Summary
holding that state officials can be held personally liable for DPPA violations
Summary of this case from Rine v. Imagitas, Inc.Opinion
No. 06-12614.
February 12, 2007.
Joel S. Perwin, Miami, FL, for Plaintiffs-Appellants.
Jason Vail, Tallahassee, FL, for Defendants-Appellees.
Appeal from the United States District Court for the Southern District of Florida.
Before BLACK, BARKETT and KRAVITCH, Circuit Judges.
Mary Ann Collier, Arthur L. Wallace, Roy McGoldrick, and Robert Pino, as well as the putative class of all other similarly situated individuals (collectively "Plaintiffs"), appeal the dismissal of their Second Amended Complaint against Fred O. Dickinson III, Carl A. Ford, and Sandra Lambert (collectively "Defendants"). Defendants, who are executive-level officials at the Florida Department of Highway Safety Motor Vehicles ("DHSMV"), were sued in their individual capacity for selling the personal information that Plaintiffs provided to the DHSMV in order to obtain their drivers' licenses and/or vehicle registrations to mass marketers, in violation of the Driver Privacy Protection Act ("DPPA"), 18 U.S.C. § 2721- 2725.
In addition to a direct claim under the DPPA, Plaintiffs also sued for relief under 42 U.S.C. § 1983, which imposes liability on anyone who, under color of state law, deprives a person "of any rights, privileges, or immunities secured by the Constitution and laws." Specifically, Plaintiffs alleged that the sale of personal information violated their constitutional right to privacy, in addition to their rights protected by the DPPA. The district court granted Defendants' motion to dismiss all claims in the complaint on the grounds that Defendants were entitled to qualified immunity.
Qualified immunity offers protection for government officials, acting within their discretionary authority, who are sued in their individual capacities as long as "their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." Harlow v. Fitzgerald, 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982) (citation omitted). We review a district court's grant of a motion to dismiss based on qualified immunity de novo and accept well-pleaded allegations as true, construing facts in the light most favorable to the plaintiffs. Maggio v. Sipple, 211 F.3d 1346, 1350 (11th Cir.2000).
To act within the scope of discretionary authority means that "the actions were (1) undertaken pursuant to the performance of [the official's] duties and (2) within the scope of [his] authority." Lenz v. Winburn, 51 F.3d 1540, 1545 (11th Cir.1995) (quotation marks and citations omitted). We find no error in the district court's determination that Defendants were acting within their discretionary duties when they sold motor vehicle record information to mass marketers. The parties agree that Defendants are high level executive officials who are required to exercise discretionary authority to develop and implement policy decisions regulating the dissemination of the DHSMV's motor vehicle records. They are essentially responsible for the distribution of motor vehicle record information. Accordingly, the acts complained of — the improper release of the information — were "within, or reasonably related to, the outer perimeter of [Defendants'] discretionary duties." Harbert Int'l Inc. v. James, 157 F.3d 1271, 1282 (11th Cir.1998).
To ascertain whether an official is entitled to qualified immunity we must first evaluate whether Plaintiffs' allegations, if true, establish a violation of a constitutional or statutory right. Saucier v. Katz, 533 U.S. 194, 201, 121 S.Ct. 2151, 150 L.Ed.2d 272 (2001). Second, if Plaintiffs' allegations, accepted as true, establish a violation of a constitutional or statutory right, we must ask whether "the [federal] right [that was violated] was clearly established" at the time of the alleged conduct. Id. Accordingly, we conduct this two part inquiry as to each of the two claims presented by the plaintiff: those filed pursuant to Section 1983 and the direct claim for the violation of the DPPA.
I. Constitutional Right To Privacy
Plaintiffs first allege that they are entitled to relief under Section 1983 because Defendants violated their constitutional right to privacy when they released their personal information to mass marketers without their consent. We find that, under our precedent, the district court did not err in answering the first Saucier question — whether a constitutional right had been violated — in the negative. See Pryor v. Reno, 171 F.3d 1281, 1288 n. 10 (11th Cir.1999), rev'd on other grounds, 528 U.S. 1111, 120 S.Ct. 929, 145 L.Ed.2d 807 (2000). We are bound by Pryor and cannot, as a panel, revisit this issue. See Morrison v. Amway Corp., 323 F.3d 920, 929 (11th Cir.2003) ("A prior panel decision of this Court is binding on subsequent panels and can be overturned only by the Court sitting en banc") (citation omitted).
Accordingly, because Plaintiffs' allegations do not establish a constitutional violation under our precedent, there is no need to reach the second Saucier question of whether the law was clearly established at the time of the alleged conduct. The district court did not err in dismissing the constitutional claim under Section 1983 as barred by qualified immunity.
II. Statutory Right To Privacy
Plaintiffs make two claims asserting that their statutory right to privacy was violated by Defendants' conduct. One is a direct claim pursuant to the DPPA. The other is a claim pursuant to Section 1983, which imposes liability on anyone who, under color of state law, deprives a person of any rights secured by either the Constitution or federal laws. 42 U.S.C. § 1983. Accordingly, we must first determine whether the DPPA directly furnishes Plaintiffs with a cause of action. We must also determine whether the rights provided by the DPPA are separately enforceable under Section 1983.
1. Does The DPPA Create A Statutory Right To Privacy In Motor Vehicle Record Information That Is Enforceable Directly Under The Statute?
Count II of the complaint asserts a claim directly under the DPPA, and alleges that Defendants violated the statute when they sold motor vehicle record information to mass marketers without Plaintiffs' consent. The DPPA prohibits the release of personal information contained in individual motor vehicle records unless the State has obtained the express consent of the person to whom such personal information pertains. The statute provides a two part remedy. First, the statute provides enforcement against the states:
18 U.S.C. § 2721(a) states:
In general. — A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity: (1) personal information, as defined in 18 U.S.C. 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section; or (2) highly restricted personal information, as defined in 18 U.S.C. 2725(4), about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9): Provided, That subsection (a)(2) shall not in any way affect the use of organ donation information on an individual's driver's license or affect the administration of organ donation initiatives in the States.
Under 18 U.S.C. § 2721(b), personal information may be disclosed under certain circumstances, including:
(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.
(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.
(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.
Any State department of motor vehicles that has a policy or practice of substantial noncompliance with this chapter shall be subject to a civil penalty imposed by the Attorney General of not more than $5,000 a day for each day of substantial noncompliance.
In addition, 18 U.S.C. § 2724 provides a cause of action against individuals as follows:
(a) Cause of action. — A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.
(b) Remedies — The court may award —
(1) actual damages, but not less than liquidated damages in the amount of $2,500; (2) punitive damages upon proof of willful or reckless disregard of the law; (3) reasonable attorneys' fees and other litigation costs reasonably incurred; and (4) such other preliminary and equitable relief as the court determines to be appropriate.
18 U.S.C. § 2724 (emphasis added).
We find that the plain language of the DPPA clearly, unambiguously, and expressly creates a statutory right which may be enforced by enabling aggrieved individuals to sue persons who disclose their personal information in violation of the DPPA. Accordingly, if the acts alleged by Plaintiffs are taken to be true — that Defendants sold personal information without their consent — then Count II of the complaint states a cause of action under the DPPA.
2. Is The Statutory Right To Privacy Created By The DPPA Enforceable Separately Under Section 1983?
Plaintiffs also allege that they are entitled to the relief provided by Section 1983 because, by releasing their personal information to mass marketers without their consent, Defendants violated the statutory right to privacy granted to them by the DPPA. Defendants argue that, even if the plain language of the statute grants individuals a right to sue persons who violate it, the DPPA does not also create an enforceable right under Section 1983 because the remedial scheme set forth in the statute is inconsistent with additional relief under Section 1983.
It is settled that "the § 1983 remedy broadly encompasses violations of federal statutory as well as constitutional law." Maine v. Thiboutot, 448 U.S. 1, 4, 100 S.Ct. 2502, 65 L.Ed.2d 555 (1980). For a federal statute to be enforceable under Section 1983, three conditions must be satisfied. First, Congress must have intended that the enforcement provisions of the statute focus on benefiting the plaintiff individually, rather than focusing on benefiting a group or making system-wide changes. Gonzaga Univ. v. Doe, 536 U.S. 273, 283, 122 S.Ct. 2268, 153 L.Ed.2d 309 (2002); Blessing v. Freestone, 520 U.S. 329, 340, 117 S.Ct. 1353, 137 L.Ed.2d 569 (1997). Second, the right "protected by the statute [must not be] so vague and amorphous that its enforcement would strain judicial competence." Blessing, 520 U.S. at 340-41, 117 S.Ct. 1353 (quotation and citation omitted). Third, the provision giving rise to the right "must unambiguously impose a binding obligation on the States" in that it is "couched in mandatory, rather than precatory, terms." Id. at 341, 117 S.Ct. 1353 (citation omitted). If all three conditions are satisfied, there exists a rebuttable presumption that the statute is enforceable under Section 1983. This presumption can only be refuted if Congress expressly or impliedly created "a comprehensive enforcement scheme [in the statute in question] that is incompatible with individual enforcement under § 1983." Id.
We have no hesitancy in finding that the plain language of the DPPA clearly satisfies all three conditions to make it enforceable under Section 1983. First, the enforcement provisions of the statute unambiguously focus on benefiting individuals, rather than focusing on benefiting a group or making system-wide changes. The statute makes the official who disobeys the law "liable to the individual to whom the information pertains, who may bring a civil action in a United States district court." 18 U.S.C.A. § 2724(a) (emphasis added). Second, it can hardly be said that the protections offered by the statute are "so vague and amorphous that its enforcement would strain judicial competence." Blessing, 520 U.S. at 340-41 (quotation and citation omitted). Rather, the protections offered by the statute are clear and specific. The language of Sections 2721(b)(11)-(13) unambiguously requires the consent of individuals before their motor vehicle record information may be released, and Section 2724(a) unambiguously states that an individual who knowingly violates the statute shall be liable to the individuals to whom the information pertains in an action in federal district court. The language sets forth the contours and limits of the right clearly, and the right is easily enforceable by courts. Third, the statutory language is mandatory in that it requires that the states obtain the consent of the persons whose information is to be disseminated.
Notwithstanding the clarity of the statute, Defendants argue that Section 1983 relief is precluded because Congress intended to create "a comprehensive enforcement scheme that is incompatible with individual enforcement under § 1983," Blessing, 520 U.S. at 341, 117 S.Ct. 1353 (citation omitted), when it authorized the United States Attorney General to enforce the statutory rights against the states and provided an individual right of action under the DPPA against persons violating the statute. We fail to see such incompatibility.
Rarely is a "remedial scheme sufficiently comprehensive to supplant § 1983." Id. at 347, 117 S.Ct. 1353. Indeed, to support the conclusion that Section 1983 relief is precluded, the scheme set forth by Congress must be so detailed, complex, or comprehensive, such that it is nonsensical to hold that Congress intended Section 1983 relief to be available. See id. (discussing two cases in which the Supreme Court held that remedial provisions precluded Section 1983 relief, one of which included so many options for relief that it was "hard to believe" that Congress intended to preserve Section 1983 relief, and the other provided such detailed procedures for administrative review that it would have defeated the purpose of the statute to enable plaintiffs to bypass the administrative process).
Rather than conflicting, we find the relief offered by the DPPA and Section 1983 to be complementary. The DPPA did not create "so many specific statutory remedies" for individual enforcement that it is "hard to believe that Congress intended to preserve the § 1983 right of action." Blessing, 520 U.S. at 347, 117 S.Ct. 1353. To ensure compliance with the statute, the DPPA provides a remedy against the state and a remedy against individuals who disregard the law. There is nothing in the statute to suggest that Congress intended to exclude Section 1983 relief. Thus, we find that the district court erred in concluding that there was no statutory right to privacy enforceable under Section 1983.
3. Was The Law Clearly Established At The Time Of The Alleged Conduct?
Having found that the statutory rights created by the DPPA are enforceable both directly and under Section 1983, we must now ask whether the law was sufficiently established to have provided fair warning to Defendants that they were violating the law. Hope v. Pelzer, 536 U.S. 730, 731, 122 S.Ct. 2508, 153 L.Ed.2d 666 (2002); Brosseau v. Haugen, 543 U.S. 194, 198-199, 125 S.Ct. 596, 160 L.Ed.2d 583 (2004). This inquiry involves evaluating whether a reasonably competent public official would have known that his actions were prohibited by the law at the time he engaged in the conduct in question. Saucier, 533 U.S. at 202, 121 S.Ct. 2151. The standard is one of objective reasonableness.
We find that the plain language of the statute and the case law gave clear notice to Defendants that releasing the information in question violated federal law. The words of the DPPA alone are "specific enough to establish clearly the law applicable to particular conduct and circumstances and to overcome qualified immunity." Vinyard v. Wilson, 311 F.3d 1340, 1350 (11th Cir.2002) (holding that statutory language alone, even in the "total absence of case law" can be sufficient to provide fair notice).
Moreover, the case law defining the reach of the DPPA gave fair notice to Defendants. In evaluating the DPPA, in both its pre-and post-amendment form, the United States Supreme Court stated that:
[Prior to October 9, 1999,] the DPPA provided that a DMV could obtain that consent either on a case-by-case basis or could imply consent if the State provided drivers with an opportunity to block disclosure of their personal information when they received or renewed their licenses and drivers did not avail themselves of that opportunity. § 2721(b)(11), (13), and (d). However, Public Law 106-69, 113 Stat. 986, which was signed into law on October 9, 1999, changed this "opt-out" alternative to an "opt-in" requirement. Under the amended DPPA, States may not imply consent from a driver's failure to take advantage of a state-afforded opportunity to block disclosure, but must rather obtain a driver's affirmative consent to disclose the driver's personal information for use in surveys, marketing, solicitations, and other restricted purposes.
Reno v. Condon, 528 U.S. 141, 144-45, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000) (emphasis added) (citations omitted). The case law defining the statute's scope could be no clearer. We find the statutory right to privacy in motor vehicle record information was clearly established at the time of Defendants' alleged conduct, giving them fair notice that their alleged conduct violated federal law.
Defendants' argument that there was conflicting state law is unavailing. The law was clear at the relevant time that the DPPA preempted any conflicting state law that regulates the dissemination of motor vehicle record information. Condon, 528 U.S. at 151, 120 S.Ct. 666 (holding that "[t]he DPPA regulates the States as the owners of data bases" and "regulates the universe of entities that participate as suppliers to the market for motor vehicle information."). Accordingly, Defendants were bound to follow the mandates of the DPPA, even though a conflicting state law may have existed.
III. Conclusion
In light of the foregoing analysis, Defendants are not entitled to qualified immunity on the portion of Count I that asserts a violation of the DPPA, nor on Count II in its entirety, and remand for proceedings consistent with this opinion.