Opinion ID: 2828917
Heading Depth: 1
Heading Rank: 3

Heading: Commissioners and DPS Does

Text: Drivers19 challenge the district court’s dismissal of the claims against Commissioners. The district court held that the DPPA did not create a private right of action for Commissioners’ alleged negligence in mismanaging information from motor vehicle records and that Commissioners could be held liable only if the complaint established that “the Commissioners themselves” had an impermissible purpose for disclosing Drivers’ personal information to Law Enforcement Does. On appeal, Commissioners contend that the allegations against them fail to state a claim either because they did not have the necessary mental state required to violate the Act or because they have qualified immunity. The parties’ arguments on this issue apply equally to DPS Does. 19 Throughout this section, “Drivers” refers only to Bass, McDonough, and Potocnik, the three Drivers who brought claims against Commissioners and DPS Does. -35- Although the district court did not address the issue of qualified immunity, we review grants of motions to dismiss de novo and may affirm on any grounds that the record supports, including qualified immunity. See Christiansen v. W. Branch Cmty. Sch. Dist., 674 F.3d 927, 933-34 (8th Cir. 2012). “Qualified immunity gives government officials breathing room to make reasonable but mistaken judgments about open legal questions.” Ashcroft v. al-Kidd, 131 S. Ct. 2074, 2085 (2011). “[G]overnment officials performing discretionary functions generally are shielded from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known.” Harlow v. Fitzgerald, 457 U.S. 800, 818 (1982). A government official “violates clearly established law when, at the time of the challenged conduct, ‘[t]he contours of [a] right [are] sufficiently clear’ that every ‘reasonable official would have understood that what he is doing violates that right.’” al-Kidd, 131 S. Ct. at 2084 (alterations in original). The DPPA’s provisions limiting the disclosure, obtainment, or use of personal information from a motor vehicle record include a mental state requirement. Section 2724 provides: “A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” Commissioners argue that they cannot be held liable to Drivers under § 2724 because the required mental state, “knowingly,” applies not only to the “disclos[ure]” of the information, but also to the phrase, “for a purpose not permitted.” In essence, Commissioners contend that DMV employees can be held liable only if they had actual knowledge of Law Enforcement Does’ impermissible purposes for obtaining the information. Commissioners also suggest that they are liable only if they themselves harbored an impermissible “purpose” for the disclosure. Drivers argue that the word “knowingly” in § 2724 modifies only the phrase denoting the act—“obtains, discloses or uses”—and not the -36- phrase “for a purpose not permitted.” Drivers contend that, at the very least, Commissioners had an obligation under the DPPA to make some effort to ascertain each Law Enforcement Doe’s purpose prior to each disclosure. Several circuits have weighed in on the scope of the DPPA’s mental state requirement. Although none have squarely addressed the issue before us, their opinions could support either of the parties’ conflicting interpretations. Compare Gordon v. Softech Int’l, Inc., 726 F.3d 42, 53-54 (2d Cir. 2013) (holding, in the context of resellers, that the DPPA implicitly imposes a duty to exercise reasonable care in responding to requests for personal information), Pichler v. UNITE, 542 F.3d 380, 396 n.21 (3d Cir. 2008) (primarily addressing an ignorance-of-the-law defense but noting agreement with the district court that the word “knowingly” modifies only the act requirement), and Senne v. Village of Palatine, 695 F.3d 597, 603 (7th Cir. 2012) (en banc) (same, stating that “[v]oluntary action . . . is sufficient to satisfy the mens rea element of the DPPA”), with Roth v. Guzman, 650 F.3d 603, 611-12 (6th Cir. 2011) (holding that state employees who disclosed information to an obtainer who explicitly stated a permissible purpose were entitled to qualified immunity because the focus should be on the use for which the information was disclosed, not the undisclosed use for which it was obtained). The circuits’ varied interpretations of § 2724’s mental state element reflect a lack of clarity regarding 1) to which element or elements the “know[ledge]” requirement applies; 2) the standard of care, if any, that disclosers must exercise when ascertaining the purpose for an information request; and 3) whether the word “purpose” in § 2724 refers to the discloser’s purpose for divulging the information or the obtainer’s purpose for requesting it. Even if, at the time of the disclosures in the instant action, it was clearly established that a discloser has a duty under the DPPA to make some effort to ascertain a recipient’s purpose, it was not clearly established that the ascertained purpose must be express and explicit. Drivers allege -37- that DPS issued passwords to police officers, employees at sheriffs’ offices, court staff, or other similarly situated government agents in connection with their jobs. There are no allegations that DPS issued passwords to agents or officers whose job duties did not require the use of personal information in motor vehicle records and who nevertheless accessed Drivers’ personal information. Drivers allege that Law Enforcement Does received training about proper use of the database and that the website used to log on to the database stated, “Access to this service is for authorized personnel only conducting official business . . . .” Law Enforcement Does thus implicitly certified a permissible purpose each time they logged on. In these circumstances, we cannot say that, at the time of the alleged accesses, any reasonable official would have understood that DPS’s policy of allowing the above-described government employees password-protected access to the database violated Drivers’ rights under the DPPA. Drivers also allege that Commissioners and DPS Does knew of the widespread misuse of the system and “knowingly disclosed” Drivers’ personal information by “failing to safeguard and monitor the database” and by “willfully refusing to correct the misuses.” These allegations, at most, allege negligence or recklessness. Even assuming that the DPPA imposes a duty of some degree of care on DPS officials, that duty of care was not clearly established at the time of the alleged violations. To the extent that Drivers attempt to allege, without support, that Commissioners and DPS Does actually knew that the particular disclosures alleged in the complaint were for impermissible purposes, such bald allegations are conclusory and are properly disregarded when determining whether the complaint survives a motion to dismiss. See Iqbal, 556 U.S. at 681, 683. We therefore affirm the dismissal of Bass’s, McDonough’s, and Potocnik’s claims against the Commissioners and DPS Does.20 20 Although qualified immunity does not necessarily prevent an award of equitable relief against government officials in their official capacities, e.g., Grantham v. Trickey, 21 F.3d 289, 295-96 (8th Cir. 1994), Drivers have not argued that their prospective-relief claims should be analyzed differently than their claims -38-