Durham v. City of Charlotte

Filing 60

ORDER granting 32 Motion for Summary Judgment ; granting 36 Motion to Certify Class; denying 39 Motion for Summary Judgment. Signed by Senior Judge Robert J. Conrad, Jr on 09/24/2024. (mdp)

UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF NORTH CAROLINA
CHARLOTTE DIVISION
3:21-cv-00638-RJC-DSC
HEATHER NICOLE DURHAM, on
behalf of herself and others similarly
situated,
Plaintiff,
v.
CITY OF CHARLOTTE,
Defendant.

)
)
)
)
)
)
)
)
)
)
)

ORDER

THIS MATTER is before the Court on Defendant’s Motion for Summary
Judgement, Plaintiff’s Motion to Certify the Class, and Plaintiff’s Motion for
Summary Judgment. For the reasons set forth below, Defendant’s Motion for
Summary Judgment, (Doc. No. 39), is DENIED; Plaintiff’s Motion to Certify Class
(Doc. No. 36), is GRANTED; and Plaintiff’s Motion for Summary Judgment, (Doc.
No. 32), is GRANTED.
I.

BACKGROUND
Each year, numerous car accidents occur across North Carolina. When these

accidents rise to the statutorily required level, a report called a DMV-349 must be
completed by the investigating officer. These forms include the name, address, and
driver’s license number of the person involved in the accident. This case arises from
the alleged improper disclosure of DMV-349 reports from the Charlotte-Mecklenburg
Police Department (CMPD) Records Division that contained the personal information
of Plaintiff and others similarly situated.
1

A. DMV-349 Accident Reports
The North Carolina DMV assigns each North Carolina-licensed driver a license
number which originates with DMV, and DMV enters each driver’s name, date of
birth, address, and license number into its database. (Doc. No. 1 at ¶¶ 14–15, 17; Doc.
No. 19 at ¶¶ 14–15, 17).
When an accident occurs, North Carolina law requires that a law enforcement
officer create an accident report using a form DMV-349 for each reportable motor
vehicle accident. N.C. Gen. Stat § 20-4.01(33b); N.C. Gen. Stat. § 20-166.1(e). (Doc. 1
at ¶ 27; Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 8–9, 18, 21). The standardized DMV349 report form is published by NCDMV and is used by all local municipal and county
law enforcement agencies in North Carolina as well as the N.C. State Highway Patrol
to report motor vehicle crashes and the circumstances surrounding the crashes to
NCDMV. (Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 9, 18).
Defendant City of Charlotte “is a North Carolina municipal corporation,
chartered by the General Assembly of North Carolina, organized and operating under
the laws of North Carolina, located in Mecklenburg County, North Carolina.” (Doc. 1
at ¶ 2). The Charlotte-Mecklenburg Police Department (“CMPD”) is a component of
the City. (Doc. No. 1 at ¶ 3).
Accidents that occur within the Charlotte city limits are investigated by
CMPD. See N.C. Gen. Stat. § 20-166.1(a). CMPD officers who complete the DMV-349
in connection with an accident investigation must comply with the then-current
edition of the NCDMV Instruction Manual for the DMV-349. (Doc. 1 at ¶ 28; Doc. No.

2

39-2, Decl. of N. Crum, at ¶¶ 10–12). When a reporting officer at CMPD has a DMV349 report approved by a supervisor, it is in turn submitted to NCDMV for review
and certification by NCDMV. (Doc. No. 39-2, N. Crum Declaration, at ¶ 16).
CMPD officers investigate tens of thousands of accidents each year. (Doc. No.
19 at ¶ 45). When CMPD officers complete DMV-349 forms, they routinely access
either the drivers’ licenses or the DMV database which contains the drivers’ personal
information found on the drivers’ licenses; such officers obtain drivers’ personal
information from these sources, including drivers’ names, addresses, and driver’s
license numbers. (Doc. No. 1 at ¶ 35; Doc. No. 19 at ¶ 35).
CMPD officers use a software program called ReportBeam to assist in
preparing DMV-349 reports. (Doc. No. 19 at ¶ 34; Doc. No. 32-1, CMPD Depo. I, at
11:9–12:7, 13:10–16; Doc. No. 33-1, CST Dep., at 10:24–11:5). When CMPD officers
use ReportBeam to complete an accident report, they have the option to enter a
driver’s license number into their computer to do a computer search for a driver’s
personal information on file in North Carolina DMV’s database. (Doc. No. 32-3,
CMPD Dep. III, at 22:14–25).
Nathan Crum explained that he and other BLET instructors—past and
present—always train CMPD police recruits not to use the auto-populate F-11
function when filling out the demographic information in a DMV-349, but rather to
fill in the individual’s information such as driver’s license number, name, address,
etc. manually on the report. He also testified that using the auto-populate F-11
function could result in an inappropriate disclosure of restricted information from

3

secure law enforcement information systems. (Doc. No. 39-6, N. Crum Dep., at 27:13–
28:4).
But, if an officer uses the “autopopulate” feature, the officer can select the
driver’s information from the results returned from the DMV database and then press
the F11 key. (Doc. No. 32-1, CMPD Dep. I, at 20:13-22:1; Doc. No. 32-3, CMPD Dep.
III, at 22:14-25). The F11 key causes the officer’s computer to automatically fill-in the
blanks on the DMV-349 form with the driver’s personal information, including her
name and address. (Doc. No. 32-1, CMPD Dep. I, at 25:4–10, 118:20–119:8). This is
known as the “autopopulate” feature. (Doc. No. 32-1, CMPD Dep. I, at 20:13–25.
When a CMPD officer autopopulates the DMV-349, the driver’s name and address
come from the DMV database. (Doc. No. 32-1, CMPD Dep. I, at 21:20–22:5, 25:4–10;
Doc. No. 32-4, Prince Aff., at ¶¶ 4–7). When a CMPD officer completes an accident
report, ReportBeam software records and stores the data for each CMPD DMV-349
in a database on a server. (Doc. No. 33-1, CST Dep., at 93:23—94:25).
When the CMPD officer has auto-populated a driver’s information on to the
DMV-349, the ReportBeam software inserts a “dataclip” into the ReportBeam
database in association with that particular report. The presence of the “dataclip”
associated with a particular report shows that the CMPD officer used the autopopulate feature to insert the driver’s personal information taken from the DMV
database into the accident report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3; Doc. No. 333, Supp. Selvaraj Decl. ¶¶ 2(d), 3).

4

B. Plaintiff’s Accident
In December 2017, Plaintiff was a driver in a motor vehicle accident in the city
limits of Charlotte, North Carolina. (Doc. No. 32-8, Pl’s. Decl., at ¶ 4). At the time of
Plaintiff’s accident, Plaintiff was licensed by the State of North Carolina to drive
motor vehicles. (Doc. No. 32-8, Pl’s. Decl., at ¶ 3). Her North Carolina driver’s license
was issued by the North Carolina Division of Motor Vehicles (“NCDMV”). (Doc. No.
32-8, Pl’s. Decl., at ¶ 3). Further, Plaintiff was required to provide her name and
address to NCDMV as a condition of obtaining a driver’s license. (Doc. No. 32-8, Pl’s.
Decl., at ¶ 3).
Plaintiff’s accident was a reportable crash as defined by N.C.G.S. § 204.01(33b). (Doc. 1 at ¶ 64; Doc. No. 9 at ¶ 64; Doc. 1-2 at 1). Further, Plaintiff’s motor
vehicle crash occurred within the City of Charlotte, so under N.C. Gen. Stat. § 20166.1(a), the CMPD was the law enforcement agency with jurisdiction over the scene
of the Accident. (Doc. 1 at ¶ 65).
A CMPD officer investigated Plaintiff’s accident. (Doc. No. 32-8, Pl’s. Decl., at
¶ 4). On December 4, 2017, the CMPD officer who investigated Plaintiff’s wreck
completed a DMV-349 containing Plaintiff’s full name, address, date of birth, driver
license number, and telephone number. (Doc. No. 1 at ¶ 67; Doc. No. 19 at ¶ 67; Doc.
No. 1-2). At CMPD, the police officer who investigates a crash submits the DMV-349
Report to a supervisor for review which is then submitted to the NCDMV. (Doc. No.
39-2, N. Crum Declaration, at ¶ 15–17).

5

The DMV-349 accident report which the CMPD officer completed for Plaintiff’s
accident contained Plaintiff’s name and address. (Doc. No. 1-2, Accident Report, at 1).
At the time of the accident, Plaintiff’s name was Heather Nicole Mack. (Doc. No. 328, Pl’s. Decl., at 1; Doc. No. 1-2 at 1). Plaintiff explained that she never told the officer
her middle name which is “Nicole” as shown on the DMV-349 accident report (Doc.
No. 32-8, Pl’s. Decl., at ¶ 5). Plaintiff does not recall the officer asking her for her
address, and she does not recall telling the officer her address. (Doc. No. 32-8, Pl’s.
Decl., at ¶ 5). Plaintiff has reviewed the accident report which shows her nine-digit
zip code, and she knows that she did not provide that information to the officer orally
because she did not know her nine-digit zip code. (Doc. No. 32-8, Pl’s. Decl., at ¶ 5).
She did not tell the officer her driver’s license number. (Doc. No. 32-8, Pl’s. Decl., at
¶ 5).
C. Distribution of Reports
From 2007 or earlier until late 2020, CMPD placed one or more copies of each
recent DMV-349 accident report on the front desk of its records division so that
anyone who came into the division could personally view the information contained
on each of the DMV-349. (Doc. No. 19 at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 12:1–
13:21).
CMPD made its DMV-349s available to the public at all 13 division offices
within the City of Charlotte. (Doc. No. 32-1, CMPD Dep. I, at 135:4–136:13). The
DMV-349s that CMPD made available to the public included the names, addresses,
and driver’s license numbers of the persons involved in traffic accidents. (Doc. No. 32-

6

6, CMPD Dep. II, at 31:19–24; Doc. No. 32-1, CMPD Dep. I, 168:9–17). CMPD knew,
since at least 2011 until through at least 2017, that marketers, including law firms
that CMPD employees referred to as “ambulance chasers,” acquired reports in bulk
directly from its records division. (Doc. No. 32-6, CMPD Dep. II, at 18:16—20:5).
CMPD nevertheless did not redact any of the personal information on the DMV-349s
it made available to the public. (Doc. No. 19 at ¶ 53; Doc. No. 32-1, CMPD Dep. I, at
147:9–23; Doc. No. 32-6, CMPD Dep. II, at 31:19–24). Each accident report involving
a licensed driver contained a driver’s license number which originates with and is
assigned by DMV. (Doc. No. 32-1, CMPD Dep. I, at 168:14-22).
Via its records division, CMPD provided copies of its accident reports to Digital
Solutions, who sent runners to CMPD in order to obtain the reports so that it could
sell them to marketers. (Doc. No. 32-9, Creech Decl. I, at ¶¶ 2, 4–5). Digital Solutions,
in turn provided the accident reports to personal injury attorneys, including James
S. Farrin, P.C. (“Farrin”). (Doc. No. 32-9, Creech Decl. I, at ¶ 7; Doc. No. 32-10,
Sanchez Decl., at ¶ 5).
Farrin then harvested personal information from the accident reports and
placed that information on a mailing-list spreadsheet. (Doc. No. 32-10, Sanchez Decl.,
at ¶ 7). According to a declaration made by Plaintiff’s attorney regarding his review
of the Farrin spreadsheets, Plaintiff’s accident report is among those which CMPD
provided to Digital Solutions as Plaintiff’s name and address are contained on the
Farrin Spreadsheet. (Doc. No. 32-13, Stradley Decl., at ¶¶ 3–4). Farrin, as a general

7

practice, then mailed letters to each person listed on the Farrin Spreadsheet. (Doc.
No. 32-10, Sanchez Decl., at ¶ 8).
Plaintiff has not provided written consent to allow anyone to disclose or use
her personal information, from a motor vehicle record, for marketing purposes or for
any other purpose. (Doc. No. 32-8, Pl’s. Decl., at ¶ 8).
D. Plaintiff Receives Marketing Letters
In 2017, shortly after Plaintiff’s accident, Plaintiff began receiving in the mail
marketing letters from attorneys who were soliciting her to hire them to assert a legal
claim arising out of the accident. (Doc. No. 32-8, Pl’s. Decl., at ¶ 7). Plaintiff does not
recall which firms they were from and she lacks a copy of the letters. (Doc. No. 32-8,
Pl.’s Decl., at ¶ 7).
Plaintiff explains that she was harmed in the following ways by Defendant’s
disclosure of her accident report showing her personal information:
1. Defendant invaded and violated her privacy rights to protected personal
information; As a result of Defendant’s improperly disclosing her name,
address, and other personal information from the accident report,
marketers were able to obtain that information and use it to create,
process, and mail advertising letters;
2. Defendant exposed her DPPA-protected personal information to
marketers and their office personnel who processed the marketing
letters and to people who handled the mail for the postal service and to
any others who saw the mail;
3. When the marketing letters arrived at Plaintiff’s house, she had to
expend time and attention to retrieve them from her mailbox and open
and/or dispose of the letters;
4. When Plaintiff received the advertising letters shortly after the
accident, she was shocked and upset that advertisers could so quickly
learn that she had been in a wreck and so quickly get so much relevant
8

personal information about her, and she questioned how that could
possibly be legal;
5. When she got the advertising letters shortly after the accident, she was
irritated that marketing attorneys were immediately soliciting business
to pursue legal claims so soon after the accident.
(Doc. No. 32-8, Pl’s. Decl., at ¶ 9; Doc. No. 32-11, Pl.’s Depo., at 19:5–22:11).
E. Connecting Data to DMV Records
Plaintiff’s expert, Sankar Selvaraj, has examined stored ReportBeam
computer data including Plaintiff’s accident report. (Doc. No. 33-2, Selveraj Decl., at
¶ 2; Doc. No. 33-3, Supp. Selvaraj Decl., at ¶ 2(b)). This data for Plaintiff’s Accident
Report contains a “dataclip” containing Plaintiff’s full name, address, and date of
birth. (Doc. No. 33-2, Selveraj Decl., at ¶ 3; (Doc. No. 33-3, Supp. Selvaraj Decl., at ¶
3). Plaintiff’s information contained in the “dataclip” matches her data shown on the
Accident Report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj
Decl., ¶ 3(4)). Hence, the “dataclip” shows that the CMPD auto-populated Plaintiff’s
name, address, and date of birth onto the Accident Report from the DMV database
and that no changes were made to Plaintiff’s auto-populated name, address, or date
of birth. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj Decl.,
Ex. 14, ¶ 3(4)).
F. Lack of CMPD Records
CMPD kept neither a record of which DMV-349 reports actually were placed
out for viewing in the CMPD Records Division nor which reports were viewed or by
whom. There is no record from CMPD that a representative of Digital Solutions

9

viewed or collected DMV-349 reports at the CMPD Records Division. (Doc. No. 39-5,
Decl. of Kiersten Frost, at ¶¶ 6–7).
G. Procedural History
On November 30, 2021, Plaintiff Heather Nicole Durham filed this putative
class action. (Doc. No. 1). Defendant City of Charlotte filed a Motion to Dismiss on
several grounds, including lack of standing. (Doc. No. 7). On October 13, 2022, this
Court adopted Magistrate Judge Cayer’s Memorandum & Recommendation, (Doc.
No. 14), granting the motion as to Plaintiff’s claim for declaratory and injunctive relief
but finding that Plaintiff had established standing as to her claims for liquidated
damages. (Doc. No. 17).
In January 2023, this case was stayed pending the outcome of the appeal in
Hensley v. City of Charlotte before the Fourth Circuit. (Doc. No. 22). Plaintiff filed her
Motion for Summary Judgment, (Doc. No. 32), and Motion to Certify Class, (Doc. No.
36), on December 1, 2023. Defendant filed its Motion for Summary Judgment on the
same day. (Doc. No. 39).
II.

STANDARD OF REVIEW
Summary judgment shall be granted “if the movant shows that there is no

genuine dispute as to any material fact and the movant is entitled to judgment as a
matter of law.” Fed. R. Civ. P. 56(a). A factual dispute is genuine “if the evidence is
such that a reasonable jury could return a verdict for the nonmoving party.”
Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is material only if it
might affect the outcome of the suit under governing law. Id. The movant has the

10

“initial responsibility of informing the district court of the basis for its motion, and
identifying those portions of the pleadings, depositions, answers to interrogatories,
and admissions on file, together with the affidavits, if any, which it believes
demonstrate the absence of a genuine issue of material fact.” Celotex Corp. v. Catrett,
477 U.S. 317, 323 (1986) (internal citations omitted). “The burden on the moving
party may be discharged by ‘showing’ . . . an absence of evidence to support the
nonmoving party’s case.” Id. at 325.
Once this initial burden is met, the burden shifts to the nonmoving party. The
nonmoving party “must set forth specific facts showing that there is a genuine issue
for trial.” Id. at 322 n.3. The nonmoving party may not rely upon mere allegations
or denials of allegations in his pleadings to defeat a motion for summary judgment.
Id. at 324. Instead, “Rule 56(e) . . . requires the nonmoving party to go beyond the
pleadings and by her own affidavits, or by the depositions, answers to interrogatories,
and admissions on file, designate specific facts showing that there is a genuine issue
for trial.” Id. The nonmoving party must present sufficient evidence from which “a
reasonable jury could return a verdict for the nonmoving party.” Anderson, 477 U.S.
at 248; accord Sylvia Dev. Corp. v. Calvert Cty., Md., 48 F.3d 810, 818 (4th Cir. 1995).
The Fourth Circuit has concluded that “evidence, which is inadmissible at trial,
cannot be considered on a motion for summary judgment. Maryland Highways
Contractors Ass'n, Inc. v. State of Md., 933 F.2d 1246, 1251–52 (4th Cir. 1991) (finding
that inadmissible hearsay evidence could not be considered on a motion for summary
judgment) (citing Rohrbough v. Wyeth Laboratories, Inc., 916 F.2d 970, 973–74 n.8

11

(4th Cir.1990); Garside v. Osco Drug, Inc., 895 F.2d 46, 50 (1st Cir.1990); Randle v.
LaSalle Telecommunications, Inc., 876 F.2d 563, 570 n.4 (7th Cir.1989); Pink Supply
Corp. v. Hiebert, Inc., 788 F.2d 1313, 1319 (8th Cir. 1986)).
When ruling on a summary judgment motion, a court must view the evidence
and any inferences from the evidence in the light most favorable to the nonmoving
party. Anderson, 477 U.S. at 255. “Where the record taken as a whole could not lead
a rational trier of fact to find for the nonmoving party, there is no genuine issue for
trial.” Ricci v. DeStefano, 557 U.S. 557, 586 (2009) (citations omitted). The mere
argued existence of a factual dispute does not defeat an otherwise properly supported
motion. Anderson, 477 U.S. at 248. If the evidence is merely colorable or is not
significantly probative such that a jury could not return a verdict for the other party,
summary judgment is appropriate. Id. at 249–50 (cleaned up).
“A district court has broad discretion in deciding whether to certify a
class.” Thorn v. Jefferson-Pilot Life Ins. Co., 445 F.3d 311, 317 (4th Cir. 2006)
(quoting Lienhart v. Dryvit Sys., Inc., 255 F.3d 138, 146 (4th Cir. 2001)). In the
execution of this discretion, a court must accept the substantive allegations of the
complaint as true and “interpret Rule 23 in such a manner as to promote justice and
judicial efficiency.” Farrar & Farrar Dairy, Inc. v. Miller-St. Nazianz, Inc., 254
F.R.D. 68, 72 (E.D.N.C. 2008); Di Biase v. SPX Corp., No. 314CV00656RJCDSC, 2017
WL 4366994, at *2 (W.D.N.C. Oct. 2, 2017). Nonetheless, the burden of establishing
certification remains with the party seeking class certification. Thorn v. JeffersonPilot Life Ins. Co., 445 F.3d 311, 321–22 (4th Cir. 2006). A class “may only be certified

12

if the trial court is satisfied, after a rigorous analysis, that the prerequisites of Rule
23(a) have been satisfied.” Gen Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 161
(1982). Then, if a plaintiff meets all of the requirements of Fed. R. Civ. P. (23)(a), the
plaintiff must show that the putative class also fits into one of the three categories
enumerated in Rule 23(b). Fed. R. Civ. P. 23(b).
III.

DISCUSSION

A. Defendant’s Motion to Dismiss and Motion for Summary Judgment
Defendant moves the Court to dismiss the action for lack of standing, or in the
alternative, to grant summary judgment in favor of Defendant, finding that the City
of Charlotte is not a “person” as defined by the relevant statute. (Doc. No. 39 at 1).
The Drivers Privacy Protection Act provides that “[a] person who knowingly
obtains, discloses or uses personal information, from a motor vehicle record, for a
purpose not permitted under this chapter shall be liable to the individual to whom
the information pertains, who may bring a civil action in a United States district
court.” 18 U.S.C. § 2724(a). Thus, there is a private right of action when a person
violates the DPPA.
1. Lack of Standing
The plaintiff bears the burden of proving that subject matter jurisdiction
exists. Evans v. B.F. Perkins Co., a Div. of Standex Int’l Corp., 166 F.3d 642, 647 (4th
Cir. 1999). “When . . . a defendant challenges the existence of subject matter
jurisdiction in fact, the plaintiff bears the burden of proving the truth of such facts by
a preponderance of the evidence.” U.S. ex rel. Vuyyuru v. Jadhav, 555 F.3d 337, 347

13

(4th Cir. 2009). “When a defendant challenges subject matter jurisdiction pursuant
to Rule 12(b)(1), the district court is to regard the pleadings as mere evidence on the
issue and may consider evidence outside the pleadings without converting the
proceeding to one for summary judgment. Evans, 166 F.3d at 647 (cleaned up).
A court will analyze standing in a class action “based on the allegations of
personal injury made by the named plaintiffs.” Baehr v. Creig Northrop Team, P.C.,
953 F.3d 244, 252 (4th Cir. 2020) (citing Hutton v. Nat'l Bd. of Exam'rs in Optometry,
Inc., 892 F.3d 613, 620 (4th Cir. 2018)). At the summary judgment stage, “the named
plaintiff is obliged to ‘set forth by affidavit or other evidence specific facts’ that, when
taken as true, establish each element of Article III standing.” Id. at 253 (quoting
Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992); and then citing Libertarian
Party of Virginia v. Judd, 718 F.3d 308, 313 (4th Cir. 2013)). “Once threshold
individual standing by the class representative is met, a proper party to raise a
particular issue is before the court [and] there is no further, separate ‘class action
standing’ requirement.” Carolina Youth Action Project; D.S. by & through Ford v.
Wilson, 60 F.4th 770, 779 (4th Cir. 2023) (citing 1 Newberg and Rubenstein on Class
Actions § 2:1 (6th ed. 2022)).
“The irreducible constitutional minimum of standing consists of three
elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly
traceable to the challenged conduct of the defendant, and (3) that is likely to be
redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338
(2016), as revised (May 24, 2016) (cleaned up). A plaintiff “cannot establish a

14

cognizable injury simply by pleading a statutory violation.” Garey v. James S. Farrin,
P.C., 35 F.4th 917, 921 (4th Cir. 2022) (citing Spokeo, 578 U.S. at 341).
As to “injury in fact,” in Garey, the Fourth Circuit held that the plaintiffs had
Article III standing to pursue claims for damages under the DPPA because they
established a legally cognizable privacy injury. 35 F.4th at 922. Specifically, plaintiffs
alleged under the DPPA that their privacy was invaded by the defendants who
knowingly obtained their personal information for an impermissible purpose. Id. The
court of appeal reasoned that like in Krakauer “injuries to personal privacy have long
been ‘recognized in tort law and redressable through private litigation.’” Id. (quoting
Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 653 (4th Cir. 2019)). Thus, the
plaintiffs in Garey had alleged a legally cognizable privacy injury. Id.
Here, Plaintiff’s alleged injury is similar to the injury claimed in Garey.
Plaintiff articulates a privacy violation through the disclosure of a motor vehicle
record for impermissible purposes under DPPA. Consistent with Garey, Plaintiff can
establish the “injury in fact” prong required for standing.
Moving on to the “fairly traceable” element, Plaintiff argues that both the
undisputed evidence and Defendant’s own admissions1 prove that Defendant
unlawfully disclosed Plaintiff’s DPPA-protected information. (Doc. No. 44 at 10).
Plaintiff claims that in its answer, “Defendant admits that it published Plaintiff’s
unredacted crash report, which contains DPPA-protected personal information, at its
records desk.” (Doc. No. 44 at 11). Defendant asserts that Plaintiff’s argument is a
mischaracterization of Defendant’s answer by leaving out that the admissions were
made upon “information and belief.” (Doc. No. 51 at 6). In general, a party is bound
by the admissions of its pleadings. Lucas v. Burnley, 879 F.2d 1240, 1242 (4th Cir.
1989); see also Butts v. Prince William Cnty. Sch. Bd., 844 F.3d 424, 432 n.3 (4th Cir.
1

15

Arguing that Plaintiff’s injury is not “fairly traceable” to Defendant’s conduct,
Defendant relies upon Hensley v. City of Charlotte, No. 3:20-CV-00482-KDB-DSC,
2023 WL 2533083, at *1 (W.D.N.C. Mar. 15, 2023). Defendant contends that Hensley
“is largely indistinguishable from the instant case,” and thus, Plaintiff is without
standing. The Court is not persuaded.
In Hensley, the district court found that the plaintiff lacked standing “because
he ha[d] not alleged in the relevant pleadings that his injury was the result of a
wrongful disclosure of his personal information by the City” in violation of the DPPA.
2023 WL 2533083, at *1. The Court observed that Plaintiff’s allegations asserted that
CMPD records and LexisNexis both made information available to the public and the
complaint did not allege that “a member of the public who viewed Hensley’s Accident
Report at the records division solicited [him].” Id. at *2. The Court concluded that the
complaint failed to allege that the plaintiff’s injury was traceable to the City’s alleged
wrongful conduct. Id. at *4.
The Court reasoned that Plaintiff’s standing depended “on an allegation that
he suffered his injury from a disclosure of Plaintiff’s accident report from the CMPD
counter,” and fatal to the plaintiff’s claim, CMPD/the City kept no record of which
accident reports were viewed or by whom, and Hensley could not show that “he

2016). However, this Court has recognized that the phrase “on information and belief”
is “a lawyer shorthand expression of uncertainty.” In re Thiel, No. 1:14-CV-168, 2015
WL 773401, at *4 n.4 (W.D.N.C. Feb. 24, 2015), aff’d, 627 F. App’x 272 (4th Cir. 2016).
Thus, the Court does not find Defendant CMPD to have admitted the allegations
asserted by Plaintiff where Defendant noted that these allegations were admitted
“upon information and belief.”
16

received a solicitation as a result of the disclosure of DPPA protected personal
information at the CMPD counter rather than the PRUS/LexisNexis website.” Id. at
*3 (quotations omitted).
The Court described the plaintiff’s affidavits attempting to establish
traceability as “wholly speculative and internally inconsistent in describing how the
law firm solicitation might have come to Plaintiff.” Id. at *4. In addressing the specific
evidence, the Court explained Plaintiff’s evidence from Digital Solutions’ this way:
[Digital Solutions] says that it gathers reports “in a variety of ways” and
it is only its President’s “best recollection” in July 2021 that from
September 2017 to the end of the year it accessed crash reports from
CMPD by gathering hard copies from the department. Significantly,
however, Digital Solutions does not say that it provided actual accident
reports to clients, but instead says that it takes information from the
reports which it puts into an excel spreadsheet format that is its product.
Id. at *4. Further, the Farrin law firm declaration denied “that it received any
spreadsheets from Digital Solutions but instead claims that it prepared its own
internal spreadsheets from actual accident reports.” Id. The Court concluded that the
plaintiff failed to “establish whether the law firm in fact even had Plaintiff’s accident
report or, if so, where it came from.” Id. Thus, the Court concluded that the plaintiff
failed to allege that the injury was traceable to the City’s alleged DPPA violation and
was without standing. Id.
In sum, the Hensley causal chain breaks between Digital Solutions and the
Farrin law firm. Digital Solutions may have received accident reports from CMPD
which it used to create spreadsheets that the Farrin law firm never received. Because
the Farrin law firm had its own accident reports that it used to make spreadsheets,

17

but Digital Solutions never claimed to have provided the actual reports to clients,
there was no link between the law firm’s accident reports and CMPD’s record counter.
Defendant argues that Plaintiff suffers from the same insufficient evidence as
the plaintiff in Hensley. (Doc. No. 39-1 at 14–17). Defendant contends that “Plaintiff
has no personal knowledge of the most fundamental facts alleged in her Complaint
that would go toward establishing a concrete and particularized injury traceable to
the City.” (Doc. No. 39-1 at 15). In response, Plaintiff argues that the evidence leaves
no other possibility than that Defendant unlawfully disclosed Plaintiff’s accident
report to Digital Solutions. (Doc. No. 44 at 10).
Based on a declaration of Plaintiff’s attorney, Plaintiff’s name and address
appears in the Farrin firm’s spreadsheets. (Doc. No. 32-13, Stradley Decl., at ¶ 4). A
declaration from Eric Sanchez at the Farrin firm details that it only obtained accident
reports that were released to the public by CMPD through its agreement with Digital
Solutions. (Doc. No. 32-10, Sanchez Decl., at ¶ 5). The Farrin Firm reviewed the
accident reports it received and created its own spreadsheets “to inform its ability to
communicate in writing with persons involved in accidents to introduce the Firm’s
services.” (Id. at ¶ 7). As a general practice, the Farrin Firm would send a mailing
that corresponded to each listing on the spreadsheets it created. (Id. at ¶ 8). Further,
based on a declaration from Kevin Creech, at Digital Solutions, Digital solutions
received accident reports, beginning in September 2017, only from sending runners
to retrieve the reports from the CMPD division. (Doc. No. 32-9, Creech Decl., at ¶ 5).

18

Digital Solutions then provided the accident reports to the Farrin law firm. (Id. at ¶
7).
It is also established that from at least 2007 until late 2020, Defendant placed
one or more copies of its recently created DMV-349s on the front desk of its records
division such that anyone who came into the records division could view the
information on each DMV-349. (Doc. No. 1 at ¶ 49; Doc. No. 19 at ¶ 49). No redactions
were ever made in the reports made available at the CMPD records counter. (Doc.
No. 1 at ¶ 53; Doc. No. 19 at ¶ 53). When Plaintiff was involved in a motor vehicle
accident in December of 2017, a DMV-349 was prepared. (Doc. No. 1 at ¶ 64; Doc. No.
19 at ¶ 64).
In this case, Plaintiff does not suffer from the same traceability deficiencies
that were present in Hensley. Unlike Hensley, Digital Solutions does say that it
provided actual accident reports to clients, thus the causal chain is not broken in the
same way. The accident reports went from the CMPD records counter to Digital
Solutions and then to the Farrin firm and into the Farrin firm’s spreadsheets. Thus,
Plaintiff has established that she suffered an injury in fact, that is fairly traceable to
the challenged conduct of Defendant, and that is likely to be redressed by a favorable
judicial decision. See Spokeo, 578 U.S. at 338. Accordingly, dismissal for lack of
standing is not appropriate, and Defendant’s Motion to Dismiss for lack of standing
is denied.

19

2. “Person” Subject to the DPPA
The Drivers Privacy Protection Act makes it “unlawful for any person
knowingly to obtain or disclose personal information, from a motor vehicle record, for
any use not permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a). The
statute provides for private cause of action against a violator: “A person who
knowingly obtains, discloses or uses personal information, from a motor vehicle
record, for a purpose not permitted under this chapter shall be liable to the individual
to whom the information pertains, who may bring a civil action in a United States
district court.” 18 U.S.C. § 2724(a). The statute also defines the term “person” as
follows: “‘person’ means an individual, organization or entity, but does not include a
State or agency thereof.” 18 U.S.C. § 2725(2).
Defendant City of Charlotte argues that it is an agency of North Carolina and,
therefore, not a person under the DPPA and not subject to a private cause of action.
(Doc. No. 39-1 at 1). Defendant proffers that North Carolina state law compels the
result that the City of Charlotte is not a “person” for purposes of the DPPA. In
response, Plaintiff asserts that municipalities like the City of Charlotte are “persons”
under the DPPA as a matter of federal law. (Doc. No. 44 at 12–13).
In interpreting the statute, the Court will look first to the statute’s language,
giving the words used their ordinary meaning. Dwoskin v. Bank of Am., N.A., 888
F.3d 117, 119 (4th Cir. 2018) (quoting Roberts v. Sea-Land Services, Inc., 566 U.S. 93,
100 (2012)). Further, in general, application of federal law does not depend upon State
law, unless there is a plain indication otherwise. Mississippi Band of Choctaw

20

Indians v. Holyfield, 490 U.S. 30, 43 (1989).2 The goal, of course, is uniform
application of statutes nationwide. Id. at 43–44; see also Brooks v. Maryland Gen.
Hosp., Inc., 996 F.2d 708, 714 (4th Cir. 1993) (“While the federal courts may give
effect to state law in interpreting the scope of a federal statute if Congress has evinced
an intention to give state law persuasive or binding effect, even when a federal
statutory provision contains significant gaps, the courts have been reluctant to infer
such intent and resort to reference to state law due to concern for uniformity in the
nation’s law.” (citations omitted)).
Section 2721 provides for permissible use of personal information “by any
government agency, including any court or law enforcement agency, in carrying out
its functions, or any private person or entity acting on behalf of a Federal, State, or
local agency in carrying out its functions” and “in connection with any civil, criminal,
administrative, or arbitral proceeding in any Federal, State, or local court or agency
or before any self-regulatory body, including the service of process, investigation in
anticipation of litigation, and the execution or enforcement of judgments and orders,
or pursuant to an order of a Federal, State, or local court.” 18 U.S.C. § 2721(b)(1),
(b)(4).
Plaintiff directs the Court to the statute’s mention of a “local agency,” which is
mentioned in addition to a State agency. (Doc. No. 44 at 14). Generally, if Congress
uses specific language in one section but does not use that same language in another

The Court finds no indication in the statute that it should consult North Carolina
law to determine if Defendant City of Charlotte is a “person” under DPPA.
2

21

section, it is assumed that Congress acted intentionally in its inclusion and exclusion
of the language at issue. Russello v. United States, 464 U.S. 16, 23 (1983). Language
in section 2725 that a State agency is excluded from the definition of “person,” without
any mention of a “local agency” also being excluded from the definition casts serious
doubt on Defendant’s not-a-person argument.
Numerous courts have concluded that a municipality does not act as a “State
or agency thereof” under DPPA and is a person under the act. The Eleventh Circuit
has expressed that the definition of “person” under section 2725 “does not exclude
municipal agencies such as sheriff’s departments,” and that “it would be a feat of
statutory reconstruction to sever the term ‘person’ as it appears in section 2722(a)
and section 2724(a) from the remedies enumerated in section 2724(b).” Truesdell v.
Thomas, 889 F.3d 719, 724 (11th Cir. 2018). District courts have also concluded that
municipalities are not excluded from liability. See Orduno v. Pietrzak, No. CV 141393 ADM/DTS, 2017 WL 4354686, at *9 (D. Minn. Sept. 29, 2017), aff’d, 932 F.3d
710 (8th Cir. 2019) (concluding based on the text of the statute that “the statute
contemplates direct liability for municipal entities like the City”); Potocnik v. Carlson,
No. 13-CV-2093 (PJS/HB), 2016 WL 3919950, at *7 (D. Minn. July 15, 2016)
(“Congress specifically exempted states and state agencies from the definition of
“person” under the DPPA, [but] Congress conspicuously did not exempt
municipalities.”); Santarlas v. Minner, No. 5:15-CV-103-OC-30PRL, 2015 WL
3852981, at *3 (M.D. Fla. June 22, 2015) (“Although a state and its agencies, such as
a department of motor vehicles, are exempt from the civil penalties provided for under

22

the DPPA, cities and municipalities are not.”); Margan v. Niles, 250 F. Supp. 2d 63,
75 (N.D.N.Y. 2003) (“[P]ursuant to 18 U.S.C. § 2724(a), states and state agencies are
expressly exempted from civil liability under the DPPA. Municipalities are not. . . .
[D]ifferential treatment of states and state departments of motor vehicles provides
no basis upon which to conclude that Congress intended to treat municipalities
different than other ‘persons.’”).
Diverging from the aforementioned district court decisions, Defendant argues
that Gaston concluded that a municipality is not a person under DPPA. (Doc. No. 391 at 18). Defendant is mistaken.
In its order, the Court noted that “any failure by a state or state agency,
including a DMV or city acting within the scope of its governmental authority, is not
subject to a private right of action under section 2724(a) because a ‘State or agency
thereof’ is not defined as a ‘person’ under the DPPA, although they are plainly subject
to the DPPA’s disclosure restrictions described in section 2721(a) and subject to a
potential civil penalty under 18 U.S.C. § 2723.” Gaston v. LexisNexis Risk Sols., Inc.,
483 F. Supp. 3d 318, 350 n.29 (W.D.N.C. 2020). The Court also noted that “[a]
subordinate division of the state, like a city administrative unit is a state agency.” Id.
at 348 n.25 (citing Smith v. Hefner, 235 N.C. 1, 68 S.E.2d 783 (1952)).
Yet, throughout its order, the Court makes clear that the disclosure of accident
reports is subject to the DPPA. The Court explained that “the very essence of the
DPPA is to limit the disclosure of information that had previously been made widely
available as a public record; so, . . . it would be nonsensical to hold that a permissible

23

governmental ‘function’ under the DPPA is to publicly disclose personal information
in a ‘public record.’” 483 F. Supp. 3d at 346.
Further, the Court explained that a municipality was considered a State
agency under the DPPA only to the extent it acted within the scope of its
governmental authority, stating the following:
the gathering of personal information to prepare the Crash Reports is a
government function permitted by section 2721(b)(1) in the same way
that gathering personal information to create a driver’s license or motor
vehicle registration is permitted by the act. However, once the
information is lawfully obtained, the disclosure of the information, in
and of itself, is not an independent governmental function that is
permitted by the DPPA (absent redaction or a separate permitted use).
483 F. Supp. 3d at 346 n.20. The Court made clear that impermissible disclosure of
DPPA-protected information is not a government function. Thus, Gaston does not
hold that Defendant cannot be subject to a private cause of action under the DPPA
for disclosure of DPPA-protected information.
In sum, the Court finds Defendant’s argument that it is not a “person” subject
to suit under DPPA unavailing. Accordingly, Defendants’ Motion for Summary
Judgment is denied. Having denied Defendant’s Motion to Dismiss and Motion for
Summary Judgment, the Court turns to Plaintiff’s Motion for Summary Judgment
and Plaintiff’s Motion to Certify Class.
B. Plaintiff’s Motion for Class Certification
Plaintiff seeks class certification in this action under the DPPA. The purported
class of persons is defined as follows:
Those (1) who were listed as North Carolina-licensed drivers on DMV349s completed by CMPD officers within the Class Period [November
24

30, 2017–June 30, 2018]; (2) whose name appears on a Farrin
Spreadsheet; and (3) whose North Carolina driver’s license number is
shown on the DMV-349 or the Same Address Box for the person is
checked “Yes” on the DMV-349.
(Doc. No. 37 at 11). Plaintiff also brings the action on behalf of a subclass consisting
of all members of the Class whose personal information was auto-populated onto a
DMV-349. (Id. at 11–12).
In opposition, Defendant reiterates its arguments, which are addressed above,
regarding standing and maintains that it is not a “person” subject to a private right
of action under DPPA. (Doc. No. 45). Defendant does not challenge Plaintiff’s
arguments on the specific factors required for class certification but instead makes
general objections to Plaintiff’s evidence procured during the Hensley litigation and
analyzed by Plaintiff’s expert in this case. (Id. at 22–24).
“The class action is ‘an exception to the usual rule that litigation is conducted
by and on behalf of the individual named parties only.’” Comcast Corp. v. Behrend,
569 U.S. 27, 33 (2013) (citing Califano v. Yamasaski, 442 U.S. 682, 700–701 (1979)).
To meet this exception, a party seeking to maintain a class action “must affirmatively
demonstrate his compliance” with Rule 23 of the Federal Rules of Civil Procedure.
Id. (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011)). This rule
requires a two-part test for certifying a class.
First, the plaintiff must establish the four requirements under Rule 23(a):
(1) the class is so numerous that joinder of all members is
impracticable;
(2) there are questions of law or fact common to the class;
(3) the claims or defenses of the representative parties are typical of
the claims or defenses of the class; and
25

(4) the representative parties will fairly and adequately protect the
interests of the class.
Fed. R. Civ. P. 23(a); see also Gunnells v. Healthplan Servs., 348 F.3d 417, 423 (4th
Cir. 2003). These basic prerequisites are commonly referred to as numerosity,
commonality, typicality, and adequacy, respectively. See id.
Second, if a plaintiff meets all of the requirements of Fed. R. Civ. P 23(a), the
plaintiff must show that the putative class also fits into one of the three categories
enumerated in Rule 23(b). Fed. R. Civ. P. 23(b); Amchem Prod., Inc. v. Windsor, 521
U.S. 591, 614 (1997). Here, Plaintiff seeks certification under Rule 23(b)(3), which
requires that “the questions of law or fact common to class members predominate
over any questions affecting only individual members, and that a class action is
superior to other available methods for fairly and efficiently adjudicating the
controversy.”
1. Rule 23(a) Factors
a. Numerosity
To bring a class action, the class must be so numerous that joinder of all
members is impracticable. Fed. R. Civ. P. 23(a)(1). “No specified number is needed to
maintain a class action.” Brady v. Thurston Motor Lines, 726 F.2d 136, 145 (4th Cir.
1984) (quoting Cypress v. Newport News General & Nonsectarian Hospital Ass’n, 375
F.2d 648, 653 (4th Cir. 1967)). For determining whether the numerosity requirement
is met, it is not necessary to demonstrate with precision the number of persons in a
purported class—reasonable estimates are sufficient. Simpson v. Specialty Retail
Concepts, 149 F.R.D. 94, 98 (M.D.N.C. 1993) (citations omitted). Large class sizes
26

alone may allow a court to presume the impracticability of joinder. Olvera-Morales v.
Int’l Lab. Mgmt. Corp., 246 F.R.D. 250, 256 (M.D.N.C. 2007). The Fourth Circuit has
recognized classes of 74 persons, or as low as 18 persons, can meet the numerosity
requirement. Brady, 726 F.2d at 145.
Plaintiff demonstrates that the proposed class and subclass each consist of at
least several thousand persons. (Doc. No. 37 at 14; Doc. No. 1 at ¶¶ 45–47; Doc. No.
19 at ¶45–47). Thus, the numerosity requirement is met.
b. Commonality
To certify a class action, there must be questions of law or fact common to the
class. Fed. R. Civ. P. 23(a)(2). The commonality prerequisite requires a plaintiff to
show that the class members share both a common contention and a common injury.
Wal-Mart Stores, 564 U.S. at 349–50. “That common contention, moreover, must be
of such a nature that it is capable of classwide resolution—which means that
determination of its truth or falsity will resolve an issue that is central to the validity
of each one of the claims in one stroke.” Id. at 350. Further, the “test for commonality
is not demanding, and is met when there is at least one issue whose resolution will
affect all or a significant number of the putative class members.” Bussian v.
DaimlerChrylser Corp., No. 104CV00387, 2007 WL 1752059, at *5 (M.D.N.C. June
18, 2007) (citing Woodard v. Online Info. Servs., 191 F.R.D. 502, 505 (E.D.N.C. 2000)).
Here, all members of the proposed class are subject to the ultimate question of
“whether Defendant violated the DPPA by disclosing class members’ unredacted
personal information from motor vehicle records without a permissible purpose.”

27

(Doc. No. 37 at 15; Doc. No. 1 at ¶ 113). The resolution of this question will affect all
of the persons in the proposed class. Thus, the commonality element is satisfied.
c. Typicality:
Rule 23 also requires that the claims or defenses of the representative plaintiff
be typical of the claims or defenses of the class. Fed. R. Civ. P. 23(a)(3). “The typicality
requirement is met where the claims asserted by the named plaintiffs arise from the
same course of conduct and are based on the same legal theories as the claims of the
unnamed class members.” Tatum v. R.J. Reynolds Tobacco Co., 254 F.R.D. 59, 65
(M.D.N.C. 2008) (cleaned up). This requirement has “consistently been held to mean
that his claim cannot be antagonistic to the claims of other members.” DeLoach v.
Philip Morris Companies, Inc., 206 F.R.D. 551, 555 (M.D.N.C. 2002) (citation
omitted). In other words, the named plaintiff’s interest must be “sufficiently aligned”
with the interest of the class to ensure confidence in the named plaintiff’s “ability to
adequately represent its interests.” Olvera-Morales, 246 F.R.D. at 258. “Typicality
tends to merge with commonality, insofar as both serve as guideposts for determining
whether under the particular circumstances maintenance of a class action is
economical and whether the named plaintiff’s claim and the class claims are so
interrelated that the interests of the class members will be fairly and adequately
protected in their absence.” Soutter v. Equifax Info. Servs., LLC, 498 F. App’x 260,
264 (4th Cir. 2012) (cleaned up).
Here, the interests of Plaintiff Durham appear to be aligned with the interests
of the class. No antagonism exists between the claims as the claims of the named

28

plaintiff “arise from the same course of conduct” and are based “on the same legal
theories as the class members.” Both the named plaintiff and the class seek to
establish Defendant’s liability and to recover damages based upon Defendant’s
disclosure of DPPA-protected information. (Doc. No. 37 at 17). Plaintiff’s DMV-349,
like the DMV-349 of the class, shows her driver’s license number and has the Address
Box checked. Likewise, Plaintiff and the subclass contend that their personal
information maintained by NCDMV was auto-populated into their respective crash
reports. Therefore, the typicality requirement is met.
d. Adequacy of representation
Class certification also requires that the representative parties will fairly and
adequately protect the interests of the class. Fed. R. Civ. P. 23(a)(4). “The adequacy
inquiry serves to uncover conflicts of interest between named parties and the class
they seek to represent.” Sharp Farms v. Speaks, 917 F.3d 276, 295 (4th Cir. 2019)
(cleaned up). “A class representative must be part of the class and possess the same
interest and suffer the same injury as the class members.” Id. (cleaned up). Adequacy
of representation is divided into two prongs: (1) the party’s attorney must be qualified,
experienced and generally able to conduct the proposed litigation and (2) the litigants
must not be involved in a collusive suit and plaintiff must not have interests
antagonistic to the remainder of the class. DeLoach v. Philip Morris Companies, Inc.,
206 F.R.D. 551, 556 (M.D.N.C. 2002).
Here, as noted in the prior section, Plaintiff does not have interests which are
antagonistic to the class. Further, Plaintiff’s counsel appears qualified, experienced,

29

and generally able to conduct the litigation. Thus, the representative parties will
fairly and adequately protect the interests of the class.
2. Rule 23(b)(3)
Plaintiff seeks certification under Rule 23(b)(3), which requires that “the
questions of law or fact common to class members predominate over any questions
affecting only individual members, and that a class action is superior to other
available methods for fairly and efficiently adjudicating the controversy.” These two
requirements are labeled “predominance” and superiority.”
“In conducting the predominance analysis, a court first characterizes issues as
common or individual.” In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig.,
341 F.R.D. 128, 155 (D. Md. 2022), vacated and remanded sub nom. In re Marriott
Int’l, Inc., 78 F.4th 677 (4th Cir. 2023), and reinstated by In re Marriott Int’l Customer
Data Sec. Breach Litig., 345 F.R.D. 137 (D. Md. 2023) (citing 2 Newberg § 4:50 (5th
ed. 2021)). “Rule 23(b)(3) is normally satisfied where there is an essential common
factual link, such as standardized documents and practices, even though the nature
and amount of damages may differ among class members.” Id. (quoting In re TD
Bank, N.A. Debit Card Overdraft Fee Litig., 325 F.R.D. 136, 154 (D.S.C. 2018)).
“The Rule 23(b)(3) predominance inquiry tests whether proposed classes are
sufficiently cohesive to warrant adjudication by representation.” Amchem Prod., Inc.
v. Windsor, 521 U.S. 591, 623 (1997). The question is whether a plaintiff suing under
the DPPA is likely to be in the same position as many other people and can rely
largely on common proof to make out her claim. See Krakauer v. Dish Network, L.L.C.,

30

925 F.3d 643, 656 (4th Cir. 2019) (explaining that a plaintiff bringing a claim under
a particular statute was likely to be in the same position as a great many other people
and can rely largely on common proof to make out his claim” and certifying the class
under Rule 23(b)(3)).
Plaintiff presents the following questions of law and fact as common to the
class:
1. Whether a DMV-349 in which the Same Address Box is checked “Yes”
is a motor vehicle record;
2. Whether a DMV-349 which openly displays a driver’s license number
is a motor vehicle record;
3. Whether Defendant, by providing unredacted accident reports at its
Records Division, knowingly disclosed protected personal
information from a motor vehicle record;
4. Whether Defendant, by disclosing an unredacted version of each
Class member’s DMV-349, knowingly disclosed information from a
motor vehicle record for a purpose not permitted under the DPPA;
5. Whether Defendant, because of its failure to comply with 18 U.S.C.
§ 2721(c) is estopped to deny, or is otherwise precluded from
contesting, Plaintiff’s contention that each Class member’s
information was obtained without a permissible purpose; and
6. Whether Defendant is estopped to deny, or is otherwise precluded
from contesting, an individual Class member’s claim that at least one
item of his personal information on his DMV-349 came from his
motor vehicle record.
(Doc. No. 37 at 20). Here, there are common issues among the class members that are
subject to the same proof. Members of the class claim the same disclosure of DPPAprotected information from the CMPD records division for marketing purposes. The
resolution of the questions above will permit resolutions of the class members claims.

31

Further, the class members ask only for liquidated damages, thus there is not a need
for individualized damage calculations.
Four factors are considered when analyzing superiority: (1) the class members’
interests in individually controlling the prosecution or defense of separate actions; (2)
the extent and nature of any litigation concerning the controversy already begun by
or against class members; (3) the desirability or undesirability of concentrating the
litigation of the claims in the particular forum; and (4) the likely difficulties in
managing a class action. Fed. R. Civ. P. 23(b)(3).
Here, Plaintiff is unaware of any pending litigation raising similar issues
against Defendant and the cost of litigating this case on an individual basis is
impractical. Further, this Court is the appropriate forum for litigating this matter,
and no potential management issues are foreseen.
3. Ascertainability
A class must also be ascertainable to be certified. Under the ascertainability
principle, “a class cannot be certified unless a court can readily identify the class
members in reference to objective criteria.” Krakauer, 925 F.3d at 655 (quoting EQT
Prod. Co. v. Adair, 764 F.3d 347, 358 (4th Cir. 2014)).
The class members can be clearly identified from Farrin spreadsheets and the
CMPD accident reports. In addition, the subclass can be identified by methods
identified by Plaintiff’s expert to determine which DMV-349s were filled out using
auto-populate.

32

In response to Plaintiff’s motion in regard to ascertainability of the subclass,
Defendant argues that Plaintiff failed to serve an expert designation and violated the
protective order in Hensley by utilizing confidential proprietary discovery obtained in
the course of litigating that case. (Doc. No. 45 at 1, 22–24). There is no indication in
the record that Plaintiff failed to serve an expert designation. Further, the protective
order in this case specifically refers to “documents, testimony, and information” that
has and may be sought, produced, or exhibited in both “this case” and Hensley. (Doc.
No. 29 at 1–2). It appears to the Court that the parties expressly contemplated use of
materials procured in litigating Hensley in the case at bar. Thus, use of those
materials cannot be said to violate the protective order in Hensley, and at this point,
the Court finds no reason to exclude that evidence.
In sum, Plaintiff seeks certification of the following class:
Those (1) who were listed as North Carolina-licensed drivers on DMV349s completed by CMPD officers within the Class Period [November
30, 2017–June 30, 2018]; (2) whose name appears on a Farrin
Spreadsheet; and (3) whose North Carolina driver’s license number is
shown on the DMV-349 or the Same Address Box for the person is
checked “Yes” on the DMV-349.
(Doc. No. 37 at 11). Plaintiff also seeks certification of a subclass consisting of all
members of the Class whose personal information was auto-populated onto a DMV349. (Id. at 11–12).
The Court finds, as detailed in the next section below, that all of the DMV-349
Crash Reports in which the box ‘Same address as driver’s license’ is checked are
“motor vehicle records” as defined by the statute. The Court does not consider
whether other characteristics of the DMV-349 accident reports would result in a
33

classification as a “motor vehicle record.” The Court also does not address whether a
driver’s license is a “motor vehicle record” under the statute. Accordingly, the Court
limits the class definition such that only those with a “motor vehicle record” disclosed
are part of the class. The class is defined as follows:
Those (1) who were listed as North Carolina-licensed drivers on DMV349s completed by CMPD officers within the Class Period [November
30, 2017–June 30, 2018]; (2) whose name appears on a Farrin
Spreadsheet; and (3) the Same Address Box for the person is checked
“Yes” on the DMV-349.
Plaintiff has established the requirements for class certification under Rule 23
for the class, as defined by the Court, and subclass which consists of all members of
the class whose personal information was auto-populated onto a DMV-349. Therefore,
Plaintiff’s Motion to Certify Class is granted, and the class is certified.
C. Plaintiff’s Motion for Summary Judgment
Plaintiff asks this Court to grant summary judgment for herself, and the
members of the class and subclass, on claims for statutory damages under the DPPA
because the uncontradicted evidence shows that Defendant systematically violated
the DPPA by providing copies of police traffic accident reports, containing protected
information, to a marketing support company. (Doc. No. 34 at 2). Defendant responds
by reiterating its arguments that Plaintiff lacks standing and that Defendant is a
state agency that cannot be subject to a private cause of action. Further, Defendant

34

argues that Plaintiff cannot show the elements of a DPPA violation through
admissible evidence. (Doc. No. 52 at 8).3
As noted above, the Drivers Privacy Protection Act provides that “[a] person
who knowingly obtains, discloses or uses personal information, from a motor vehicle
record, for a purpose not permitted under this chapter shall be liable to the individual
to whom the information pertains, who may bring a civil action in a United States
district court.” 18 U.S.C. § 2724(a).
To establish a claim under the DPPA, Plaintiff must show that Defendant (1)
knowingly obtained, disclosed, or used “personal information,” (2) from a “motor
vehicle record,” (3) for a purpose not permitted under the statute. 18 U.S.C. § 2724(a);
Thomas v. George, Hartz, Lundeen, Fulmer, Johnstone, King, & Stevens, P.A., 525
F.3d 1107, 1111 (11th Cir. 2008); see Hatch v. LexisNexis Risk Sols., Inc., No.
319CV00449KDBDCK, 2020 WL 1042256, at *3 (W.D.N.C. Mar. 3, 2020); Wilcox v.
Swapp, 330 F.R.D. 584, 594 (E.D. Wash. 2019).
1. Knowingly obtained, disclosed, or used ‘personal information’
The requirement that the defendant act “knowingly” only applies to the
obtaining, disclosing, or using of the DPPA-protected information, and does not

In addition to the arguments addressed in more depth in the class certification
section regarding confidential information from Hensley, Defendant asserts that
Plaintiff’s “post-deposition Declaration statements that are inconsistent with her
deposition testimony are incapable of creating a genuine issue of material fact.” (Doc.
No. 52 at 2–3). Having reviewed both Plaintiff’s deposition and declaration, the Court
fails to see the inconsistencies that Defendant asserts.
3

35

require that the defendant knowingly violated the statute. Wilcox, 330 F.R.D. at 594–
95; Wiles v. Worldwide Info., Inc., 809 F. Supp. 2d 1059, 1080 (W.D. Mo. 2011).
“Personal information” is “information that identifies an individual, including
an individual’s photograph, social security number, driver identification number,
name, address (but not the 5-digit zip code), telephone number, and medical or
disability information, but does not include information on vehicular accidents,
driving violations, and driver’s status.” 18 U.S.C. § 2725.
Here, the evidence shows that Defendant knowingly disclosed Plaintiff’s
personal information. Plaintiff was involved in an accident on December 4, 2017. The
CMPD officer who investigated Plaintiff’s wreck completed a DMV-349 containing
Plaintiff’s full name, address, date of birth, driver’s license number, and telephone
number. (Doc. No. 1, at ¶ 67; Doc. No. 19, at ¶ 67; Doc. No. 1-2; Doc. No. 32-8 at ¶ 5).
At CMPD, the police officer who investigates a crash submits the DMV-349 Report to
a supervisor for review which is then submitted to the NCDMV. (Doc. No. 39-2, N.
Crum Declaration, at ¶ 15–17).
CMPD, from 2007 or earlier until late 2020, placed one or more copies of each
recent DMV-349 accident report on the front desk of its records division so that
anyone who came into the division could personally view the DMV-349. (Doc. No. 19
at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 11:7–12:25). Defendant has never redacted
personal information as defined by the DPPA from any DMV-349 made publicly
available at the CMPD records division. (Doc. No. 1, at ¶ 53; Doc. No. 19, at ¶ 53).

36

As noted in the standing analysis above, a declaration of Plaintiff’s attorney
states that Plaintiff’s name and address appear in the Farrin firm’s spreadsheets.
(Doc. No. 32-13, Stradley Decl., at ¶ 4). A declaration from Eric Sanchez at the Farrin
Firm details that it only obtained accident reports that were released to the public by
CMPD through its agreement with Digital Solutions. (Doc. No. 32-10, Sanchez Decl.,
at ¶ 5).
The Farrin Firm reviewed the accident reports it received and created its own
spreadsheets. (Id. at ¶ 7). Based on a declaration from Kevin Creech, at Digital
Solutions, Digital Solutions received accident reports, beginning in September 2017,
from sending runners to retrieve the reports from the CMPD records division. (Doc.
No. 32-9, Creech Decl., at ¶ 5). Digital Solutions then provided the accident reports
to the Farrin law firm. (Id. at ¶ 7). This establishes a knowing disclosure of Plaintiff’s
personal information that is protected under the DPPA.
Further, CMPD not only knew of the disclosure but since at least 2011, CMPD
knew that marketers, including law firms that CMPD employees referred to as
“ambulance chasers,” acquired reports in bulk directly from its records division. (Doc.
No. 32-6, CMPD Dep. II, at 13:22–14:14, 15:2–17:12, 18:16–20:5).
Here, there is no genuine dispute as to any material fact from which a
reasonable jury could conclude that the accident reports of Plaintiff and those
similarly situated were not knowingly disclosed. The only evidence presented shows
that the accident reports were disclosed from the CMPD records division and made

37

their way to Digital Solutions and then to the Farrin firm. Thus, Plaintiff has
established that CMPD knowingly disclosed her “personal information.”
2. From a ‘motor vehicle record’
To succeed in establishing her claim under DPPA, Plaintiff must show that
Defendant disclosed “personal information” from a “motor vehicle record.” Garey v.
James S. Farrin, P.C., 35 F.4th 917, 929 (4th Cir. 2022) (“[A] DPPA plaintiff must
allege and prove that the defendant obtained the plaintiff'’s personal information
‘from a motor vehicle record.’”). A “motor vehicle record” under the DPPA is “any
record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor
vehicle registration, or identification card issued by a department of motor vehicles.”
18 U.S.C. § 2725(1).
In determining what meets the definition of a “motor vehicle record,” this Court
in Gaston found that “all of the DMV Form 349 Crash Reports in which the box ‘Same
address as driver’s license’ is checked are ‘motor vehicle records’ under the statutory
definition.” 483 F. Supp. 3d at 336. The Court concluded that “the accident report is
plainly a record that ‘pertains to’ the driver’s license and thus qualifies as a ‘motor
vehicle record’ under the DPPA,” reasoning that “[r]egardless of whether the initial
source of the address information was the accident participant’s records in the DMV
database (using the F11 function), or a driver’s license, or if the driver’s license was
only used to confirm earlier provided information, everyone who has access to the

38

Crash Reports knows the address on that individual’s driver’s license just the same
as if they had the person’s driver’s license in their hands.” Id. at 337.
In Garey, the Fourth Circuit did not reach the question of whether an accident
report was a “motor vehicle record,” but noted that the Court in Gaston determined
that it was. Garey, 35 F.4th at 927. As Defendant observes, the Fourth Circuit
expressed doubt regarding whether “motor vehicle records” include accident reports.
The Fourth Circuit explained the following:
On the one hand, there is a non-frivolous textual argument that
an accident report is a “record that pertains to a motor vehicle operator’s
permit,” because the report indicates whether a driver’s address is the
same as that shown on their license. Indeed, a district court in our
circuit recently held that the exact same kind of accident report at issue
here is a “motor vehicle record” within the meaning of the DPPA. On the
other hand, several courts have limited a DPPA “motor vehicle record”
to those documents held by a state DMV, which would exclude the
accident reports in question. We need not and do not reach this question,
because the Plaintiffs have failed to preserve this argument.
Garey v. James S. Farrin, P.C., 35 F.4th 917, 927–28 (4th Cir. 2022) (citations
omitted). Ultimately, the court of appeal did not decide the issue of whether an
accident report is a “motor vehicle record” under the DPPA, so it remains an open
question in the Fourth Circuit.
Since the Fourth Circuit’s ruling in Garey, another district court in the Fourth
Circuit has found that when it is not disputed that the personal information
contained in each accident report came from a NCDMV database, those reports are a
“motor vehicle record.” McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F.
Supp. 3d 769, 777 (M.D.N.C. 2023).

39

The Court concludes that all of the DMV-349 Crash Reports in which the box
‘Same address as driver’s license’ is checked are motor vehicle records under the
statutory definition. Plaintiff’s accident report and the accident reports of the class
members include that checked box. Thus, the personal information disclosed from the
DMV-349 accident reports with the appropriate box checked are disclosed from a
“motor vehicle record.”
However, even if an accident report standing alone is not considered a “motor
vehicle record,” Plaintiff has also established that the personal information in the
accident reports which contain “dataclips” came from the DMV database. (Doc. No.
34 at 17–19). When using the ReportBeam software, the F11 key causes the officer’s
computer to automatically fill-in the blanks on the DMV-349 form with the driver’s
personal information, including her name and address. (Doc. No. 32-1, CMPD Dep. I
at 25:4–10, 118:20–119:8). Using auto-populate for the DMV-349, means the driver’s
name and address come from the DMV database. (Doc. No. 32-1, CMPD Dep. I at
21:20–22:1, 25:4–10, 119:2–120:8; Doc. No. 32-4, Prince Aff., at ¶¶ 4–7).
The presence of the “dataclip” associated with a particular report shows that
the CMPD officer used the auto-populate feature to insert the driver’s personal
information taken from the DMV database into the accident report. (Doc. No. 33-2,
Selvaraj Decl. at ¶ 3; Doc. No. 33-3, Supp. Selvaraj Decl. ¶¶ 2(d), 3).
In opposition, Defendant contends, as its witness Nathan Crum explained, that
he and other BLET instructors—past and present—always train CMPD police
recruits not to use the auto-populate F-11 function when filling out the demographic

40

information in a DMV-349, but rather to fill in the individual’s information such as
driver’s license number, name, address, etc. manually on the report. Defendant uses
this information to assert that officer’s do not use the F-11 function.
Viewing the facts in the light most favorable to Defendant, the Court concludes
that a reasonable jury could not find in favor of Defendant. Defendant does not
meaningfully dispute the fact that a “dataclip” shows that the information in an
accident report originated with the DMV database. Instead, Defendant challenges
how the evidence was obtained and contends that officers were trained not to autopopulate the information into the accident report. This is insufficient to create a
genuine issue of material fact.
In sum, the Court concludes that a DMV-349 accident report where the “Same
address as driver’s license” is checked is a “motor vehicle record” as a matter of law.
Thus, the disclosure of personal information from this report for an impermissible
purpose is a violation of the DPPA. Accident reports belonging to Plaintiff and the
class members have the “Same address as driver’s license” box checked, and are thus,
“motor vehicle records” subject to DPPA protection. Further, even if the DMV-349
accident reports could not be said to be “motor vehicle records,” Plaintiff has
established that the presence of a “dataclip” indicates that the materials were autopopulated from the DMV database. Thus, even if the definition of a “motor vehicle
record” is limited to documents held by a state DMV, Plaintiff can still prevail by
showing the information came from the DMV database. See Maracich v. Spears, 570
U.S. 48, 52 (2013) (“Respondents are trial lawyers . . . [who] obtained names and

41

addresses of thousands of individuals from the South Carolina DMV in order to send
[attorney solicitation materials].”); see also Garey, 35 F.4th at 927.
3. For a purpose not permitted under the statute
Marketing is not a permissible purpose for disclosing protected information
from motor vehicle records under the DPPA. Maracich v. Spears, 570 U.S. 48, 66–67
(2013).
Here, Plaintiff’s evidence shows that CMPD knew, since at least 2011, that
marketers, including law firms that CMPD employees referred to as “ambulance
chasers,” acquired reports in bulk directly from its records division. (Doc. No. 32-6,
CMPD Dep. II, at 18:16–20:6). CMPD nevertheless did not redact any of the personal
information on the DMV-349s it made available to the public. (Doc. No. 19 at ¶ 53;
Doc. No. 32-1, CMPD Dep. I, at 147:9–20; Doc. No. 32-6, CMPD Dep. II, at 31:19–24).
Defendant asserts that the purpose of disclosure, to the extent that reports
were disclosed, was not improper because the information was made available
pursuant to North Carolina public records law and an opinion of the North Carolina
attorney general. (Doc. No. 52 at 7). See 2005 N.C. AG Lexis 1. This argument has
failed at least once before, and the Court finds no reason to reach a different result
now. See Gaston, 483 F. Supp. 3d at 346–47 (concluding that “to the extent that
CMPD provides such records to the public without redacting that personal
information or limiting disclosure only for those uses permitted by the DPPA then it
is in violation of the statute” whether or not they are “public records” and reasoning
that “it would completely undermine the purpose of the DPPA if a state could simply

42

designate a document containing personal information subject to DPPA protection as
a ‘public record’ and thereby avoid complying with its restrictions”); see also
McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F. Supp. 3d 769, 777
(M.D.N.C. 2023) (rejecting the argument that a police department’s release of
personal information in response to a public records request falls within the
“government function” exception to the DPPA).
4. Damages
Further, section 2724 provides that a person who violates the statute “shall be
liable to the individual to whom the information pertains” and that “[t]he court may
award . . . actual damages, but not less than liquidated damages in the amount of
$2,500.” 18 U.S.C. § 2724.
Plaintiff seeks only liquidated statutory damages. Because Plaintiff has shown
a violation of DPPA as a matter of law, she, and those similarly situated, are entitled
to statutory damages. Accordingly, Plaintiff’s Motion for Summary Judgment is
granted.
IV.

CONCLUSION
IT IS, THEREFORE, ORDERED that:
1. Defendant’s Motion to Dismiss and Motion for Summary Judgment, (Doc.
No. 39), are DENIED;
2. Plaintiff’s Motion to Certify Class, (Doc. No. 36), is GRANTED; and

3. Plaintiff’s Motion for Summary Judgment, (Doc. No. 32), is GRANTED.
Signed: September 24, 2024

43