# United States Court of Appeals

FOR THE DISTRICT OF COLUMBIA CIRCUIT

A rgued November 8, 2017 Decided January 12, 2018

No. 16

- 5355

O WNER

- O PERATOR I NDEPENDENT D RIVERS A SS OCIATIO N , I NC ., ET AL ., A PPELLANTS

v.

U NITED S TATES D EPARTMENT OF T RANSPORTATION , ET AL ., A PPELLEES

Appeal from the United States District Court for the District of Columbia (No. 1:12

- cv

- 01158)

Joyce E. Mayers ar gued the cause for appellants. With her on the briefs were Paul D. Cullen

, Sr.

, and Paul D. Cullen

, Jr.

Caroline D. L opez , Attorney, U.S. Department of Justice, argued the cause for appellees. With her on the brief were Matthew M. Collette , Attorney, Paul M. Geier , Assistant General Counsel, U.S. Department of Transportation, Joy K. Park , Senior Trial Attorney, and Sue L awless , Assistant Chief Counsel for Enforcement and Litigation , Federal Motor Carrier Safety Administration

.

Before: T ATEL , G RIFFITH , and S RINIVASAN , Circuit Judges

.2
Opinion for the Court filed by Circuit Judge T ATEL

.

T ATEL , Circuit Judge : I n Spokeo, Inc. v. Robins

, 136 S. Ct. 1540 (2016)

, the Supreme Court held that “ Article III standing requires a concrete injury even in the c ontext of a statutory violation

, ” id. at 1549

. In this case, s everal commercial truck drivers and their industry association claim they were injured by the Department of Transportation ’ s violation of its statutory obligation to ensure the accuracy of a database containing driver

- safety information

. As explained in this opinion , we agr ee with the district court that

, under Spokeo

, the asserted injury is , by itself, insufficiently concrete to confer Article III standing. We reverse, however, with respect to two drivers whose information was released to prospective employers because dissemination of inaccurate driver

- safety data inflicts an injury sufficiently concrete to confer standing to seek damages.

I.
To fulfill its mandate of ensuring “ the highest degree of safety in motor carrier transportation, ” the Federal Motor Carrier Safety Administration, part of the Department of Tr ansportation, maintains the Motor Carrier Management Information System, a database of commercial truck drivers ’ safe ty records. 49 U.S .C. § 113(b). The database includes

“ accident reports and other safety violations. ” Weaver v. F

ederal M otor C arrier S afet y A dministration , 744 F.3d 142, 143 (D.C. Cir. 2014). Maintaining the database requires collaboration between state and federal authorities. States serve as the p rimary reporters of information: they are obligated by

statute to “ collect[] and report[] .

. . accurate, complete, and timely motor carrier safety data. ” 49 U.S.C. § 31102(c) (2)(P)(i). For its part, t he Department must “ ensure, to the maximum extent practical, [that] all the data is complete, timely, and accurate, ” id. § 31106(a)(3)(F), and “ prescribe3
technical and op erational standards to ensure .

. . uniform, timely, and accurate information collection and reporting by the States, ” id. § 31106(a)(4)(A).

Shippers and other f irms looking to hire truck drivers can access certain information in the database

, namely,

“ [c]ommercial motor vehicle accident reports, ” “ [i]nspection reports that contain no driver

- related safety violations, ” and

“ [s]erious driver

- related safety violation inspection reports

. ” I

d. § 31150(a)

. The Department makes this info rmation available through its Pre

- Employment Screening Program, which provides employer s w ith reports containing crash data from the previous five years and inspection data from the previous three

. See U.S. Department of Transportation, Federal Motor Carri er Safety Administration (FMCSA), Privacy Impact Assessment: Pre

- Employment Screening Program (PSP) (Apr. 14, 2010). T he Department must “ ensure that any information that is relea sed .

. . will be in accordance with the Fair Credit Reporting Act [FCRA]

. . . and all other applicable F ederal law. ” 49 U.S.C. § 31150(b)(1).

To further guarante e the accuracy of the database, the Department must “ provide a procedure for [ driver s ] to correct inaccurate information. ” Id. § 31150(b)(4). In order t o accomplish this, the Department “ established ‘ DataQs, ’ a web

based dispute resolution procedure that allows ‘ [drivers] to challenge [’]” data base information

. Weaver , 744 F.3d at 143 (quoting Privacy Act of 1974; Department of Transportation, Federal Motor Carrier Safety Administration ( FMCSA ) 007 Pre

- Employment Screening Program, 77 Fed. Reg. 42,548, 42,551 (July 19, 2012))

. When a driver files a challenge, the Department forwards it to the relevant state and state officials

“ decide how to respond. ” Id.4
Appellants are fiv e commercial truck drivers and the ir industry association , the Owner

- Operator Indepe ndent Drivers Association, Inc. Between 2010 and 2013, state law

enforcement authorities cited each driver for violating safety regul ations. See Owner

- Operator Independent Drivers Association v. Department of Transportation , 211 F. Su pp. 3d 252, 256 (D.D.C. 2016). T he drivers successfully challenged the citations in state court : one driver was found not guilty after trial

, and the others had their citations dismissed. Id. at 256

– 57. A ll but one of the drivers then asked through DataQs to have the violation reports rela ting to the citations removed from the Department ’ s database

. T heir requests were rejected because

, according to the relevant state authorities, the database at the time displayed only initial citations, not adjudicat ed outcomes

. Id. at 257. The safety records of two drivers

— Klint Mowrer and Fred Weaver , Jr.

— including the challenged violation reports
, were shared through the Pre

- Employment Screeni ng Program ; the other drivers ’ records were never disseminated

. Id. at 260

– 61.

The individual driver s and the industry association then sued, challenging the Department ’ s failure to ensure the accuracy of the database and seeking injunctive and declaratory relief under the Administrative Procedure Act, as well as damages under the FCRA

. T he Department moved for summary judgment

, argu ing ( among other things ) that the drivers lacked Article III standing because they fail ed to show concrete injury in fact. Id. at 258. The district court agreed and dismissed the case

. I d. at 261

. T he drivers appeal

, and now we consider the issue afresh

. S ee Scenic America, Inc. v. Department of Transportation , 836 F.3d 42, 49 (D.C. Cir. 2016) ( “ We review the District Court ’ s decision .

. . as to standing de novo

. . . . ” ).5

II.

“‘ [T]he irreducible constitutional minimum of standing ’ requires ‘ an injury in fact ’ that is both ‘ concrete and particularized, ’ and ‘ actual or imminent, not conjectural or hypothetical. ’” Hancock v. Urban Outfitters, Inc. , 830 F.3d 511, 513 (D.C. Cir. 2016) (alteration in original) (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 560 (1992)). This

case focuses on just one element of that test: whether the alleged injury is “ concrete. ” Specifically, w e must determine whether the drivers ’ claimed injury

— the Department ’ s failure to discharge its statutory duty to ensure the accuracy of information in the database

— is sufficiently concr ete to qualify

as injury in fact

. The touchstone for analyzing whether the violation of a statutory obligation constitutes inju ry in fact is the Supreme Court’ s recent decision in Spokeo, Inc. v. Robins , 136 S. Ct. 1540 (2016)

. There , a consumer initiated a class action against a company that operates an online search engine that gathers and disseminates personal information, claiming that some of the disseminated information was incorrect

. Id. at 1544. According to the consumer, this violat ed the FCRA , wh ich imposes procedural requirements on the creation and use of consumer reports, including obligating reporting agencies to adopt mechanisms for ensuring the information’s accuracy. Id. at 1545

– 46. The Ninth Circuit had conclude d that the co nsumer satisfie d Article III’s injury

- in

- fact requirement because he had alleged that the search engine violated his rights under the FCRA. Id. at 1546.

The Supreme Court vacated

, explaining that the Ninth Circuit

, which had focused only on whether the injury was partic ularized, failed to consider whether the injury was
concrete. See id. at 1548 ( “ We have made it clear time and time again that an injury in fact must be both concrete and6
particularized. ” ). W here the alleged injury arises only from a statutory violation

— as in both Spokeo and here

— the Court explained, “[a] ‘ concrete ’ injury must be ‘ de facto ’ ; that is, it must actually exist. ” Id. Although “ Congress may ‘ elevat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law, ’” this “ does not mean that a plaintiff automatically satisfies the injury

- in

- fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate t hat right. ” Id. at 1549 (alteration in original) (quoting Lujan , 504 U.S. at 578). “ Article III standing requires a concrete injury even in the context of a statutory violation. ” Id. A plaintiff

“ could not, for example, allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury

- in

- fact requirement of Article III. ” Id.

Our court has had only a few occasions to apply Spokeo

. I n Hancock v. Urban Outfitters, Inc. , 830 F.3d 511 (D.C. Cir. 2016), for example, we found that plainti ffs who alleged that a retailer ’ s request for their zip codes violated District of Columbia consumer

- protection law lacked standing

. As we explained, the plaintiffs asserted only “ a bare violation of the requirements of D.C. law, ” and failed to allege any concrete injury from the disclosure of a zip code

, “ for example, any invasion of privacy, increased risk of fraud or identity theft, or pecuniary or emotional injury

. ” I d. at 514. Collecting Spokeo ’ s scattered definitions of concreteness, we held that a “ plaintiff must allege some ‘ concrete interest ’ that is ‘ de facto

, ’ ‘ real, ’ and ‘ actually exist[s]. ’” Id. (alteration in original) (quoting Spokeo , 136 S. Ct. at 1548, 1549).

Although helpful, Hancock does not control here. In that

case , we found that a re quest for potentially harmless information

— a zip code

— had inflicted no concrete injury

. See i d. ( “ If, as the Supreme Court advised, disclosure of an7
incorrect zip code is not a concrete Article III injury, then even less so is [plaintiffs ’ ] naked assertion that a zip code was requested and recorded without any concrete consequence. ” ). By contrast, here we address information that could easily harm a driver were it shared with prospective employer s

. See Appellants’ Br. 41

– 42 (explaining that reports of safety violations can meaningfully affect a driver ’ s professional reputation and employment prospects).

In support of their argument that they are injured by the mere existence of inaccurate information in the database, the drivers focus on two sentences from Spokeo : “ [T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identifi ed. ” Spokeo , 136 S. Ct. at 1549

. According to the drivers, th e s e sentences mean that the Department’s failure to comply with its statutory obligation to ensure accuracy, by itself, inflicts injury in fact. We disagree. The emphasized phrase “ additional har m ” clearly presumes that the putative plaintiff ha d already suffered a de facto injury resulting from the procedural violation . Reinforcing this understanding of Spokeo

, the Supreme Court, in explaining the

“ no additional harm ” proposition, cited only exam ples of torts like libel and slander per se , where , so long as harmful information is publicized, “ the law has long permitted recovery by certain tort victims even if their harms may be difficult to
prove or measure, ” and cases relating to the denial of ac cess to publically available information. Id. at 1549

– 50 (citing the informational

- standing cases FEC v. Akins , 524 U.S. 11 (1998)

, and Public Citizen v. Department of Justice , 491 U.S. 440 (1989)). Although the Court gave no indication that these two types of cases represent the only instances in which concrete injury results from a bare statutory violation

, all of the decisions the drivers discuss fall into these two categories. That8

is, the violati on at issue result ed either from the disclosure of potentially harmful information or from the withholding of public information. See Appellants’ Br. 28

– 32 (collecting cases).

For example, the drivers invoke the Ninth Circuit ’ s decision on remand in Spoke o , where the court found that the plaintiff had standing because he had “ specifically alleged that [the search engine] falsely reported ” facts about his age, marital status, education, employment, and wealth. Robins v. Spokeo, Inc. , 867 F.3d 1108, 1117 (9t h Cir. 2017). T he Ninth Circuit also found that the allegations were not too speculative to establish concrete injury because “ both the challenged conduct and the attendant injury ha [d] already occurred ,” as the search engine “ ha [d] indeed published a mate rially inaccurate consumer report. ” Id. at 1118. Rather than supporting the drivers’ allegation of injury, then, Spokeo on remand confirms that actual publication is required to seek FCRA relief, and that a statutory violation is sufficient to confer standing only if “ the specific procedural violations alleged .

. . actually harm, or present a material risk of harm to, [co ncrete] interests. ” Id. at 1113.

The primary case the drivers cite from this Circuit is Friends of Animals v. Jewell , 828 F.3d 989 (D.C. Cir. 2016),

see Appellants’ Br. 27

– 28, a post

- Spokeo informational

standing case in which plaintiffs challeng ed the Int erior Secretary’s failure to publish certain information as required by the Endangered Species Act. The drivers read Jewell to support their claim that Congress has broad latitude to define new injuries, but the opinion in that case e mphasizes the narrow

s cope o f informational injuries and mak e s clear that plaintiffs must suffer real harm to support standing

. “ A plaintiff suffers sufficiently concrete and particularized informational injury ,” we explained, “ where the plaintiff alleges that: (1) it has been9
deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it, and (2) it suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure. ” Jewell , 828 F.3d at 992. Jewell is thus of no help to the drivers unless, of course, they can show that the Depart ment’ s statutory violation injured them.

The other post

- Spokeo cases the drivers cite , no t one of which come s from this Circuit , similarly involve putative injuries flowing from either disclosure or withholding. Appellants’ Br. 28

– 32. The courts in each case made clear that plaintiffs must show de facto injury even in the presence of a statutory violation

. See , e.g. , In re Horizon Healthcare Services Inc. Data Breach Litigation , 846 F.3d 625, 640 (3d Cir. 2017) ( “ Plaintiffs here do not allege a mere technical or procedural violation of FCRA. They allege instead the unauthorized dissemination of their own private information

— the very injury tha t FCRA is intended to prevent. There is thus a de facto injury that satisfies the concreteness requirement for Article III standing. ” (footnotes omitted) ); Strubel v. Comenity Bank , 842 F.3d 181, 190 (2d Cir. 2016) ( “[A] creditor ’ s alleged violation of eac h notice requirement, by itself, gives rise to a ‘ risk of real harm ’ to the consumer ’ s concrete interest in the informed use of credit. ” (quoting Spokeo , 136 S. Ct. at 1549) )

.

Unlike the injuries in the cited cases, the drivers’ injury results from neither disclosure nor withholding of information. Rather, the drivers claim they suffer concrete harm from the

mere fact that the Department , in violation of its statutory obligation s, has allowed inaccurate safety information to remain in the database. As the d rivers describe it, they “ have a concrete interest in the accuracy of their safety records and the reflection those records project of their safety risk to potential employers. ” Appellants’ Br. 33. “ As long as [the Department]10

maintain [s] the inaccurate records of safety regulation violations in the database, ” the drivers explain, “[the Department] expose [s] [them] to a material risk of harm contrary to their concrete statutory rights to accuracy .” Id. at 38.

But does the drivers ’ injury a ctually exist? Or, put another way, if inaccurate information falls into a government database, does it make a sound? Considering the drivers ’ claimed harm in light of “ both history and the judgment of Congress, ” as Spokeo instructs, we think not. Spokeo

, 136 S. Ct. at 1549.

To begin with , the drivers have identified no historical or

common

- law analog where the mere existence of inaccurate information, absent dissemination, amounts to concrete injury. They cite libel and slander per se , Appellants’ Br. 35

– 3 8, but as explained above, tho se torts require evidence of publication

. See Restatement (First) of Torts § 569 (libel); id. § 570 (slander).

Turning then to the judgment of Congress, we see nothing in the relevant statutory provisions indicating that Congr ess

“ creat[e d ] legal rights ” in the database ’ s accuracy, “ the invasion of which creates standing. ” Havens Realty Corp. v. Coleman , 455 U.S. 363, 373 (1982) (quoting Warth v. Seldin

, 422 U.S. 490, 500 (1975)) ; cf. Electronic Privacy Information Center v. Pr esidential Advisory Commission on Election Integrity , No. 17

- 5171, 2017 WL 6564621 , at *4 (D.C. Cir. Dec. 26, 2017) (finding that the plaintiff lacks standing because “it has not suffered the type of harm that [the statute] seeks to prevent”) . As the safety statute itself demonstrates, Congress chose to protect truck drivers by requiring the Department to ensure the accuracy of their information, not by giving them a right of action to independently enforce th at obligation. Section11

31106 obligates the Departm ent to ensure the database ’ s accuracy and creates no right on the part of the drivers to police their records

— it speaks only to the Department itself. See 49 U.S.C. § 31106(a)(3)(F) (“The Secretary shall .

. . .”)

. Section 31150, which authorizes pre

- emplo yment screening, likewise reflects Congress’s concern about disclosure , requiring the Department to “ ensure that any information that is released

. . . will be in accordance with the [ FCRA] and all other applicable F ederal law. ” Id. § 31150(b) (1) (emphasis added). The FCRA,

too , is designed “ to curb the dissemination of false information. ” Spokeo , 136 S. Ct. at 1550 (emphasis added). The se statutes demonstrate that the harm Congress was concerned about was the dissemination of inaccurate information, not its mere existence in the Department’s database

. The drivers’ inability to identify a clear common

- law analog or to cite statutory support for their injury confirms that the mere existence of inaccurate information in the database is insufficient to co nfer Article III standing. Even though the inaccuracy results from the Department ’ s violation of its statutory obligations

, t he drivers have identified no “‘ concrete interest ’ that is ‘ de facto

, ’ ‘ real, ’ and ‘ actually exist[s] .’” Hancock , 830 F.3d at 514 ( alteration in original) (quoting Spokeo , 136 S. Ct. at 1548, 1549).

As the foregoing analysis demonstrates , although the mere existence of inaccurate database information is not sufficient to confer Article III standing , the dissemination of that information to a potential employer i s. A t oral argument, Department counsel conceded that the two drivers whose safety records were released to prospective employers , Mowrer and Weaver , would ha ve had standing to seek damages h ad they
preserve d the issue for appeal. See Oral Arg. 19:23

– 41. In our view, however, Mowrer and Weaver did raise the issue, stating12
in their opening brief that “[a] t a minimum, the false report of a criminal history for [ Mowrer ] and Weaver constitute [s] t he demonstration of the kind of concrete injury sufficient to satisfy Article III standing. ” Appellants’ Br. 42 ; see also Compl. ¶ 192 (describing the Department ’ s “ disseminat[ion of] false, inaccurate, imprecise, incomplete and misleading consumer reports to third parties through the [Pr e

- Employment Screening Program]” )

. Given this, and because we agree that the two drivers have suffered concrete harm , we shall remand their damages claims to the district court.

I n addition to damages, t he drivers and their industry association seek prospective relief, including a declaration that the Department violated its statutory obligations and an injunction requiring it to purge the database of inaccurate information. Because “standing is not dispensed in gr oss ,” Town of Chester v. Laroe Estates, Inc. , 137 S. Ct. 1645, 1650 (2017) (quoting Davis v. FEC , 554 U.S. 724, 734 (2008)), the drivers “ must demonstrate standing separately for each form of relief sought,” Friends of the Earth, Inc. v. Laidlaw Environmen tal Services (TOC), Inc. , 528 U.S. 167, 185 (2000). In order to have standing to seek prospective relief, the drivers must show that dissemination of their database information is “continuing” or “imminen[t].” Steel Co. v. Citizens for a Better Environment , 523 U.S. 83, 108 (1998).

T he drivers , however, concede that the ir information is no longer at risk of dissemination through the Department ’ s Pre

Employment Screening Program, as in spection dat a remains available for only three years after the relevant inspection and all of their disputed violations occurred more than three years
ago. Appellants ’ Br. 45. The association, moreover, has offered no evidence that any other member faces a risk of dissemination

. Indeed, any risk of future disclosure of inaccurate information has been virtually eliminated by the13
Department ’ s adoption of an interpretive rule in June 2014

, which allows States “ to reflect the r esults of adjudicated citations ” in the database and prohibits certain fav orably adjudicated citations from being disseminated through the Pre

Employment Screening Program

. See Motor Carrier Management Information System (MCMIS) Changes To Improve Uniformity in the Treatment of Inspection Violation Data, 79 Fed. Reg. 32,491

, 32,491, 32,495 ( June 5, 2014). Though the rule applies only to inspections occurring “ on or after August 23, 2014, ” thus excluding the drivers ’ citations here, it ensures that similarly situated in dividuals face little risk of future harm

. Id. at 32,495

. B esides , g iven that our review comes more than three years after the rule ’ s effecti ve date, all inaccurate records are protected from disclosure because they

are either s ubject to the new rule or have aged out of the three

year Pre

- Employment Screening Prog ram reporting period.

The drivers insist that , in addition to the Pre

- Employment Screening Program, database information is used for other purposes and that the records can be accessed under the Freedom of Information Act , 5 U.S.C. § 552 . But the drivers offer no evidence that such use is either imminent or likely, as would be required to support standing at the summary

judgment stage. See Lujan , 504 U.S. at 561 ( “ [Standing] must be supported .

. . with the manner and degree of evidence required at the suc cessive stages of the litigation. ” )

. Finally, this case is not at all like our court’s recent decision in Attias v. CareFirst, Inc. , 865 F.3d 620 (D.C. Cir. 2017) . There, at the motion to dismiss stage , we found that health

- insurance customers had standin g to sue their insurer after it suffered a cyberattack in which an intruder breached a

customer

- information database. Id. at 622. We explained that

“ identity theft .

. . would constitute a concrete and particularized injury ” and that “ the complaint plausib ly alleges14
that the plaintiffs now face a substantial risk of identity theft, ” because “ an unauthorized party ha [d] already accessed
p ersonally identifying data .

. . and it is much less speculative

— at the very least, it is plausible

— to infer that this party ha [d] both the intent and the ability to use that data for ill

. ” I d. at 6 27

– 2 8

. Here, not only are we at the summary

judgment stage, where the drivers must produce evidence of injury, see Lujan , 504 U.S. at 561

, but nothing in the record indicates th at any one has recently accessed or used the information at issue or intends to do so in the future

. T he prospect of future inj ury is thus pu rely “ speculative. ” Attias

, 865 F.3d at 626 (quoting Spokeo , 136 S. Ct. at 1548).

III.

Because the d rivers are unharmed by the mere existence of inaccurate information in the Department ’ s database and because dissemination of that information is not imminent

, they

— with the exception of Mowrer and Weaver

— have suffered no concrete injury in fact sufficient to con fer Article III standing

. To be sure, it is possible that the mere existence of inaccurate informat ion in a government database could cause concrete harm depending on how that information is to be used

. We conclude only that , under the specific circumstances of this case, the drivers have failed to show standing for all of the relief they seek

. We thus affirm in part, reverse in part, and remand to the district court for further proceedings consistent with this opinion.

So ordered.