Doe, 660 F.3d at 176 (explaining that “[p]rivacy claims under the Fourteenth Amendment necessarily require fact-intensive and context-specific analyses”). While “it need not be the case that the exact conduct has previously been held unlawful,” qualified immunity will apply unless “there are sufficiently analogous cases that should have placed a reasonable official on notice that his actions were unlawful.” Kane v. Barger, 902 F.3d 185, 194–95 (3d Cir. 2018) (quotation marks, alteration omitted).
2
The District Court did not err in concluding that, given the dearth of specific case law, the defendants did not violate Eadess clearly established constitutional rights in this respect, either.
3
Accordingly, we will affirm the District Courts judgment.
FOOTNOTES
1
. There are two prongs to the qualified-immunity analysis: the plaintiff must show “(1) that the official violated a statutory or constitutional right, and (2) that the right was ‘clearly established’ at the time of the challenged conduct.” Ashcroft v. al-Kidd, 563 U.S. 731, 735, 131 S.Ct. 2074, 179 L.Ed.2d 1149 (2011) (quoting Harlow v. Fitzgerald, 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982)). Courts may consider the prongs in either order, see id., and the District Court here started with the second prong.
2
. Eades cites various federal regulations that he claims should have prevented disclosure, but “[o]fficials sued for constitutional violations do not lose their qualified immunity merely because their conduct violates some statutory or administrative provision.” Walker v. Coffey, 905 F.3d 138, 150 n.63 (3d Cir. 2018) (quoting Davis v. Scherer, 468 U.S. 183, 194, 104 S.Ct. 3012, 82 L.Ed.2d 139 (1984)).
3
. In light of the legal bars to Eadess claims that we have discussed above, we are satisfied that the District Court did not err in concluding that amendment would be futile. See generally Grayson v. Mayview State Hosp., 293 F.3d 103, 106, 108 (3d Cir 2002).
PER CURIAM