Consumer complaint received 2025-04-07 00:00:00
Product: Student loan — Federal student loan servicing
Issue: Dealing with your lender or servicer — Problem with customer service
Company: Nelnet, Inc.
State: WA

Complaint narrative:
XX/XX/XXXXXXXX XXXX XXXX XXXX XXXX Nelnet XXXX XXXX XXXX XXXX XXXX XXXX Re : Formal Response to XX/XX/XXXX Letter Unauthorized Access & Privacy Violation Account Number : XXXX Dear XXXX XXXX, I am writing in direct response to your letter dated XX/XX/XXXX, regarding my inquiry submitted to the Consumer Financial Protection Bureau concerning the potential unauthorized access to and misuse of my federal student loan data. I respectfully reject your conclusion that Nelnet has not engaged in unauthorized or unlawful activity, and I reiterate the legal basis and evidence supporting my concerns. 

Statutory Violations and Oversight 1. Family Educational Rights and Privacy Act ( FERPA ) 20 U.S.C. 1232g ; 34 CFR Part 99 As a borrower, my federal student loan records are classified as protected education records under FERPA. Unauthorized access, review, or disclosure of my financial aid data without my written consent is a clear violation of 34 CFR 99.30 and constitutes a breach of privacy.

2. Privacy Act of 1974 5 U.S.C. 552a As a federal loan servicer contracted by the U.S. Department of Education ( ED ), Nelnet is subject to the Privacy Acts provisions. The act mandates that all systems of records containing personal data be safeguarded against unauthorized access or disclosure. Your statement that consent is granted only when lawful and necessary lacks documentation showing compliance with 552a ( b ) and ( e ) ( 10 ). I request to review audit logs and security measures related to this data access.

3. Breach of Contract I entered into a binding loan agreement with the reasonable expectation that Nelnet and the Department of Education would take all necessary steps to safeguard my sensitive data. Unauthorized accesswhether by internal actors, affiliates, or outside entities like XXXX XXXX XXXX as suspected ) constitutes a breach of fiduciary and contractual duty. 
4. Fair Credit Reporting Act ( FCRA ) 15 U.S.C. 16811681x If any financial data or records were accessed or viewed by an unauthorized entity without a permissible purpose, that is a violation of 15 U.S.C. 1681b ( f ) and subject to enforcement by the CFPB.

5. Federal Information Security Modernization Act ( FISMA ) & OMB Circular A-130 As a federal contractor managing personally identifiable information ( PII ), Nelnet is required to adhere to the safeguards and audit procedures under FISMA and OMB Circular A-130. Your statement does not address whether security logs have been reviewed or if a breach report was filed with ED. 



Formal Demands Under Federal Law In accordance with FERPA, the Privacy Act, and other applicable statutes, I am demanding the following : 1. A full audit trail of all users and entities who accessed my account data from XX/XX/XXXX to present. 
2. Disclosure of any data breach reports or unauthorized access incidents involving my loan data.

3. Clarification of data retention practices, security measures, and breach notification protocols in line with 552a ( e ) ( 10 ). 
4. Determination of contract breach eligibility for discharge, per borrower defense regulations under 34 CFR 685.206 ( c ).

5. Legal basis for denial of remedy, if applicable, including why breach-based forgiveness was not considered.

Notice of Escalation If these issues are not fully addressed within 30 days of receipt, I will pursue further escalation with the Student Privacy Policy Office, Federal Student Aid Ombudsman Group, CFPB, Department of Education Office of Inspector General, and, if necessary, legal counsel. 

Your response, while acknowledging the concern, is legally insufficient. Nelnets duty is not only to comply with laws but to demonstrate compliance through verifiable actions and transparent reporting. 

Sincerely, Federal Student Loan Borrower

Company response to consumer: Closed with explanation