Roberts et al v. Source for Public Data LP et al

Filing 261

ORDER entered by Judge Nanette Laughrey. Defendants' motions for summary judgment [Docs. ## 245, 247] are GRANTED and Plaintiffs' motion for summary judgment [Doc. # 246] is DENIED.(Kanies, Renea)

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF MISSOURI CENTRAL DIVISION EMILY ROBERTS, et al., ) ) ) Plaintiffs, ) ) v. ) THE SOURCE FOR PUBLIC DATA, et al., ) ) ) Defendants. ) )

Case No. 08-4167-CV-C-NKL

ORDER Plaintiffs Emily Roberts and Sarah E. Smith brought this class action against Defendants, The Source for Public Data, L.P. ("Public Data"), Shadowsoft, Inc. ("Shadowsoft"), and Omar Davis, Julie Allen, Karen Dudenhoeffer, Ruth Otto, and Patricia Vincent ­ Missouri Department of Revenue ("DOR") officials sued in their individual capacities. Plaintiffs claimed violations of the Drivers Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721, et seq., as well as 42 U.S.C. § 1983 and the Missouri Merchandising Practices Act. Before the Court are three motions for summary judgment. One was filed by Defendants Allen, Dudenhoeffer, Otto, and Vincent [Doc. # 245]; one was filed by Defendant Davis [Doc. # 247]; and the third summary judgment motion was filed by Plaintiffs [Doc. # 246]. For the following reasons, the Court grants Defendants' motions and denies Plaintiffs' motion.

I.

Background A. The Uncontroverted Facts

The Court has considered the parties' statements of facts and finds that the following facts are undisputed and supported by evidence. In order to receive access to Missouri drivers' personal information, Form 4678 must be submitted to the Missouri DOR for review. The version of Form 4678 used during the time period identified in Plaintiffs' Complaint listed a series of exceptions to the DPPA, allowing the requestor to obtain drivers' personal information ­ including social security numbers ­ from DOR records. Shadowsoft requested access to Missouri drivers' personal information and claimed that it was entitled to the information under the "business use" exception to the DPPA. [Doc. # 254, Ex. 8.] The entire Missouri driver's license file was disclosed to Shadowsoft in the years 2001, 2003, twice in 2004, twice in 2005, twice in 2006, twice in 2007, and again in 2008. [Doc. # 254, Ex. 7.] Public Data received Missouri drivers' personal information from Shadowsoft. Defendant Julie Allen was the Customer Services Director for the Missouri DOR from February 2004 to November of 2008. She oversaw the Divisions of Taxation and Motor Vehicle and Driver Licensing. Defendant Allen had approximately 1,200 employees working under her. Allen was responsible for the department which disclosed information to Shadowsoft. She had not reviewed the Form 4678 sent in by Shadowsoft, as it predated her tenure at the Missouri DOR.

2

Defendant Karen Dudenhoeffer has been a Revenue Manager at Missouri DOR since January 2008. Her duties involve managing a staff of approximately 50 employees, overseeing public information, including record sales such as the disclosure of driver's license and motor vehicle information. Defendant Dudenhoeffer did not participate in the creation of Form 4678, and does not remember ever reviewing Shadowsoft's Form 4678. The department and employees that Karen Dudenhoeffer oversees are responsible for verifying the applications for Missouri drivers' personal information submitted by businesses such as Shadowsoft. The last disclosure of Missouri drivers' personal information to Shadowsoft occurred on January 22, 2008. Dudenhoeffer did not authorize that request. Defendant Ruth Otto has been a Revenue Manager for the DOR since December of 1996. She is currently a Revenue Manager in the Motor Vehicle and Driver Licensing Division. Defendant Otto is not in charge of promulgating DOR policies or procedures. Otto did not review Shadowsoft's Form 4678 when it was submitted in 2001. Defendant Patricia Vincent was the Director of the Missouri DOR from January 2005 until November 2007. When Defendant Vincent took over, there were policies and procedures in effect setting forth the circumstances under which drivers' personal information could be sold in bulk, and she did not amend them. Vincent has not seen the Form 4678 submitted by Shadowsoft, was not involved in the decision to approve Shadowsoft's access to Missouri drivers' personal information, and does not know who approved it.

3

Defendant Omar Davis was the Director of the Missouri DOR from December 31, 2007 until January 12, 2009. Defendant Davis had been General Counsel for the Missouri DOR from July 2006 through October 2006. During the period between October 2007 and December 31, 2007, Davis served as Director of the Department of Labor and Industrial Relations. Shadowsoft applied for and obtained access to the driver's license data base before Davis was employed by the Missouri DOR. Davis did not approve Shadowsoft's application for security access to Missouri drivers' personal information. Prior to learning of the allegations of Shadowsoft's misuse of Missouri drivers' personal information, Defendant Davis does not think he saw Form 4678. That form predated Davis at the Missouri DOR. Davis had not heard of Shadowsoft or Public Data until late February 2008, shortly before he ended Shadowsoft's access to drivers' personal information in response to a February 20, 2008 letter from the Missouri Attorney General's Office. The Missouri DOR policy on the DPPA was issued on September 13, 1997, and was revised on September 1, 2008. There was also a policy issued on September 13, 1997, and revised on March 12, 2002. There is no evidence that any of the Defendants violated any of the DOR's policies and procedures regarding driver's license data information sold to Shadowsoft. The Missouri DOR started an audit process in late 2007, sending out a questionnaire in December 2007. The audit was part of a project to develop a record system to address the DPPA requirement of keeping records of those parties to whom personal information is resold. Defendant Otto contacted Shadowsoft to request information when DOR was
4

conducting the audit. The results of the audit did not change Shadowsoft's eligibility to receive bulk disclosures of Missouri drivers' personal information from the DOR. Shadowsoft was subsequently approved to receive the entire Missouri driver's license file on January 28, 2008. In February 2008, the Missouri Attorney General filed a state court action against Public Data, claiming that it was permitting access to information in violation of state and federal law. That month, the Missouri Attorney General sent a letter to Defendant Davis indicating that "highly confidential personal drivers license information that the Department of Revenue is charged with protecting is being used for illegal and improper purposes." [Doc. # 254, Ex. 12.] The Missouri Attorney General further requested that Davis "take whatever steps are necessary to ensure that Missourians' personal and confidential information is not made available to those who would misuse it or sell it to others who will." Id. On February 22, 2008, Defendant Dudenhoeffer sent a letter to Bruce Stringfellow of Shadowsoft. Defendant Otto drafted the letter, which stated: This letter is in reference to the complete driver license file that you receive from the Missouri Department of Revenue (Department) on a semi-annual basis. Department records reflect that your request for access to driver license record information has been made for the purpose of "use in the normal course of business . . . to verify the accuracy of personal information submitted by the individual to the business or its agents, employees or contractors." It has been determined, however, that such purpose serves only as a basis for requesting access to individual driver records, and not the entire driver license record

5

database. Therefore, effective immediately, your request for access to the entire driver license database is denied. [Doc. # 254, Ex. 11.] The Missouri DOR changed its Form 4678 in late 2007 or early 2008. The new version of Form 4678 provides for only the following authorization to obtain personal information under the DPPA's "business use" exception: For use as a legitimate business in verifying accuracy of the personal information submitted by the individual to the business or its agents, employees, or contractors and/or to obtain correct information but only for purposes of preventing fraud, pursuing legal remedies, or collecting debts. (For individual requests only.) [Doc. # 254, Ex. 9.] Additionally, the DOR now truncates Missouri drivers' license

numbers to the last four digits if they are also social security numbers. B. Procedural Background

Plaintiffs' Second Amended Complaint contained five counts. Count I alleged that the individual Defendants, "acting as officers, agents, employees or contractors of Mo. DOR, knowingly authorized, directed, ratified, approved, acquiesced in, committed or participated in disclosing Plaintiffs' and the Class members' highly restricted personal information to co-defendants Shadowsoft and PublicData, without the express consent of the persons to whom the information pertained. . . ." [Doc. # 154 at 12.] Count II alleged that Defendants Shadowsoft and Public Data also violated the DPPA. Count III alleged that the individual Defendants violated 42 U.S.C. § 1983. Count IV alleged that Shadowsoft and Public Data

6

violated the Missouri Merchandising Practices Act. Finally, Count V asserted a claim for unjust enrichment against Shadowsoft and Public Data. On December 1, 2008, the Court denied the motion to dismiss filed by Defendants Shadowsoft and Public Data. Also on December 1, 2008, the Court denied Defendant Davis's motion to dismiss with respect to Plaintiffs' DPPA claim and granted it with respect to Plaintiffs' Section 1983 claim. The parties have agreed that the DPPA does not allow for a private cause of action against states or state officials in their official capacities. [Doc. # 37 at 5.] Plaintiffs subsequently dismissed all of the individually named Defendants except for Davis, Allen, Dudenhoeffer, Otto, and Vincent. Plaintiffs have also entered into a settlement agreement with Defendants Shadowsoft and Public Data. In their motion for summary judgment, Defendants Allen, Dudenhoeffer, Otto, and Vincent argue, inter alia, that: (1) Plaintiffs' claims are barred by the Eleventh Amendment, (2) they are entitled to qualified immunity, and (3) there is insufficient evidence to conclude that they knowingly violated the DPPA. Defendant Davis's separate motion for summary judgment also advances arguments based on the Eleventh Amendment, qualified immunity, and the sufficiency of evidence that the DPPA was knowingly violated. Plaintiffs move for summary judgment as well, contending that there is no genuine issue of material fact regarding the DPPA violations. II. Discussion A. The Driver's Privacy Protection Act
7

In 1994, Congress enacted the DPPA to protect the privacy of drivers. The DPPA makes it unlawful for a person to "knowingly . . . obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b)" of the Act, and further states that "[a] person who knowingly obtains, discloses, or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains . . . ." 18 U.S.C. §§ 2722(a), 2724(a). The DPPA defines "person" to include entities but to exclude "a State or agency thereof." 18 U.S.C. § 2725(2). The statute defines "personal information" as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address . . . telephone number, and medical or disability information . . . ." 18 U.S.C. § 2725(3). Section 2721(b) contains fourteen permissible purposes for obtaining, disclosing, or using personal information ­ exceptions to the DPPA's general rule against obtaining or disclosing personal information from a DMV record. 18 U.S.C. § 2721(b).1 Furthermore,

Section 2721(b) allows disclosure of "personal information" for the following uses (paraphrasing): (1) by a government agency or by any private person or entity acting on behalf of a government agency in carrying out its functions; (2) for use in connection with motor vehicle safety and prevention of car theft; (3) in the normal course of business, to verify or correct the accuracy of personal information submitted to the business by an individual; (4) for use in connection with court, agency, or arbitral proceedings; (5) for use in research activities, as long as the information is not redisclosed; (6) by insurance companies; (7) in providing notice to owners of towed vehicles; (8) by licensed private investigative agencies; (9) by employers to verify driver's license information; (10) in connection with the operation of private toll transportation facilities; (11) for any other use in response to requests for individual DMV records if the State has obtained the express consent of the person to whom such personal information pertains; (12) for bulk distribution for surveys, marketing, or solicitation if the State has obtained the express consent of the person to whom such personal information pertains; (13) 8

1

section 2721(a)(2) creates an even higher level of protection for "highly restricted personal information" ­ including social security numbers ­ which may be obtained or disclosed only with the consent of the individual to whom the information pertains, or pursuant to the limited "uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9)." 18 U.S.C. §§ 2721(a)(2), 2725(4). Those four subsections provide the limited exceptions for obtaining or disclosing "highly restricted personal information": (1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions. .... (4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any selfregulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court. .... (6) For use by any insurer or insurance support organization, or by a selfinsured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, or underwriting. .... (9) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49. 18 U.S.C. §§ 2721(b)(1), (4), (6), (9). Notably, the "business use" exception is not among the permissible uses of "highly restricted personal information." Under that exception, only "personal information" may be disclosed:

by any requester with written consent of the individual whose information is requested; and (14) for any other use authorized under the law of the State that is related to the operation of a motor vehicle or public safety. See 18 U.S.C. § 2721(b). 9

For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and (B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual. 18 U.S.C. § 2721(b)(3). Finally, through section 2721(c), the DPPA also regulates the resale and redisclosure of drivers' personal information by an "authorized recipient." 18 U.S.C. § 2721(c). The general rule for resellers is that "[a]n authorized recipient of personal information . . . may resell or redisclose the information only for a use permitted under subsection (b) . . . ." Id. B. Eleventh Amendment Immunity

Defendants argue that (1) they have not waived Missouri's Eleventh Amendment immunity, and (2) the State of Missouri is the real, substantial party in interest in this case, such that the Eleventh Amendment bars Plaintiffs' claims against them. 1. Whether Defendants have Waived Missouri's Eleventh Amendment Immunity

Plaintiffs argue that Defendants have waived any Eleventh Amendment immunity, relying primarily on Hankins v. Finnel where the Eighth Circuit explained that courts infer a waiver when the State has made a general appearance in federal court and defended a lawsuit on the merits. 964 F.2d 853, 856 (8th Cir. 1992). The Eighth Circuit has subsequently explained that Hankins was "a special case of limited application" because
10

there the State paid a judgment to its indemnified employee and then attempted to recoup that amount by bringing an action in state court before finally defending another federal suit regarding the same dispute. Union Elec. Co. v. Missouri Dep't of Conservation, 366 F.3d 655, 659 (8th Cir. 2004). In Union Elec. Co. v. Missouri Dep't of Conservation, the Eighth Circuit held that "a State's Eleventh Amendment immunity may be waived if a state actor with the power to bring suit in federal court invokes federal jurisdiction in a clear and voluntary manner." Id. at 659-60. Because the plaintiff in that case failed to demonstrate that the Missouri Department of Conservation had the power to waive the State's Eleventh Amendment immunity, there was no waiver by the State. Id. at 660. Similarly, in another context, the Eighth Circuit explained: Whether or not the appearance of the Attorney General for the state in this case amounts to a voluntary appearance by the state depends upon the authority of the Attorney General. Neither he nor any other state officer can waive the immunity of a state in the absence of a statute authorizing it to be done, and if his appearance for the state was in excess of the power vested in him by law it would not constitute a voluntary submission by the state to the jurisdiction of the court. O'Connor v. Slaker, 22 F.2d 147, 152 (8th Cir. 1927). Thus, only the State ­ or a State actor so empowered ­ can waive the State's Eleventh Amendment immunity. The State of Missouri has played no role in this litigation and therefore has not waived its Eleventh Amendment immunity. The individual Defendants in this case lack the power to waive the State's sovereign immunity. The parties have agreed that the DPPA does not allow for a private cause of action against state officials in their official capacities. Sued

11

merely in their individual capacities and not as state officials, the Defendants lack the power to waive the Eleventh Amendment on behalf of Missouri. Even if the individual Defendants did have the power to waive Missouri's Eleventh Amendment immunity, that defense was raised in every answer filed by the individual Defendants. Fromm v. Comm'n of Veterans Affairs, 220 F.3d 887, 888-90 (8th Cir. 2000) (en banc) (no waiver where attorney general appeared in federal court, answered a complaint, responded to discovery, and later moved to amend its answer to raise state's Eleventh Amendment immunity). Plaintiffs quote from a Ninth Circuit case: We see no valid reason why a party should belatedly be permitted to assert Eleventh Amendment immunity. . . . Timely disclosure provides fair warning to the plaintiff, who can amend the complaint, dismiss the action and refile it in state court, or request a prompt ruling on the Eleventh Amendment defense before the parties and the court have invested substantial resources in the case. Hill v. Blind Indus. & Servs. of Md., 179 F.3d 754, 758-59 (9th Cir. 1999). However, in this case the Eleventh Amendment defense was raised in every answer filed by the individual Defendants demonstrating that Plaintiffs did have fair warning and could have requested a prompt ruling on the Eleventh Amendment defense before investing substantial resources in the case. The Court also notes that these Plaintiffs have already secured a settlement agreement with the corporate defendants in this case and have pursued very similar claims in other actions, further lessening any prejudice arising from the consideration of the Eleventh Amendment at this juncture. 2. Whether the Eleventh Amendment Bars Plaintiffs' Claims
12

As the U.S. Supreme Court stated in Pennhurst State School & Hosp. v. Haldeman: When the suit is brought only against state officials, a question arises as to whether that suit is a suit against the State itself. . . . The Eleventh Amendment bars a suit against state officials when "the state is the real, substantial party in interest." 465 U.S. 89, 101 (1984) (quoting Ford Motor Co. v. Department of Treasury, 323 U.S. 459, 464 (1945)). "The general rule is that a suit is against the sovereign if the judgment sought would expend itself on the public treasury or domain, or interfere with the public administration, or if the effect of the judgment would be to restrain the Government from acting, or to compel it to act." Id. at 101 n.11 (internal quotations and citation omitted). As Justice Kennedy has subsequently written: "When suit is commenced against state officials, even if they are named and served as individuals, the State itself will have a continuing interest in the litigation whenever state policies or procedures are at stake." Idaho v. Coeur d'Alene Tribe of Idaho, 521 U.S. 261, 269 (1997). "The real interests served by the Eleventh Amendment are not to be sacrificed to elementary mechanics of captions and pleading." Id. at 270. To be sure, the doctrine of Ex Parte Young provides an exception to Eleventh Amendment immunity for claims for declaratory and prospective injunctive relief against state officials in their official capacities. See Dakota, Minn. & Eastern R.R. Corp. v. South Dakota, 362 F.3d 512, 516-17 (8th Cir. 2004); Fond du Lac Band of Chippewa Indians v. Carlson, 68 F.3d 253, 255 (8th Cir. 1995) (stating that Ex Parte Young allows suits in federal court against state officials in their official capacities for prospective injunctive relief to

13

prevent future violations of federal law). "[O]fficial-capacity actions for prospective relief are not treated as actions against the State." Will v. Michigan Dep't of State Police, 491 U.S. 58, 71 n.10 (1989) (quoting Kentucky v. Graham, 473 U.S. 159, 165, (1985)). "An official-capacity suit is the typical way in which we have held States responsible for their duties under federal law." Id. at 89 (Brennan, J., dissenting). Here, however, it is undisputed that Plaintiffs sued the state officials in their individual capacities. Thus, Plaintiffs do not fall within the Ex Parte Young exception to the Eleventh Amendment. In Luder v. Endicott, Judge Posner explained the application of Pennhurst and Coeur d'Alene Tribe of Idaho under similar circumstances: [E]ven when a suit is against a public officer in his or her individual capacity, the court is obliged to consider whether it may really and substantially be against the state. . . . Indirect effects are not enough; otherwise the practical necessity for a state to compensate an employee for bearing liability risks would place individual-capacity suits under the bar of the Eleventh Amendment. But a suit nominally against state employees in their individual capacities that demonstrably has the identical effect as a suit against the state is, we think, barred. 253 F.3d 1020, 1023 (7th Cir. 2001). Indeed, suits against state officials in their individual capacity are not barred by the Eleventh Amendment merely because the plaintiff seeks damages from individuals rather than from the state treasury. Id. at 1022-23 (citations omitted). It is only when the State is the real, substantial party in interest that the Eleventh Amendment acts as a bar. In Kraege v. Busalacchi, 687 F.Supp. 834 (W.D. Wis. 2009), these Plaintiffs' counsel also sued state officials in their individual capacities for DPPA violations. There, Judge

14

Barbara Crabb found that it was the State's policies, and not the defendants' implementation of them, that were at the heart of their complaint. Id. at 836. She explained that the plaintiffs had not suggested that the defendants engaged in any conduct that was both independent of what the States's policies required and a violation of the DPPA. Id. at 837. Judge Crabb found the plaintiffs' DPPA action against state officials to be similar to the circumstances in Luder: In that case, 145 plaintiffs sought payment for pre- and post-work shifts, including minimum wage and overtime pay. The Court of Appeals for the Seventh Circuit held that plaintiffs' suit against a state official was actually a suit against the state because plaintiffs sought "to accomplish exactly what they would accomplish were they to maintain this suit against the state and did so successfully: . . . to force the state to accede to their view of the Act [and abide by it]." [Luder, 253 F.3d at] 1024. Under the circumstances of the case, the individual defendants would be unable to pay and would either "declare bankruptcy and quit;" or "declare bankruptcy and comply with [the law] as interpreted by the court." Kraege, 687 F.Supp. at 837-38. Applying Luder, Pennhurst, and Coeur d'Alene Tribe of Idaho to the nearly identical DPPA claims against state officials in their individual capacities, the Kraege court noted that a judgment in plaintiffs' favor could require defendants to make statutory payments of $2,500 to each of the millions of potential class members. Id at 838. As in Luder, the state official defendants would be forced to file bankruptcy and either quit or accede to the plaintiffs' view of the DPPA, creating an exception to the Eleventh Amendment beyond the Ex Parte Young doctrine. Here as well, Plaintiffs have not pursued the Ex Parte Young doctrine's official-capacity approach.

15

Plaintiffs argue that Kraege was wrongly decided because it allows state officials to violate the DPPA with impunity. However, the DPPA provides for other enforcement mechanisms in addition to a private right of action: (a) Criminal fine.­ A person who knowingly violates this chapter shall be fined under this title. (b) Violations by State department of motor vehicles.­ Any State department of motor vehicles that has a policy or practice of substantial noncompliance with this chapter shall be subject to a civil penalty imposed by the Attorney General of not more than $5,000 a day for each day of substantial noncompliance. 18 U.S.C. § 2723. Section 2723(b) is an enforcement mechanism specifically targeting the very kind of state officials that Plaintiffs have attempted to sue here for damages. However, that provision leaves to the discretion of the Attorney General when to impose a fine on state DMVs for "substantial noncompliance." Id. For the reasons stated above, the Court finds that the Eleventh Amendment bars this suit ­ nominally against these state officials in their individual capacities ­ because the State of Missouri is the real, substantial party in interest. Therefore, it is unnecessary for the Court to analyze Defendants' remaining arguments.

16

III.

Conclusion Accordingly, it is hereby ORDERED that Defendants' motions for summary judgment

[Docs. ## 245, 247] are GRANTED and Plaintiffs' motion for summary judgment [Doc. # 246] is DENIED.

s/ Nanette K. Laughrey NANETTE K. LAUGHREY United States District Judge Dated: March 31, 2011 Jefferson City, Missouri

17