Graczyk v. West Publishing Co.

660 F.3d 275 (2011)

Lisa M. GRACZYK, et al., Plaintiffs-Appellants,
v.
WEST PUBLISHING COMPANY, Defendant-Appellee.

No. 10-1193.

United States Court of Appeals, Seventh Circuit.

Argued February 11, 2011. Decided September 28, 2011.

Ben Barnow, Blake Anthony Strautins (argued), Attorneys, Barnow & Associates, P.C., Chicago, IL, for Plaintiffs-Appellants.

Diane Green-Kelly (argued), Attorney, Reed Smith LLP, Chicago, IL, for Defendant-Appellee.

Before POSNER, FLAUM, and WILLIAMS, Circuit Judges.

WILLIAMS, Circuit Judge.

The plaintiffs in this case contend that West Publishing obtains their personal information from state Department of Motor Vehicle ("DMV") records and resells the information in violation of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. § 2722. The district court granted West Publishing's motion to dismiss this lawsuit, finding that the plaintiffs lacked standing. We disagree and conclude that the DPPA creates a federal private right of action for persons who, like the plaintiffs, claim that their personal information has been disclosed in violation of the Act. But, we affirm the district court's dismissal of the plaintiffs' complaint under Federal Rule of Civil Procedure 12(b)(6) because we agree that the DPPA does not prohibit West Publishing from reselling the plaintiffs' personal information to those with permissible uses under the Act.

I. BACKGROUND

The plaintiffs, citizens of Illinois, brought a class action on behalf of licensed drivers in several states against West Publishing, asserting claims under the DPPA and for unjust enrichment, and seeking injunctive relief. The plaintiffs contend that West Publishing acquires the personal information contained in motor vehicle records of millions of drivers from state DMVs (or from entities that have acquired the information from state DMVs) for resale in violation of the DPPA.

Before the district court, West Publishing filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1), arguing that the plaintiffs did not have standing, and under Federal Rule of Civil Procedure 12(b)(6), contending that the plaintiffs had failed to state a claim under the DPPA. The district court granted the motion, finding that the plaintiffs did not have standing, that their complaint did not state a claim under the DPPA, and that the plaintiffs' unjust enrichment and injunctive relief claims were derivative of their DPPA claim and also failed. The plaintiffs appeal.

II. ANALYSIS

State DMVs require drivers to supply sensitive personal information such as names, addresses, and social security numbers when applying for a driver's license. In 1993, Congress enacted the Driver's Privacy Protection Act to limit how state DMVs can share that personal information with others. Congress passed the DPPA as an amendment to the Violent Crime Control and Law Enforcement Act of 1993 in response to nationwide reports that criminals were obtaining the personal information of their victims from state DMV records with relative ease. See Reno v. Condon, 528 U.S. 141, 143-44, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). Congress was also concerned that many states were selling drivers' personal information to individuals, marketers, and businesses without drivers' knowledge or consent. See id.

The DPPA prohibits state DMVs from "knowingly disclosing or otherwise making available to any person or entity personal information ... about any individual obtained by the department in connection with a motor vehicle record." 18 U.S.C. § 2721(a). It also prohibits private individuals from "knowingly ... obtain[ing] or disclos[ing] personal information, from a motor vehicle record, for any use not permitted under section 2721(b)." 18 U.S.C. § 2722(a). The DPPA gives aggrieved persons a private right of action:

A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.

18 U.S.C. § 2724(a).

The DPPA, however, does not prohibit all unconsented disclosures of personal information. It permits (and in some circumstances requires, see § 2721(b) (requiring disclosure in connection with vehicle safety and theft)) disclosure for certain uses. Section 2721(b) of the DPPA lists fourteen permissible uses for which personal information may be disclosed.^[1]

In section 2721(c), the DPPA regulates the resale of personal information. That section provides in pertinent part that, "An authorized recipient of personal information... may resell or redisclose the information only for a use permitted under subsection [2721(b)]." § 2721(c).

A. Standing

The district court found that the plaintiffs did not have standing to assert a claim under the DPPA because their allegations fell short of standing requirements. We review a district court's dismissal for lack of subject matter jurisdiction de novo. Doctors Nursing & Rehab. Ctr. v. Sebelius, 613 F.3d 672, 676 (7th Cir.2010).

We disagree with the district court's resolution of the standing question. The DPPA protects individuals from certain uses or disclosures of their personal information and creates a federal right of action for the same. See 18 U.S.C. § 2724(a); see also Taylor v. Tex. Farm Bureau Mut. Ins. Co., 612 F.3d 325, 340 n. 15 (5th Cir.2010). Congress has defined the relevant injury under the DPPA as the "obtain[ment], disclos[ure], or [use]," 18 U.S.C. § 2724(a), of an individual's personal information. See Massachusetts v. EPA, 549 U.S. 497, 516, 127 S.Ct. 1438, 167 L.Ed.2d 248 (2007) ("Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before."). The plaintiffs allege that West Publishing engages in bulk compilation and distribution of their personal information, which West Publishing obtains from DMV records, and that this constitutes a disclosure or use of the plaintiffs' personal information that is prohibited by the DPPA. A ruling in the plaintiff's favor would mean that West Publishing could no longer obtain the plaintiffs personal information and resell it. The plaintiffs have therefore alleged an injury in fact, caused by West Publishing, that would be redressed by a decision in their favor, and so they have standing to bring this case. See id.; see also Taylor, 612 F.3d at 340-41 (addressing same legal question presented in this case and concluding that the plaintiffs had standing).

B. Motion to Dismiss

The district court also dismissed the plaintiffs' complaint for failure to state a claim. We review a district court's dismissal of a plaintiff's complaint for failure to state a claim de novo. Greenberger v. GEICO Gen. Ins. Co., 631 F.3d 392, 399 (7th Cir.2011). In doing so, we construe the complaint in the light most favorable to the plaintiff, accept well-pleaded facts as true, and draw all inferences in the plaintiff's favor. Fednav Int'l Ltd. v. Cont'l Ins. Co., 624 F.3d 834, 837 (7th Cir.2010).

The plaintiffs contend that West Publishing obtains personal information contained in DMV records from state DMVs (and other sources), stores the information in a database, and eventually sells the information to others. According to the plaintiffs, this practice is unlawful because a person may only obtain DMV records if she or he has a permissible use for the information as provided in one of the fourteen exceptions listed in section 2721(b). The plaintiffs contend that "resale" to the public is not in the list, and that as a result West Publishing does not have a permissible "purpose" for obtaining the records. See 18 U.S.C. § 2722(a) (prohibiting obtaining or using information for a purpose "not permitted under this chapter").

The plaintiffs acknowledge that section 2721(c) of the DPPA permits authorized recipients to resell information for uses listed under section 2721(b). However, the plaintiffs argue that West Publishing is not an authorized recipient because the plaintiffs construe the term "authorized recipient" to mean a person or entity who in the first instance obtains the records for one of the purposes listed in section 2721(b). West Publishing contends that it is an authorized recipient because its "obtainment of information for those who intend to use [the information] in one of the ways permitted by section 2721(b) is obtainment [for a purpose permitted by the DPPA]." Unfortunately, the dispute cannot be resolved exclusively by reference to the text of the DPPA because the DPPA does not define the term "authorized recipient."

What is apparent from considering the DPPA as a whole is that it is concerned with the ultimate use or uses to which personal information contained in motor vehicle records is put. See 18 U.S.C. § 2721(b) (listing permissible "uses" of records); Howard v. Criminal Inf. Servs. Inc., 654 F.3d 887, 891-92 (9th Cir.2011). The plaintiffs here do not allege that the ultimate users of the records compiled and sold by West Publishing do not have a permissible use for those records as required by section 2721(b). The plaintiffs contend, however, that the DPPA does not allow West Publishing to obtain and store DMV records in bulk in order to later sell them to someone with a permissible use. According to the plaintiffs, the person requesting the records must have an immediate permissible use for them.

However, the plaintiffs concede that "if West Publishing, as an agent, first receives a valid request for Personal Information, it then may be allowed to request that individual's information from the state on behalf of its principal." Indeed, the plaintiffs would be hard pressed to argue that the task of obtaining records cannot be delegated to someone else. See 18 U.S.C. § 2721(b) (permitting a business or its agents to obtain motor vehicle records to verify personal information); 18 U.S.C. § 2721(c) (permitting resale of records to those with permissible uses).

The plaintiffs' concession undermines their contention that West Publishing cannot resell the records it compiles because it lacks a valid purpose under the DPPA. There is no meaningful difference in terms of West Publishing's purpose between the practice the plaintiffs approve—obtaining the records each time West Publishing receives a valid request—and the practice they object to—compiling the records first and then disclosing them in response to a valid request. In both cases, West Publishing's "purpose" for obtaining the records is to make a profit since West only obtains the records in order to sell them to others with permissible uses. So, even under the plaintiffs' view of the DPPA, it cannot be the profit motive that renders West Publishing's conduct unlawful.

And if West Publishing is only selling the records to those who fall under one of the exceptions listed in section 2721(b) (the plaintiffs do not contend otherwise), why would Congress care whether each record is obtained individually by someone who intends to put the record to immediate use, or in bulk by someone who intends to sell and transmit the records to others with valid uses? The plaintiffs' response at oral argument was that Congress intended the states to be the "gatekeepers" of personal information. The plaintiffs thus implied that the states are the only ones that can store personal information from motor vehicle records. But the DPPA does not prohibit storing records for which an individual has a valid use under section 2721(b). See Howard, 654 F.3d at 891-92. The DPPA does prohibit DMVs from releasing personal information for uses not listed in § 2721(b). The same prohibition also applies to private individuals. § 2724. But, since the plaintiffs do not allege that West Publishing is releasing personal information to persons who do not have a permissible use, there is no suggestion in the plaintiffs' complaint that the states are failing as "gatekeepers." See Taylor, 612 F.3d at 338 (addressing the same question at issue here and noting that "the plaintiffs could not articulate, and we could not find, any reason why Congress would require resellers to actually use the records before selling the records").

Perhaps what the plaintiffs were suggesting by arguing that Congress intended the states to be "gatekeepers" was simply that Congress wanted to limit the number of people with access to the personal information because the greater the number of people with access, the greater the risk that personal information will be disseminated to those who do not have valid uses for the personal information. However, the plaintiffs' cramped interpretation of the DPPA would undermine the statute's countervailing purpose, which is to allow legitimate users to access the records. As the plaintiffs conceive of the DPPA, each time a person needs information stored in DMV records (for one of the uses listed in section 2721(b)) that person would have to send a request to the DMV for the information. In many cases, this process would be so cumbersome that it would be virtually impossible for ultimate users to take advantage of the exceptions listed in section 2721(b). Many businesses, for example, have "to verify the accuracy of personal information submitted by [an] individual to the business or its agents" on a fairly regular basis. See Taylor, 612 F.3d at 338 (noting that credit card companies may approve more than nineteen million credit card applications a year for which they need to verify personal information). If these business had to send a request to the DMV every single time they needed to verify an individual's information, the process would become unwieldy for both the companies and the state. We do not interpret statutes to lead to absurdities or to defeat Congressional intent. City of Chicago v. U.S. Dep't of the Treasury, 423 F.3d 777, 781 (7th Cir.2005).

At least one of our sister circuits has addressed precisely the question at issue here and has concluded that the DPPA does not prohibit a reseller, such as West Publishing, from reselling personal information to others with permissible uses. Taylor, 612 F.3d at 338-339. The Department of Justice, in an unpublished letter, has also concluded that states may release personal information to commercial distributors that disseminate the information only to entities that use the information solely for authorized purposes. Unpublished Letter of October 9, 1995 from Robert C. McFetridge, Special Counsel to the Assistant Attorney Gen., to Peter Sacks, Office of the Attorney Gen. for the Commonwealth of Mass. (on file with this court). Another circuit has held that the DPPA permits DMVs to release records to those who vouch for their lawful uses under section 2721(b). Roth v. Guzman, 650 F.3d 603, 614-17 (6th Cir.2011). And the Ninth Circuit has held that it is lawful for private individuals to store records obtained pursuant to one of the exceptions in section 2721(b). See Howard, 654 F.3d at 891-92. In line with these cases, we hold the DPPA does not prohibit West Publishing from reselling records it obtains from state DMVs to persons with permissible uses under section 2721(b).

It was therefore proper for the district court to dismiss the plaintiffs' claim under the DPPA. Further, since the plaintiffs' claims for unjust enrichment and for injunctive relief are premised on West Publishing's alleged violation of the DPPA, we also conclude that the district court properly dismissed these claims.

III. CONCLUSION

The judgment of the district court is AFFIRMED.

NOTES

[1] (1) For use by any government agency ... in carrying out its functions....

(2) For use in connection with matters of motor vehicle or driver safety and theft....

(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only—

(A) to verify the accuracy of personal information submitted by the individual to the business or its agents ...; and

(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud....

(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding....

(5) For use in research activities, and for use in producing statistical reports....

(6) For use by any insurer ... in connection with claims investigation activities....

(7) For use in providing notice to the owners of towed or impounded vehicles.

(8) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.

(9) For use by an employer or its agent or insurer to obtain or verify information....

(10) For use in connection with the operation of private toll transportation facilities.

(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.

(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.

(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.

(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.

§ 2721(b).