Marcy Johnson v. West Publishing Corporation

504 F. App'x 531

• Court: Court of Appeals for the Eighth Circuit
• Decided: April 9, 2013
• Docket: 12-1172, 12-1176
• Status: Unpublished

Opinion

PER CURIAM.

Marcy Johnson brought this putative class action against West Publishing Corporation (“West”), alleging that it “improperly] and unlawfully] ... obtained, ac quired, disclosed, sold and/or disseminated [Johnson’s] and putative Class members’ personal information or highly restricted personal information for commercial purposes and profit, as prohibited by [the Driver’s Privacy Protection Act (DPPA), 18 U.S.C. §§ 2721-2725].” West moved pursuant to Federal Rule of Civil Procedure 12(c) for judgment on the pleadings, which the district court denied. The district court concluded that the DPPA does not permit a reseller of personal information, such as West, to obtain driver’s license information from a state or third party when the reseller’s only purpose is to resell the information to other third parties. Johnson v. West Publ’g. Corp., 801 F.Supp.2d 862, 864 (W.D.Mo.2011). The district court also found that the DPPA does not permit a reseller to “disclose the entire database to a business or individual having only a potential future use for some of the information sold, so long as there is no evidence of specific misuse, such as identity theft or stalking.” Id. at 864-65. On appeal, West argues that the district court’s interpretation of the DPPA is contrary to this court’s interpretation of the DPPA in Cook v. ACS State & Local Solutions, Inc., 668 F.3d 989 (8th Cir.2011). Because we find that Cook is controlling, we reverse the judgment of the district court and remand for further proceedings consistent with this opinion.

I. Background

Johnson filed suit “on behalf of herself and all others similarly situated” against West, alleging that West “obtained, acquired, disclosed, sold, and/or disseminated [Johnson’s] and putative Class members’ personal information or highly restricted personal information for commercial purposes and profit, as prohibited by law.” According to the complaint, West “special-iz[es] in legal publishing, online information delivery, and various other legal information products.” The complaint alleges that West “has obtained and continues to obtain a large database(s) of motor vehicle records, and the corresponding personal information or highly restricted personal information for each such record ... directly from” 29 states and the District of Columbia, “or from entities who acquired it from the States, in violation of the DPPA.”

The complaint maintains that West collected the information from the states “under the pretense that the information would be used only for the legitimate purposes outlined in 18 U.S.C. § 2725(3).” According to the complaint, the information databases that West obtained from the states “contained ‘personal information’ and/or ‘highly restricted personal information’ (as defined by the DPPA, 18 U.S.C. §§ 2721, et seq.), belonging to millions of licensed drivers.” The complaint alleges that West “then made the unlawfully obtained information belonging to [Johnson] and the putative Class members available for search and sale on the Internet via websites controlled and operated by [West].” West’s acquisition and dissemination of “personal information or highly restricted personal information” was allegedly “for purposes not permitted under the DPPA.” Johnson and the putative class assert that they “suffered damages as a result of [West’s] conduct.”

The complaint contains three counts. Count I asserts that West “knowingly obtained, disclosed, and/or sold [Johnson’s] and the putative Class members’ personal information or highly restricted personal information, as defined by the DPPA, for a use or uses not permitted under the statute.” It provides that West “made false representations to the States to obtain [Johnson’s] and the putative Class members’ personal information or highly restricted personal information, and at other times obtained [Johnson’s] and the putative Class members’ personal information or highly restricted personal information from third parties.” Count I prays for “actual damages, but not less than liquidated damages in the amount of $2,500 each.” Count II asserts a claim for unjust enrichment and “seek[s] disgorgement and restitution of the benefits obtained by [West] through its unlawful conduct.” Finally, Count III asserts an injunctive-relief claim based on DPPA violations.

West moved to dismiss Count II of Johnson’s complaint pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted. The district court granted the motion, which “had been based primarily on [the district] [c]ourt’s reasoning in another DPPA case, Wiles v. Southwestern Bell Tel. Co., No. 09-4236-CV-C-NKL, 2010 WL 1463025 (W.D.Mo. Apr. 13, 2010).” Johnson, 801 F.Supp.2d at 867. West then moved for judgment on the pleadings pursuant to Federal Rule of Civil Procedure 12(c).

In denying West’s motion, the district court rejected the majority view that the DPPA “permit[s] wholesale resellers to obtain in bulk every driver’s personal information so long as there is no evidence of specific misuse.” Id. at 866 (citing Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010)). Specifically, the court rejected the conclusion that “a reseller is not limited to obtaining personal information only for a specific customer qualified to use it by the DPPA” and that “the reseller itself [does not need] a right to the information under one of the fourteen exceptions to the DPPA’s rule of nondisclosure.” Id. Additionally, the court disagreed with the notion that “the information can be sold in bulk to purchasers, even though the purchaser is only authorized under the DPPA to receive one piece of information.” Id. The court found “that Congress did not intend the DPPA to authorize this widespread dissemination of private information untethered from the very uses that Congress listed in the DPPA.” Id. at 867.

Following its denial of West’s motion for judgment on the pleadings, the court certified the class. Johnson v. West Publ’g. Corp., No. 2:10-CV-04027-NKL, 2011 WL 3490187 (W.D.Mo. Aug. 9, 2011). 1

After the district court entered its order denying West’s motion for judgment on the pleadings, it certified under 28 U.S.C. § 1292(b) that “the case involves [’]a controlling question of law as to which there is substantial ground for difference of opinion and ... an immediate appeal from the order may materially advance the ultimate termination of the litigation.’ ” (Second alteration in original.) (Quoting 28 U.S.C. § 1292(b).) West subsequently petitioned this court for permission to appeal.

West also petitioned this court for permission to appeal the class certification order under Federal Rule of Civil Procedure 23(f).

We granted both the § 1292(b) and Rule 23(f) applications and consolidated the appeals.

II. Discussion

On appeal, West asserts that the district court erroneously held that Johnson stated cognizable DPPA claims and that class adjudication was appropriate. Specifically, West contends that the district court erred in concluding that the DPPA fails to authorize the bulk acquisition of motor vehicle record information for resale for DPPA-permitted uses. In support of its argument, West relies on Cook. According to West, “Cook addresses the same statutory construction question at issue here— whether the DPPA permits the obtainment in bulk of state motor vehicle record information for resale for DPPA-permitted uses.” West states that this court “joined several of its sister federal circuits and concluded that it does.” West requests that this court reverse the district court’s order denying its motion for judgment on the pleadings and direct the district court to enter judgment in its favor and dismiss as moot Johnson’s motion for class certification.

Johnson makes two arguments in support of affirmance. First, she “respectfully suggests] that the issues and facts presented in this appeal were not sufficiently fleshed out or addressed by the parties in the Cook matter, and that this appeal provides a more complete picture and background of the DPPA.” According to Johnson, Cook’s “reading of the DPPA does not comport with the statute’s full legislative history and the intentions of Congress.” She argues that Cook failed to define the phrase “authorized recipient” and “goes beyond the text of the statute and creates a ‘data repository’ Permissible Purpose for West that is unsupported by either the plain text of the DPPA or its legislative history.” She maintains that the DPPA’s purpose “in providing control over the disclosure of individuals’ Personal Information appears weakened under Cook’s interpretation of the DPPA” because Cook “imposes no limitation on the release of Personal Information to anyone who merely promises to resell such information to those with an alleged Permissible Purpose under § 2721(b).” Johnson urges this court to adopt the district court’s definition of “authorized recipient” and conclude that West is not one under that definition.

Second, Johnson attempts to distinguish Cook, asserting that in that case this court “held that bulk obtainment of Personal Information directly from the State is permitted regardless of whether the person obtaining the information has a Permissible Purpose for the information.” (Emphasis added.) Johnson contends that “West does not obtain Plaintiffs Personal Information from Motor Vehicle Records directly from States: West obtains said information indirectly through a third party, and does so without a Permissible Purpose.” Johnson maintains that “[t]his crucial factual variance from Cook illustrates that West’s conduct exponentially erodes the privacy protections and goals provided for and set forth by the DPPA — protections and goals for which Congress expressly intended in the passage of the DPPA.”

This court applies “de novo [review to] a district court’s [resolution] of a motion for judgment on the pleadings, using the same standard as when we review the [district court’s resolution] of a motion to dismiss under ... Rule ... 12(b)(6).” Gallagher v. City of Clayton, 699 F.3d 1013, 1016 (8th Cir.2012). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Id. (quotations and citations omitted).

The district court denied West’s motion for judgment on the pleadings before we decided Cook. In that case, the plaintiffs brought a “class action suit against a variety of defendants, alleging that each improperly obtained personal driver information from the Missouri Department of Revenue (‘DOR’) in violation of the [DPPA].” 663 F.3d at 991. The plaintiffs’ claims were based

on two separate theories: (1) The bulk obtainment of personal information, which allows a company to “stockpile” information for the sake of convenience when a permissible purpose to use that information arises, is a per se violation of the DPPA; and (2) obtaining an entire database of personal information for the sole purpose of reselling that information to others is also a violation of the DPPA.

Id. The district court granted the defendants’ Rule 12(b)(6) motions to dismiss for failure to state a claim upon which relief can be granted, finding “that neither theory stated a valid claim under the DPPA.” Id.

On appeal, we affirmed the district court’s dismissal of the plaintiffs’ DPPA claims. First, we addressed the plaintiffs’ “stockpiling” argument, i.e., that the defendants “obtained records in bulk merely for the convenience of maintaining their own motor vehicle record databases in anticipation of future use, and therefore have violated the DPPA as to each record Defendants did not put to an immediate permissible use.” Id. at 994. We noted that the plaintiffs “d[id] not contend that Defendants actually misused drivers’ personal information, nor d[id] they dispute that Defendants might have put some information to an end use permitted under section 2721(b).” Id. We held that “[b]ulk obtainment of driver information for a permissible purpose does not violate the DPPA.” Id. at 996. As a result, the plaintiffs were unable to “establish a violation of the DPPA if all the defendants have done is obtain driver information in bulk for potential use under a permissible purpose.” Id.

Second, we addressed the plaintiffs’s “resale” argument. Id. “Some of the Defendants in [Cook] obtained personal information in bulk from the Missouri DOR not for their own permissible use, but to sell to third parties who have permissible uses of their own.” Id. The plaintiffs argued that although § 2721(c) permits “the resale and redistribution of personal information, ... this section does not provide a stand-alone justification for businesses to obtain records from the state.” Id. According to the plaintiffs, “the DPPA requires resellers to have their own permissible use for personal information before selling it to third parties.” Id. They “interpreted] the phrase ‘authorized recipient’ under section 2721(c) as an individual or entity who has an immediate permissible use for the information under section 2721(b).” Id. After citing as persuasive authority cases from the Fifth and Seventh Circuits — Graczyk v. West Publishing Co., 660 F.3d 275, 280-81 (7th Cir.2011), and Taylor, 612 F.3d at 339 — we concluded that “[s]ection 2721(c) explicitly permits the resale of drivers’ information, and it does not require that resellers must first use the information themselves.” Id. at 997. Therefore, the plaintiffs were unable to “establish a DPPA violation by alleging that Defendants obtained personal information with the sole purpose of selling it to third parties who have permissible section 2721(b) uses for the information.” Id.

Cook’s holdings — that “[plaintiffs cannot establish a violation of the DPPA if all the defendants have done is obtain driver information in bulk for potential use under a permissible purpose,” id. at 996, and “[plaintiffs cannot establish a DPPA viola tion by alleging that Defendants obtained personal information with the sole purpose of selling it to third parties who have permissible section 2721(b) uses for the information,” id. at 997 — are applicable to the present case. As in Cook, Johnson has not alleged that West “actually misused drivers’ personal information,” see id. at 994; instead, she has only alleged that West had an invalid purpose because it “obtained, acquired, disclosed, sold and/or disseminated ... personal information for commercial purposes and profit.” Johnson essentially asks us to reject Cook because it was ill-reasoned. But “[i]t is well established, however, that one panel of this Court may not overrule another and so we must decline [Johnson’s] invitation to reconsider our prior decision.” See United States v. Franklin, 250 F.3d 658, 665 (8th Cir.2001).

Nor do we agree with Johnson that Cook is distinguishable from the present case because Cook involved the bulk obtainment of personal information directly from the state, as opposed to the state and other entities. First, Cook’s holdings were not premised on where the reseller first obtained the information. Second, Grac-zyk — which we relied on in Cook — involved a complaint that is virtually identical to the present complaint. 2 The Graczyk complaint alleged, among other things, “that West Publishing acquires the personal information contained in motor vehicle records of millions of drivers from state DMVs (or from entities that have acquired the information from state DMVs) for resale in violation of the DPPA.” 660 F.3d at 276 (emphasis added). The district court granted West’s motion to dismiss pursuant to Rule 12(b)(6), and the Seventh Circuit affirmed. Id. The Seventh Circuit held that “the DPPA does not prohibit West Publishing from reselling the plaintiffs’ personal information to those with permissible uses under the Act.” Id. Because the complaint alleged that West acquired its database of motor vehicle records both directly from the states and from other entities “that have acquired the information from state DMVs,” id., the Seventh Circuit’s holding was not restricted to the reseller obtaining the information only directly from the states.

III. Conclusion

Accordingly, we reverse the district court’s denial of West’s motion for judgment on the pleadings and remand for further proceedings consistent with this opinion. Because West is entitled to judgment on the pleadings, we necessarily reverse the district court’s order granting Johnson’s motion to certify the class. On remand, we direct the court to dismiss as moot Johnson’s motion for class certification.

1 . The district court certified the following class:

All persons who registered a motor vehicle in, or were issued a driver’s license or state identification card by, the States of Alabama, Alaska, Colorado, Connecticut, Florida, Idaho, Illinois, Iowa, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, New York, North Dakota, Ohio, Tennessee, Texas, Utah, Wisconsin, Wyoming and the District of Columbia, whose personal information or highly restricted personal information, as defined by 18 U.S.C. § 2725(3) and (4), was obtained, disclosed, or sold by Defendant, or any agent, officer, employee, or contractor of Defendant between February 19, 2006 and the date of final judgment in this matter (the “Class”). The Class excludes Defendant’s directors, officers, parent corporations, subsidiaries, and affiliates.

Id. at *3.

2 . The Graczyk plaintiffs filed their complaint in the United States District Court for the Northern District of Illinois. The district court case number is l:09-cv-04760.