Thomas McConnell sued the Georgia Department of Labor after the agency sent an email containing the Social Security numbers and other personal information of him and about 4,000 proposed class members to roughly 1,000 recipients. The trial court dismissed his negligence, public-disclosure-of-private-facts, and breach-of-fiduciary-duty claims on sovereign-immunity grounds and, alternatively, on the merits. The Court of Appeals affirmed after addressing the merits without deciding whether sovereign immunity barred the claims. The Supreme Court of Georgia held that sovereign immunity is a jurisdictional threshold issue and that the appellate court lacked authority to reach the merits before resolving it. The Supreme Court vacated the judgment and remanded with direction for the Court of Appeals to determine whether the trial court correctly held that sovereign immunity applied, including the asserted Georgia Tort Claims Act waiver.