United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued November 8, 2017 Decided January 12, 2018
No. 16-5355
OWNER-OPERATOR INDEPENDENT DRIVERS ASSOCIATION,
INC., ET AL.,
APPELLANTS
v.
UNITED STATES DEPARTMENT OF TRANSPORTATION, ET AL.,
APPELLEES
Appeal from the United States District Court
for the District of Columbia
(No. 1:12-cv-01158)
Joyce E. Mayers argued the cause for appellants. With her
on the briefs were Paul D. Cullen, Sr., and Paul D. Cullen, Jr.
Caroline D. Lopez, Attorney, U.S. Department of Justice,
argued the cause for appellees. With her on the brief were
Matthew M. Collette, Attorney, Paul M. Geier, Assistant
General Counsel, U.S. Department of Transportation, Joy K.
Park, Senior Trial Attorney, and Sue Lawless, Assistant Chief
Counsel for Enforcement and Litigation, Federal Motor Carrier
Safety Administration.
Before: TATEL, GRIFFITH, and SRINIVASAN, Circuit
Judges.
2
Opinion for the Court filed by Circuit Judge TATEL.
TATEL, Circuit Judge: In Spokeo, Inc. v. Robins, 136 S. Ct.
1540 (2016), the Supreme Court held that “Article III standing
requires a concrete injury even in the context of a statutory
violation,” id. at 1549. In this case, several commercial truck
drivers and their industry association claim they were injured
by the Department of Transportation’s violation of its statutory
obligation to ensure the accuracy of a database containing
driver-safety information. As explained in this opinion, we
agree with the district court that, under Spokeo, the asserted
injury is, by itself, insufficiently concrete to confer Article III
standing. We reverse, however, with respect to two drivers
whose information was released to prospective employers
because dissemination of inaccurate driver-safety data inflicts
an injury sufficiently concrete to confer standing to seek
damages.
I.
To fulfill its mandate of ensuring “the highest degree of
safety in motor carrier transportation,” the Federal Motor
Carrier Safety Administration, part of the Department of
Transportation, maintains the Motor Carrier Management
Information System, a database of commercial truck drivers’
safety records. 49 U.S.C. § 113(b). The database includes
“accident reports and other safety violations.” Weaver v.
Federal Motor Carrier Safety Administration, 744 F.3d 142,
143 (D.C. Cir. 2014). Maintaining the database requires
collaboration between state and federal authorities. States serve
as the primary reporters of information: they are obligated by
statute to “collect[] and report[] . . . accurate, complete, and
timely motor carrier safety data.” 49 U.S.C.
§ 31102(c)(2)(P)(i). For its part, the Department must “ensure,
to the maximum extent practical, [that] all the data is complete,
timely, and accurate,” id. § 31106(a)(3)(F), and “prescribe
3
technical and operational standards to ensure . . . uniform,
timely, and accurate information collection and reporting by
the States,” id. § 31106(a)(4)(A).
Shippers and other firms looking to hire truck drivers can
access certain information in the database, namely,
“[c]ommercial motor vehicle accident reports,” “[i]nspection
reports that contain no driver-related safety violations,” and
“[s]erious driver-related safety violation inspection reports.”
Id. § 31150(a). The Department makes this information
available through its Pre-Employment Screening Program,
which provides employers with reports containing crash data
from the previous five years and inspection data from the
previous three. See U.S. Department of Transportation, Federal
Motor Carrier Safety Administration (FMCSA), Privacy
Impact Assessment: Pre-Employment Screening Program
(PSP) (Apr. 14, 2010). The Department must “ensure that any
information that is released . . . will be in accordance with the
Fair Credit Reporting Act [FCRA] . . . and all other applicable
Federal law.” 49 U.S.C. § 31150(b)(1).
To further guarantee the accuracy of the database, the
Department must “provide a procedure for [drivers] to correct
inaccurate information.” Id. § 31150(b)(4). In order to
accomplish this, the Department “established ‘DataQs,’ a web-
based dispute resolution procedure that allows ‘[drivers] to
challenge[’]” database information. Weaver, 744 F.3d at 143
(quoting Privacy Act of 1974; Department of Transportation,
Federal Motor Carrier Safety Administration (FMCSA) 007
Pre-Employment Screening Program, 77 Fed. Reg. 42,548,
42,551 (July 19, 2012)). When a driver files a challenge, the
Department forwards it to the relevant state and state officials
“decide how to respond.” Id.
4
Appellants are five commercial truck drivers and their
industry association, the Owner-Operator Independent Drivers
Association, Inc. Between 2010 and 2013, state law-
enforcement authorities cited each driver for violating safety
regulations. See Owner-Operator Independent Drivers
Association v. Department of Transportation, 211 F. Supp. 3d
252, 256 (D.D.C. 2016). The drivers successfully challenged
the citations in state court: one driver was found not guilty after
trial, and the others had their citations dismissed. Id. at 256–57.
All but one of the drivers then asked through DataQs to have
the violation reports relating to the citations removed from the
Department’s database. Their requests were rejected because,
according to the relevant state authorities, the database at the
time displayed only initial citations, not adjudicated outcomes.
Id. at 257. The safety records of two drivers—Klint Mowrer
and Fred Weaver, Jr.—including the challenged violation
reports, were shared through the Pre-Employment Screening
Program; the other drivers’ records were never disseminated.
Id. at 260–61.
The individual drivers and the industry association then
sued, challenging the Department’s failure to ensure the
accuracy of the database and seeking injunctive and declaratory
relief under the Administrative Procedure Act, as well as
damages under the FCRA. The Department moved for
summary judgment, arguing (among other things) that the
drivers lacked Article III standing because they failed to show
concrete injury in fact. Id. at 258. The district court agreed and
dismissed the case. Id. at 261. The drivers appeal, and now we
consider the issue afresh. See Scenic America, Inc. v.
Department of Transportation, 836 F.3d 42, 49 (D.C. Cir.
2016) (“We review the District Court’s decision . . . as to
standing de novo . . . .”).
5
II.
“‘[T]he irreducible constitutional minimum of standing’
requires ‘an injury in fact’ that is both ‘concrete and
particularized,’ and ‘actual or imminent, not conjectural or
hypothetical.’” Hancock v. Urban Outfitters, Inc., 830 F.3d
511, 513 (D.C. Cir. 2016) (alteration in original) (quoting
Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992)). This
case focuses on just one element of that test: whether the
alleged injury is “concrete.” Specifically, we must determine
whether the drivers’ claimed injury—the Department’s failure
to discharge its statutory duty to ensure the accuracy of
information in the database—is sufficiently concrete to qualify
as injury in fact.
The touchstone for analyzing whether the violation of a
statutory obligation constitutes injury in fact is the Supreme
Court’s recent decision in Spokeo, Inc. v. Robins, 136 S. Ct.
1540 (2016). There, a consumer initiated a class action against
a company that operates an online search engine that gathers
and disseminates personal information, claiming that some of
the disseminated information was incorrect. Id. at 1544.
According to the consumer, this violated the FCRA, which
imposes procedural requirements on the creation and use of
consumer reports, including obligating reporting agencies to
adopt mechanisms for ensuring the information’s accuracy. Id.
at 1545–46. The Ninth Circuit had concluded that the consumer
satisfied Article III’s injury-in-fact requirement because he had
alleged that the search engine violated his rights under the
FCRA. Id. at 1546.
The Supreme Court vacated, explaining that the Ninth
Circuit, which had focused only on whether the injury was
particularized, failed to consider whether the injury was
concrete. See id. at 1548 (“We have made it clear time and time
again that an injury in fact must be both concrete and
6
particularized.”). Where the alleged injury arises only from a
statutory violation—as in both Spokeo and here—the Court
explained, “[a] ‘concrete’ injury must be ‘de facto’; that is, it
must actually exist.” Id. Although “Congress may ‘elevat[e] to
the status of legally cognizable injuries concrete, de facto
injuries that were previously inadequate in law,’” this “does not
mean that a plaintiff automatically satisfies the injury-in-fact
requirement whenever a statute grants a person a statutory right
and purports to authorize that person to sue to vindicate that
right.” Id. at 1549 (alteration in original) (quoting Lujan, 504
U.S. at 578). “Article III standing requires a concrete injury
even in the context of a statutory violation.” Id. A plaintiff
“could not, for example, allege a bare procedural violation,
divorced from any concrete harm, and satisfy the injury-in-fact
requirement of Article III.” Id.
Our court has had only a few occasions to apply Spokeo.
In Hancock v. Urban Outfitters, Inc., 830 F.3d 511 (D.C. Cir.
2016), for example, we found that plaintiffs who alleged that a
retailer’s request for their zip codes violated District of
Columbia consumer-protection law lacked standing. As we
explained, the plaintiffs asserted only “a bare violation of the
requirements of D.C. law,” and failed to allege any concrete
injury from the disclosure of a zip code, “for example, any
invasion of privacy, increased risk of fraud or identity theft, or
pecuniary or emotional injury.” Id. at 514. Collecting Spokeo’s
scattered definitions of concreteness, we held that a “plaintiff
must allege some ‘concrete interest’ that is ‘de facto,’ ‘real,’
and ‘actually exist[s].’” Id. (alteration in original) (quoting
Spokeo, 136 S. Ct. at 1548, 1549).
Although helpful, Hancock does not control here. In that
case, we found that a request for potentially harmless
information—a zip code—had inflicted no concrete injury. See
id. (“If, as the Supreme Court advised, disclosure of an
7
incorrect zip code is not a concrete Article III injury, then even
less so is [plaintiffs’] naked assertion that a zip code was
requested and recorded without any concrete consequence.”).
By contrast, here we address information that could easily harm
a driver were it shared with prospective employers. See
Appellants’ Br. 41–42 (explaining that reports of safety
violations can meaningfully affect a driver’s professional
reputation and employment prospects).
In support of their argument that they are injured by the
mere existence of inaccurate information in the database, the
drivers focus on two sentences from Spokeo: “[T]he violation
of a procedural right granted by statute can be sufficient in
some circumstances to constitute injury in fact. In other words,
a plaintiff in such a case need not allege any additional harm
beyond the one Congress has identified.” Spokeo, 136 S. Ct. at
1549. According to the drivers, these sentences mean that the
Department’s failure to comply with its statutory obligation to
ensure accuracy, by itself, inflicts injury in fact. We disagree.
The emphasized phrase “additional harm” clearly presumes
that the putative plaintiff had already suffered a de facto injury
resulting from the procedural violation. Reinforcing this
understanding of Spokeo, the Supreme Court, in explaining the
“no additional harm” proposition, cited only examples of torts
like libel and slander per se, where, so long as harmful
information is publicized, “the law has long permitted recovery
by certain tort victims even if their harms may be difficult to
prove or measure,” and cases relating to the denial of access to
publically available information. Id. at 1549–50 (citing the
informational-standing cases FEC v. Akins, 524 U.S. 11
(1998), and Public Citizen v. Department of Justice, 491 U.S.
440 (1989)). Although the Court gave no indication that these
two types of cases represent the only instances in which
concrete injury results from a bare statutory violation, all of the
decisions the drivers discuss fall into these two categories. That
8
is, the violation at issue resulted either from the disclosure of
potentially harmful information or from the withholding of
public information. See Appellants’ Br. 28–32 (collecting
cases).
For example, the drivers invoke the Ninth Circuit’s
decision on remand in Spokeo, where the court found that the
plaintiff had standing because he had “specifically alleged that
[the search engine] falsely reported” facts about his age, marital
status, education, employment, and wealth. Robins v. Spokeo,
Inc., 867 F.3d 1108, 1117 (9th Cir. 2017). The Ninth Circuit
also found that the allegations were not too speculative to
establish concrete injury because “both the challenged conduct
and the attendant injury ha[d] already occurred,” as the search
engine “ha[d] indeed published a materially inaccurate
consumer report.” Id. at 1118. Rather than supporting the
drivers’ allegation of injury, then, Spokeo on remand confirms
that actual publication is required to seek FCRA relief, and that
a statutory violation is sufficient to confer standing only if “the
specific procedural violations alleged . . . actually harm, or
present a material risk of harm to, [concrete] interests.” Id. at
1113.
The primary case the drivers cite from this Circuit is
Friends of Animals v. Jewell, 828 F.3d 989 (D.C. Cir. 2016),
see Appellants’ Br. 27–28, a post-Spokeo informational-
standing case in which plaintiffs challenged the Interior
Secretary’s failure to publish certain information as required by
the Endangered Species Act. The drivers read Jewell to support
their claim that Congress has broad latitude to define new
injuries, but the opinion in that case emphasizes the narrow
scope of informational injuries and makes clear that plaintiffs
must suffer real harm to support standing. “A plaintiff suffers
sufficiently concrete and particularized informational injury,”
we explained, “where the plaintiff alleges that: (1) it has been
9
deprived of information that, on its interpretation, a statute
requires the government or a third party to disclose to it, and
(2) it suffers, by being denied access to that information, the
type of harm Congress sought to prevent by requiring
disclosure.” Jewell, 828 F.3d at 992. Jewell is thus of no help
to the drivers unless, of course, they can show that the
Department’s statutory violation injured them.
The other post-Spokeo cases the drivers cite, not one of
which comes from this Circuit, similarly involve putative
injuries flowing from either disclosure or withholding.
Appellants’ Br. 28–32. The courts in each case made clear that
plaintiffs must show de facto injury even in the presence of a
statutory violation. See, e.g., In re Horizon Healthcare Services
Inc. Data Breach Litigation, 846 F.3d 625, 640 (3d Cir. 2017)
(“Plaintiffs here do not allege a mere technical or procedural
violation of FCRA. They allege instead the unauthorized
dissemination of their own private information—the very
injury that FCRA is intended to prevent. There is thus a de facto
injury that satisfies the concreteness requirement for Article III
standing.” (footnotes omitted)); Strubel v. Comenity Bank, 842
F.3d 181, 190 (2d Cir. 2016) (“[A] creditor’s alleged violation
of each notice requirement, by itself, gives rise to a ‘risk of real
harm’ to the consumer’s concrete interest in the informed use
of credit.” (quoting Spokeo, 136 S. Ct. at 1549)).
Unlike the injuries in the cited cases, the drivers’ injury
results from neither disclosure nor withholding of information.
Rather, the drivers claim they suffer concrete harm from the
mere fact that the Department, in violation of its statutory
obligations, has allowed inaccurate safety information to
remain in the database. As the drivers describe it, they “have a
concrete interest in the accuracy of their safety records and the
reflection those records project of their safety risk to potential
employers.” Appellants’ Br. 33. “As long as [the Department]
10
maintain[s] the inaccurate records of safety regulation
violations in the database,” the drivers explain, “[the
Department] expose[s] [them] to a material risk of harm
contrary to their concrete statutory rights to accuracy.” Id. at
38.
But does the drivers’ injury actually exist? Or, put another
way, if inaccurate information falls into a government
database, does it make a sound? Considering the drivers’
claimed harm in light of “both history and the judgment of
Congress,” as Spokeo instructs, we think not. Spokeo, 136 S.
Ct. at 1549.
To begin with, the drivers have identified no historical or
common-law analog where the mere existence of inaccurate
information, absent dissemination, amounts to concrete injury.
They cite libel and slander per se, Appellants’ Br. 35–38, but
as explained above, those torts require evidence of publication.
See Restatement (First) of Torts § 569 (libel); id. § 570
(slander).
Turning then to the judgment of Congress, we see nothing
in the relevant statutory provisions indicating that Congress
“creat[ed] legal rights” in the database’s accuracy, “the
invasion of which creates standing.” Havens Realty Corp. v.
Coleman, 455 U.S. 363, 373 (1982) (quoting Warth v. Seldin,
422 U.S. 490, 500 (1975)); cf. Electronic Privacy Information
Center v. Presidential Advisory Commission on Election
Integrity, No. 17-5171, 2017 WL 6564621, at *4 (D.C. Cir.
Dec. 26, 2017) (finding that the plaintiff lacks standing because
“it has not suffered the type of harm that [the statute] seeks to
prevent”). As the safety statute itself demonstrates, Congress
chose to protect truck drivers by requiring the Department to
ensure the accuracy of their information, not by giving them a
right of action to independently enforce that obligation. Section
11
31106 obligates the Department to ensure the database’s
accuracy and creates no right on the part of the drivers to police
their records—it speaks only to the Department itself. See 49
U.S.C. § 31106(a)(3)(F) (“The Secretary shall . . . .”). Section
31150, which authorizes pre-employment screening, likewise
reflects Congress’s concern about disclosure, requiring the
Department to “ensure that any information that is released . . .
will be in accordance with the [FCRA] and all other applicable
Federal law.” Id. § 31150(b)(1) (emphasis added). The FCRA,
too, is designed “to curb the dissemination of false
information.” Spokeo, 136 S. Ct. at 1550 (emphasis added).
These statutes demonstrate that the harm Congress was
concerned about was the dissemination of inaccurate
information, not its mere existence in the Department’s
database.
The drivers’ inability to identify a clear common-law
analog or to cite statutory support for their injury confirms that
the mere existence of inaccurate information in the database is
insufficient to confer Article III standing. Even though the
inaccuracy results from the Department’s violation of its
statutory obligations, the drivers have identified no “‘concrete
interest’ that is ‘de facto,’ ‘real,’ and ‘actually exist[s].’”
Hancock, 830 F.3d at 514 (alteration in original) (quoting
Spokeo, 136 S. Ct. at 1548, 1549).
As the foregoing analysis demonstrates, although the mere
existence of inaccurate database information is not sufficient to
confer Article III standing, the dissemination of that
information to a potential employer is. At oral argument,
Department counsel conceded that the two drivers whose safety
records were released to prospective employers, Mowrer and
Weaver, would have had standing to seek damages had they
preserved the issue for appeal. See Oral Arg. 19:23–41. In our
view, however, Mowrer and Weaver did raise the issue, stating
12
in their opening brief that “[a]t a minimum, the false report of
a criminal history for [Mowrer] and Weaver constitute[s] the
demonstration of the kind of concrete injury sufficient to
satisfy Article III standing.” Appellants’ Br. 42; see also
Compl. ¶ 192 (describing the Department’s “disseminat[ion of]
false, inaccurate, imprecise, incomplete and misleading
consumer reports to third parties through the [Pre-Employment
Screening Program]”). Given this, and because we agree that
the two drivers have suffered concrete harm, we shall remand
their damages claims to the district court.
In addition to damages, the drivers and their industry
association seek prospective relief, including a declaration that
the Department violated its statutory obligations and an
injunction requiring it to purge the database of inaccurate
information. Because “standing is not dispensed in gross,”
Town of Chester v. Laroe Estates, Inc., 137 S. Ct. 1645, 1650
(2017) (quoting Davis v. FEC, 554 U.S. 724, 734 (2008)), the
drivers “must demonstrate standing separately for each form of
relief sought,” Friends of the Earth, Inc. v. Laidlaw
Environmental Services (TOC), Inc., 528 U.S. 167, 185 (2000).
In order to have standing to seek prospective relief, the drivers
must show that dissemination of their database information is
“continuing” or “imminen[t].” Steel Co. v. Citizens for a Better
Environment, 523 U.S. 83, 108 (1998).
The drivers, however, concede that their information is no
longer at risk of dissemination through the Department’s Pre-
Employment Screening Program, as inspection data remains
available for only three years after the relevant inspection and
all of their disputed violations occurred more than three years
ago. Appellants’ Br. 45. The association, moreover, has offered
no evidence that any other member faces a risk of
dissemination. Indeed, any risk of future disclosure of
inaccurate information has been virtually eliminated by the
13
Department’s adoption of an interpretive rule in June 2014,
which allows States “to reflect the results of adjudicated
citations” in the database and prohibits certain favorably
adjudicated citations from being disseminated through the Pre-
Employment Screening Program. See Motor Carrier
Management Information System (MCMIS) Changes To
Improve Uniformity in the Treatment of Inspection Violation
Data, 79 Fed. Reg. 32,491, 32,491, 32,495 (June 5, 2014).
Though the rule applies only to inspections occurring “on or
after August 23, 2014,” thus excluding the drivers’ citations
here, it ensures that similarly situated individuals face little risk
of future harm. Id. at 32,495. Besides, given that our review
comes more than three years after the rule’s effective date, all
inaccurate records are protected from disclosure because they
are either subject to the new rule or have aged out of the three-
year Pre-Employment Screening Program reporting period.
The drivers insist that, in addition to the Pre-Employment
Screening Program, database information is used for other
purposes and that the records can be accessed under the
Freedom of Information Act, 5 U.S.C. § 552. But the drivers
offer no evidence that such use is either imminent or likely, as
would be required to support standing at the summary-
judgment stage. See Lujan, 504 U.S. at 561 (“[Standing] must
be supported . . . with the manner and degree of evidence
required at the successive stages of the litigation.”).
Finally, this case is not at all like our court’s recent
decision in Attias v. CareFirst, Inc., 865 F.3d 620 (D.C. Cir.
2017). There, at the motion to dismiss stage, we found that
health-insurance customers had standing to sue their insurer
after it suffered a cyberattack in which an intruder breached a
customer-information database. Id. at 622. We explained that
“identity theft . . . would constitute a concrete and
particularized injury” and that “the complaint plausibly alleges
14
that the plaintiffs now face a substantial risk of identity theft,”
because “an unauthorized party ha[d] already accessed
personally identifying data . . . and it is much less
speculative—at the very least, it is plausible—to infer that this
party ha[d] both the intent and the ability to use that data for
ill.” Id. at 627–28. Here, not only are we at the summary-
judgment stage, where the drivers must produce evidence of
injury, see Lujan, 504 U.S. at 561, but nothing in the record
indicates that anyone has recently accessed or used the
information at issue or intends to do so in the future. The
prospect of future injury is thus purely “speculative.” Attias,
865 F.3d at 626 (quoting Spokeo, 136 S. Ct. at 1548).
III.
Because the drivers are unharmed by the mere existence of
inaccurate information in the Department’s database and
because dissemination of that information is not imminent,
they—with the exception of Mowrer and Weaver—have
suffered no concrete injury in fact sufficient to confer Article
III standing. To be sure, it is possible that the mere existence of
inaccurate information in a government database could cause
concrete harm depending on how that information is to be used.
We conclude only that, under the specific circumstances of this
case, the drivers have failed to show standing for all of the relief
they seek. We thus affirm in part, reverse in part, and remand
to the district court for further proceedings consistent with this
opinion.
So ordered.