Graczyk v. West Publ'g Co.

• Decision Date: 28 September 2011
• Docket Number: No. 10–1193.,10–1193.
• Citation: 660 F.3d 275
• Parties: Lisa M. GRACZYK, et al., Plaintiffs–Appellants, v. WEST PUBLISHING COMPANY, Defendant–Appellee.
• Court: U.S. Court of Appeals — Seventh Circuit

660 F.3d 275

Lisa M. GRACZYK, et al., Plaintiffs–Appellants,

v.WEST PUBLISHING COMPANY, Defendant–Appellee.

No. 10–1193.

United States Court of Appeals, Seventh Circuit.

Argued Feb. 11, 2011.Decided Sept. 28, 2011.

Ben Barnow, Blake Anthony Strautins (argued), Attorneys, Barnow & Associates, P.C., Chicago, IL, for Plaintiffs–Appellants.

Diane Green–Kelly (argued), Attorney, Reed Smith LLP, Chicago, IL, for Defendant–Appellee.

Before POSNER, FLAUM, and WILLIAMS, Circuit Judges.

WILLIAMS, Circuit Judge.

The plaintiffs in this case contend that West Publishing obtains their personal information from state Department of Motor Vehicle (“DMV”) records and resells the information in violation of the Driver's Privacy Protection Act (“DPPA”), 18 U.S.C. § 2722. The district court granted West Publishing's motion to dismiss this lawsuit, finding that the plaintiffs lacked standing. We disagree and conclude that the DPPA creates a federal private right of action for persons who, like the plaintiffs, claim that their personal information has been disclosed in violation of the Act. But, we affirm the district court's dismissal of the plaintiffs' complaint under Federal Rule of Civil Procedure 12(b)(6) because we agree that the DPPA does not prohibit West Publishing from reselling the plaintiffs' personal information to those with permissible uses under the Act.

I. BACKGROUND

The plaintiffs, citizens of Illinois, brought a class action on behalf of licensed drivers in several states against West Publishing, asserting claims under the DPPA and for unjust enrichment, and seeking injunctive relief. The plaintiffs contend that West Publishing acquires the personal information contained in motor vehicle records of millions of drivers from state DMVs (or from entities that have acquired the information from state DMVs) for resale in violation of the DPPA.

Before the district court, West Publishing filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1), arguing that the plaintiffs did not have standing, and under Federal Rule of Civil Procedure 12(b)(6), contending that the plaintiffs had failed to state a claim under the DPPA. The district court granted the motion, finding that the plaintiffs did not have standing, that their complaint did not state a claim under the DPPA, and that the plaintiffs' unjust enrichment and injunctive relief claims were derivative of their DPPA claim and also failed. The plaintiffs appeal.

II. ANALYSIS

State DMVs require drivers to supply sensitive personal information such as names, addresses, and social security numbers when applying for a driver's license. In 1993, Congress enacted the Driver's Privacy Protection Act to limit how state DMVs can share that personal information with others. Congress passed the DPPA as an amendment to the Violent Crime Control and Law Enforcement Act of 1993 in response to nationwide reports that criminals were obtaining the personal information of their victims from state DMV records with relative ease. See Reno v. Condon, 528 U.S. 141, 143–44, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). Congress was also concerned that many states were selling drivers' personal information to individuals, marketers, and businesses without drivers' knowledge or consent. See id.

The DPPA prohibits state DMVs from “knowingly disclosing or otherwise making available to any person or entity personal information ... about any individual obtained by the department in connection with a motor vehicle record.” 18 U.S.C. § 2721(a). It also prohibits private individuals from “knowingly ... obtain[ing] or disclos[ing] personal information, from a motor vehicle record, for any use not permitted under section 2721(b).” 18 U.S.C. § 2722(a). The DPPA gives aggrieved persons a private right of action:

A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.

18 U.S.C. § 2724(a).

The DPPA, however, does not prohibit all unconsented disclosures of personal information. It permits (and in some circumstances requires, see § 2721(b) (requiring disclosure in connection with vehicle safety and theft)) disclosure for certain uses. Section 2721(b) of the DPPA lists fourteen permissible uses for which personal information may be disclosed.¹

In section 2721(c), the DPPA regulates the resale of personal information. That section provides in pertinent part that, “An authorized recipient of personal information ... may resell or redisclose the information only for a use permitted under subsection [2721(b) ].” § 2721(c).

A. Standing

The district court found that the plaintiffs did not have standing to assert a claim under the DPPA because their allegations fell short of standing requirements. We review a district court's dismissal for lack of subject matter jurisdiction de novo. Doctors Nursing & Rehab. Ctr. v. Sebelius, 613 F.3d 672, 676 (7th Cir.2010).

We disagree with the district court's resolution of the standing question. The DPPA protects individuals from certain uses or disclosures of their personal information and creates a federal right of action for the same. See 18 U.S.C. § 2724(a); see also Taylor v. Tex. Farm Bureau Mut. Ins. Co., 612 F.3d 325, 340 n. 15 (5th Cir.2010). Congress has defined the relevant injury under the DPPA as the “obtain[ment], disclos[ure], or [use],” 18 U.S.C. § 2724(a), of an individual's personal information. See Massachusetts v. EPA, 549 U.S. 497, 516, 127 S.Ct. 1438, 167 L.Ed.2d 248 (2007) (“Congress has the power to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.”). The plaintiffs allege that West Publishing engages in bulk compilation and distribution of their personal information, which West Publishing obtains from DMV records, and that this constitutes a disclosure or use of the plaintiffs' personal information that is prohibited by the DPPA. A ruling in the plaintiff's favor would mean that West Publishing could no longer obtain the plaintiffs personal information and resell it. The plaintiffs have therefore alleged an injury in fact, caused by West Publishing, that would be redressed by a decision in their favor, and so they have standing to bring this case. See id.; see also Taylor, 612 F.3d at 340–41 (addressing same legal question presented in this case and concluding that the plaintiffs had standing).

B. Motion to Dismiss

The district court also dismissed the plaintiffs' complaint for failure to state a claim. We review a district court's dismissal of a plaintiff's complaint for failure to state a claim de novo. Greenberger v. GEICO Gen. Ins. Co., 631 F.3d 392, 399 (7th Cir.2011). In doing so, we construe the complaint in the light most favorable to the plaintiff, accept well-pleaded facts as true, and draw all inferences in the plaintiff's favor. Fednav Int'l Ltd. v. Cont'l Ins. Co., 624 F.3d 834, 837 (7th Cir.2010).

The plaintiffs contend that West Publishing obtains personal information contained in DMV records from state DMVs (and other sources), stores the information in a database, and eventually sells the information to others. According to the plaintiffs, this practice is unlawful because a person may only obtain DMV records if she or he has a permissible use for the information as provided in one of the fourteen exceptions listed in section 2721(b). The plaintiffs contend that “resale” to the public is not in the list, and that as a result West Publishing does not have a permissible “purpose” for obtaining the records. See 18 U.S.C. § 2722(a) (prohibiting obtaining or using information for a purpose “not permitted under this chapter”).

The plaintiffs acknowledge that section 2721(c) of the DPPA permits authorized recipients to resell information for uses listed under section 2721(b). However, the plaintiffs argue that West Publishing is not an authorized recipient because the plaintiffs construe the term “authorized recipient” to mean a person or entity who in the first instance obtains the records for one of the purposes listed in section 2721(b). West Publishing contends that it is an authorized recipient because its “obtainment of information for those who intend to use [the information] in one of the ways permitted by section 2721(b) is obtainment [for a purpose permitted by the DPPA].” Unfortunately, the dispute cannot be resolved exclusively by reference to the text of the DPPA because the DPPA does not define the term “authorized recipient.”

What is apparent from considering the DPPA as a whole is that it is concerned with the ultimate use or uses to which personal information contained in motor vehicle records is put. See 18 U.S.C. § 2721(b) (listing permissible “uses” of records); Howard v. Criminal Inf. Servs. Inc., 654 F.3d 887, 891–92 (9th Cir.2011). The plaintiffs here do not allege that the ultimate users of the records compiled and sold by West Publishing do not have a permissible use for those records as required by section 2721(b). The plaintiffs contend, however, that the DPPA does not allow West Publishing to obtain and store DMV records in bulk in order to later sell them to someone with a permissible use. According to the plaintiffs, the person requesting the records must have an immediate permissible use for them.

However, the plaintiffs concede that “if West Publishing, as an agent, first receives a valid request for Personal Information, it then may be allowed to request that individual's information from the state on behalf of its principal.” Indeed, the plaintiffs would be hard pressed to argue that the task of obtaining records cannot be delegated to someone else. See 18 U.S.C. § 2721(b) (permitting a business or its agents to obtain motor vehicle records to verify personal information); 18 U.S.C. § 2721(c)...