Opinion ID: 1036114
Heading Depth: 4
Heading Rank: 3

Heading: Resellers' Duty of Reasonable Care: As

Text: Applied to Softech and Arcanum
Softech released Gordon's personal information per Arcanum's request for use by any licensed private investigative agency. Rodriguez Dep. 49:15-16. Moreover, Softech and Arcanum had an ongoing business relationship through which Softech knew Arcanum was a licensed private investigative agency, and Arcanum had contractually agreed that it would only use information for three purposes permitted by the DPPA. Hence, at a minimum, Softech's disclosures to Arcanum were permitted by the private investigative agency exception. See 18 U.S.C. § 2721(b)(8). Nothing in the record suggests that, in complying with the information request , Softech acted unreasonably. Gordon contends that Softech's disclosure was still unreasonable because Arcanum's Affidavit of Intended Use affirmed that Arcanum would only use information for three stated purposes -- none of which were for public -41- investigative services. 15 Furthermore, the agreement provided that Arcanum was required to strictly abide by the terms of the affidavit. Softech contends that its automated system would check[] that the DPPA [permissible use] selected is the one that they actually, upon signin g up with us, was the one that they selected on the Affidavit of Intended Use, and reject the request if it were not. Rodriguez Dep. 46:11-14, 16-20. Yet when Arcanum requested information pursuant to an exception not listed on its Affidavit of Intended Use, Softech did not reject Arcanum's request; instead, it released Gordon's personal information. We do not believe that these circumstances create a genuine issue of fact for trial. Although, when it initially entered into a relationship with Softech, Arcanum agreed that it would seek information only for three permissible purposes, no legal obstacles prevented Arcanum from requesting information from Softech (or precluded Softech from giving information to Arcanum) for other 15 See supra note 7. -42- permissible purposes in the future. Moreover, Arcanum was, in fact, a licensed private investigative agency , and Arcanum had provided Softech with an Affidavit of Intended Use that promised that Arcanum would use the information only in accordance with the requirements in section 2721(b)(8). Further, as a reseller, Softech's disclosure, to a user for an apparently permissible use, was permitted under section 2721(c). 16 Finally, even assuming that Softech had inquired further, nothing in the record suggests that Softech would have uncovered any red flags suggesting the information was being sought for an improper purpose. Hence, we conclude that the district court properly granted summary judgment in favor of Softech.
By contrast, we conclude that a reasonable jury could find that Arcanum failed to exercise reasonable care 16 We further note that each of the four Courts of Appeals to have considered the issue has concluded that resellers (like Softech and Arcanum) need not themselves use the information before disclosing it in a manner permitted by the DPPA. See Cook v. ACS State & Local Solutions, Inc., 663 F.3d 989, 997 (9th Cir. 2011); Graczyk v. W. Publ'g Co., 660 F.3d 275, 279-80 (7th Cir. 2011); Howard v. Criminal Info. Servs., Inc., 654 F.3d 887, 891-92 (9th Cir. 2011); Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010). -43- when it disclosed Gordon's personal information to Leifer. In seeking the information, Leifer used the alias Jack Loren. He used a credit card number that did not match the name Jack Loren. He claimed he worked for a business, Bodyguards.com, that was not operational. He selected a purpose, Insurance Other, that, at least arguably, is not a permitted purpose. He did not provide any information or proof relating to his status as an insurance company, a self-insured entity, or an insurance support organization, to verify his eligibility to invoke the insurance exception. Arcanum failed to inquire as to Leifer's eligibility to invoke the insurance exception, and it never checked the accuracy of the purported Jack Loren identity or the purported business affiliation. Arcanum apparently did not even bother to verify whether the name associated with the credit card number provided by Jack Loren matched the name associated with the Docusearch.com account. Moreover, the Docusearch.com dropdown menu offered a selection of fourteen purportedly Permissible -44- Purpose[s], and instructed the customer that he Must Select One of the purportedly permissible purposes. Thus, the Docusearch.com website was designed -- as a reasonable jury could so find -- to ensure that end users selected one of fourteen purportedly permissible purposes, without providing them with an opportunity to articulate the true purpose -- permissible or not -- behind a particular records request. Although Arcanum did ask Leifer to represent that he was seeking the information for a lawful purpose, a reasonable jury could find on these facts that Arcanum failed to use reasonable care, and that, had it been reasonably diligent, Arcanum would have discovered that Leifer was seeking the information for an improper purpose. See King v. Crossland Sav. Bank, 111 F.3d 251, 259 (2d Cir. 1997) ([T]he assessment of reasonableness generally is a factual question to be addressed by the jury.). Accordingly, the district court erred in granting summary judgment to Arcanum.