Marcy Johnson v. West Publishing Corporation

United States Court of Appeals
For the Eighth Circuit
___________________________
No. 12-1172
___________________________
Marcy A Johnson, individually and on behalf of others similarly situated
lllllllllllllllllllll Plaintiff - Appellee
v.
West Publishing Corporation
lllllllllllllllllllll Defendant - Appellant
___________________________
No. 12-1176
___________________________
Marcy A Johnson, individually and on behalf of others similarly situated
lllllllllllllllllllll Plaintiff - Appellee
v.
West Publishing Corporation
lllllllllllllllllllll Defendant - Appellant
____________
Appeals from United States District Court
for the Western District of Missouri - Jefferson City
____________
Submitted: November 13, 2012
Filed: April 9, 2013
[Unpublished]
____________
Before SMITH, BEAM, and GRUENDER, Circuit Judges.
____________
PER CURIAM.
Marcy Johnson brought this putative class action against West Publishing
Corporation ("West"), alleging that it "improper[ly] and unlawful[ly] . . . obtained,
acquired, disclosed, sold and/or disseminated [Johnson's] and putative Class members'
personal information or highly restricted personal information for commercial
purposes and profit, as prohibited by [the Driver's Privacy Protection Act (DPPA), 18
U.S.C. §§ 2721–2725]." West moved pursuant to Federal Rule of Civil Procedure
12(c) for judgment on the pleadings, which the district court denied. The district court
concluded that the DPPA does not permit a reseller of personal information, such as
West, to obtain driver's license information from a state or third party when the
reseller's only purpose is to resell the information to other third parties. Johnson v.
West Publ'g Corp., 801 F. Supp. 2d 862, 864 (W.D. Mo. 2011). The district court also
found that the DPPA does not permit a reseller to "disclose the entire database to a
business or individual having only a potential future use for some of the information
sold, so long as there is no evidence of specific misuse, such as identity theft or
stalking." Id. at 864–65. On appeal, West argues that the district court's interpretation
of the DPPA is contrary to this court's interpretation of the DPPA in Cook v. ACS
State & Local Solutions, Inc., 663 F.3d 989 (8th Cir. 2011). Because we find that
Cook is controlling, we reverse the judgment of the district court and remand for
further proceedings consistent with this opinion.
-2-
I. Background
Johnson filed suit "on behalf of herself and all others similarly situated" against
West, alleging that West "obtained, acquired, disclosed, sold, and/or disseminated
[Johnson's] and putative Class members' personal information or highly restricted
personal information for commercial purposes and profit, as prohibited by law."
According to the complaint, West "specializ[es] in legal publishing, online
information delivery, and various other legal information products." The complaint
alleges that West "has obtained and continues to obtain a large database(s) of motor
vehicle records, and the corresponding personal information or highly restricted
personal information for each such record . . . directly from" 29 states and the District
of Columbia, "or from entities who acquired it from the States, in violation of the
DPPA."
The complaint maintains that West collected the information from the states
"under the pretense that the information would be used only for the legitimate
purposes outlined in 18 U.S.C. § 2725(3)." According to the complaint, the
information databases that West obtained from the states "contained 'personal
information' and/or 'highly restricted personal information' (as defined by the DPPA,
18 U.S.C. §§ 2721, et seq.), belonging to millions of licensed drivers." The complaint
alleges that West "then made the unlawfully obtained information belonging to
[Johnson] and the putative Class members available for search and sale on the Internet
via websites controlled and operated by [West]." West's acquisition and dissemination
of "personal information or highly restricted personal information" was allegedly "for
purposes not permitted under the DPPA." Johnson and the putative class assert that
they "suffered damages as a result of [West's] conduct."
The complaint contains three counts. Count I asserts that West "knowingly
obtained, disclosed, and/or sold [Johnson's] and the putative Class members' personal
information or highly restricted personal information, as defined by the DPPA, for a
use or uses not permitted under the statute." It provides that West "made false
-3-
representations to the States to obtain [Johnson's] and the putative Class members'
personal information or highly restricted personal information, and at other times
obtained [Johnson's] and the putative Class members' personal information or highly
restricted personal information from third parties." Count I prays for "actual damages,
but not less than liquidated damages in the amount of $2,500 each." Count II asserts
a claim for unjust enrichment and "seek[s] disgorgement and restitution of the benefits
obtained by [West] through its unlawful conduct." Finally, Count III asserts an
injunctive-relief claim based on DPPA violations.
West moved to dismiss Count II of Johnson's complaint pursuant to Federal
Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be
granted. The district court granted the motion, which "had been based primarily on
[the district] [c]ourt's reasoning in another DPPA case, Wiles v. Southwestern Bell Tel.
Co., No. 09–4236–CV–C–NKL, 2010 WL 1463025 (W.D. Mo. Apr. 13, 2010)."
Johnson, 801 F. Supp. 2d at 867. West then moved for judgment on the pleadings
pursuant to Federal Rule of Civil Procedure 12(c).
In denying West's motion, the district court rejected the majority view that the
DPPA "permit[s] wholesale resellers to obtain in bulk every driver's personal
information so long as there is no evidence of specific misuse." Id. at 866 (citing
Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010)). Specifically, the court rejected
the conclusion that "a reseller is not limited to obtaining personal information only for
a specific customer qualified to use it by the DPPA" and that "the reseller itself [does
not need] a right to the information under one of the fourteen exceptions to the
DPPA's rule of nondisclosure." Id. Additionally, the court disagreed with the notion
that "the information can be sold in bulk to purchasers, even though the purchaser is
only authorized under the DPPA to receive one piece of information." Id. The court
found "that Congress did not intend the DPPA to authorize this widespread
dissemination of private information untethered from the very uses that Congress
listed in the DPPA." Id. at 867.
-4-
 Following its denial of West's motion for judgment on the pleadings, the court
certified the class. Johnson v. West Publ'g Corp., No. 2:10–CV–04027–NKL, 2011
WL 3490187 (W.D. Mo. Aug. 9, 2011).1
After the district court entered its order denying West's motion for judgment
on the pleadings, it certified under 28 U.S.C. § 1292(b) that "the case involves [']a
controlling question of law as to which there is substantial ground for difference of
opinion and . . . an immediate appeal from the order may materially advance the
ultimate termination of the litigation.'" (Second alteration in original.) (Quoting 28
U.S.C. § 1292(b).) West subsequently petitioned this court for permission to appeal.
West also petitioned this court for permission to appeal the class certification
order under Federal Rule of Civil Procedure 23(f).
1
The district court certified the following class:
All persons who registered a motor vehicle in, or were issued a driver's
license or state identification card by, the States of Alabama, Alaska,
Colorado, Connecticut, Florida, Idaho, Illinois, Iowa, Kentucky,
Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota,
Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, New
York, North Dakota, Ohio, Tennessee, Texas, Utah, Wisconsin,
Wyoming and the District of Columbia, whose personal information or
highly restricted personal information, as defined by 18 U.S.C.
§§ 2725(3) and (4), was obtained, disclosed, or sold by Defendant, or
any agent, officer, employee, or contractor of Defendant between
February 19, 2006 and the date of final judgment in this matter (the
"Class"). The Class excludes Defendant's directors, officers, parent
corporations, subsidiaries, and affiliates.
Id. at *3.
-5-
 We granted both the § 1292(b) and Rule 23(f) applications and consolidated the
appeals.
II. Discussion
On appeal, West asserts that the district court erroneously held that Johnson
stated cognizable DPPA claims and that class adjudication was appropriate.
Specifically, West contends that the district court erred in concluding that the DPPA
fails to authorize the bulk acquisition of motor vehicle record information for resale
for DPPA-permitted uses. In support of its argument, West relies on Cook. According
to West, "Cook addresses the same statutory construction question at issue
here—whether the DPPA permits the obtainment in bulk of state motor vehicle record
information for resale for DPPA-permitted uses." West states that this court "joined
several of its sister federal circuits and concluded that it does." West requests that this
court reverse the district court's order denying its motion for judgment on the
pleadings and direct the district court to enter judgment in its favor and dismiss as
moot Johnson's motion for class certification.
Johnson makes two arguments in support of affirmance. First, she "respectfully
suggest[s] that the issues and facts presented in this appeal were not sufficiently
fleshed out or addressed by the parties in the Cook matter, and that this appeal
provides a more complete picture and background of the DPPA." According to
Johnson, Cook's "reading of the DPPA does not comport with the statute's full
legislative history and the intentions of Congress." She argues that Cook failed to
define the phrase "authorized recipient" and "goes beyond the text of the statute and
creates a 'data repository' Permissible Purpose for West that is unsupported by either
the plain text of the DPPA or its legislative history." She maintains that the DPPA's
purpose "in providing control over the disclosure of individuals' Personal Information
appears weakened under Cook's interpretation of the DPPA" because Cook "imposes
no limitation on the release of Personal Information to anyone who merely promises
to resell such information to those with an alleged Permissible Purpose under
-6-
§ 2721(b)." Johnson urges this court to adopt the district court's definition of
"authorized recipient" and conclude that West is not one under that definition.
Second, Johnson attempts to distinguish Cook, asserting that in that case this
court "held that bulk obtainment of Personal Information directly from the State is
permitted regardless of whether the person obtaining the information has a Permissible
Purpose for the information." (Emphasis added.) Johnson contends that "West does
not obtain Plaintiff's Personal Information from Motor Vehicle Records directly from
States: West obtains said information indirectly through a third party, and does so
without a Permissible Purpose." Johnson maintains that "[t]his crucial factual variance
from Cook illustrates that West's conduct exponentially erodes the privacy protections
and goals provided for and set forth by the DPPA—protections and goals for which
Congress expressly intended in the passage of the DPPA."
This court applies "de novo [review to] a district court's [resolution] of a motion
for judgment on the pleadings, using the same standard as when we review the
[district court's resolution] of a motion to dismiss under . . . Rule . . . 12(b)(6)."
Gallagher v. City of Clayton, 699 F.3d 1013, 1016 (8th Cir. 2012). "To survive a
motion to dismiss, a complaint must contain sufficient factual matter, accepted as true,
to state a claim to relief that is plausible on its face." Id. (quotations and citations
omitted).
The district court denied West's motion for judgment on the pleadings before
we decided Cook. In that case, the plaintiffs brought a "class action suit against a
variety of defendants, alleging that each improperly obtained personal driver
information from the Missouri Department of Revenue ('DOR') in violation of the
[DPPA]." 663 F.3d at 991. The plaintiffs' claims were based
on two separate theories: (1) The bulk obtainment of personal
information, which allows a company to "stockpile" information for the
-7-
sake of convenience when a permissible purpose to use that information
arises, is a per se violation of the DPPA; and (2) obtaining an entire
database of personal information for the sole purpose of reselling that
information to others is also a violation of the DPPA.
Id. The district court granted the defendants' Rule 12(b)(6) motions to dismiss for
failure to state a claim upon which relief can be granted, finding "that neither theory
stated a valid claim under the DPPA." Id.
On appeal, we affirmed the district court's dismissal of the plaintiffs' DPPA
claims. First, we addressed the plaintiffs' "stockpiling" argument, i.e., that the
defendants "obtained records in bulk merely for the convenience of maintaining their
own motor vehicle record databases in anticipation of future use, and therefore have
violated the DPPA as to each record Defendants did not put to an immediate
permissible use." Id. at 994. We noted that the plaintiffs "d[id] not contend that
Defendants actually misused drivers' personal information, nor d[id] they dispute that
Defendants might have put some information to an end use permitted under section
2721(b)." Id. We held that "[b]ulk obtainment of driver information for a permissible
purpose does not violate the DPPA." Id. at 996. As a result, the plaintiffs were unable
to "establish a violation of the DPPA if all the defendants have done is obtain driver
information in bulk for potential use under a permissible purpose." Id.
Second, we addressed the plaintiffs's "resale" argument. Id. "Some of the
Defendants in [Cook] obtained personal information in bulk from the Missouri DOR
not for their own permissible use, but to sell to third parties who have permissible uses
of their own." Id. The plaintiffs argued that although § 2721(c) permits "the resale and
redistribution of personal information, . . . this section does not provide a stand-alone
justification for businesses to obtain records from the state." Id. According to the
plaintiffs, "the DPPA requires resellers to have their own permissible use for personal
information before selling it to third parties." Id. They "interpret[ed] the phrase
'authorized recipient' under section 2721(c) as an individual or entity who has an
-8-
immediate permissible use for the information under section 2721(b)." Id. After citing
as persuasive authority cases from the Fifth and Seventh Circuits—Graczyk v. West
Publishing Co., 660 F.3d 275, 280–81 (7th Cir. 2011), and Taylor, 612 F.3d at
339—we concluded that "[s]ection 2721(c) explicitly permits the resale of drivers'
information, and it does not require that resellers must first use the information
themselves." Id. at 997. Therefore, the plaintiffs were unable to "establish a DPPA
violation by alleging that Defendants obtained personal information with the sole
purpose of selling it to third parties who have permissible section 2721(b) uses for the
information." Id.
Cook's holdings—that "[p]laintiffs cannot establish a violation of the DPPA if
all the defendants have done is obtain driver information in bulk for potential use
under a permissible purpose," id. at 996, and "[p]laintiffs cannot establish a DPPA
violation by alleging that Defendants obtained personal information with the sole
purpose of selling it to third parties who have permissible section 2721(b) uses for the
information," id. at 997—are applicable to the present case. As in Cook, Johnson has
not alleged that West "actually misused drivers' personal information," see id. at 994;
instead, she has only alleged that West had an invalid purpose because it "obtained,
acquired, disclosed, sold and/or disseminated . . . personal information for commercial
purposes and profit." Johnson essentially asks us to reject Cook because it was ill-
reasoned. But "[i]t is well established, however, that one panel of this Court may not
overrule another and so we must decline [Johnson's] invitation to reconsider our prior
decision." See United States v. Franklin, 250 F.3d 653, 665 (8th Cir. 2001).
Nor do we agree with Johnson that Cook is distinguishable from the present
case because Cook involved the bulk obtainment of personal information directly from
the state, as opposed to the state and other entities. First, Cook's holdings were not
premised on where the reseller first obtained the information. Second,
Graczyk—which we relied on in Cook—involved a complaint that is virtually
-9-
identical to the present complaint.2 The Graczyk complaint alleged, among other
things, "that West Publishing acquires the personal information contained in motor
vehicle records of millions of drivers from state DMVs (or from entities that have
acquired the information from state DMVs) for resale in violation of the DPPA." 660
F.3d at 276 (emphasis added). The district court granted West's motion to dismiss
pursuant to Rule 12(b)(6), and the Seventh Circuit affirmed. Id. The Seventh Circuit
held that "the DPPA does not prohibit West Publishing from reselling the plaintiffs'
personal information to those with permissible uses under the Act." Id. Because the
complaint alleged that West acquired its database of motor vehicle records both
directly from the states and from other entities "that have acquired the information
from state DMVs," id., the Seventh Circuit's holding was not restricted to the reseller
obtaining the information only directly from the states.
III. Conclusion
Accordingly, we reverse the district court's denial of West's motion for
judgment on the pleadings and remand for further proceedings consistent with this
opinion. Because West is entitled to judgment on the pleadings, we necessarily reverse
the district court's order granting Johnson's motion to certify the class. On remand, we
direct the court to dismiss as moot Johnson's motion for class certification.
______________________________
2
The Graczyk plaintiffs filed their complaint in the United States District Court
for the Northern District of Illinois. The district court case number is 1:09-cv-04760.
-10-