[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS
FILED
FOR THE ELEVENTH CIRCUIT U.S. COURT OF APPEALS
________________________ ELEVENTH CIRCUIT
FEBRUARY 12, 2007
No. 06-12614 THOMAS K. KAHN
________________________ CLERK
D. C. Docket No. 04-21351-CV-JEM
MARY ANN COLLIER,
ARTHUR L. WALLACE,
ROY MCGOLDRICK,
ROBERT PINO,
Plaintiffs-Appellants,
versus
FRED O. DICKINSON, III,
CARL A. FORD,
SANDRA LAMBERT,
MICHAEL D. MCCASKILL,
BOYD WALDEN,
PHILLIP SHELTON,
DAVID M. PERRYMAN,
LAWRENCE J. BILBO,
Defendants-Appellees,
FLORIDA DEPARTMENT OF FINANCIAL SERVICES,
Defendant.
________________________
Appeal from the United States District Court
for the Southern District of Florida
_________________________
(February 12, 2007)
Before BLACK, BARKETT and KRAVITCH, Circuit Judges.
BARKETT, Circuit Judge:
Mary Ann Collier, Arthur L. Wallace, Roy McGoldrick, and Robert Pino, as
well as the putative class of all other similarly situated individuals (collectively
“Plaintiffs”), appeal the dismissal of their Second Amended Complaint against
Fred O. Dickinson III, Carl A. Ford, and Sandra Lambert (collectively
“Defendants”). Defendants, who are executive-level officials at the Florida
Department of Highway Safety & Motor Vehicles (“DHSMV”), were sued in their
individual capacity for selling the personal information that Plaintiffs provided to
the DHSMV in order to obtain their drivers’ licenses and/or vehicle registrations to
mass marketers, in violation of the Driver Privacy Protection Act (“DPPA”), 18
U.S.C. § 2721-2725.
In addition to a direct claim under the DPPA, Plaintiffs also sued for relief
under 42 U.S.C. § 1983, which imposes liability on anyone who, under color of
state law, deprives a person “of any rights, privileges, or immunities secured by the
2
Constitution and laws.” Specifically, Plaintiffs alleged that the sale of personal
information violated their constitutional right to privacy, in addition to their rights
protected by the DPPA. The district court granted Defendants’ motion to dismiss
all claims in the complaint on the grounds that Defendants were entitled to
qualified immunity.
Qualified immunity offers protection for government officials, acting within
their discretionary authority,1 who are sued in their individual capacities as long as
“their conduct does not violate clearly established statutory or constitutional rights
of which a reasonable person would have known.” Harlow v. Fitzgerald, 457 U.S.
800, 818 (1982) (citation omitted). We review a district court’s grant of a motion
to dismiss based on qualified immunity de novo and accept well-pleaded
allegations as true, construing facts in the light most favorable to the plaintiffs.
Maggio v. Sipple, 211 F.3d 1346, 1350 (11th Cir. 2000).
1
To act within the scope of discretionary authority means that “the actions were (1)
undertaken pursuant to the performance of [the official’s] duties and (2) within the scope of [his]
authority.” Lenz v. Winburn, 51 F.3d 1540, 1545 (11th Cir. 1995) (quotation marks and citations
omitted). We find no error in the district court’s determination that Defendants were acting
within their discretionary duties when they sold motor vehicle record information to mass
marketers. The parties agree that Defendants are high level executive officials who are required
to exercise discretionary authority to develop and implement policy decisions regulating the
dissemination of the DHSMV’s motor vehicle records. They are essentially responsible for the
distribution of motor vehicle record information. Accordingly, the acts complained of—the
improper release of the information—were “within, or reasonably related to, the outer perimeter
of [Defendants’] discretionary duties.” Harbert Int’l Inc. v. James, 157 F.3d 1271, 1282 (11th
Cir. 1998).
3
To ascertain whether an official is entitled to qualified immunity we must
first evaluate whether Plaintiffs’ allegations, if true, establish a violation of a
constitutional or statutory right. Saucier v. Katz, 533 U.S. 194, 201 (2001).
Second, if Plaintiffs’ allegations, accepted as true, establish a violation of a
constitutional or statutory right, we must ask whether “the [federal] right [that was
violated] was clearly established” at the time of the alleged conduct. Id.
Accordingly, we conduct this two part inquiry as to each of the two claims
presented by the plaintiff: those filed pursuant to Section 1983 and the direct claim
for the violation of the DPPA.
I. Constitutional Right To Privacy
Plaintiffs first allege that they are entitled to relief under Section 1983
because Defendants violated their constitutional right to privacy when they
released their personal information to mass marketers without their consent. We
find that, under our precedent, the district court did not err in answering the first
Saucier question—whether a constitutional right had been violated—in the
negative. See Pryor v. Reno, 171 F.3d 1281, 1288 n.10 (11th Cir. 1999), rev’d on
other grounds, 528 U.S. 1111 (2000). We are bound by Pryor and cannot, as a
panel, revisit this issue. See Morrison v. Amway Corp., 323 F.3d 920, 929 (11th
Cir. 2003) (“A prior panel decision of this Court is binding on subsequent panels
4
and can be overturned only by the Court sitting en banc.”) (citation omitted).
Accordingly, because Plaintiffs’ allegations do not establish a constitutional
violation under our precedent, there is no need to reach the second Saucier question
of whether the law was clearly established at the time of the alleged conduct. The
district court did not err in dismissing the constitutional claim under Section 1983
as barred by qualified immunity.
II. Statutory Right To Privacy
Plaintiffs make two claims asserting that their statutory right to privacy was
violated by Defendants’ conduct. One is a direct claim pursuant to the DPPA. The
other is a claim pursuant to Section 1983, which imposes liability on anyone who,
under color of state law, deprives a person of any rights secured by either the
Constitution or federal laws. 42 U.S.C. § 1983. Accordingly, we must first
determine whether the DPPA directly furnishes Plaintiffs with a cause of action.
We must also determine whether the rights provided by the DPPA are separately
enforceable under Section 1983.
1. Does The DPPA Create A Statutory Right To Privacy In Motor Vehicle Record
Information That Is Enforceable Directly Under The Statute?
Count II of the complaint asserts a claim directly under the DPPA, and
alleges that Defendants violated the statute when they sold motor vehicle record
5
information to mass marketers without Plaintiffs’ consent. The DPPA prohibits the
release of personal information contained in individual motor vehicle records
unless the State has obtained the express consent of the person to whom such
personal information pertains.2 The statute provides a two part remedy. First, the
statute provides enforcement against the states:
Any State department of motor vehicles that has a policy or practice of
substantial noncompliance with this chapter shall be subject to a civil
penalty imposed by the Attorney General of not more than $5,000 a day for
each day of substantial noncompliance.
2
18 U.S.C. § 2721(a) states:
In general.–A State department of motor vehicles, and any officer, employee,
or contractor thereof, shall not knowingly disclose or otherwise make
available to any person or entity: (1) personal information, as defined in 18
U.S.C. 2725(3), about any individual obtained by the department in
connection with a motor vehicle record, except as provided in subsection (b)
of this section; or (2) highly restricted personal information, as defined in 18
U.S.C. 2725(4), about any individual obtained by the department in
connection with a motor vehicle record, without the express consent of the
person to whom such information applies, except uses permitted in
subsections (b)(1), (b)(4), (b)(6), and (b)(9): Provided, That subsection (a)(2)
shall not in any way affect the use of organ donation information on an
individual’s driver’s license or affect the administration of organ donation
initiatives in the States.
Under 18 U.S.C. § 2721(b), personal information may be disclosed under certain
circumstances, including:
(11) For any other use in response to requests for individual motor vehicle
records if the State has obtained the express consent of the person to whom
such personal information pertains.
(12) For bulk distribution for surveys, marketing or solicitations if the State
has obtained the express consent of the person to whom such personal
information pertains.
(13) For use by any requester, if the requester demonstrates it has obtained
the written consent of the individual to whom the information pertains.
6
18 U.S.C. § 2723(b).
In addition, 18 U.S.C. § 2724 provides a cause of action against individuals
as follows:
(a) Cause of action.–A person who knowingly obtains, discloses or uses
personal information, from a motor vehicle record, for a purpose not
permitted under this chapter shall be liable to the individual to whom the
information pertains, who may bring a civil action in a United States district
court.
(b) Remedies–The court may award–(1) actual damages, but not less than
liquidated damages in the amount of $2,500; (2) punitive damages upon
proof of willful or reckless disregard of the law; (3) reasonable attorneys’
fees and other litigation costs reasonably incurred; and (4) such other
preliminary and equitable relief as the court determines to be appropriate.
18 U.S.C. § 2724 (emphasis added).
We find that the plain language of the DPPA clearly, unambiguously, and
expressly creates a statutory right which may be enforced by enabling aggrieved
individuals to sue persons who disclose their personal information in violation of
the DPPA. Accordingly, if the acts alleged by Plaintiffs are taken to be true—that
Defendants sold personal information without their consent—then Count II of the
complaint states a cause of action under the DPPA.
2. Is The Statutory Right To Privacy Created By The DPPA Enforceable
Separately Under Section 1983?
Plaintiffs also allege that they are entitled to the relief provided by Section
7
1983 because, by releasing their personal information to mass marketers without
their consent, Defendants violated the statutory right to privacy granted to them by
the DPPA. Defendants argue that, even if the plain language of the statute grants
individuals a right to sue persons who violate it, the DPPA does not also create an
enforceable right under Section 1983 because the remedial scheme set forth in the
statute is inconsistent with additional relief under Section 1983.
It is settled that “the § 1983 remedy broadly encompasses violations of
federal statutory as well as constitutional law.” Maine v. Thiboutot, 448 U.S. 1, 4
(1980). For a federal statute to be enforceable under Section 1983, three conditions
must be satisfied. First, Congress must have intended that the enforcement
provisions of the statute focus on benefiting the plaintiff individually, rather than
focusing on benefiting a group or making system-wide changes. Gonzaga Univ. v.
Doe, 536 U.S. 273, 283 (2002); Blessing v. Freestone, 520 U.S. 329, 340 (1997).
Second, the right “protected by the statute [must not be] so vague and amorphous
that its enforcement would strain judicial competence.” Blessing, 520 U.S. at 340-
41 (quotation and citation omitted). Third, the provision giving rise to the right
“must unambiguously impose a binding obligation on the States” in that it is
“couched in mandatory, rather than precatory, terms.” Id. at 341 (citation omitted).
If all three conditions are satisfied, there exists a rebuttable presumption that the
8
statute is enforceable under Section 1983. This presumption can only be refuted if
Congress expressly or impliedly created “a comprehensive enforcement scheme [in
the statute in question] that is incompatible with individual enforcement under §
1983.” Id.
We have no hesitancy in finding that the plain language of the DPPA
clearly satisfies all three conditions to make it enforceable under Section 1983.
First, the enforcement provisions of the statute unambiguously focus on benefiting
individuals, rather than focusing on benefiting a group or making system-wide
changes. The statute makes the official who disobeys the law “liable to the
individual to whom the information pertains, who may bring a civil action in a
United States district court.” 18 U.S.C.A. § 2724(a) (emphasis added). Second, it
can hardly be said that the protections offered by the statute are “so vague and
amorphous that its enforcement would strain judicial competence.” Blessing, 520
U.S. at 340-341 (quotation and citation omitted). Rather, the protections offered by
the statute are clear and specific. The language of Sections 2721(b)(11)-(13)
unambiguously requires the consent of individuals before their motor vehicle
record information may be released, and Section 2724(a) unambiguously states that
an individual who knowingly violates the statute shall be liable to the individuals
to whom the information pertains in an action in federal district court. The
9
language sets forth the contours and limits of the right clearly, and the right is
easily enforceable by courts. Third, the statutory language is mandatory in that it
requires that the states obtain the consent of the persons whose information is to be
disseminated.
Notwithstanding the clarity of the statute, Defendants argue that Section
1983 relief is precluded because Congress intended to create “a comprehensive
enforcement scheme that is incompatible with individual enforcement under §
1983,” Blessing, 520 U.S. at 341 (citation omitted), when it authorized the United
States Attorney General to enforce the statutory rights against the states and
provided an individual right of action under the DPPA against persons violating
the statute. We fail to see such incompatibility.
Rarely is a “remedial scheme sufficiently comprehensive to supplant §
1983.” Id. at 347. Indeed, to support the conclusion that Section 1983 relief is
precluded, the scheme set forth by Congress must be so detailed, complex, or
comprehensive, such that it is nonsensical to hold that Congress intended Section
1983 relief to be available. See id. (discussing two cases in which the Supreme
Court held that remedial provisions precluded Section 1983 relief, one of which
included so many options for relief that it was “hard to believe” that Congress
intended to preserve Section 1983 relief, and the other provided such detailed
10
procedures for administrative review that it would have defeated the purpose of the
statute to enable plaintiffs to bypass the administrative process).
Rather than conflicting, we find the relief offered by the DPPA and Section
1983 to be complementary. The DPPA did not create “so many specific statutory
remedies” for individual enforcement that it is “hard to believe that Congress
intended to preserve the § 1983 right of action.” Blessing, 520 U.S. at 347. To
ensure compliance with the statute, the DPPA provides a remedy against the state
and a remedy against individuals who disregard the law. There is nothing in the
statute to suggest that Congress intended to exclude Section 1983 relief. Thus, we
find that the district court erred in concluding that there was no statutory right to
privacy enforceable under Section 1983.
3. Was The Law Clearly Established At The Time Of The Alleged Conduct?
Having found that the statutory rights created by the DPPA are enforceable
both directly and under Section 1983, we must now ask whether the law was
sufficiently established to have provided fair warning to Defendants that they were
violating the law. Hope v. Pelzer, 536 U.S. 730, 731 (2002); Brosseau v. Haugen,
543 U.S. 194, 198-199 (2004). This inquiry involves evaluating whether a
reasonably competent public official would have known that his actions were
prohibited by the law at the time he engaged in the conduct in question. Saucier,
11
533 U.S. at 202. The standard is one of objective reasonableness.
We find that the plain language of the statute and the case law gave clear
notice to Defendants that releasing the information in question violated federal law.
The words of the DPPA alone are “specific enough to establish clearly the law
applicable to particular conduct and circumstances and to overcome qualified
immunity.” Vinyard v. Wilson, 311 F.3d 1340, 1350 (11th Cir. 2002) (holding that
statutory language alone, even in the “total absence of case law” can be sufficient
to provide fair notice).
Moreover, the case law defining the reach of the DPPA gave fair notice to
Defendants. In evaluating the DPPA, in both its pre- and post-amendment form,
the United States Supreme Court stated that:
[Prior to October 9, 1999,] the DPPA provided that a DMV could
obtain that consent either on a case-by-case basis or could imply
consent if the State provided drivers with an opportunity to block
disclosure of their personal information when they received or
renewed their licenses and drivers did not avail themselves of that
opportunity. § 2721(b)(11), (13), and (d). However, Public Law
106-69, 113 Stat. 986, which was signed into law on October 9, 1999,
changed this “opt-out” alternative to an “opt-in” requirement. Under
the amended DPPA, States may not imply consent from a driver’s
failure to take advantage of a state-afforded opportunity to block
disclosure, but must rather obtain a driver’s affirmative consent to
disclose the driver’s personal information for use in surveys,
marketing, solicitations, and other restricted purposes.
Reno v. Condon, 528 U.S. 141, 144-145 (2000) (emphasis added) (citations
12
omitted). The case law defining the statute’s scope could be no clearer.3 We find
the statutory right to privacy in motor vehicle record information was clearly
established at the time of Defendants’ alleged conduct, giving them fair notice that
their alleged conduct violated federal law.
III. Conclusion
In light of the foregoing analysis, Defendants are not entitled to qualified
immunity on the portion of Count I that asserts a violation of the DPPA, nor on
Count II in its entirety, and remand for proceedings consistent with this opinion.
AFFIRMED IN PART; REVERSED AND REMANDED IN PART.
3
Defendants’ argument that there was conflicting state law is unavailing. The law was
clear at the relevant time that the DPPA preempted any conflicting state law that regulates the
dissemination of motor vehicle record information. Condon, 528 U.S. at 151 (holding that “[t]he
DPPA regulates the States as the owners of data bases” and “regulates the universe of entities
that participate as suppliers to the market for motor vehicle information.”). Accordingly,
Defendants were bound to follow the mandates of the DPPA, even though a conflicting state law
may have existed.
13