Roberts v. Source for Public Data

(2008)

Emily ROBERTS, et al., Plaintiffs,
v.
The SOURCE FOR PUBLIC DATA, et al., Defendants.

Case No. 08-4167-CV-C-NKL.

United States District Court, W.D. Missouri, Central Division.

December 1, 2008.

ORDER

NANETTE K. LAUGHREY, District Judge.

Plaintiffs Emily Roberts and Sarah E. Smith ("Plaintiffs") brought this putative class action against Defendants The Source for Public Data, L.P. ("Public Data"), Shadowsoft, Inc. ("Shadowsoft"), Omar Davis, Director of the Missouri Department of Revenue ("Davis") and other unnamed individual defendants who acted as agents of the Missouri Department of Revenue (the "Doe defendants"). Plaintiffs claim violations of the Drivers Privacy Protection Act ("DPPA") 18 U.S.C. §§ 2721, et seq., 42 U.S.C. § 1983, and the Missouri Merchandising Practices Act. Plaintiffs' claims against Defendant Davis under the DPPA (Count I) and § 1983 (Count III) stem from his alleged violations of Plaintiffs' statutory privacy rights created by the DPPA. Pending before the Court is Davis' Motion to Dismiss [Doc. # 21]. For the reasons stated herein, Davis' motion is granted in part and denied in part.

I. Background^[1]

Plaintiffs allege that Defendant Shadowsoft acquired a large database from the Missouri Department of Revenue by falsely representing that this information was to be used to verify the accuracy of information of individuals doing business with Shadowsoft. This database contained information about Plaintiffs and putative class members, including their social security numbers. Shadowsoft then transferred this database to Defendant Public Data, who made the information contained in the database, including social security numbers, available for sale at its website, www.publicdata.com. Plaintiffs allege that Davis is the Director of the Department of Revenue. They allege that he and the Doe defendants (collectively, "individual defendants") "knowingly authorized, directed, ratified, approved, acquiesced in, committed or participated in the disseminating of" the information in the database to Shadowsoft and Public Data (collectively, "entity defendants") without Plaintiffs' or the putative class members' express consent. (Pls.' Compl. ¶ 26).

Plaintiffs claim that Davis' actions listed above were in violation of their and the putative class members' statutory privacy rights created in the DPPA. The DPPA prohibits the knowing disclosure of "highly restricted personal information," defined to include social security numbers, without the express consent of the person to whom the information pertains, unless one of four statutory exceptions applies. 18 U.S.C. § 2721(a)(2). Plaintiffs argue that none of these exceptions was applicable to Davis' alleged disclosures and that Davis knew or should have known what the DPPA required of him.

II. Discussion

In ruling on a motion to dismiss, the Court views the allegations in the Complaint in the light most favorable to Plaintiffs. Scheuer v. Rhodes, 416 U.S. 232, 236, 94 S.Ct. 1683, 40 L.Ed.2d 90 (1974). Additionally, the Court must accept "the allegations contained in the complaint as true and draw all reasonable inferences in favor of the nonmoving party." Coons v. Mineta, 410 F.3d 1036, 1039 (8th Cir.2005). A motion to dismiss must be granted if the Complaint does not contain "enough facts to state a claim to relief that is plausible on its face." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1974, 167 L.Ed.2d 929 (2007).

In his motion, Davis argues that the allegations against him in Count III (§ 1983) fail to state a claim upon which relief can be granted because the DPPA is not enforceable through a § 1983 action. Further, he argues that the allegations in Count I (DPPA) fail to state a claim against him because: (1) he was sued in his official capacity; (2) the Complaint fails to allege the mental state required by the DPPA; and (3) he is entitled to qualified immunity.

A. Count III—Is the DPPA Enforceable Through § 1983?

Davis argues that Count III of the Complaint must fail because the comprehensive enforcement scheme provided by the DPPA precludes enforcement under § 1983. Plaintiffs respond that the Eleventh Circuit rejected the same argument in Collier v. Dickinson in finding that Florida plaintiffs could bring a § 1983 action based upon violations of privacy rights created in the DPPA. 477 F.3d 1306 (11th Cir.2007).

Courts employ a two-step process to determine whether plaintiffs have a right to bring a § 1983 action for violation of a federal statute. In the first step, the Court must ask whether:

(1) Congress intended the statutory provision to benefit the plaintiff; (2) the asserted right is no so "vague and amorphous" that its enforcement would strain judicial competence; and (3) the provision clearly imposes a mandatory obligation upon the states.

Lankford v. Sherman, 451 F.3d 496, 508 (8th Cir.2006) (citing Blessing v. Freestone, 520 U.S. 329, 341, 117 S.Ct. 1353, 137 L.Ed.2d 569 (1997)).

If the Court concludes that the statutory right in question passes these three tests, there is a presumption that the right is enforceable through § 1983. Id. However, this presumption is rebuttable at the second step of the process: the presumption is rebutted where Congress has either explicitly or implicitly foreclosed resort to § 1983. Id. Where Congress has created "a comprehensive remedial scheme ... [c]ourts should presume that Congress intended that the enforcement mechanism provided in the statute[s] be exclusive." Alsbrook v. City of Maumelle, 184 F.3d 999, 1011 (8th Cir.1999) (citations omitted).

Davis argues that the second step—which requires the Court to consider whether Congress intended its enforcement mechanism to be exclusive—is dispositive. He states, "[r]egardless of the outcome of the [first step], dual claims under the DPPA and § 1983 cannot be permitted because of the presumption of exclusivity." (Def.'s Reply Sugg. 6).

Case law considering statutes other than the DPPA is instructive. In Blessing v. Freestone, the Supreme Court held that Title IV-D's remedial scheme was not "sufficiently comprehensive to demonstrate congressional intent to preclude § 1983 suits," finding that the statutory scheme was "far more limited than those at issue in Middlesex County Sewerage Authority v. National Sea Clammers Assn., 453 U.S. 1, 101 S.Ct. 2615, 69 L.Ed.2d 435 [ (1981) ] and Smith v. Robinson, 468 U.S. 992, 104 S.Ct. 3457, 82 L.Ed.2d 746 [ (1984) ], the only cases in which the Court ha[d] found preclusion[.]." 520 U.S. 329, 331, 117 S.Ct. 1353, 137 L.Ed.2d 569 (1997). The Court was particularly concerned with the fact that Title IV-D "contain[ed] no private remedy-either judicial or administrative-through which aggrieved persons [could] seek redress." Id. The Court noted that Title IV-D did not contain the "panoply of enforcement options, including noncompliance orders, civil suits, and criminal penalties" contained in the Water Pollution Control Act, which it had decided was not enforceable through § 1983 in Sea Clammers. Id. at 347, 117 S.Ct. 1353 (citing Sea Clammers, 453 U.S. at 13, 101 S.Ct. 2615).

Blessing indicates that the DPPA is not enforceable via § 1983. Like the Water Pollution Control Act, and unlike Title IV-D, the DPPA provides for multiple avenues of enforcement. It provides for civil penalties and criminal penalties imposed by the United States Attorney General as well as civil actions by private individuals. 18 U.S.C. §§ 2723-2724. Private citizens may sue under § 2724 to recover actual and punitive damages, attorneys fees, and costs, as well as appropriate preliminary and equitable relief. 18 U.S.C. § 2724. Given this comprehensive remedial scheme, the Court must presume that Congress intended that the enforcement scheme it created in the DPPA would be the exclusive remedy for violations, precluding resort to § 1983 by Plaintiffs. Therefore, Count III fails to state a claim upon which relief could be granted.

B. Count I

1. Was Davis Sued in his Personal or in his Official Capacity?

Davis argues that he was sued in his official, rather than his personal capacity. While "[p]ersonal capacity suits seek to impose personal liability upon a government official for actions ... take[n] under color of state law ... [o]fficial-capacity suits ... ``generally represent only another way of pleading an action against an entity of which an officer is an agent.'" Kentucky v. Graham, 473 U.S. 159, 165, 105 S.Ct. 3099, 87 L.Ed.2d 114 (1985) (quoting Monell v. New York City Dept. of Social Services, 436 U.S. 658, 690, 98 S.Ct. 2018, 56 L.Ed.2d 611 (1978)). The parties agree that the DPPA does not allow for a private cause of action against states or state officials in their official capacities. (Pls.' Sugg. Opp. 4; Def.'s Sugg. Supp. 2); see 18 U.S.C. §§ 2724, 2725(2). If Plaintiffs sue Davis in his official capacity, their claim must be dismissed.

Plaintiffs argue that the Complaint "clearly and sufficiently alleges claims against [Davis] in [his] individual capacit[y]". (Pls.' Sugg. Opp. 3). They note that Davis and the Doe defendants were repeatedly referred to in the Complaint as the "individual Defendants." Defendant argues that Director Davis and the Doe defendants were referred to as the "individual" defendants primarily to differentiate them from the other "entity" defendants, and not because they were meant to be sued in their personal capacities. Throughout, the Complaint describes Davis and the Doe defendants as agents of the Department of Revenue who acted "under color of state law"—a notion relevant in personal-capacity suits. While the Complaint is not altogether clear on this point, drawing all inferences in favor of Plaintiffs, the allegations in Count I look more like an action against an official in his personal capacity than an attempt to reach the Department of Revenue through its agent in the context of an official-capacity suit. The Court will not dismiss Count I on the basis of capacity.

2. Mental State Required by § 2724(a)

Next, Defendant Davis argues Count I should be dismissed because the Complaint fails to allege the mental state required in § 2724(a) of the DPPA. Section 2724(a) of the DPPA states, in relevant part: "[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains[.]" 18 U.S.C. § 2724(a) (emphasis added). Davis emphasizes that the Complaint alleges that he "knew, or reasonably should have known," or that he was "aware, or should have been aware" that his actions violated the DPPA. He argues that the Complaint alleges a lesser mental state than that required by § 2724(a).

Rather than relate to the DPPA violations, the portions of the Complaint highlighted by Davis, paragraphs 29 and 44, appear to be allegations related to the absence of qualified immunity for the individual defendants. In full, the paragraphs state: "At all times material, the individual defendant and agents of [the Department of Revenue] knew, or reasonably should have known, that their actions violated clearly established statutory rights of the Plaintiffs and the Class members" (Pls.' Compl. ¶ 26); "The individual defendants were aware or should have been aware that such a disclosure of Plaintiffs' and the Class members' highly restricted personal information, without the express consent of the person to whom the information pertained... was an invasion of privacy in violation of the DPPA" (Pls.' Compl. ¶ 44). "Clearly-established" rights are at issue in determining qualified immunity. See discussion of Qualified Immunity, infra. These allegations appear to concern the individual defendants' knowledge and awareness of Plaintiffs' clearly-established DPPA rights rather than Defendants' mental state in disclosing the information.

Where the Complaint does address the DPPA violations themselves, it states only the "knowingly" mental state. Paragraph 26 of Plaintiffs' Complaint states: "[t]he individual defendants [including Davis] ... knowingly authorized, directed, ratified, approved, acquiesced in, committed or participated in disseminating the highly restricted personal information[.]" (Pls.' Compl. ¶ 26) (emphasis added). Paragraph 43 similarly reads: "[t]he individual defendants ... knowingly authorized, directed, ratified, approved, acquiesced in, committed or participated in disclosing Plaintiffs' and the Class members' highly restricted personal information[.]" (Pls.' Compl. ¶ 43) (emphasis added). The Complaint, therefore, does not allege any mental state other than "knowingly" with regard to Davis' disclosing the information. The Complaint pleads the appropriate mental state with regard to the DPPA violation. The Court will not dismiss Count I on this basis.

3. Qualified Immunity

Finally, Davis argues that Plaintiffs' DPPA claim against him is barred by qualified immunity. Qualified immunity is an affirmative defense; on a motion to dismiss the defendant must demonstrate its applicability on the face of the complaint. Bradford v. Huckabee, 330 F.3d 1038, 1041 (8th Cir.2003). "Public officials are entitled to qualified immunity in suits against them in their individual capacity as long as their actions do not violate ``clearly established statutory or constitutional rights of which a reasonable person would have known.'" Id. (quoting Harlow v. Fitzgerald, 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982)). For a right to be clearly established, it must "be apparent from pre-existing law that the [official's] conduct is unlawful," but "there need not be a case decided on all fours with the present factual circumstances." Wilson v. Lawrence County, 260 F.3d 946 (8th Cir.2001) (citations omitted).

Davis does not appear to argue that the DPPA is not clearly established federal law. Instead, he argues that, as a matter of law and logic, he could not possibly have known that his conduct violated any clearly established statutory right because the Complaint alleges he was basically tricked into making the allegedly illegal disclosures. He points out that the Complaint alleges that the entity defendants made "false representations" to the Department of Revenue, and that they obtained the highly restricted personal information on the "pretense that the information would be used only for legitimate business purposes[.]" (Def.'s brf. 7; Pls.' Compl. ¶¶ 3, 22).

Davis' argument fails because the allegations in the Complaint are logically consistent. The allegedly false reason the entity defendants used to obtain the highly restricted personal information from the Department—that they needed the information for the "purposes of verifying the accuracy of information of individuals doing business with Shadowsoft"—was not, even if it had been true, a purpose that would have allowed Davis to disclose the information without obtaining Plaintiffs' consent.^[2] The plain language of the DPPA gave Davis sufficient notice that the disclosures he is alleged to have made were in violation of Plaintiffs' rights. See Collier v. Dickinson, 477 F.3d 1306, 1311-12 (11th Cir.2007) (finding that "[t]he words of the DPPA alone are ``specific enough to establish clearly the law applicable to particular conduct and circumstances and to overcome qualified immunity.'" (internal citations omitted)). The allegations in the Complaint do not demonstrate that Davis is entitled to qualified immunity. The Court will not dismiss Count I of Plaintiffs' Complaint.

III. Conclusion

Accordingly, it is hereby

ORDERED that Defendant's Motion to Dismiss [Doc. # 21] is DENIED as to Count I and GRANTED as to Count III of Plaintiffs' Complaint.

NOTES

[1] The Court treats the allegations in Plaintiffs' Complaint as true for purposes of Davis' motion to dismiss.

[2] The Complaint alleges that the database contained Plaintiffs' social security numbers, which constitute "highly restricted personal information" under the DPPA. 18 U.S.C. § 2725(4). Certain of the exceptions to the general rule of non-disclosure in the DPPA apply only to the disclosure of "personal information," and not to "highly restricted personal information." See 18 U.S.C. § 2721. One such exception is the exception for "use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only ... to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors[.]" 18 U.S.C. §§ 2721(a)(2), (b)(3)(A). Because this purpose would not have been a legitimate reason to disclose "highly restricted personal information" under the DPPA, it is plausible that both (1) the entity defendants falsely represented that they would use the information for this purpose; and (2) Davis knowingly disclosed the information for this purpose, a purpose which would not except him from liability under the DPPA.