Opinion ID: 1036114
Heading Depth: 5
Heading Rank: 2

Heading: The Structure of the Civil Penalties

Text: Provision The structure of the DPPA also supports the conclusion that resellers owe a duty of reasonable care. The DPPA provides that a court may award punitive damages upon proof of willful or reckless disregard of the law. 18 U.S.C. § 2724(b)(2); see also Pichler, 542 F.3d at 397 (willful or reckless disregard is when a party appre ciated it was engaging in wrongful conduct (internal quotation marks omitted)). In contrast, the preceding subdivision provides that the court may award actual damages, but not less than liquidated damages in the amount of $2,500. 18 U.S.C. § 2724(b)(1). The actual damages provision is silent as to the degree of fault necessary to trigger liability for actual damages. If, however, as the statute suggests, punitive damages are available only for willful and reckless violations of the DPPA, then actual damages must require something less -- that is, conduct that is neither willful nor reckless. As we have rejected a theory of strict liability, the most appropriate standard, in our view, is -34- reasonableness: a reasonableness standard best harmonizes the wording, the structure, and, as discussed below, the purpose of the DPPA. Accordingly, we conclude that a reseller is liable for actual (or liquidated) damages when it fails to use reasonable care to ensure that personal information is being obtained for a permissible purpose. We note too that the Department of Justice (DOJ) has reached a similar conclusion. In a non-binding advisory opinion, DOJ concluded that a state DMV could release personal information to resellers upon reasonably concluding that the information [requested by the commercial distributor] will be used for authorized purposes only. Letter from Robert C. McFetridge, Special Counsel to the Assistant Att'y Gen., Civil Div., Dep't of Justice, to Peter Sacks, Office of the Att'y Gen., The Commonwealth of Mass. (Oct. 9, 1998) (on file with the Court) [hereinafter DOJ Letter], at 2 (emphasis added); see also, e.g., Graczyk v. W. Publ'g Co., 660 F.3d 275, 280-81 (7th Cir. 2011) (discussing DOJ Letter), cert. denied, 132 S. Ct. 2391 (2012); Taylor, 612 F.3d at 339 (same). An entity cannot reasonably conclude that a person -35- or entity may access DPPA-protected personal information if it does not exercise some modicum of care. See Cook v. ACS State & Local Solutions, Inc., 663 F.3d 989, 997 (8th Cir. 2011) (summarizing DOJ letter as stating that states must reasonably conclude that the information would be used only for authorized purposes).