Court Opinion

ID: 6322446
Source: CourtListenerOpinion
Date Created: 2022-03-11 19:00:39.674089+00
Date Added: 2024-06-11T09:20:47.737482
License: Public Domain

Case: 21-20404     Document: 00516235197         Page: 1     Date Filed: 03/11/2022

           United States Court of Appeals
                for the Fifth Circuit                             United States Court of Appeals
                                                                           Fifth Circuit

                                                                         FILED
                                                                   March 11, 2022
                                  No. 21-20404
                                                                    Lyle W. Cayce
                                                                         Clerk
   Derek Allen; Leandre Bishop; John Burns,

                                                           Plaintiffs—Appellants,

                                      versus

   Vertafore, Incorporated,

                                                           Defendant—Appellee.

                  Appeal from the United States District Court
                      for the Southern District of Texas
                           USDC No. 4:20-CV-4139

   Before Southwick, Haynes, and Higginson, Circuit Judges.
   Stephen A. Higginson, Circuit Judge:
         Plaintiffs, Texas driver’s license holders, brought this action against
   Vertafore, Inc., for a violation of the Driver’s Privacy Protection Act, 18
   U.S.C. § 2721, et seq., after Vertafore announced that unauthorized users had
   gained access to personal information protected by the statute that Vertafore
   had stored on unsecured external servers.       The district court granted
   Vertafore’s motion to dismiss. We AFFIRM.
Case: 21-20404       Document: 00516235197         Page: 2   Date Filed: 03/11/2022

                                    No. 21-20404

                                         I.
          On November 10, 2020, Vertafore, an insurance software company,
   announced that three data files that it had “stored in an unsecured external
   storage service” had been accessed without authorization sometime between
   March and August 2020. Those files contained the driver information of
   approximately 27.7 million people holding Texas driver’s licenses issued
   before February 2019. As of November 2020, Vertafore’s investigation had
   not turned up any evidence that the information accessed without
   authorization had been misused.
          On December 4, 2020, Plaintiffs filed a putative class action complaint
   against Vertafore for a violation of the Driver’s Privacy Protection Act.
   Plaintiffs alleged that “Vertafore knowingly disclosed the Driver’s License
   Information of Plaintiffs and approximately 27.7 million other Class members
   by storing that information on unsecured external servers.” On January 29,
   2021, Vertafore filed a motion to dismiss under Federal Rule of Civil
   Procedure 12(b)(1), arguing that Plaintiffs lacked standing, and under Federal
   Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief
   can be granted.
          The magistrate judge held a hearing on the motion on April 27, 2021
   and subsequently recommended that the district court find that Plaintiffs had
   standing but that they failed to state a claim. The magistrate judge noted that
   “absent from [Plaintiffs’ complaint] is any factual allegation describing how
   [Vertafore’s] purported mismanagement of information amounts to a
   knowing disclosure of personal information for an improper purpose.”
   Therefore, he concluded that “Plaintiffs’ allegation that Vertafore knowingly
   disclosed their personal information for an improper purpose is nothing
   more than a conclusory allegation or legal conclusion masquerading as a
   factual conclusion.”

                                         2
Case: 21-20404            Document: 00516235197               Page: 3       Date Filed: 03/11/2022

                                             No. 21-20404

            Plaintiffs objected to the magistrate judge’s Memorandum and
   Recommendation and asked for an opportunity to amend their complaint if
   the district judge was not inclined to deny Vertafore’s motion. 1 On July 23,
   2021, the district court adopted the magistrate judge’s Memorandum and
   Recommendation in its entirety and granted Vertafore’s motion to dismiss.
   Plaintiffs timely filed this appeal.
                                                   II.
            We review de novo the district court’s grant of a motion to dismiss for
   failure to state a claim. Kennedy v. Chase Manhattan Bank USA, NA, 369 F.3d
   833, 839 (5th Cir. 2004). “To survive a motion to dismiss, a complaint must
   contain sufficient factual matter, accepted as true, to ‘state a claim to relief
   that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)
   (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). In
   reviewing a motion to dismiss, we “accept[] all well-pleaded facts as true and
   view[] those facts in the light most favorable to the plaintiff.” Cummings v.
   Premier Rehab Keller, P.L.L.C., 948 F.3d 673, 675 (5th Cir. 2020) (internal
   citation omitted). But “a complaint’s allegations must make relief plausible,
   not merely conceivable, when taken as true.” Inclusive Communities Project,
   Inc. v. Lincoln Prop. Co., 920 F.3d 890, 899 (5th Cir. 2019) (internal citation
   omitted). “The court’s review is limited to the complaint, any documents
   attached to the complaint, and any documents attached to the motion to
   dismiss that are central to the claim and referenced by the complaint.” Lone
   Star Fund V (U.S.), L.P. v. Barclays Bank PLC, 594 F.3d 383, 387 (5th Cir.
   2010).

            1
                Plaintiffs have not renewed this request in their briefs on appeal.

                                                    3
Case: 21-20404      Document: 00516235197          Page: 4    Date Filed: 03/11/2022

                                    No. 21-20404

                                         III.
                                         A.
          The Driver’s Privacy Protection Act (DPPA) “regulates the
   disclosure of personal information contained in the records of state motor
   vehicle departments.” Reno v. Condon, 528 U.S. 141, 143 (2000). The DPPA
   was enacted in 1994 to respond to at least two concerns: “The first was a
   growing threat from stalkers and criminals who could acquire personal
   information from state DMVs. The second concern related to the States’
   common practice of selling personal information to businesses engaged in
   direct marketing and solicitation.” Maracich v. Spears, 570 U.S. 48, 57
   (2013).
          The DPPA makes it “unlawful for any person knowingly to obtain or
   disclose personal information, from a motor vehicle record, for any use not
   permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a). “A
   person who knowingly obtains, discloses or uses personal information, from
   a motor vehicle record, for a purpose not permitted under [the DPPA] shall
   be liable to the individual to whom the information pertains, who may bring
   a civil action in a United States district court.” 18 U.S.C. § 2724(a). “The
   court may award . . . actual damages, but not less than liquidated damages in
   the amount of $2,500 . . . .” § 2724(b). To state a claim for a violation of the
   DPPA, the complaint must adequately allege that “(1) the defendant
   knowingly obtain[ed], disclose[d] or use[d] personal information; (2) from a
   motor vehicle record; and (3) for a purpose not permitted.” Taylor v. Acxiom
   Corp., 612 F.3d 325, 335 (5th Cir. 2010).
                                         B.
          Plaintiffs’ complaint alleges that Vertafore knowingly disclosed
   Plaintiffs’ personal information “by storing that information on unsecured
   external servers.” The complaint further states that “the unsecure servers

                                          4
Case: 21-20404      Document: 00516235197           Page: 5     Date Filed: 03/11/2022

                                     No. 21-20404

   disclosed” Plaintiffs’ personal information “[i]n response to the commands
   of unauthorized individuals and consistent with the manner in which they
   were programmed and configured by Vertafore.” In their motion to dismiss
   and before us, Vertafore has argued that Plaintiffs failed to allege both that
   the company acted with an impermissible purpose and that the company
   made a knowing disclosure. Because we conclude that Plaintiffs have not
   alleged a “disclosure” within the meaning of the DPPA, we need not reach
   whether Plaintiffs sufficiently alleged that Vertafore acted knowingly and
   with an impermissible purpose.
          We turn, then, to whether any of the allegations in Plaintiffs’
   complaint amount to a disclosure, as that word is used in the DPPA. When
   interpreting statutes, we begin with the text’s plain meaning, “ascertained by
   reference to ‘the particular statutory language at issue, as well as the language
   and design of the statute as a whole.’” United States v. Renda, 709 F.3d 472,
   481 (5th Cir. 2013) (quoting Frame v. City of Arlington, 657 F.3d 215, 224 (5th
   Cir. 2011)). The DPPA makes it unlawful to “obtain or disclose personal
   information,” and Plaintiffs’ complaint alleges that Vertafore “disclose[d]”
   Plaintiffs’ personal information. § 2722(a). The statute does not define
   “disclose,” see 18 U.S.C. § 2725, but Black’s Law Dictionary defines the
   word as “[t]o bring into view by uncovering; to expose; to make known; to
   lay bare; to reveal to knowledge; to free from secrecy or ignorance, or make
   known.” Black’s Law Dictionary (6th ed. 1990).
          The Plaintiffs argue in their briefs to us that Vertafore’s disclosure
   was the act of “plac[ing] the information onto a server that was readily
   accessible to the public,” but this assertion is nowhere in Plaintiffs’ complaint,
   nor is it supported by the facts alleged in Plaintiffs’ complaint.           The
   complaint does not allege, for example, that Vertafore published Plaintiffs’
   personal information on a public website or otherwise placed the information
   in plain view of any digital “passer-by.” See Senne v. Village of Palatine, Ill.,

                                           5
Case: 21-20404         Document: 00516235197            Page: 6      Date Filed: 03/11/2022

                                         No. 21-20404

   695 F.3d 597, 603 (7th Cir. 2012) (en banc) (holding that a police officer’s
   placement of a parking ticket on a car windshield was a disclosure within the
   meaning of the DPPA because “[t]he real effect of the placement of the ticket
   was to make available Mr. Senne’s motor vehicle record to any passer-by”).
           Instead, the only facts alleged in Plaintiffs’ complaint are that
   Vertafore stored personal information on “unsecured external servers” and
   that unauthorized users accessed that information. Without more, these
   facts do not plausibly state a “disclosure” consistent with the plain meaning
   of that word. Nothing about the words “unsecured” or “external” implies
   exposure to public view, and the mere fact that unauthorized users managed
   to access the information does not imply that Vertafore granted or facilitated
   that access. After all, we would hardly say that personal information was
   “disclosed” if it was kept in hard copy and the papers were stolen out of an
   unlocked, but private, storage facility. See Enslin v. Coca-Cola Co., 136 F.
   Supp. 3d 654, 658-59, 671 (E.D. Pa. 2015) (concluding that “privately holding
   [personal information], even in an unsecured manner, does not constitute a
   ‘voluntary disclosure’ under the DPPA” where personal information was
   stored unencrypted on laptops that were stolen from company property by
   an employee), aff’d, 739 F. App’x 91 (3d Cir. 2018).
           Though at this stage of the proceedings we draw all reasonable
   inferences in Plaintiffs’ favor, the inference Plaintiffs ask us to draw—from
   “stored on unsecured external servers” to “disclosed”—is not reasonable.
   See Iqbal, 556 U.S. at 678. 2 Because Plaintiffs have not alleged a disclosure
   within the meaning of the DPPA, their complaint fails to state a plausible
   claim for relief.

           2
            Plaintiffs cite no case in which insufficiently secure data storage constituted a
   “disclosure” within the meaning of the DPPA.

                                               6
Case: 21-20404   Document: 00516235197         Page: 7   Date Filed: 03/11/2022

                                No. 21-20404

                                    IV.
         For the foregoing reasons, the judgment of the district court is
   AFFIRMED.

                                     7