UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE
Michael Ives
v. Civil No. 23-cv-432-LM Opinion No. 2024 DNH 034 P Bath & Body Works, LLC
ORDER
Plaintiff Michael Ives brings this putative class action against defendant
Bath & Body Works, LLC, alleging that defendant violated the New Hampshire
Driver Privacy Act (“Driver Privacy Act”), RSA 260:14, by transmitting information
from plaintiff’s driver’s license to a third party without his consent. Presently before
the court is defendant’s motion to dismiss for lack of standing pursuant to Federal
Rule of Civil Procedure 12(b)(1) and for failure to state a claim upon which relief
may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). See doc. no.
16. For the following reasons, the court finds that plaintiff has sufficiently alleged
standing but fails to state a claim upon which relief may be granted. The court
therefore grants the motion to dismiss.
STANDARDS OF REVIEW
There are two ways to challenge a court’s subject-matter jurisdiction under
Rule 12(b)(1). Freeman v. City of Keene, 561 F. Supp. 3d 22, 25 (D.N.H. 2021). First,
the defendant may challenge the sufficiency of the allegations relied upon in the
complaint to support jurisdiction. Id. Alternatively, the defendant can challenge the accuracy of the complaint’s jurisdictional allegations. Id. The court’s standard of
review differs depending on the challenge brought. Id. Where a defendant
challenges the sufficiency of the complaint’s jurisdictional facts, the standard of
review is the same as the Rule 12(b)(6) standard. Id. Where a defendant challenges
the accuracy of the plaintiff’s allegations, those allegations “are entitled to no
presumptive weight,” and “the court must address the merits of the jurisdictional
claim by resolving the factual disputes between the parties.” Valentin v. Hosp. Bella
Vista, 254 F.3d 358, 363 (1st Cir. 2001).
Here, defendant challenges only the sufficiency of the facts alleged in the
complaint that would support the existence of jurisdiction. Therefore, the court
considers both of defendant’s arguments for dismissal under the 12(b)(6) standard.
Under Rule 12(b)(6), the court must accept the factual allegations in the
complaint as true, construe reasonable inferences in the plaintiff’s favor, and
“determine whether the factual allegations in the plaintiff’s complaint set forth a
plausible claim upon which relief may be granted.” Foley v. Wells Fargo Bank, N.A.,
772 F.3d 63, 68, 71 (1st Cir. 2014) (quotation omitted). A claim is facially plausible
“when the plaintiff pleads factual content that allows the court to draw the
reasonable inference that the defendant is liable for the misconduct
alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Analyzing plausibility is “a
context-specific task” in which the court relies on its “judicial experience and
common sense.” Id. at 679.
2 BACKGROUND
The court draws the following factual summary from the limited allegations
in the complaint. Within the last three years, plaintiff has made multiple returns to
one of defendant’s retail stores in Manchester, New Hampshire. He did not present
a receipt for his items at the time of these returns. When customers make non-
receipted returns at defendant’s stores, defendant provides them with store credit
via “stored value cards,” which are similar to gift cards. In addition to making non-
receipted returns, plaintiff has also made purchases using store credit on stored
value cards at this same retail location within the last three years.
When making non-receipted returns or purchasing items using in-store
credit, defendant required plaintiff to present his driver’s license. Defendant then
transmitted information on plaintiff’s driver’s license to an entity known as “The
Retail Equation.” According to the complaint, The Retail Equation provides
software used by retailers to analyze customers’ shopping habits in order to
determine whether a particular transaction may be fraudulent. Plaintiff alleges
that he was not aware that defendant would transmit the information on plaintiff’s
license to a third party in order to process his transactions.
Plaintiff brought the instant putative class action in New Hampshire
Superior Court on or about July 28, 2023. His complaint alleges two claims against
defendant, both of which arise under the Driver Privacy Act. Defendant removed
plaintiff’s action to this court on or about September 13, 2023, pursuant to the Class
3 Action Fairness Act of 2005 (“CAFA”), Pub. L. No. 109-2, 119 Stat. 4 (codified in
scattered sections of 28 U.S.C.).1
DISCUSSION
Plaintiff’s first claim alleges that defendant violated RSA 260:14, IX(a) by
disclosing information on his driver’s license to The Retail Equation. That
subparagraph provides in pertinent part:
A person is guilty of a misdemeanor if such person knowingly discloses information from a department record to a person known by such person to be an unauthorized person . . . . Each such unauthorized disclosure . . . shall be considered a separate offense.
RSA 260:14, IX(a). His second claim alleges that defendant violated RSA 260:14,
IX(b) by engaging in this same conduct. That subparagraph provides that a “person
is guilty of a class B felony if, in the course of business, such person knowingly sells,
rents, offers, or exposes for sale motor vehicle records to another person in violation
of this section.” RSA 260:14, IX(b). Although both subparagraphs speak in terms of
criminal liability, another provision of the statute states that “any person aggrieved
by a violation of this section may bring a civil action.” RSA 260:14, X. A successful
1 The court notes that this action is one of several materially identical putative
class actions recently removed to this court alleging that retailers violate the Driver Privacy Act when they provide customers’ driver’s license information to The Retail Equation. See Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---, 2023 WL 8787578 (D.N.H. Dec. 19, 2023) (appeal filed); Bourgeois v. The Gap, Inc., Civ. No. 23-cv-394- LM-TSM, 2023 WL 9689611 (D.N.H. Dec. 20, 2023); Bourgeois v. The TJX Cos., Inc., Civ. No. 23-cv-354-PB (D.N.H. Jan. 5. 2024); see also Stewart v. Burlington Coat Factory Warehouse Corp., Civ. No. 23-cv-468-JL-TSM. 4 plaintiff may obtain the greater of actual damages or statutory damages of $2,500
“for each violation,” as well as attorneys’ fees and costs. Id.
Defendant moves to dismiss both counts. First, defendant argues that
plaintiff lacks standing to maintain this action because he fails to allege an actual,
concrete injury. Second, defendant argues that plaintiff fails to state a claim
because the Driver Privacy Act does not provide for liability in these circumstances.
The court must first consider standing. See Steel Co. v. Citizens for a Better Env’t,
523 U.S. 83, 94-95 (1998).
I. Plaintiff Plausibly Alleges Standing
Article III of the Constitution limits federal courts’ jurisdiction to “Cases” and
“Controversies.” U.S. Const. art III, § 2. “The doctrine of standing emanates from
the case-or-controversy requirement; it ‘developed . . . to ensure that federal courts
do not exceed their authority as it has been traditionally understood.’” Freeman,
561 F. Supp. 3d at 30 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016))
(alteration in Freeman). For a plaintiff to have standing, he must have suffered a
“concrete” injury. TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021).
“A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Spokeo,
578 U.S. at 340. A concrete injury may be tangible or intangible. Id. Tangible harms
include “traditional . . . harms, such as physical harms and monetary harms.”
TransUnion, 594 U.S. at 425. Intangible harms include “injuries with a close
relationship to harms traditionally recognized as providing a basis for lawsuits in
American courts,” such as “disclosure of private information.” Id. History is an
5 important touchstone “[b]ecause the doctrine of standing derives from the case-or-
controversy requirement, and because that requirement in turn is grounded in
historical practice.” Spokeo, 578 U.S. at 340-41. However, a plaintiff’s alleged injury
for standing purposes need not be “an exact duplicate” of a harm traditionally
recognized as constituting the basis for a cause of action. TransUnion, 594 U.S. at
424.
Moreover, where a legislature has conferred a cause of action for violation of
a statutory prohibition, the legislature’s “judgment is instructive and important” in
discerning whether the plaintiff has suffered an intangible yet concrete harm.
Spokeo, 578 U.S. at 341. “Courts must afford due respect to [a legislature’s] decision
to impose a statutory prohibition or obligation on a defendant, and to grant a
plaintiff a cause of action to sue over the defendant’s violation of that statutory
prohibition or obligation.” TransUnion, 594 U.S. at 425. Indeed, a “legislature may
‘elevate to the status of legally cognizable injuries concrete, de facto injuries that
were previously inadequate in law.’” Bryant v. Compass Grp. USA, Inc., 958 F.3d
617, 621 (7th Cir.) (quoting Spokeo, 578 U.S. at 341), amended on denial of reh’g en
banc, 2020 WL 6534581 (7th Cir. 2020). Where a plaintiff plausibly alleges the
deprivation of certain “procedural right[s] granted by statute . . . [he] need not
allege any additional harm beyond the one [the legislature] has identified.” Spokeo,
578 U.S. at 342 (emphasis omitted).
However, the creation of a cause of action for a statutory violation cannot
“automatically” confer standing upon the plaintiff. Id. at 341. Thus, a “bare
6 procedural violation” does not confer standing. Id.; see also TransUnion, 594 U.S. at
427 (“Article III grants federal courts the power to redress harms that defendants
cause plaintiffs, not a freewheeling power to hold defendants accountable for legal
infractions.” (quoting Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th
Cir. 2019) (Barrett, J.)). At the end of the day, although a legislature’s judgment is
entitled to consideration, the “creation of a statutory prohibition . . . and a cause of
action does not relieve courts of their responsibility to independently decide whether
a plaintiff has suffered a concrete harm under Article III.” TransUnion, 594 U.S. at
426.
Importantly, “standing in no way depends on the merits of the plaintiff’s
contention that particular conduct is illegal.” Hochendoner v. Genzyme Corp., 823
F.3d 724, 734 (1st Cir. 2016) (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)).
“For standing purposes, we accept as valid the merits of [plaintiff’s] legal
claims . . . .” Fed. Election Comm’n v. Cruz, 596 U.S. 289, 298 (2022). Thus, in
assessing a motion to dismiss for lack of standing, the “only question is, putting the
merits aside, whether [plaintiff] plausibly alleges [he] was injured under [his]
theory of the underlying legal claim.” Laufer v. Acheson Hotels, LLC, 50 F.4th 259,
267 (1st Cir. 2022), vacated and remanded on other grounds, 144 S. Ct. 18 (2023).
As noted, plaintiff alleges that defendant disclosed information on his driver’s
license to a third party without plaintiff’s knowledge or consent in violation of the
7 Driver Privacy Act.2 Defendant contends that the unauthorized disclosure of
information on plaintiff’s driver’s license does not constitute a concrete injury
sufficient to confer standing. Although defendant acknowledges that the
unauthorized disclosure of private information can be a concrete injury in some
circumstances, defendant contends that the information contained within a driver’s
license is not private because persons routinely show their license to strangers and
because most of the information contained in a driver’s license is readily discernible
(such as hair color) or is a matter of public record (such as a person’s legal address).
The Fourth Circuit considered a closely analogous set of facts in Garey v.
James S. Farrin, P.C., 35 F.4th 917 (4th Cir. 2022). The defendants in that case
were a group of personal injury lawyers who obtained car accident reports from law
enforcement agencies and private entities. 35 F.4th at 919. The defendants used the
personal information revealed on those reports—the names and addresses of the
drivers—to solicit clients. Id. The drivers who received the defendants’ solicitations
brought suit alleging that the defendants violated the Driver Privacy Act’s federal
counterpart, the Driver’s Privacy Protection Act (“DPPA”), 18 U.S.C. § 2721 et seq.
Id. at 919-20. Like New Hampshire’s Driver Privacy Act, DPPA establishes a cause
of action against persons who obtain or use personal information from motor vehicle
records for an unauthorized purpose. See 18 U.S.C. § 2724(a); Garey, 35 F.4th at
2 For purposes of resolving the standing issue and in keeping with the standing
inquiry at the motion to dismiss stage, the court will assume that defendant’s alleged actions violated the Driver Privacy Act and that defendant’s alleged conduct is actionable under that Act. 8 920. Applying TransUnion, the Fourth Circuit held that the plaintiffs alleged a
privacy injury that was closely related to the common law tort of invasion of
privacy, “which has long provided a basis for recovery at common law.” Garey, 35
F.4th at 921 (quotation omitted). The court reasoned that, by enacting DPPA,
“Congress responded to the harms of actual people by creating a cause of action that
protects their particular and concrete privacy interests.” Id. at 922 (quoting
Krakauer v. Dish Network, LLC, 925 F.3d 643, 653 (4th Cir. 2019)).
The court follows the Fourth Circuit’s reasoning in Garey. Here, plaintiff has
alleged that defendant disclosed information from his driver’s license without his
knowledge or consent on multiple occasions. He alleges that this information
included, among other things, his name, his driver identification number, his
address, and medical or disability information. See doc. no. 5 at 3. Plaintiff has
adequately alleged an invasion of his privacy that bears a sufficiently close
relationship to a harm traditionally recognized in American law. See Garey, 35
F.4th at 921-22; see also TransUnion, 594 U.S. at 425 (recognizing that disclosure of
private information can be sufficient to confer standing).
Further support for the existence of standing is found in the Seventh Circuit’s
opinion in Bryant v. Compass Group USA, Inc.3 At issue there was an Illinois state
law that required any entity collecting persons’ “biometric identifiers or
information” (such as their fingerprints or their facial features for facial recognition
3While Bryant preceded the Supreme Court’s opinion in TransUnion, the Seventh Circuit has held that Bryant remains good law post-TransUnion. See Cothron v. White Castle Sys., Inc., 20 F.4th 1156, 1161 (7th Cir. 2021). 9 technology) to obtain the written, informed consent of persons whose information
was acquired, and established a cause of action for any person whose biometric
information was obtained in violation of the statute. Bryant, 958 F.3d at 619. The
plaintiff’s employer installed the defendant’s fingerprint-operated vending machines
in the employer’s cafeteria, and the plaintiff used the vending machines. Id. The
defendant failed to inform the plaintiff that her biometric identifier was being
collected and did not obtain her written consent to collect, store, or use her
fingerprint. Id. Although it was uncontested that the plaintiff knew her fingerprint
was being collected and stored, she brought a putative class action alleging that the
defendant failed to obtain her informed, written consent in violation of the Illinois
state law. Id. at 619-20.
The plaintiff originally brought her action in Illinois state court, but the
defendant removed pursuant to CAFA. Id. at 620. The plaintiff thereafter moved to
remand, arguing that federal jurisdiction did not exist because her complaint failed
to allege a concrete injury for standing purposes.4 Id. The district court granted the
motion to remand, finding that the plaintiff’s allegations did not support standing,
but the court of appeals granted the defendant’s petition to appeal the remand order
and took up the standing issue. Id.; see 28 U.S.C. § 1453(c) (allowing for
discretionary appeal of remand to state court of class action previously removed to
federal court under CAFA).
4 The Seventh Circuit noted that Illinois state law does not have as stringent
a standing requirement as exists under the case-or-controversy requirement. See 958 F.3d at 622. 10 On appeal, the Seventh Circuit held that the plaintiff had alleged an injury
sufficient to confer Article III standing. By collecting the plaintiff’s fingerprint
information without her informed consent, the defendant committed “no bare
procedural violation; it was an invasion of her private domain.” 958 F.3d at 624. The
court analogized the defendant’s alleged conduct to the common law tort of trespass,
which seeks to protect an individual’s personal rights in his or her land. See id.; see
also Spokeo, 578 U.S. at 344 (Thomas, J., concurring) (explaining that “courts
historically presumed that the plaintiff suffered a de facto injury merely from
having his personal, legal rights invaded. Thus, when one man placed his foot on
another’s property, the property owner needed to show nothing more to establish a
traditional case or controversy”). Moreover, the requirement to obtain a person’s
informed consent to collect their biometric data was not an ancillary requirement of
the at-issue Illinois law; it was at the law’s “heart.” 958 F.3d at 626. Indeed, the
manifest purpose of the statute “is to ensure that consumers understand, before
providing their biometric data, how that information will be used, who will have
access to it, and for how long will it be retained.” Id. Highlighting “[t]he judgment of
[the] Illinois[ ] General Assembly . . . that the sensitivity of biometric information
and the risk of . . . privacy . . . harm that may result from its dissemination
necessitates that people be given the opportunity to make informed choices about to
whom and for what purpose they will relinquish control of that information,” the
court found that a failure to obtain a person’s informed consent in violation of the
Illinois law constituted a concrete injury for Article III purposes. Id.
11 The Seventh Circuit’s analysis in Bryant supports standing here. While at
least some of the information contained in a person’s driver’s license is readily
observable, so too are a person’s facial features for purposes of biometric
identification. The mere fact that a person’s information may be readily observable
or a matter of public record does not mean that the unauthorized intrusion upon
such information fails to establish a concrete injury. A person’s yard may be visible
from a public street; that does not give passersby the right to intrude upon private
property. See Spokeo, 578 U.S. at 344 (Thomas, J., concurring). Indeed, the very
existence of the Driver Privacy Act contemplates that certain information contained
within “department records” and “motor vehicle records” may not be disclosed
except in accordance with the Act, even if that information might be publicly
available elsewhere. See RSA 260:14, IX(a)-(b).5 Far from a mere technical violation,
the unauthorized disclosure of drivers’ records is at the “heart” of the Driver Privacy
Act. See DeVere v. Att’y Gen., 146 N.H. 762, 764-65 (2001) (explaining the genesis
of the Driver Privacy Act and noting its “general rule that motor vehicle ‘records
shall not be public records or open to the inspection of any person’” (quoting RSA
260:14, II(a))); Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---, 2023 WL
8787578, at *3-4 (D.N.H. Dec. 19, 2023) (explaining restrictions imposed by the
Driver Privacy Act). Plaintiff is not “merely seeking to ensure a defendant’s
5 The First Circuit has recognized that the misuse of a person’s name—which
is otherwise generally public information—may constitute an injury in fact for standing purposes. See Webb v. Injured Workers Pharm., LLC, 72 F.4th 365, 373 (2023). 12 ‘compliance with regulatory law,’” TransUnion, 594 U.S. at 427 (quoting Spokeo,
578 U.S. at 345 (Thomas, J., concurring)), he is seeking vindication for “a violation
of [his] own rights . . . an invasion of [his] private domain,” Bryant, 958 F.3d at 624.
Defendant’s arguments against the existence of standing are not persuasive.
Defendant points to district court orders in other circuits in which courts have
found that the unauthorized disclosure of information within a driver’s license
failed to state various claims upon which relief could be granted. See Rasmussen v.
Chisago Cnty., 991 F. Supp. 2d 1065, 1078-79 (D. Minn. 2014) (plaintiff’s allegations
failed to meet the “high threshold of offensiveness and expectation of privacy”
needed to state claim for intrusion upon seclusion under Minnesota state law);
Rollins v. City of Albert Lea, 79 F. Supp. 3d 946, 957-59 (D. Minn. 2014) (plaintiff
failed to plausibly allege dissemination of “highly personal matters representing the
most intimate aspects of human affairs” necessary to state claim for violation of
constitutional right to privacy (quotation omitted)); Sutherland v. Massa, Case No.
08-5129-CV-SW-RED, 2010 WL 11545751, at *2 (W.D. Mo. Sept. 16, 2010) (plaintiff
failed to plausibly allege that disclosure of information in driver’s license “would be
highly offensive to a reasonable person” as required to state claim for invasion of
privacy claim under Missouri state law); Phillips v. Bailey, 337 F. Supp. 2d 804,
806-07 (W.D. Va. 2004) (plaintiff failed to state § 1983 claim for violation of his
Fourth Amendment rights because plaintiff did not have a reasonable expectation of
privacy in information shared with a third party such as the DMV).
13 In none of these cases, however, did the court consider whether the plaintiff
had Article III standing.6 While intangible harms bearing “a close relationship to
harms traditionally recognized as providing a basis for lawsuits in American courts”
confer standing to sue, TransUnion, 594 U.S. at 425, Article III does “not require an
exact duplicate,” id. at 433. Garey and Bryant show that the unauthorized
disclosure of personal information from a driver’s license in violation of a statutory
prohibition may constitute a concrete injury sufficient to confer standing—
especially where that unauthorized disclosure causes the plaintiff to “suffer[ ] injury
in precisely the form the statute was intended to guard against.” Havens Realty
Corp. v. Coleman, 455 U.S. 363, 373 (1982); see also Spokeo, 578 U.S. at 342
(explaining that “the violation of a procedural right granted by statute can be
sufficient in some circumstances to constitute an injury in fact”). Here, the harm
plaintiff alleges bears a sufficiently close relationship to an invasion of privacy
traditionally recognized in American law, even if that harm is not a mirror image of
the specific causes of action that were at issue in the cases defendant relies upon.
Defendant also argues that plaintiff lacks standing because he does not allege
he suffered monetary harm as a result of the unauthorized disclosure. However,
6 While defendant also cites, in a footnote, to cases where district courts in
other circuits have found that the disclosure of information on driver’s licenses failed to confer Article III standing, these were data breach cases that concerned the requirement that a plaintiff’s injury be imminent, not the requirement that a plaintiff’s injury be concrete. Here by contrast, defendant does not argue that the injury plaintiff complains of is not imminent—nor could it, since plaintiff alleges that the disclosure of his driver’s license information in violation of the Driver Privacy Act has already occurred. 14 while “actual economic loss . . . is the prototypical concrete harm,” Gustavsen v.
Alcon Labs., Inc., 903 F.3d 1, 8 (1st Cir. 2018), concrete harms also include
intangible harms that are “actionable without wallet injury,” Amrhein v. eClinical
Works, LLC, 954 F.3d 328, 331 (1st Cir. 2020). Here, plaintiff has sufficiently
alleged an intangible harm for the reasons discussed above.
For these reasons, the court finds that plaintiff has sufficiently alleged
standing at the motion to dismiss stage. The court next considers defendant’s
second ground for dismissal: whether plaintiff has stated a claim upon which relief
can be granted.
II. Plaintiff Fails to State a Claim Upon Which Relief Can Be Granted
The complaint in this case is materially identical to the complaint before this
court in Home Depot. See Home Depot, 2023 WL 8787578, at *1.7 The court finds
that neither Count I nor Count II of plaintiff’s complaint states a claim upon which
relief can be granted for the same reasons the identical causes of action failed to
state claims in Home Depot. With respect to Count I, plaintiff’s driver’s license is
not a “department record” within the meaning of RSA 260:14, IX(a). With respect to
Count II, his driver’s license is not a “motor vehicle record” within the meaning of
RSA 260:14, IX(b), and plaintiff failed to plausibly allege that defendant sold,
rented, offered, or exposed for sale his driver’s license or the information contained
therein.
7 For this reason, the court denies defendant’s request for a hearing on its
motion to dismiss. 15 The clerk of court is directed to enter judgment and close the case.
SO ORDERED.
__________________________ Landya McCafferty United States District Judge
April 18, 2024
cc: Counsel of Record