United States Court of Appeals
For the Eighth Circuit
___________________________
No. 16-1425
___________________________
Angela Kay Shambour
lllllllllllllllllllll Plaintiff - Appellant
v.
Carver County; City of Cottage Grove; City of Dundas; City of Farmington; City
of Lonsdale; City of Northfield; Ramsey County; Rice County; City of St. Paul;
City of West St. Paul; Michael Campion, in his individual capacity as the
Commissioner of the Department fo Public Safety; Ramona Dohman, in her
capacity as the Commissioner of the Department of Public Safety; John and Jane
Does (1-100), acting in thier individual capacity as supervisors, officers, deputies,
staff, investigators, employees or agents of the other governmental agencies;
Department of Public Safety Does (1-30), acting in their individual capacity as
officers, supervisors, staff, employees, independent contractors or agents of the
Minnesota Department of Public Safety; Entity Does (1-30), including cities,
counties, municipalities, and other entities sited in Minnesota
lllllllllllllllllllll Defendants - Appellees
____________
Appeal from United States District Court
for the District of Minnesota - Minneapolis
____________
Submitted: June 6, 2017
Filed: September 25, 2017
[Unpublished]
____________
Before WOLLMAN, ARNOLD, and GRUENDER, Circuit Judges.
____________
PER CURIAM.
Angela Shambour brought suit against various Minnesota individuals, cities,
counties, and law-enforcement entities, alleging numerous violations of the Data
Privacy Protection Act (“the DPPA” or “the Act”), 18 U.S.C. §§ 2721-2725. The
district court1 dismissed the majority of these claims as time-barred, for failure to
state an actionable DPPA claim, or both. For the reasons discussed below, we affirm.
The DPPA restricts the use and distribution of personal information contained
in motor-vehicle records. The Act outlines fourteen purposes for which government
employees may access such records—including, as relevant here, law-enforcement
functions. See id. § 2721(b). Access for unenumerated purposes constitutes a
violation of the DPPA, see id. § 2722(a), which provides that “[a] person who
knowingly obtains, discloses or uses personal information, from a motor vehicle
record, for a purpose not permitted under this chapter shall be liable to the individual
to whom the information pertains, who may bring a civil action in a United States
district court,” id. § 2724.
Shambour, a former law-enforcement officer, discovered through an audit
report in 2013 that her Driver and Vehicle Services (DVS) records had been accessed
fifty-nine times between 2003 and 2011. She alleged that there was no reason for
officials to access her information except that her appearance “changed noticeably”
since her time as an officer. As such, she hypothesized that individuals viewed her
record out of romantic attraction or curiosity about the changes in her appearance.
She filed this action on February 28, 2014 against: (1) unknown individuals who
accessed her records (“Individual Defendants”); (2) their supervisors (“Supervisor
Defendants”); (3) the cities and counties that employed the Individual Defendants
1
The Honorable Richard H. Kyle, United States District Judge for the District
of Minnesota.
-2-
(“Entity Defendants”); (4) Mona Dohman and Michael Campion in their individual
capacities as Commissioners of the Department of Public Safety from 2003 to 2011
(“Commissioners”); and (5) unidentified officers, supervisors, employees, staff,
independent contractors, and agents of the Department of Public Safety (“DPS
Does”). She alleged that these parties violated her statutory, constitutional, and
common-law privacy rights by accessing or allowing access to her DVS records.
The district court determined that many of Shambour’s DPPA claims were
time-barred under the applicable four-year statute of limitations, see 28 U.S.C.
§ 1658, and it dismissed all claims based on alleged violations occurring before
February 28, 2010. The court then denied dismissal of the claims against the
Individual Defendants based on conduct that occurred after February 28,
2010—finding those claims were sufficiently pled—while granting dismissal on all
non-time-barred claims against the Supervisor Defendants, Entity Defendants,
Commissioners, and DPS Does (collectively “the Defendants”). The court found that
the Defendants merely allowed individual officers and government officials access
to personal information to carry out law-enforcement functions. Thus, even though
the Individual Defendants may have acted with impermissible purposes when
obtaining or using Shambour’s personal information, the court found that the
Defendants could not be held liable for even the non-time-barred DPPA claims
because Shambour did not allege any facts indicating that Individual Defendants were
given access to DVS records for any reason other than law-enforcement purposes.
After the district court dismissed her claims against the Defendants, Shambour settled
and voluntarily dismissed the two claims against Individual Defendants that arose
from access occurring after February 28, 2010. She now appeals the dismissal of her
DPPA claims against the Defendants.
We review a district court’s grant of a motion to dismiss de novo. Cook v. ACS
State & Local Sols., Inc., 663 F.3d 989, 992 (8th Cir. 2011). To survive a motion to
dismiss, “a complaint must contain sufficient factual matter, accepted as true, to state
a claim to relief that is plausible on its face.” Braden v. Wal-Mart Stores, Inc., 588
-3-
F.3d 585, 594 (8th Cir. 2009) (quotations omitted). Shambour argues that her DPPA
claims against the Defendants are not time-barred because the four-year statute of
limitations starts when the unlawful accesses are discovered. Defendants disagree,
arguing that binding Eighth Circuit precedent holds that the limitations period
commences as soon as a violation occurs. Furthermore, Defendants contend that
under the Supreme Court’s recent decision in Spokeo v. Robbins, 136 S. Ct. 1540
(2016), Shambour lacks standing to bring her claims. Because Article III standing
is jurisdictional, see id. at 1547, we begin with the Defendants’ Spokeo argument and
conclude with Shambour’s statute-of-limitations claim. Our task is simplified,
however, by recent Eighth Circuit precedents deciding these exact issues.
In Heglund v. City of Grand Rapids, we applied the Supreme Court’s decision
in Spokeo and found that plaintiffs alleging DPPA violations had suffered an injury
in fact and thus had standing to bring suit. No. 16-3063, 2017 WL 3910116, at *2-3
(8th Cir. Sept. 7, 2017). Spokeo held that the “bare procedural violation” of a
statutory right does not in and of itself constitute an injury in fact, for “Article III
requires a concrete injury even in the context of a statutory violation.” 136 S. Ct. at
1549. Thus, even though the Fair Credit Reporting Act requires consumer reporting
agencies to “follow reasonable procedures to assure maximum possible accuracy” of
consumer reports and imposes liability on “[a]ny person who willfully fails to comply
with any requirement [of the Act],” id. at 1545 (citations omitted), the plaintiff
in Spokeo lacked standing based on his allegation of a mere procedural violation. Id.
at 1550. In applying this analysis to the DPPA context, Heglund first identified the
relevant interest as “[a]n individual’s control of information concerning her person”
and the relevant harm as an invasion of privacy. 2017 WL 3910116, at *3. Then, in
determining whether this intangible harm constituted an injury in fact, the court
followed Spokeo’s direction to “consider Congress’ judgment and whether the alleged
intangible harm has a close relationship to a harm that traditionally provided a basis
for suit in the Anglo-American legal system.” Id. at *2 (citing Spokeo, 136 S.Ct. at
1549). The court first noted that, “[i]n enacting the DPPA, Congress recognized the
potential harm to privacy from state officials accessing drivers’ personal information
-4-
for improper reasons.” Id. at *3 (citing Maracich v. Spears, 133 S. Ct. 2191, 2195
(2013)). Heglund then explained that the intangible harm associated with the
violation of the DPPA’s substantive protections is consonant with the “common law
tradition of lawsuits for invasion of privacy.” Id. (citation omitted). Accordingly, the
court held that a DPPA violation is sufficient to establish an injury in fact for the
purposes of Article III standing. Id. The Defendants’ claim here—that Shambour has
alleged a bare procedural violation of the DPPA without a concrete injury—is the
exact argument that Heglund rejected. Thus, because this case is indistinguishable
from Heglund, we hold that Shambour has standing as to her DPPA claims.
Because Shambour has standing, we turn to her arguments concerning the
dismissal of her DPPA claims against the Defendants. In McDonough v. Anoka
County, we “conclude[d] that the statute of limitations for these DPPA violations
began to run when the violations occurred.” 799 F.3d 931, 943 (8th Cir. 2015); see
also Tichich v. City of Bloomington, 835 F.3d 856, 866 (8th Cir. 2016), cert. denied,
137 S.Ct. 2246 (“The present appeals . . . are governed by our holdings in
[McDonough], one of which is that the four-year statute of limitations set forth in 28
U.S.C. § 1658(a) begins to run when a DPPA violation occurs.”). At oral argument
and in her briefs, Shambour conceded that, unless this panel overturns McDonough
and Tichitch, all of her DPPA claims against the Defendants are time-barred. We
refuse to do so, for “it is a cardinal rule in the Eighth Circuit that one panel is bound
by the decision of a prior panel.” Elmore v. Harbor Freight Tools USA, Inc., 844
F.3d 764, 767 (8th Cir. 2016) (quotations, citations, and alterations omitted). As a
result, the four-year statute of limitations applies, and none of Shambour’s DPPA
claims are timely.
We therefore affirm the dismissal of Shambour’s DPPA claims against the
Defendants.
______________________________
-5-