Roth v. Guzman

RECOMMENDED FOR FULL-TEXT PUBLICATION
Pursuant to Sixth Circuit Rule 206
File Name: 11a0155p.06

UNITED STATES COURT OF APPEALS
FOR THE SIXTH CIRCUIT
_________________

X
-
ERIC T. ROTH, individually and on behalf of

ROTH, individually and on behalf of all others --
all others similarly situated; MARY BETH

-
No. 10-3542
similarly situated; ERIN C. KENNY,
,
>
-
individually and on behalf of all others

Plaintiffs-Appellees, -
similarly situated,
-
-
-
-
v.

-
-
HENRY GUZMAN, Director, Ohio Department
-
of Public Safety; MIKE RANKIN, Registrar,
Ohio Bureau of Motor Vehicles, -
Defendants-Appellants. -
N
Appeal from the United States District Court
for the Southern District of Ohio at Cincinnati.
No. 09-00253—Michael R. Barrett, District Judge.
Argued: April 26, 2011
Decided and Filed: June 13, 2011
Before: GUY, CLAY, and McKEAGUE, Circuit Judges.

_________________

COUNSEL
ARGUED: Elisabeth A. Long, OHIO ATTORNEY GENERAL’S OFFICE, Columbus,
Ohio, for Appellants. Charles T. Lester, Jr., ERIC C. DETERS & ASSOCIATES,
Independence, Kentucky, for Appellees. ON BRIEF: Elisabeth A. Long, Benjamin C.
Mizer, OHIO ATTORNEY GENERAL’S OFFICE, Columbus, Ohio, for Appellants.
Charles T. Lester, Jr., ERIC C. DETERS & ASSOCIATES, Independence, Kentucky,
for Appellees.
GUY, J., delivered the opinion of the court, in which McKEAGUE, J., joined.
CLAY, J. (pp. 21–26), delivered a separate dissenting opinion.

1
No. 10-3542 Roth, et al. v. Guzman, et al. Page 2

_________________

OPINION
_________________

RALPH B. GUY, JR., Circuit Judge. Defendants Henry Guzman, Director of the
Ohio Department of Public Safety, and Mike Rankin, Registrar of the Ohio Bureau of
Motor Vehicles, appeal from the district court’s determination that they were not entitled
to qualified immunity from suit in this putative class action alleging violation of the
plaintiffs’ rights under the federal Driver’s Privacy Protection Act (DPPA), 18 U.S.C.
§§ 2721-2725, and 42 U.S.C. § 1983. Without challenging other aspects of the decision
denying their motion to dismiss, defendants argue that their alleged conduct did not
violate the plaintiffs’ clearly established federal rights as delineated by the DPPA. We
agree, and for the reasons that follow, we reverse.

I.

This court has jurisdiction over the defendants’ interlocutory appeal from the
denial of qualified immunity, but only to the extent that the appeal turns on issues of law.
Mitchell v. Forsyth, 472 U.S. 511, 530 (1985); Estate of Carter v. City of Detroit, 408
F.3d 305, 309-10 (6th Cir. 2005). We review the denial of qualified immunity de novo,
and the same standard applies to the motion for judgment on the pleadings under Fed.
R. Civ. P. 12(c) as to a motion to dismiss under Fed. R. Civ. P. 12(b)(6). Williams v.
Mehra, 186 F.3d 685, 689-90 (6th Cir. 1999) (en banc); EEOC v. J.H. Routh Packing
Co., 246 F.3d 850, 851 (6th Cir. 2001). To survive a motion to dismiss, the complaint
must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that
is plausible on its face.’” Ashcroft v. Iqbal, 129 S. Ct. 1937, 1949 (2009); (quoting Bell
Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).1

1
Apart from the issue of qualified immunity, the district court also found that plaintiffs had
standing; that Eleventh Amendment immunity did not bar the claims for money damages; and that statutory
rights under the DPPA are enforceable both directly and under § 1983. None of these issues are before
us.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 3

A. Driver’s Privacy Protection Act of 1994

The federal DPPA was enacted in response to growing concerns over the ease
with which stalkers and other criminals could obtain personal information from state
departments of motor vehicles.2 Reno v. Condon, 528 U.S. 141, 143-44 (2000).
Congress was also concerned about the practice in many states of selling personal
information from motor vehicle records to businesses, marketers, and others for, at
times, significant revenue. Id. The DPPA, held to be a proper exercise of the power to
regulate interstate commerce, established a regulatory scheme that both mandates and
restricts the disclosure of personal information from records maintained by state motor
vehicle departments. Id. at 148.

At all times relevant to this case, the DPPA, as amended, imposed the following
general prohibitions against the disclosure of personal information obtained from an
individual’s motor vehicle record:

(a) In general.–A State department of motor vehicles, and any officer,
employee, or contractor thereof, shall not knowingly disclose or
otherwise make available to any person or entity:
(1) personal information, as defined in 18 U.S.C.
[§] 2725(3), about any individual obtained by the
department in connection with a motor vehicle record,
except as provided in subsection (b) of this section; or
(2) highly restricted personal information, as defined in
18 U.S.C. § 2725(4), about any individual obtained by the
department in connection with a motor vehicle record,
without the express consent of the person to whom such
information applies, except uses permitted in subsections
(b)(1), (b)(4), (b)(6), and (b)(9); Provided, That
subsection (a)(2) shall not in any way affect the use of
organ donation information on an individual’s driver’s
license or affect the administration of organ donation
initiatives in the States.

2
Among several well-publicized cases was the 1989 murder of the actress Rebecca Shaeffer by
a stalker who obtained her unlisted address from information that she had provided to the California DMV.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 4

18 U.S.C. § 2721(a)(1)-(2) (emphasis added). “Personal information” is defined as
“information that identifies an individual, including an individual’s photograph, social
security number, driver identification number, name, address (but not the 5-digit zip
code), telephone number, and medical or disability information.” Id. at § 2725(3).
“Highly restricted personal information” is defined as “an individual’s photograph or
image, social security number, medical or disability information.” Id. at § 2725(4).

Section 2721(b) carves out both mandatory and permissive exceptions to the
general prohibitions in subsection (a). Id. at § 2721(b). First, states must disclose
personal information for use in carrying out the purposes of several federal statutes not
relevant here. Second, states may disclose personal information (subject to
§ 2721(a)(2)), for any of the permissible uses or purposes listed in § 2721(b)(1)-(14).
Eleven of these permissible uses—including for “use in the normal course of business”
under § 2721(b)(3)—authorize nonconsensual disclosure of personal information. Id.
at § 2721(b)(1)-(10) and (14). The other three permissible uses require the express
consent of the persons to whom the information pertains. Id. at § 2721(b)(11)-(13).

The DPPA also regulates the “resale or redisclosure” of personal information in
§ 2721(c), which provides, in pertinent part, that: “An authorized recipient of personal
information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose
the information only for a use permitted under subsection (b) (but not for uses under
subsection (b)(11) or (b)(12)).” Id. at § 2721(c) (emphasis added). Subsection (c) also
imposes a record-keeping obligation on “[a]ny authorized recipient (except a recipient
under subsection (b)(11)) that resells or rediscloses personal information covered by this
chapter” to keep for five years “records identifying each person or entity that receives
information and the permitted purpose for which the information will be used and must
make such records available to the motor vehicle department upon request.” Id.3

3
Disclosure under subsections (b)(11) (for any use) and (b)(12) (for bulk distributions for surveys,
marketing or solicitation) is permissible “if the State has obtained the express consent of the person to
whom such personal information pertains.” Id. at § 2721(b)(11)-(12) (as amended eff. June 1, 2000).
No. 10-3542 Roth, et al. v. Guzman, et al. Page 5

The DPPA makes it unlawful for “any person knowingly to obtain or disclose
personal information, from a motor vehicle record, for any use not permitted under [§]
2721(b),” or “to make false representation to obtain any personal information from an
individual’s motor vehicle record.” 18 U.S.C. § 2722(a)-(b). A person who knowingly
violates the DPPA is subject to criminal fine, id. at § 2723(a), and may be held civilly
liable for actual damages (but not less than $2,500 in liquidated damages), punitive
damages, attorney fees, and appropriate equitable relief, id. at § 2724. A “person” is
defined as an individual, organization or entity, “but does not include a State or agency
thereof,” id. at § 2725(2). Instead, the Attorney General may impose civil penalties if
a state has a policy or practice of “substantial noncompliance” with the DPPA, id. at
§ 2723(b) (civil penalty of not more than $5,000 per day).

B. Factual Allegations

Plaintiffs Eric Roth, Mary Beth Roth, and Erin Kenny brought this action on
behalf of themselves and other similarly situated drivers licensed in Ohio any time after
April 8, 2004, whose “personal information” as defined by the DPPA was disclosed,
sold, or otherwise disseminated by the individual defendants while acting as agents or
employees of the Ohio Department of Public Safety (DPS) and/or the Ohio Bureau of
Motor Vehicles (BMV). Specifically, plaintiffs alleged that Shadowsoft, Inc., a Texas
corporation specializing in “public records database distribution,” unlawfully acquired
a large database from the DPS and/or BMV that contained “personal information”
belonging to “hundreds of thousands” of drivers licensed in Ohio. Defendants admitted
in their Answer that the BMV disclosed personal information to Shadowsoft in response
to its requests for public records for a purportedly permissible purpose under the
DPPA—namely, for use in the “normal course of business” under 18 U.S.C.
§ 2721(b)(3)—and attached documents associated with Shadowsoft’s requests to their
Answer.4

4
Defendants’ Answer alleged that Guzman did not become director of the DPS until February 9,
2007, and that Rankin did not become Registrar of the BMV until April 16, 2007. Defendants argue that,
if the case were to go forward, they could not be held personally liable for disclosures that occurred before
they took office.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 6

Plaintiffs further alleged, upon information and belief, that Shadowsoft
“transferred the database in totum” to The Source for Public Data, LP, (PublicData),
which, in turn, allegedly made the personal information “available for search and sale
on its website, www.publicdata.com.” There is no claim that the defendants disclosed
information directly to PublicData, only a general allegation that plaintiffs’ personal
information was disseminated without obtaining their express consent and not for a
purpose otherwise permitted by the DPPA. Defendants, for their part, generally denied
having unlawfully disclosed, sold, or otherwise disseminated personal information to
Shadowsoft, PublicData, or any other entity.

More specifically, the documents attached to defendants’ Answer, and therefore
properly considered as part of the pleading for all purposes, shed light on the challenged
disclosures. See FED. R. CIV. P. 10(c) (“A copy of a written instrument that is an exhibit
to a pleading is a part of the pleading for all purposes.”); Commercial Money Ctr., Inc.
v. Ill. Union Ins. Co., 508 F.3d 327, 335 (6th Cir. 2007). First, in Exhibit A, defendants
attached two Record Requests made by an individual on behalf of Shadowsoft using
Ohio’s BMV Form 1173. The first request sought driver’s license information on a
monthly basis, and the second requested vehicle registration records. On each form, the
requester indicated, by way of a check mark, that the requests were being made for a
permissible purpose corresponding to the “normal course of business” exception under
§ 2721(b)(3). Form 1173 also informed the requester of the restrictions placed on the
resale or redisclosure of the information consistent with the DPPA’s limitations found
in § 2721(c). The requester provided her name, the company name, an address, and
telephone numbers, but left blank the spaces that requested other identifying information
(e.g., social security number, driver’s license number, tax identification number, vendor
number or professional license number).5

5
Form 1173 references Ohio’s parallel statute governing disclosures of personal information from
motor vehicle records rather than the provisions of the DPPA. There is no dispute that the Ohio statute
mirrors the DPPA, except that defendants maintain that the Ohio law directs that disclosures must be made
whenever permissible under the DPPA.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 7

Defendants’ Exhibit B to the Answer, titled “Agreement for the Sale of
Information (to be used with BMV Form 1173),” was executed in December 2004 by
Shadowsoft and the comptroller of the BMV. That Agreement provided, among other
things, that Shadowsoft would receive copies of public records on a monthly basis and
would pay the associated fees on a monthly basis. Also, Shadowsoft warranted that it
and all its personnel were familiar with the Ohio Driver Privacy Protection Act, and
agreed that all users would abide by both federal and state laws restricting access to
personal information from motor vehicle records and governing the resale or redisclosure
of such information. In addition, Shadowsoft agreed not to provide information obtained
under the Agreement to any other person without entering into an agreement that
included these prohibitions.

Accepting the factual allegations as true, we assume that the BMV made “bulk”
disclosures of personal information from motor vehicle records to Shadowsoft for what
was asserted to be a permissible purpose, and that Shadowsoft resold or redisclosed the
information “in bulk” to PublicData. While defendants do not deny that PublicData
resold or redisclosed the information in violation of the DPPA, there are also no facts
alleged regarding the operation of PublicData or the disclosures allegedly made by it.6

C. Procedural History

Plaintiffs commenced this action in April 2009, and amended their complaint
shortly thereafter. Defendants moved for judgment on the pleadings, seeking dismissal
of the amended complaint on a number of grounds. That motion was fully briefed,
argued, and supplemented. In an order entered March 31, 2010, the district court
rejected each of the defendants’ contentions and concluded, in pertinent part, that the
defendants were not entitled to qualified immunity from suit on the plaintiffs’ claims

6
At one point, plaintiffs disavowed that their claims were based on how the information was
allegedly misused by Shadowsoft. (“Plaintiffs have brought this suit because of an unlawful disclosure
made by the individual Defendants, not because of how the information was ultimately misused by
Shadowsoft. In other words, it makes no difference whether Shadowsoft sold the unlawfully disclosed
information on the internet, or whether it used the information to tabulate how many ‘Johns’ or ‘Jims’ are
driving in Ohio. The Defendants[’] liability is based on the fact that they were prohibited from disclosing
the information except to an ‘authorized recipient[.]’”)
No. 10-3542 Roth, et al. v. Guzman, et al. Page 8

under the DPPA or § 1983. Briefly, the district court concluded that plaintiffs had
plausibly alleged that the defendants’ conduct violated a statutory right by alleging that
defendants had disclosed personal information for a purpose not permitted by the DPPA.
Further, the district court found that this right was “clearly established” by the plain
language of the statute and that, in light of the incomplete information provided in the
Record Requests, a reasonable official would have understood that the disclosures would
violate the DPPA. Defendants appealed, and the district court entered a stay pending
appeal.

II.

Qualified immunity protects government officials and employees performing
discretionary functions “from liability for civil damages insofar as their conduct does not
violate clearly established statutory or constitutional rights of which a reasonable person
would have known.” Harlow v. Fitzgerald, 457 U.S. 800, 818 (1982); see also Saucier
v. Katz, 533 U.S. 194, 202 (2001). In deciding claims of qualified immunity, we must
determine: (1) whether the facts alleged or shown by the plaintiffs make out a violation
of federal statutory or constitutional right; and (2) whether that right was “clearly
established” at the time of the defendants’ alleged misconduct. Pearson v. Callahan,
129 S. Ct. 808, 815-16 (2009). Although it is “often appropriate” to resolve these
questions sequentially, it is no longer mandatory that the court do so. Id. at 818; see also
Waeschle v. Dragovic, 576 F.3d 539, 543-44 (6th Cir. 2009). For a right to be “clearly
established,” the “contours of the right must be sufficiently clear that a reasonable
official would understand that what he is doing violates that right.” Anderson v.
Creighton, 483 U.S. 635, 640 (1987). Once raised as a defense, plaintiffs bear the
burden of demonstrating that the defendants are not entitled to qualified immunity.
Silberstein v. City of Dayton, 440 F.3d 306, 311 (6th Cir. 2006).

A. Purportedly Permissible Use

Plaintiffs argue that, as the district court found, defendants violated the DPPA
by disclosing personal information for a use not permitted under § 2721(b). In reaching
No. 10-3542 Roth, et al. v. Guzman, et al. Page 9

this conclusion, the district court interpreted the DPPA’s provisions as imposing
liability, presumably criminal as well as civil, whether or not the state official knew that
the disclosure was not actually for a proper purpose. Defendants argue (1) that this is
a misreading of the DPPA that would require the state to verify a requester’s true
intentions; and (2) that, even if a correct interpretation, it was not a clearly established
right of which a reasonable person would have known.

1. Violation

The pleadings establish that the disclosures in this case were purportedly made
under § 2721(b)(3), which permits nonconsented disclosure of personal information (but
not highly restricted personal information):

(3) For use in the normal course of business by a legitimate business or
its agents, employees, or contractors, but only—
(A) to verify the accuracy of personal information
submitted by the individual to the business or its agents,
employees, or contractors; and
(B) if such information as so submitted is not correct or
is no longer correct, to obtain the correct information, but only
for the purposes of preventing fraud by, pursuing legal remedies
against, or recovering on a debt or security interest against, the
individual.

18 U.S.C. § 2721(b)(3). As outlined above, the disclosures made by the Ohio BMV
were made based on Shadowsoft’s express written representations that the disclosures
were “for use in the normal course of business”—as permitted by § 2721(b)(3) (and
Ohio law)—although plaintiffs allege that Shadowsoft falsely represented this to be the
purpose of the disclosures.

The finding that this alleged a violation of the DPPA rested on the district court’s
interpretation of § 2724(a), which provides that: “A person who knowingly obtains,
discloses or uses personal information, from a motor vehicle record, for a purpose not
permitted under this chapter shall be liable to the individual to whom the information
pertains[.]” The district court relied on Pichler v. UNITE, 228 F.R.D. 230, 241-42 (E.D.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 10

Pa. 2005), aff’d on other grounds, 542 F.3d 380 (3d Cir. 2008), which reasoned that the
location of the adverb “knowingly” in this provision suggested an intention to limit the
reach of the knowledge requirement. That is, the court in Pichler found that
“knowingly” modifies only the first part—the two clauses defining the act element—and
not the last part—the third clause defining the purpose element. Without agreeing or
disagreeing with Pichler, we find that it does not address the question presented in this
case.

In Pichler, the labor union defendants recorded license plate numbers from cars
in an employee parking lot and obtained the employees’ addresses from motor vehicle
records through Westlaw and a private investigator’s requests to the state motor vehicle
department. The court in Pichler rejected the defendants’ claim that they could not be
liable because they did not know that the requester’s purpose in obtaining the personal
information was not permissible, explaining:

If one could not violate the DPPA without “knowing[]” that the purpose
for which he “obtain[ed],” “disclose[d]” or “use[d]” motor vehicle
information was unlawful, then every defendant would get at least one
free bite at the violation-of-privacy apple. After all, anyone could claim
that he did not “know” his purpose to be impermissible until a court
interpreted the DPPA to proscribe that purpose. Even after such a ruling,
a defendant could manufacture a slightly different purpose for his
conduct and then claim ignorance of whether the DPPA prohibited the
new purpose. A plaintiff could recover only if the defendant repeatedly
violated her privacy and lacked sufficient creativity to conjure up some
conceivable purpose that no court had yet considered.

Id. at 242; see also Rios v. Direct Mail Express, Inc., 435 F. Supp. 2d 1199, 1204-05
(S.D. Fla. 2006) (relying on Pichler to conclude that plaintiffs were not required to prove
that a direct marketer who knowingly obtained records from the Florida DMV also knew
that Florida had not obtained the express consent required under the amended DPPA to
release the records to a mass marketer under (b)(12)).

It is one thing to say that a defendant’s ignorance that his own conduct violates
the law is not a defense, but it is another, we think, to conclude that a defendant is liable
for a knowing disclosure made for a permissible purpose any time the purpose was
No. 10-3542 Roth, et al. v. Guzman, et al. Page 11

misrepresented or the information was later misused or improperly redisclosed by the
requester or any other entity. Here, the pleadings establish that the defendants’ act, the
knowing disclosure of personal information, was for an explicitly permissible purpose.
Moreover, the plaintiffs complain that Shadowsoft falsely represented its intended use
and redisclosed the information to PublicData, which made the information available for
search and sale to its customers for unspecified purposes.

If no distinction is made between the use for which the defendants disclosed the
information, and the undisclosed use for which it was obtained, subsequently misused
or impermissibly redisclosed by the recipient, the DPPA becomes essentially a strict
liability statute. Every subsequent misuse could be traced back to a violation by the state
official. Rather than place all of the liability with the state officials, however, the DPPA
makes it unlawful for any person (excluding the states and their agencies) to knowingly
obtain, disclose, or use the information for a purpose not permitted by the DPPA. While
it may be that this and other courts will find that one’s ignorance of the law is no defense
to a claim under the DPPA, this was not the defendants’ claim in this case. Rather,
defendants’ alleged that their disclosures were for a permitted purpose, even if
Shadowsoft’s undisclosed intention was to obtain the personal information for a purpose
not permitted by the DPPA.

That the defendants’ disclosure was expressly for a permitted purpose
distinguishes this case from Welch v. Theodorides-Bustle, 677 F. Supp. 2d 1283 (N.D.
Fla. 2010). Similar to this case, state officials were alleged to have violated the DPPA
by making disclosures of personal information in bulk to Shadowsoft, which, in turn,
redisclosed the information to PublicData. The defendants did not deny that from
PublicData’s website, “an internet user can access the information for any or no
reason—or on a whim.” Id. at 1286. Unlike this case, however, the court in Welch
specifically found that the contracts entered into with Shadowsoft did not specify either
a proper purpose for the disclosures, or the uses and further disclosures it would or
would not make. No claim could be made in that case that disclosures were for a
purportedly permissible purpose, and the court rejected the suggestion that the
No. 10-3542 Roth, et al. v. Guzman, et al. Page 12

defendants could rely on § 2721(b)(1) (for use by a government agency in carrying out
its functions). Not surprisingly, the court also found that the state officials’ disclosures
for an unspecified purpose, when the DPPA requires that personal information not be
disclosed except as provided for in § 2721(b), violated clearly established federal law of
which the defendants’ should have known. Id. (citing Collier v. Dickenson, 477 F.3d
1306 (11th Cir. 2007).

2. Clearly Established

Even if we accept that the DPPA may be read to impose liability on a state
official in his individual capacity when personal information disclosed for a purportedly
permissible purpose was actually obtained for an impermissible purpose, we cannot
agree that this right was clearly established at the time of the disclosures (putting aside
the allegation that the disclosures were only made under the defendants’ authority for
a short time).

The district court acknowledged that there was (and is) no binding precedent
from the Supreme Court, the Sixth Circuit, the district court itself, or other circuits
deciding the issues raised in this case such as would render the asserted right “clearly
established.” See Risbridger v. Connelly, 275 F.3d 565, 569 (6th Cir. 2002). “‘This is
not to say that an official action is protected by qualified immunity unless the very action
in question has previously been held unlawful, but it is to say that in the light of pre-
existing law the unlawfulness must be apparent.’” Wilson v. Layne, 526 U.S. 603, 615
(1999) (quoting Anderson, 483 U.S. at 641). An official may be on notice that his
conduct violates established law even in novel factual circumstances. See Hope v.
Pelzer, 536 U.S. 730, 741 (2002).

Relying on the Eleventh Circuit decision in Collier affirming the denial of
qualified immunity to state officials for disclosures under the DPPA, the district court
concluded that the plain language of the DPPA clearly established an individual’s right
to be free from disclosures for purposes not permitted under § 2721(b). As is clear from
a closer reading of Collier, however, the district court did not engage in a sufficiently
particularized reading of the rights that are clearly established by the DPPA.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 13

In Collier, the plaintiffs alleged that the state officials in Florida violated the
DPPA by releasing personal information from driver’s license records to a mass
marketer without first obtaining the driver’s express consent. The court in Collier found
not only that the DPPA, as amended, required express consent for bulk distribution of
surveys, marketing or solicitations in § 2721(b)(12), but also that the Supreme Court’s
decision in Condon specifically recognized (1) that following the amendments in 2000,
states could no longer infer consent from a driver’s failure to “opt-out” of disclosures,
and (2) that states were bound by the mandates of the DPPA irrespective of any
conflicting state law. Collier, 477 F.3d at 1312. The same cannot be said for the alleged
violation in this case based on the defendants’ failure to discover Shadowsoft’s true
intentions.7

Finally, the district court rejected defendants’ contention that this interpretation
made the state BMV an insurer rather than simply a gatekeeper that may rely on the
requester’s declaration that the disclosure would be for a permitted purpose. The district
court explained as follows:

While Defendants may be properly characterized as gatekeepers, this
does not mean that they may forfeit this role entirely and adopt without
question the representations of entities such as Shadowsoft who make
requests for personal information. The Court finds the following
discussion applicable, even though it is outside the context of the DPPA:
Qualified immunity is intended to allow officials to
render intelligent decisions even though they may, upon
further reflection, be deemed to have been erroneous. It
is not intended to allow individual officers to abdicate
their decision-making obligations in blind reliance on

7
Another Eleventh Circuit decision interpreting the DPPA also arises out of the failure of the
State of Florida to amend its statutes to comply with the amendments to the federal DPPA that changed
the manner for obtaining consent from an “opt-out” to an “opt-in” procedure. See Kehoe v. Fid. Fed. Bank
& Trust, 421 F.3d 1209, 1210 (11th Cir. 2005) (“Forty-nine states immediately passed legislation to ensure
compliance with this amendment to the DPPA. Florida was the only state that did not immediately
comply. Instead, Florida waited until May 13, 2004, to amend its public records statute to comply with
the DPPA.”) (holding that no actual damages were required to recover liquidated damages), cert. denied,
126 S. Ct. 1612 (2006). Notably, while concurring in the denial of certiorari in Kehoe, Justice Scalia,
joined by Justice Alito, noted that there were two important issues in the case: (1) whether actual damages
must be shown, and (2) whether the bank that purchased vehicle registration information for purposes of
solicitation can be held liable if it did not know that the state had failed to comply with the “express
consent” requirement. See 126 S. Ct. at 1612.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 14

state statutes. This is especially true in this instance
where the officers involved, unlike police officers who
frequently have little rule-making authority, are endowed
with independent policy-making authority and have an
obligation to make reasoned decisions with respect to
programs and policies which they promulgate, regardless
of whether those programs and policies are promulgated
in accordance with State law.
F. Buddie Contracting, Ltd. v. Cuyahoga Community College Dist., 31
F. Supp. 2d 584, 589-590 (N.D. Ohio 1998) (finding that officials were
not entitled to qualified immunity where there was evidence that
affirmative action policy was unconstitutional even though the policy
was enacted in compliance with state law).
In this instance, those with policy-making authority have made
no effort [to] ensure that requests for information are legitimate. Based
on the allegations before the Court, Defendants take any request at face
value and without any regard to the accuracy of the information. The
Court notes that while the Record Request included places for
Shadowsoft to provide its tax identification number, vendor number,
professional license number, and license, Shadowsoft never completed
this part of the form. Despite this lack of information, Defendants
granted Shadowsoft’s request for information. This indicates to the
Court that Defendants proceeded with “blind reliance” on any request
made. While Defendants place value in the Agreement between ODPS
and Shadowsoft, the Court finds reliance on such an agreement at best
naive. By simply visiting the PublicData website, Defendants would
have discovered that just as Plaintiffs allege, the information Defendants
were providing was available to anyone with a credit card.

Certainly, there is no claim by defendants that they did anything to affirmatively verify
that Shadowsoft’s request was for the use it stated. At the same time, nothing about the
incomplete requester information would have told defendants that Shadowsoft was
misrepresenting the use it intended to make of the personal information it was
requesting. Nor did Shadowsoft’s Record Requests give defendants a reason to visit
PublicData’s website. Whether or not it would have been prudent for the BMV to
investigate Shadowsoft before making any disclosures, this is neither an obligation
imposed by the terms of the DPPA, nor one that has been “clearly established” under the
governing case law.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 15

The suggestion that defendants are not entitled to qualified immunity because
defendants could not have reasonably believed that Shadowsoft was a “legitimate
business”—a term not defined by the DPPA—misses the mark. Plaintiffs did not allege
or argue that Shadowsoft was, in fact, anything but a “legitimate business.”8 Indeed, the
district court’s focus was on what it viewed to be defendants’ “blind reliance” on
Shadowsoft’s representations and not on a failure to verify that Shadowsoft was a
“legitimate business.” The logic of this argument seems to be that if defendants had
verified Shadowsoft’s corporate existence—as plaintiffs alleged that Shadowsoft was
a Texas corporation—the defendants might have found reason to question the veracity
of Shadowsoft’s representation that it was requesting personal information for a
permissible purpose. It is not explained, however, how a reasonable official would have
known that it would violate the DPPA to make a disclosure for an expressly permissible
purpose, to an entity plaintiffs do not claim to be illegitimate, because the defendants did
not investigate the legitimacy of that business.

B. Bulk Disclosures under § 2721(b)(3)

Defendants recognize that plaintiffs have asserted a second basis for finding that
the disclosures to Shadowsoft violated the DPPA. That is, plaintiffs contend that even
if the personal information had been requested for use in the “normal course of
business,” “bulk” disclosures are not authorized for requests made under § 2721(b)(3).
The district court did not reach this issue, however.

The parties agree that the starting point is the ordinary meaning of the statute.
Mills Music, Inc. v. Snyder, 469 U.S. 153, 164 (1985) (“In construing a federal statute
it is appropriate to assume that the ordinary meaning of the language that Congress
employed ‘accurately expresses the legislative purpose.’”) (citation omitted). If the
language of the statute is clear, the plain meaning of the text must be enforced. United
States v. Ron Pair Enters., Inc., 489 U.S. 235, 241 (1989). “The plainness or ambiguity
of statutory language is determined by reference to the language itself, the specific

8
Nor did plaintiffs contend that there were any material questions of fact in dispute concerning
Shadowsoft’s legal status at the time of the disclosure requests.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 16

context in which that language is used, and the broader context of the statute as a
whole.” Robinson v. Shell Oil Co., 519 U.S. 337, 341 (1997). When a plain reading
“leads to ambiguous or unreasonable results, a court may look to legislative history to
interpret a statute.” Limited, Inc. v. Comm’r, 286 F.3d 324, 332 (6th Cir. 2002).

Quoted in full above, § 2721(b)(3) provides that state officials may disclose
personal information “[f]or use in the normal course of business . . . to verify the
accuracy of personal information submitted by the individual to the business,” and to
correct inaccurate personal information for the purposes of “preventing fraud by,
pursuing legal remedies against, or recovering on a debt or security interest against the
individual.” Plaintiffs interpret the references to “the individual” in § 2721(b)(3) as
unambiguously limiting disclosure to personal information pertaining to one individual
at a time. Defendants counter that “individual” in this subsection does not refer to how
many requests may be made at one time, but rather to the basis for disclosures permitted
under this subsection. The Fifth Circuit, the only circuit to decide this issue, rejected the
same arguments in Taylor v. Acxiom Corp., 612 F.3d 325, 335 (5th Cir. 2010), cert.
denied, 131 S. Ct. 908 (2011).

Texas, like at least eleven other states, allows persons or entities to purchase
magnetic tapes of the database of driver’s license records upon certification of a lawful
purpose under the DPPA. Id. at 332. The defendants in Taylor were third parties who
did not use all of the records immediately, but maintained databases to either use in the
future (non-resellers) or to resell to others for lawful purposes (resellers). The plaintiffs
in Taylor argued that maintaining records not actually used was itself an impermissible
purpose; in other words, that “‘buying the records in bulk with an expectation and
purpose of valid potential use is not a permissible use under the DPPA.” Id. at 334.
Examining § 2721(b)(3) in the context of all fourteen permissible uses under § 2721(b),
the court emphasized that only one subsection limits permissible uses to individual
motor vehicle records, while only one other subsection limits permissible uses to bulk
distributions. Id. at 335; compare § 2721(b)(11) (“[f]or any other use in response to
requests for individual motor vehicle records if the State has obtained the express
No. 10-3542 Roth, et al. v. Guzman, et al. Page 17

consent of the person to whom such personal information pertains”), with § 2721(b)(12)
(“[f]or bulk distribution for surveys, marketing or solicitations if the State has obtained
the express consent of the person to whom such personal information pertains”). For the
rest of the permissible uses, the court found there was more than one reasonable
interpretation: “individual release, bulk release, or both.” Id. at 335. The court
explained:

It does not make sense that Congress would expressly limit states
to individual distribution with one permissible use if Congress intended
to limit all of the permissible uses to individual distribution. If Congress
intended only individual distribution, one would expect either Congress
to expressly limit all uses or, at least, to remain silent on the matter.
Likewise, if Congress intended only bulk distribution, it makes no sense
to expressly limit one of the fourteen uses to bulk distribution and not the
others. The text of the statute strongly indicates that it allows both
individual and bulk distribution.

Id. at 336. We agree. Plaintiffs in this case do not offer any authority or persuasive
argument for concluding that § 2721(b)(3) clearly and unambiguously limits disclosure
of personal information to one individual at a time.9

To resolve the ambiguity, both parties point to aspects of the legislative history
to support their positions but nothing speaks directly to the issue of “bulk” disclosures
under § 2721(b)(3). More generally, Congress expressed an intention “to strike ‘a
critical balance between legitimate governmental and business needs for this
information, and the fundamental right of our people to privacy and safety.’” Russell v.
Choicepoint Servs., Inc., 302 F. Supp. 2d 450, 456 (E.D. La. 2004) (quoting 139 Cong.
Rec. S15, 763 (1993)). Although plaintiffs rely on statements from the legislative
history reflecting an intention to give individuals control over the release of their
personal information, those statements are again directed at the bulk sale of personal
information for direct marketing purposes.

9
Plaintiffs also misrepresent Locate.Plus.Com, Inc. v. Iowa Dept. of Transp., 650 N.W.2d 609,
616 (Iowa 2002), as holding that the § 2721(b)(3) exception only authorizes the disclosure of information
belonging to a specific individual and not the entire driving public. However, that case involved a request
for disclosure by a private business for the purpose of reformatting the information for resale to law
enforcement agencies, which the Court held was not among the permissible purposes of § 2721(b).
No. 10-3542 Roth, et al. v. Guzman, et al. Page 18

A statement by the sponsor of the DPPA in the House expressed concern first
with the need to address the ease with which criminals and strangers could obtain
driver’s license information and second with the desire to curb the sale of DMV
databases to direct marketers for commercial purposes by requiring consent. Taylor, 612
F.3d at 336-37 (quoting statement of Rep. Moran Feb. 4, 1994, 1994 WL 212698
(F.D.C.H.)). In that same statement, however, the sponsor also expressed the intention
that common uses being made of the information at the time—including by businesses
verifying personal information—should continue unfettered. Id. at 336.

Notably, the amendments to the DPPA, which restricted further the bulk
distribution provision to require express as opposed to implied consent, did not adopt a
consent requirement for disclosure under § 2721(b)(3), or clarify that requests for
disclosure under § 2721(b)(3) should be for one person’s records at a time. The Fifth
Circuit was also persuaded by a Department of Justice (DOJ) advisory opinion issued
in October 1998, concluding that the DPPA allowed the State of Massachusetts to
release personal information to a commercial distributor who would disseminate the
information to any other authorized recipients or entities that use the information solely
for authorized purposes. Taylor, 612 F.3d at 339. We agree that the DOJ’s advisory
opinion is inconsistent with the notion that bulk distribution is prohibited by the DPPA.
Id.

Finally, the court in Taylor concluded that the plaintiffs’ reading of § 2721(b)(3)
would lead to “essentially absurd results,” explaining:

At a checkout line at a grocery store or similar establishment, when a
customer wishes to pay by (or cash) a check, and presents a driver’s
license as identification, it is obviously wholly impractical to require the
merchant for each such customer to submit a separate individual request
to the state motor vehicle department to verify the accuracy of the
personal information submitted by the customer, under section
2721(b)(3). Any such process would obviously take way too long to be
of any use to either the customer or the merchant, and would moreover
flood the state department with more requests than it could possibly
handle. So, the merchant buys the state department’s entire data base and
from it extracts on that occasion that particular customer’s information,
and later performs the same task as to the next such customer in the line.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 19

Plaintiffs would have us hold that the merchant violates the DPPA by
acquiring the data base even though every single actual use made of it is
an authorized use under section 2721(b), so long as there is at least one
name in the data base as to which no actual use is made.
Id. at 337. The court then analogized the situation to the purchase of a set of legal
reporters, which a lawyer purchases for the purpose of legal research even though the
attorney would never read every opinion in each volume. Id.

As interpreted by the court in Taylor, plaintiffs could not establish a violation of
the DPPA merely because the defendants sold personal information from motor vehicle
records in bulk where the disclosure was for use, or potential use, in “the normal course
of business” under § 2721(b)(3). The purchase in bulk for use as needed for a permitted
purpose under § 2721(b)(3), described by some courts as “stockpiling,” has been found
not to violate the DPPA by several district courts. See, e.g., Wiles v. ASCOM Transp.
Sys., Inc. (Wiles II), No. 3:10-cv-28-H, 2011 WL 672652 (W.D. Ky. Feb. 17, 2011)
(unpublished); Cook v. ACS State and Local Solutions, Inc., 756 F. Supp. 2d 1104 (W.D.
Mo. 2010).

Although the district court did not decide this issue in the first instance, it is
apparent to us that, as a matter of law, it was not clearly established at the time of
defendants’ conduct that “stockpiling” or bulk disclosures of personal information for
a permissible purpose under § 2721(b)(3) would violate the DPPA. For this reason,
plaintiffs cannot overcome a claim of qualified immunity on this theory.

III.

To the extent that the plaintiffs could prove a violation of the DPPA based on the
allegation that Shadowsoft misrepresented itself as having a proper purpose under
§ 2721(b)(3) or that the disclosures were made in bulk under § 2721(b)(3), we find the
contours of such rights were not sufficiently clear that a reasonable official would have
understood at the time that the disclosures would violate such rights. Accordingly, we
REVERSE the district court’s denial of qualified immunity with respect to claims under
No. 10-3542 Roth, et al. v. Guzman, et al. Page 20

either the DPPA or § 1983, and REMAND for entry of judgment in favor of defendants
Guzman and Rankin.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 21

_________________

DISSENT
_________________

CLAY, Circuit Judge, dissenting. While I do not take issue with the majority’s
conclusion that nothing in the Drivers Privacy Protection Act (“DPPA” or the “Act”),
18 U.S.C. § 2721, et seq., prohibits the bulk disclosure of personal information contained
in drivers’ records, I respectfully dissent from the majority’s determination that the
disclosure of such records to Shadowsoft by officials at the Ohio Department of Public
Safety and the Ohio Bureau of Motor Vehicles (collectively, “BMV Officials”), without
reasonably inquiring into whether Shadowsoft was a legitimate business using the
records for a permissible purpose, was not a violation of a clearly established statutory
requirement.

While, as the majority notes, we have no binding case authority to guide us in
addressing the claims raised in this case, we do have the statutory language of the DPPA.
Under the factual scenario and procedural posture of the case now before us, I agree with
the district court that the language of the DPPA is, in itself, sufficient to defeat qualified
immunity for Defendants.1

Defendants argue that the DPPA does not impose on them any obligation to
verify how the information that they disclose will be used. Instead, if they disclose
information that is used for an impermissible purpose, then “a driver may seek relief
against the entity that violated the DPPA, not the State.” (Defs.’ Br. at 15.) Plaintiffs
counter that “[t]he DPPA is clear: if the Defendants disclosed information for a purpose

1
The district court held that “a reasonable official would have understood that a disclosure of
information for a purpose other than one permitted by the DPPA would violate the DPPA.” (Dist. Ct. Op.
at 19-20.)
No. 10-3542 Roth, et al. v. Guzman, et al. Page 22

that did not meet an exception to the DPPA, then they are in violation of the Statute.”2
(Pls.’ Br. at 10.)

The majority opinion circumvents the legal question of what duty the DPPA
imposes on Defendants by making the finding that Defendants disclosed drivers’
information to Shadowsoft “for an explicitly permissible purpose,” though Shadowsoft
later used the information impermissibly. (Maj. Op. at p. 11 (emphasis omitted).) In
doing so, the majority reasons that as long as a requestor represents to BMV Officials
that it will use drivers’ personal information in accordance with a DPPA exception,
BMV Officials do not violate the Act if they then knowingly disclose that information.

There are two insurmountable problems with the majority’s approach. The first
is simple, but dispositive—the record, on this judgment on the pleadings, is too vastly
underdeveloped for the majority to make the factual findings necessary to logically
support its conclusion. The evidence in the record insufficiently addresses any number
of necessary questions, such as: what is Shadowsoft’s legal status? What is
Shadowsoft’s relationship to PublicData? What did Shadowsoft represent to BMV
Officials during contract negotiations? What did BMV Officials actually know about
Shadowsoft at the time of disclosure? Did Shadowsoft impermissibly use the
information that it received? With each of these material factual questions still in
dispute, a grant of qualified immunity to Defendants is inappropriate. See Harrison v.
Ash, 539 F.3d 510, 517 (6th Cir. 2008) (“[T]o the extent that the denial of qualified
immunity is based on a factual dispute, such a denial falls outside of the narrow
jurisdiction of this Court.”)

Secondly, the majority’s reading of the DPPA not only contradicts the
“straightforward and commonsense meaning[]” of the Act, see Henry Ford Health Sys.

2
As this appeal arises from a motion for judgment on the pleadings, Defendants must concede
all factual allegations to Plaintiffs. Therefore, if there were a dispute regarding whether Shadowsoft
permissibly used the records it obtained from BMV Officials, Plaintiff’s factual allegations must be
conceded for the purposes of the qualified immunity inquiry. See JPMorgan Chase Bank, N.A. v. Winget,
510 F.3d 577, 581 (6th Cir. 2007) (“For purposes of a motion for judgment on the pleadings, all
well-pleaded material allegations of the pleadings of the opposing party must be taken as true, and the
motion may be granted only if the moving party is nevertheless clearly entitled to judgment.”) (internal
citations and quotation marks omitted).
No. 10-3542 Roth, et al. v. Guzman, et al. Page 23

v. Shalala, 233 F.3d 907, 910 (6th Cir. 2000), but if accepted also renders much of the
language of the DPPA completely superfluous. See Hibbs v. Winn, 542 U.S. 88, 101
(2004) (“A statute should be construed so that effect is given to all its provisions, so that
no part will be inoperative or superfluous, void or insignificant.”) (citing 2A N. Singer,
Statutes and Statutory Construction § 46.06, pp. 181-186 (rev. 6th ed. 2000)).

Under the majority’s reading of the DPPA, the Act places no actual duty upon
BMV Officials, other than the ministerial task of soliciting rote representations from
prospective requesters. In the majority’s view, as long as BMV Officials receive such
rote representations, then they have complied with the DPPA.

It is difficult to reconcile this reading of the Act by the majority with the very
next conclusion reached in its opinion. Because the majority continues by holding that
even when a requestor does not provide a representation that it is acting in accordance
with the DPPA—for instance, that the requester is a “legitimate business” under
18 U.S.C. § 2721(b)(3)—BMV Officials still do not violate the Act by knowingly
disclosing information to that requestor.

The majority, in determining whether BMV Officials are liable to Plaintiffs
because they disclosed information that was used for an impermissible purpose, holds
that BMV Officials are immune because they disclosed the information in reliance on
Shadowsoft’s arguably false representations. But in determining whether BMV Officials
are liable to Plaintiffs because they disclosed information to an arguably illegitimate
business, the majority holds that BMV Officials are entitled to immunity, even though
Shadowsoft made no actual representations that would invite the reliance of BMV
Officials. Under this interpretation of 18 U.S.C. § 2721(b)(3), whether BMV Officials
relied on false representations, or none at all, is of no actual consequence. The majority
seemingly holds that the DPPA permits state officials such as those at the BMV to ask
nothing and require no salient information, but to disclose everything.

Clearly, any interpretation of the DPPA that would require a requestor to make
an affirmative statement of illegal intent or bad purpose in order for disclosure liability
to attach to BMV Officials is inconsistent with both the language and the purpose of the
No. 10-3542 Roth, et al. v. Guzman, et al. Page 24

Act. While the DPPA may not mandate that BMV Officials conduct an actual
investigation into an entity requesting drivers’ information, or verify that entity’s
purpose, it clearly imposes some kind of duty upon the state and state officials. If it did
not, then subjecting the state to a penalty for having a “policy or practice of substantial
noncompliance” with the DPPA would be nonsensical, because as a practical matter a
state (or its officials) could not fail to comply with an Act that imposes no actual duty
upon it. See 18 U.S.C.A. § 2723(b).

Therefore, a proper reading of the DPPA compels the conclusion that the Act
imposes upon the state (and its officials) a duty of reasonable inquiry. In this case, the
permissible use that Defendants claim allows BMV Officials to knowingly disclose
drivers’ personal information to a certain type of requestor—“a legitimate
business”—for certain purposes—“to verify the accuracy of personal information” and
“to obtain . . . correct information” to prevent fraud or pursue other legal remedies. 18
U.S.C. § 2721(b)(3). Consequently, the Act sets forth a requirement that BMV Officials
reasonably inquire into the dual questions of the identity of the requestor and the purpose
for which information protected under the Act is being disclosed.

The content of the Record Request form (“Form 1173”) created by BMV
Officials to ensure compliance with the DPPA confirms that BMV Officials understood
that the DPPA imposed this duty of reasonable inquiry. This understanding is apparent
from the fact that Form 1173 requires that a requester submit both information about
itself and information about the basis for the request. (See R. 13; Ex. A, B.)

On the two Form 1173s completed by Shadowsoft, the company provided none
of the required information about itself, with the exception of an out-of-state mailing
address. As the district court highlighted, “while [Form 1173] included places for
Shadowsoft to provide its tax identification number, vendor number, professional license
number, and license, Shadowsoft never completed this part of the form.” (Dist. Ct. Op.
at 21.) Nor did Shadowsoft provide any information regarding its status as a business
in the contract that it subsequently entered into with BMV Officials, which did not
request such information. (R. 13; Ex. A, B.)
No. 10-3542 Roth, et al. v. Guzman, et al. Page 25

Not inconsequently, it appears from the record that BMV Officials conducted this
transaction with Shadowsoft via fax. So not only did BMV Officials not require
Shadowsoft to represent that it was a licensed or incorporated business, it did not even
require any actual contact with Shadowsoft. (Id.) There is no indication that BMV
Officials even verified the identity of the individual requestor listed on the Form 1173s,
Cara Hill, nor did she provide her personal driver license or social security number, as
required by the forms. In practical terms, less verification was demanded of Shadowsoft,
in order to receive the personal information of every driver in Ohio, than would be
requested of any judge on this panel to write a personal check while shopping at any
major retailer in this country.

The majority has strongly implied that Plaintiffs have somehow conceded that
Shadowsoft operates as a “legitimate business,” and that such a concession, if existent,
should have some impact on this Court’s legal analysis. (See Maj. Op. at p. 15.) On the
contrary, Plaintiffs have alleged throughout the course of this litigation that BMV
Officials had no basis for considering Shadowsoft a legitimate business at the time of the
disclosure. (Pls.’ Br. at 12-13, 22-23.) Defendants, in their answer to the complaint,
denied any knowledge of Shadowsoft’s corporate status based on their “want of
information or knowledge sufficient to form a belief as to the truth of the matter.” (R.
11: Answer at 3.) On reply before this Court, Defendants state that Shadowsoft is a
legitimate business, but still offer no assertion or evidence that BMV Officials were
aware of or inquired into this fact, even if accurate, at the time of the disclosure. (Defs.’
Reply at 2-4.)

But whether Shadowsoft is a legitimate business is largely irrelevant.3 What is
relevant is that Defendants in this case do not plead that they knew or had any reason to
believe that Shadowsoft was a legitimate business at the time that they made the

3
Because the procedural posture of the case arises from a motion for judgment on the pleadings,
no discovery was taken into the issue of Shadowsoft’s claim that it was a “legitimate business” at the time
that it made the record requests. Again, the majority’s factual presumption that Shadowsoft was a
“legitimate business,” and that Defendants were in a position that would have allowed them to confirm as
much, is misplaced. Because material disputes exist as to both of these questions, a grant of qualified
immunity which relies upon accepting Defendants’ representations on these matters is unjustified.
No. 10-3542 Roth, et al. v. Guzman, et al. Page 26

disclosure. At the time of the disclosure and alleged violation, Shadowsoft had neither
represented itself to BMV Officials as a legitimate business, nor had BMV Officials
inquired into or confirmed whether it was a legitimate business.

“The relevant, dispositive inquiry in determining whether a right is clearly
established is whether it would be clear to a reasonable [official] that his conduct was
unlawful in the situation he confronted.” Saucier v. Katz, 533 U.S. 194, 202 (2001); see
also Cooper v. Parrish, 203 F.3d 937, 951 (6th Cir. 2000). Even if it were true, as the
majority contends, that BMV Officials’ obligation of reasonable inquiry into a
requester’s permissible use begins and ends with a check in a box on a standardized
form, it cannot be the case that a state official fulfills his legal obligations, under
18 U.S.C. § 2721(b)(3), when he releases drivers’ personal information with absolutely
nothing to indicate that he is releasing the information to a “legitimate business.” Under
the facts as pleaded in this case, any reasonable official would have been on notice that
to disclose the information requested by Shadowsoft in response to Shadowsoft’s facially
deficient request would violate the DPPA.

Finally, it must be emphasized that the exceptions outlined in 18 U.S.C.
§§ 2721(b)(1)-(14) are permissive, not mandatary. Holding that a state official must
perform a reasonable minimal inquiry before releasing sensitive personal information
to anyone with a fax machine, a pencil and two dollars does not impose an unreasonable
burden. BMV Officials may decide that they do not want to face the threat of DPPA
liability for disclosing drivers’ information without first inquiring into whom and for
what purpose they are being asked to disclose. The solution is simple: when in doubt
as to whether the purpose of the request comports with the requirements of the Act,
BMV Officials may choose not to release drivers’ information for non-mandatory uses.
After all, the purpose of the DPPA is to encourage state officials to do what they should
strive to do anyway, which is to protect the personal information of state residents.

For these reasons, I would affirm the decision of the district court, and I therefore
respectfully dissent from the opinion of the majority.