Alp Baysal v. Midvale Indemnity Company

• Court: Court of Appeals for the Seventh Circuit
• Decided: August 22, 2023
• Docket: 22-1892
• Status: Published

Opinion

In the

United States Court of Appeals For the Seventh Circuit ____________________

No. 22-1892 ALP BAYSAL, THOMAS MAXIM, and SANDRA ITALIANO, Plaintiffs-Appellants,

v.

MIDVALE INDEMNITY COMPANY and AMERICAN FAMILY MUTUAL INSURANCE COMPANY, S.I., Defendants-Appellees. ____________________

Appeal from the United States District Court for the Western District of Wisconsin. No. 21-cv-394-wmc — William M. Conley, Judge. ____________________

ARGUED JANUARY 12, 2023 — DECIDED AUGUST 22, 2023 ____________________

Before SYKES, Chief Judge, and EASTERBROOK and RIPPLE, Circuit Judges. EASTERBROOK, Circuit Judge. Midvale Indemnity and American Family Mutual (collectively Midvale) created an “instant quote” feature on their websites. Anyone who sup- plied basic identifying information could receive a quote for auto insurance. To simplify this process, each site would auto- 2 No. 22-1892

fill some information, including the number of the applicant’s driver’s license. Problem: anyone could enter a stranger’s name and home address, which would lead the form to dis- close the number of the stranger’s driver’s license. Midvale discontinued the autofill feature after observing unusual ac- tivity suggesting misuse, and it notified people whose infor- mation had been disclosed improperly. Three people who re- ceived Midvale’s notice then filed this suit under the Driver’s Privacy Protection Act, 18 U.S.C. §§ 2721–25 (DPPA or the Act), and state negligence law. Plaintiffs style themselves as class representatives, but a class was not certified, so we treat this as an individual suit. Whether the Act applies at all is questionable. Its principal rule is directed to state officials rather than private actors. 18 U.S.C. §2721(a). If an insurer obtains drivers’ information from a state under §2721(b)(6), then dissemination of that in- formation is limited by §2721(c). This record does not reveal how Midvale came by the information. The district court did not address the merits, because it concluded that the three plaintiffs have not been injured and therefore lack standing to sue. 2022 U.S. Dist. LEXIS 71414 (W.D. Wis. Apr. 19, 2022). The judge recognized that people injured by leaked or hacked data can have standing. See Dieffenbach v. Barnes & Noble, Inc., 887 F.3d 826 (7th Cir. 2018); Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963 (7th Cir. 2016); Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015). But all of these deci- sions hold that litigants must show concrete injury traceable to the disclosure. The district judge concluded that plaintiffs had not done so. For example, Remijas holds that the need to pay for a credit-monitoring service is a form of injury because the cost No. 22-1892 3

is money out of pocket. Similarly, loss of access to a credit card for even a few days is an injury. One of our three plaintiffs asserts that she paid for a credit-monitoring service, and an- other contends that a fraudulent brokerage account was opened in his name, but the district judge observed that nei- ther the complaint nor any of the other papers shows how these events can be traced to the disclosure of drivers’-license numbers. Social Security numbers can be used to open bro- kerage accounts, but drivers’-license numbers cannot. Like- wise with credit cards—and if a driver’s-license number can- not be used to obtain credit in someone else’s name, what’s the point of credit monitoring? That step entails expense, but the expense does not stem from the asserted wrong. Plaintiffs try to bridge this gap by contending that the dis- closure caused worry and anxiety, which led to other steps such as credit monitoring. Yet we have held that worry and anxiety are not the kind of concrete injury essential to stand- ing. E.g., Wadsworth v. Kross, Lieberman & Stone, Inc., 12 F.4th 665, 668–69 (7th Cir. 2021); Gunn v. Thrasher, Buschmann & Voelkel, P.C., 982 F.3d 1069, 1071–72 (7th Cir. 2020). If they were, almost everyone could litigate about almost anything, because just about everything anyone does causes some other people to fret. Imagine someone who asserts: “The disclosure of my license number made me sad, and to cheer myself up I ate a chocolate bar.” The price of candy would be money out of pocket, but eating chocolate is not a normal consequence of disclosures except through the bridge of worry. The cost of a credit-monitoring service is no different, when the disclosed information does not facilitate credit-re- lated frauds. As the Supreme Court put it in Clapper v. Am- nesty International USA, 568 U.S. 398, 416 (2013): 4 No. 22-1892

“Respondents’ contention that they have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing—because the harm respondents seek to avoid is not certainly impending. In other words, [people] cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” On appeal, plaintiffs stress one possibility that the district judge did not mention: they say that bogus unemployment- insurance claims were filed in New York in the names of two plaintiffs. A phony claim could cause injury—having a fraud attributed to one’s name could affect a credit rating or make it harder to obtain unemployment compensation following the real loss of a job. Plaintiffs do not contend, however, that either of these things happened to them. Nor do they contend that knowledge of a driver’s-license number could facilitate such a bogus claim, or indeed that New York State asked for a claimant’s driving information. The complaint is silent on these matters, and at oral argument counsel for the plaintiffs conceded that she had never looked at the application form New York uses for unemployment benefits and does not know what role, if any, a driver’s-license number plays. Yet a suit fails for lack of standing unless the complaint plausibly alleges concrete injury caused by the as- serted wrong. See, e.g., Department of Education v. Brown, 143 S. Ct. 2343 (2023). This complaint does not do so. If a license number could have contributed to an unemploy- ment-insurance scam under the complaint’s allegations, then we would need an evidentiary hearing to learn whether it did contribute, to plaintiffs’ detriment (and whether the number came from Midvale rather than some other source)—for No. 22-1892 5

standing must be demonstrated as well as alleged. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–61 (1992). But plaintiffs’ complaint did not allege any link between drivers’ licenses and unemployment-compensation applications in New York, so a hearing is unnecessary. We do not doubt that it is possible in principle for drivers’-license numbers to play a role in un- employment insurance, and it may have been prudent for Midvale to warn plaintiffs about this possibility. But a possi- ble route for a loss does not suffice for standing; the complaint must allege that what is possible actually happened or was “certainly impending”. That’s Clapper’s main holding. Plaintiffs’ submission boils down to an assertion that there might be a connection. Guesswork of that kind is not enough, however; the injury must be traceable to the asserted wrong and likely rather than speculative. Lujan, 504 U.S. at 560–61. Plaintiffs’ complaint does not even try to explain how, if at all, New York uses a driver’s-license number in acting on requests for unemployment compensation. (What other states may do is neither here nor there for our plaintiffs.) New York State may have suffered a concrete injury when it had to devote re- sources to finding and denying false claims (our plaintiffs do not allege that the bogus claims in their names were allowed), but New York’s loss does not supply a footing for plaintiffs’ standing. Only injury to plaintiffs counts. Perhaps anticipating that we would reach this conclusion, plaintiffs maintain that a violation of the Act is enough by it- self to establish standing, because Congress provided for an award of “liquidated damages” when actual damages cannot be shown. 18 U.S.C. §2724(b)(1). This line of argument, though, is incompatible with many decisions, including TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021); Spokeo, Inc. 6 No. 22-1892

v. Robins, 578 U.S. 330 (2016); and Summers v. Earth Island In- stitute, 555 U.S. 488, 496–97 (2009). See also United States v. Texas, 143 S. Ct. 1964 (2023) (no standing despite the Court’s assumption that the defendant had violated a statute). Spokeo and TransUnion reject the proposition that Con- gress can create standing just by requiring payment in the ab- sence of an injury. These decisions add, however, that courts must respect a legislative determination that concrete harms need remedies. The Act does not identify any particular com- pensable harm (§2724(b)(1) refers to “actual damages” but does not enumerate them). TransUnion and Spokeo say that, in this situation, courts should inquire whether what the plain- tiff asserts as injury has a historical or common-law analog. So we ask: Does any state make disclosure of a driver’s- license number tortious? Not that we can see (and not that plaintiffs have found). Between the invention of the motor car in the nineteenth century and the adoption of the Act in 1994, license numbers were freely available from many sources, in- cluding states’ departments of motor vehicles. Even after the Act directed states to limit the dissemination of information about drivers (“limit,” not “forbid”; the Act has a long list of exceptions in §2721(b)), many businesses—not just insurers such as Midvale—continued to require it. Auto-rental compa- nies won’t hand over a car without this information; banks may seek copies of drivers’ licenses to open accounts; hotels require them to check in; many hospitals and medical prac- tices demand them; and the normal way to get onto an air- plane is to present a driver’s license and step through a metal detector. Drivers’ licenses often are used as ID for voting, and a voter’s registration may be linked to the license through the No. 22-1892 7

motor-voter process. (Section 5 of the National Voter Regis- tration Act, 52 U.S.C. §20504.) Many people thus know the numbers on strangers’ li- censes. A license number is not viewed as embarrassing (as a low grade point average or a poor credit score would be) or private (as medical details are) but as neutral: most adults have these numbers, which are neither good nor bad. Social Security numbers are unique personal identifiers that can be used for identity theft, but license numbers change over time as people move to different states or licenses are renewed. When TransUnion spoke of “reputational harms, disclosure of private information, and intrusion upon seclusion” (141 S. Ct. at 2204) as examples of situations in which the common law often provided redress, the Court had in mind the sort of po- tentially embarrassing or intimate details we have mentioned. License numbers are not in that set. Since TransUnion was decided, we have classified many potential disclosures on one side of the Court’s divide or an- other. For example, Ewing v. MED-1 Solutions, LLC, 24 F.4th 1146 (7th Cir. 2022), holds that a credit report’s failure to dis- close the disputed status of a debt amounts to the release of false information, analogous to the tort of defamation. Cothron v. White Castle System, Inc., 20 F.4th 1156 (7th Cir. 2021), treats unlawful collection and disclosure of biometric information as equivalent to the tort of trespass—while explaining that some other violations of the Illinois Biometric Privacy Act are not actionable in federal court because the injury is neither concrete nor similar to a tort. Persinger v. Southwest Credit Sys- tems, L.P., 20 F.4th 1184 (7th Cir. 2021), holds that obtaining a propensity-to-pay score (in a credit report) without a permis- sible purpose is akin to the crime of wrongfully opening 8 No. 22-1892

someone else’s mail to obtain derogatory information and can be classed with the tort of wrongful intrusion on seclusion. But other credit-related events lack common-law analogs and do not support standing. See, e.g., Pierre v. Midland Credit Management, Inc., 29 F.4th 934 (7th Cir. 2022) (sending a de- ceptive debt-collection letter); Wadsworth, 12 F.4th 665 (failing to provide a debtor with required notice). See also Dinerstein v. Google, LLC, 73 F.4th 502 (7th Cir. 2023) (disclosure of anon- ymous medical records is not analogous to any tort); Choice v. Kohn Law Firm, S.C., No. 21-2288 (7th Cir. Aug. 11, 2023) (same with contradictory statements about attorneys’ fees). Plaintiffs have pointed to only one decision after TransUn- ion in which a court found standing for persons complaining about a violation of the Driver’s Privacy Protection Act: Garey v. James S. Farrin, P.C., 35 F.4th 917 (4th Cir. 2022). That deci- sion illustrates the need to be precise when thinking about in- vasion of privacy. Plaintiffs in Garey alleged that the defend- ants disclosed, not license numbers, but home addresses, which attorneys then used to send unsolicited ads. As in junk- fax and robocall cases, the analogous tort is intrusion on se- clusion. Our plaintiffs, by contrast, do not allege that any of the information that Midvale leaked has had a similar result. We have explained why a driver’s-license number is not potentially embarrassing or an intrusion on seclusion. It is a neutral fact derived from a public records system, a fact legit- imately known to many private actors and freely revealed to banks, insurers, hotels, and others. Plaintiffs have not plausi- bly alleged that Midvale’s disclosure of their numbers caused them any injury, and the disclosure of a number in common use by both public and private actors does not correspond to any tort. It follows that plaintiffs lack standing to sue, and No. 22-1892 9

plaintiffs who lack standing cannot receive either damages or an injunction. AFFIRMED. 10 No. 22-1892

RIPPLE, Circuit Judge, dissenting. The panel affirms the dis- trict court’s dismissal of the plaintiffs’ claims for lack of stand- ing. Because the plaintiffs plausibly alleged injuries in fact that are fairly traceable to the insurance companies, I respect- fully dissent. The majority opinion commits at least three errors. The opinion first fails to grapple with the substance of the plain- tiffs’ complaint and brushes aside the most natural inferences to be drawn from their allegations. Then, it continues down our court’s ill-advised march to restructure standing doctrine, and in particular the concrete-injury analysis for statutory claims, in ways that move far beyond the Supreme Court’s guidance. Finally, the opinion fails to address the plaintiffs’ standing to seek injunctive relief. I begin with the question of concreteness and statutory rights under recent Supreme Court precedent. I then turn to the sufficiency of the pleadings and, finally, to the request for injunctive relief. I A The law of standing is rooted in Article III’s case-or-con- troversy requirement and in the Constitution’s scheme of sep- arated powers. Raines v. Byrd, 521 U.S. 811, 818–20 (1997); Lujan v. Defs. of Wildlife, 504 U.S. 555, 559–60 (1992). By limit- ing federal courts to adjudicating legal disputes between par- ties with genuine stakes in the matter, standing doctrine aims to prevent the judiciary from straying into open-ended policy concerns that the Constitution reserves to the executive and legislative branches of the Government. Lujan, 504 U.S. at 576–78; Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). No. 22-1892 11

To enforce the case-or-controversy requirement, the Su- preme Court has instructed federal courts to apply the famil- iar three-part test of injury in fact, causation, and redressabil- ity. See Spokeo, 578 U.S. at 338. The present case centers on the injury-in-fact requirement and in particular on the require- ment that an injury be concrete. In Spokeo, the Court explained that a concrete injury “must be ‘de facto’; that is, it must actu- ally exist.” Id. at 340. In other words, an injury must be “real” rather than “abstract.” Id. “‘Concrete’ is not, however, neces- sarily synonymous with ‘tangible.’” Id. “Various intangible harms can also be concrete. Chief among them are injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” TransUn- ion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021). A difficult and recurring theme in standing jurisprudence is the significance of congressional action. The Supreme Court has gone to some lengths to explain what bearing Congress’s creation of a statutory right and cause of action has on the standing analysis. Its basic teaching is that Congress may “el- evat[e] to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law,” Lujan, 504 U.S. at 578, but it may not “‘enact an injury into exist- ence,’” TransUnion, 141 S. Ct. at 2205 (quoting Hagy v. Demers & Adams, 882 F.3d 616, 622 (6th Cir. 2018)). In sum, the Su- preme Court has told us that the violation of a statutory right is not always sufficient to establish standing. Spokeo, 578 U.S. at 341. Rather, when a federal court assesses a plaintiff’s standing to sue to vindicate a statutory right, it must assure itself that a concrete injury beyond a bare statutory violation exists. TransUnion, 141 S. Ct. at 2205. 12 No. 22-1892

When the violation of a plaintiff’s statutory rights entails a tangible injury to the plaintiff, the injury is plainly adequate to confer standing. But when the injury allegedly attending a statutory violation is intangible, the Supreme Court has told us, our assessment of concreteness must look to “both history and the judgment of Congress.” Spokeo, 578 U.S. at 340. Under the historical prong, we ask whether the claimed injury has “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” TransUn- ion, 141 S. Ct. at 2204. The identification of a historical or com- mon-law analog will be useful to demonstrate the concrete- ness of the alleged injury, but, as the Court has made clear, we are not looking for “an exact duplicate.” Id. at 2209. We are looking, simply, for injuries that are similar in kind, but not necessarily in degree, to the plaintiff’s alleged injury. Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020); Ewing v. MED-1 Solutions, LLC, 24 F.4th 1146, 1151 (7th Cir. 2022). Our assessment of the concreteness of an alleged injury must also consider the judgment of Congress, which, after all, enjoys the constitutional authority to define the jurisdiction of the federal courts and “to create statutory rights and obliga- tions.” Ewing, 24 F.4th at 1151. As our polity changes and be- comes more complex, “Congress is well-positioned to identify intangible harms that meet minimum Article III require- ments,” Spokeo, 578 U.S. at 341, and “we must be sensitive to the articulation of new rights of action that do not have clear analogs in our common-law tradition,” Lujan, 504 U.S. at 580 (Kennedy, J., concurring in part and concurring in the judg- ment). The legislative function, as conceived by our Constitu- tion, vests in Congress the responsibility and the authority “‘to define injuries and articulate chains of causation that will give rise to a case or controversy where none existed before.’” No. 22-1892 13

Spokeo, 578 U.S. at 341 (quoting Lujan, 504 U.S. at 580 (Ken- nedy, J., concurring in part and concurring in the judgment)). B History and congressional judgment both make clear that the plaintiffs’ alleged statutory injuries are adequately con- crete to establish Article III standing. The plaintiffs allege a violation of their rights under the Driver’s Privacy Protection Act (“DPPA”), 18 U.S.C. §§ 2721–25, which “regulates the dis- closure of personal information contained in the records of state motor vehicle departments.” Reno v. Condon, 528 U.S. 141, 143 (2000). Specifically, they claim that, in allowing their driver’s license numbers to be accessed improperly by strangers, the insurance companies violated their right not to have their “personal information[] from a motor vehicle rec- ord” “disclose[d]” for unauthorized purposes. 18 U.S.C. § 2724(a); see also id. § 2722(a) (making it “unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted” by 1 the statute).

1 The majority opinion suggests that the DPPA may not be applicable here at all because “[i]ts principal rule is directed to state officials rather than private actors” and insurance companies are subject to it only to the extent that they obtained the driver’s license numbers from state agencies. Ma- jority Op. 2. At this stage, I see no grounds for this speculation on the mer- its of the plaintiffs’ claims. The majority states that “[t]his record does not reveal how [the companies] came by the information.” Id. Of course, at the pleading stage, we are looking at a complaint, not an evidentiary record. And, indeed, the complaint expressly alleged that the insurance compa- nies “obtain motor vehicle records directly from state agencies or through resellers who sell such records.” R.27 ¶ 103. To the extent the companies’ conduct comes within the scope of the DPPA, they can be held liable under § 2724(a)’s private right of action, which applies to “[a] person who 14 No. 22-1892

1 Consider first Congress’s action. In enacting the DPPA, Congress acted on its legislative judgment that certain disclo- sures, sales, and uses of personal information in motor vehicle records were causing serious harms to the American public. Congress saw a need “to protect the personal privacy and safety of all American licensed drivers.” 140 Cong. Rec. 7929 (1994) (statement of Rep. Porter Goss). The statute accord- ingly has “a chief aim of privacy protection” and is “predom- inantly … a public safety measure.” Senne v. Vill. of Palatine, 695 F.3d 597, 606–07 (7th Cir. 2012) (en banc). The legislative history reveals that “safety and security concerns associated with excessive disclosures of personal information held by the State in motor vehicle records were the primary issue to be remedied by the legislation.” Id. at 607. As the sponsor of the bill, Representative Moran, emphasized, with “[a]dvances in technology,” personal information can be accessed “with the click of a button,” making it all the “more important that safe- guards are in place to protect personal information.” Protect- ing Driver Privacy: Hearing on H.R. 3365 Before the Subcomm. on Civ. & Const. Rts. of the H. Comm. on the Judiciary, 1994 WL 2 212698 (Feb. 4, 1994) (statement of Rep. James P. Moran). Made freely available to an individual with malicious intent,

knowingly” engages in conduct that violates the statute. See also § 2725(2) (“‘person’ means an individual, organization or entity”). 2 Representative Moran further observed that disclosure of personal in- formation even to relatively harmless recipients like marketers “pre- sent[s], to some people, an invasion of privacy.” Hearing on H.R. 3365, 1994 WL 212698. He accordingly urged Congress to adopt the legislation to “re- affirm that privacy is … a basic human right to which every person is en- titled.” Id. No. 22-1892 15

an address, phone number, photograph, or driver’s license number, see § 2725(3), can pose problems for the subject of the information—problems ranging from simple annoyance and irritation to serious harms such as stalking, threats, fraud, or physical violence. Cf. Senne, 695 F.3d at 609 (“The possibilities for identity theft are obvious.”). Recognizing that “open access to” personal information can be a resource to bad actors, with “grave consequences” to the subjects of the information, Congress determined that it was appropriate to impose restrictions on the disclosure and sale of information contained in motor vehicle records. Id. at 607. Its decision to make persons who flout the substantive restrictions of the DPPA subject to civil actions by affected in- dividuals was within its sound discretion to regulate inter- state commerce. See Condon, 528 U.S. at 148 (“[The] sale or re- lease [of drivers’ information] into the interstate stream of business is sufficient to support congressional regulation.”). In providing a cause of action for such harms, Congress acted within its powers to “‘define [an] injur[y] and articulate [a] chain[] of causation that will give rise to a case or controversy where none existed before.’” Spokeo, 578 U.S. at 341. Congress’s judgment on this matter, in other words, is highly “‘instructive’” for our consideration of the concrete- ness of the alleged injury. TransUnion, 141 S. Ct. at 2204 (quot- ing Spokeo, 578 U.S. at 341). We “must afford due respect to Congress’s decision to impose a statutory prohibition or obli- gation on a defendant, and to grant a plaintiff a cause of action to sue over the defendant’s violation of that statutory prohi- bition or obligation.” Id. The majority opinion, however, has little to say about the place of legislative judgment in the standing analysis. Rather, 16 No. 22-1892

the majority opinion seems to rest on its own impressionistic surmise about the public character of driver’s license num- bers, the lack of any expectation of privacy in this infor- mation, and the general harmlessness of disclosure of this in- formation. See Majority Op. 5–7. Common everyday experi- ence casts doubt on these personal impressions. But, accurate or not, such conclusions are the prerogative and responsibil- ity of Congress, not a panel of a court of appeals. By failing to recognize and respect Congress’s legislative authority, we un- dermine the very purpose of standing law—preserving the separation of powers—and “effect[] a direct and complete frustration of Congress’s attempt to regulate commerce in the manner that it has chosen.” Markakos v. Medicredit, Inc., 997 F.3d 778, 783 (7th Cir. 2021) (Ripple, J., concurring). It is enough that this injury is real and that, even if it may have been “previously inadequate in law,” Congress has chosen to “elevat[e]” it to a “legally cognizable” injury. Lujan, 504 U.S. at 578; see also Ewing, 24 F.4th at 1151 (“Congress may elevate de facto injuries that once were thought to be insufficiently in- jurious to form the basis of a federal lawsuit … .”); Carey v. James S. Farrin, P.C., 35 F.4th 917, 921 (4th Cir. 2022) (a plaintiff who identifies a historical or common-law analog for his in- jury “has standing even if the precise injury would not, absent the statute, be sufficient for Article III standing purposes”). 2 Congress’s judgment on this matter does not stand, more- over, unsupported by history. To the contrary, in enacting the DPPA cause of action, Congress has authorized us to provide a remedy for violations of a statutory right that cause intangi- ble injuries “with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American No. 22-1892 17

courts.” TransUnion, 141 S. Ct. at 2204. TransUnion’s examples of traditional intangible injuries are highly suggestive in this case: “reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. The common-law analog that immediately comes to mind in this case is the tort of invasion of privacy. Cf. U.S. Dep’t of Just. v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989) (“[B]oth the common law and the literal under- standings of privacy encompass the individual’s control of in- formation concerning his or her person.”). A claim for inva- sion of privacy can proceed under one of four basic theories, the most relevant of which is unreasonable publicity given to private life. Restatement (Second) of Torts §§ 652A, 652D (Am. L. Inst. 1977). Under this invasion-of-privacy theory, a defendant is liable for “g[iving] publicity to a matter concern- ing the private life of another … if the matter publicized is of a kind that (a) would be highly offensive to a reasonable per- son, and (b) is not of legitimate concern to the public.” Id. § 652D. The injury recognized by this common-law tort is analogous to the injury Congress elevated to legally cogniza- ble status in the DPPA: the unwanted and unauthorized dis- closure of information that tends to be held privately. It may well be that, as a matter of tort law, disclosure of a driver’s license number would not likely suffice to make out an invasion-of-privacy claim. But that observation is of no moment: “[A]n exact duplicate [injury] in American history and tradition” is not required. TransUnion, 141 S. Ct. at 2204; see also Persinger v. Southwest Credit Sys., L.P., 20 F.4th 1184, 1192 (7th Cir. 2021) (“Whether Persinger would prevail in a lawsuit for common law invasion of privacy is irrelevant. It is enough to say that the harm alleged in her complaint resembles 18 No. 22-1892

the harm associated with intrusion upon seclusion.” (empha- sis added) (footnote omitted)). Indeed, the Supreme Court hardly could have been clearer on this point when it recog- nized as sufficiently concrete an injury that plainly lacked an essential element of the analog tort. See TransUnion, 141 S. Ct. at 2209 (“[T]he harm from a misleading statement of this kind bears a sufficiently close relationship to the harm from a false and defamatory statement.” (emphases added)). What we must look for is a “‘close relationship’ in kind, not degree,” to a common-law analog. Gadelhak, 950 F.3d at 462 (quoting Spokeo, 578 U.S. at 341). The unwanted and improper disclosure of personal infor- mation, such as a driver’s license number, represents an in- jury that is similar in kind to the tort of invasion of privacy. As the Supreme Court has recognized, “private” is often a characterization of degree: “In an organized society, there are few facts that are not at one time or another divulged to an- other. Thus the extent of the protection accorded a privacy right at common law rested in part on the degree of dissemi- nation of the allegedly private fact … .” Reporters Comm. for Freedom of the Press, 489 U.S. at 763 (footnote omitted). In providing a cause of action for statutory violations that entail disclosure of information that sits along the general spectrum of “private,” Congress has elevated to legally cognizable sta- tus the kind of harm that “traditionally … provid[ed] a basis for lawsuits in American courts,” a harm “associated with the tort of” invasion of privacy. TransUnion, 141 S. Ct. at 2208. The majority opinion declines to pursue any analysis along these lines. Instead, the majority opinion revises the standard that the Supreme Court has said must guide our in- quiry: Despite the Court’s admonition not to seek “an exact No. 22-1892 19

duplicate” to the harm alleged by the plaintiffs, the majority opinion suggests that the standard, in fact, is just that. In the majority’s view, the analysis in this case comes down to one question: “Does any state make disclosure of a driver’s license number tortious?” Majority Op. 6. As the foregoing discus- sion makes clear, the operative standard under the Supreme Court’s case law is not whether state tort law covers the pre- cise harm underlying the plaintiffs’ statutory claim. Indeed, if that were the standard, one would be left to wonder what was left of Congress’s legislative power to define the rights and remedies to be had in the courts of the United States; Congress would seem to be left to operate within the strictures of the pre-statutory common law, unable to move beyond those boundaries to recognize the new and evolving harms experi- enced by the American people. Cf. Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 653–54 (4th Cir. 2019) (explaining that Spokeo did not endorse a project of “judicial grafting” in which courts must “import the elements of common law torts, piece by piece, into any scheme Congress may devise”). The proper inquiry is, instead, whether “the harm alleged in [the] com- plaint resembles the harm associated with” a traditionally rec- ognized basis for suit. Persinger, 20 F.4th at 1192 (emphasis added). Moreover, the majority’s belief that disclosure of driver’s license numbers is ultimately a trivial matter is misguided. Logically, it does not follow from the fact that driver’s license numbers must be disclosed to some businesses, hotels, hospi- tals, or airport security agencies that individuals are indiffer- ent to the indiscriminate disclosure of this information or to its disclosure to actors who deliberately seek it with malicious intent. A driver’s license number is, in fact, at least moder- ately sensitive, cf. id. (describing the injury of an “unlawful 20 No. 22-1892

inspection of one’s mail, wallet, or bank account”), and as the sources quoted in the plaintiffs’ complaint suggest, a driver’s license number in the wrong hands can cause serious prob- 3 lems for an affected person. It seems that the majority’s real problem with the plaintiffs’ position is that driver’s license numbers are not sensitive or private enough to be analogous to any historical or common-law injury traditionally recog- nized in American courts. Again, however, that is not our judgment to make, and it oversteps the instructions of the Su- preme Court: “[W]hen Spokeo instructs us to analogize to harms recognized by the common law, we are meant to look

3 The complaint quotes a Forbes article stating: “Hackers harvest license numbers because they’re a very valuable piece of information. A driver’s license can be a critical part of a fraudulent, synthetic identity—which go for about $1200 on the Dark Web. On its own, a forged license can sell for around $200.” R.27 ¶ 36 (quoting Lee Matthews, Hackers Stole Customers’ License Numbers from Geico in Months-Long Breach, Forbes (Apr. 20, 2021)). The complaint also quotes at length from a post on Experian’s webpage: If someone gets your driver’s license number, it is also concerning because it’s connected to your vehicle regis- tration and insurance policies, as well as records on file with the Department of Motor Vehicles, place of employ- ment (that keep copy of your driver’s license on file), doc- tor’s office, government agencies, and other entities. Hav- ing access to that one number can provide an identity thief with several pieces of information they want to know about you. Next to your Social Security number, your driver’s license is one of the most important pieces to keep safe from thieves. Id. ¶ 37 (emphasis added). No. 22-1892 21

for a ‘close relationship’ in kind, not degree.” Gadelhak, 950 F.3d at 462 (quoting Spokeo, 578 U.S. at 341). A person’s privacy interest in a driver’s license number may be different in degree, but it is not different in kind, from the privacy interests historically protected in American law; the disclosure of this information in violation of statute in- flicts a harm closely related to the harms traditionally recog- nized at common law. By imposing a standard of concrete- ness that is not only more restrictive than, but contrary to, the guidance given by the Supreme Court, our circuit today ad- vances its ongoing “invasion into the congressional domain while continuing to provide no real precedential justification for doing so.” Markakos, 997 F.3d at 784 (Ripple, J., concur- ring). In light of controlling Supreme Court precedent, I would hold that the alleged violations of the DPPA establish sufficiently concrete injuries to support the plaintiffs’ stand- ing to sue. II The panel’s decision errs in a second, independent way in its treatment of the tangible injuries alleged to have resulted from the disclosure of the plaintiffs’ driver’s license numbers. The plaintiffs plausibly alleged injuries in the form of identity theft, lost time and effort in working to prevent fraudulent unemployment-benefits applications, and lost time and effort in responding to actual fraudulent applications made in their names, but the majority opinion holds that the complaint did not plausibly trace these harms to the actions of the insurance companies. I respectfully disagree. At the pleading stage, “the plaintiff must ‘clearly … allege facts demonstrating’ each element” of standing. Spokeo, 578 22 No. 22-1892

U.S. at 338 (quoting Warth v Seldin, 422 U.S. 490, 518 (1975)). In ruling on a motion to dismiss, “‘the district court must ac- cept as true all material allegations of the complaint, drawing all reasonable inferences therefrom in the plaintiff’s favor, un- less standing is challenged as a factual matter.’” Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 691 (7th Cir. 2015). The plaintiffs plausibly alleged concrete injuries traceable to the insurance companies’ public disclosure of their driver’s license numbers. In assessing this aspect of the case, there are several background allegations that are important to bear in mind, before we turn to the allegations of specific injuries. The complaint alleged that, after the insurance companies learned that their websites were being used improperly to obtain driver’s license numbers, the companies sent notification let- ters to the thousands of affected individuals. These letters stated, in relevant part: To the extent you were affected by this incident, unauthorized parties may have obtained your driver’s license number. We have reason to believe this data may be used to fraudulently apply for unemployment bene- fits in your name. Please carefully review any written communications you receive from your state’s unemployment agency, especially if you have not applied for unemployment benefits. If you suspect that your data has been used to fraudulently apply for unemployment benefits, you should contact the relevant state unemploy- ment agency immediately. … No. 22-1892 23

To help protect you, we are offering you [credit monitoring] services free of charge. These ser- vices … will provide you with alerts for twelve months from the date of enrollment whenever changes occur to your Experian credit file. … If you wish to monitor your own credit report for unauthorized activity, you may obtain a copy of your credit report, free of charge, once every 12 months from each of the three nation- wide credit reporting agencies: Equifax, Ex- perian, and TransUnion. … Additional infor- mation on identity theft protection is also pro- 4 vided in the enclosed pages … . Elsewhere in the complaint, the plaintiffs alleged that the driver’s license numbers were “taken for the purpose of com- mitting fraud in the name of the person whose license infor- 5 mation is taken,” and they provided extensive descriptions of the risks that attend compromised personal information 6 such as driver’s license numbers. Describing the plaintiffs’ specific injuries, the complaint alleged, as to two plaintiffs, that “[f]ollowing the Unauthor- ized Data Disclosure,” these plaintiffs “received notice from the New York State Department of Labor that a claim for un- employment insurance benefits was filed” using their

4 R.27 ¶¶ 25, 26.

5 Id. ¶ 28.

6 Id. ¶¶ 29–39. 24 No. 22-1892

7 identities. Both plaintiffs “spent time researching … options to respond to the theft of [their] driver’s license[s], and the use of same to commit identity fraud,” and they “spent time con- tacting the New York State Department of Labor to deal with the fraudulent application[s] [for] unemployment insurance 8 benefits.” A third plaintiff, after receiving the insurance com- panies’ notification letter, “contacted the Florida Reemploy- ment Assistance Program to notify them that she was a victim of a data breach and to place a fraud alert to mitigate the un- authorized application [for] unemployment benefits in her 9 name.” The majority opinion first downplays the plaintiffs’ alle- gations as merely “contending that the disclosure caused worry and anxiety,” harms which our circuit has found to be insufficient to establish a concrete injury. Majority Op. 3; see Wadsworth v. Kross, Lieberman & Stone, Inc., 12 F.4th 665, 668– 10 69 (7th Cir. 2021). But the plaintiffs do not simply rely on

7 Id. ¶¶ 54, 61.

8 Id. ¶¶ 55, 64.

9 Id. ¶ 70.

10 As one of our colleagues has explained elsewhere, however, the Su- preme Court appears to have “left open the possibility that a plaintiff could show standing by showing that her knowledge of a serious risk caused its own emotional or psychological harm.” Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 946 n.6 (7th Cir. 2022) (Hamilton, J., dissenting). Specifically, in TransUnion, the Court mentioned the possibility that “a plaintiff’s knowledge that he or she is exposed to a risk of future physical, monetary, or reputational harm could cause its own current emotional or psychological harm,” but it “t[ook] no position on whether or how such an emotional or psychological harm could suffice for Article III purposes.” No. 22-1892 25

worry and anxiety. Two plaintiffs experienced actual identity theft in the form of fraudulent unemployment-benefits appli- cations, and they spent time and effort to address and reme- diate this fraud. We have recognized actual identity theft and the attendant mitigation efforts as a concrete injury. See Rem- ijas, 794 F.3d at 692 (“[T]here are identifiable costs associated with the process of sorting things out [after fraudulent activ- ity].”); Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 967 (7th Cir. 2016) (“Even if those fraudulent charges did not result in injury to his wallet (he stated that his bank stopped the charges before they went through), he spent time and ef- fort resolving them.”). Moreover, as the plaintiffs point out in their brief, it is reasonable to infer that they have suffered in- jury in the form of an impaired ability to access unemploy- ment benefits due to the presence of fraudulent claims made in their names in the State’s records. Additionally, the third plaintiff’s expense of time and effort to take preventive action with the Florida unemployment agency constitutes a concrete injury. TransUnion, 141 S. Ct. at 2211 (although the risk of fu- ture harm is not a concrete injury in a suit for damages, “the exposure to the risk of future harm” may “itself cause[] a sep- 11 arate concrete harm”).

141 S. Ct. at 2211 n.7 (emphasis added). Judge Hamilton detailed several doctrinal reasons for why, contrary to our circuit’s restrictive approach to this question, certain emotional and psychological harms should be ade- quate to support standing. See Pierre, 29 F.4th at 947–50 (Hamilton, J., dis- senting). 11 See also In re Equifax Inc. Customer Data Security Breach Litig., 999 F.3d 1247, 1262–63 (11th Cir. 2021) (describing “actual identity theft” and its resulting harms, including “time, money, and effort trying to mitigate … injuries,” as an injury in fact); Hutton v. Nat’l Bd. of Examiners in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018) (“The Plaintiffs have been concretely 26 No. 22-1892

The majority opinion nonetheless concludes that, even if there is some harm related to the fraudulent applications, the plaintiffs failed to allege in sufficiently explicit terms that these fraudulent applications could be traced to the insurance companies’ disclosure of their driver’s license numbers. This is an unacceptably parsimonious reading of the complaint, which, under well-established principles governing the as- sessment of complaints, we must “accept as true,” “drawing all reasonable inferences” in the plaintiffs’ favor. Remijas, 794 F.3d at 691 (internal quotation marks omitted). “It is certainly plausible for pleading purposes” that the plaintiffs’ injuries— identity theft and lost time and effort responding to fraudu- lent unemployment-benefits applications—“are ‘fairly trace- able’ to the data breach.” Id. at 696. It is crucial to remember that the insurance companies themselves warned the affected individuals that they suspected malicious actors intended to use their driver’s license numbers to apply for unemployment benefits and further advised the affected individuals to re- view communications from their state unemployment agen- cies and alert those agencies to suspected fraud. The com- plaint alleged that the driver’s license numbers were “deliber- ately targeted” for a specific purpose and that, within six months of the data breach, the anticipated harm materialized for at least two affected individuals. Id. at 693 (emphasis added). In the majority opinion’s view, the plaintiffs failed to al- lege specifically that New York’s unemployment agency re- quires an applicant to provide a driver’s license number. To

injured by the data breach because the fraudsters used—and attempted to use—the Plaintiffs’ personal information to open Chase Amazon Visa credit card accounts without their knowledge or approval.”). No. 22-1892 27

treat this omission as fatal to the traceability analysis is an ex- ceedingly narrow manner of reading the complaint. The noti- fication letters from the insurance companies—reproduced at length in the complaint—stated that the companies “believe this data may be used to fraudulently apply for unemploy- ment benefits” and advised affected individuals to “contact the relevant state unemployment agency immediately” if the 12 recipient had any suspicion of fraud. Later, the complaint repeated the point again, noting that “bad actors” often “us[e] these driver’s license numbers to fraudulently apply for un- 13 employment benefits.” The complaint even referred ex- pressly to “the use of [the driver’s license] to commit identity theft” in connection with the unemployment-benefits appli- 14 cation in one plaintiff’s name. These allegations give rise to the natural inference that it is standard practice for state un- employment agencies to require driver’s license numbers in these applications and that New York’s unemployment 15 agency likewise did so.

12 R.27 ¶¶ 25, 26.

13 Id. ¶ 38.

14 Id. ¶ 55.

15 The defendants could have challenged the factual accuracy of this point before the district court. “Where standing is challenged as a factual matter, the plaintiff bears the burden of supporting the allegations necessary for standing with ‘competent proof.’” Retired Chicago Police Ass’n v. City of Chi- cago, 76 F.3d 856, 862 (7th Cir. 1996). In that event, “the district court may find the facts.” Reid L. v. Ill. State Bd. of Educ., 358 F.3d 511, 515 (7th Cir. 2004). 28 No. 22-1892

Finally, for good measure, the complaint alleged that none of the three plaintiffs had “knowingly transmitted unen- crypted [personal information] over the internet or any other unsecured source,” strengthening the inference that the unau- thorized users of the driver’s license numbers obtained that 16 information from the insurance companies. It is certainly conceivable that “the plaintiffs may eventu- ally not be able to provide an adequate factual basis for the inference[s]” tracing their injuries to the insurance compa- nies’ disclosures, “but they had no such burden at the plead- ing stage.” Id. at 694. The “admissions and actions by” the in- surance companies, coupled with the actual materialization of the specific risk that the companies anticipated, “adequately raise the plaintiffs’ right to relief above the speculative level.” Id. at 696 (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Under the well-established rules governing pleading, the plaintiffs have alleged plausibly concrete injuries in the form of identity theft and lost time and effort to mitigate iden- tity theft and that these injuries are fairly traceable to the in- surance companies. III A word remains to be said about the plaintiffs’ standing to seek injunctive relief, which the majority opinion does not ad- dress. Presumably, the majority thinks the plaintiffs lack standing for this form of relief for two reasons: (a) the major- ity does not believe the unauthorized disclosure of the plain- tiffs’ driver’s license numbers constitutes an injury or poses a sufficient risk of future injury, and (b) the majority does not

16 Id. ¶¶ 57, 66, 72. No. 22-1892 29

think the plaintiffs have traced any actual or potential injury to the insurance companies. For substantially the same rea- sons that I have already given, I believe the majority is mis- taken on each point. In fact, the plaintiffs’ allegations in sup- port of standing for injunctive relief are likely even stronger than for purposes of seeking damages. As TransUnion ex- plained, “a person exposed to a risk of future harm may pur- sue forward-looking, injunctive relief to prevent the harm from occurring, at least so long as the risk of harm is suffi- ciently imminent and substantial.” 141 S. Ct. at 2210 (citing Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 n.5 (2013)). At the very least, the plaintiffs have plausibly alleged future in- juries of unemployment-benefits fraud (with its related harms) resulting from the insurance companies’ failure to protect their driver’s license numbers. For purposes of these future injuries, it was sufficient for the plaintiffs to allege that a driver’s license number may be used by a fraudulent actor to obtain unemployment benefits from state unemployment agencies, that several fraudulent actors have indeed sought this information and attempted to use it for that purpose, and that the insurance companies failed to secure the plaintiffs’ information and continue to fail to take adequate measures to secure it in the future. See, e.g., Remijas, 794 F.3d at 692–94. Ac- cordingly, I would hold that the plaintiffs have standing to pursue injunctive relief. Conclusion Because I believe the plaintiffs’ allegations are adequate to support standing for their requests for damages and injunc- tive relief, I would reverse the judgment of the district court and remand for further proceedings. I respectfully dissent.