Cook v. ACS State & Local Solutions, Inc.

756 F. Supp. 2d 1104 (2010)

Janice COOK, et al., on behalf of themselves and all others similarly situated, Plaintiffs,
v.
ACS STATE & LOCAL SOLUTIONS, INC., et al., Defendants.

Case No. 10-00179-CV-W-DGK.

United States District Court, W.D. Missouri, Western Division.

November 19, 2010.

Jeremy Reade Wilson, Thomas Matthew Corea, The Corea Firm, PLLC, Joseph Hanson Malley, Dallas, TX, Timothy H. Bosler, Bosler Law Firm, P.C., Chillicothe, MO, for Plaintiffs.

John B. Boyd, Boyd & Kenter, P.C., Kansas City, MO, Larry F. York, Nicholas P. Laurent, McGinnis, Lochridge & Kilgore, LLP, Austin, TX, Alison L. Esbeck, Robert T. Haar, Haar & Woods, LLP, St. Louis, MO, Richard F. Modin, Theodore A. Kardis, Dougherty, Modin & Holloway, Kansas City, MO, Kurt D. Williams, Berkowitz, Oliver, Williams, Shaw & Eisenbrandt, LLP, Kansas City, MO, Mark W. Baye, Gardere Wynne Swewll LLP, Dallas, TX, Douglas Charles McKenna, Lewis, Rice & Fingersh, L.C., Kansas City, MO, Joseph E. Martineau, Lewis, Rice & Fingersh, St. Louis, MO, Richard N. Bien, Brett J. Coppage, James Moloney, V. Lathrop & Gage LLP, Kansas City, MO, Andrew P. Botti, McLane, Graf, Raulerson & Middleton, P.A., Woburn, MA, for Defendants.

ORDER

GREG KAYS, District Judge.

This is a putative class action regarding alleged violations of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721-25. Now pending before the Court are Defendants' Motions to dismiss and Suggestions in Support, Plaintiffs' consolidated response and Defendants' Replies. Docs. 38-45, 55-57, 61-63, 66. Defendants seek dismissal for lack of standing and failure to state a claim. For the reasons discussed below, Defendants' Motions are GRANTED IN PART AND DENIED IN PART. This case is dismissed for failure to state a claim.

Background

On February 25, 2010, Plaintiffs filed suit against ACS State & Local Solutions, Inc., Listco West,^[1] Samba Holdings, Inc., Aristotle International, Inc., E-Infodata.com, Inc.,^[2] Insurance Information Exchange, the St. Louis Post-Dispatch and Worldwide Information, Inc., alleging violation of the DPPA. Doc. 1. Plaintiffs amended their complaint on April 29, 2010. Doc. 10. Plaintiffs allege that Defendants violated the DPPA by obtaining, at various times, the "entire database of names, addresses and other personal information" from the State of Missouri's driver records. Defendants claim that Plaintiffs lack standing due to lack of an injury-in-fact and have failed to state a valid DPPA claim.

Standard

Federal Rule of Civil Procedure 12(b)(6) allows for dismissal of a lawsuit for failure to state a claim upon which relief can be granted. Recent Supreme Court decisions have dramatically changed the way courts view these motions. While the federal system remains one of notice pleading, "a complaint must contain sufficient factual matter, accepted as true, to `state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, ___ U.S. ___, 129 S. Ct. 1937, 1949, 173 L. Ed. 2d 868 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S. Ct. 1955, 167 L. Ed. 2d 929 (2007)). A claim must do more than state "an unadorned, the-defendant-unlawfully-harmed-me accusation" or "a formulaic recitation of the elements of a cause of action." Iqbal, 129 S.Ct. at 1949.

Article III of the United States Constitution grants federal courts jurisdiction to hear "Cases ... [and] ... Controversies." Among the doctrines inherent in this requirement is standing. The Supreme Court has held that the "irreducible constitutional minimum" of standing is that a party must have three elements:

"First, the plaintiff must have suffered an injury in fact—an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical. Second, there must be a causal connection between the injury and the conduct complained of—the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court. Third, it must be likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision."

Lujan v. Defenders of Wildlife, 504 U.S. 555, 561, 112 S. Ct. 2130, 119 L. Ed. 2d 351 (1992) (internal formatting omitted). Standing is an issue of subject matter jurisdiction and therefore subject to a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1). Stalley v. Catholic Health Initiatives, 509 F.3d 517, 520 (8th Cir.2007). As jurisdictional issue, the Court will consider standing before determining whether or not Plaintiffs have stated a claim.

Discussion

A. Plaintiffs Have Standing To Sue

The DPPA provides for a civil action against "A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter..." 18 U.S.C. § 2724(a). Among other remedies, plaintiffs can recover "actual damages, but not less than liquidated damages in the amount of $2,500 ..." Id. at (b)(1). Plaintiffs plead that

"[They] have suffered harm as their private information has been obtained unlawfully. In addition to violation of this Congressionally recognized, legally protected right, Plaintiffs and members of the class have suffered harm by virtue of increased risks to them associated with having their protected data in the possession of numerous individuals. This is precisely the harm Congress sought to prevent by enacting the DPPA and its statutory remedies.... The violation of Plaintiffs' legally protected interests, and the consequent harm caused thereby, gives them standing to bring this lawsuit. In addition, Plaintiffs and members of the class are entitled to liquidated damages in the amount of $2,500.00 for each instance in which the Defendants violated the DPPA."

Doc. 10 at ¶¶ 41-42. Defendants assert that "increased risks" do not represent injuries which are concrete, particularized, actual and imminent. In response, Plaintiffs cite case law holding that plaintiffs are not required to show actual damages in order to recover liquidated damages under the DPPA. Kehoe v. Fid. Fed. Bank & Trust, 421 F.3d 1209, 1215 (11th Cir. 2005). Kehoe held that the language of section 2724(b), specifically "but not less," makes clear that it is not necessary to prove actual damages in order to qualify for the liquidated damages award. Id. In reaching this conclusion, the Eleventh Circuit relied on dicta from the Supreme Court case of Doe v. Chao, in which the Supreme Court held that statutory language in the Privacy Act required actual damages in order to be entitled to statutory damages. Doe v. Chao, 540 U.S. 614, 627, 124 S. Ct. 1204, 157 L. Ed. 2d 1122 (2004). Chao held that the phrase "but in no case shall a person entitled to recovery receive less than the sum of $1,000" requires Plaintiffs to show actual damages. Id. at 619, 627, 124 S. Ct. 1204. The Supreme Court suggested that "but in no case ... less than the sum of $1,000," language similar to the DPPA language, would have done away with the actual damages requirement.

While Kehoe did not address the constitutional issue, various courts have expressed the view that pleading a violation of the DPPA satisfies Article III standing. See Taylor v. Acxiom Corp., 612 F.3d 325, 340-41 (5th Cir.2010) (Dennis, Circuit Judge, concurring) (noting that pleading a violation of the DPPA constitutes "the invasion of an interest which the plaintiffs argue is legally protected"); Pichler v. UNITE, 542 F.3d 380, 388 (3d Cir.2008) ("The DPPA provides redress for violation of a person's protected interest in the privacy of his or her motor vehicle records and the identifying information therein."); Parus v. Cator, No. 05-C-0063-C, 2005 WL 2240955, at *5 (W.D.Wis. Sept. 14, 2005) ("It is true that plaintiff has not alleged that he suffered injury as a result of defendant Kreitlow's obtaining his personal information. However, under the statute, improperly obtaining plaintiff's information was an injury.") (emphasis in original). While Congress cannot simply confer standing on a party, it may define an injury that did not exist prior to the enactment of a statute. See Lujan, 504 U.S. at 579, 112 S. Ct. 2130 (Kennedy, J., concurring) (citing Warth v. Seldin, 422 U.S. 490, 500, 95 S. Ct. 2197, 45 L. Ed. 2d 343 (1975)). Even a case cited by Defendants to support their argument takes this view. Young v. West Pub. Corp., 724 F. Supp. 2d 1268, 1281 (S.D.Fla.2010) ("Thus, if [the defendant] knowingly obtained, disclosed or used Plaintiffs' personal information for a purpose not permitted under the DPPA, an injury has occurred such that Plaintiffs have standing to bring a cause of action.") (emphasis added). While the Young court did dismiss for lack of standing, it did so because it found that the plaintiffs had failed to plead an impermissible use, not for lack of a constitutional injury. Id.

If Congress's power to define injuries as a method of bestowing standing is to mean anything, the case cannot be dismissed on this basis. While these injuries are certainly not garden-variety tort injuries, such is the nature of a statute designed to protect an interest as abstract as personal privacy. Defendants' 12(b)(1) Motions are DENIED.

B. Plaintiffs Have Not Stated A DPPA Claim Upon Which Relief Can Be Granted

Defendants also seek dismissal on the basis that Plaintiffs have failed to state a claim due to lack of an impermissible use under the DPPA. A civil action under the DPPA must show that the defendant "obtain[ed], disclos[ed] or us[ed] personal information, from a motor vehicle record, for a purpose not permitted under this chapter." 18 U.S.C. § 2724(a). Plaintiffs assert that Defendant ACS State & Local Solutions, Inc.'s impermissible purposes were "stockpiling it in case a use for it arose in the future," to "avoid the inconvenience of having to go to the State each time it needs an additional customers' information" and "maintaining a database containing the above-referenced Plaintiffs' personal information as part and parcel to the conduct of its ordinary business activities and as a business resource."^[3] Doc. 10 at ¶ 29. In addition to these three allegedly impermissible uses, Plaintiffs assert that Defendant Samba Holdings, Inc.'s impermissible purpose was "to resell [the records] to its customers." Id. at ¶ 31. Plaintiff's assert that Defendant Aristotle International, Inc.'s impermissible purpose was "the ... sale of data to third parties." Id. at ¶ 32. Plaintiffs assert that Defendants the St. Louis Post-Dispatch and Insurance Information Exchange had the same impermissible uses as ACS. Id. at ¶ 34-35. Finally, Plaintiffs allege that Defendant Worldwide Information, Inc. had the impermissible use of resale. Id. at ¶ 36.

At the outset, the Court finds that this is not a pleading problem under Twombly/Iqbal. Accordingly, the Court will focus its analysis on whether the alleged impermissible uses state a valid claim under the DPPA. Resale is expressly permitted by the DPPA.

(c) Resale or redisclosure.—An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal information for any purpose. An authorized recipient under subsection (b)(12) may resell or redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.

18 U.S.C. § 2721(c). Regarding Plaintiffs' claims of "stockpiling," the Taylor court summarized similar claims as follows:

"Plaintiffs complain that the defendants in the instant case, pursuant to the Texas statute, buy DMV records in bulk from the Texas DPS. These defendants do not use all of the records immediately. They maintain databases or resell the information. They potentially could use any record in the normal course of their business for a permissible purpose under the DPPA. Plaintiffs do not complain that the defendants actually used any of the records for a purpose other than the ones listed in the DPPA. Instead, the plaintiffs complain that maintaining records not actually used for the defendants' stated purpose is itself an impermissible purpose under the statute. Stated another way, plaintiffs assert that buying the records in bulk with an expectation and purpose of valid potential use is not a permissible use under the DPPA."

Taylor, 612 F.3d at 334 (emphasis added). Plaintiffs claim that Defendants are stockpiling data, that they are holding data for convenience, and that they are maintaining databases for use "as part and parcel to the conduct of its ordinary business activities and as a business resource." Though Plaintiffs characterize the claims differently, the claims are virtually identical to Taylor. Regarding the "stockpiling" of records, Taylor notes that the language of the statute and the legislative history indicate that there is no proscription against bulk obtainment of driver records. Id. at 335-38. For parties that may have a permissible use in the future, it makes sense to obtain the database as opposed to submitting multiple individual requests as needed. Furthermore, because the impetus for the DPPA was a number of high-profile crimes in which criminals obtained individuals' driver records, Congress was not contemplating bulk obtainment as the problem to be addressed. Regarding reselling, the Court agrees with Taylor that a reseller does not need to have its own permissible use. Id. at 338. Finally, as noted in Taylor, the Attorney General, who is charged with civil enforcement of the DPPA, has issued an advisory opinion supporting the argument that neither reselling nor bulk obtainment are in violation of the statute. Id. Based on this, the Court rejects Plaintiffs' arguments that "stockpiling" and obtainment for future reselling state a valid DPPA claim. Defendants' 12(b)(6) Motions are GRANTED.

Conclusion

Though not binding authority, the Court finds that analysis applied by the Fifth Circuit in Taylor to be persuasive. Plaintiffs have standing to sue. However, none of the allegedly impermissible uses state a valid DPPA claim. Defendants' Motions to dismiss are GRANTED IN PART AND DENIED IN PART. All other motions are discharged by this order.

IT IS SO ORDERED.

NOTES

[1] On October, 13, 2010, the Court dismissed Listco West without prejudice based on Plaintiffs' failure to effect service. Doc. 74.

[2] On May 28, 2010, Plaintiffs filed a notice of dismissal without prejudice as to E-Infodata.com, Inc. Doc. 13. The Court will refer to the remaining Defendants collectively as "the Defendants."

[3] Though Plaintiffs state it three different ways, the Court finds that this actually one allegation of an impermissible use, because the latter two prongs are the reasons that Defendants have allegedly "stockpiled" the data.