Current Issues under the Driver s Privacy Protection Act *

Transcription

1 96 Current Issues under the Driver s Privacy Protection Act * By John L. Ropiequet John L. Ropiequet is Counsel to the Litigation Group of Arnstein & Lehr LLP, in Chicago, where he has practiced since 1973, and Co-Chair of its Consumer ˇinance Group. His litigation experience includes consumer finance class action, anti-trust, environmental, and commercial cases in numerous state and federal courts. Mr. Ropiequet is a graduate of The Johns Hopkins University and Northwestern University School of Law. He writes and speaks frequently on issues involving consumer credit class actions, evidentiary privilege, legal ethics and other matters. John is a contributing editor to THE LAW Oˇ TRUTH IN LENDING (Alvin C. Harrell, ed & 2015 Suppl.), on private remedies for TILA violations and the author of numerous articles on a variety of consumer finance topics in The Business Lawyer, the Consumer Finance Law Quarterly Report and other publications. He is a member of the Governing Committee of the Conference on Consumer ˇinance Law and Chairman of the Conference, a ˇellow of the American College of Consumer ˇinancial Services Lawyers, and Co-Editor of the Annual Survey of Consumer ˇinancial Services Law in The Business Lawyer. I. Introduction The Driver s Privacy Protection Act of 1994 (DPPA or the Act) 1 was enacted as part of a series of crime prevention measures. 2 Prior to its enactment, state Departments of Motor Vehicles (DMVs) sold lists of motor vehicle licensees with their personal identifiers, including names, addresses, and Social Security numbers, to direct marketers on a bulk basis, and also released the information to individuals on request. 3 A few states had an opt-out system that would allow registrants to keep their personal information private, but that was the exception rather than the rule. 4 The DPPA changed that by prohibiting state DMVs from releasing such information except to the extent that the DPPA permits release. One incident that motivated Congress to enact the DPPA was a case where a television actress who had an unlisted home address was pursued and murdered by a stalker who used the California DMV records to find her address. 5 In addition, other criminals used DMV information to commit murder, send women threatening letters, and steal expensive cars. 6 * This article is adapted from an earlier version that was published in the Banking & ˇinancial Services Policy Report. Reprinted with permission. 1. Pub. L. No , tit. XXX, Sec (a), 108 Stat (Sept. 13, 1994) (codified as amended at 18 U.S.C (2012)). 2. See id. tit. I-XXXII (codified as amended at scattered sections of 18 U.S.C.). 3. Taylor v. Acxiom Corp., 612 ˇ.3d 325, & nn.9 10 (5th Cir. 2010), cert. denied, 562 U.S (2011). 4. Id. at 337 n See id. at 336. See also: Maracich v. Spears, 133 S. Ct. 2191, 2198 (2013); and Pichler v. UNITE, 542 ˇ.3d 380, 400 (3d Cir. 2008) (dissenting opinion). 6. See Taylor v. Acxiom Corp., No. 2:07-cv-0001, 2008 U.S. Dist. LEXIS , at *15 16 (E.D. Tex. Sept. 8, 2008), aff d, 612 ˇ.3d 325 (5th Cir. 2010), cert. denied, 562 U.S (2011). Although the DPPA was contained in a law enforcement enactment, and is part of the U.S. Criminal Code, its main purpose is to protect the privacy of individuals personal information from improper usage. 7 As noted by the U.S. Supreme Court, the second factor that motivated Congress to enact the DPPA was the States common practice of selling personal information to businesses engaged in direct marketing and solicitation. 8 The DPPA protects personal privacy by prohibiting DMVs from disclosing licensees personal information unless the disclosure is done for a reason on the list of permissible uses. 9 The permissible uses exclude commercial use of registrants names and addresses for marketing purposes except to the extent that individuals have given express consent to their DMV for receiving solicitations. 10 The DPPA has one feature that has attracted the attention of the plaintiff s class action bar. The statute includes the right to bring a civil action for violation of the Act that allows for individual statutory damages of $2,500 plus reasonable attorney s fees and costs, with no limitation on the amount that can be awarded to a plaintiff class. 11 This feature has tempted attorneys to try to turn the shield provided by the DPPA into a class action sword. However, to date, class certification appears to be relatively infrequent in DPPA cases, and many class 7. See Maracich, 133 S. Ct. 2191, 2204 (discussed infra at Part III.B.4.). 8. Id. at See also Reno v. Condon, 528 U.S. 141, (2000) (discussed infra at Part III.A.). 9. See 18 U.S.C. 2721(a). 10. See id. 2721(b)(12). 11. Id. 2724(a) (b). This is more than other statutes provide for an individual plaintiff s statutory damages or for class damages. See infra notes

2 97 action cases have been dismissed at the pleadings stage for a variety of reasons. II. Basic Provisions of the DPPA A. DPPA Prohibitions Section 2721(a) of the DPPA prohibits state DMVs, their officers, and contractors from knowingly disclosing a licensee s personal information, as defined in the Act, except for fourteen specified permitted uses listed below in Part II.C. 12 It also prohibits DMVs, their employees, and contractors from releasing highly restricted personal information, as defined in the Act, except for a more narrowly drawn list of four of the fourteen permitted uses. 13 Personal information is identifying information about an individual including the following: An individual s photograph, social security number, driver identification number, name, address telephone number and medical or disability information, but excluding a five-digit zip code and information on vehicular accidents, driving violations, and driver s status. 14 Highly restricted personal information is a subset of personal information, consisting of an individual s photograph or image, social security number, medical or disability information. 15 Organ donation information contained on a driver s license is excepted from the prohibition against use of highly restricted personal information, however. 16 The DPPA provides for two types of criminal penalties. Under section 2723, which is directed at DMVs, a knowing violation of the prohibitions in section 2721(a) can result in a criminal fine against an individual and a civil penalty against a state DMV that fails to comply with the requirements of the DPPA. 17 Section 2722, which is directed to recipients of DMV information, makes it unlawful for a person knowingly to obtain or disclose personal information from a motor vehicle record, for any use not permitted by the DPPA, or to make false representation to obtain any personal information from an individual s motor vehicle record. 18 B. DPPA Civil Liability The DPPA creates a civil action against individuals who impermissibly use motor vehicle record information. A motor vehicle record is any driver s license, motor vehicle title or registration, or DMV identification card. 19 Thus, any person who knowingly obtains, discloses or uses personal information, from a motor vehicle record for an unpermitted use shall be liable to the individual to whom the information pertains. 20 The DPPA sets forth the following civil remedies: The court may award (1) actual damages, but not less than liquidated damages in the amount of $2,500; (2) punitive damages upon proof of willful or reckless disregard of the law; (3) reasonable attorneys fees and other litigation costs reasonably incurred; and (4) such other preliminary and equitable relief as the court determines to be appropriate. 21 Unlike other statutes that allow for statutory damages but place a cap on class action awards, 22 there is no provision that specifically relates to class actions in the DPPA, nor is there a limitation on damages for the members of a class. There is, therefore, no restriction on a potential class award at the rate of $2,500 per class member, which itself is more than other statutes award to an individual plaintiff for statutory damages. 23 C. Permissible Uses of Personal Information Section 2721(b) of the DPPA provides a list of fourteen permissible uses for DMV records of licensees personal information. Many of the case decisions under the DPPA deal with the question of whether the conduct at issue falls within one of the permissible uses, either for the original recipient of the information from a DMV, or for subsequent recipients to whom the information is resold pursuant to section 2721(c). If it the complained-of conduct does constitute a permitted use, it is non-actionable. The section begins with a general statement that personal information shall be disclosed with respect to several different kinds of matters, specifically for motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of several listed federal statutes. 24 Beyond that mandatory disclosure, disclosure of drivers personal information is permissible under the following circumstances: U.S.C. 2721(a)(1). 13. Id. 2721(a)(2) U.S.C. 2725(3). 15. Id. 2725(4) U.S.C. 2721(a)(2) U.S.C. 2723(a) (b) U.S.C. 2722(a) (b) U.S.C. 2725(1) U.S.C. 2724(a). 21. Id. 2724(b). 22. See, e.g.: 15 U.S.C. 1640(a)(2)(B) (cap of lesser of $1 million or 1% of defendant s net worth); 15 U.S.C. 1962k(2)(B) (cap of lesser of $500,000 or 1% of defendant s net worth). 23. See, e.g.: 15 U.S.C. 1692k(2)(A) ($1,000 in statutory damages); 47 U.S.C. 227(b)(3)(B) ($500 in statutory damages, which can be trebled for willful violations) U.S.C. 2721(b).

3 98 Section 2721(b)(1) provides that government agencies, including courts and law enforcement agencies and private persons acting on their behalf, may use the information to carry out their functions. 25 This category includes disclosure of highly restricted personal information. 26 Overlapping the mandatory use provision at the beginning of the section, section 2721(b)(2) provides that such information may be used for: matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities; and removal of nonowner records from the original owner records of motor vehicle manufacturers. 27 Section 2721(b)(3) provides that personal information can be used in the normal course of business by a legitimate business in order to verify the accuracy of personal information submitted by the individual or to obtain the correct information to prevent fraud, pursue legal remedies, or recover on a debt where the information that was submitted is not correct or is no longer correct. 28 Section 2721(b)(4) provides that personal information may be used in civil or criminal court cases or arbitrations, including the service of process, 25. Id. 2721(b)(1). 26. Id. 2721(a)(2). 27. Id. 2721(b)(2). 28. Id. 2721(b)(3). investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to court order. 29 This category includes disclosure of highly restricted personal information. 30 Section 2721(b)(5) provides that personal information can be used for research and statistical purposes if the information is not published, re-disclosed, or used to contact individuals. 31 Section 2721(b)(6) provides that insurance companies and selfinsured entities can use personal information in connection with claims investigation activities, anti-fraud activities, rating or underwriting. 32 This category includes disclosure of highly restricted personal information. 33 Section 2721(b)(7) provides that personal information can be used to give notice to owners of towed or impounded vehicles. 34 Section 2721(b)(8) provides that licensed private investigators or security services can use personal information for a permitted purpose. 35 Section 2721(b)(9) provides that employers and insurers can use personal information to obtain or verify information relating to a holder of a commercial driver s license 29. Id. 2721(b)(4). 30. Id. 2721(a)(2). 31. Id. 2721(b)(5). 32. Id. 2721(b)(6). 33. Id. 2721(a)(2). 34. Id. 2721(b)(7). 35. Id. 2721(b)(8). that is required under federal law. 36 This category includes disclosure of highly restricted personal information. 37 Section 2721(b)(10) provides that personal information can be used for the operations of private toll transportation facilities. 38 Section 2721(b)(11) provides that personal information can be used if the DMV has obtained the individual s express consent to its use. 39 Express consent must be made in writing or conveyed with an electronic signature. 40 Section 2721(b)(12) provides that if the DMV has obtained an individual s express consent, personal information can be used [f]or bulk distribution of surveys, marketing or solicitations. 41 Section 2721(b)(13) provides that personal information can be given to a requester if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains. 42 Section 2721(b)(14) provides that personal information can be used for any motor vehicle operation or public safety use that is authorized by state law Id. 2721(b)(9). 37. Id. 2721(a)(2). 38. Id. 2721(b)(10). 39. Id. 2721(b)(11) U.S.C. 2725(5) U.S.C. 2721(b)(12). 42. Id. 2721(b)(13). 43. Id. 2721(b)(14).

4 99 Section 2721(c) allows persons who have obtained personal driver information for a permitted use to resell or re-disclose the information to another person for a permitted use. 44 If the individual who is the subject of the record has given express consent to a DMV, the information can be resold or re-disclosed for any purpose. 45 Persons who resell or re-disclose the information are required to keep records for five years identifying the recipients of the information that they have resold or re-disclosed along with the permitted reason for the resale or re-disclosure. 46 Section 2721(d) permits state DMVs to provide procedures to allow requesters who make requests that are not for a permissible purpose to request that individuals who have not previously given an express consent waive their right to privacy. 47 To prevent the states from making an end run around the prohibitions in the DPPA, section 2721(e) prohibits the states from requiring licensees to give express consent to disclosure as a condition for issuing a license. 48 III. Current Issues in DPPA Litigation A. Constitutional Issues The DPPA was the subject of a constitutional challenge in Reno v. Condon 49 shortly after the DPPA was enacted. In that case, the South Carolina Attorney General brought suit to challenge the DPPA as being violative of the Tenth and Eleventh Amendments. The district court held that the DPPA was incompatible with the principles of federalism expressed in those Amendments and issued a permanent injunction against enforcement of the act, which was affirmed by 44. Id. 2721(c) 45. Id. 46. Id. 47. Id. 2721(d) 48. Id. 2721(e) U.S. 141 (2000). 50. Condon v. Reno, 972 ˇ. Supp.977 (D.S.C. 1997), aff d, 155 ˇ.3d 453 (4th Cir. 1998), rev d, 521 U.S. 141 (2000). 51. See: Travis v. Reno, 163 ˇ.3d 1000 (7th Cir. 1998), cert. denied, 528 U.S (2000) (Wisconsin challenge); Oklahoma v. Reno, 161 ˇ.3d 1266 (10th Cir. 1998), cert. denied, 528 U.S (2000) (Oklahoma challenge). 52. See Pryor v. Reno, 171 ˇ.3d 1281 (11th Cir. 1999), vacated, 528 U.S (2000) (Alabama challenge). 53. Condon, 521 U.S. at 148 (see supra note 50). 54. Id. at 149 (citing: New York v. United States, 504 U.S. 144, 162 (1992); and Printz v. United States, 521 U.S. 898, 902, 935 (1997)). 55. Id. at (internal quotation marks removed). the United States Court of Appeals for the ˇourth Circuit. 50 Although the Condon Court did not mention a circuit split on the constitutionality of the DPPA, the Seventh and Tenth Circuit United States Courts of Appeals disagreed with the ˇourth Circuit s decision and found that it was constitutional, 51 while the United States Court of Appeals for the Eleventh Circuit found it unconstitutional. 52 The U.S. Supreme Court unanimously reversed the ˇourth Circuit s decision in Condon. The Supreme Court held that the DPPA regulated an article of commerce, the sale in interstate commerce of drivers information, which the States have historically sold for use by insurers, manufacturers, direct marketers, and others engaged in interstate commerce to contact drivers with customized solicitations. 53 At issue was whether the effect of the DPPA was the same as that of statutes in other cases in which the Court had found a Tenth Amendment violation because Congress commandeered the state legislative process by requiring a state legislature to enact a particular kind of law, or the statute commanded state and local enforcement officers to conduct background checks on prospective hand gun purchasers. 54 South Carolina argued that there was a Tenth Amendment violation because the DPPA requires the states to exercise all of the day-to-day responsibility for administering its complex provisions, making the state s officials the unwilling implementers of federal policy. 55 However, although the Supreme Court conceded that the DPPA will require time and effort on the part of state employees, it found that there was a permissible exercise of federal power under the Commerce Clause because the DPPA regulates state activities rather controlling or influencing how states regulate private parties. 56 Thus, the Court found: [T]he DPPA does not require the States in their sovereign capacity to regulate their own citizens. The DPPA regulates the States as the owners of data bases. It does not require the South Carolina Legislature to enact any laws or regulations, and it does not require state officials to assist in the enforcement of federal statutes regulating private individuals. 57 Subsequent to the decision in Condon, constitutional issues have only occasionally arisen in DPPA cases. The only case that has dealt with a significant constitutional issue was Dahlstrom v. Sun-Times Media, LLC. 58 The defendant newspaper published information about several police officers, who were involved in a high-profile homicide investigation of the actions of the nephew of Chicago Mayor Richard Daley, that included the officers dates of birth, height, weight, hair color, and eye color, information that the paper allegedly knowingly obtained from DMV records in violation of the DPPA. 59 Among the grounds raised in the newspaper s motion to dismiss was that the requested injunctive relief of requiring it to permanently remove their information from its publications violated the ˇirst Amendment as an unconstitutional prior restraint on speech. 60 On an interlocutory appeal of the trial court s finding that there was no unconstitutional prior restraint, the United States Court of Appeals for the Seventh Circuit addressed the effect of 56. Id. at 150 (citing South Carolina v. Baker, 485 U.S. 505, (1988)). 57. Id. at ˇ.3d 937 (7th Cir.), cert. denied, 136 S. Ct. 689 (2015). 59. Id. at Id. at

5 100 the requested relief with respect to the plaintiff officers personal information. The Dahlstrom court found first that newspapers have no special right of access to information and that laws of general application which merely have incidental effects on the ability to gather and report the news do not violate the ˇirst Amendment. 61 Thus, the limitation on access to information stemming from the DPPA s prohibition on obtaining it from drivers records alleged no cognizable ˇirst Amendment injury. 62 In addition, the court found that there was no suppression of speech in a constitutional sense because the DPPA only prohibited the acquisition of personal information from a single, isolated source that had no effect on the newspaper s right to publish information which could be obtained from other lawful sources. 63 The second constitutional issue was whether a prohibition against publishing information obtained in violation of the DPPA would constitute a separate violation of the ˇirst Amendment. The Dahlstrom court noted that prohibiting disclosure of such information is a direct regulation of speech. 64 Observing that publication of the same information would be permitted so long as that information flows from a source other than driving records, the court found that the DPPA prohibition was not a limitation on disclosure of personal information... because [Congress] disagreed with the message communicated by drivers personal details, but [was enacted] in order to keep individuals identifying information out of the hands of potential stalkers. 65 The DPPA was therefore content neutral because its 61. Id. at (citing: Branzburg v. Hayes, 408 U.S. 665, 707 (1972); Pell v. Procunier, 417 U.S. 817, 833 (1974); and Cohen v. Cowles Media Co., 501 U.S. 663, 669 (1991)). 62. Id. at 947 (citing Travis v. Reno, 163 ˇ.3d 1000, 1007 (7th Cir. 1998)). 63. Id. at Id. at Id. at 950. public safety goals are unrelated to the content of [the regulated] expression. 66 The Dahlstrom court distinguished the situation from the one in Smith v. Daily Mail Publishing Co., 67 because in Smith, the state statute which prohibited the press from publishing the names of youths charged as juveniles dealt with information that the newspaper had lawfully obtained. 68 Likewise, the Dahlstrom court distinguished Bartnicki v. Vopper, 69 which dealt with a cell phone conversation that was illegally intercepted by a third party because the newspaper s access to the information in Dahlstrom was obtained lawfully. 70 Noting that Bartnicki had left an open question as to whether a newspaper s unlawful acquisition of information can be punished and restrained, which it characterized as uncharted territory, the Dahlstrom court found that the issue before it was whether the limitation on disclosure in section 2722(a) of the DPPA furthered an important or substantial governmental interest unrelated to the suppression of free expression, with only an incidental restriction on the ˇirst Amendment that is no greater than is essential to the furtherance of that interest. 71 The court found that the balance tipped away from the defendant newspaper s ˇirst Amendment rights because, while the article related to a matter of public significance, namely whether the Chicago Police Department manipulated a homicide investigation, the details about the plaintiff officers physical traits was largely redundant of what the public could easily observe from their photographs, so that a prohibition would do little to advance Sun- 66. Id. (citing Ward v. Rock Against Racism, 491 U.S. 781, 791 (1989)) U.S. 97 (1979). 68. Dahlstrom, 777 ˇ. 3d at (citing Smith, 443 U.S. at 98, 105) U.S. 514 (2001). 70. Dahlstrom, 777 ˇ. 3d at 951 (citing Bartnicki, 532 U.S. at , 525). 71. Id. at (citing: Bartnicki, 532 U.S. at 528; and Turner Broad. Sys. v. ˇed. Commc n Comm n, 512 U.S. 622, 662 (1994)). Times s reporting on a story of public concern, and would not override the government s substantial interest in privacy protection of the officers personal information in their driver records. 72 Continuing its analysis, the Dahlstrom court found that the government s interests in deterring the initial illegal acquisition of personal information and protecting the privacy of individuals whose information has been illegally obtained were not related to the suppression of free expression and instead relate to the promotion of public safety. 73 The court noted that the disclosure prohibition in the DPPA contains several safeguards characteristic of narrow tailoring necessary to make any encroachment on ˇirst Amendment freedoms limited to the extent necessary to further those government interests for the following reasons: [I]t is content neutral, it permits publication of the same information gathered from lawful sources, it imposes no special burden upon the media, and it has a scienter requirement ( knowingly ) to provide fair warning to potential offenders. 74 This narrow tailoring plus the DPPA s fourteen permissible use exceptions led the court to conclude that the statute does not burden substantially more speech than necessary to further the government s legitimate interests. 75 It therefore affirmed the denial of the newspaper s motion to dismiss on ˇirst Amendment grounds. 76 B. Issues of Interpretation 1. Introduction The body of case law concerning the DPPA has grown slowly in the 72. Id. at Id. at Id. (citing Bartnicki, 532 U.S. at 548). 75. Id. 76. Id. at

6 101 years since the Supreme Court found it constitutional in Condon. Some cases have focused on determining how a particular provision of the DPPA should be interpreted while other cases have considered what types of fact scenarios either constitute actionable violations or qualify as permissible uses of DMV information, and therefore are not actionable. While many cases have been filed as class actions, few DPPA classes have been certified. Many additional cases have involved matters that qualify only as individual rather than class claims. The issues in the reported DPPA cases can be categorized generally as follows: What constitutes disclosure of protected information? Must the information be used immediately after it is obtained? When do permissible uses become impermissible? Is there vicarious liability under the DPPA? What damages must be alleged? 2. What Constitutes Disclosure of Protected Information? While most DPPA cases do not examine the issue of whether a disclosure of personal information from DMV records has taken place, this question was the subject of close review in a series of decisions by the Seventh Circuit in Senne v Village of Palatine. 77 Senne arose from a $20 dollar parking ticket for illegal overnight parking that was left on the plaintiff s windshield. 78 This led to filing a multi-million-dollar ˇ.3d 919 (7th Cir. 2001), vacated en banc, 695 ˇ.3d 597 (7th Cir. 2012), cert. denied, 133 S. Ct. 2850, after remand, 6 ˇ. Supp.3d 786 (N.D. Ill. 2013), aff d, 784 ˇ.3d 444 (7th Cir.), cert. denied, 136 S. Ct. 419 (2015). 78. Id. at 920. class action lawsuit for disclosing personal information from DMV records. 79 The case was dismissed by the district court, which was affirmed by the Seventh Circuit on the initial appeal. Since it was undisputed that the plaintiff s personal information was obtained from DMV records, the first issue addressed by the Seventh Circuit was whether putting the information in a parking ticket citation that is readily accessible to passersby discloses the information under section 2721(a)(1) of the DPPA. 80 The Senne court rejected the village s argument that the disclosure must be made to someone other than the individual in the record, finding that [w]hen a citation with personal information has been placed on an automobile, readily viewable and free for the taking, it cannot be gainsaid that the recipient s personal information has been made available. 81 The second issue was whether the village s actions fell within one of the fourteen permissible uses under section 2721(b). The court found that it came within the permissible use in subsection (b)(4), [f]or use in connection with any civil, criminal, administrative, or arbitral proceeding in any court or agency or before any self-regulatory body, including the service of process, since the parking citation constituted service of legal process of under state law. 82 The court rejected the plaintiff s argument that the subsection (b)(4) exception did not apply because printing the plaintiff s information on the citation did not aid service of process, on the ground that [t]he statute does not ask whether the service of process reveals no more information than necessary to effect service, and so neither do we. 83 It therefore affirmed the dismissal of the complaint Id. 80. Id. at Id. at Id. at Id. at Id. at 925. However, one judge on the panel dissented in part, on the grounds the Village has violated the DPPA through excessive disclosure of personal information on parking tickets, stating that Congress did not contemplate that the permissible uses would justify any disclosure, but only those that are reasonable in light of the permitted use. 85 The ticket included more than was necessary to notify the owner of a car that he is financially liable for an administrative violation, because it included, for the public to view, the owner s home address, driver s license number, date of birth, sex and height or the vehicle identification number. 86 The dissent posited that the majority opinion facilitates the very wrongdoing that Congress intended to thwart, such as that an individual seeking to stalk or rape can go down a street where overnight parking is banned and collect the home address and personal information of women whose vehicles have been tagged and their personal information left for him to see. 87 ˇollowing this decision, the case was reheard by the Seventh Circuit en banc. The panel decision was vacated on a seven-to-four vote, with the majority opinion being written by the dissenter and the principal dissent being written by the author of the panel decision. 88 The majority again rejected the village s argument that putting the ticket on the windshield was not a disclosure within the meaning of the DPPA because no one other than the plaintiff saw it. 89 The court noted that under the statutory scheme, all disclosure of DMV information is prohibited unless it falls within one of the specific authorizations in section 2721(b). 90 With respect to the village s argument that it came within both section 2721(b)(1), [f]or use by a law enforcement agency [ ] in carrying out 85. Id. at (Ripple, J., dissenting). 86. Id. at Id. at Senne v. Vill. of Palatine, 695 ˇ.3d 597 (7th Cir. 2012), cert. denied, 133 S. Ct (2013). 89. Id. at Id.

7 102 its functions, and section 2721(b)(4), for the service of process function, the majority found that the key issue was the meaning of the phrase for use in both subsections of the statute. 91 The court found that those words performed a critical function and contain the necessary limiting principle that preserves the force of the general prohibition while permitting the disclosures compatible with that prohibition. 92 Accordingly, while a disclosure is authorized when it is used for the identified purpose, the contrary result occurs for unused information: When a particular piece of disclosed information is not used to effectuate that purpose in any way, the exception provides no protection for the disclosing party. In short, an authorized recipient, faced with the general prohibition against further disclosure, can disclose the information only in a manner that does not exceed the scope of the authorized statutory exception. The disclosure actually made under the exception must be compatible with the purpose of the exception. Otherwise, the statute s purpose of safeguarding information for security and safety reasons, contained in the general prohibition against disclosure, is frustrated. 93 The majority also found that the legislative history supported its narrow interpretation of the language for use, since numerous witnesses testified regarding the grave consequences of open access to government records of personal information. 94 The principal dissent continued to take issue with this interpretation, reiterating that the DPPA contained no provision that limits the amount of personal information that can be disclosed so long as the disclosure fits within the requirements of section 2721(b)(4). 95 The dissent noted that while there were some provisions in section 2721(b) that limit how the information can be used, section 2721(b)(4) does not contain any words of limitation. 96 While Congress was concerned about the dangers of disclosing personal information, the dissent found that [r]ather than evincing the intent to guard against all imaginable dangers, the legislative history emphasizes Congress s intent to prevent the specific danger that arises when individuals are able to obtain personal information upon request from state motor vehicle records. 97 The type of risks created by a stalker stumbling upon a parking citation containing information about his or her target, or a miscreant selecting a target based upon information provided in the citation were not the types of crimes that motivated Congress to enact the DPPA. 98 The dissent also found that its categorical approach towards disclosure may end up over- or under-inclusive at times, but it has the virtue of being straightforward, predictable, and less costly to administer, and that it would also avoid tasking the judiciary with determining what pieces of information are needed in order to carry out the purpose of the applicable exception. 99 It also observed that the majority shed little light on how to distinguish proper from improper disclosures. 100 An additional dissent by Judge Posner remarked that it was difficult to imagine that a stalker would follow a woman when she drives home and lurk behind her car in hopes that it would be ticketed so that he could find her name and address, rather than just following her home without waiting to see if she got a parking ticket with personal information on it. 101 In addition, he observed that putting a full set of personal information on the ticket, rather than only some of it, served a modest error-correction function and that the majority approach is apt to entangle the courts in closer questions of the legitimacy of including particular personal information on a parking ticket, questions that will generate costly and time-consuming litigation and pointless wealth transfers from taxpayers to violators of the parking laws through the vehicle of a class action lawsuit. 102 Although the Senne court imposed tight restrictions on the use of personal information under the DPPA, at least for cases originating in the Seventh Circuit, this was not the end of the story. On remand, the trial court entered summary judgment in favor of the village, which was affirmed on the second appeal in an opinion by Judge Posner. 103 The village s chief of police provided evidence about how the information on the parking ticket is used that was not contested by the plaintiff. ˇor example, he testified that putting all of the personal information on the ticket increases the likelihood that the ticket will be paid since it shows that the police can find the car s driver or owner, which would therefore make the car s borrower or renter more likely to pay the ticket than leaving the innocent owner responsible for it. 104 Additional testimony established that tickets can be voided in case of error in the personal information, persons with poor English proficiency and people who do not have their driver s licenses available can use the ticket for identification purposes upon being stopped by police, and people can use the ticket to correct motor vehicle records, as the plaintiff himself did Id. at Id. at Id. 94. Id. at Id. at 613 (ˇlaum, J., dissenting). 96. Id. at Id. at Id. at Id. at Id Id. at 610 (Posner, J., dissenting) Id. at Senne v. Vill. of Palatine, 6 ˇ. Supp. 3d 786 (N.D. Ill. 2013), aff d, 784 ˇ.3d 444 (7th Cir.), cert. denied, 136 S. Ct. 419 (2015) Senne, 784 ˇ.3d at Id. at

8 103 Judge Posner also noted that the DPPA case law, including the Seventh Circuit s decision in Graczyk v. West Publishing Co., 106 clearly established that a permitted use allows all of a driver s personal information to be accumulated even if it is not used immediately Must the Information Be Used Immediately After It is Obtained? The Graczyk decision was one of several cases which have dealt with the issue of whether information that has been obtained in bulk from a DMV must be used immediately in order to qualify as a use for a permitted purpose. Several class action cases have sought recovery under the DPPA against companies that obtained information pursuant to section 2721(b)(3) for legitimate business purposes that added the DMV information to their databases on a regular and continuing basis and then resold the information pursuant to section 2721(c) to other users of the information. At issue in these cases was whether the companies could continue their practice of stockpiling the information for later use by their subscribers and customers. The leading case discussing this issue is Taylor v. Acxiom Corp., 108 where the plaintiffs filed a class action seeking vast potential liquidated damages over the defendants practice of purchasing the entire Texas DMV driver s license database for the purpose of reselling the information. 109 The Acxiom court first dealt with the group of defendants that did not resell information and used some of the information for a permitted purpose soon after purchase, but did not use all of the records. The court found no DPPA violation for this type of bulk obtainment. 110 It found no support in ˇ.3d 275 (7th Cir. 2011) Senne, 784 ˇ.3d at 447 (citing Graczyk, 660 ˇ.3d at 279) ˇ.3d 325 (5th Cir. 2010), cert. denied, 131 U.S. 908 (2011) Id. at Id. at 335. the statutory language for the argument that the statute generally prohibited bulk distribution where the recipient had a permissible use for the records since it found that the legislative history clearly reflects that Congress did not intend to suppress legitimate business uses of motor vehicle records. 111 The court analogized a reading of the DPPA as only allowing individual sale of DMV records for immediate use to a restriction on the sale of a set of legal reporters for the purpose of legal research where the purchaser must plan on reading every opinion in every volume of the reporters. 112 It therefore held that when a person obtains motor vehicle records in bulk for one of the permissible uses listed in 18 U.S.C. [section] 2721(b), and does not actually use, or intend to use, any of the information in a manner prohibited by section 2721(b), then that person does not obtain the records for a purpose not permitted under the DPPA. 113 With respect to the group of defendants that compiled databases for the purpose of reselling DMV information, the plaintiffs argued that the reseller defendants must make a permissible use of records before reselling them under section 2721(c). 114 The Taylor court found no basis for that argument in the statute, and instead held that the only reasonable construction of authorized recipient [in section 2721(c)] requires no actual use. 115 The Taylor ruling concerning bulk purchases was followed by the United States Court of Appeals for the Sixth Circuit in Roth v. Guzman. 116 Roth was a class action against state officials who allegedly violated the DPPA by selling Ohio DMV records in bulk to Shadow- Soft, Inc., a company that was in the business of maintaining a public records 111. Id. at Id. at Id Id. at Id. (citing Russell v. Choicepoint Servs., Inc., 300 ˇ. Supp.2d 450, (E.D. La. 2004)) ˇ.3d 603 (6th Cir. 2011). database for resale of the information in it. 117 ShadowSoft allegedly resold the data in bulk to another company, Public Data, which made the information available online to its customers. 118 The defendants relied on the permissible use provision in section 2721(b)(3) for use of information by a legitimate business to verify the accuracy of personal information submitted by the individual to the business. 119 The Roth court first dealt with whether a DPPA claim was stated where it was alleged that ShadowSoft, the original recipient of the information, had stated an explicitly permissible purpose for obtaining the information to the defendant officials but falsely represented what it intended to do with the information after it got it. 120 The court found that making the defendants liable for any subsequent misuse of the information would convert the DPPA into a strict liability statute, which was contrary to the language of the statute. 121 Accordingly, the court found that the defendants would only be liable if they knowingly made disclosures for a non-permitted purpose. 122 Since ShadowSoft s representations to the defendants stated a permissible purpose, there was no liability under the DPPA for the disclosures. 123 This was particularly true since there was nothing in ShadowSoft s information requests that would have put the defendants on notice that it was making any misrepresentation about its use of the DMV information. 124 The Roth court distinguished Welch v. Theodorides-Bustle, 125 a class action case against a ˇlorida official who sold information in bulk to ShadowSoft in which the court found against the defendant official on the claim that the bulk 117. Id. at Id. at Id. at Id. at Id Id Id Id. at ˇ. Supp.2d 1283 (N.D. ˇla. 2010).

9 104 disclosure of ˇlorida DMV information violated the DPPA. The Roth court based its distinction on a specific finding in Welch that the ShadowSoft contracts in ˇlorida did not specify either a proper purpose for the disclosures, or the uses and further disclosures that it would or would not make, so that there was a failure to fulfill the DPPA requirement of specifying a permissible purpose for requesting the DMV information. 126 After Roth was decided, the Welch court subsequently found in favor of the defendant official following a bench trial since there was no evidence of misuse of the information by ShadowSoft or its customer, Public Data. 127 Notably, the Welch court found that Public Data s use of a dropdown menu that required its customers to swear under penalty of perjury that they had one of fourteen permissible purposes for accessing the information online met the DPPA s permissible use requirements. 128 However, in a later decision, Gordon v. Softech International, Inc., 129 the Second Circuit cast considerable doubt on the use of a dropdown menu for this purpose. After observing that resellers are obliged to use some care in disclosing personal information obtained from motor vehicle records and that they must be obliged to make some inquiry before concluding that disclosure is permitted, the Gordon court concluded that the reseller s obligations under the DPPA could not be met simply by accepting the end user s mere say-so if there were red flags that suggested an improper purpose for the inquiry. 130 Specifically, the court suggested that securing a representation that the recipient of personal information had a permissible use or hiding behind one or more dropdown menus would not 126. Roth, 650 ˇ.3d at 611. Welch was subsequently certified as a class action. See Welch v. Theodorides-Bustle, 273 ˇ.R.D. 692 (N.D. ˇla. 2010) ˇ. Supp.2d 1253, 1255 (N.D. ˇla. 2011) Id ˇ.3d 42 (2d Cir. 2013), cert. denied, 134 S. Ct. 923, 925 (2014) Id. at meet the resellers duty of reasonable care. 131 Thus, the court found, in light of the congressional intent to safeguard the privacy and safety of drivers, it is inconceivable that a dropdown menu, a check box, and a representation that no laws would be violated could satisfy any reasonable diligence floor. 132 The Roth court also followed Taylor on the plaintiff s second claim, that bulk disclosures like those made by the defendant officials are not authorized for a request made under subsection (b)(3). 133 The Roth court agreed that there was nothing in the DPPA that limited disclosure of personal information under the subsection to individual records rather than complete databases. 134 Thus, stockpiling information from bulk disclosures did not violate the statute. 135 The Welch court also followed Taylor on the stockpiling issue. 136 Taylor and Roth were also followed by the Ninth Circuit on the stockpiling issue in Howard v. Criminal Information Services, Inc., 137 where the court remarked that the Plaintiffs argument confuses Defendants purposes for obtaining the information with the Defendants reasons for obtaining the information in bulk. 138 The Howard court found no problem with the Defendants obtaining the personal information for future use, even if they may never use it since the DPPA contains no temporal requirement for when the information obtained must be used for the permissible purpose. 139 ˇinally, the same result was reached in Graczyk v. West Publishing Co Id. at Id. at Roth, 650 ˇ.3d at Id. at Id. at (citing Taylor, 612 ˇ.3d at 337) Welch, 770 ˇ. Supp.2d at ˇ.3d 887 (9th Cir. 2011) cert. denied, 132 S. Ct (2012) Id. at Id. at 892 (citing: Taylor, 612 ˇ.3d at 340; and Roth, 650 ˇ.3d at ) ˇ.3d 275 (7th Cir. 2011), cert. denied, 132 S. Ct (2012). The plaintiffs brought a purported class action against West on behalf of drivers in several states based on West s acquisition of DMV records for purposes of resale. 141 The plaintiffs argued that acquiring the information for resale was not a permissible use under section 2721(b) since that purpose is not listed there. 142 They made no allegation that West s customers lacked permissible uses, but instead contended that the DPPA does not allow obtaining and storing records in bulk for later resale to a customer that has a permissible use. 143 The Seventh Circuit found no problem with West s storage of the data for later resale, since there is no prohibition in the DPPA about storing records once there is a valid use for them. 144 The Graczyk court also agreed with the Taylor court that there was no requirement in the DPPA that information be used immediately by the recipient instead of being stored for later use upon resale to those who vouch for their lawful uses under the statute. 145 Similar challenges to West s bulk obtainment of DMV record information were also rejected in Young v. West Publishing Corp. based on the district court s Graczyk, 146 ruling dismissing the plaintiffs claims, and by the Eighth Circuit in Johnson v. West Publishing Corp When Do Permissible Uses Become Impermissible? The dividing line between a permissible use and an impermissible use is often not at all clear-cut. Many decisions have dealt with where to draw the line, in a variety of contexts. ˇor example, the 141. Id. at Id. at Id Id. at 280 (citing Howard, 654 ˇ.3d at ) Id. at (citing Taylor, 612 ˇ.3d at ; Roth, 650 ˇ.3d at ) ˇ. Supp.2d 1268, (S.D. ˇla. 2010) ˇed. Appx. 531, 537 (8th Cir. 2013) (citing: Cook v. ACS State & Local Solutions, Inc., 633 ˇ.3d 989, (8th Cir. 2011); Graczyk, 660 ˇ.3d at ; and Taylor, 612 ˇ.3d at 339).

10 105 question before the U.S. Supreme Court in Maracich v. Spears 148 was whether attorneys who obtained South Carolina DMV information, for the purpose of soliciting car buyers to join class actions against auto dealers, properly qualified for the permissible use under section 2721(b)(4), for use in connection with any civil, criminal, administrative, or arbitral proceeding, including investigation in anticipation of litigation. The attorneys made several requests to the South Carolina DMV and used drivers personal information to send mass mailings to more than 34,000 South Carolina car buyers, with their letters labeled as advertising material. 149 Some of the recipients of the mailings brought a putative class action against the attorneys under the DPPA for their use of DMV information to make a bulk solicitation. 150 Affirming dismissal of the complaint, the ˇourth Circuit found that although the letters qualified as solicitations, they were inextricably intertwined with conduct that came within the litigation exception in section 2721(b)(4) and therefore were not actionable. 151 The Supreme Court recognized that the language in this subsection could encompass the attorneys use of the information if it were interpreted broadly, but it observed that if no limits are placed on the text of the exception, then all uses of personal information with a remote relation to litigation would be exempt under [section 2721](b)(4). 152 The Court found that such a reading would undermine in a substantial way the DPPA s purpose of protecting an individual s right to privacy in his or her motor vehicle records. The in connection with language in (b)(4) must have a limit. 153 In its analysis of where to set the limit, the Maracich Court found that an attorney s solicitation of clients is distinct from other aspects of the legal profession, and a business transaction. 154 Unlike the ordinary business purpose of solicitation of clients, the other uses mentioned in section 2721(b)(4) involve an attorney s conduct when acting in the capacity as an officer of the court, not as a commercial actor, such as insuring the integrity and efficiency of an existing or imminent legal proceeding. 155 The Court also found that drivers interests in privacy, concerning the highly restricted personal information that section 2721(b)(4) allows to be disclosed, provided another reason to find that the subsection should not be interpreted to allow access for an attorney s own commercial ends without government authorization, or the individual s consent. 156 The Supreme Court further referred to the restriction in section 2721(b)(12), against the use of DMV information for direct marketing and solicitation, not only because these activities are of the ordinary commercial sort but also because contacting an individual is an affront to privacy even beyond the fact that a large number of persons have access to the personal information. 157 With respect to the ˇourth Circuit s finding that the attorneys communications were inextricably intertwined with permissible litigation purposes, the Court noted that, while personal information could permissibly be used under section 2721(b)(4) to discern the extent of the alleged misconduct or identify particular defendants[,] [s]olicitation of new business is not [an] investigation within the meaning of subsection [2721] (b)(4). 158 Thus, where the use of DPPA-protected personal information [is] for the predominant purpose of solicitation, no permissible litigation purpose is present. 159 The United States Court of Appeals for the Eighth Circuit sorted out a number of issues concerning alleged improper access to DMV information by law enforcement officers, in McDonough v. Anoka County, 160 after numerous similar DPPA cases were brought in district court in Minnesota. 161 The case involved four consolidated appeals from lower court decisions in which each of the plaintiffs had sued numerous cities, counties, and unknown John Doe law enforcement and other government personnel after all of the cases had been dismissed for failure to state a DPPA claim. 162 ˇor example, plaintiff Bass alleged that she discovered that, over a six-year period when she served as a negotiator and attorney for a law enforcement union, her personal information was searched more than 750 times by approximately 340 government personnel even though she had no criminal record and committed no crimes. 163 An audit of the accesses to her records by the Minnesota Department of Public Safety (DPS) showed that her information was frequently obtained late at night, with multiple accesses on the same day, by different agencies, and that county attorneys accessed her information before proceedings that resulted in adverse results for her clients. 164 Likewise, plaintiff McDonough, a female crime reporter for a television station, had her information accessed nearly 500 times by 170 different personnel for seventy different agencies or police departments over a seven-year period. 165 Plaintiff Mitchell, a female television news anchor and sports reporter, had her information accessed approximately S. Ct (2013) Id. at Id. at Maracich v. Spears, 675 ˇ.3d 281, 284 (4th Cir. 2012), rev d, 133 S. Ct (2013) Maracich, 133 S. Ct. at Id Id. at 2201 (citing: Cohen v. Hurley, 366 U.S. 117, 124 (1961); and Ohralik v. Ohio State Bar Ass n, 436 U.S. 447, 457 (1978)) (internal quotation marks omitted) Id. at Id. at Id. at Id. at Id ˇ.3d 931 (8th Cir. 2015), cert. denied, 136 S. Ct. 388 (2016) One court counted at least 28 cases. See Roschen v. Wabasha Cnty., 29 ˇ. Supp.3d 1244, 1249 n.4 (D. Minn. 2014) McDonough, 799 ˇ.3d at Id. at Id. at 939, Id. at 951.