Durham v. City of Charlotte

• Court: District Court, W.D. North Carolina
• Decided: September 24, 2024
• Docket: 3:21-cv-00638
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NORTH CAROLINA CHARLOTTE DIVISION 3:21-cv-00638-RJC-DSC

HEATHER NICOLE DURHAM, on ) behalf of herself and others similarly ) situated, ) ) Plaintiff, ) ) ORDER v. ) ) CITY OF CHARLOTTE, ) ) Defendant. )

THIS MATTER is before the Court on Defendant’s Motion for Summary Judgement, Plaintiff’s Motion to Certify the Class, and Plaintiff’s Motion for Summary Judgment. For the reasons set forth below, Defendant’s Motion for Summary Judgment, (Doc. No. 39), is DENIED; Plaintiff’s Motion to Certify Class (Doc. No. 36), is GRANTED; and Plaintiff’s Motion for Summary Judgment, (Doc. No. 32), is GRANTED. I. BACKGROUND Each year, numerous car accidents occur across North Carolina. When these accidents rise to the statutorily required level, a report called a DMV-349 must be completed by the investigating officer. These forms include the name, address, and driver’s license number of the person involved in the accident. This case arises from the alleged improper disclosure of DMV-349 reports from the Charlotte-Mecklenburg Police Department (CMPD) Records Division that contained the personal information of Plaintiff and others similarly situated. A. DMV-349 Accident Reports The North Carolina DMV assigns each North Carolina-licensed driver a license number which originates with DMV, and DMV enters each driver’s name, date of

birth, address, and license number into its database. (Doc. No. 1 at ¶¶ 14–15, 17; Doc. No. 19 at ¶¶ 14–15, 17). When an accident occurs, North Carolina law requires that a law enforcement officer create an accident report using a form DMV-349 for each reportable motor vehicle accident. N.C. Gen. Stat § 20-4.01(33b); N.C. Gen. Stat. § 20-166.1(e). (Doc. 1 at ¶ 27; Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 8–9, 18, 21). The standardized DMV- 349 report form is published by NCDMV and is used by all local municipal and county

law enforcement agencies in North Carolina as well as the N.C. State Highway Patrol to report motor vehicle crashes and the circumstances surrounding the crashes to NCDMV. (Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 9, 18). Defendant City of Charlotte “is a North Carolina municipal corporation, chartered by the General Assembly of North Carolina, organized and operating under the laws of North Carolina, located in Mecklenburg County, North Carolina.” (Doc. 1

at ¶ 2). The Charlotte-Mecklenburg Police Department (“CMPD”) is a component of the City. (Doc. No. 1 at ¶ 3). Accidents that occur within the Charlotte city limits are investigated by CMPD. See N.C. Gen. Stat. § 20-166.1(a). CMPD officers who complete the DMV-349 in connection with an accident investigation must comply with the then-current edition of the NCDMV Instruction Manual for the DMV-349. (Doc. 1 at ¶ 28; Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 10–12). When a reporting officer at CMPD has a DMV- 349 report approved by a supervisor, it is in turn submitted to NCDMV for review and certification by NCDMV. (Doc. No. 39-2, N. Crum Declaration, at ¶ 16).

CMPD officers investigate tens of thousands of accidents each year. (Doc. No. 19 at ¶ 45). When CMPD officers complete DMV-349 forms, they routinely access either the drivers’ licenses or the DMV database which contains the drivers’ personal information found on the drivers’ licenses; such officers obtain drivers’ personal information from these sources, including drivers’ names, addresses, and driver’s license numbers. (Doc. No. 1 at ¶ 35; Doc. No. 19 at ¶ 35). CMPD officers use a software program called ReportBeam to assist in

preparing DMV-349 reports. (Doc. No. 19 at ¶ 34; Doc. No. 32-1, CMPD Depo. I, at 11:9–12:7, 13:10–16; Doc. No. 33-1, CST Dep., at 10:24–11:5). When CMPD officers use ReportBeam to complete an accident report, they have the option to enter a driver’s license number into their computer to do a computer search for a driver’s personal information on file in North Carolina DMV’s database. (Doc. No. 32-3, CMPD Dep. III, at 22:14–25).

Nathan Crum explained that he and other BLET instructors—past and present—always train CMPD police recruits not to use the auto-populate F-11 function when filling out the demographic information in a DMV-349, but rather to fill in the individual’s information such as driver’s license number, name, address, etc. manually on the report. He also testified that using the auto-populate F-11 function could result in an inappropriate disclosure of restricted information from secure law enforcement information systems. (Doc. No. 39-6, N. Crum Dep., at 27:13– 28:4). But, if an officer uses the “autopopulate” feature, the officer can select the

driver’s information from the results returned from the DMV database and then press the F11 key. (Doc. No. 32-1, CMPD Dep. I, at 20:13-22:1; Doc. No. 32-3, CMPD Dep. III, at 22:14-25). The F11 key causes the officer’s computer to automatically fill-in the blanks on the DMV-349 form with the driver’s personal information, including her name and address. (Doc. No. 32-1, CMPD Dep. I, at 25:4–10, 118:20–119:8). This is known as the “autopopulate” feature. (Doc. No. 32-1, CMPD Dep. I, at 20:13–25. When a CMPD officer autopopulates the DMV-349, the driver’s name and address

come from the DMV database. (Doc. No. 32-1, CMPD Dep. I, at 21:20–22:5, 25:4–10; Doc. No. 32-4, Prince Aff., at ¶¶ 4–7). When a CMPD officer completes an accident report, ReportBeam software records and stores the data for each CMPD DMV-349 in a database on a server. (Doc. No. 33-1, CST Dep., at 93:23—94:25). When the CMPD officer has auto-populated a driver’s information on to the DMV-349, the ReportBeam software inserts a “dataclip” into the ReportBeam

database in association with that particular report. The presence of the “dataclip” associated with a particular report shows that the CMPD officer used the auto- populate feature to insert the driver’s personal information taken from the DMV database into the accident report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3; Doc. No. 33- 3, Supp. Selvaraj Decl. ¶¶ 2(d), 3). B. Plaintiff’s Accident In December 2017, Plaintiff was a driver in a motor vehicle accident in the city limits of Charlotte, North Carolina. (Doc. No. 32-8, Pl’s. Decl., at ¶ 4). At the time of

Plaintiff’s accident, Plaintiff was licensed by the State of North Carolina to drive motor vehicles. (Doc. No. 32-8, Pl’s. Decl., at ¶ 3). Her North Carolina driver’s license was issued by the North Carolina Division of Motor Vehicles (“NCDMV”). (Doc. No. 32-8, Pl’s. Decl., at ¶ 3). Further, Plaintiff was required to provide her name and address to NCDMV as a condition of obtaining a driver’s license. (Doc. No. 32-8, Pl’s. Decl., at ¶ 3). Plaintiff’s accident was a reportable crash as defined by N.C.G.S. § 20-

4.01(33b). (Doc. 1 at ¶ 64; Doc. No. 9 at ¶ 64; Doc. 1-2 at 1). Further, Plaintiff’s motor vehicle crash occurred within the City of Charlotte, so under N.C. Gen. Stat. § 20- 166.1(a), the CMPD was the law enforcement agency with jurisdiction over the scene of the Accident. (Doc. 1 at ¶ 65). A CMPD officer investigated Plaintiff’s accident. (Doc. No. 32-8, Pl’s. Decl., at ¶ 4). On December 4, 2017, the CMPD officer who investigated Plaintiff’s wreck

completed a DMV-349 containing Plaintiff’s full name, address, date of birth, driver license number, and telephone number. (Doc. No. 1 at ¶ 67; Doc. No. 19 at ¶ 67; Doc. No. 1-2). At CMPD, the police officer who investigates a crash submits the DMV-349 Report to a supervisor for review which is then submitted to the NCDMV. (Doc. No. 39-2, N. Crum Declaration, at ¶ 15–17). The DMV-349 accident report which the CMPD officer completed for Plaintiff’s accident contained Plaintiff’s name and address. (Doc. No. 1-2, Accident Report, at 1). At the time of the accident, Plaintiff’s name was Heather Nicole Mack. (Doc. No. 32-

8, Pl’s. Decl., at 1; Doc. No. 1-2 at 1). Plaintiff explained that she never told the officer her middle name which is “Nicole” as shown on the DMV-349 accident report (Doc. No. 32-8, Pl’s. Decl., at ¶ 5). Plaintiff does not recall the officer asking her for her address, and she does not recall telling the officer her address. (Doc. No. 32-8, Pl’s. Decl., at ¶ 5). Plaintiff has reviewed the accident report which shows her nine-digit zip code, and she knows that she did not provide that information to the officer orally because she did not know her nine-digit zip code. (Doc. No. 32-8, Pl’s. Decl., at ¶ 5).

She did not tell the officer her driver’s license number. (Doc. No. 32-8, Pl’s. Decl., at ¶ 5). C. Distribution of Reports From 2007 or earlier until late 2020, CMPD placed one or more copies of each recent DMV-349 accident report on the front desk of its records division so that anyone who came into the division could personally view the information contained

on each of the DMV-349. (Doc. No. 19 at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 12:1– 13:21). CMPD made its DMV-349s available to the public at all 13 division offices within the City of Charlotte. (Doc. No. 32-1, CMPD Dep. I, at 135:4–136:13). The DMV-349s that CMPD made available to the public included the names, addresses, and driver’s license numbers of the persons involved in traffic accidents. (Doc. No. 32- 6, CMPD Dep. II, at 31:19–24; Doc. No. 32-1, CMPD Dep. I, 168:9–17). CMPD knew, since at least 2011 until through at least 2017, that marketers, including law firms that CMPD employees referred to as “ambulance chasers,” acquired reports in bulk

directly from its records division. (Doc. No. 32-6, CMPD Dep. II, at 18:16—20:5). CMPD nevertheless did not redact any of the personal information on the DMV-349s it made available to the public. (Doc. No. 19 at ¶ 53; Doc. No. 32-1, CMPD Dep. I, at 147:9–23; Doc. No. 32-6, CMPD Dep. II, at 31:19–24). Each accident report involving a licensed driver contained a driver’s license number which originates with and is assigned by DMV. (Doc. No. 32-1, CMPD Dep. I, at 168:14-22). Via its records division, CMPD provided copies of its accident reports to Digital

Solutions, who sent runners to CMPD in order to obtain the reports so that it could sell them to marketers. (Doc. No. 32-9, Creech Decl. I, at ¶¶ 2, 4–5). Digital Solutions, in turn provided the accident reports to personal injury attorneys, including James S. Farrin, P.C. (“Farrin”). (Doc. No. 32-9, Creech Decl. I, at ¶ 7; Doc. No. 32-10, Sanchez Decl., at ¶ 5). Farrin then harvested personal information from the accident reports and

placed that information on a mailing-list spreadsheet. (Doc. No. 32-10, Sanchez Decl., at ¶ 7). According to a declaration made by Plaintiff’s attorney regarding his review of the Farrin spreadsheets, Plaintiff’s accident report is among those which CMPD provided to Digital Solutions as Plaintiff’s name and address are contained on the Farrin Spreadsheet. (Doc. No. 32-13, Stradley Decl., at ¶¶ 3–4). Farrin, as a general practice, then mailed letters to each person listed on the Farrin Spreadsheet. (Doc. No. 32-10, Sanchez Decl., at ¶ 8). Plaintiff has not provided written consent to allow anyone to disclose or use

her personal information, from a motor vehicle record, for marketing purposes or for any other purpose. (Doc. No. 32-8, Pl’s. Decl., at ¶ 8). D. Plaintiff Receives Marketing Letters In 2017, shortly after Plaintiff’s accident, Plaintiff began receiving in the mail marketing letters from attorneys who were soliciting her to hire them to assert a legal claim arising out of the accident. (Doc. No. 32-8, Pl’s. Decl., at ¶ 7). Plaintiff does not recall which firms they were from and she lacks a copy of the letters. (Doc. No. 32-8,

Pl.’s Decl., at ¶ 7). Plaintiff explains that she was harmed in the following ways by Defendant’s disclosure of her accident report showing her personal information: 1. Defendant invaded and violated her privacy rights to protected personal information; As a result of Defendant’s improperly disclosing her name, address, and other personal information from the accident report, marketers were able to obtain that information and use it to create, process, and mail advertising letters;

2. Defendant exposed her DPPA-protected personal information to marketers and their office personnel who processed the marketing letters and to people who handled the mail for the postal service and to any others who saw the mail;

3. When the marketing letters arrived at Plaintiff’s house, she had to expend time and attention to retrieve them from her mailbox and open and/or dispose of the letters;

4. When Plaintiff received the advertising letters shortly after the accident, she was shocked and upset that advertisers could so quickly learn that she had been in a wreck and so quickly get so much relevant personal information about her, and she questioned how that could possibly be legal;

5. When she got the advertising letters shortly after the accident, she was irritated that marketing attorneys were immediately soliciting business to pursue legal claims so soon after the accident.

(Doc. No. 32-8, Pl’s. Decl., at ¶ 9; Doc. No. 32-11, Pl.’s Depo., at 19:5–22:11). E. Connecting Data to DMV Records Plaintiff’s expert, Sankar Selvaraj, has examined stored ReportBeam computer data including Plaintiff’s accident report. (Doc. No. 33-2, Selveraj Decl., at ¶ 2; Doc. No. 33-3, Supp. Selvaraj Decl., at ¶ 2(b)). This data for Plaintiff’s Accident Report contains a “dataclip” containing Plaintiff’s full name, address, and date of birth. (Doc. No. 33-2, Selveraj Decl., at ¶ 3; (Doc. No. 33-3, Supp. Selvaraj Decl., at ¶ 3). Plaintiff’s information contained in the “dataclip” matches her data shown on the Accident Report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj Decl., ¶ 3(4)). Hence, the “dataclip” shows that the CMPD auto-populated Plaintiff’s name, address, and date of birth onto the Accident Report from the DMV database and that no changes were made to Plaintiff’s auto-populated name, address, or date of birth. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj Decl., Ex. 14, ¶ 3(4)). F. Lack of CMPD Records CMPD kept neither a record of which DMV-349 reports actually were placed out for viewing in the CMPD Records Division nor which reports were viewed or by whom. There is no record from CMPD that a representative of Digital Solutions viewed or collected DMV-349 reports at the CMPD Records Division. (Doc. No. 39-5, Decl. of Kiersten Frost, at ¶¶ 6–7). G. Procedural History

On November 30, 2021, Plaintiff Heather Nicole Durham filed this putative class action. (Doc. No. 1). Defendant City of Charlotte filed a Motion to Dismiss on several grounds, including lack of standing. (Doc. No. 7). On October 13, 2022, this Court adopted Magistrate Judge Cayer’s Memorandum & Recommendation, (Doc. No. 14), granting the motion as to Plaintiff’s claim for declaratory and injunctive relief but finding that Plaintiff had established standing as to her claims for liquidated damages. (Doc. No. 17).

In January 2023, this case was stayed pending the outcome of the appeal in Hensley v. City of Charlotte before the Fourth Circuit. (Doc. No. 22). Plaintiff filed her Motion for Summary Judgment, (Doc. No. 32), and Motion to Certify Class, (Doc. No. 36), on December 1, 2023. Defendant filed its Motion for Summary Judgment on the same day. (Doc. No. 39). II. STANDARD OF REVIEW

Summary judgment shall be granted “if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). A factual dispute is genuine “if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is material only if it might affect the outcome of the suit under governing law. Id. The movant has the “initial responsibility of informing the district court of the basis for its motion, and identifying those portions of the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, which it believes

demonstrate the absence of a genuine issue of material fact.” Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986) (internal citations omitted). “The burden on the moving party may be discharged by ‘showing’ . . . an absence of evidence to support the nonmoving party’s case.” Id. at 325. Once this initial burden is met, the burden shifts to the nonmoving party. The nonmoving party “must set forth specific facts showing that there is a genuine issue for trial.” Id. at 322 n.3. The nonmoving party may not rely upon mere allegations

or denials of allegations in his pleadings to defeat a motion for summary judgment. Id. at 324. Instead, “Rule 56(e) . . . requires the nonmoving party to go beyond the pleadings and by her own affidavits, or by the depositions, answers to interrogatories, and admissions on file, designate specific facts showing that there is a genuine issue for trial.” Id. The nonmoving party must present sufficient evidence from which “a reasonable jury could return a verdict for the nonmoving party.” Anderson, 477 U.S.

at 248; accord Sylvia Dev. Corp. v. Calvert Cty., Md., 48 F.3d 810, 818 (4th Cir. 1995). The Fourth Circuit has concluded that “evidence, which is inadmissible at trial, cannot be considered on a motion for summary judgment. Maryland Highways Contractors Ass'n, Inc. v. State of Md., 933 F.2d 1246, 1251–52 (4th Cir. 1991) (finding that inadmissible hearsay evidence could not be considered on a motion for summary judgment) (citing Rohrbough v. Wyeth Laboratories, Inc., 916 F.2d 970, 973–74 n.8 (4th Cir.1990); Garside v. Osco Drug, Inc., 895 F.2d 46, 50 (1st Cir.1990); Randle v. LaSalle Telecommunications, Inc., 876 F.2d 563, 570 n.4 (7th Cir.1989); Pink Supply Corp. v. Hiebert, Inc., 788 F.2d 1313, 1319 (8th Cir. 1986)).

When ruling on a summary judgment motion, a court must view the evidence and any inferences from the evidence in the light most favorable to the nonmoving party. Anderson, 477 U.S. at 255. “Where the record taken as a whole could not lead a rational trier of fact to find for the nonmoving party, there is no genuine issue for trial.” Ricci v. DeStefano, 557 U.S. 557, 586 (2009) (citations omitted). The mere argued existence of a factual dispute does not defeat an otherwise properly supported motion. Anderson, 477 U.S. at 248. If the evidence is merely colorable or is not

significantly probative such that a jury could not return a verdict for the other party, summary judgment is appropriate. Id. at 249–50 (cleaned up). “A district court has broad discretion in deciding whether to certify a class.” Thorn v. Jefferson-Pilot Life Ins. Co., 445 F.3d 311, 317 (4th Cir. 2006) (quoting Lienhart v. Dryvit Sys., Inc., 255 F.3d 138, 146 (4th Cir. 2001)). In the execution of this discretion, a court must accept the substantive allegations of the

complaint as true and “interpret Rule 23 in such a manner as to promote justice and judicial efficiency.” Farrar & Farrar Dairy, Inc. v. Miller-St. Nazianz, Inc., 254 F.R.D. 68, 72 (E.D.N.C. 2008); Di Biase v. SPX Corp., No. 314CV00656RJCDSC, 2017 WL 4366994, at *2 (W.D.N.C. Oct. 2, 2017). Nonetheless, the burden of establishing certification remains with the party seeking class certification. Thorn v. Jefferson- Pilot Life Ins. Co., 445 F.3d 311, 321–22 (4th Cir. 2006). A class “may only be certified if the trial court is satisfied, after a rigorous analysis, that the prerequisites of Rule 23(a) have been satisfied.” Gen Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 161 (1982). Then, if a plaintiff meets all of the requirements of Fed. R. Civ. P. (23)(a), the

plaintiff must show that the putative class also fits into one of the three categories enumerated in Rule 23(b). Fed. R. Civ. P. 23(b). III. DISCUSSION A. Defendant’s Motion to Dismiss and Motion for Summary Judgment Defendant moves the Court to dismiss the action for lack of standing, or in the alternative, to grant summary judgment in favor of Defendant, finding that the City of Charlotte is not a “person” as defined by the relevant statute. (Doc. No. 39 at 1).

The Drivers Privacy Protection Act provides that “[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” 18 U.S.C. § 2724(a). Thus, there is a private right of action when a person violates the DPPA.

1. Lack of Standing The plaintiff bears the burden of proving that subject matter jurisdiction exists. Evans v. B.F. Perkins Co., a Div. of Standex Int’l Corp., 166 F.3d 642, 647 (4th Cir. 1999). “When . . . a defendant challenges the existence of subject matter jurisdiction in fact, the plaintiff bears the burden of proving the truth of such facts by a preponderance of the evidence.” U.S. ex rel. Vuyyuru v. Jadhav, 555 F.3d 337, 347 (4th Cir. 2009). “When a defendant challenges subject matter jurisdiction pursuant to Rule 12(b)(1), the district court is to regard the pleadings as mere evidence on the issue and may consider evidence outside the pleadings without converting the

proceeding to one for summary judgment. Evans, 166 F.3d at 647 (cleaned up). A court will analyze standing in a class action “based on the allegations of personal injury made by the named plaintiffs.” Baehr v. Creig Northrop Team, P.C., 953 F.3d 244, 252 (4th Cir. 2020) (citing Hutton v. Nat'l Bd. of Exam'rs in Optometry, Inc., 892 F.3d 613, 620 (4th Cir. 2018)). At the summary judgment stage, “the named plaintiff is obliged to ‘set forth by affidavit or other evidence specific facts’ that, when taken as true, establish each element of Article III standing.” Id. at 253 (quoting

Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992); and then citing Libertarian Party of Virginia v. Judd, 718 F.3d 308, 313 (4th Cir. 2013)). “Once threshold individual standing by the class representative is met, a proper party to raise a particular issue is before the court [and] there is no further, separate ‘class action standing’ requirement.” Carolina Youth Action Project; D.S. by & through Ford v. Wilson, 60 F.4th 770, 779 (4th Cir. 2023) (citing 1 Newberg and Rubenstein on Class

Actions § 2:1 (6th ed. 2022)). “The irreducible constitutional minimum of standing consists of three elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016), as revised (May 24, 2016) (cleaned up). A plaintiff “cannot establish a cognizable injury simply by pleading a statutory violation.” Garey v. James S. Farrin, P.C., 35 F.4th 917, 921 (4th Cir. 2022) (citing Spokeo, 578 U.S. at 341). As to “injury in fact,” in Garey, the Fourth Circuit held that the plaintiffs had

Article III standing to pursue claims for damages under the DPPA because they established a legally cognizable privacy injury. 35 F.4th at 922. Specifically, plaintiffs alleged under the DPPA that their privacy was invaded by the defendants who knowingly obtained their personal information for an impermissible purpose. Id. The court of appeal reasoned that like in Krakauer “injuries to personal privacy have long been ‘recognized in tort law and redressable through private litigation.’” Id. (quoting Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 653 (4th Cir. 2019)). Thus, the

plaintiffs in Garey had alleged a legally cognizable privacy injury. Id. Here, Plaintiff’s alleged injury is similar to the injury claimed in Garey. Plaintiff articulates a privacy violation through the disclosure of a motor vehicle record for impermissible purposes under DPPA. Consistent with Garey, Plaintiff can establish the “injury in fact” prong required for standing. Moving on to the “fairly traceable” element, Plaintiff argues that both the

undisputed evidence and Defendant’s own admissions1 prove that Defendant unlawfully disclosed Plaintiff’s DPPA-protected information. (Doc. No. 44 at 10).

1 Plaintiff claims that in its answer, “Defendant admits that it published Plaintiff’s unredacted crash report, which contains DPPA-protected personal information, at its records desk.” (Doc. No. 44 at 11). Defendant asserts that Plaintiff’s argument is a mischaracterization of Defendant’s answer by leaving out that the admissions were made upon “information and belief.” (Doc. No. 51 at 6). In general, a party is bound by the admissions of its pleadings. Lucas v. Burnley, 879 F.2d 1240, 1242 (4th Cir. 1989); see also Butts v. Prince William Cnty. Sch. Bd., 844 F.3d 424, 432 n.3 (4th Cir. Arguing that Plaintiff’s injury is not “fairly traceable” to Defendant’s conduct, Defendant relies upon Hensley v. City of Charlotte, No. 3:20-CV-00482-KDB-DSC, 2023 WL 2533083, at *1 (W.D.N.C. Mar. 15, 2023). Defendant contends that Hensley

“is largely indistinguishable from the instant case,” and thus, Plaintiff is without standing. The Court is not persuaded. In Hensley, the district court found that the plaintiff lacked standing “because he ha[d] not alleged in the relevant pleadings that his injury was the result of a wrongful disclosure of his personal information by the City” in violation of the DPPA. 2023 WL 2533083, at *1. The Court observed that Plaintiff’s allegations asserted that CMPD records and LexisNexis both made information available to the public and the

complaint did not allege that “a member of the public who viewed Hensley’s Accident Report at the records division solicited [him].” Id. at *2. The Court concluded that the complaint failed to allege that the plaintiff’s injury was traceable to the City’s alleged wrongful conduct. Id. at *4. The Court reasoned that Plaintiff’s standing depended “on an allegation that he suffered his injury from a disclosure of Plaintiff’s accident report from the CMPD

counter,” and fatal to the plaintiff’s claim, CMPD/the City kept no record of which accident reports were viewed or by whom, and Hensley could not show that “he

2016). However, this Court has recognized that the phrase “on information and belief” is “a lawyer shorthand expression of uncertainty.” In re Thiel, No. 1:14-CV-168, 2015 WL 773401, at *4 n.4 (W.D.N.C. Feb. 24, 2015), aff’d, 627 F. App’x 272 (4th Cir. 2016). Thus, the Court does not find Defendant CMPD to have admitted the allegations asserted by Plaintiff where Defendant noted that these allegations were admitted “upon information and belief.” received a solicitation as a result of the disclosure of DPPA protected personal information at the CMPD counter rather than the PRUS/LexisNexis website.” Id. at *3 (quotations omitted).

The Court described the plaintiff’s affidavits attempting to establish traceability as “wholly speculative and internally inconsistent in describing how the law firm solicitation might have come to Plaintiff.” Id. at *4. In addressing the specific evidence, the Court explained Plaintiff’s evidence from Digital Solutions’ this way: [Digital Solutions] says that it gathers reports “in a variety of ways” and it is only its President’s “best recollection” in July 2021 that from September 2017 to the end of the year it accessed crash reports from CMPD by gathering hard copies from the department. Significantly, however, Digital Solutions does not say that it provided actual accident reports to clients, but instead says that it takes information from the reports which it puts into an excel spreadsheet format that is its product.

Id. at *4. Further, the Farrin law firm declaration denied “that it received any spreadsheets from Digital Solutions but instead claims that it prepared its own internal spreadsheets from actual accident reports.” Id. The Court concluded that the plaintiff failed to “establish whether the law firm in fact even had Plaintiff’s accident report or, if so, where it came from.” Id. Thus, the Court concluded that the plaintiff failed to allege that the injury was traceable to the City’s alleged DPPA violation and was without standing. Id. In sum, the Hensley causal chain breaks between Digital Solutions and the Farrin law firm. Digital Solutions may have received accident reports from CMPD which it used to create spreadsheets that the Farrin law firm never received. Because the Farrin law firm had its own accident reports that it used to make spreadsheets, but Digital Solutions never claimed to have provided the actual reports to clients, there was no link between the law firm’s accident reports and CMPD’s record counter. Defendant argues that Plaintiff suffers from the same insufficient evidence as

the plaintiff in Hensley. (Doc. No. 39-1 at 14–17). Defendant contends that “Plaintiff has no personal knowledge of the most fundamental facts alleged in her Complaint that would go toward establishing a concrete and particularized injury traceable to the City.” (Doc. No. 39-1 at 15). In response, Plaintiff argues that the evidence leaves no other possibility than that Defendant unlawfully disclosed Plaintiff’s accident report to Digital Solutions. (Doc. No. 44 at 10). Based on a declaration of Plaintiff’s attorney, Plaintiff’s name and address

appears in the Farrin firm’s spreadsheets. (Doc. No. 32-13, Stradley Decl., at ¶ 4). A declaration from Eric Sanchez at the Farrin firm details that it only obtained accident reports that were released to the public by CMPD through its agreement with Digital Solutions. (Doc. No. 32-10, Sanchez Decl., at ¶ 5). The Farrin Firm reviewed the accident reports it received and created its own spreadsheets “to inform its ability to communicate in writing with persons involved in accidents to introduce the Firm’s

services.” (Id. at ¶ 7). As a general practice, the Farrin Firm would send a mailing that corresponded to each listing on the spreadsheets it created. (Id. at ¶ 8). Further, based on a declaration from Kevin Creech, at Digital Solutions, Digital solutions received accident reports, beginning in September 2017, only from sending runners to retrieve the reports from the CMPD division. (Doc. No. 32-9, Creech Decl., at ¶ 5). Digital Solutions then provided the accident reports to the Farrin law firm. (Id. at ¶ 7). It is also established that from at least 2007 until late 2020, Defendant placed

one or more copies of its recently created DMV-349s on the front desk of its records division such that anyone who came into the records division could view the information on each DMV-349. (Doc. No. 1 at ¶ 49; Doc. No. 19 at ¶ 49). No redactions were ever made in the reports made available at the CMPD records counter. (Doc. No. 1 at ¶ 53; Doc. No. 19 at ¶ 53). When Plaintiff was involved in a motor vehicle accident in December of 2017, a DMV-349 was prepared. (Doc. No. 1 at ¶ 64; Doc. No. 19 at ¶ 64).

In this case, Plaintiff does not suffer from the same traceability deficiencies that were present in Hensley. Unlike Hensley, Digital Solutions does say that it provided actual accident reports to clients, thus the causal chain is not broken in the same way. The accident reports went from the CMPD records counter to Digital Solutions and then to the Farrin firm and into the Farrin firm’s spreadsheets. Thus, Plaintiff has established that she suffered an injury in fact, that is fairly traceable to

the challenged conduct of Defendant, and that is likely to be redressed by a favorable judicial decision. See Spokeo, 578 U.S. at 338. Accordingly, dismissal for lack of standing is not appropriate, and Defendant’s Motion to Dismiss for lack of standing is denied. 2. “Person” Subject to the DPPA The Drivers Privacy Protection Act makes it “unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for

any use not permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a). The statute provides for private cause of action against a violator: “A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” 18 U.S.C. § 2724(a). The statute also defines the term “person” as follows: “‘person’ means an individual, organization or entity, but does not include a

State or agency thereof.” 18 U.S.C. § 2725(2). Defendant City of Charlotte argues that it is an agency of North Carolina and, therefore, not a person under the DPPA and not subject to a private cause of action. (Doc. No. 39-1 at 1). Defendant proffers that North Carolina state law compels the result that the City of Charlotte is not a “person” for purposes of the DPPA. In response, Plaintiff asserts that municipalities like the City of Charlotte are “persons”

under the DPPA as a matter of federal law. (Doc. No. 44 at 12–13). In interpreting the statute, the Court will look first to the statute’s language, giving the words used their ordinary meaning. Dwoskin v. Bank of Am., N.A., 888 F.3d 117, 119 (4th Cir. 2018) (quoting Roberts v. Sea-Land Services, Inc., 566 U.S. 93, 100 (2012)). Further, in general, application of federal law does not depend upon State law, unless there is a plain indication otherwise. Mississippi Band of Choctaw Indians v. Holyfield, 490 U.S. 30, 43 (1989).2 The goal, of course, is uniform application of statutes nationwide. Id. at 43–44; see also Brooks v. Maryland Gen. Hosp., Inc., 996 F.2d 708, 714 (4th Cir. 1993) (“While the federal courts may give

effect to state law in interpreting the scope of a federal statute if Congress has evinced an intention to give state law persuasive or binding effect, even when a federal statutory provision contains significant gaps, the courts have been reluctant to infer such intent and resort to reference to state law due to concern for uniformity in the nation’s law.” (citations omitted)). Section 2721 provides for permissible use of personal information “by any government agency, including any court or law enforcement agency, in carrying out

its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions” and “in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.” 18 U.S.C. § 2721(b)(1),

(b)(4). Plaintiff directs the Court to the statute’s mention of a “local agency,” which is mentioned in addition to a State agency. (Doc. No. 44 at 14). Generally, if Congress uses specific language in one section but does not use that same language in another

2 The Court finds no indication in the statute that it should consult North Carolina law to determine if Defendant City of Charlotte is a “person” under DPPA. section, it is assumed that Congress acted intentionally in its inclusion and exclusion of the language at issue. Russello v. United States, 464 U.S. 16, 23 (1983). Language in section 2725 that a State agency is excluded from the definition of “person,” without

any mention of a “local agency” also being excluded from the definition casts serious doubt on Defendant’s not-a-person argument. Numerous courts have concluded that a municipality does not act as a “State or agency thereof” under DPPA and is a person under the act. The Eleventh Circuit has expressed that the definition of “person” under section 2725 “does not exclude municipal agencies such as sheriff’s departments,” and that “it would be a feat of statutory reconstruction to sever the term ‘person’ as it appears in section 2722(a)

and section 2724(a) from the remedies enumerated in section 2724(b).” Truesdell v. Thomas, 889 F.3d 719, 724 (11th Cir. 2018). District courts have also concluded that municipalities are not excluded from liability. See Orduno v. Pietrzak, No. CV 14- 1393 ADM/DTS, 2017 WL 4354686, at *9 (D. Minn. Sept. 29, 2017), aff’d, 932 F.3d 710 (8th Cir. 2019) (concluding based on the text of the statute that “the statute contemplates direct liability for municipal entities like the City”); Potocnik v. Carlson,

No. 13-CV-2093 (PJS/HB), 2016 WL 3919950, at *7 (D. Minn. July 15, 2016) (“Congress specifically exempted states and state agencies from the definition of “person” under the DPPA, [but] Congress conspicuously did not exempt municipalities.”); Santarlas v. Minner, No. 5:15-CV-103-OC-30PRL, 2015 WL 3852981, at *3 (M.D. Fla. June 22, 2015) (“Although a state and its agencies, such as a department of motor vehicles, are exempt from the civil penalties provided for under the DPPA, cities and municipalities are not.”); Margan v. Niles, 250 F. Supp. 2d 63, 75 (N.D.N.Y. 2003) (“[P]ursuant to 18 U.S.C. § 2724(a), states and state agencies are expressly exempted from civil liability under the DPPA. Municipalities are not. . . .

[D]ifferential treatment of states and state departments of motor vehicles provides no basis upon which to conclude that Congress intended to treat municipalities different than other ‘persons.’”). Diverging from the aforementioned district court decisions, Defendant argues that Gaston concluded that a municipality is not a person under DPPA. (Doc. No. 39- 1 at 18). Defendant is mistaken. In its order, the Court noted that “any failure by a state or state agency,

including a DMV or city acting within the scope of its governmental authority, is not subject to a private right of action under section 2724(a) because a ‘State or agency thereof’ is not defined as a ‘person’ under the DPPA, although they are plainly subject to the DPPA’s disclosure restrictions described in section 2721(a) and subject to a potential civil penalty under 18 U.S.C. § 2723.” Gaston v. LexisNexis Risk Sols., Inc., 483 F. Supp. 3d 318, 350 n.29 (W.D.N.C. 2020). The Court also noted that “[a]

subordinate division of the state, like a city administrative unit is a state agency.” Id. at 348 n.25 (citing Smith v. Hefner, 235 N.C. 1, 68 S.E.2d 783 (1952)). Yet, throughout its order, the Court makes clear that the disclosure of accident reports is subject to the DPPA. The Court explained that “the very essence of the DPPA is to limit the disclosure of information that had previously been made widely available as a public record; so, . . . it would be nonsensical to hold that a permissible governmental ‘function’ under the DPPA is to publicly disclose personal information in a ‘public record.’” 483 F. Supp. 3d at 346. Further, the Court explained that a municipality was considered a State

agency under the DPPA only to the extent it acted within the scope of its governmental authority, stating the following: the gathering of personal information to prepare the Crash Reports is a government function permitted by section 2721(b)(1) in the same way that gathering personal information to create a driver’s license or motor vehicle registration is permitted by the act. However, once the information is lawfully obtained, the disclosure of the information, in and of itself, is not an independent governmental function that is permitted by the DPPA (absent redaction or a separate permitted use).

483 F. Supp. 3d at 346 n.20. The Court made clear that impermissible disclosure of DPPA-protected information is not a government function. Thus, Gaston does not hold that Defendant cannot be subject to a private cause of action under the DPPA for disclosure of DPPA-protected information. In sum, the Court finds Defendant’s argument that it is not a “person” subject to suit under DPPA unavailing. Accordingly, Defendants’ Motion for Summary Judgment is denied. Having denied Defendant’s Motion to Dismiss and Motion for Summary Judgment, the Court turns to Plaintiff’s Motion for Summary Judgment and Plaintiff’s Motion to Certify Class. B. Plaintiff’s Motion for Class Certification Plaintiff seeks class certification in this action under the DPPA. The purported class of persons is defined as follows: Those (1) who were listed as North Carolina-licensed drivers on DMV- 349s completed by CMPD officers within the Class Period [November 30, 2017–June 30, 2018]; (2) whose name appears on a Farrin Spreadsheet; and (3) whose North Carolina driver’s license number is shown on the DMV-349 or the Same Address Box for the person is checked “Yes” on the DMV-349.

(Doc. No. 37 at 11). Plaintiff also brings the action on behalf of a subclass consisting of all members of the Class whose personal information was auto-populated onto a DMV-349. (Id. at 11–12). In opposition, Defendant reiterates its arguments, which are addressed above, regarding standing and maintains that it is not a “person” subject to a private right of action under DPPA. (Doc. No. 45). Defendant does not challenge Plaintiff’s arguments on the specific factors required for class certification but instead makes general objections to Plaintiff’s evidence procured during the Hensley litigation and analyzed by Plaintiff’s expert in this case. (Id. at 22–24). “The class action is ‘an exception to the usual rule that litigation is conducted by and on behalf of the individual named parties only.’” Comcast Corp. v. Behrend, 569 U.S. 27, 33 (2013) (citing Califano v. Yamasaski, 442 U.S. 682, 700–701 (1979)). To meet this exception, a party seeking to maintain a class action “must affirmatively demonstrate his compliance” with Rule 23 of the Federal Rules of Civil Procedure. Id. (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011)). This rule requires a two-part test for certifying a class. First, the plaintiff must establish the four requirements under Rule 23(a):

(1) the class is so numerous that joinder of all members is impracticable; (2) there are questions of law or fact common to the class; (3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and (4) the representative parties will fairly and adequately protect the interests of the class.

Fed. R. Civ. P. 23(a); see also Gunnells v. Healthplan Servs., 348 F.3d 417, 423 (4th Cir. 2003). These basic prerequisites are commonly referred to as numerosity, commonality, typicality, and adequacy, respectively. See id. Second, if a plaintiff meets all of the requirements of Fed. R. Civ. P 23(a), the plaintiff must show that the putative class also fits into one of the three categories enumerated in Rule 23(b). Fed. R. Civ. P. 23(b); Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 614 (1997). Here, Plaintiff seeks certification under Rule 23(b)(3), which requires that “the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.”

1. Rule 23(a) Factors a. Numerosity To bring a class action, the class must be so numerous that joinder of all members is impracticable. Fed. R. Civ. P. 23(a)(1). “No specified number is needed to maintain a class action.” Brady v. Thurston Motor Lines, 726 F.2d 136, 145 (4th Cir. 1984) (quoting Cypress v. Newport News General & Nonsectarian Hospital Ass’n, 375 F.2d 648, 653 (4th Cir. 1967)). For determining whether the numerosity requirement

is met, it is not necessary to demonstrate with precision the number of persons in a purported class—reasonable estimates are sufficient. Simpson v. Specialty Retail Concepts, 149 F.R.D. 94, 98 (M.D.N.C. 1993) (citations omitted). Large class sizes alone may allow a court to presume the impracticability of joinder. Olvera-Morales v. Int’l Lab. Mgmt. Corp., 246 F.R.D. 250, 256 (M.D.N.C. 2007). The Fourth Circuit has recognized classes of 74 persons, or as low as 18 persons, can meet the numerosity

requirement. Brady, 726 F.2d at 145. Plaintiff demonstrates that the proposed class and subclass each consist of at least several thousand persons. (Doc. No. 37 at 14; Doc. No. 1 at ¶¶ 45–47; Doc. No. 19 at ¶45–47). Thus, the numerosity requirement is met. b. Commonality To certify a class action, there must be questions of law or fact common to the class. Fed. R. Civ. P. 23(a)(2). The commonality prerequisite requires a plaintiff to

show that the class members share both a common contention and a common injury. Wal-Mart Stores, 564 U.S. at 349–50. “That common contention, moreover, must be of such a nature that it is capable of classwide resolution—which means that determination of its truth or falsity will resolve an issue that is central to the validity of each one of the claims in one stroke.” Id. at 350. Further, the “test for commonality is not demanding, and is met when there is at least one issue whose resolution will

affect all or a significant number of the putative class members.” Bussian v. DaimlerChrylser Corp., No. 104CV00387, 2007 WL 1752059, at *5 (M.D.N.C. June 18, 2007) (citing Woodard v. Online Info. Servs., 191 F.R.D. 502, 505 (E.D.N.C. 2000)). Here, all members of the proposed class are subject to the ultimate question of “whether Defendant violated the DPPA by disclosing class members’ unredacted personal information from motor vehicle records without a permissible purpose.” (Doc. No. 37 at 15; Doc. No. 1 at ¶ 113). The resolution of this question will affect all of the persons in the proposed class. Thus, the commonality element is satisfied. c. Typicality:

Rule 23 also requires that the claims or defenses of the representative plaintiff be typical of the claims or defenses of the class. Fed. R. Civ. P. 23(a)(3). “The typicality requirement is met where the claims asserted by the named plaintiffs arise from the same course of conduct and are based on the same legal theories as the claims of the unnamed class members.” Tatum v. R.J. Reynolds Tobacco Co., 254 F.R.D. 59, 65 (M.D.N.C. 2008) (cleaned up). This requirement has “consistently been held to mean that his claim cannot be antagonistic to the claims of other members.” DeLoach v.

Philip Morris Companies, Inc., 206 F.R.D. 551, 555 (M.D.N.C. 2002) (citation omitted). In other words, the named plaintiff’s interest must be “sufficiently aligned” with the interest of the class to ensure confidence in the named plaintiff’s “ability to adequately represent its interests.” Olvera-Morales, 246 F.R.D. at 258. “Typicality tends to merge with commonality, insofar as both serve as guideposts for determining whether under the particular circumstances maintenance of a class action is

economical and whether the named plaintiff’s claim and the class claims are so interrelated that the interests of the class members will be fairly and adequately protected in their absence.” Soutter v. Equifax Info. Servs., LLC, 498 F. App’x 260, 264 (4th Cir. 2012) (cleaned up). Here, the interests of Plaintiff Durham appear to be aligned with the interests of the class. No antagonism exists between the claims as the claims of the named plaintiff “arise from the same course of conduct” and are based “on the same legal theories as the class members.” Both the named plaintiff and the class seek to establish Defendant’s liability and to recover damages based upon Defendant’s

disclosure of DPPA-protected information. (Doc. No. 37 at 17). Plaintiff’s DMV-349, like the DMV-349 of the class, shows her driver’s license number and has the Address Box checked. Likewise, Plaintiff and the subclass contend that their personal information maintained by NCDMV was auto-populated into their respective crash reports. Therefore, the typicality requirement is met. d. Adequacy of representation Class certification also requires that the representative parties will fairly and

adequately protect the interests of the class. Fed. R. Civ. P. 23(a)(4). “The adequacy inquiry serves to uncover conflicts of interest between named parties and the class they seek to represent.” Sharp Farms v. Speaks, 917 F.3d 276, 295 (4th Cir. 2019) (cleaned up). “A class representative must be part of the class and possess the same interest and suffer the same injury as the class members.” Id. (cleaned up). Adequacy of representation is divided into two prongs: (1) the party’s attorney must be qualified,

experienced and generally able to conduct the proposed litigation and (2) the litigants must not be involved in a collusive suit and plaintiff must not have interests antagonistic to the remainder of the class. DeLoach v. Philip Morris Companies, Inc., 206 F.R.D. 551, 556 (M.D.N.C. 2002). Here, as noted in the prior section, Plaintiff does not have interests which are antagonistic to the class. Further, Plaintiff’s counsel appears qualified, experienced, and generally able to conduct the litigation. Thus, the representative parties will fairly and adequately protect the interests of the class. 2. Rule 23(b)(3)

Plaintiff seeks certification under Rule 23(b)(3), which requires that “the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.” These two requirements are labeled “predominance” and superiority.” “In conducting the predominance analysis, a court first characterizes issues as common or individual.” In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig.,

341 F.R.D. 128, 155 (D. Md. 2022), vacated and remanded sub nom. In re Marriott Int’l, Inc., 78 F.4th 677 (4th Cir. 2023), and reinstated by In re Marriott Int’l Customer Data Sec. Breach Litig., 345 F.R.D. 137 (D. Md. 2023) (citing 2 Newberg § 4:50 (5th ed. 2021)). “Rule 23(b)(3) is normally satisfied where there is an essential common factual link, such as standardized documents and practices, even though the nature and amount of damages may differ among class members.” Id. (quoting In re TD

Bank, N.A. Debit Card Overdraft Fee Litig., 325 F.R.D. 136, 154 (D.S.C. 2018)). “The Rule 23(b)(3) predominance inquiry tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation.” Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 623 (1997). The question is whether a plaintiff suing under the DPPA is likely to be in the same position as many other people and can rely largely on common proof to make out her claim. See Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 656 (4th Cir. 2019) (explaining that a plaintiff bringing a claim under a particular statute was likely to be in the same position as a great many other people and can rely largely on common proof to make out his claim” and certifying the class

under Rule 23(b)(3)). Plaintiff presents the following questions of law and fact as common to the class: 1. Whether a DMV-349 in which the Same Address Box is checked “Yes” is a motor vehicle record;

2. Whether a DMV-349 which openly displays a driver’s license number is a motor vehicle record;

3. Whether Defendant, by providing unredacted accident reports at its Records Division, knowingly disclosed protected personal information from a motor vehicle record;

4. Whether Defendant, by disclosing an unredacted version of each Class member’s DMV-349, knowingly disclosed information from a motor vehicle record for a purpose not permitted under the DPPA;

5. Whether Defendant, because of its failure to comply with 18 U.S.C. § 2721(c) is estopped to deny, or is otherwise precluded from contesting, Plaintiff’s contention that each Class member’s information was obtained without a permissible purpose; and

6. Whether Defendant is estopped to deny, or is otherwise precluded from contesting, an individual Class member’s claim that at least one item of his personal information on his DMV-349 came from his motor vehicle record.

(Doc. No. 37 at 20). Here, there are common issues among the class members that are subject to the same proof. Members of the class claim the same disclosure of DPPA- protected information from the CMPD records division for marketing purposes. The resolution of the questions above will permit resolutions of the class members claims. Further, the class members ask only for liquidated damages, thus there is not a need for individualized damage calculations. Four factors are considered when analyzing superiority: (1) the class members’

interests in individually controlling the prosecution or defense of separate actions; (2) the extent and nature of any litigation concerning the controversy already begun by or against class members; (3) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and (4) the likely difficulties in managing a class action. Fed. R. Civ. P. 23(b)(3). Here, Plaintiff is unaware of any pending litigation raising similar issues against Defendant and the cost of litigating this case on an individual basis is

impractical. Further, this Court is the appropriate forum for litigating this matter, and no potential management issues are foreseen. 3. Ascertainability A class must also be ascertainable to be certified. Under the ascertainability principle, “a class cannot be certified unless a court can readily identify the class members in reference to objective criteria.” Krakauer, 925 F.3d at 655 (quoting EQT

Prod. Co. v. Adair, 764 F.3d 347, 358 (4th Cir. 2014)). The class members can be clearly identified from Farrin spreadsheets and the CMPD accident reports. In addition, the subclass can be identified by methods identified by Plaintiff’s expert to determine which DMV-349s were filled out using auto-populate. In response to Plaintiff’s motion in regard to ascertainability of the subclass, Defendant argues that Plaintiff failed to serve an expert designation and violated the protective order in Hensley by utilizing confidential proprietary discovery obtained in

the course of litigating that case. (Doc. No. 45 at 1, 22–24). There is no indication in the record that Plaintiff failed to serve an expert designation. Further, the protective order in this case specifically refers to “documents, testimony, and information” that has and may be sought, produced, or exhibited in both “this case” and Hensley. (Doc. No. 29 at 1–2). It appears to the Court that the parties expressly contemplated use of materials procured in litigating Hensley in the case at bar. Thus, use of those materials cannot be said to violate the protective order in Hensley, and at this point,

the Court finds no reason to exclude that evidence. In sum, Plaintiff seeks certification of the following class: Those (1) who were listed as North Carolina-licensed drivers on DMV- 349s completed by CMPD officers within the Class Period [November 30, 2017–June 30, 2018]; (2) whose name appears on a Farrin Spreadsheet; and (3) whose North Carolina driver’s license number is shown on the DMV-349 or the Same Address Box for the person is checked “Yes” on the DMV-349.

(Doc. No. 37 at 11). Plaintiff also seeks certification of a subclass consisting of all members of the Class whose personal information was auto-populated onto a DMV- 349. (Id. at 11–12). The Court finds, as detailed in the next section below, that all of the DMV-349 Crash Reports in which the box ‘Same address as driver’s license’ is checked are “motor vehicle records” as defined by the statute. The Court does not consider whether other characteristics of the DMV-349 accident reports would result in a classification as a “motor vehicle record.” The Court also does not address whether a driver’s license is a “motor vehicle record” under the statute. Accordingly, the Court limits the class definition such that only those with a “motor vehicle record” disclosed

are part of the class. The class is defined as follows: Those (1) who were listed as North Carolina-licensed drivers on DMV- 349s completed by CMPD officers within the Class Period [November 30, 2017–June 30, 2018]; (2) whose name appears on a Farrin Spreadsheet; and (3) the Same Address Box for the person is checked “Yes” on the DMV-349.

Plaintiff has established the requirements for class certification under Rule 23 for the class, as defined by the Court, and subclass which consists of all members of the class whose personal information was auto-populated onto a DMV-349. Therefore, Plaintiff’s Motion to Certify Class is granted, and the class is certified. C. Plaintiff’s Motion for Summary Judgment Plaintiff asks this Court to grant summary judgment for herself, and the members of the class and subclass, on claims for statutory damages under the DPPA because the uncontradicted evidence shows that Defendant systematically violated the DPPA by providing copies of police traffic accident reports, containing protected information, to a marketing support company. (Doc. No. 34 at 2). Defendant responds by reiterating its arguments that Plaintiff lacks standing and that Defendant is a state agency that cannot be subject to a private cause of action. Further, Defendant argues that Plaintiff cannot show the elements of a DPPA violation through admissible evidence. (Doc. No. 52 at 8).3 As noted above, the Drivers Privacy Protection Act provides that “[a] person

who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” 18 U.S.C. § 2724(a). To establish a claim under the DPPA, Plaintiff must show that Defendant (1) knowingly obtained, disclosed, or used “personal information,” (2) from a “motor vehicle record,” (3) for a purpose not permitted under the statute. 18 U.S.C. § 2724(a);

Thomas v. George, Hartz, Lundeen, Fulmer, Johnstone, King, & Stevens, P.A., 525 F.3d 1107, 1111 (11th Cir. 2008); see Hatch v. LexisNexis Risk Sols., Inc., No. 319CV00449KDBDCK, 2020 WL 1042256, at *3 (W.D.N.C. Mar. 3, 2020); Wilcox v. Swapp, 330 F.R.D. 584, 594 (E.D. Wash. 2019). 1. Knowingly obtained, disclosed, or used ‘personal information’ The requirement that the defendant act “knowingly” only applies to the

obtaining, disclosing, or using of the DPPA-protected information, and does not

3 In addition to the arguments addressed in more depth in the class certification section regarding confidential information from Hensley, Defendant asserts that Plaintiff’s “post-deposition Declaration statements that are inconsistent with her deposition testimony are incapable of creating a genuine issue of material fact.” (Doc. No. 52 at 2–3). Having reviewed both Plaintiff’s deposition and declaration, the Court fails to see the inconsistencies that Defendant asserts. require that the defendant knowingly violated the statute. Wilcox, 330 F.R.D. at 594– 95; Wiles v. Worldwide Info., Inc., 809 F. Supp. 2d 1059, 1080 (W.D. Mo. 2011). “Personal information” is “information that identifies an individual, including

an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status.” 18 U.S.C. § 2725. Here, the evidence shows that Defendant knowingly disclosed Plaintiff’s personal information. Plaintiff was involved in an accident on December 4, 2017. The CMPD officer who investigated Plaintiff’s wreck completed a DMV-349 containing

Plaintiff’s full name, address, date of birth, driver’s license number, and telephone number. (Doc. No. 1, at ¶ 67; Doc. No. 19, at ¶ 67; Doc. No. 1-2; Doc. No. 32-8 at ¶ 5). At CMPD, the police officer who investigates a crash submits the DMV-349 Report to a supervisor for review which is then submitted to the NCDMV. (Doc. No. 39-2, N. Crum Declaration, at ¶ 15–17). CMPD, from 2007 or earlier until late 2020, placed one or more copies of each

recent DMV-349 accident report on the front desk of its records division so that anyone who came into the division could personally view the DMV-349. (Doc. No. 19 at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 11:7–12:25). Defendant has never redacted personal information as defined by the DPPA from any DMV-349 made publicly available at the CMPD records division. (Doc. No. 1, at ¶ 53; Doc. No. 19, at ¶ 53). As noted in the standing analysis above, a declaration of Plaintiff’s attorney states that Plaintiff’s name and address appear in the Farrin firm’s spreadsheets. (Doc. No. 32-13, Stradley Decl., at ¶ 4). A declaration from Eric Sanchez at the Farrin

Firm details that it only obtained accident reports that were released to the public by CMPD through its agreement with Digital Solutions. (Doc. No. 32-10, Sanchez Decl., at ¶ 5). The Farrin Firm reviewed the accident reports it received and created its own spreadsheets. (Id. at ¶ 7). Based on a declaration from Kevin Creech, at Digital Solutions, Digital Solutions received accident reports, beginning in September 2017, from sending runners to retrieve the reports from the CMPD records division. (Doc.

No. 32-9, Creech Decl., at ¶ 5). Digital Solutions then provided the accident reports to the Farrin law firm. (Id. at ¶ 7). This establishes a knowing disclosure of Plaintiff’s personal information that is protected under the DPPA. Further, CMPD not only knew of the disclosure but since at least 2011, CMPD knew that marketers, including law firms that CMPD employees referred to as “ambulance chasers,” acquired reports in bulk directly from its records division. (Doc.

No. 32-6, CMPD Dep. II, at 13:22–14:14, 15:2–17:12, 18:16–20:5). Here, there is no genuine dispute as to any material fact from which a reasonable jury could conclude that the accident reports of Plaintiff and those similarly situated were not knowingly disclosed. The only evidence presented shows that the accident reports were disclosed from the CMPD records division and made their way to Digital Solutions and then to the Farrin firm. Thus, Plaintiff has established that CMPD knowingly disclosed her “personal information.” 2. From a ‘motor vehicle record’

To succeed in establishing her claim under DPPA, Plaintiff must show that Defendant disclosed “personal information” from a “motor vehicle record.” Garey v. James S. Farrin, P.C., 35 F.4th 917, 929 (4th Cir. 2022) (“[A] DPPA plaintiff must allege and prove that the defendant obtained the plaintiff'’s personal information ‘from a motor vehicle record.’”). A “motor vehicle record” under the DPPA is “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles.”

18 U.S.C. § 2725(1). In determining what meets the definition of a “motor vehicle record,” this Court in Gaston found that “all of the DMV Form 349 Crash Reports in which the box ‘Same address as driver’s license’ is checked are ‘motor vehicle records’ under the statutory definition.” 483 F. Supp. 3d at 336. The Court concluded that “the accident report is plainly a record that ‘pertains to’ the driver’s license and thus qualifies as a ‘motor

vehicle record’ under the DPPA,” reasoning that “[r]egardless of whether the initial source of the address information was the accident participant’s records in the DMV database (using the F11 function), or a driver’s license, or if the driver’s license was only used to confirm earlier provided information, everyone who has access to the Crash Reports knows the address on that individual’s driver’s license just the same as if they had the person’s driver’s license in their hands.” Id. at 337. In Garey, the Fourth Circuit did not reach the question of whether an accident

report was a “motor vehicle record,” but noted that the Court in Gaston determined that it was. Garey, 35 F.4th at 927. As Defendant observes, the Fourth Circuit expressed doubt regarding whether “motor vehicle records” include accident reports. The Fourth Circuit explained the following: On the one hand, there is a non-frivolous textual argument that an accident report is a “record that pertains to a motor vehicle operator’s permit,” because the report indicates whether a driver’s address is the same as that shown on their license. Indeed, a district court in our circuit recently held that the exact same kind of accident report at issue here is a “motor vehicle record” within the meaning of the DPPA. On the other hand, several courts have limited a DPPA “motor vehicle record” to those documents held by a state DMV, which would exclude the accident reports in question. We need not and do not reach this question, because the Plaintiffs have failed to preserve this argument.

Garey v. James S. Farrin, P.C., 35 F.4th 917, 927–28 (4th Cir. 2022) (citations omitted). Ultimately, the court of appeal did not decide the issue of whether an accident report is a “motor vehicle record” under the DPPA, so it remains an open question in the Fourth Circuit. Since the Fourth Circuit’s ruling in Garey, another district court in the Fourth Circuit has found that when it is not disputed that the personal information contained in each accident report came from a NCDMV database, those reports are a “motor vehicle record.” McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F. Supp. 3d 769, 777 (M.D.N.C. 2023). The Court concludes that all of the DMV-349 Crash Reports in which the box ‘Same address as driver’s license’ is checked are motor vehicle records under the statutory definition. Plaintiff’s accident report and the accident reports of the class

members include that checked box. Thus, the personal information disclosed from the DMV-349 accident reports with the appropriate box checked are disclosed from a “motor vehicle record.” However, even if an accident report standing alone is not considered a “motor vehicle record,” Plaintiff has also established that the personal information in the accident reports which contain “dataclips” came from the DMV database. (Doc. No. 34 at 17–19). When using the ReportBeam software, the F11 key causes the officer’s

computer to automatically fill-in the blanks on the DMV-349 form with the driver’s personal information, including her name and address. (Doc. No. 32-1, CMPD Dep. I at 25:4–10, 118:20–119:8). Using auto-populate for the DMV-349, means the driver’s name and address come from the DMV database. (Doc. No. 32-1, CMPD Dep. I at 21:20–22:1, 25:4–10, 119:2–120:8; Doc. No. 32-4, Prince Aff., at ¶¶ 4–7). The presence of the “dataclip” associated with a particular report shows that

the CMPD officer used the auto-populate feature to insert the driver’s personal information taken from the DMV database into the accident report. (Doc. No. 33-2, Selvaraj Decl. at ¶ 3; Doc. No. 33-3, Supp. Selvaraj Decl. ¶¶ 2(d), 3). In opposition, Defendant contends, as its witness Nathan Crum explained, that he and other BLET instructors—past and present—always train CMPD police recruits not to use the auto-populate F-11 function when filling out the demographic information in a DMV-349, but rather to fill in the individual’s information such as driver’s license number, name, address, etc. manually on the report. Defendant uses this information to assert that officer’s do not use the F-11 function.

Viewing the facts in the light most favorable to Defendant, the Court concludes that a reasonable jury could not find in favor of Defendant. Defendant does not meaningfully dispute the fact that a “dataclip” shows that the information in an accident report originated with the DMV database. Instead, Defendant challenges how the evidence was obtained and contends that officers were trained not to auto- populate the information into the accident report. This is insufficient to create a genuine issue of material fact.

In sum, the Court concludes that a DMV-349 accident report where the “Same address as driver’s license” is checked is a “motor vehicle record” as a matter of law. Thus, the disclosure of personal information from this report for an impermissible purpose is a violation of the DPPA. Accident reports belonging to Plaintiff and the class members have the “Same address as driver’s license” box checked, and are thus, “motor vehicle records” subject to DPPA protection. Further, even if the DMV-349

accident reports could not be said to be “motor vehicle records,” Plaintiff has established that the presence of a “dataclip” indicates that the materials were auto- populated from the DMV database. Thus, even if the definition of a “motor vehicle record” is limited to documents held by a state DMV, Plaintiff can still prevail by showing the information came from the DMV database. See Maracich v. Spears, 570 U.S. 48, 52 (2013) (“Respondents are trial lawyers . . . [who] obtained names and addresses of thousands of individuals from the South Carolina DMV in order to send [attorney solicitation materials].”); see also Garey, 35 F.4th at 927. 3. For a purpose not permitted under the statute

Marketing is not a permissible purpose for disclosing protected information from motor vehicle records under the DPPA. Maracich v. Spears, 570 U.S. 48, 66–67 (2013). Here, Plaintiff’s evidence shows that CMPD knew, since at least 2011, that marketers, including law firms that CMPD employees referred to as “ambulance chasers,” acquired reports in bulk directly from its records division. (Doc. No. 32-6, CMPD Dep. II, at 18:16–20:6). CMPD nevertheless did not redact any of the personal

information on the DMV-349s it made available to the public. (Doc. No. 19 at ¶ 53; Doc. No. 32-1, CMPD Dep. I, at 147:9–20; Doc. No. 32-6, CMPD Dep. II, at 31:19–24). Defendant asserts that the purpose of disclosure, to the extent that reports were disclosed, was not improper because the information was made available pursuant to North Carolina public records law and an opinion of the North Carolina attorney general. (Doc. No. 52 at 7). See 2005 N.C. AG Lexis 1. This argument has

failed at least once before, and the Court finds no reason to reach a different result now. See Gaston, 483 F. Supp. 3d at 346–47 (concluding that “to the extent that CMPD provides such records to the public without redacting that personal information or limiting disclosure only for those uses permitted by the DPPA then it is in violation of the statute” whether or not they are “public records” and reasoning that “it would completely undermine the purpose of the DPPA if a state could simply designate a document containing personal information subject to DPPA protection as a ‘public record’ and thereby avoid complying with its restrictions’); see also McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F. Supp. 3d 769, 777 (M.D.N.C. 2023) (rejecting the argument that a police department’s release of personal information in response to a public records request falls within the “sovernment function” exception to the DPPA). 4. Damages Further, section 2724 provides that a person who violates the statute “shall be liable to the individual to whom the information pertains” and that “[t]he court may award... actual damages, but not less than liquidated damages in the amount of $2,500.” 18 U.S.C. § 2724. Plaintiff seeks only liquidated statutory damages. Because Plaintiff has shown a violation of DPPA as a matter of law, she, and those similarly situated, are entitled to statutory damages. Accordingly, Plaintiffs Motion for Summary Judgment is granted. IV. CONCLUSION IT IS, THEREFORE, ORDERED that: 1. Defendant’s Motion to Dismiss and Motion for Summary Judgment, (Doc. No. 39), are DENIED; 2. Plaintiff's Motion to Certify Class, (Doc. No. 36), is GRANTED; and 3. Plaintiff's Motion for Summary Judgment, (Doc. No. 32), is GRANTED. Signed: September 24, 2024 4 Cn Of 43 Robert J. Conrad, Jr. : es TInited Statec Tyictrict Tnidoe ee a