Opinion ID: 1036114
Heading Depth: 3
Heading Rank: 1

Heading: Strict Liability for Downstream Acts

Text: Gordon primarily argues that Resellers should be held strictly liable for civil penalties based on Leifer's improper use of Gordon's personal information. We conclude that a strict liability standard is inconsistent with the DPPA as a whole and would frustrate its legislative aims. -19- The text of the DPPA does not support -- either explicitly or implicitly -- a strict liability standard. Although, as described below, the text and structure of the DPPA can be read to support a duty of reasonable inquiry, nothing in the DPPA suggests that a reseller is responsible, regardless of whether it is at fault, for an end user's misuse of personal information. Moreover, no case law interpreting the DPPA suggests that a reseller could be strictly liable for downstream violations by another party. But cf. Pichler v. UNITE, 542 F.3d 380, 396-97 (3d Cir. 2008) (end user liable for own actions, even if it did not know those actions would violate DPPA). We note, moreover, that strict liability offenses, while not unknown to the criminal law , are generally disfavored. United States v. U.S. Gypsum Co., 438 U.S. 422, 437-38 (1978); see also United States v. Burwell, 690 F.3d 500, 505 (D.C. Cir. 2012); Am.-Arab Anti- Discrimination Comm. v. City of Dearborn, 418 F.3d 600, 610 (6th Cir. 2005). Gordon's appeal, of course, arises in the civil context, but the provision describing a criminal offense under the DPPA mirrors the language describing a -20- civil cause of action. 6 This similarity suggests that knowingly is read the same way in both provisions. See Dep't of Revenue of Or. v. ACF Indus., Inc., 510 U.S. 332, 342 (1994) (normal rule of statutory construction is that identical words used in different parts of the same act are intended to have the same meaning (quotation and internal quotation marks omitted)). But see Kirtsaeng v. John Wiley & Sons, Inc., 133 S. Ct. 1351, 1362 (2013) (acknowledging general rule, but applying different canon of interpretation). We are loathe to write strict liability into the DPPA absent a clear indication in the text or the legislative history that strict liability applies. The notion of strict liability is also inconsistent with at least some of the congressional concerns that prompted the DPPA. The DPPA sought to 6 Compare id. § 2722(a) (It shall be unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title. (emphasis added)), with id. § 2724(a) (A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter may be liable in a civil action (emphasis added)). -21- strike[] a critical balance between an individual's fundamental right to privacy and safety and the legitimate governmental and business needs for this information. 145 Cong. Rec. H2522 (daily ed. Apr. 20, 1994) (statement of Rep. Moran), available at 1994 WL 140035; see also id. at H2527 (statement of Rep. Goss). Congress knew that legitimate businesses used information derived from motor vehicle records and ensured continued access to it through the DPPA. See, e.g., 139 Cong. Rec. S15762-63 (daily ed. Nov. 16, 1993) (statement of Sen. Hatch), available at 1993 WL 470986; Driver's Privacy Protection Act: Hearings on H.R. 3365 Before the Subcomm. on Civil & Constitutional Rights of the House of Rep. Comm. on the Judiciary , 103rd Cong. (Feb. 3-4, 1994). In fact, Congress was cognizant of the concerns raised by the business community, and consequently it broadened the exceptions to non-disclosure in the law. See 140 Cong. Rec. H2523 (daily ed. Apr. 20, 1994) (statement of Rep. Moran) (noting that revised DPPA addressed commercial concerns raised during subcommittee hearings), available at 1994 WL 140035. -22- [W]e will not interpret a statute in a way 'that apparently frustrates the statute's goals, in the absence of a specific congressional intention otherwise.' United States v. Livecchi, 711 F.3d 345, 351 (2d Cir. 2013) (quoting New York v. Shore Realty Corp., 759 F.2d 1032, 1045 (2d Cir. 1985)). Thus, because we conclude that neither the text nor the legislative history of the DPPA supports reading a strict liability standard into the DPPA, we hold that Resellers are not strictly liable for Leifer's improper use of Gordon's personal information.