Opinion ID: 218670
Heading Depth: 3
Heading Rank: 1

Heading: Purportedly Permissible Use

Text: Plaintiffs argue that, as the district court found, defendants violated the DPPA by disclosing personal information for a use not permitted under § 2721(b). In reaching this conclusion, the district court interpreted the DPPA's provisions as imposing liability, presumably criminal as well as civil, whether or not the state official knew that the disclosure was not actually for a proper purpose. Defendants argue (1) that this is a misreading of the DPPA that would require the state to verify a requester's true intentions; and (2) that, even if a correct interpretation, it was not a clearly established right of which a reasonable person would have known.
The pleadings establish that the disclosures in this case were purportedly made under § 2721(b)(3), which permits nonconsented disclosure of personal information (but not highly restricted personal information): (3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only (A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and (B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual. 18 U.S.C. § 2721(b)(3). As outlined above, the disclosures made by the Ohio BMV were made based on Shadowsoft's express written representations that the disclosures were for use in the normal course of businessas permitted by § 2721(b)(3) (and Ohio law)although plaintiffs allege that Shadowsoft falsely represented this to be the purpose of the disclosures. The finding that this alleged a violation of the DPPA rested on the district court's interpretation of § 2724(a), which provides that: A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains[.] The district court relied on Pichler v. UNITE, 228 F.R.D. 230, 241-42 (E.D.Pa.2005), aff'd on other grounds, 542 F.3d 380 (3d Cir.2008), which reasoned that the location of the adverb knowingly in this provision suggested an intention to limit the reach of the knowledge requirement. That is, the court in Pichler found that knowingly modifies only the first partthe two clauses defining the act elementand not the last partthe third clause defining the purpose element. Without agreeing or disagreeing with Pichler, we find that it does not address the question presented in this case. In Pichler, the labor union defendants recorded license plate numbers from cars in an employee parking lot and obtained the employees' addresses from motor vehicle records through Westlaw and a private investigator's requests to the state motor vehicle department. The court in Pichler rejected the defendants' claim that they could not be liable because they did not know that the requester's purpose in obtaining the personal information was not permissible, explaining: If one could not violate the DPPA without knowing[ ] that the purpose for which he obtain[ed], disclose[d] or use[d] motor vehicle information was unlawful, then every defendant would get at least one free bite at the violation-of-privacy apple. After all, anyone could claim that he did not know his purpose to be impermissible until a court interpreted the DPPA to proscribe that purpose. Even after such a ruling, a defendant could manufacture a slightly different purpose for his conduct and then claim ignorance of whether the DPPA prohibited the new purpose. A plaintiff could recover only if the defendant repeatedly violated her privacy and lacked sufficient creativity to conjure up some conceivable purpose that no court had yet considered. Id. at 242; see also Rios v. Direct Mail Express, Inc., 435 F.Supp.2d 1199, 1204-05 (S.D.Fla.2006) (relying on Pichler to conclude that plaintiffs were not required to prove that a direct marketer who knowingly obtained records from the Florida DMV also knew that Florida had not obtained the express consent required under the amended DPPA to release the records to a mass marketer under (b)(12)). It is one thing to say that a defendant's ignorance that his own conduct violates the law is not a defense, but it is another, we think, to conclude that a defendant is liable for a knowing disclosure made for a permissible purpose any time the purpose was misrepresented or the information was later misused or improperly redisclosed by the requester or any other entity. Here, the pleadings establish that the defendants' act, the knowing disclosure of personal information, was for an explicitly permissible purpose. Moreover, the plaintiffs complain that Shadowsoft falsely represented its intended use and redisclosed the information to PublicData, which made the information available for search and sale to its customers for unspecified purposes. If no distinction is made between the use for which the defendants disclosed the information, and the undisclosed use for which it was obtained, subsequently misused or impermissibly redisclosed by the recipient, the DPPA becomes essentially a strict liability statute. Every subsequent misuse could be traced back to a violation by the state official. Rather than place all of the liability with the state officials, however, the DPPA makes it unlawful for any person (excluding the states and their agencies) to knowingly obtain, disclose, or use the information for a purpose not permitted by the DPPA. While it may be that this and other courts will find that one's ignorance of the law is no defense to a claim under the DPPA, this was not the defendants' claim in this case. Rather, defendants' alleged that their disclosures were for a permitted purpose, even if Shadowsoft's undisclosed intention was to obtain the personal information for a purpose not permitted by the DPPA. That the defendants' disclosure was expressly for a permitted purpose distinguishes this case from Welch v. Theodorides-Bustle, 677 F.Supp.2d 1283 (N.D.Fla. 2010). Similar to this case, state officials were alleged to have violated the DPPA by making disclosures of personal information in bulk to Shadowsoft, which, in turn, redisclosed the information to PublicData. The defendants did not deny that from PublicData's website, an internet user can access the information for any or no reasonor on a whim. Id. at 1286. Unlike this case, however, the court in Welch specifically found that the contracts entered into with Shadowsoft did not specify either a proper purpose for the disclosures, or the uses and further disclosures it would or would not make. No claim could be made in that case that disclosures were for a purportedly permissible purpose, and the court rejected the suggestion that the defendants could rely on § 2721(b)(1) (for use by a government agency in carrying out its functions). Not surprisingly, the court also found that the state officials' disclosures for an unspecified purpose, when the DPPA requires that personal information not be disclosed except as provided for in § 2721(b), violated clearly established federal law of which the defendants' should have known. Id. (citing Collier v. Dickinson, 477 F.3d 1306 (11th Cir.2007)).
Even if we accept that the DPPA may be read to impose liability on a state official in his individual capacity when personal information disclosed for a purportedly permissible purpose was actually obtained for an impermissible purpose, we cannot agree that this right was clearly established at the time of the disclosures (putting aside the allegation that the disclosures were only made under the defendants' authority for a short time). The district court acknowledged that there was (and is) no binding precedent from the Supreme Court, the Sixth Circuit, the district court itself, or other circuits deciding the issues raised in this case such as would render the asserted right clearly established. See Risbridger v. Connelly, 275 F.3d 565, 569 (6th Cir.2002). `This is not to say that an official action is protected by qualified immunity unless the very action in question has previously been held unlawful, but it is to say that in the light of preexisting law the unlawfulness must be apparent.' Wilson v. Layne, 526 U.S. 603, 615, 119 S.Ct. 1692, 143 L.Ed.2d 818 (1999) (quoting Anderson, 483 U.S. at 641, 107 S.Ct. 3034). An official may be on notice that his conduct violates established law even in novel factual circumstances. See Hope v. Pelzer, 536 U.S. 730, 741, 122 S.Ct. 2508, 153 L.Ed.2d 666 (2002). Relying on the Eleventh Circuit decision in Collier affirming the denial of qualified immunity to state officials for disclosures under the DPPA, the district court concluded that the plain language of the DPPA clearly established an individual's right to be free from disclosures for purposes not permitted under § 2721(b). As is clear from a closer reading of Collier, however, the district court did not engage in a sufficiently particularized reading of the rights that are clearly established by the DPPA. In Collier, the plaintiffs alleged that the state officials in Florida violated the DPPA by releasing personal information from driver's license records to a mass marketer without first obtaining the driver's express consent. The court in Collier found not only that the DPPA, as amended, required express consent for bulk distribution of surveys, marketing or solicitations in § 2721(b)(12), but also that the Supreme Court's decision in Condon specifically recognized (1) that following the amendments in 2000, states could no longer infer consent from a driver's failure to opt-out of disclosures, and (2) that states were bound by the mandates of the DPPA irrespective of any conflicting state law. Collier, 477 F.3d at 1312. The same cannot be said for the alleged violation in this case based on the defendants' failure to discover Shadowsoft's true intentions. [7] Finally, the district court rejected defendants' contention that this interpretation made the state BMV an insurer rather than simply a gatekeeper that may rely on the requester's declaration that the disclosure would be for a permitted purpose. The district court explained as follows: While Defendants may be properly characterized as gatekeepers, this does not mean that they may forfeit this role entirely and adopt without question the representations of entities such as Shadowsoft who make requests for personal information. The Court finds the following discussion applicable, even though it is outside the context of the DPPA: Qualified immunity is intended to allow officials to render intelligent decisions even though they may, upon further reflection, be deemed to have been erroneous. It is not intended to allow individual officers to abdicate their decision-making obligations in blind reliance on state statutes. This is especially true in this instance where the officers involved, unlike police officers who frequently have little rule-making authority, are endowed with independent policy-making authority and have an obligation to make reasoned decisions with respect to programs and policies which they promulgate, regardless of whether those programs and policies are promulgated in accordance with State law. F. Buddie Contracting, Ltd. v. Cuyahoga Community College Dist., 31 F.Supp.2d 584, 589-590 (N.D.Ohio 1998) (finding that officials were not entitled to qualified immunity where there was evidence that affirmative action policy was unconstitutional even though the policy was enacted in compliance with state law). In this instance, those with policy-making authority have made no effort [to] ensure that requests for information are legitimate. Based on the allegations before the Court, Defendants take any request at face value and without any regard to the accuracy of the information. The Court notes that while the Record Request included places for Shadowsoft to provide its tax identification number, vendor number, professional license number, and license, Shadowsoft never completed this part of the form. Despite this lack of information, Defendants granted Shadowsoft's request for information. This indicates to the Court that Defendants proceeded with blind reliance on any request made. While Defendants place value in the Agreement between ODPS and Shadowsoft, the Court finds reliance on such an agreement at best naive. By simply visiting the PublicData website, Defendants would have discovered that just as Plaintiffs allege, the information Defendants were providing was available to anyone with a credit card. Certainly, there is no claim by defendants that they did anything to affirmatively verify that Shadowsoft's request was for the use it stated. At the same time, nothing about the incomplete requester information would have told defendants that Shadowsoft was misrepresenting the use it intended to make of the personal information it was requesting. Nor did Shadowsoft's Record Requests give defendants a reason to visit PublicData's website. Whether or not it would have been prudent for the BMV to investigate Shadowsoft before making any disclosures, this is neither an obligation imposed by the terms of the DPPA, nor one that has been clearly established under the governing case law. The suggestion that defendants are not entitled to qualified immunity because defendants could not have reasonably believed that Shadowsoft was a legitimate businessa term not defined by the DPPAmisses the mark. Plaintiffs did not allege or argue that Shadowsoft was, in fact, anything but a legitimate business. [8] Indeed, the district court's focus was on what it viewed to be defendants' blind reliance on Shadowsoft's representations and not on a failure to verify that Shadowsoft was a legitimate business. The logic of this argument seems to be that if defendants had verified Shadowsoft's corporate existenceas plaintiffs alleged that Shadowsoft was a Texas corporationthe defendants might have found reason to question the veracity of Shadowsoft's representation that it was requesting personal information for a permissible purpose. It is not explained, however, how a reasonable official would have known that it would violate the DPPA to make a disclosure for an expressly permissible purpose, to an entity plaintiffs do not claim to be illegitimate, because the defendants did not investigate the legitimacy of that business.