[*356] [*812] We granted certiorari in these cases to determine, first, whether the Court of Appeals erred in holding that the State has waived sovereign immunity under the Georgia Torts Claims Act ("GTCA"), OCGA § 50-21-20 et seq., for Thomas McConnell's tort action and, second, whether the Court of Appeals erred in holding that McConnell's complaint failed to state a claim.^[1] After review, we agree with the Court of Appeals and affirm.

1. The underlying facts are essentially undisputed. In September 2012, the Georgia Department of Labor created a spreadsheet containing the name, social security number, home telephone number, email address, and age of 4,757 individuals over the age of 55 in Cherokee, Cobb, and Fulton counties who had applied for unemployment benefits or other services administered by the Department, including McConnell. Almost a year later, a Department employee inadvertently sent an email with the spreadsheet attached[*813] to approximately 1,000 recipients without the permission of the individuals whose information was included in the spreadsheet.

On January 17, 2014, McConnell filed a complaint, which he later amended on March 12, 2014, against the Department on behalf of himself and a proposed class of all individuals whose information was contained in the spreadsheet, alleging negligence, breach of fiduciary duty, and invasion of privacy by public disclosure of private facts. The complaint alleged that, as a result of the Department's negligent disclosure of McConnell's and the other proposed class members' personal information, they were required to place freezes and alerts with credit reporting agencies, close or modify financial accounts, and closely review and monitor their credit reports and accounts for unauthorized activity. The complaint further alleged that McConnell and others whose information had been disclosed incurred out-of-pocket costs related to credit monitoring and identity protection services and suffered adverse impacts to their credit scores related to the closure of credit accounts. In addition, the complaint alleged that the affected individuals experienced, and would continue to experience, fear, upset, anxiety, and injury to peace and happiness, as the disclosure of their personal identifying information provided the material necessary to facilitate identity theft and unauthorized charges on their credit and bank accounts. The complaint did not allege that any identity theft or resulting unauthorized charges actually had occurred. Nor did the complaint allege that the personal identifying information had been disclosed by or for criminal conduct.

The Department filed a motion to dismiss, which the trial court granted, ruling that sovereign immunity barred the lawsuit because the GTCA did not waive the State's immunity for the type of "loss" that McConnell alleged. OCGA § 50-21-22 (3).^[2] The trial court also held that each count of the complaint failed to state a claim upon which relief could be granted. See OCGA § 9-11-12 (b) (6).

McConnell appealed, and the Court of Appeals affirmed, pretermitting a decision on sovereign immunity and addressing only the trial court's ruling that each count of the complaint failed to state a claim. See McConnell v. Dept. of Labor , 337 Ga. App. 457, 787 S.E.2d 794 (2016). We granted McConnell's petition for certiorari to decide whether the Court of Appeals erred in considering the merits of McConnell's claims without deciding first whether sovereign immunity barred the lawsuit. We held that the Court of Appeals[*357] did[*814] err in this regard, and we vacated the Court of Appeals' judgment and remanded the case with direction to make the threshold determination. See McConnell v. Dept. of Labor , 302 Ga. 18, 19, 805 S.E.2d 79 (2017).

On remand, the Court of Appeals first held that the trial court erred in concluding that sovereign immunity barred McConnell's claims. See McConnell v. Dept. of Labor , 345 Ga. App. 669, 670-675 (1), 814 S.E.2d 790 (2018) (physical precedent only). On the merits, the Court of Appeals again held that the trial court properly dismissed the complaint for failure to state a claim. See id. at 675-683 (2)-(4), 814 S.E.2d 790(full concurrence as to Div. 2). Both the Department and McConnell filed petitions for certiorari, which we granted. After review, we conclude that the Court of Appeals was correct, and we affirm its holdings.

2. The Department argues that the definition of "loss" set forth in OCGA § 50-21-22 (3) limits the waiver of sovereign immunity in OCGA § 50-21-23 (a) to claims where a plaintiff also has suffered a personal "injury, disease, or death," which the complaint did not allege. We disagree.

The complaint alleged that a Department employee, acting within the scope of his employment, committed the torts of negligence, breach of fiduciary duty, and invasion of privacy against McConnell and the other proposed class members. And OCGA § 50-21-23 (a) says that "[t]he state waives its sovereign immunity for the torts of state ... employees while acting within the scope of their ... employment," subject to the exceptions and limitations set forth in the rest of the GTCA. Thus, absent some express "exception[ ] or limitation[ ] set forth in [the GTCA]," the State waived its sovereign immunity from McConnell's lawsuit. See OCGA § 50-21-23 (a). The Department does not argue that the conduct alleged in the complaint is included in any of the exceptions or limitations listed in OCGA §§ 50-21-24 (1) - (13) and 50-21-24.1.

The Department instead contends that OCGA § 50-21-22 (3) provides an exception or limitation in its definition of "loss." But OCGA § 50-21-23 (a), which waives the State's sovereign immunity from tort claims "in broad language," see Dept. of Transp. v. Montgomery Tank Lines , 276 Ga. 105, 106 (1), 575 S.E.2d 487 (2003), mentions "loss" only in the context of a non-waiver of sovereign immunity that does not apply here.^[3] Moreover, as the Court of Appeals noted,[*815] OCGA § 50-21-22 (3) ends with a catch-all phrase that unambiguously includes in the definition of loss "any other element of actual damages recoverable in actions for negligence," which clearly encompasses McConnell's tort claims.

The Department's other arguments - that McConnell's lawsuit does not fit within OCGA § 50-21-22 (3)'s catch-all phrase because Georgia does not recognize as a cognizable injury his alleged economic damages, and that Georgia's "impact rule" bars McConnell's claims for emotional damages - actually are arguments about the validity of McConnell's claims and are irrelevant to the threshold question of whether the State has waived its sovereign immunity from McConnell's lawsuit. See Upper Oconee Basin Water Auth. v. Jackson County , 305 Ga. App. 409, 412 (1), 699 S.E.2d 605 (2010) ("A motion to dismiss asserting sovereign immunity is based upon the trial court's lack of subject matter jurisdiction, rather than the merits of the plaintiff's claim." (Citation and punctuation omitted.)).

Accordingly, because McConnell's claims for negligence, breach of fiduciary duty, and invasion of privacy sound in tort, are based on the conduct of a state employee while acting within the employee's scope of employment, and do not fall within an express exception or limitation in the GTCA, we agree with the Court of Appeals and conclude that the GTCA waived the State's sovereign immunity from McConnell's lawsuit. Thus, McConnell has carried his burden of showing that the trial court had subject matter[*358] jurisdiction over his claims. Therefore, we now address the merits.

3. McConnell contends that the Court of Appeals erred in holding that his complaint failed to state a claim upon which relief could be granted. The complaint contained counts for negligence, breach of fiduciary duty, and invasion of privacy. We consider each count in turn.

(a) Negligence is premised on, among other things, a duty owed by the defendant to the plaintiff. See Rasnick v. Krishna Hospitality, Inc. , 289 Ga. 565, 566, 713 S.E.2d 835 (2011). The complaint alleged that the Department owed a duty to McConnell and the other proposed class members to safeguard and protect their personal information, which McConnell argues is based on a purported common law duty "to all the world not to subject [others] to an unreasonable risk of harm," Bradley Center, Inc. v. Wessner , 250 Ga. 199, 201, 296 S.E.2d 693 (1982) (opinion of Gregory, J.), and two statutes, OCGA §§ 10-1-393.8 and 10-1-910.

In Bradley Center , the lead opinion, which only two Justices joined, said that everyone owes a general duty not to subject others to an "unreasonable risk of harm" and may be liable for any breach of[*816] that duty that causes harm to another. However, the language in Bradley Center on which McConnell relies was not a holding concurred in by a majority of this Court, was not supported by the only authority that the lead opinion cited, was not a correct statement of the law, did not control the result in that case (which was based on a "special relationship" between the plaintiff and the defendant), and has never been endorsed in a decision of this Court that qualifies as precedent. Accordingly, we hereby disapprove Bradley Center to the extent that it created a general legal duty "to all the world not to subject [others] to an unreasonable risk of harm." 250 Ga. at 201, 296 S.E.2d 693.^[4] We therefore reject McConnell's reliance upon Bradley Center .

McConnell also argues that two statutes, OCGA §§ 10-1-910 and 10-1-393.8, created a legal duty on the part of the Department to safeguard his and the other proposed class members' personal information. But OCGA § 10-1-910 does not explicitly establish any duty, nor does it prohibit or require any conduct at all. Rather, the statute recites a series of legislative findings about the vulnerability of personal information and the risk of identity theft. And while OCGA § 10-1-393.8 (a) (1) says that no "person, firm, or corporation" shall "[p]ublicly post or publicly display in any manner an individual's social security number," the statute then immediately adds, "As used in this Code section, 'publicly post' or 'publicly display' means to intentionally communicate or otherwise make available to the general public." The complaint alleged only a negligent disclosure, not an intentional one. Even assuming that OCGA § 10-1-393.8 (a) (1) creates a duty enforceable in tort to refrain from intentionally disclosing social security numbers, McConnell has not shown that the Department owed him or the other proposed class members a duty to protect their information against negligent disclosure. Accordingly, the Court of Appeals correctly held that the complaint failed to state a claim for negligence.^[5]

(b) McConnell contends that the Court of Appeals erred in holding that the breach of fiduciary duty count failed to state a claim upon which relief could be granted. Specifically, McConnell argues that Department employees are public officers and that, under the[*817] Trustee Clause of the Georgia Constitution, they owed McConnell and the other proposed class members a fiduciary duty to protect their personal information. We disagree.[*359] The Trustee Clause provides, "Public officers are the trustees and servants of the people and are at all times amenable to them." Ga. Const. of 1983, Art. I, Sec. II, Par. I. Even assuming that this statement includes a duty owed to individual members of the public that is enforceable in tort,^[6] the Trustee Clause "is applied when a public officer ha[s] definitely benefitted financially (or definitely stood to benefit financially) as a result of simply performing [his or her] official duties." (Citation and punctuation omitted.) City of Columbus v. Georgia Dept. of Transp. , 292 Ga. 878, 882, 742 S.E.2d 728 (2013). The complaint did not allege that any public officer was "reaping personal financial gain at the expense of the public," so the Trustee Clause is inapplicable. Id.

McConnell also argues that the particular facts of this case created a confidential relationship that imposed a fiduciary duty on the Department to McConnell and the proposed class members. The complaint alleged that a fiduciary duty arose when the Department required McConnell and the other proposed class members to disclose their confidential personal information in order to obtain services or benefits from the Department because they reasonably placed trust and confidence in the Department that the Department would safeguard and protect the information from public disclosure. This argument is without merit.

OCGA § 23-2-58 defines a confidential relationship as a relationship in which "one party is so situated as to exercise a controlling influence over the will, conduct, and interest of another or where, from a similar relationship of mutual confidence, the law requires the utmost good faith, such as the relationship between partners, principal and agent, etc." The complaint did not allege any particular circumstances showing that McConnell or any of the other proposed class members had a special relationship of trust or mutual confidence with the Department or any Department employee. As the Court of Appeals noted, the complaint alleged merely that the Department, as the gatekeeper to unemployment benefits, required McConnell and the others to[*818] provide personal information in order to receive benefits. Such conduct is common between citizens and government agencies and is insufficient to show a fiduciary relationship.

(c) Finally, McConnell asserts that the Court of Appeals erred in holding that his allegations of invasion of privacy failed to state a claim. Under Georgia law,

there are four disparate torts under the common name of invasion of privacy. These four torts may be described briefly as: (1) intrusion upon the plaintiff's seclusion or solitude, or into his private affairs; (2) public disclosure of embarrassing private facts about the plaintiff; (3) publicity which places the plaintiff in a false light in the public eye; and (4) appropriation, for the defendant's advantage, of the plaintiff's name or likeness.

(Citation and punctuation omitted.) Bullard v. MRA Holding, LLC , 292 Ga. 748, 751-752 (2), 740 S.E.2d 622 (2013). The complaint's allegations, if they stated any invasion of privacy claim, could fall only within the second category: public disclosure of embarrassing private facts.

There are at least three necessary elements for recovery under this theory: (a) the disclosure of private facts must be a public disclosure; (b) the facts disclosed to the public must be private, secluded or secret facts and not public ones; [and] (c) the matter made public must be offensive and objectionable to a reasonable man of ordinary sensibilities under the circumstances. The interest protected is that of reputation, with the same overtones of mental distress that are present in libel and slander. It is in reality an extension of defamation into the field of publications that do not fall within the narrow limits of the old torts, with the elimination of the defense of truth.

(Citation omitted.) Cottrell v. Smith , 299 Ga. 517, 532-533 (II) (C), 788 S.E.2d 772 (2016).

The Court of Appeals did not err. The complaint alleged that the matter disclosed[*360] included only the name, social security number, home telephone number, email address, and age of individuals who had sought services or benefits from the Department. This kind of information does not normally affect a person's reputation, which is[*819] the interest the tort of public disclosure of embarrassing private facts was meant to remedy.^[7] See id. at 532, 788 S.E.2d 772.

And even if the information were of the kind that affected reputation, the complaint would still not state a claim here because the matters disclosed were not offensive and objectionable. See, e.g., Dortch v. Atlanta Journal , 261 Ga. 350, 352 (2), 405 S.E.2d 43 (1991) (holding that unlisted telephone numbers were not offensive and objectionable); Cumberland Contractors, Inc. v. State Bank & Trust Co. , 327 Ga. App. 121, 126 (2) (a), 755 S.E.2d 511 (2014) (holding that social security numbers were not embarrassing private facts). Compare Walker v. Walker , 293 Ga. App. 872, 875 (2) (c), 668 S.E.2d 330 (2008) (holding that allegations by ex-husband that ex-wife, her attorney, and a psychologist made disclosure of objectionable private facts to the public in connection with custody dispute were sufficient to support claim for public disclosure of private facts); Zieve v. Hairston , 266 Ga. App. 753, 758 (1) (c), 598 S.E.2d 25 (2004) (holding that the matter of plaintiff's hair replacement treatment was one that a reasonable person of ordinary sensibilities would find offensive and objectionable under the circumstances). McConnell does not cite any authority that the information disclosed here was offensive and objectionable. And because the complaint did not allege that any objectionable and offensive matters were disclosed, it therefore failed to state a claim for invasion of privacy through the public disclosure of embarrassing private facts.^[8]

Each count of the complaint failed to state a claim upon which relief could be granted. The Court of Appeals therefore properly affirmed the dismissal of the complaint.

Judgment affirmed.

All the Justices concur, except Peterson, Warren, and Ellington, JJ., disqualified.