Opinion ID: 1036114
Heading Depth: 3
Heading Rank: 2

Heading: Resellers' Liability Due to Their Own Actions

Text: Gordon contends that the Resellers disclosed his personal information for a use that was not specifically identified in the DPPA's list of fourteen exceptions. See 18 U.S.C. § 2721(b). We review the disclosure of each Reseller separately and conclude that, while Softech disclosed Gordon's personal information for a permitted use, a material question of fact exists as to the propriety of Arcanum's disclosure. -23-
Gordon alleges that Softech disclosed his personal information to Arcanum even though Arcanum did not identify a permissible use; this argument is meritless. When Arcanum, a private investigative agency, requested Gordon's personal information from Softech, it selected DPPA Purpose No. 8. Rodriguez Dep. 49:8-11, Feb. 16, 2011; Cohn Dep. 29:3-10, Apr. 13, 2011. This corresponds to the exception in section 2721(b)(8), [f]or use by any licensed private investigative agency . . . for any purpose permitted under this subsection. 18 U.S.C. § 2721(b)(8); see also Rodriguez Dep. 49:12-16. Hence, this exception includes two limiting factors: (1) the entities that may claim the exception, and (2) the purposes for which information may be requested. Arcanum's request satisfied both requirements. First, as discussed above, Arcanum was a licensed private investigative agency and therefore eligible to claim the exception. Second, Arcanum had provided Softech with an Affidavit of Intended Use that specifically identified -24- three intended uses for the records requested, all of which complied with exceptions in section 2721(b). 7 When Softech accessed the New York State DMV database and provided Arcanum with Gordon's name, address, and additional information pertaining to his car , it disclosed that information pursuant to an exception in section 2721(b), to an entity eligible to invoke the exception, for three purposes permitted by the DPPA. See 18 U.S.C. § 2721(b)(8). Therefore, the district court correctly concluded as a matter of law that Softech had disclosed Gordon's personal information for a use expressly permitted by statute. 8 7 Specifically, the affidavit indicated that Arcanum would use information only for the purposes outlined in section 2721(b)(3) (for limited purposes in the normal course of business), section 2721(b)(7) (to provide notice to owners of towed or impounded vehicles), and section 2721(b)(13) (when the party in interest had consented in writing). 8 Gordon also argues that Softech's disclosure under the private investigative agency exception violated the terms of an agreement between Softech and Arcanum. Under either Florida or New York law, Gordon, because he is a non-party who was not an intended third-party beneficiary of the agreement, cannot allege a DPPA violation on breach of contract grounds. See, e.g., Bochese v. Town of Ponce Inlet, 405 F.3d 964, 981-83 (11th Cir. 2005) (discussing Florida law); State of Cal. Pub. Emps.' Retirement Sys. v. Shearman & Sterling, 95 N.Y.2d 427, 434-35 (2000) (discussing New York law). -25-
Arcanum disclosed Gordon's personal information to Leifer based on Leifer's selection of Insurance Other  from the Docusearch.com dropdown menu. Gordon contends that Insurance Other did not correspond to a permitted use. 9 Although Resellers insist that Gordon waived this argument by failing to raise it below, we disagree. Gordon's amended complaint noted that Arcanum disclosed . . . Gordon's personal information without a permissible use under the DPPA. Amended Complaint, ¶¶ 79, 81. This necessarily implied that Gordon challenged whether the stated use -- Insurance Other -- fell within the section 2721(b) exceptions. 10 Furthermore, Gordon argued below that 9 Although Resellers further argue that Leifer wanted Gordon's personal information in preparation for litigation, pursuant to the exception in section 2721(b)(4), Leifer only claimed one exception -- Insurance Other. Section 2722(a) prohibits disclosure for any use not permitted by statute, and Arcanum did not know that Leifer's use might later qualify for this exception. A reseller's ex post decision about a recipient's intended use of information cannot justify its decision to disclose the information in the first place. 10 When cross-moving for summary judgment, Gordon explicitly argued that Insurance Other was not a permitted use, but made that argument only with respect to Softech. -26- to qualify under [the insurance exception] you have to either be an insurance company or a self-insured entity. Nov. 22, 2011 Tr., at 17:21-23. Counsel for Arcanum was present, but did not object. Accordingly, we determine that the issue was not waived. Under a textual approach, Insurance Other does not track the language of the insurance exception, which allows a person to disclose or use DPPA-protected personal information in connection with claims investigation activities, antifraud activities, rating or underwriting . 18 U.S.C. § 2721(b)(6). Thus, a disclosure for Insurance Other could be outside the scope of the statute , as the generic phrase encompasses many insurance-related activities beyond the stated activities of section 2721(b)(6). See Maracich, 133 S. Ct. at 2199-2200 (examining DPPA's litigation exception and noting that [u]nless commanded by the text . . . these exceptions ought not operate to the farthest reach of their linguistic possibilities if that result would contravene the statutory design). -27- The insurance exception, moreover, may only be claimed by certain entities: an insurer or insurance support organization, or [] a self-insured entity. Id. § 2721(b)(6). When deposed, Leifer conceded that he did not work at an insurance company, and could not identify what a self-insured entity or an insurance support organization was. Leifer Dep. 81:22 to 82:19, July 12, 2011. Arcanum has pointed to nothing in the record to suggest that Leifer was, in fact, eligible to request information pursuant to that exception. Thus, even if we were to assume that a collision had occurred, an insurance claim had accrued, and Insurance Other was coterminous with section 2721(b)(6), a reasonable jury could easily find that Leifer was not eligible to request information pursuant to the insurance exception. The Resellers insist that Insurance Other covered all insurance-related uses, but only to the extent contemplated by the exception in section 2721(b)(6). This argument relies on the fact that each Docusearch.com customer certified that it was in, and assume[d] full responsibility for, compliance with the Driver's Privacy -28- Protection Act of 1994 by clicking OK on a pop-up window. Furthermore, the customer also check ed a box, thereby consenting to the terms of a Client Agreement, in which the customer represent[ed] and warrant[ed] that it will provide Docusearch with accurate and complete information regarding the searches requested, and that search results will not be used for any purpose other than the purpose stated to Docusearch. We need not decide whether these representations sufficiently narrowed the scope of Insurance Other ; Resellers' argument still ignores the fact that only certain entities are eligible to claim the insurance exception. Whether Leifer is one of them is determinative of Arcanum's liability. If Leifer was not eligible to claim that exception, Arcanum's disclosure would have been for a use not permitted by section 2721(b). Hence, with respect to Arcanum, we conclude that the district court erred by granting summary judgment without having first considered (1) whether Leifer was eligible to request information pursuant to the insurance exception, (2) if so, whether a collision had occurred, and (3) if so, whether an -29- insurance claim had accrued. These material questions of fact preclude summary judgment as to Arcanum's liability.
Framework Gordon further contends that, even if Resellers disclosed his personal information for what they believed to be a permitted use, they are still liable because they violated a duty of reasonable care imposed by the DPPA. Resellers contend that the DPPA imposes no such duty. Based on the language of the statute, its structure, and its legislative history, we conclude that the DPPA imposes a duty on resellers to exercise reasonable care in responding to requests for personal information drawn from motor vehicle records.
The default rule under the DPPA is non -disclosure. It is unlawful for a state DMV or any employee or officer thereof to knowingly disclose or otherwise make available to any person or entity . . . personal information obtained from a motor vehicle record, except as provided i n section 2721(b). 18 U.S.C. § 2721(a). Resellers are -30- subject to the same general rule of non-disclosure; with limited exceptions not relevant here, resellers may resell or redisclose the information only for a use permitted under subsection (b). Id. § 2721(c) (emphasis added); see also Taylor v. Acxiom Corp., 612 F.3d 325, 338 (5th Cir. 2010). Moreover, the DPPA creates a civil cause of action for unauthorized disclosure: section 2724(a) provides that a person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court. 18 U.S.C. § 2724(a). Logically, the language makes clear, albeit implicitly, that resellers are obliged to use some care in disclosing personal information obtained from motor vehicle records. If resellers may not disclose personal information except as permitted by the DPPA, they must be obliged to make some inquiry before concluding that disclosure is permitted. See also Roth v. Guzman, 650 F.3d 603, 618 (6th Cir. 2011) (Clay, J., dissenting) (rejecting -31- notion that upstream source had no actual duty . . . other than the ministerial task of soliciting rote representations from prospective requesters of DPPAprotected personal information). It would make no sense that this obligation could be met simply by accepting an end user's mere say-so in the presence of red flags suggesting the requested information was being sought for an improper purpose. Under this theory, advocated by Resellers, an upstream source could always avoid liability by securing a representation that the recipient of personal information had a permissible use or by hiding behind one or more dropdown menus so that a user would always -- and could only -- select a permitted use. The civil remedies provision would be rendered toothless if resellers could insulate themselves from liability based solely on the conclusory representations of end users, with out being required to exercise due care themselves. We note also that the statute's use of the word knowingly is not inconsistent with the notion that some duty of care exists. Cf. id. Case law is replete with situations where knowledge contemplates what a party knew -32- or should have known. 11 Negligence law in particular frequently invokes the concept of constructive knowledge when deciding whether a particular outcome was foreseeable, 12 and criminal law applies a similar concept when imposing criminal liability under a theory of conscious avoidance. 13 11 See, e.g., Farmer v. Brennan, 511 U.S. 825, 843 n.8 (1994) (inferences not conclusive but prison official in Bivens suit would not escape liability if the evidence showed that he merely refused to verify underlying facts that he strongly suspected to be true, or declined to confirm inferences of risk that he strongly suspected to exist); In re Potomac Transp., Inc., 909 F.2d 42, 46 (2d Cir. 1990) (construing privity and knowledge under provision of maritime law to mean ship owner knew or should have known that particular condition existed). 12 See, e.g., Ehrens v. Lutheran Church, 385 F.3d 232, 235 (2d Cir. 2004) (to state claim of negligent supervision, plaintiff must allege, inter alia, that employer knew or should have known of employee's propensity for injury-causing conduct); Williams v. Long Island R.R. Co., 196 F.3d 402, 406 (2d Cir. 1999) (employer may breach liability under Federal Employers Liability Act, 45 U.S.C. § 51 et seq., if it knew or should have known of workplace hazard but did not inform or protect its employees). 13 See, e.g., United States v. Beech-Nut Nutrition Corp., 871 F.2d 1181, 1195 (2d Cir. 1989) (finding conscious avoidance applies when defendant claims to lack some specific aspect of knowledge necessary to conviction but where the evidence may be construed as deliberate ignorance (citation and internal quotation marks omitted)); United States v. Finkelstein, 229 F.3d 90, 95-96 (2d Cir. 2000) (distinguishing conscious avoidance from negligence but holding it is relevant when considering sentencing enhancements). -33-
Provision The structure of the DPPA also supports the conclusion that resellers owe a duty of reasonable care. The DPPA provides that a court may award punitive damages upon proof of willful or reckless disregard of the law. 18 U.S.C. § 2724(b)(2); see also Pichler, 542 F.3d at 397 (willful or reckless disregard is when a party appre ciated it was engaging in wrongful conduct (internal quotation marks omitted)). In contrast, the preceding subdivision provides that the court may award actual damages, but not less than liquidated damages in the amount of $2,500. 18 U.S.C. § 2724(b)(1). The actual damages provision is silent as to the degree of fault necessary to trigger liability for actual damages. If, however, as the statute suggests, punitive damages are available only for willful and reckless violations of the DPPA, then actual damages must require something less -- that is, conduct that is neither willful nor reckless. As we have rejected a theory of strict liability, the most appropriate standard, in our view, is -34- reasonableness: a reasonableness standard best harmonizes the wording, the structure, and, as discussed below, the purpose of the DPPA. Accordingly, we conclude that a reseller is liable for actual (or liquidated) damages when it fails to use reasonable care to ensure that personal information is being obtained for a permissible purpose. We note too that the Department of Justice (DOJ) has reached a similar conclusion. In a non-binding advisory opinion, DOJ concluded that a state DMV could release personal information to resellers upon reasonably concluding that the information [requested by the commercial distributor] will be used for authorized purposes only. Letter from Robert C. McFetridge, Special Counsel to the Assistant Att'y Gen., Civil Div., Dep't of Justice, to Peter Sacks, Office of the Att'y Gen., The Commonwealth of Mass. (Oct. 9, 1998) (on file with the Court) [hereinafter DOJ Letter], at 2 (emphasis added); see also, e.g., Graczyk v. W. Publ'g Co., 660 F.3d 275, 280-81 (7th Cir. 2011) (discussing DOJ Letter), cert. denied, 132 S. Ct. 2391 (2012); Taylor, 612 F.3d at 339 (same). An entity cannot reasonably conclude that a person -35- or entity may access DPPA-protected personal information if it does not exercise some modicum of care. See Cook v. ACS State & Local Solutions, Inc., 663 F.3d 989, 997 (8th Cir. 2011) (summarizing DOJ letter as stating that states must reasonably conclude that the information would be used only for authorized purposes).
We acknowledge that there is some ambiguity in the statute. The DPPA does not explicitly provide for a duty of reasonable care, and it is silent as to the degree of fault necessary for an award of actual or liquidated damages. Moreover, the word knowingly, as used in sections 2722(a) and 2724(a), is ambiguous: depending on one's reading of the statute, civil liability could attach (1) to any act committed intentionally, or (2) only for an act undertaken with knowledge of an improper purpose . For example, in Pichler v. UNITE, 542 F.3d 380 (3d Cir. 2008), the Third Circuit concluded that the end user -- a union -- could be civilly liable for using DPPA -protected personal information for an improper purpose even though, at the -36- time, the union did not know that its purpose would be deemed improper. Id. at 396-97. By contrast, in Roth v. Guzman, 650 F.3d 603 (6th Cir. 2011), the Sixth Circuit concluded that a state DMV was not subject to civil liability under the DPPA unless it actually knew that the recipient, who had represented that it had a permissible use for the requested DPPA-protected personal information, would use it for an improper purpose. Id. at 611-12. We need not resolve the disagreement, however, as both Pichler (addressing use by an end user) and Roth (addressing disclosure by the state) are distinguishable from this case, which addresses disclosure by resellers . In light of the ambiguity in the statute, we look to its legislative history, and the legislative history supports the conclusion that resellers must exercise some degree of care. The legislative history emphasized that the DPPA would protect an individual's fundamental right to privacy and safety. 145 Cong. Rec. H2522 (daily ed. Apr. 20, 1994) (statement of Rep. Moran), available at 1994 WL 140035; see also id. at H2527 (statement of Rep. Goss). Protecting this right was particularly important in light -37- of two mandates associated with driving: all drivers must register with the state, and no drivers may obscure the license plate number on their cars. See 139 Cong. Rec. S15764 (daily ed. Nov. 16, 1993) (statement of Sen. Boxer), available at 1993 WL 470986; 140 Cong. Rec. H2523 (daily ed. Apr. 20, 1994) (statement of Rep. Moran), available at 1994 WL 144035; 139 Cong. Rec. S14436 (daily ed. Oct. 26, 1993) (statement of Sen. Warner), available at 1993 WL 470986 (drivers that register with the DMV should do so with full confidence that the information they provide will not be disclosed indiscriminately). Because disclosures, such as the one made by Softech to Arcanum to Leifer, are often totally incompatible with the purpose for which the information was collected, regulating the circumstanc es of disclosure was of paramount importance to Congress. See 139 Cong. Rec. S15764 (daily ed. Oct. 26, 1993) (statement of Sen. Boxer), available at 1993 WL 470986. Concerns that state actions had undermined public safety also catalyzed the enactment of the DPPA, which was passed as part of the Violent Crime Control and La w Enforcement Act of 1994, Pub. L. No. 103-322, 108 Stat. -38- 1796. Congress perceived a need to better regulate disclosure of personal information because such disclosures had been used to stalk, rob, and even kill private citizens. See, e.g., 139 Cong. Rec. E2747 (daily ed. Nov. 3, 1993) (statement of Rep. Moran), available at 1993 WL 448643; 139 Cong. Rec. S15762, S15766 (daily ed. Nov. 16, 1993) (statements of Sen. Boxer and Sen. Harkin). Assuming Gordon's allegations are true, Leifer's threats to Gordon's family and friends were precisely the sort of acts that Congress sought to curtail. Given the nature of information available through motor vehicle records -- e.g., social security number, medical or disability information, and home address -- the DPPA's purpose would be severely undermined if resellers' disclosures were not subject to a duty of reasonable inquiry. See Reno, 528 U.S. at 151 (The DPPA regulates the universe of entities that participate as suppliers to the market for motor vehicle information -- the States as initial suppliers of the information in interstate commerce and private resellers or redisclosers of that information in commerce. (emphasis added)). And, in light of the -39- clear congressional intent to safeguard the privacy and safety of drivers, it is inconceivable that a dropdown menu, a check box, and a representation that no laws would be violated could satisfy any reasonable diligence floor. See 139 Cong. Rec. S15765 (daily ed. Nov. 16, 1993) (statement of Sen. Robb), available at 1993 WL 470986; see also Roth, 650 F.3d at 619 (Clay, J., dissenting) ([T]he DPPA compels the conclusion that the Act imposes . . . a duty of reasonable inquiry.); Welch v. Jones, 770 F. Supp. 2d 1253, 1260 (N.D. Fla. 2011) (no DPPA violation in reseller's disclosure where recipient identified its permissible use under penalties of perjury, and reseller verified recipient's identity, even though the recipient ultimately used the information impermissibly). In light of the text, structure, and legislative history of the DPPA, we hold that resellers are subject to a duty of reasonable care before disclosing DPPA -protected personal information. 14 See 18 U.S.C. § 2721(b)-(c). 14 Notwithstanding the similarities among upstream sources of DPPA-protected personal information, as this case does not require us to consider the effect on state DMVs, we limit our holding to private resellers under the statute. -40-
Applied to Softech and Arcanum
Softech released Gordon's personal information per Arcanum's request for use by any licensed private investigative agency. Rodriguez Dep. 49:15-16. Moreover, Softech and Arcanum had an ongoing business relationship through which Softech knew Arcanum was a licensed private investigative agency, and Arcanum had contractually agreed that it would only use information for three purposes permitted by the DPPA. Hence, at a minimum, Softech's disclosures to Arcanum were permitted by the private investigative agency exception. See 18 U.S.C. § 2721(b)(8). Nothing in the record suggests that, in complying with the information request , Softech acted unreasonably. Gordon contends that Softech's disclosure was still unreasonable because Arcanum's Affidavit of Intended Use affirmed that Arcanum would only use information for three stated purposes -- none of which were for public -41- investigative services. 15 Furthermore, the agreement provided that Arcanum was required to strictly abide by the terms of the affidavit. Softech contends that its automated system would check[] that the DPPA [permissible use] selected is the one that they actually, upon signin g up with us, was the one that they selected on the Affidavit of Intended Use, and reject the request if it were not. Rodriguez Dep. 46:11-14, 16-20. Yet when Arcanum requested information pursuant to an exception not listed on its Affidavit of Intended Use, Softech did not reject Arcanum's request; instead, it released Gordon's personal information. We do not believe that these circumstances create a genuine issue of fact for trial. Although, when it initially entered into a relationship with Softech, Arcanum agreed that it would seek information only for three permissible purposes, no legal obstacles prevented Arcanum from requesting information from Softech (or precluded Softech from giving information to Arcanum) for other 15 See supra note 7. -42- permissible purposes in the future. Moreover, Arcanum was, in fact, a licensed private investigative agency , and Arcanum had provided Softech with an Affidavit of Intended Use that promised that Arcanum would use the information only in accordance with the requirements in section 2721(b)(8). Further, as a reseller, Softech's disclosure, to a user for an apparently permissible use, was permitted under section 2721(c). 16 Finally, even assuming that Softech had inquired further, nothing in the record suggests that Softech would have uncovered any red flags suggesting the information was being sought for an improper purpose. Hence, we conclude that the district court properly granted summary judgment in favor of Softech.
By contrast, we conclude that a reasonable jury could find that Arcanum failed to exercise reasonable care 16 We further note that each of the four Courts of Appeals to have considered the issue has concluded that resellers (like Softech and Arcanum) need not themselves use the information before disclosing it in a manner permitted by the DPPA. See Cook v. ACS State & Local Solutions, Inc., 663 F.3d 989, 997 (9th Cir. 2011); Graczyk v. W. Publ'g Co., 660 F.3d 275, 279-80 (7th Cir. 2011); Howard v. Criminal Info. Servs., Inc., 654 F.3d 887, 891-92 (9th Cir. 2011); Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010). -43- when it disclosed Gordon's personal information to Leifer. In seeking the information, Leifer used the alias Jack Loren. He used a credit card number that did not match the name Jack Loren. He claimed he worked for a business, Bodyguards.com, that was not operational. He selected a purpose, Insurance Other, that, at least arguably, is not a permitted purpose. He did not provide any information or proof relating to his status as an insurance company, a self-insured entity, or an insurance support organization, to verify his eligibility to invoke the insurance exception. Arcanum failed to inquire as to Leifer's eligibility to invoke the insurance exception, and it never checked the accuracy of the purported Jack Loren identity or the purported business affiliation. Arcanum apparently did not even bother to verify whether the name associated with the credit card number provided by Jack Loren matched the name associated with the Docusearch.com account. Moreover, the Docusearch.com dropdown menu offered a selection of fourteen purportedly Permissible -44- Purpose[s], and instructed the customer that he Must Select One of the purportedly permissible purposes. Thus, the Docusearch.com website was designed -- as a reasonable jury could so find -- to ensure that end users selected one of fourteen purportedly permissible purposes, without providing them with an opportunity to articulate the true purpose -- permissible or not -- behind a particular records request. Although Arcanum did ask Leifer to represent that he was seeking the information for a lawful purpose, a reasonable jury could find on these facts that Arcanum failed to use reasonable care, and that, had it been reasonably diligent, Arcanum would have discovered that Leifer was seeking the information for an improper purpose. See King v. Crossland Sav. Bank, 111 F.3d 251, 259 (2d Cir. 1997) ([T]he assessment of reasonableness generally is a factual question to be addressed by the jury.). Accordingly, the district court erred in granting summary judgment to Arcanum.