Gaston et al v. LexisNexis Risk Solutions, Inc. et al
Filing
148
ORDER granting in part and denying in part 101 Motion to Certify Class; granting in part and denying in part Plaintiffs' 107 Motion for Summary Judgment; denying Defendants' 109 Motion for Summary Judgment; denying as moot 103 Motion to Appoint Interim Co-Lead and Liaison Counsel and 120 Motion to Stay. Signed by District Judge Kenneth D. Bell on 9/2/2020. (nvc)
IN THE UNITED STATES DISTRICT COURT
FOR THE WESTERN DISTRICT OF NORTH CAROLINA
STATESVILLE DIVISION
CIVIL ACTION NO. 5:16-CV-00009-KDB-DCK
DELORIS GASTON AND
LEONARD GASTON,
Plaintiffs,
v.
ORDER
LEXISNEXIS RISK SOLUTIONS,
INC. AND POLICEREPORTS.US,
LLC,
Defendants.
THIS MATTER is before the Court on Plaintiff’s Motion to Certify Class (Doc. No. 101),
Plaintiffs’ Motion for Appointment of Interim Co-Lead and Liaison counsel (Doc. No. 103), the
parties’ cross Motions for Summary Judgment (Doc. Nos. 107, 109) and Defendants’ Motion to
Stay a ruling on Plaintiffs’ Motion for Summary Judgment (Doc. No. 120). The Court has carefully
considered these motions, the parties’ extensive briefs and exhibits and oral argument on the
motions from the parties’ counsel on August 27, 2020. For the reasons and in the manner discussed
below, the Court will GRANT in part and DENY in part Plaintiff’s class certification motion,
GRANT in part and DENY in part Plaintiff’s Motion for Summary Judgment and DENY
Defendants’ summary judgment motion, the motion for interim appointment of counsel and the
motion to stay.
With respect to class certification, the Court declines to certify the nationwide, statewide
and Rule 23(b)(1) and 23(b)(3) money damages classes sought by Plaintiffs, but will certify a
1
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 1 of 49
class under Federal Rule of Civil Procedure 23(b)(2) to consider Plaintiffs’ claim for injunctive
relief under the Driver’s Privacy Protection Act (“DPPA,”) 18 U.S.C. § 2721, et seq., as limited
below. Concerning the appointment of counsel, there does not appear to be a dispute that Plaintiffs’
counsel will adequately represent the limited class certified by the Court so Plaintiffs’ counsel will
be appointed Class counsel pursuant to Rule 23(g) and the motion to appoint interim counsel will
accordingly be denied as moot.
On the parties’ cross motions for summary judgment, the Court holds that based on the
Court’s finding that North Carolina accident reports that indicate that the address that appears in
the report is the same as on a driver’s license are “motor vehicle records” under the statute and
Defendants’ admission that they disclosed the reports without regard to whether the personal
information in the reports would be used for a purpose permitted by the DPPA (as well as the
undisputed evidence that at least some of those reports were used for an impermissible purpose),
Plaintiffs are entitled to summary judgment on their claim for injunctive relief to end Defendants’
unlawful practices. However, because there are genuinely disputed material issues of fact
regarding whether the Plaintiffs’ accident reports were disclosed for a purpose not permitted by
the DPPA, Plaintiff’s motion for summary judgment on their claim for liquidated damages must
be denied. Further, Defendants are not entitled to summary judgment because the Court finds they
are liable for injunctive relief as discussed above and do not have immunity, qualified or otherwise,
based on their alleged “public service” in making the accident reports available. Finally, having
determined that no class will be certified under Rule 23(b)(3) and that the summary judgement
motions will be denied, Defendants’ Motion to Stay will be denied as moot.
2
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 2 of 49
I.
LEGAL STANDARD
Plaintiffs seeking class certification “must affirmatively demonstrate [their] compliance”
with Federal Rule of Civil Procedure 23. Wal–Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350
(2011). Rule 23(a) requires that a prospective class satisfy four prerequisites to ensure that the
class claims are fairly encompassed by those of the named plaintiffs. See Fed. R. Civ. P. 23(a).
These prerequisites are often referred to as numerosity, commonality, typicality, and adequacy.
See Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 654 (4th Cir. 2019). The Fourth Circuit
has also recognized that Rule 23 “contains an implicit threshold requirement” of
“ascertainability” – that the members of a proposed class be “readily identifiable” by way of
reference to objective criteria. See id. at 654–55. If these initial requirements are met, the
plaintiffs must then demonstrate that the proposed class fits within at least one of the three types
of classes outlined in Rule 23(b). Id. at 655.
Although it is Plaintiffs’ burden to demonstrate compliance with Rule 23, this Court “has
an independent obligation to perform a ‘rigorous analysis’ to ensure that all of the prerequisites
have been satisfied.” EQT Prod. Co. v. Adair, 764 F.3d 347, 358 (4th Cir. 2014) (quoting Dukes,
564 U.S. at 350–51). As Rule 23’s criteria are often “enmeshed in the factual and legal issues
comprising the plaintiff’s cause of action,” this analysis may entail some consideration of the
merits of the underlying claims. See Dukes, 564 U.S. at 351. However, “Rule 23 grants courts no
license to engage in free-ranging merits inquiries at the certification stage. Merits questions may
be considered to the extent—but only to the extent—that they are relevant to determining whether
the Rule 23 prerequisites for class certification are satisfied.” Amgen Inc. v. Conn. Ret. Plans &
Trust Funds, 568 U.S. 455, 466, 133 S.Ct. 1184, 185 L.Ed.2d 308 (2013).
3
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 3 of 49
An order that certifies a class action must define the class and the class claims, issues or
defenses, and must appoint counsel under Rule 23(g). Fed. R. Civ. P. 23 (c)(1)(B). In appointing
class counsel, the court must consider the work counsel has done in identifying and investigating
the potential claims, counsel’s relevant experience and knowledge of the applicable law and the
resources that counsel will commit to representing the class. Fed. R. Civ. P. 23(g)(1)(A). Also,
the Court may consider any other matter pertinent to counsel’s ability to fairly and adequately
represent the interests of the class. Id. at Rule 23(g)(1)(B).
Summary judgment must be granted “if the movant shows that there is no genuine dispute
as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P.
56. A factual dispute is considered genuine “if the evidence is such that a reasonable jury could
return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248
(1986). “A fact is material if it might affect the outcome of the suit under the governing law.”
Vannoy v. Federal Reserve Bank of Richmond, 827 F.3d 296, 300 (4th Cir. 2016) (quoting
Libertarian Party of Va. v. Judd, 718 F.3d 308, 313 (4th Cir. 2013)).
The party seeking summary judgment bears the initial burden of demonstrating the absence
of a genuine issue of material fact through citations to the pleadings, depositions, answers to
interrogatories, admissions or affidavits in the record. See Celotex Corp. v. Catrett, 477 U.S. 317,
323 (1986); Bouchat v. Baltimore Ravens Football Club, Inc., 346 F.3d 514, 522 (4th Cir. 2003).
“The burden on the moving party may be discharged by ‘showing’ ... an absence of evidence to
support the nonmoving party's case.” Celotex, 477 U.S. at 325. Once this initial burden is met, the
burden shifts to the nonmoving party. The nonmoving party “must set forth specific facts showing
that there is a genuine issue for trial.” Id. at 322 n.3. The nonmoving party may not rely upon mere
4
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 4 of 49
allegations or denials of allegations in his pleadings to defeat a motion for summary judgment. Id.
at 324.
When ruling on a summary judgment motion, a court must view the evidence and any
inferences from the evidence in the light most favorable to the nonmoving party. Tolan v. Cotton,
572 U.S. 650, 657 (2014); see also Anderson, 477 U.S. at 255. “Summary judgment cannot be
granted merely because the court believes that the movant will prevail if the action is tried on the
merits.” Jacobs v. N.C. Admin. Office of the Courts, 780 F.3d 562, 568-69 (4th Cir. 2015) (quoting
10A Charles Alan Wright & Arthur R. Miller et al., Federal Practice & Procedure § 2728 (3d
ed.1998)). “The court therefore cannot weigh the evidence or make credibility determinations.”
Id. at 569 (citing Mercantile Peninsula Bank v. French (In re French), 499 F.3d 345, 352 (4th Cir.
2007)).
However, “[w]here the record taken as a whole could not lead a rational trier of fact to find
for the nonmoving party, there is no genuine issue for trial.” Ricci v. DeStefano, 557 U.S. 557, 586
(2009) (internal citations omitted). “Only disputes over facts that might affect the outcome of the
suit under the governing law will properly preclude the entry of summary judgment. Factual
disputes that are irrelevant or unnecessary will not be counted.” Anderson, 477 U.S. at 248. Also,
the mere argued existence of a factual dispute does not defeat an otherwise properly supported
motion. Id. If the evidence is merely colorable, or is not significantly probative, summary judgment
is appropriate. Id. at 249-50.
In the end, the question posed by a summary judgment motion is whether the evidence as
applied to the governing legal rules “is so one-sided that one party must prevail as a matter of law.”
Id. at 252.
5
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 5 of 49
II.
FACTS AND PROCEDURAL HISTORY
Plaintiffs Leonard and Delores Gaston are a married couple who live in Charlotte, North
Carolina. Defendant LexisNexis Risk Solutions, Inc. (“LexisNexis”) is a Georgia corporation that
provides data and information to various professionals and industries around the world. Defendant
PoliceReports.US, LLC, (“PRUS”) is a North Carolina corporation that is an online distributor of
vehicle accident/crash reports throughout the United States, including North Carolina. PRUS was
acquired by LexisNexis in 2014.
In 2012 and 2015, the Gastons were involved in car accidents in Charlotte. After each
accident, the responding CMPD officer prepared a Crash Report that included personal
information, including their name, address and driver’s license number. Further, the Crash Report
specifically indicated that the address provided was the same as appears on their driver’s license.
In this action, the Gastons allege on their own behalf and as representatives of several proposed
putative classes that Defendants violated the DPPA by unlawfully using and disclosing Plaintiffs’
personal driver information in the Crash Reports without Plaintiffs’ consent.
The process by which Crash Reports are prepared and the source of the personal
information that appears in the reports is one of the core issues in the parties’ dispute. Law
enforcement agencies in North Carolina are obligated to investigate motor vehicle accidents which
are reported to them, and any driver who is involved in a motor vehicle accident in North Carolina
is required by law to produce a driver’s license and registration card for the vehicle on request of
a law enforcement officer. N.C. Gen. Stat. § 20-29, 20-57-(c). In conducting accident
investigations, law enforcement officers in North Carolina use a standard form promulgated by the
North Carolina Division of Motor Vehicles (“DMV”), known as a DMV-349, to record their
6
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 6 of 49
investigations of reportable crashes. When law enforcement officers complete the DMV-349 in
connection with an accident investigation, they include specific personal information about the
driver and others involved in the accident, including name, address and driver’s license number.
Also, there is a box that may be checked to indicate whether the address information is the “Same
Address on Driver’s License?”.
CMPD and other law enforcement officers in North Carolina theoretically can collect
information to create a Crash Report through various means. Crash Reports can be prepared using
an electronic crash reporting software application known as Report Beam, which interacts with a
CMPD officer’s Computer Automated Dispatch (CAD) system. (See Doc. No. 122-3 at ¶ 5). “CAD
has the ability to interface with a variety of third party databases, including the National Crime
Information Center (NCIC) and the North Carolina Division of Criminal Information (DCI), and
return available information relating to the driver’s license number or license tag, such as the
driver’s name, address, date of birth and insurance information.” (Id. at ¶ 6.) For North Carolina
driver’s licenses and tags, officers can “pre-populate the driver information in a crash report form
with the information returned by the CAD-connected databases by using the F11 function in
Report Beam.” (Id. at ¶ 7.) 1 “For non-North Carolina residents, the F11 function is available, but
available information returned must be verified.” (Id. at ¶ 8.) Officers may, for example, “ask a
person to orally report his or her name and address” at the scene of the accident. (Doc. No. 122-2
(CMPD Dep. Tr. 63:3–7.)) Also, in some cases officers might collect “demographical information
Defendants suggest that this software might not be working in every instance and “officers may
choose to manually enter an involved party’s information into a crash report.” (Id. at ¶ 11.) Further,
they note that “[t]he CMPD’s policies and procedures do not mandate that officers use the F11
function for creating crash reports.” (Id.)
1
7
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 7 of 49
through driver’s licenses [or] registration of [sic] cards,” (Id. at 13:4–7.), which officers can write
that information down on their notepads. (Id. at 13:20–14:4.). However, in all cases, the completed
Crash Report does not include any indication of whether the information was manually entered or
whether the officer used the F11 function. (Id.) (See Doc. No. 122-3 at ¶ 11).
Plaintiffs assert that in their accidents and almost all of the accidents involving other
putative North Carolina class members, the investigating officers electronically accessed their
personal information, including driver identification numbers, names, and addresses, from
information maintained by the DMV and then integrated that personal information obtained from
the DMV into the Crash Report using electronic crash reporting software. In support of this claim,
they offer an affidavit of Officer Nicholas Bush of the CMPD. See Doc. No. 101-13.2 Officer Bush
testified that in the field he created thousands of crash reports using the Report Beam crash
reporting software. Id. at ¶ 4. He further testified that he taught other officers at the CMPD how to
use the Report Beam crash reporting software, including the use of the F11 function to speed up
the crash reporting process. Id. at ¶ 6. Most specifically, he testified that he transmitted accident
reports using the e-crash software directly from his vehicle 95% to 98% of the time and used the
data from the NC Division of Criminal Information to populate the crash reports. 3 Id. at ¶ 10 and
11. He manually typed only a small percentage of his accident reports. Id. at ¶ 10 and 14. However,
2
Officer Bush provided several affidavits in this case to both parties. His March 2020 affidavit
offered into evidence by the Plaintiffs is his most recent and detailed affidavit, although it is not
inconsistent with his earlier affidavits.
3
Wayne Pettingill, a Special Agent in charge of the Criminal Information and Identification
Section of the North Carolina Statue Bureau of Investigation, testified that when “a police officer
in the field queries driver and vehicle information through the North Carolina Division of Criminal
Information, the information returned to the officer’s computer is derived from the NCDMV
database in real time.” See Declaration of Wayne Pettingill, Doc. No. 101-14 at ¶ 5.
8
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 8 of 49
Officer Bush testified that for the one of the Plaintiffs’ accidents for which he was the investigating
officer and the other thousands of accident reports he has prepared, he has “no independent
recollection of what occurred during the call for service beyond what is contained in the report.”
See Doc. No. 122-3 at ¶ 12.
Accordingly, it appears (and the parties do not dispute) that because police officers
collectively prepare thousands of Crash Reports and the reports do not themselves indicate the
source of the personal information in the report, the source of the personal information in any
particular Crash Report is, as a practical matter, unknown and generally unknowable to an absolute
certainty very shortly after the accident. However, it also appears that the Crash Reports were
prepared using computer software and information from the DMV databases in at least a very
substantial number of cases – and particularly so for at least for one CMPD officer.
During the relevant period, PRUS entered into contracts to make CMPD’s Crash Reports
available online. See Doc. 137-5. In those agreements with CMPD, PRUS is authorized to provide
online access to Crash Reports as well as a “bulk/subscription download capability” to customers
on a set price schedule. Also, while those contracts do not mention the DPPA nor specifically limit
the manner in which the reports can be provided to the public (with the exception of the prices that
PRUS can charge for access to the reports), the contracts do not provide a blanket authority to
allow access to the Crash Reports without regard to Federal law. On the contrary, the contracts
require that PRUS “comply with all applicable federal, state and local laws and regulations …”
and further include a specific representation that “the Company shall comply in all material
respects with all applicable federal, state and local laws, regulations and guidelines in providing
the Services… .”
9
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 9 of 49
Pursuant to the CMPD / PRUS agreements, the Crash Reports related to Plaintiffs’
accidents, and allegedly over 262,000 other Crash Reports, were transmitted to PRUS and made
available on PRUS’ eCommerce web portal without redaction4 of any personal information during
the alleged class period from 2012 to the present. (R. Marler Decl. at ¶ 6.).5 Further,
contemporaneously with sending Crash Reports electronically to PRUS, CMPD also separately
sent an electronic copy of the Crash Report to the DMV, which maintained the reports in its
records. So, both PRUS and DMV received copies of the same Crash Reports on each reportable
accident. However, CMPD and DMV handled the disclosure of the Crash Reports very differently.
As described, CMPD made the reports available through PRUS and in person without any
redaction or restriction. On the other hand, DMV, acting pursuant to N.C. Gen. Stat. § 20-43.1,
limited disclosure of the crash reports in accordance with the DPPA, requiring any individual or
entity that obtained a report to complete a form (TR-67) that states that “[a] crash report is a motor
4
While the Crash Reports that were available to the public and monthly subscribers were not
redacted, Defendants testified they had the capability to pull selected information from the reports
and did so for select customers. For example, the Defendants sold information from their crash
reports to Carfax but redacted any personal information about the drivers or owners from the data
shared with Carfax. See Doc. No. 108-4, Huneycutt Deposition 107:17-23 and Doc. No. 108-6,
Marler Deposition 132:7-134:7.
5
While none of these reports were redacted, a person accessing individual reports without a
subscription (which apparently provided unlimited access with no need for further information)
could obtain unredacted reports with identifying information such as the driver name, etc. (“…
accident reports [are] available to parties or entities who had the following information: report
number, report date, driver name or location.”). See Ex. 4, Declaration of William Ramirez ¶ 5, 6,
7, and 8; Ex. 5, Declaration of Michelle Tran ¶ 5, 6, 7 and 8; Ex. 6, Deposition of Son Doan 59:665:25. Thus, an individual without a subscription could still access every report merely by
requesting all reports for every day of the year.
10
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 10 of 49
vehicle record” and emphasizes that personal information may only be accessed for a permissible
use as defined in the DPPA. See Doc. 139 at 2-3.
In addition to making individual unredacted crash reports available, the Defendants sold
monthly Crash Support access subscriptions to numerous customers, who were primarily body
shops, chiropractic offices, and law firms, which allowed the customers to have unlimited access
to all crash reports available from the Defendants. Doc. No. 107-3 (PRUS Supplemental Responses
to Interrogatories dated January 13, 2020, Response to No. 1); Doc. No. 107-4 (PRUS Amended
Responses to RFP dated October 11, 2018). The Defendants made 750 reports available at a time,
and then these reports would be gradually replaced as new reports were made available by the
Defendants. Customers of the Defendants could review these reports anytime and did not have to
provide any permissible use to access them. The Defendants did not keep records of the Crash
Reports viewed or downloaded by their monthly subscription customers, see Doc. No. 108-6,
Marler Deposition at pp. 103-107, and did not request, obtain or keep any information regarding
the use for which its customers were obtaining the Crash Reports.
With respect to the use made of Plaintiffs’ information, the Gastons testified that they
received numerous solicitations by both telephone and mail after the crash in February 2012, but
the identification of those solicitations is unknown or disputed. As to the putative class members
more generally, the parties also dispute the extent to which Defendants’ monthly subscription
customers viewed and used their personal information for marketing and soliciting purposes, but
there is substantial evidence that numerous monthly subscription customers used the personal
information in the Crash Reports for the purpose of marketing and solicitation. See Doc. No. 1071 at p.4-5, citing Doc. Nos. 107-6, 107-7, 107-8, 107-9 and 101-5.
11
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 11 of 49
Beyond CMPD and North Carolina, Defendants resell crash reports for numerous law
enforcement agencies around the nation. Plaintiffs allege that law enforcement agencies in the state
of New York and elsewhere similarly use software to create accident crash reports. However,
Plaintiffs have not offered any specific testimony of the manner and prevalence of the use of the
software outside of CMPD.
With respect to class claims, Plaintiffs seek to certify and represent a nationwide class of
Plaintiffs seeking declaratory and injunctive relief, pursuant to the provisions of Fed. R. Civ. P.
23(a), 23(b)(1)(A), 23(b)(2) and Rule 23(b)(3), defined as:
Class 1 – Nationwide
All persons in the United States who, within four (4) years prior to the date
of January 12, 2016 through the final disposition of this or any related actions (the
“Class Period”), had their personal information (as defined by the DPPA, effective
during the Class Period) contained in motor vehicle records of their State Motor
Vehicle Departments obtained, used, disclosed, re-disclosed, and/or resold by the
named Defendants, for purposes not permitted by the DPPA, or without
establishing a permissible purpose required by the DPPA, without their express
consent.
Subclass 1 -North Carolina and New York Vehicle Owners and Drivers
All North Carolina and New York driver's license holders and North
Carolina and New York vehicle owners who within four (4) years prior to the date
of January 12, 2016, through the final disposition of this or any related actions (the
“Class Period”), had their personal information (as defined by the DPPA, effective
during the Class Period) contained in motor vehicle records of the North Carolina
or New York Motor Vehicle Departments obtained, used, disclosed, re-disclosed,
and/or resold by the named Defendants, for purposes not permitted by the DPPA,
or without establishing a permissible purpose required by the DPPA, without their
express consent.
Subclass 2 – All Vehicle Owners and Drivers CMPD crash reports
All driver's license holders and owners who within four (4) years prior to
the date of January 12, 2016, through the final disposition of this or any related
12
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 12 of 49
actions (the “Class Period”), had their personal information (as defined by the
DPPA, effective during the Class Period) contained in motor vehicle records of the
North Carolina Department of Motor Vehicles obtained, used, disclosed, redisclosed, and/or resold by the named Defendants, for purposes not permitted by
the DPPA, or without establishing a permissible purpose required by the DPPA,
without their express consent.
Plaintiffs seek the following class-wide relief under the DPPA. First, they seek a judgment
that the Defendants (1) breached the DPPA by disclosing or making available their and class
members’ personal information to third-parties that did not have a permissible use to view or obtain
such information; and (ii) violated 18 U.S.C. § 2721(c) by failing to keep records of the persons
or entities who obtained or viewed this information and the permissible use of each such disclosure.
Plaintiffs allege they suffered actual damages and claim they and the members of the class are
entitled to at least minimum statutory damages of $2,500.00 for the impermissible disclosures to
third parties, plus injunctive relief, punitive damages, and attorneys’ fees.
III.
A.
DISCUSSION
Class Certification
As noted above, because the requirements of Rule 23 are often “enmeshed in the factual
and legal issues comprising the plaintiffs’ cause of action,” Dukes, 564 U.S. at 351, the Court must
“rigorously examine” the core issues of the case at the certification stage, while not overstepping
this task to prematurely decide the merits of the Plaintiffs’ claims. The Court will proceed with
this examination in three stages. First, the Court will discuss the DPPA because the elements of
class certification cannot be thoughtfully considered without a careful understanding of the cause
of action alleged. Next, the Court will address each of the Rule 23(a) threshold requirements
applicable to all class actions, commonly referred to as
“numerosity,” “commonality,”
“typicality,” and “adequacy,” as well as the implicit requirement that the class be “readily
13
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 13 of 49
identifiable” or ascertainable. See Fed. R. Civ. P. 23(a), Krakauer, 925 F. 3d at 654-55. Finally,
the Court will discuss whether and how the proposed classes fit (or do not fit) into each of the
specific forms of class adjudication provided by Rule 23(b).
1.
The DPPA
The application of Rule 23 often turns on the cause of action. See, e.g., Erica P. John Fund,
Inc. v. Halliburton, 563 U.S. 804, 809 (2011). Rule 23 is designed to, among other goals, make it
possible to efficiently decide class-wide questions and identify those who may be affected by a
judgment. To determine if those questions exist requires consideration of the asserted claim and
its elements. As stated in Krakauer, “[e]fficient and manageable classes require common proof,
and the availability of such proof turns on what exactly needs to be proven.” Id. at 655.
At its core, the DPPA is a public safety statute designed to protect citizens from the danger
and annoyance that may result from the unnecessary disclosure of their personal information.
Enacted in 1994 as a result of the stalking and, in some cases, murders of women whose assailants
obtained their addresses and other personal information from state DMV offices, the DPPA is a
seemingly straightforward statute that has proven to be decidedly less so in its application to
commercial efforts to monetize this information, such as the online databases offered by
Defendants. In Section 2721, the DPPA prohibits state DMV departments and their officers,
employees and contractors from, inter alia, disclosing or otherwise making available “personal
information” obtained by the DMV in connection with a “motor vehicle record” for any purpose
not specifically listed in 18 U.S.C. §2721(b). See 18 U.S.C. §2721(a) (1). The statute also expressly
prohibits private individuals from “knowingly ... obtain[ing] or disclos[ing] personal information,
from a motor vehicle record, for any use not permitted under section 2721(b).” 18 U.S.C. §
14
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 14 of 49
2722(a). “Personal information” is defined in the statute as “information that identifies an
individual, including an individual’s photograph, social security number, driver identification
number, name, address (but not the 5-digit zip code), telephone number, and medical or disability
information, but does not include information on vehicular accidents, driving violations, and
driver’s status.” 18 U.S.C. § 2725(3). A “motor vehicle record” includes “any record that pertains
to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identity card
issued by a department of motor vehicles.” 18 U.S.C. § 2725(1).
There are fourteen permissible purposes described in 18 U.S.C. § 2721(b), including, for
example, to allow governmental agencies and law enforcement to carry out their functions and to
inform vehicle owners of safety recalls. Significantly, however, marketing and solicitation efforts
are not permissible purposes under the statute. See Maracich v. Spears, 570 U.S. 48, 60-61 (2013).
Section § 2721 (c) further describes the requirements for the resale or redisclosure of this personal
information, i.e. disclosure by those, including Defendants, who obtain information protected by
the DPPA from the DMV or other governmental agencies. Under the DPPA, an authorized
recipient that resells or rediscloses personal information must keep for a period of 5 years records
identifying each person or entity that receives information and the permitted purpose for which the
information will be used. 18 U.S.C. § 2721 (c).
Finally, in Section 2724 (entitled “Civil Action”), the DPPA provides a “cause of action”
that makes any person who “knowingly obtains, discloses or uses personal information, from a
motor vehicle record, for a purpose not permitted under [the statute] … liable to the individual to
whom the information pertains.” 18 U.S.C. § 2724 (a). A person who brings a civil action under
this section, can recover “(1) actual damages, but not less than liquidated damages in the amount
15
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 15 of 49
of $2500; (2) punitive damages …; (3) reasonable attorneys’ fees and … costs …; and (4) such
other preliminary and equitable relief as the court deems to be appropriate.” 18 U.S.C. § 2724 (b).
2.
Rule 23 (a) Factors
a)
Ascertainability and Numerosity
Apart from its specifically enumerated requirements, “Rule 23 contains an implicit
threshold requirement that the members of a proposed class be ‘readily identifiable.’” EQT Prod.
Co. v. Adair, 764 F.3d 347 (4th Cir. 2014). Under this principle, often called “ascertainability,” “a
class cannot be certified unless a court can readily identify the class members in reference to
objective criteria.” Id. The Court finds that the proposed class members are ascertainable on these
terms. Plaintiffs seek to certify classes of those individuals whose personal information sourced
from DMV records is contained in Crash Reports that Defendants made available electronically to
its customers.
It is indisputable that a vast number of individuals have had their DMV personal
information sold, made available and disclosed to persons who did not have a permissible use for
the information. Members of this class are thus easily defined by objective criteria. Defendants
argue, though, that because the identity of each class member cannot be known with absolute
certainty (because a Crash Report does not definitively disclose the source of the personal
information in the report) no class can be certified. To the extent this is true, it is because the
North Carolina DMV, CMPD and Defendants employ a system that makes it so, thereby entirely
frustrating the public safety goals of the DPPA. Indeed, if Defendants’ arguments prevailed no
16
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 16 of 49
class of clearly wronged individuals could ever be certified. Also, ascertainability does not require
that every member of the class must be knowable to an absolute certainty. 6
Accordingly, class members can be identified through the reports themselves maintained
either by CMPD or the DMV. Moreover, there is no question that the proposed class satisfies the
numerosity requirement, with Plaintiffs estimating that there are over 250,000 individuals
identified in the CMPD Crash Reports during the proposed multi-year class period.
b)
Commonality
Certification is only appropriate if “there are questions of law or fact common to the class.”
Fed. R. Civ. P. 23(a)(2). Because nearly all legal disputes involving a large number of people in
similar circumstances will raise common questions, what matters most in determining
“commonality” in the context of class certification is “the capacity of a class-wide proceeding to
generate common answers apt to drive the resolution of the litigation.” See Dukes, 564 U.S. at
349–50. Indeed, “[a] single common question will suffice,” so long as it is “of such a nature that
its determination ‘will resolve an issue that is central to the validity of each one of the claims in
one stroke.’ ” EQT, 764 F.3d at 360 (citing Dukes, 564 U.S. at 350, 359). Also, in this context a
common question is one where “the same evidence will suffice for each member to make a prima
On this issue, Defendants argue that the identity of class members is not “ascertainable” because
the Court must, in their view, make an independent determination how each class member’s Crash
Report was prepared and that it was used for an improper purpose and that information cannot be
found on the Crash Report itself. The Court disagrees. Defendant wrongly conflates the Court’s
assessment of the commonality and typicality requirements (discussed below) with the threshold
question of whether the proposed class members are simply identifiable. Whether or not Plaintiffs’
claims necessitate individual litigation (thus making their claims insufficiently common or
typical), the fact remains that the putative class members can be readily identified by objective
criteria from the accident reports themselves.
6
17
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 17 of 49
facie showing [or] the issue is susceptible to generalized, class-wide proof.” Tyson Foods, Inc. v.
Bouaphakeo, 136 S. Ct. 1036, 1045, 194 L. Ed. 2d 124 (2016) (quoting 2 W. Rubenstein, Newberg
on Class Actions § 4:50, pp. 196–197 (5th ed. 2012).
Here, the parties have offered at least two common questions which might serve as the
basis for a common resolution and thus a finding of “commonality.” First, are the Crash Reports
themselves “motor vehicle records” or the personal information within those reports derived from
“motor vehicle records” under the DPPA? Second, did the Defendants knowingly obtain, disclose
or use the reports for a purpose permitted under the DPPA? For the reasons explained below the
Court finds that, at a minimum, the first question can be commonly answered, thus resolving “an
issue central to the validity” of each member’s DPPA claim and thereby satisfying Rule 23(a)’s
commonality requirement.7
The Court’s conclusion that the question of whether the North Carolina Crash Reports
contain information from or pertaining to motor vehicle records can be answered with common
proof from a properly defined8 putative class is supported by two alternate grounds. First, with
respect to the question of whether any of the information in the reports came from a DMV record9
Having determined that the “commonality” requirement is satisfied as to at least one core issue,
the Court need not reach a determination of whether that requirement could also be met as to other
issues. However, the Court will address the issue of whether the Defendants improperly disclosed
personal information in the Crash Reports without a proper purpose in connection with the
discussion of certification of a damages class under 23(b)(3) below.
8 As discussed below, the Court finds that the Class must be limited to CMPD Crash Reports
because there is insufficient evidence in the current record to support the certification of a broader
class.
9 Defendants acknowledge that information obtained from a DMV database (for example by using
the Crash Report software) to create a Crash Report comes from a “motor vehicle record,” but
dispute whether obtaining the information from a driver’s license provided at the accident scene
upon the demand of the officer also comes from a “motor vehicle record.” The Court finds that
7
18
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 18 of 49
(as distinguished from whether the record itself can be considered a motor vehicle record) the
parties agree that any individual determination of how the CMPD Crash Report for a particular
accident was prepared would be practically impossible because those Crash Reports themselves
don’t reveal the source of the personal information (for example, whether or not the accident report
software was used) nor do law enforcement officers recall how any specific report among the
hundreds or thousands they prepare was created. See Doc. 122 at 10, 18 (Defendants questioning
if “individualized inquiries would “even [be] feasible” and stating that with respect to an
investigation to determine where the information from each respective crash report was derived,
“in almost every instance, the source of the information would not be discernable.”
In the absence of the possibility of a meaningful individualized investigation of the source
of personal information in the Crash Reports, Plaintiffs and the remainder of the putative class are
left to prove DPPA liability through circumstantial evidence and other inferential proof, evidence
that could and would be presented on a class-wide basis. See Tyson Foods, 136 S. Ct. 1036 at 1040.
(Where representative evidence “may be the only feasible way to establish liability, it cannot be
deemed improper merely because the claim is brought on behalf of a class” and such evidence “is
a permissible means of establishing [liability] in a class action by showing that each class member
personal information from either source would be sufficient in the circumstance of the compelled
production of a driver’s license to a law enforcement officer to fall within the scope of information
protected by the DPPA. See Eggen v. WESTconsin Credit Union, 2016 WL 4382773, at *3 (W.D.
Wis. Aug. 16, 2016) (“On its face, defendant’s argument that a driver’s license is not a ‘motor
vehicle record’ is difficult to take seriously… After all, a driver’s license is created by the
Department of Motor Vehicles and it is a record of the information on the license.”); Doc. No. 42
at p. 6 (“Applying a modicum of common sense to what is a clearly written statute, being involved
in a fender bender on the way to work is clearly an insufficient reason to expose protected ‘personal
information’ (especially a person's name and home address) to a web audience increasingly
inhabited more by identity thieves than boy scouts”).
19
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 19 of 49
could have relied on that [evidence] to establish liability had each brought an individual action.”)
Thus, there is a commonality among the class on this core issue.
Simply put, each person whose personal information appears in an accident report would
face the same challenge – “How do I prove it is ‘more likely than not’ that the personal information
in my accident report came from a ‘motor vehicle record’”? And, the evidence from which a
common answer would be derived would be the same; that is, the inferential evidence of the
process by which the accident reports were most often prepared. Having no ability to determine
the source of the personal information in any specific accident report, the fact-finder would then
need to make a determination of DPPA liability on the basis of this class-wide proof generally
applicable to the class as a whole. Thus, the Court finds the requirement of “commonality” is met
on this issue.
Also, the Court finds that all of the DMV Form 349 Crash Reports in which the box “Same
address as driver’s license” is checked are “motor vehicle records” under the statutory definition
so no further individual assessment of the “source” of the personal information is required. The
DPPA only imposes liability for personal information that has been obtained “from a motor vehicle
record.” See 18 U.S.C. § 2722(a). In turn, the statute defines a “motor vehicle record” as “any
record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle
registration, or identification card issued by a department of motor vehicles.” 18 U.S.C. § 2725(1)
(emphasis added). All of the Crash Reports in which the “Same address as Driver’s License” box
is checked “pertain to” 10 a motor vehicle operator’s permit (i.e. a driver’s license). Regardless of
“Pertain to” or “pertain” is a broad term which means with “reference to” or “related to” and is
frequently used in statutes and legal writing. See, e.g., FCC v. AT & T Inc., 562 U.S. 397 (2011);
10
20
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 20 of 49
whether the initial source of the address information was the accident participant’s records in the
DMV database (using the F11 function), or a driver’s license, or if the driver’s license was only
used to confirm earlier provided information, everyone who has access to the Crash Reports knows
the address on that individual’s driver’s license just the same as if they had the person’s driver’s
license in their hands. Thus, the accident report is plainly a record that “pertains to” the driver’s
license and thus qualifies as a “motor vehicle record” under the DPPA. Accordingly,
“commonality” is satisfied on this alternate ground as well.
In support of their position that commonality (as well as typicality) cannot be found
because of the various ways in which Crash Reports are prepared, Defendants cite to the Court
two recent decisions in the Middle District of North Carolina, Hatch v. Demayo, No. 1:16CV925,
2020 WL 4719632 (M.D.N.C. Aug. 13, 2020) and Garey v. James S. Farrin, P.C., No. 1:16CV542,
2020 WL 4227551 (M.D.N.C. July 23, 2020).
In those DPPA actions, the putative class
representatives asserted claims against law firms who obtained similar North Carolina accident
reports and solicited the plaintiffs and their putative class. In both cases, the court declined to
certify a class, holding that it was not persuaded that a “central merits question – Where did the
information come from? – can ultimately be answered with class-wide proof.” For the reasons
discussed above, this Court respectfully finds otherwise. Also, in Hatch, unlike in this action, the
Webster's Third New International Dictionary of the English Language (2020) (“To have
reference”); Black's Law Dictionary (11th ed. 2019) (“To relate directly to; to concern or have to
do with”).
21
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 21 of 49
Court did not address whether the accident reports were themselves “motor vehicle records”
because no party had raised the issue. See Hatch, 2020 WL 4719632 at *4.11
While the Court agrees with our sister court that vehicle accident reports can be prepared
in various ways, the practical impossibility of the individualized adjudication of that issue which
led the court in Garey and Hatch to decline class certification leads this Court to conclude that the
enforcement of the DPPA cannot be so easily thwarted. Put another way, the Court is unwilling to
decline to certify a class because of the alleged necessity of conducting individualized assessments
of a fact (the source of the personal information in each accident report) that Defendants urge the
Court cannot ever be made with respect to any individual’s accident report because individualized
proof is inherently unavailable. Also, if the theoretical variability of how accident reports are
prepared means that no class can ever be certified, then effective injunctive relief could never be
ordered to end widely practiced conduct that plainly violates the statute. This Court will not read
such a clearly stated statute so narrowly as to make it ineffectual in carrying out its important
purposes.
However, the Court’s finding of commonality is limited to North Carolina residents and
CMPD Crash Reports. While based on the current record the Plaintiffs can present class wide
evidence of the specific form of the accident report typically used in North Carolina, the
Plaintiffs have raised this issue in this action, albeit arguing that the Crash Reports are “motor
vehicle records” on the different ground that the DMV form used to request disclosure of a Crash
Report says that accident reports are “motor vehicle records” and North Carolina law specifically
limits disclosure of such reports in accordance with the DPPA. See N.C. Gen. Stat. § 20-43.1,
DMV Form TR-67. While the Court does not find that the state statute or the DMV form can alone
make a record a “motor vehicle record” as defined in the DPPA, the DMV’s view of the issue does
lend support to the Court’s conclusion that the Crash Reports “pertain to” a motor vehicle
operator’s permit.
11
22
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 22 of 49
availability of software that allows North Carolina law enforcement officers to fill out that form
with personal information taken from a NCDMV database and the absence of a practical ability to
determine how a particular accident report is prepared shortly after the accident, no such evidence
(other than the availability of similar software in New York) is available for other states or even
outside CMPD.12 Also, the record reflects that North Carolina officers were required to handle
non-North Carolina residents differently with respect to using the accident report software.
Therefore, the Court cannot conclude that Plaintiffs’ claims and evidence satisfy the requirement
of proving commonality with respect to class members and accident reports outside of CMPD or
for non-North Carolina residents. Therefore, Plaintiffs are not entitled to certify their proposed
nationwide class.13
c)
Typicality
The next Rule 23(a) prerequisite is that “the claims or defenses of the representative parties
are typical of the claims or defenses of the class.” Fed. R. Civ. P. 23(a)(3). To meet this
At oral argument, Plaintiffs acknowledged their lack of information concerning Defendants’
conduct outside of CMPD, even in North Carolina.
13 The Court is also concerned about exercising jurisdiction over far flung conduct. In BristolMyers Squibb Company v. Superior Court of California, San Francisco County, 137 S. Ct. 1773
(2017), the Court rejected an attempted assertion of personal jurisdiction over a non-resident
defendant by plaintiffs with no connection to activity occurring in the chosen forum. More than
600 plaintiffs (only eighty-six (86) of whom were California residents) filed an action in California
against an in-state defendant. Id. at 1777. The Supreme Court emphasized that a plaintiff’s claim
must arise out of the defendant’s contacts with the forum to establish personal jurisdiction. Id. at
1781. And, the fact that others allegedly suffered from similar conduct is immaterial, as personal
jurisdiction must be proven on an individual basis. Id. Since Bristol-Myers, numerous federal
courts have applied its holdings to limit class actions that improperly seek to include claims with
no connection to the forum state. See, e.g., Plumbers’ Local Union No. 690 Health Plan v. Apotex,
2017 U S. Dist. LEXIS 114733 (E.D. Pa. July 24, 2017). For these same reasons, a nationwide
class should not be certified here.
12
23
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 23 of 49
requirement, the class representative's claim must “arise[ ] from the same event or practice or
course of conduct that gives rise to the claims of other class members.” Oshana v. Coca–Cola Co.,
472 F.3d 506, 514 (7th Cir. 2006). Typicality does not require “that the plaintiff’s claim and the
claims of class members be perfectly identical or perfectly aligned” – some minor variation
between a named plaintiff’s individual claim and those of the class members she aims to represent
is to be expected. See Dieter v. Microsoft Corp., 436 F.3d 461, 467 (4th Cir. 2006). Rather, the
representative's claims must only have the same essential characteristics as the claims of the class
at large. Arreola v. Godinez, 546 F.3d 788, 798 (7th Cir. 2008). Typicality ensures that a
representative “possess[es] the same interest and suffer[s] the same injury as the class members.”
Gen. Tel. Co. of the SW v. Falcon, 457 U.S. 147, 156 (1982). The typicality requirement is designed
to ensure that there is “enough congruence between the named representative's claim and that of
the unnamed members of the class to justify allowing the named party to litigate on behalf of the
group.” Spano v. The Boeing Co., 633 F.3d 574, 586 (7th Cir. 2011). Moreover, as noted by the
Fourth Circuit in Soutter v. Equifax Info. Servs., LLC, 498 F. App'x 260 (4th Cir. 2012), “typicality
tends to merge with commonality.” Thus, the same reasons as to why there is commonality will
support (or counsel against) a finding of “typicality.”
The Court finds that, at least with respect to Plaintiffs’ putative class seeking injunctive
relief, their claims are typical of their fellow class members. As discussed above, like the other
members of the class, Plaintiffs will pursue their claims under the DPPA based on the inferential
evidence that the personal information in their Crash Reports most likely came from either DMV
records (through the accident report software connections) or a driver’s license or DMV
identification card or based on the indication in their Crash Reports that the address on the report
24
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 24 of 49
is the same as on their driver’s license. Also, they assert that their personal information was
impermissibly disclosed by Defendants without a showing that the disclosure was made only for
a purpose permitted by the statute. Thus, their claims are typical of the claims of other class
members.
The Defendants’ defenses as to injunctive relief would also be typical, based on their
position that the accident reports are not themselves “motor vehicle records” and that the Plaintiffs’
inferential evidence is insufficient to establish a likelihood that the information came from a DMV
record. With respect to the propriety of their disclosures, Defendants’ defenses rest on their
common allegations that their disclosures either were permitted as vendors to CMPD and other
law enforcement agencies or that they had no obligation under the DPPA to determine a
permissible use prior to disclosing or making available the class members’ personal information
to their numerous customers. Therefore, the Court finds that the requirement of “typicality” has
been satisfied.
d)
Adequacy
Representative parties and class counsel must “fairly and adequately protect the interests
of the class.” Fed. R. Civ. P. 23(a)(4), (g)(4); see also Sharp Farms v. Speaks, 917 F.3d 276, 290
& n.7 (4th Cir. 2019). Defendants have not challenged either the adequacy of the Plaintiffs or their
counsel to represent the class, and the Court similarly finds that they will adequately represent the
class the Court intends to certify. Therefore, this final Rule 23(a) requirement and each of the Rule
23(a) requirements has been met.
3.
Rule 23(b) Classes
25
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 25 of 49
Having determined that all of the requirements of Rule 23(a) have been met, the Court
must now determine which, if any, of the types of classes described in Rule 23(b) are appropriate
in this action. To be maintained as a class action, a case must not only meet the four requirements
of Rule 23(a) but it also must fit into one of the four categories of Rule 23(b), and it may fit into
more than one. Fed. R. Civ. P. 23; Krakauer, 925 F.3d at 655. In other words, Rule 23 recognizes
that there are cases that satisfy the Rule 23(a) criteria—numerous individuals with common
questions whose rights are being pursued by an adequate class representative with typical claims—
but that are unworthy of class certification on those grounds alone.
Rule 23(b)(1)(A) describes the “rarely used” category of class actions where the
prosecution of “separate actions by or against individual members of the class would create a risk
of incompatible standards of conduct for the adverse party due to inconsistent or varying
adjudications with respect to individual members of the class.” See 2 William Rubenstein et al.,
Newberg on Class Actions, § 4:1 (5th ed. 2020) (hereinafter “Newberg”); Reyes v. Julia Place
Condominiums Homeowners Ass'n, Inc., 2014 WL 7330602, *10 (E.D. La. 2014) (noting that Rule
23(b)(1)(A) category is “rarely utilized” and “does not cover situations in which multiple plaintiffs
sue a single defendant for money damages”). Rule 23(b)(1)(B) class actions are appropriate in
situations where an individual judgment, while not technically concluding the claims of other
members, might do so as a practical matter, for example a suit against a single defendant whose
funds are so limited that they are incapable of satisfying all the potential claimants. See Fed. R.
Civ. P. 23(b)(1)(B).
Rule 23(b)(2) authorizes a class action when a party has taken or refused to take action
with respect to a class, and “final injunctive relief or corresponding declaratory relief is appropriate
26
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 26 of 49
with respect to the class as a whole.” See Fed. R. Civ. P. 23(b)(2). The (b)(2) class action is often
referred to as an “injunctive” class suit. See Newberg at § 4.1.
Finally, Rule 23(b)(3) permits a class action in all other circumstances where the
prerequisites of Rule 23(a) are met, and two additional criteria are satisfied: (1) that questions of
law or fact common to members of the class predominate over any questions affecting only
individual members and (2) that a class action is superior to other available methods for the fair
and efficient adjudication of the controversy. See Fed. R. Civ. P. 23(b)(3). This is the most common
category for money damage cases, especially small claims class actions, and hence is commonly
referred to as the “money damages” class action. See Krakauer, 925 F.3d at 655 (Rule 23(b)(3) is
the “common vehicle” for class actions “which seek damages for widespread wrongful conduct”);
Newberg at § 4.1.
As discussed below, the Court finds that an “injunctive class” limited to CMPD accident
reports should be certified, but declines to certify a class under Rule 23(b)(1), which is inapplicable
to this action, or a money damages class under Rule 23(b)(3) because the Court finds it is not a
superior procedure given the Defendants’ right to challenge damages individually based on
whether a particular person’s Crash Report was disclosed for an improper purpose under the
DPPA.
a)
Rule 23(b)(1)
Plaintiffs seek certification under both Rule 23(b)(1)(A) and (B). See Tatum v. R.J.
Reynolds Tobacco Co., 254 F.R.D. 59, 66 (M.D.N.C. 2008) (citation and internal quotation marks
omitted) (“In essence, Rule 23(b)(1)(A) considers possible prejudice to the defendants, while
23(b)(1)(B) looks to possible prejudice to the putative class members.”). However, beyond
27
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 27 of 49
arguing that the DPAA creates “uniform standards and requirements” for those who are subject
to the statute – which is of course true for nearly all statutes – Plaintiffs do not articulate how
Defendants would be held to “incompatible standards of conduct” if, in individual actions, some
class members proved a violation of the DPAA and others did not. See Newberg at § 4.1. (Noting
that 23(b)(1) class actions generally do not cover situations in which multiple plaintiffs sue a
single defendant for money damages with some plaintiffs prevailing and some losing because the
fact that the defendant must pay some claimants but not others does not create the danger at which
the Rule is aimed).14 Indeed, Defendants argue that instead of prejudicing the Defendants,
individual actions will allow them to assert individual defenses and that different results as to
different class members in individual actions would not necessarily lead to confusion concerning
how the Defendants were required to apply the DPPA.15
Similarly, with respect to Rule 23(b)(1)(B), the putative class members would not be
prejudiced by a finding against the class representatives nor would their ability to pursue their
own claims be “substantially impair[ed] or impede[d]” by the Plaintiffs’ DPPA claims. This is
14
Rather, Rule 23(b)(1)(A) is reserved for that subset of cases in which the different adjudicatory
outcomes would put the defendant in a true bind—for example, if bondholders sued to have a bond
declared invalid and some won and some lost; in that circumstance, the municipality would not
know how to proceed with regard to its outstanding obligations. Id.
15 It might be that Plaintiffs’ claim that Defendants allegedly failed to comply with their obligation
to obtain and keep records of the permissible purposes for which Crash Reports accident reports
were disclosed could create an incompatible duty with respect to that obligation, but, as discussed
below there is no private right of action to pursue this claim and, in any event, the Defendants
could theoretically keep one person’s records but not another’s. Also, as there may be no damages
associated with such an obligation (no one is necessarily harmed if a record of lawful use is not
retained for the prescribed period), if this claim could proceed it would be better viewed as a
potential class under Rule 23(b)(2).
28
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 28 of 49
not a “‘limited fund’ circumstance, whereby individual lawsuits may exhaust the limited amount
of assets available and leave some claimants without a remedy.” McLaurin v. Prestage Foods,
Inc. 271 F.R.D. 465, 478 (E.D.N.C. 2010). Therefore, Rule 23(b)(1) is inapplicable to this action,
and the Court declines to certify a class under Rule 23(b)(1).
b)
Rule 23(b)(2)
Plaintiffs also seek certification under Rule 23(b)(2). A class may be certified under
23(b)(2) when “the party opposing the class has acted or refused to act on grounds that apply
generally to the class, so that final injunctive relief or corresponding declaratory relief is
appropriate respecting the class as a whole.” Fed. R. Civ. P. 23(b)(2). Therefore, Rule 23(b)(2)
sets forth two basic requirements: (1) the party opposing the class must have acted, refused to act,
or failed to perform a legal duty on grounds generally applicable to all class members, and (2) final
relief of an injunctive nature or a corresponding declaratory nature, settling the legality of the
behavior with respect to the class as a whole, must be appropriate. See R.I.L-R v. Johnson, 2015
WL 737117, *11 (D.D.C. 2015). Both of these requirements are satisfied here. Defendants have
admitted that they generally disclose the proposed class members’ personal information in all
CMPD Crash Reports without redaction (and without a determination of the permissible purpose
for the disclosure – although Defendants contend that they have authority to do so based on their
relationship with CMPD and other law enforcement agencies). Thus, Defendants have acted and
refused to act generally in the same manner as to the whole class.16
16
Also, certification of a Rule 23(b)(2) class is proper even if not all class members may have
suffered the injury posed by the class representatives so long as the challenged policy or practice
was generally applicable to the class as a whole. Newberg at § 4.28.
29
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 29 of 49
Also, final injunctive relief is appropriate for the class as a whole. See Krakauer, 925 F. 3d
at 656. Recently, in Krakauer, the Fourth Circuit upheld the certification of a class action in an
action under the Telephone Consumer Protection Act (“TCPA”), a remedial public oriented statute
comparable in many ways to the DPPA. In doing so, the court explained:
Given the remedial purpose of the TCPA, it is no surprise that its cause of
action would be conducive to class-wide disposition. In enacting the law, Congress
sought to deter an activity that, while pernicious and disruptive, does not trigger
extensive liability in any single case. Since few individuals would have an incentive
to bring suit, no matter how frustrated they were with the intrusion on their privacy,
the TCPA opted for a model that allows for resolution of issues without extensive
individual complications.
Id. Like the TCPA, in the DPPA Congress sought to broadly protect the public from
harassment (as a consequence of the necessity of providing their personal information in
connection with motor vehicle records), but “extensive liability” is not triggered in any particular
case. Accordingly, if a Defendant is found to have, as alleged here, engaged in a pattern and
practice of disclosing thousands of Crash Reports that violate the DPPA it is appropriate to redress
that conduct with injunctive relief. An injunction ordering an end to any unlawful conduct will
properly enforce the statute. See Douglin v. GreatBanc Tr. Co., 115 F. Supp. 3d 404, 413–14
(S.D.N.Y. 2015) (holding that if Plaintiffs demonstrated a breach of fiduciary duty by defendant
then their request for an injunction which “would, in substance, prohibit defendant from engaging
in similar conduct in the future” is sufficient on its face to permit certification under Rule
23(b)(2)); Sykes v. Mel S. Harris & Assocs. LLC, 780 F.3d 70, 97–98 (2d Cir. 2015)
(upholding Rule 23(b)(2) certification based in major part on proposed injunction against future
violations).
30
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 30 of 49
Further, an injunctive class is appropriate notwithstanding Defendants’ contention that the
facts related to the disclosure of each class members’ Crash Report are different.17 While any
differences among class members may be relevant to certification of a class seeking money
damages under Rule 23(b)(3) as discussed below, such differences are not relevant to the
certification of a class limited to seeking only injunctive rather than monetary relief. As to such a
class, so long as “each individual class member” is not “entitled to a different injunction” then
alleged individual differences do not counsel against certification of a class under Rule 23(b)(2).
See Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 360 (2011) (emphasis in original). Here,
Plaintiffs seek a single injunction applicable to the class as a whole, which is fully consistent with
Dukes.
Finally, although they did not raise this issue in their briefing, at oral argument Defendants
argued that Plaintiffs do not have standing to assert their claims for injunctive relief, citing Lujan
v. Defenders of Wildlife, 504 U.S. 555 (1992). In Lujan, the Supreme Court explained that to
establish standing plaintiffs must show that: (1) they suffered an injury in fact that's concrete and
particularized and actual or imminent, not conjectural or hypothetical; (2) there is a causal
connection between the injury and the conduct complained of; and (3) the injury can be redressed
by a favorable decision. Id. at 560–561. Because the second and third elements of standing are
Defendants also argue that the Court should not certify Plaintiffs’ proposed Rule 23(b)(2) class
because of Plaintiffs’ request for monetary relief in the form of liquidated damages. While
Plaintiffs assert that this request is only “incidental” to their requested injunctive relief, the Court
finds otherwise and Plaintiffs will not be permitted to recover monetary damages in connection
with the certified Rule 23(b)(2) class, see Dukes, 564 U.S. at 364-65. And, Plaintiff’s request for
monetary relief with respect to other potential classes does not bar certification of a class seeking
only injunctive relief under Rule 23(b)(2). See Adkins v. Facebook, Inc., 424 F. Supp. 3d 686, 698
(N.D. Cal. 2019) (certifying a 23(b)(2) class while denying a 23(b)(3) class).
31
17
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 31 of 49
plainly met here, presumably Defendants contend that the plaintiffs don't have an “injury in fact”
so they lack standing. The Court disagrees.
First, “Congress may elevate to the status of legally cognizable injuries concrete, de
facto injuries that were previously inadequate in law.” Spokeo v. Robins, 136 S.Ct. 1540, 1548
(2016). In the DPPA, the statute specifically protects people from all disclosure of personal
information from motor vehicle records, except in certain permissible instances. 18 U.S.C. § 2721–
2722; see Whitaker v. Appriss, Inc., 229 F. Supp. 3d 809, 813 (N.D. Ind. 2017). Thus,
impermissible disclosure of a plaintiff's personal information in violation of the DPPA creates
statutory harm and confers standing. Graczyk v. W. Publ'g Co., 660 F.3d 275, 278 (7th Cir. 2011)
(relying for standing on Congress, through the DPPA, having defined a particular injury in the
form of the “‘obtain[ment], disclos[ure], or [use],’ 18 U.S.C. § 2724(a), of an individual's personal
information”).
Moreover, the nature of the injunctive relief sought by the proposed class does not deny
Plaintiffs standing. Defendants have obtained the personal information of the class members as
discussed above and it still remains available without redaction to those who might request it.
Defendants and their fellow class members ought not to have to wait until their information is
again used inappropriately to maintain standing. See Appriss, 229 F. Supp. 3d at 816; Remijas v.
Neiman Marcus Group, LLC, 794 F.3d 688, 693 (7th Cir. 2015) (“[T]he Neiman Marcus customers
should not have to wait until hackers commit identity theft or credit-card fraud [after a data breach]
in order to give the class standing, because there is an ‘objectively reasonable likelihood’ that such
an injury will occur.”); See also Adkins, 424 F. Supp. 3d at 698 (certifying a 23(b)(2) class in a
data breach action in which plaintiffs sought injunctive relief to require Facebook to implement
32
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 32 of 49
and maintain certain reasonable security measures, even though Facebook argued it had allegedly
“fixed the bug” that caused the data breach).
In Adkins, the Court found that a credible threat of real and immediate harm had been
sufficiently alleged because the information: (i) had been sensitive and (ii) had been stolen. Id. at
691, citing Krottner v. Starbucks Corporation, 628 F.3d 1139, 1143 (9th Cir. 2010). Similarly, in
this case, not only has the class’ personal information been indisputably obtained, it still remains
available for disclosure without redaction or any requirement that it be used for a permitted purpose
under the DPPA. The injury-in-fact requirement “helps to ensure that the plaintiff has a personal
stake in the outcome of the controversy.” Susan B. Anthony List v. Driehaus, 573 U.S. 149, 158,
(2014). The personal information obtained and available for disclosure by Defendants assures that
plaintiff has such a personal stake in the outcome of the case. Thus, Plaintiffs and the class have
established Article III standing.18
Defendants also briefly argued that too much time has passed since Plaintiffs’ accidents and
suggested that a more “current” accident report victim must be found. The Court is unpersuaded
by this argument. If accepted, it would effectively prohibit anyone harmed by Defendants’ conduct
from establishing standing because by the time a lawsuit is filed and class certification sought their
personal information would, according to Defendants, be “stale” and unlikely to be of further
interest to marketers and others who would use the information unlawfully. However, Courts make
an exception to the general rules of justiciability for claims like this where a defendant is likely to
continue engaging in its conduct but also evade review as soon as a plaintiff files suit. See
Campbell-Ewald Co. v. Gomez, 136 S. Ct. 663, 672 (2016); Buckeye Tree Lodge & Sequoia Vill.
Inn, LLC v. Expedia, Inc., No. 16-CV-04721-VC, 2019 WL 1170489, at *2–3 (N.D. Cal. Mar. 13,
2019). There is no evidence that Defendants will stop disclosing unredacted personal information
contained in North Carolina accident reports without requiring compliance with the DPPA in the
absence of an injunction. Therefore, the named plaintiffs have standing to seek injunctive relief.
33
18
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 33 of 49
Accordingly, the Court finds Plaintiffs have satisfied the requirements of Rule 23(b)(2) and
the Court will certify an “injunctive relief” class and subclass as follows:
North Carolina residents whose personal information (as defined by the DPPA)
appears on a North Carolina form DMV-349 CMPD vehicle accident report that
was created between January 12, 2012 and September 1, 2020 and disclosed by a
Defendant to a third party without any contemporaneous record of a purpose
permitted by the DPPA. The class does not include any person who gave consent
to the disclosure of their personal information by a Defendant.
Subclass – All members of the class whose related accident report indicates that
their address in the report is the same as on their driver’s license.
Further, the Court will appoint Plaintiffs’ counsel as class counsel for this class under Rule
23(g). In doing so, the Court has considered Plaintiffs’ counsel’s long history of handling this
matter and demonstrated knowledge of the applicable law; counsel's experience in handling class
actions, other complex litigation, and the types of claims asserted in the action; and the resources
that counsel will commit to representing the class. See Doc. No. 103-1, pp. 5-11. In sum, the Court
finds that Plaintiffs’ counsel will fairly and adequately represent the interests of the class, a finding
which Defendants do not challenge.
c)
Rule 23(b)(3)
Finally, Plaintiffs seek certification under Rule 23(b)(3). In addition to establishing the
requirements of Rule 23(a) have been met as discussed above, to obtain certification under 23(b)(3)
the plaintiff must show both that “(1) questions of law and fact common to class members
predominate over any questions affecting only individual class members, and (2) that a class action
is superior to other available methods for fairly and efficiently adjudicating the controversy.” Fed.
34
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 34 of 49
R. Civ. P. 23(b)(3). Because the Court finds that a class action does not satisfy the final prong of
“superiority” it will decline to certify a class under Rule 23(b)(3).19
Notwithstanding evidence of wrongful conduct generally, a class seeking individual
monetary damages “cannot be certified . . . [if a defendant] will not be entitled to litigate its
statutory defenses to individual claims,” Dukes, 564 U.S. at 367. In this action, Defendants argue
that the Crash Reports for some class members, including the Plaintiffs themselves, were not
disclosed for a purpose that is not permitted by the DPPA. While this defense is not relevant to the
Plaintiffs’ claim for declaratory and injunctive relief, which can be proven without determining
which Crash Reports were in fact disclosed for an impermissible purpose, Plaintiffs’ proposed
Rule 23(b)(3) class seeks money damages for individual class members, which requires that the
Court ultimately identify the particular Crash Reports that were improperly disclosed.
As the Court has already found, in many ways representative litigation would be an
appropriate vehicle for adjudicating this controversy. Also, Plaintiffs represent that each class
member would only be seeking the liquidated damages amount provided by the statute so there
would be no need for an individualized assessment of the amount of each class members’ damages.
However, in considering “the likely difficulties in managing a class action,” Fed. R. Civ. P.
23(b)(3)(D), the Court must also take into account Defendants’ right to challenge whether
individual class members are entitled to a statutory damages award. Weighing the benefits and
19
Because the Court has determined that a class action is not superior in these circumstances it
need not and does not reach the issue of predominance beyond noting that the Rule23(b)(3)
predominance inquiry overlaps with the commonality requirement in 23(a)(2), although it is “more
demanding” as its focus is “not only on the existence of common questions, but also on how those
questions relate to the controversy at the heart of the litigation.” See Amchem Prods., Inc. v.
Windsor, 521 U.S. 591, 623-24 (1997); EQT, 764 F.3d at 366.
35
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 35 of 49
challenges of certifying a class action under these circumstances, the Court finds that a class action
is not a superior framework in which to adjudicate Plaintiffs’ money damages claims because of
the Defendants’ intention to seek an individualized assessment of the right to recover such
damages. Therefore, the Court will decline to certify a class action under Rule 23(b)(3).
B.
Summary Judgment
The parties have each filed motions for summary judgment. Defendants raise three
arguments in support of their motion. They broadly argue that Defendants’ disclosures of Crash
Reports “fall within an express permissible DPPA use,” 18 U.S.C. § 2721(b)(1), because they
allegedly “act[ed] on behalf of CMPD in carrying out CMPD’s obligations under North Carolina’s
public record laws.” Relatedly, Defendants argue that they are entitled to “qualified immunity”
because PRUS was allegedly performing a government function and is entitled to the same
qualified immunity protections that CMPD would have if it had been made a defendant. Finally,
Defendants argue more specifically that Plaintiffs have not offered evidence from which a jury
could find that Plaintiffs’ personal information was disclosed for marketing or solicitation in
violation of the DPPA or that they suffered actual damages, which Defendants claim must be
established before liquidated damages can be awarded.
In its cross motion, Plaintiffs assert that they are entitled to summary judgment because
North Carolina Crash Reports are motor vehicle records subject to the DPPA and the reports of
their accidents were disclosed by the Defendants for a purpose not permitted by the DPPA (because
the Crash Reports were disclosed to, among others, monthly subscribers who may have accessed
the information for marketing purposes). Also, Plaintiffs contend that Defendants have violated
36
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 36 of 49
the DPPA by failing to obtain and maintain records of the permissible uses for which the Crash
Reports were disclosed. See 18 U.S.C. § 2721(c).
For the reasons discussed below, the Court finds that Defendants’ conduct is not authorized
by the “governmental function” purpose permitted by the DPPA nor are they entitled to “qualified
immunity” from liability. Also, with respect to their more specific arguments related to the purpose
for which Plaintiffs’ personal information was used, the Court finds that they are not entitled to
summary judgment because there are disputed factual issues related to whether Plaintiffs’
information was improperly disclosed. For the same reason, the Court will deny Plaintiffs’ cross
motion for summary judgment as to their own claim for liquidated damages. Also, the Court will
deny Plaintiffs’ motion for summary judgment based on the alleged violation of 18 U.S.C. §
2721(c) because there is no private right of action to assert this violation.
The Court will, however, grant summary judgment on Plaintiffs’ claims for declaratory
and injunctive relief with respect to the Rule 23(b)(2) subclass of those class members whose
accident reports indicate that the address in the report matches the address on their driver’s license.
The Court finds that Defendants have violated the DPPA as a matter of law because the Crash
Reports related to that subclass are “motor vehicle records” as discussed earlier and Plaintiffs are
entitled to summary judgment because, inter alia, it is undisputed that Defendants make no effort
to limit the disclosure of Crash Reports for purposes permitted by the DPPA (and have disclosed
the personal information contained in those records for marketing and/or solicitation purposes that
are not permitted under the DPPA), even though all records may not have been disclosed (as
distinguished from just being “made available”) and some records may have been disclosed for
37
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 37 of 49
permissible purposes. Accordingly, the Court will enjoin the Defendants from continuing any
conduct that violates the DPPA.
1.
Permissible “Governmental Function” Use under
18 U.S.C. § 2721(b)(1)
Defendants’ first class wide argument in support of their motion for summary judgment is
that they have a “permissible use” for their disclosure of the Crash Reports because they are acting
“on behalf of” CMPD in making the Crash Reports available as “public records,” which they claim
qualifies as a permissible DPPA use under 18 U.S.C. § 2721(b)(1). The Court disagrees. First,
while the Crash Reports may be public records, see N.C. Gen. Stat. § 20-166.1(i), the disclosure
of accident reports is expressly subject to the DPPA. See N.C. Gen. Stat. § 20-43.1(e).
This distinction is neither inconsistent nor remarkable. Indeed, the fundamental purpose of
the DPPA is to limit the public disclosure of personal information contained in motor vehicle
records. Therefore, while an accident report may be a public record subject to unlimited disclosure
with respect to information in the report that is not personal information protected under the DPPA,
it would completely undermine the purpose of the DPPA if a state could simply designate a
document containing personal information subject to DPPA protection as a “public record” and
thereby avoid complying with its restrictions. Simply put, the very essence of the DPPA is to limit
the disclosure of information that had previously been made widely available as a public record;
so, with due respect to Defendants’ argument, it would be nonsensical to hold that a permissible
38
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 38 of 49
governmental “function” under the DPPA is to publicly disclose personal information in a “public
record.” 20 21
This conclusion applies to the Crash Reports whether they are obtained from CMPD or
another local law enforcement agency or the state DMV. Defendants argue that because CMPD
makes Crash Reports available as “public records” without any restrictions if the reports are
obtained in person then they can make the same reports available online without complying with
the DPPA. However, as discussed above, whether or not they are “public records,” Crash Reports
which qualify as “motor vehicle records” or which contain personal information obtained from
“motor vehicle records” such as DMV records or driver’s licenses are subject to the DPPA. So, to
the extent that CMPD provides such records to the public without redacting that personal
information or limiting disclosure only for those uses permitted by the DPPA then it is in violation
of the statute.22
In the same vein, Defendants’ argument that the fact that Crash Reports are sent in
“separate workflows” to DMV and PRUS does not help their cause. Indeed, it would substantially
elevate form over substance for the Court to hold that a person cannot obtain a Crash Report from
20
To be clear, the gathering of personal information to prepare the Crash Reports is a government
function permitted by section 2721(b)(1) in the same way that gathering personal information to
create a driver’s license or motor vehicle registration is permitted by the act. However, once the
information is lawfully obtained, the disclosure of the information, in and of itself, is not an
independent governmental function that is permitted by the DPAA (absent redaction or a separate
permitted use).
21 And, it is familiar doctrine that the prohibition of a federal statute “may not be set at naught by
a state statute.” Sola Electric Co. v. Jefferson Electric Co., 317 U.S. 173 (1942).
22 As acknowledged by the parties, the DMV already limits disclosure of Crash Reports in
accordance with the DPPA through a standard form (TR-67) so it should not be difficult for CMPD
and other local law enforcement agencies to comply with the DPPA.
39
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 39 of 49
a local DMV office without complying with the DPPA but can go down the street and get the very
same report from CMPD (or online from Defendants) without any DPPA redactions or restrictions.
On this point, Defendants also cite a 2005 Opinion by the office of the Attorney General of North
Carolina (“NCAG”) opining on the “legal obligations of the Division of Motor Vehicles (‘DMV’)
and local law enforcement agencies upon receiving a request for a copy of a motor vehicle accident
report” in view of the DPPA and North Carolina’s public records act. See 2005 N.C. AG LEXIS
However, that opinion either supports this Court’s conclusions or is unpersuasive.23
In the opinion, the NCAG’s office begins by stating that the United States Supreme Court
has unanimously ruled that Congress had the power under the Commerce Clause to require the
states to comply with the DPPA. Id. at *3. “Therefore, federal law controls, and the State's Public
Records Act is preempted by the DPPA where there is a direct conflict.” Id. at **3-4, citing
Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States, 161 F.3d 1266, 1272 (10th
Cir. 1998) ("the DPPA directly regulates the disclosure of [personal information from motor
vehicle records] and preempts contrary state law"), cert. denied, 528 U.S. 1114 (2000). The opinion
goes on to say:
[I]t is our view that the intent of Congress in enacting the DPPA was to
restrict a state department of motor vehicles from releasing certain personal
identifying information in records obtained and maintained in connection with the
department's responsibility for the regulation of drivers and motor vehicles. Such
personal identifying information may be contained within a variety of official motor
vehicle records, including accident reports.
In responding to a request for information under North Carolina's Public
Records law, the relevant inquiry for DMV must therefore be whether the document
Indeed, the opinion itself noted that, “[w]e recognize that the courts may eventually provide
clarification of the DPPA's requirements which conflicts with the advice offered in this opinion.”
23
40
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 40 of 49
contains personal identifying information about a motor vehicle operator which
cannot be disclosed under the DPPA. An accident report will likely include both
information which is protected by the DPPA and information which is excepted
from the DPPA. … It is therefore our opinion that motor vehicle accident
reports are public records, but should be released only after DMV has
redacted personal identifying information in accordance with the DPPA.
Id. at *5 (emphasis added). However, despite this correct interpretation of the relationship between
the DPPA and North Carolina’s public records law with respect to the DMV, the opinion does not
properly apply that conclusion to local law enforcement agencies. Rather, without citation or
analysis beyond the conclusory (and incorrect) statement that “the DPPA’s restrictions generally
apply only to a state department of motor vehicles,”24 the opinion states that local law enforcement
agencies should comply with the Public Records Act rather than the DPPA with respect to the
exact same accident reports being sent to the DMV (which the opinion then again notes are subject
to the DPPA). For the reasons stated above, the Court declines to find any basis either in the text
of the statute or its purpose to treat the same accident report differently based on whether it is
disclosed by the DMV or another agency of the State.25
Accordingly, the Court holds that Defendants cannot wrap their profit seeking efforts in
the mantle of “public service” to avoid compliance with the DPPA and are not entitled to summary
judgment based on a claim that their disclosure of personal information in the Crash Reports was
permitted under 18 U.S.C. § 2721(b)(1).
24
As discussed above, the DPPA applies to all motor vehicle records as defined by the statute and
limits the disclosure of personal information contained in such records by DMVs, local law
enforcement agencies and private individuals or entities who obtain that information from them,
not just DMVs.
25 A subordinate division of the state like a city administrative unit is a state agency. See Smith v.
Hefner, 235 N.C. 1 (1952).
41
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 41 of 49
2.
Qualified Immunity
Qualified immunity protects government officials performing discretionary functions
“from liability for civil damages insofar as their conduct does not violate clearly established
statutory or constitutional rights of which a reasonable person would have known.” Harlow v.
Fitzgerald, 457 U.S. 800, 818 (1982). Accordingly, claims for declaratory and injunctive relief are
not affected by qualified immunity. Lefemine v. Wideman, 672 F.3d 292, 303–04 (4th Cir. 2012),
citing Roller v. Cavanaugh, 984 F.2d 120, 122 (4th Cir.1993), overruled in part on other grounds
by Ca. Dep't of Corr. v. Morales, 514 U.S. 499 (1995). Therefore, Defendants asserted qualified
immunity defense has limited application here where the Court has only certified an injunctive
relief class.
Further, Defendants are not entitled to qualified immunity even with respect to Plaintiffs’
claim for liquidated damages. In contracting with PRUS to authorize it to make Crash Reports
available subject to the obligations of federal law, the City of Charlotte and CMPD have not
violated the DPPA in any manner (because the Defendants could have disclosed the Crash Reports
only in accordance with the DPPA). Thus, those governmental actors need no immunity, qualified
or otherwise, that could potentially shield someone who is acting on their behalf. Rather, Plaintiffs’
claims in this action are solely focused on whether Defendants’ conduct violated the DPPA.
Indeed, if Defendants violated the DPPA then they have in fact violated their agreements with
CMPD. Plainly, a person may not claim “qualified immunity” based on conduct that violates the
contract under which they claim the immunity arises. Therefore, Defendants are not entitled to
qualified immunity for the claims asserted in this action.
42
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 42 of 49
3.
Plaintiffs’ Claim for Liquidated Damages
Both parties seek summary judgment on Plaintiffs’ claim for statutory liquidated damages.
While the Court finds that Plaintiffs’ Crash Reports are “motor vehicle records” under the DPPA
because the reports indicate that their personal address on the report is the same as on their driver’s
licenses (and thus the record “pertains to” their driver’s license), there is a factual dispute among
the parties as to whether those reports were disclosed for a purpose not permitted by the statute.
On the one hand, Plaintiffs have presented sworn deposition testimony that they received written
marketing solicitations soon after the accident that they contend were sent as a result of
Defendants’ disclosure of their Crash Reports. However, Plaintiffs do not have copies of the letters
soliciting their business nor do they recall the names of the businesses that solicited them.
Defendants in turn deny that Plaintiffs have provided sufficient proof of receiving marketing
solicitations because of their Crash Report disclosures. While there is evidence, see Doc. No. 1262, that over 20 businesses had access to the Crash Reports as monthly subscription customers of
the Defendants the parties dispute whether Plaintiffs’ reports were simply “made available” to
these subscribers or were actually accessed by them.26
26
The Court does not decide here whether Defendants making their database of accident report
records “available” to monthly subscribers and others constitutes “disclosure” under the DPPA.
However, disclosure certainly occurs as soon as any accident report containing unredacted
personal information is accessed by a customer, regardless of whether the customer “downloads”
or uses the information. Accessing a record protected by the DPPA to determine if it can be used
for marketing purposes or warehousing such records by an end user simply on the possibility that
the record may be useful in the future (as distinguished from distributors of information like the
Defendants who are permitted to obtain records in bulk for later lawful distribution) are not uses
permitted by the DPPA.
43
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 43 of 49
It is for the jury not this Court to decide this factual dispute and determine whether it is
more likely than not that Plaintiffs’ Crash Reports were disclosed by Defendants for a purpose not
permitted by the DPPA. Therefore, both parties’ motions for summary judgment will be denied
on Plaintiffs’ claim for statutory liquidated damages.27 28
4.
Claim of DPPA Liability under 18 U.S.C. § 2721(c)
In their Motion for Summary Judgment, Plaintiffs claim that Defendants violated 18 U.S.C.
§ 2721(c) “by failing to keep any of the records of a permissible purpose for five years.” While
Defendants acknowledge that they failed to fully comply with this requirement, the DPPA does
not provide a private right of action for the absence of the required records.
The limits of the private cause of action under the DPPA is found in section 2724(a). That
section only makes liable any person who “knowingly obtains, discloses or uses personal
information, from a motor vehicle record, for a purpose not permitted under [the statute]… .” 18
U.S.C. § 2724 (a). The failure to obtain and keep records for five years identifying each person or
entity that receives information and the permitted purpose for which the information will be used
under 18 U.S.C. § 2721(c) is not encompassed by that description, even though it is plainly an
Defendants also argue that Plaintiffs must show “actual damages” (such as documented
emotional harm) to recover liquidated damages under the DPPA. The Court disagrees. In setting a
floor of $2500 in “liquidated damages” in addition to providing a full opportunity to obtain “actual
damages” Congress plainly intended not to require proof of “actual damages” to recover
“liquidated damages.” See, e.g., Pichler v. UNITE, 542 F.3d 380, 397–400 (3d Cir. 2008); Kehoe
v. Fid. Fed. Bank & Tr., 421 F.3d 1209 (11th Cir. 2005), cert. denied, 547 U.S. 1051 (2006).
28 Further, as noted above, the Court finds that Plaintiffs have Article III standing to maintain their
claims. See Heglund v. Aitkin Cty., 871 F.3d 572, 577 (8th Cir. 2017); Krakauer, 925 F. 3d 652654 (finding Article III standing under the analogous TCPA).
27
44
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 44 of 49
obligation of the statute and subject to a potential criminal fine under 18 U.S.C. § 2723.29 “Where
Congress includes particular language in one section of a statute but omits it in another section of
the same Act, it is generally presumed that Congress acts intentionally and purposely in the
disparate inclusion or exclusion.” Russello v. United States, 464 U.S. 16, 23 (1983) (citation and
internal quotation marks omitted). Therefore, the Court finds that Plaintiffs may not pursue a
private cause of action under section 2724(a) for Defendants’ alleged failure to meet their
recordkeeping obligations under section 2721(c).
5.
Injunctive Relief for the Rule 23(b)(2) Subclass
Finally, as noted above, the Court will grant summary judgment on Plaintiffs’ claims for
declaratory and injunctive relief with respect to the Rule 23(b)(2) subclass30 of those class
members whose accident reports indicate that the address in the report matches the address on their
driver’s licenses. As to the question of whether the Crash Reports are “motor vehicle records”
under the DPPA, the Court finds as a matter of law that those reports, as they relate to the members
29
Similarly, any failure by a state or state agency, including a DMV or city acting within the scope
of its governmental authority, is not subject to a private right of action under section 2724(a)
because a “State or agency thereof” is not defined as a “person” under the DPPA, although they
are plainly subject to the DPPA’s disclosure restrictions described in section 2721(a) and subject
to a potential civil penalty under 18 U.S.C. § 2723.
30
While it is a close question, the Court finds that although Plaintiffs have produced persuasive
evidence that the accident reports for many of the class members contain personal information that
was obtained from DMV records through the F11 software function or from their driver’s licenses,
they have not established for the purpose of summary judgment, construing all inferences and
evidence for Defendants, that a reasonable jury could not but find that they proved that “it is more
likely than not” that their personal information came from motor vehicle records subject to the
DPPA.
45
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 45 of 49
of the subclass, “pertain to” their driver’s licenses and are therefore “motor vehicle records” as
discussed above.
Moreover, it is undisputed that Defendants make no effort to limit the disclosure of Crash
Reports for purposes permitted by the DPPA (and the Court finds that no reasonable jury could
fail to determine that Defendants have routinely disclosed the personal information contained in
those records for marketing and/or solicitation purposes that are not permitted under the DPPA).
Accordingly, the Court declares31 that Defendants have violated the DPPA as set forth above and
will enjoin the Defendants from continuing any conduct that violates the DPPA 32 with respect to
the subclass as follows:
The Declaratory Judgement Act provides that federal courts “may declare the rights and other
legal relations of any interested party.” 28 U.S.C. § 2201. The Fourth Circuit has explained that a
declaratory judgment action is appropriate “when the judgment will serve a useful purpose in
clarifying and settling the legal relations in issue, and ... when it will terminate and afford relief
from the uncertainty, insecurity, and controversy giving rise to the proceeding.” Centennial Life
Ins. Co. v. Poston, 88 F.3d 255, 256 (4th Cir. 1996) (quoting Aetna Cas. & Sur. Co. v. Quarles, 92
F.2d 321, 325 (4th Cir. 1937)). In short, “declaratory judgments are designed to declare rights so
that parties can conform their conduct to avoid future litigation.” Hipage Co. v. Access2Go, Inc.,
589 F.Supp.2d 602, 615 (E.D. Va. 2008).
31
32
While the Court has not granted summary judgment for the class as a whole for the reasons
described above, the Court finds that there is abundant evidence that the personal information
contained in many of the subclass members’ accident reports came from either the DMV database
through the “F11” function or the compelled production of a driver’s license at the accident scene
such that the Court in the exercise of its discretion under the DPPA to award equitable relief will
enjoin Defendants from any conduct that violates the statute, including the disclosure of any
personal information (not just the class member’s address) that came from the DMV or a driver’s
license. District courts have broad discretion when fashioning injunctive relief. Ostergren v.
Cuccinelli, 615 F.3d 263, 288 (4th Cir. 2010), and an injunction's scope may extend to that which
is “necessary to provide complete relief to the plaintiff.” Mountain Valley Pipeline, LLC v.
Wender, 337 F. Supp. 3d 656, 672 (S.D.W. Va. 2018), citing PBM Prods., LLC v. Mead Johnson
& Co., 639 F.3d 111, 128 (4th Cir. 2011) (quoting Kentuckians for Commonwealth v. Rivenburgh,
317 F.3d 425, 436 (4th Cir. 2003). In the absence of an injunction prohibiting Defendants from
46
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 46 of 49
Defendants and their officers, agents, servants, employees, and attorneys and those
acting in active concert with them are enjoined from disclosing or making access
available to CMPD DMV Form 349 vehicle accident reports that include a North
Carolina resident’s “personal information” as defined in the DPPA and are “motor
vehicle records” under the DPPA or contain such personal information sourced
from the DMV, a driver’s license or other motor vehicle record without redacting
the personal information, obtaining the consent of the person whose personal
information appears on the record or having a good faith belief33 that the accident
report will be used for a specific purpose permitted by the DPPA (which Defendant
shall record and maintain in accordance with 18 U.S.C. § 2721 (c)). 34
C.
Motion to Appoint Interim Counsel and Motion to Stay
The remaining motions before the Court are Plaintiffs’ Motion to Appoint Interim Counsel
and Defendants’ Motion to Stay consideration of the Plaintiffs’ Motion for Summary Judgment.
Both of these motions will be denied as moot. The Court is now certifying a class under Rule 23
disclosing all personal information subject to the DPPA, the members of the subclass would not
receive the “complete relief” to which they are entitled.
In forming a “good faith” belief as to whether an accident report is being disclosed for a purpose
permitted by the DPPA, Defendants must do more than simply obtain a general representation of
a lawful intent to use the record; that is, they must determine the specific purpose for which the
record is being disclosed and form a reasonable belief that the stated purpose is at least credible
under all the circumstances. Defendants do not, however, have an obligation to independently
investigate each proposed use of records subject to the DPPA.
34 Although this injunction does not apply to members of the public outside the certified class, its
reasoning is of course generally applicable to all North Carolina accident reports subject to the
DPPA as described above, and the Court notes that the DPPA provides the Court discretion to
award “punitive damages upon proof of willful or reckless disregard of the law” if future violations
of the DPPA are proven. See 18 U.S.C. § 2724 (b)(2).
47
33
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 47 of 49
(b)(2), appointing Plaintiffs’ counsel as class counsel and denying certification of the Plaintiffs’
other proposed classes; therefore, appointment of interim counsel is unnecessary. Similarly,
because the Court is declining to certify a class under Rule 23(b)(3), the only type of class which
provides potential class members the right to “opt-out” which was the root of Defendants’ concern,
and the Court has in any event entered summary judgment for Plaintiffs’ subclass, there is no basis
for the Court to further consider the Defendants’ requested stay.
IV.
ORDER
NOW THEREFORE IT IS ORDERED THAT:
1. Plaintiff’s Motion to Certify Class (Doc. No. 101) is GRANTED in part and
DENIED in part as described above;
2. Plaintiffs’ counsel, Larry S. McDevitt, David M. Wilkerson, Eugene C. Covington,
Jr. and Chris Cogdill are appointed as class counsel for the certified class pursuant
to Rule 23(g);
3. Plaintiffs’ Motion for Summary Judgment (Doc. No. 107) is GRANTED in part
and DENIED in part as described above;
4. Defendants and their officers, agents, servants, employees, and attorneys and those
acting in active concert with them are enjoined from violating the DPPA as
described above;
5. Defendants’ Motion for Summary Judgment (Doc. No. 109) is DENIED;
6. Plaintiffs’ Motion for Appointment of Interim Co-Lead and Liaison counsel (Doc.
No. 103) is DENIED as moot;
48
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 48 of 49
7. Defendants’ Motion to Stay a ruling on Plaintiffs’ Motion for Summary Judgment
(Doc. No. 120) is DENIED as moot; and
8. This case shall proceed to trial on the merits on Plaintiffs’ claim for statutory
liquidated damages and the full certified class’ claim for injunctive relief in
the absence of a voluntary resolution of the dispute among the parties.
SO ORDERED ADJUDGED AND DECREED.
Signed: September 2, 2020
2020
49
Case 5:16-cv-00009-KDB-DCK Document 148 Filed 09/02/20 Page 49 of 49
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?