Gaston v. LexisNexis Risk Sols.

Full title: DELORIS GASTON AND LEONARD GASTON, Plaintiffs, v. LEXISNEXIS RISK…

Court: UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NORTH CAROLINA STATESVILLE DIVISION

Date published: Sep 2, 2020

483 F. Supp. 3d 318 (W.D.N.C. 2020)

Opinion

CIVIL ACTION NO. 5:16-CV-00009-KDB-DCK

2020-09-02

Deloris GASTON and Leonard Gaston, Plaintiffs, v. LEXISNEXIS RISK SOLUTIONS, INC. and PoliceReports.US, LLC, Defendants.

Christopher L. Cogdill, Pro Hac Vice, Christopher L. Cogdill P.A., Eugene Clark Covington, Jr., Pro Hac Vice, Covington, Patrick, Hagins, Stern & Lewis, P.A., Greenville, SC, David M. Wilkerson, Heather Whitaker Goldstein, Larry S. McDevitt, The Van Winkle Law Firm, Asheville, NC, for Plaintiffs. Cindy D. Hanson, Pro Hac Vice, Troutman Sanders LLP, Atlanta, GA, Dennis Kyle Deak, Troutman Sanders LLP, Raleigh, NC, Joshua Daniel Davey, Troutman Sanders, Charlotte, NC, Julie Diane Hoffmeister, Pro Hac Vice, Troutman Pepper Hamilton Sanders, LLP, Richmond, VA, Ronald I. Raether, Jr., Pro Hac Vice, Troutman Sanders, Irvine, CA, Philip Scott Anderson, Robert B. Long, Jr., Long, Parker, Warren & Jones, P.A., Asheville, NC, for Defendants.

Kenneth D. Bell, United States District Judge

Christopher L. Cogdill, Pro Hac Vice, Christopher L. Cogdill P.A., Eugene Clark Covington, Jr., Pro Hac Vice, Covington, Patrick, Hagins, Stern & Lewis, P.A., Greenville, SC, David M. Wilkerson, Heather Whitaker Goldstein, Larry S. McDevitt, The Van Winkle Law Firm, Asheville, NC, for Plaintiffs.

Cindy D. Hanson, Pro Hac Vice, Troutman Sanders LLP, Atlanta, GA, Dennis Kyle Deak, Troutman Sanders LLP, Raleigh, NC, Joshua Daniel Davey, Troutman Sanders, Charlotte, NC, Julie Diane Hoffmeister, Pro Hac Vice, Troutman Pepper Hamilton Sanders, LLP, Richmond, VA, Ronald I. Raether, Jr., Pro Hac Vice, Troutman Sanders, Irvine, CA, Philip Scott Anderson, Robert B. Long, Jr., Long, Parker, Warren & Jones, P.A., Asheville, NC, for Defendants.

ORDER

Kenneth D. Bell, United States District Judge

THIS MATTER is before the Court on Plaintiff's Motion to Certify Class (Doc. No. 101), Plaintiffs’ Motion for Appointment of Interim Co-Lead and Liaison counsel (Doc. No. 103), the parties’ cross Motions for Summary Judgment (Doc. Nos. 107, 109) and Defendants’ Motion to Stay a ruling on Plaintiffs’ Motion for Summary Judgment (Doc. No. 120). The Court has carefully considered these motions, the parties’ extensive briefs and exhibits and oral argument on the motions from the parties’ counsel on August 27, 2020. For the reasons and in the manner discussed below, the Court will GRANT in part and DENY in part Plaintiff's class certification motion, GRANT in part and DENY in part Plaintiff's Motion for Summary Judgment and DENY Defendants’ summary judgment motion, the motion for interim appointment of counsel and the motion to stay.

With respect to class certification, the Court declines to certify the nationwide, statewide and Rule 23(b)(1) and 23(b)(3) money damages classes sought by Plaintiffs, but will certify a class under Federal Rule of Civil Procedure 23(b)(2) to consider Plaintiffs’ claim for injunctive relief under the Driver's Privacy Protection Act ("DPPA,") 18 U.S.C. § 2721, et seq. , as limited below. Concerning the appointment of counsel, there does not appear to be a dispute that Plaintiffs’ counsel will adequately represent the limited class certified by the Court so Plaintiffs’ counsel will be appointed Class counsel pursuant to Rule 23(g) and the motion to appoint interim counsel will accordingly be denied as moot.

On the parties’ cross motions for summary judgment, the Court holds that based on the Court's finding that North Carolina accident reports that indicate that the address that appears in the report is the same as on a driver's license are "motor vehicle records" under the statute and Defendants’ admission that they disclosed the reports without regard to whether the personal information in the reports would be used for a purpose permitted by the DPPA (as well as the undisputed evidence that at least some of those reports were used for an impermissible purpose), Plaintiffs are entitled to summary judgment on their claim for injunctive relief to end Defendants’ unlawful practices. However, because there are genuinely disputed material issues of fact regarding whether the Plaintiffs’ accident reports were disclosed for a purpose not permitted by the DPPA, Plaintiff's motion for summary judgment on their claim for liquidated damages must be denied. Further, Defendants are not entitled to summary judgment because the Court finds they are liable for injunctive relief as discussed above and do not have immunity, qualified or otherwise, based on their alleged "public service" in making the accident reports available. Finally, having determined that no class will be certified under Rule 23(b)(3) and that the summary judgement motions will be denied, Defendants’ Motion to Stay will be denied as moot.

I. LEGAL STANDARD

Plaintiffs seeking class certification "must affirmatively demonstrate [their] compliance" with Federal Rule of Civil Procedure 23. Wal–Mart Stores, Inc. v. Dukes , 564 U.S. 338, 350, 131 S.Ct. 2541, 180 L.Ed.2d 374 (2011). Rule 23(a) requires that a prospective class satisfy four prerequisites to ensure that the class claims are fairly encompassed by those of the named plaintiffs. See Fed. R. Civ. P. 23(a). These prerequisites are often referred to as numerosity, commonality, typicality, and adequacy. See Krakauer v. Dish Network, L.L.C. , 925 F.3d 643, 654 (4th Cir. 2019). The Fourth Circuit has also recognized that Rule 23 "contains an implicit threshold requirement" of "ascertainability" – that the members of a proposed class be "readily identifiable" by way of reference to objective criteria. See id. at 654–55. If these initial requirements are met, the plaintiffs must then demonstrate that the proposed class fits within at least one of the three types of classes outlined in Rule 23(b). Id. at 655.

Although it is Plaintiffs’ burden to demonstrate compliance with Rule 23, this Court "has an independent obligation to perform a ‘rigorous analysis’ to ensure that all of the prerequisites have been satisfied." EQT Prod. Co. v. Adair , 764 F.3d 347, 358 (4th Cir. 2014) (quoting Dukes , 564 U.S. at 350–51, 131 S.Ct. 2541 ). As Rule 23 ’s criteria are often "enmeshed in the factual and legal issues comprising the plaintiff's cause of action," this analysis may entail some consideration of the merits of the underlying claims. See Dukes , 564 U.S. at 351, 131 S.Ct. 2541. However, " Rule 23 grants courts no license to engage in free-ranging merits inquiries at the certification stage. Merits questions may be considered to the extent—but only to the extent—that they are relevant to determining whether the Rule 23 prerequisites for class certification are satisfied." Amgen Inc. v. Conn. Ret. Plans & Trust Funds , 568 U.S. 455, 466, 133 S.Ct. 1184, 185 L.Ed.2d 308 (2013).

An order that certifies a class action must define the class and the class claims, issues or defenses, and must appoint counsel under Rule 23(g). Fed. R. Civ. P. 23 (c)(1)(B). In appointing class counsel, the court must consider the work counsel has done in identifying and investigating the potential claims, counsel's relevant experience and knowledge of the applicable law and the resources that counsel will commit to representing the class. Fed. R. Civ. P. 23(g)(1)(A). Also, the Court may consider any other matter pertinent to counsel's ability to fairly and adequately represent the interests of the class. Id. at Rule 23(g)(1)(B).

Summary judgment must be granted "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56. A factual dispute is considered genuine "if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). "A fact is material if it might affect the outcome of the suit under the governing law." Vannoy v. Federal Reserve Bank of Richmond , 827 F.3d 296, 300 (4th Cir. 2016) (quoting Libertarian Party of Va. v. Judd , 718 F.3d 308, 313 (4th Cir. 2013) ).

The party seeking summary judgment bears the initial burden of demonstrating the absence of a genuine issue of material fact through citations to the pleadings, depositions, answers to interrogatories, admissions or affidavits in the record. See Celotex Corp. v. Catrett , 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) ; Bouchat v. Baltimore Ravens Football Club, Inc. , 346 F.3d 514, 522 (4th Cir. 2003). "The burden on the moving party may be discharged by ‘showing’ ... an absence of evidence to support the nonmoving party's case." Celotex , 477 U.S. at 325, 106 S.Ct. 2548. Once this initial burden is met, the burden shifts to the nonmoving party. The nonmoving party "must set forth specific facts showing that there is a genuine issue for trial." Id. at 322, 106 S.Ct. 2548 n.3. The nonmoving party may not rely upon mere allegations or denials of allegations in his pleadings to defeat a motion for summary judgment. Id. at 324, 106 S.Ct. 2548.

When ruling on a summary judgment motion, a court must view the evidence and any inferences from the evidence in the light most favorable to the nonmoving party. Tolan v. Cotton , 572 U.S. 650, 657, 134 S.Ct. 1861, 188 L.Ed.2d 895 (2014) ; see also Anderson , 477 U.S. at 255, 106 S.Ct. 2505. "Summary judgment cannot be granted merely because the court believes that the movant will prevail if the action is tried on the merits." Jacobs v. N.C. Admin. Office of the Courts , 780 F.3d 562, 568-69 (4th Cir. 2015) (quoting 10A Charles Alan Wright & Arthur R. Miller et al., Federal Practice & Procedure § 2728 (3d ed. 1998)). "The court therefore cannot weigh the evidence or make credibility determinations." Id. at 569 (citing Mercantile Peninsula Bank v. French (In re French ), 499 F.3d 345, 352 (4th Cir. 2007) ).

However, "[w]here the record taken as a whole could not lead a rational trier of fact to find for the nonmoving party, there is no genuine issue for trial." Ricci v. DeStefano , 557 U.S. 557, 586, 129 S.Ct. 2658, 174 L.Ed.2d 490 (2009) (internal citations omitted). "Only disputes over facts that might affect the outcome of the suit under the governing law will properly preclude the entry of summary judgment. Factual disputes that are irrelevant or unnecessary will not be counted." Anderson , 477 U.S. at 248, 106 S.Ct. 2505. Also, the mere argued existence of a factual dispute does not defeat an otherwise properly supported motion. Id. If the evidence is merely colorable, or is not significantly probative, summary judgment is appropriate. Id. at 249-50, 106 S.Ct. 2505.

In the end, the question posed by a summary judgment motion is whether the evidence as applied to the governing legal rules "is so one-sided that one party must prevail as a matter of law." Id. at 252, 106 S.Ct. 2505.

II. FACTS AND PROCEDURAL HISTORY

Plaintiffs Leonard and Delores Gaston are a married couple who live in Charlotte, North Carolina. Defendant LexisNexis Risk Solutions, Inc. ("LexisNexis") is a Georgia corporation that provides data and information to various professionals and industries around the world. Defendant PoliceReports.US, LLC, ("PRUS") is a North Carolina corporation that is an online distributor of vehicle accident/crash reports throughout the United States, including North Carolina. PRUS was acquired by LexisNexis in 2014.

In 2012 and 2015, the Gastons were involved in car accidents in Charlotte. After each accident, the responding CMPD officer prepared a Crash Report that included personal information, including their name, address and driver's license number. Further, the Crash Report specifically indicated that the address provided was the same as appears on their driver's license. In this action, the Gastons allege on their own behalf and as representatives of several proposed putative classes that Defendants violated the DPPA by unlawfully using and disclosing Plaintiffs’ personal driver information in the Crash Reports without Plaintiffs’ consent.

The process by which Crash Reports are prepared and the source of the personal information that appears in the reports is one of the core issues in the parties’ dispute. Law enforcement agencies in North Carolina are obligated to investigate motor vehicle accidents which are reported to them, and any driver who is involved in a motor vehicle accident in North Carolina is required by law to produce a driver's license and registration card for the vehicle on request of a law enforcement officer. N.C. Gen. Stat. § 20-29, 20-57-(c). In conducting accident investigations, law enforcement officers in North Carolina use a standard form promulgated by the North Carolina Division of Motor Vehicles ("DMV"), known as a DMV-349, to record their investigations of reportable crashes. When law enforcement officers complete the DMV-349 in connection with an accident investigation, they include specific personal information about the driver and others involved in the accident, including name, address and driver's license number. Also, there is a box that may be checked to indicate whether the address information is the "Same Address on Driver's License?".

CMPD and other law enforcement officers in North Carolina theoretically can collect information to create a Crash Report through various means. Crash Reports can be prepared using an electronic crash reporting software application known as Report Beam, which interacts with a CMPD officer's Computer Automated Dispatch (CAD) system. (See Doc. No. 122-3 at ¶ 5). "CAD has the ability to interface with a variety of third party databases, including the National Crime Information Center (NCIC) and the North Carolina Division of Criminal Information (DCI), and return available information relating to the driver's license number or license tag, such as the driver's name, address, date of birth and insurance information." (Id. at ¶ 6.) For North Carolina driver's licenses and tags, officers can "pre-populate the driver information in a crash report form with the information returned by the CAD-connected databases by using the F11 function in Report Beam." (Id. at ¶ 7.)¹ "For non-North Carolina residents, the F11 function is available, but available information returned must be verified." (Id. at ¶ 8.) Officers may, for example, "ask a person to orally report his or her name and address" at the scene of the accident. (Doc. No. 122-2 (CMPD Dep. Tr. 63:3–7.)) Also, in some cases officers might collect "demographical information through driver's licenses [or] registration of [sic] cards," (Id. at 13:4–7.), which officers can write that information down on their notepads. (Id. at 13:20–14:4.). However, in all cases, the completed Crash Report does not include any indication of whether the information was manually entered or whether the officer used the F11 function. (Id. ) (See Doc. No. 122-3 at ¶ 11).

1 Defendants suggest that this software might not be working in every instance and "officers may choose to manually enter an involved party's information into a crash report." (Id. at ¶ 11.) Further, they note that "[t]he CMPD's policies and procedures do not mandate that officers use the F11 function for creating crash reports." (Id. )

Plaintiffs assert that in their accidents and almost all of the accidents involving other putative North Carolina class members, the investigating officers electronically accessed their personal information, including driver identification numbers, names, and addresses, from information maintained by the DMV and then integrated that personal information obtained from the DMV into the Crash Report using electronic crash reporting software. In support of this claim, they offer an affidavit of Officer Nicholas Bush of the CMPD. See Doc. No. 101-13.² Officer Bush testified that in the field he created thousands of crash reports using the Report Beam crash reporting software. Id. at ¶ 4. He further testified that he taught other officers at the CMPD how to use the Report Beam crash reporting software, including the use of the F11 function to speed up the crash reporting process. Id. at ¶ 6. Most specifically, he testified that he transmitted accident reports using the e-crash software directly from his vehicle 95% to 98% of the time and used the data from the NC Division of Criminal Information to populate the crash reports.³ Id. at ¶ 10 and 11. He manually typed only a small percentage of his accident reports. Id. at ¶ 10 and 14. However, Officer Bush testified that for the one of the Plaintiffs’ accidents for which he was the investigating officer and the other thousands of accident reports he has prepared, he has "no independent recollection of what occurred during the call for service beyond what is contained in the report." See Doc. No. 122-3 at ¶ 12.

2 Officer Bush provided several affidavits in this case to both parties. His March 2020 affidavit offered into evidence by the Plaintiffs is his most recent and detailed affidavit, although it is not inconsistent with his earlier affidavits.

3 Wayne Pettingill, a Special Agent in charge of the Criminal Information and Identification Section of the North Carolina State Bureau of Investigation, testified that when "a police officer in the field queries driver and vehicle information through the North Carolina Division of Criminal Information, the information returned to the officer's computer is derived from the NCDMV database in real time." See Declaration of Wayne Pettingill, Doc. No. 101-14 at ¶ 5.

Accordingly, it appears (and the parties do not dispute) that because police officers collectively prepare thousands of Crash Reports and the reports do not themselves indicate the source of the personal information in the report, the source of the personal information in any particular Crash Report is, as a practical matter, unknown and generally unknowable to an absolute certainty very shortly after the accident. However, it also appears that the Crash Reports were prepared using computer software and information from the DMV databases in at least a very substantial number of cases – and particularly so for at least for one CMPD officer.

During the relevant period, PRUS entered into contracts to make CMPD's Crash Reports available online. See Doc. 137-5. In those agreements with CMPD, PRUS is authorized to provide online access to Crash Reports as well as a "bulk/subscription download capability" to customers on a set price schedule. Also, while those contracts do not mention the DPPA nor specifically limit the manner in which the reports can be provided to the public (with the exception of the prices that PRUS can charge for access to the reports), the contracts do not provide a blanket authority to allow access to the Crash Reports without regard to Federal law. On the contrary, the contracts require that PRUS "comply with all applicable federal, state and local laws and regulations ..." and further include a specific representation that "the Company shall comply in all material respects with all applicable federal, state and local laws, regulations and guidelines in providing the Services ...."

Pursuant to the CMPD / PRUS agreements, the Crash Reports related to Plaintiffs’ accidents, and allegedly over 262,000 other Crash Reports, were transmitted to PRUS and made available on PRUS’ eCommerce web portal without redaction⁴ of any personal information during the alleged class period from 2012 to the present. (R. Marler Decl. at ¶ 6.).⁵ Further, contemporaneously with sending Crash Reports electronically to PRUS, CMPD also separately sent an electronic copy of the Crash Report to the DMV, which maintained the reports in its records. So, both PRUS and DMV received copies of the same Crash Reports on each reportable accident. However, CMPD and DMV handled the disclosure of the Crash Reports very differently. As described, CMPD made the reports available through PRUS and in person without any redaction or restriction. On the other hand, DMV, acting pursuant to N.C. Gen. Stat. § 20-43.1, limited disclosure of the crash reports in accordance with the DPPA, requiring any individual or entity that obtained a report to complete a form (TR-67) that states that "[a] crash report is a motor vehicle record" and emphasizes that personal information may only be accessed for a permissible use as defined in the DPPA. See Doc. 139 at 2-3.

4 While the Crash Reports that were available to the public and monthly subscribers were not redacted, Defendants testified they had the capability to pull selected information from the reports and did so for select customers. For example, the Defendants sold information from their crash reports to Carfax but redacted any personal information about the drivers or owners from the data shared with Carfax. See Doc. No. 108-4, Huneycutt Deposition 107:17-23 and Doc. No. 108-6, Marler Deposition 132:7-134:7.

5 While none of these reports were redacted, a person accessing individual reports without a subscription (which apparently provided unlimited access with no need for further information) could obtain unredacted reports with identifying information such as the driver name, etc. ("... accident reports [are] available to parties or entities who had the following information: report number, report date, driver name or location."). See Ex. 4, Declaration of William Ramirez ¶ 5, 6, 7, and 8; Ex. 5, Declaration of Michelle Tran ¶ 5, 6, 7 and 8; Ex. 6, Deposition of Son Doan 59:6-65:25. Thus, an individual without a subscription could still access every report merely by requesting all reports for every day of the year.

In addition to making individual unredacted crash reports available, the Defendants sold monthly Crash Support access subscriptions to numerous customers, who were primarily body shops, chiropractic offices, and law firms, which allowed the customers to have unlimited access to all crash reports available from the Defendants. Doc. No. 107-3 (PRUS Supplemental Responses to Interrogatories dated January 13, 2020, Response to No. 1); Doc. No. 107-4 (PRUS Amended Responses to RFP dated October 11, 2018). The Defendants made 750 reports available at a time, and then these reports would be gradually replaced as new reports were made available by the Defendants. Customers of the Defendants could review these reports anytime and did not have to provide any permissible use to access them. The Defendants did not keep records of the Crash Reports viewed or downloaded by their monthly subscription customers, see Doc. No. 108-6, Marler Deposition at pp. 103-107, and did not request, obtain or keep any information regarding the use for which its customers were obtaining the Crash Reports.

With respect to the use made of Plaintiffs’ information, the Gastons testified that they received numerous solicitations by both telephone and mail after the crash in February 2012, but the identification of those solicitations is unknown or disputed. As to the putative class members more generally, the parties also dispute the extent to which Defendants’ monthly subscription customers viewed and used their personal information for marketing and soliciting purposes, but there is substantial evidence that numerous monthly subscription customers used the personal information in the Crash Reports for the purpose of marketing and solicitation. See Doc. No. 107-1 at p.4-5, citing Doc. Nos. 107-6, 107-7, 107-8, 107-9 and 101-5.

Beyond CMPD and North Carolina, Defendants resell crash reports for numerous law enforcement agencies around the nation. Plaintiffs allege that law enforcement agencies in the state of New York and elsewhere similarly use software to create accident crash reports. However, Plaintiffs have not offered any specific testimony of the manner and prevalence of the use of the software outside of CMPD.

With respect to class claims, Plaintiffs seek to certify and represent a nationwide class of Plaintiffs seeking declaratory and injunctive relief, pursuant to the provisions of Fed. R. Civ. P. 23(a), 23(b)(1)(A), 23(b)(2) and Rule 23(b)(3), defined as:

Class 1 – Nationwide

All persons in the United States who, within four (4) years prior to the date of

January 12, 2016 through the final disposition of this or any related actions (the "Class Period"), had their personal information (as defined by the DPPA, effective during the Class Period) contained in motor vehicle records of their State Motor Vehicle Departments obtained, used, disclosed, re-disclosed, and/or resold by the named Defendants, for purposes not permitted by the DPPA, or without establishing a permissible purpose required by the DPPA, without their express consent.

Subclass 1 - North Carolina and New York Vehicle Owners and Drivers

All North Carolina and New York driver's license holders and North Carolina and New York vehicle owners who within four (4) years prior to the date of January 12, 2016, through the final disposition of this or any related actions (the "Class Period"), had their personal information (as defined by the DPPA, effective during the Class Period) contained in motor vehicle records of the North Carolina or New York Motor Vehicle Departments obtained, used, disclosed, re-disclosed, and/or resold by the named Defendants, for purposes not permitted by the DPPA, or without establishing a permissible purpose required by the DPPA, without their express consent.

Subclass 2 – All Vehicle Owners and Drivers CMPD crash reports

All driver's license holders and owners who within four (4) years prior to the date of January 12, 2016, through the final disposition of this or any related actions (the "Class Period"), had their personal information (as defined by the DPPA, effective during the Class Period) contained in motor vehicle records of the North Carolina Department of Motor Vehicles obtained, used, disclosed, re-disclosed, and/or resold by the named Defendants, for purposes not permitted by the DPPA, or without establishing a permissible purpose required by the DPPA, without their express consent.

Plaintiffs seek the following class-wide relief under the DPPA. First, they seek a judgment that the Defendants (1) breached the DPPA by disclosing or making available their and class members’ personal information to third-parties that did not have a permissible use to view or obtain such information; and (ii) violated 18 U.S.C. § 2721(c) by failing to keep records of the persons or entities who obtained or viewed this information and the permissible use of each such disclosure. Plaintiffs allege they suffered actual damages and claim they and the members of the class are entitled to at least minimum statutory damages of $2,500.00 for the impermissible disclosures to third parties, plus injunctive relief, punitive damages, and attorneys’ fees.

III. DISCUSSION

A. Class Certification

As noted above, because the requirements of Rule 23 are often "enmeshed in the factual and legal issues comprising the plaintiffs’ cause of action," Dukes , 564 U.S. at 351, 131 S.Ct. 2541, the Court must "rigorously examine" the core issues of the case at the certification stage, while not overstepping this task to prematurely decide the merits of the Plaintiffs’ claims. The Court will proceed with this examination in three stages. First, the Court will discuss the DPPA because the elements of class certification cannot be thoughtfully considered without a careful understanding of the cause of action alleged. Next, the Court will address each of the Rule 23(a) threshold requirements applicable to all class actions, commonly referred to as "numerosity," "commonality," "typicality," and "adequacy," as well as the implicit requirement that the class be "readily identifiable" or ascertainable. See Fed. R. Civ. P. 23(a), Krakauer , 925 F. 3d at 654-55. Finally, the Court will discuss whether and how the proposed classes fit (or do not fit) into each of the specific forms of class adjudication provided by Rule 23(b).

1. The DPPA

The application of Rule 23 often turns on the cause of action. See, e.g., Erica P. John Fund, Inc. v. Halliburton , 563 U.S. 804, 809, 131 S.Ct. 2179, 180 L.Ed.2d 24 (2011). Rule 23 is designed to, among other goals, make it possible to efficiently decide class-wide questions and identify those who may be affected by a judgment. To determine if those questions exist requires consideration of the asserted claim and its elements. As stated in Krakauer , "[e]fficient and manageable classes require common proof, and the availability of such proof turns on what exactly needs to be proven." Id. at 655.

At its core, the DPPA is a public safety statute designed to protect citizens from the danger and annoyance that may result from the unnecessary disclosure of their personal information. Enacted in 1994 as a result of the stalking and, in some cases, murders of women whose assailants obtained their addresses and other personal information from state DMV offices, the DPPA is a seemingly straightforward statute that has proven to be decidedly less so in its application to commercial efforts to monetize this information, such as the online databases offered by Defendants. In Section 2721, the DPPA prohibits state DMV departments and their officers, employees and contractors from, inter alia , disclosing or otherwise making available "personal information" obtained by the DMV in connection with a "motor vehicle record" for any purpose not specifically listed in 18 U.S.C. § 2721(b). See 18 U.S.C. § 2721(a) (1). The statute also expressly prohibits private individuals from "knowingly ... obtain[ing] or disclos[ing] personal information, from a motor vehicle record, for any use not permitted under section 2721(b)." 18 U.S.C. § 2722(a). "Personal information" is defined in the statute as "information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3). A "motor vehicle record" includes "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identity card issued by a department of motor vehicles." 18 U.S.C. § 2725(1).

There are fourteen permissible purposes described in 18 U.S.C. § 2721(b), including, for example, to allow governmental agencies and law enforcement to carry out their functions and to inform vehicle owners of safety recalls. Significantly, however, marketing and solicitation efforts are not permissible purposes under the statute. See Maracich v. Spears , 570 U.S. 48, 60-61, 133 S.Ct. 2191, 186 L.Ed.2d 275 (2013). Section § 2721 (c) further describes the requirements for the resale or redisclosure of this personal information, i.e. disclosure by those, including Defendants, who obtain information protected by the DPPA from the DMV or other governmental agencies. Under the DPPA, an authorized recipient that resells or rediscloses personal information must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used. 18 U.S.C. § 2721 (c).

Finally, in Section 2724 (entitled "Civil Action"), the DPPA provides a "cause of action" that makes any person who "knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under [the statute] ... liable to the individual to whom the information pertains." 18 U.S.C. § 2724 (a). A person who brings a civil action under this section, can recover "(1) actual damages, but not less than liquidated damages in the amount of $2500; (2) punitive damages ...; (3) reasonable attorneys’ fees and ... costs ...; and (4) such other preliminary and equitable relief as the court deems to be appropriate." 18 U.S.C. § 2724 (b).

2. Rule 23 (a) Factors

a) Ascertainability and Numerosity

Apart from its specifically enumerated requirements, " Rule 23 contains an implicit threshold requirement that the members of a proposed class be ‘readily identifiable.’ " EQT Prod. Co. v. Adair , 764 F.3d 347 (4th Cir. 2014). Under this principle, often called "ascertainability," "a class cannot be certified unless a court can readily identify the class members in reference to objective criteria." Id. The Court finds that the proposed class members are ascertainable on these terms. Plaintiffs seek to certify classes of those individuals whose personal information sourced from DMV records is contained in Crash Reports that Defendants made available electronically to its customers.

It is indisputable that a vast number of individuals have had their DMV personal information sold, made available and disclosed to persons who did not have a permissible use for the information. Members of this class are thus easily defined by objective criteria. Defendants argue, though, that because the identity of each class member cannot be known with absolute certainty (because a Crash Report does not definitively disclose the source of the personal information in the report) no class can be certified. To the extent this is true, it is because the North Carolina DMV, CMPD and Defendants employ a system that makes it so, thereby entirely frustrating the public safety goals of the DPPA. Indeed, if Defendants’ arguments prevailed no class of clearly wronged individuals could ever be certified. Also, ascertainability does not require that every member of the class must be knowable to an absolute certainty.⁶

6 On this issue, Defendants argue that the identity of class members is not "ascertainable" because the Court must, in their view, make an independent determination how each class member's Crash Report was prepared and that it was used for an improper purpose and that information cannot be found on the Crash Report itself. The Court disagrees. Defendant wrongly conflates the Court's assessment of the commonality and typicality requirements (discussed below) with the threshold question of whether the proposed class members are simply identifiable. Whether or not Plaintiffs’ claims necessitate individual litigation (thus making their claims insufficiently common or typical), the fact remains that the putative class members can be readily identified by objective criteria from the accident reports themselves.

Accordingly, class members can be identified through the reports themselves maintained either by CMPD or the DMV. Moreover, there is no question that the proposed class satisfies the numerosity requirement, with Plaintiffs estimating that there are over 250,000 individuals identified in the CMPD Crash Reports during the proposed multi-year class period.

b) Commonality

Certification is only appropriate if "there are questions of law or fact common to the class." Fed. R. Civ. P. 23(a)(2). Because nearly all legal disputes involving a large number of people in similar circumstances will raise common questions, what matters most in determining "commonality" in the context of class certification is "the capacity of a class-wide proceeding to generate common answers apt to drive the resolution of the litigation." See Dukes , 564 U.S. at 349–50, 131 S.Ct. 2541. Indeed, "[a] single common question will suffice," so long as it is "of such a nature that its determination ‘will resolve an issue that is central to the validity of each one of the claims in one stroke.’ " EQT , 764 F.3d at 360 (citing Dukes , 564 U.S. at 350, 359, 131 S.Ct. 2541 ). Also, in this context a common question is one where "the same evidence will suffice for each member to make a prima facie showing [or] the issue is susceptible to generalized, class-wide proof." Tyson Foods, Inc. v. Bouaphakeo , 577 U.S. 442, 136 S. Ct. 1036, 1045, 194 L. Ed. 2d 124 (2016) (quoting 2 W. Rubenstein, Newberg on Class Actions § 4:50, pp. 196–197 (5th ed. 2012)).

Here, the parties have offered at least two common questions which might serve as the basis for a common resolution and thus a finding of "commonality." First, are the Crash Reports themselves "motor vehicle records" or the personal information within those reports derived from "motor vehicle records" under the DPPA? Second, did the Defendants knowingly obtain, disclose or use the reports for a purpose permitted under the DPPA? For the reasons explained below the Court finds that, at a minimum, the first question can be commonly answered, thus resolving "an issue central to the validity" of each member's DPPA claim and thereby satisfying Rule 23(a) ’s commonality requirement.⁷

7 Having determined that the "commonality" requirement is satisfied as to at least one core issue, the Court need not reach a determination of whether that requirement could also be met as to other issues. However, the Court will address the issue of whether the Defendants improperly disclosed personal information in the Crash Reports without a proper purpose in connection with the discussion of certification of a damages class under 23(b)(3) below.

The Court's conclusion that the question of whether the North Carolina Crash Reports contain information from or pertaining to motor vehicle records can be answered with common proof from a properly defined⁸ putative class is supported by two alternate grounds. First, with respect to the question of whether any of the information in the reports came from a DMV record⁹ (as distinguished from whether the record itself can be considered a motor vehicle record) the parties agree that any individual determination of how the CMPD Crash Report for a particular accident was prepared would be practically impossible because those Crash Reports themselves don't reveal the source of the personal information (for example, whether or not the accident report software was used) nor do law enforcement officers recall how any specific report among the hundreds or thousands they prepare was created. See Doc. 122 at 10, 18 (Defendants questioning if "individualized inquiries would "even [be] feasible" and stating that with respect to an investigation to determine where the information from each respective crash report was derived, "in almost every instance, the source of the information would not be discernable."

8 As discussed below, the Court finds that the Class must be limited to CMPD Crash Reports because there is insufficient evidence in the current record to support the certification of a broader class.

9 Defendants acknowledge that information obtained from a DMV database (for example by using the Crash Report software) to create a Crash Report comes from a "motor vehicle record," but dispute whether obtaining the information from a driver's license provided at the accident scene upon the demand of the officer also comes from a "motor vehicle record." The Court finds that personal information from either source would be sufficient in the circumstance of the compelled production of a driver's license to a law enforcement officer to fall within the scope of information protected by the DPPA. See Eggen v. WESTconsin Credit Union , 2016 WL 4382773, at *3 (W.D. Wis. Aug. 16, 2016) ("On its face, defendant's argument that a driver's license is not a ‘motor vehicle record’ is difficult to take seriously ... After all, a driver's license is created by the Department of Motor Vehicles and it is a record of the information on the license."); Doc. No. 42 at p. 6 ("Applying a modicum of common sense to what is a clearly written statute, being involved in a fender bender on the way to work is clearly an insufficient reason to expose protected ‘personal information’ (especially a person's name and home address) to a web audience increasingly inhabited more by identity thieves than boy scouts").

In the absence of the possibility of a meaningful individualized investigation of the source of personal information in the Crash Reports, Plaintiffs and the remainder of the putative class are left to prove DPPA liability through circumstantial evidence and other inferential proof, evidence that could and would be presented on a class-wide basis. See Tyson Foods , 136 S. Ct. 1036 at 1040. (Where representative evidence "may be the only feasible way to establish liability, it cannot be deemed improper merely because the claim is brought on behalf of a class" and such evidence "is a permissible means of establishing [liability] in a class action by showing that each class member could have relied on that [evidence] to establish liability had each brought an individual action.") Thus, there is a commonality among the class on this core issue.

Simply put, each person whose personal information appears in an accident report would face the same challenge – "How do I prove it is ‘more likely than not’ that the personal information in my accident report came from a ‘motor vehicle record’ "? And, the evidence from which a common answer would be derived would be the same; that is, the inferential evidence of the process by which the accident reports were most often prepared. Having no ability to determine the source of the personal information in any specific accident report, the fact-finder would then need to make a determination of DPPA liability on the basis of this class-wide proof generally applicable to the class as a whole. Thus, the Court finds the requirement of "commonality" is met on this issue.

Also, the Court finds that all of the DMV Form 349 Crash Reports in which the box "Same address as driver's license" is checked are "motor vehicle records" under the statutory definition so no further individual assessment of the "source" of the personal information is required. The DPPA only imposes liability for personal information that has been obtained "from a motor vehicle record." See 18 U.S.C. § 2722(a). In turn, the statute defines a "motor vehicle record" as "any record that pertains to a motor vehicle operator's permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles." 18 U.S.C. § 2725(1) (emphasis added). All of the Crash Reports in which the "Same address as Driver's License" box is checked "pertain to"¹⁰ a motor vehicle operator's permit (i.e. a driver's license). Regardless of whether the initial source of the address information was the accident participant's records in the DMV database (using the F11 function), or a driver's license, or if the driver's license was only used to confirm earlier provided information, everyone who has access to the Crash Reports knows the address on that individual's driver's license just the same as if they had the person's driver's license in their hands. Thus, the accident report is plainly a record that "pertains to" the driver's license and thus qualifies as a "motor vehicle record" under the DPPA. Accordingly, "commonality" is satisfied on this alternate ground as well.

10 "Pertain to" or "pertain" is a broad term which means with "reference to" or "related to" and is frequently used in statutes and legal writing. See, e.g., FCC v. AT & T Inc. , 562 U.S. 397, 131 S.Ct. 1177, 179 L.Ed.2d 132 (2011) ; Webster's Third New International Dictionary of the English Language (2020) ("To have reference"); Black's Law Dictionary (11th ed. 2019) ("To relate directly to; to concern or have to do with").

In support of their position that commonality (as well as typicality) cannot be found because of the various ways in which Crash Reports are prepared, Defendants cite to the Court two recent decisions in the Middle District of North Carolina, Hatch v. Demayo , No. 1:16CV925, 2020 WL 4719632 (M.D.N.C. Aug. 13, 2020) and Garey v. James S. Farrin, P.C. , No. 1:16CV542, 2020 WL 4227551 (M.D.N.C. July 23, 2020). In those DPPA actions, the putative class representatives asserted claims against law firms who obtained similar North Carolina accident reports and solicited the plaintiffs and their putative class. In both cases, the court declined to certify a class, holding that it was not persuaded that a "central merits question – Where did the information come from? – can ultimately be answered with class-wide proof." For the reasons discussed above, this Court respectfully finds otherwise. Also, in Hatch , unlike in this action, the Court did not address whether the accident reports were themselves "motor vehicle records" because no party had raised the issue. See Hatch , 2020 WL 4719632 at *4.¹¹

11 Plaintiffs have raised this issue in this action, albeit arguing that the Crash Reports are "motor vehicle records" on the different ground that the DMV form used to request disclosure of a Crash Report says that accident reports are "motor vehicle records" and North Carolina law specifically limits disclosure of such reports in accordance with the DPPA. See N.C. Gen. Stat. § 20-43.1, DMV Form TR-67. While the Court does not find that the state statute or the DMV form can alone make a record a "motor vehicle record" as defined in the DPPA, the DMV's view of the issue does lend support to the Court's conclusion that the Crash Reports "pertain to" a motor vehicle operator's permit.

While the Court agrees with our sister court that vehicle accident reports can be prepared in various ways, the practical impossibility of the individualized adjudication of that issue which led the court in Garey and Hatch to decline class certification leads this Court to conclude that the enforcement of the DPPA cannot be so easily thwarted. Put another way, the Court is unwilling to decline to certify a class because of the alleged necessity of conducting individualized assessments of a fact (the source of the personal information in each accident report) that Defendants urge the Court cannot ever be made with respect to any individual's accident report because individualized proof is inherently unavailable. Also, if the theoretical variability of how accident reports are prepared means that no class can ever be certified, then effective injunctive relief could never be ordered to end widely practiced conduct that plainly violates the statute. This Court will not read such a clearly stated statute so narrowly as to make it ineffectual in carrying out its important purposes.

However, the Court's finding of commonality is limited to North Carolina residents and CMPD Crash Reports. While based on the current record the Plaintiffs can present class wide evidence of the specific form of the accident report typically used in North Carolina, the availability of software that allows North Carolina law enforcement officers to fill out that form with personal information taken from a NCDMV database and the absence of a practical ability to determine how a particular accident report is prepared shortly after the accident, no such evidence (other than the availability of similar software in New York) is available for other states or even outside CMPD.¹² Also, the record reflects that North Carolina officers were required to handle non-North Carolina residents differently with respect to using the accident report software. Therefore, the Court cannot conclude that Plaintiffs’ claims and evidence satisfy the requirement of proving commonality with respect to class members and accident reports outside of CMPD or for non-North Carolina residents. Therefore, Plaintiffs are not entitled to certify their proposed nationwide class.¹³

12 At oral argument, Plaintiffs acknowledged their lack of information concerning Defendants’ conduct outside of CMPD, even in North Carolina.

13 The Court is also concerned about exercising jurisdiction over far flung conduct. In Bristol-Myers Squibb Company v. Superior Court of California, San Francisco County , ––– U.S. ––––, 137 S. Ct. 1773, 198 L.Ed.2d 395 (2017), the Court rejected an attempted assertion of personal jurisdiction over a non-resident defendant by plaintiffs with no connection to activity occurring in the chosen forum. More than 600 plaintiffs (only eighty-six (86) of whom were California residents) filed an action in California against an in-state defendant. Id. at 1777. The Supreme Court emphasized that a plaintiff's claim must arise out of the defendant's contacts with the forum to establish personal jurisdiction. Id. at 1781. And, the fact that others allegedly suffered from similar conduct is immaterial, as personal jurisdiction must be proven on an individual basis. Id. Since Bristol-Myers , numerous federal courts have applied its holdings to limit class actions that improperly seek to include claims with no connection to the forum state. See, e.g., Plumbers’ Local Union No. 690 Health Plan v. Apotex , 2017 WL 3129147, 2017 U S. Dist. LEXIS 114733 (E.D. Pa. July 24, 2017). For these same reasons, a nationwide class should not be certified here.

c) Typicality

The next Rule 23(a) prerequisite is that "the claims or defenses of the representative parties are typical of the claims or defenses of the class." Fed. R. Civ. P. 23(a)(3). To meet this requirement, the class representative's claim must "arise[ ] from the same event or practice or course of conduct that gives rise to the claims of other class members." Oshana v. Coca–Cola Co. , 472 F.3d 506, 514 (7th Cir. 2006). Typicality does not require "that the plaintiff's claim and the claims of class members be perfectly identical or perfectly aligned" – some minor variation between a named plaintiff's individual claim and those of the class members she aims to represent is to be expected. See Deiter v. Microsoft Corp. , 436 F.3d 461, 467 (4th Cir. 2006). Rather, the representative's claims must only have the same essential characteristics as the claims of the class at large. Arreola v. Godinez , 546 F.3d 788, 798 (7th Cir. 2008). Typicality ensures that a representative "possess[es] the same interest and suffer[s] the same injury as the class members." Gen. Tel. Co. of the SW v. Falcon , 457 U.S. 147, 156, 102 S.Ct. 2364, 72 L.Ed.2d 740 (1982). The typicality requirement is designed to ensure that there is "enough congruence between the named representative's claim and that of the unnamed members of the class to justify allowing the named party to litigate on behalf of the group." Spano v. The Boeing Co. , 633 F.3d 574, 586 (7th Cir. 2011). Moreover, as noted by the Fourth Circuit in Soutter v. Equifax Info. Servs., LLC , 498 F. App'x 260 (4th Cir. 2012), "typicality tends to merge with commonality." Thus, the same reasons as to why there is commonality will support (or counsel against) a finding of "typicality."

The Court finds that, at least with respect to Plaintiffs’ putative class seeking injunctive relief, their claims are typical of their fellow class members. As discussed above, like the other members of the class, Plaintiffs will pursue their claims under the DPPA based on the inferential evidence that the personal information in their Crash Reports most likely came from either DMV records (through the accident report software connections) or a driver's license or DMV identification card or based on the indication in their Crash Reports that the address on the report is the same as on their driver's license. Also, they assert that their personal information was impermissibly disclosed by Defendants without a showing that the disclosure was made only for a purpose permitted by the statute. Thus, their claims are typical of the claims of other class members.

The Defendants’ defenses as to injunctive relief would also be typical, based on their position that the accident reports are not themselves "motor vehicle records" and that the Plaintiffs’ inferential evidence is insufficient to establish a likelihood that the information came from a DMV record. With respect to the propriety of their disclosures, Defendants’ defenses rest on their common allegations that their disclosures either were permitted as vendors to CMPD and other law enforcement agencies or that they had no obligation under the DPPA to determine a permissible use prior to disclosing or making available the class members’ personal information to their numerous customers. Therefore, the Court finds that the requirement of "typicality" has been satisfied.

d) Adequacy

Representative parties and class counsel must "fairly and adequately protect the interests of the class." Fed. R. Civ. P. 23(a)(4), (g)(4) ; see also Sharp Farms v. Speaks , 917 F.3d 276, 290 & n.7 (4th Cir. 2019). Defendants have not challenged either the adequacy of the Plaintiffs or their counsel to represent the class, and the Court similarly finds that they will adequately represent the class the Court intends to certify. Therefore, this final Rule 23(a) requirement and each of the Rule 23(a) requirements has been met.

3. Rule 23(b) Classes

Having determined that all of the requirements of Rule 23(a) have been met, the Court must now determine which, if any, of the types of classes described in Rule 23(b) are appropriate in this action. To be maintained as a class action, a case must not only meet the four requirements of Rule 23(a) but it also must fit into one of the four categories of Rule 23(b), and it may fit into more than one. Fed. R. Civ. P. 23 ; Krakauer , 925 F.3d at 655. In other words, Rule 23 recognizes that there are cases that satisfy the Rule 23(a) criteria—numerous individuals with common questions whose rights are being pursued by an adequate class representative with typical claims—but that are unworthy of class certification on those grounds alone.

Rule 23(b)(1)(A) describes the "rarely used" category of class actions where the prosecution of "separate actions by or against individual members of the class would create a risk of incompatible standards of conduct for the adverse party due to inconsistent or varying adjudications with respect to individual members of the class." See 2 William Rubenstein et al., Newberg on Class Actions, § 4:1 (5th ed. 2020) (hereinafter "Newberg"); Reyes v. Julia Place Condominiums Homeowners Ass'n, Inc. , 2014 WL 7330602, *10 (E.D. La. 2014) (noting that Rule 23(b)(1)(A) category is "rarely utilized" and "does not cover situations in which multiple plaintiffs sue a single defendant for money damages"). Rule 23(b)(1)(B) class actions are appropriate in situations where an individual judgment, while not technically concluding the claims of other members, might do so as a practical matter, for example a suit against a single defendant whose funds are so limited that they are incapable of satisfying all the potential claimants. See Fed. R. Civ. P. 23(b)(1)(B).

Rule 23(b)(2) authorizes a class action when a party has taken or refused to take action with respect to a class, and "final injunctive relief or corresponding declaratory relief is appropriate with respect to the class as a whole." See Fed. R. Civ. P. 23(b)(2). The (b)(2) class action is often referred to as an "injunctive" class suit. See Newberg at § 4.1.

Finally, Rule 23(b)(3) permits a class action in all other circumstances where the prerequisites of Rule 23(a) are met, and two additional criteria are satisfied: (1) that questions of law or fact common to members of the class predominate over any questions affecting only individual members and (2) that a class action is superior to other available methods for the fair and efficient adjudication of the controversy. See Fed. R. Civ. P. 23(b)(3). This is the most common category for money damage cases, especially small claims class actions, and hence is commonly referred to as the "money damages" class action. See Krakauer , 925 F.3d at 655 ( Rule 23(b)(3) is the "common vehicle" for class actions "which seek damages for widespread wrongful conduct"); Newberg at § 4.1.

As discussed below, the Court finds that an "injunctive class" limited to CMPD accident reports should be certified, but declines to certify a class under Rule 23(b)(1), which is inapplicable to this action, or a money damages class under Rule 23(b)(3) because the Court finds it is not a superior procedure given the Defendants’ right to challenge damages individually based on whether a particular person's Crash Report was disclosed for an improper purpose under the DPPA.

a) Rule 23(b)(1)

Plaintiffs seek certification under both Rule 23(b)(1)(A) and (B). See Tatum v. R.J. Reynolds Tobacco Co. , 254 F.R.D. 59, 66 (M.D.N.C. 2008) (citation and internal quotation marks omitted) ("In essence, Rule 23(b)(1)(A) considers possible prejudice to the defendants, while 23(b)(1)(B) looks to possible prejudice to the putative class members."). However, beyond arguing that the DPPA creates "uniform standards and requirements" for those who are subject to the statute – which is of course true for nearly all statutes – Plaintiffs do not articulate how Defendants would be held to "incompatible standards of conduct" if, in individual actions, some class members proved a violation of the DPPA and others did not. See Newberg at § 4.1. (Noting that 23(b)(1) class actions generally do not cover situations in which multiple plaintiffs sue a single defendant for money damages with some plaintiffs prevailing and some losing because the fact that the defendant must pay some claimants but not others does not create the danger at which the Rule is aimed).¹⁴ Indeed, Defendants argue that instead of prejudicing the Defendants, individual actions will allow them to assert individual defenses and that different results as to different class members in individual actions would not necessarily lead to confusion concerning how the Defendants were required to apply the DPPA.¹⁵

14 Rather, Rule 23(b)(1)(A) is reserved for that subset of cases in which the different adjudicatory outcomes would put the defendant in a true bind—for example, if bondholders sued to have a bond declared invalid and some won and some lost; in that circumstance, the municipality would not know how to proceed with regard to its outstanding obligations. Id.

15 It might be that Plaintiffs’ claim that Defendants allegedly failed to comply with their obligation to obtain and keep records of the permissible purposes for which Crash Reports accident reports were disclosed could create an incompatible duty with respect to that obligation, but, as discussed below there is no private right of action to pursue this claim and, in any event, the Defendants could theoretically keep one person's records but not another's. Also, as there may be no damages associated with such an obligation (no one is necessarily harmed if a record of lawful use is not retained for the prescribed period), if this claim could proceed it would be better viewed as a potential class under Rule 23(b)(2).

Similarly, with respect to Rule 23(b)(1)(B), the putative class members would not be prejudiced by a finding against the class representatives nor would their ability to pursue their own claims be "substantially impair[ed] or impede[d]" by the Plaintiffs’ DPPA claims. This is not a " ‘limited fund’ circumstance, whereby individual lawsuits may exhaust the limited amount of assets available and leave some claimants without a remedy." McLaurin v. Prestage Foods, Inc. 271 F.R.D. 465, 478 (E.D.N.C. 2010). Therefore, Rule 23(b)(1) is inapplicable to this action, and the Court declines to certify a class under Rule 23(b)(1).

b) Rule 23(b)(2)

Plaintiffs also seek certification under Rule 23(b)(2). A class may be certified under 23(b)(2) when "the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole." Fed. R. Civ. P. 23(b)(2). Therefore, Rule 23(b)(2) sets forth two basic requirements: (1) the party opposing the class must have acted, refused to act, or failed to perform a legal duty on grounds generally applicable to all class members, and (2) final relief of an injunctive nature or a corresponding declaratory nature, settling the legality of the behavior with respect to the class as a whole, must be appropriate. See R.I.L-R v. Johnson , 80 F.Supp.3d 164, 182 (D.D.C. 2015). Both of these requirements are satisfied here. Defendants have admitted that they generally disclose the proposed class members’ personal information in all CMPD Crash Reports without redaction (and without a determination of the permissible purpose for the disclosure – although Defendants contend that they have authority to do so based on their relationship with CMPD and other law enforcement agencies). Thus, Defendants have acted and refused to act generally in the same manner as to the whole class.¹⁶

16 Also, certification of a Rule 23(b)(2) class is proper even if not all class members may have suffered the injury posed by the class representatives so long as the challenged policy or practice was generally applicable to the class as a whole. Newberg at § 4.28.

Also, final injunctive relief is appropriate for the class as a whole. See Krakauer , 925 F. 3d at 656. Recently, in Krakauer , the Fourth Circuit upheld the certification of a class action in an action under the Telephone Consumer Protection Act ("TCPA"), a remedial public oriented statute comparable in many ways to the DPPA. In doing so, the court explained:

Given the remedial purpose of the TCPA, it is no surprise that its cause of action would be conducive to class-wide disposition. In enacting the law, Congress sought to deter an activity that, while pernicious and disruptive, does not

trigger extensive liability in any single case. Since few individuals would have an incentive to bring suit, no matter how frustrated they were with the intrusion on their privacy, the TCPA opted for a model that allows for resolution of issues without extensive individual complications.

Id. Like the TCPA, in the DPPA Congress sought to broadly protect the public from harassment (as a consequence of the necessity of providing their personal information in connection with motor vehicle records), but "extensive liability" is not triggered in any particular case. Accordingly, if a Defendant is found to have, as alleged here, engaged in a pattern and practice of disclosing thousands of Crash Reports that violate the DPPA it is appropriate to redress that conduct with injunctive relief. An injunction ordering an end to any unlawful conduct will properly enforce the statute. See Douglin v. GreatBanc Tr. Co. , 115 F. Supp. 3d 404, 413–14 (S.D.N.Y. 2015) (holding that if Plaintiffs demonstrated a breach of fiduciary duty by defendant then their request for an injunction which "would, in substance, prohibit defendant from engaging in similar conduct in the future" is sufficient on its face to permit certification under Rule 23(b)(2) ); Sykes v. Mel S. Harris & Assocs. LLC , 780 F.3d 70, 97–98 (2d Cir. 2015) (upholding Rule 23(b)(2) certification based in major part on proposed injunction against future violations).

Further, an injunctive class is appropriate notwithstanding Defendants’ contention that the facts related to the disclosure of each class members’ Crash Report are different.¹⁷ While any differences among class members may be relevant to certification of a class seeking money damages under Rule 23(b)(3) as discussed below, such differences are not relevant to the certification of a class limited to seeking only injunctive rather than monetary relief. As to such a class, so long as "each individual class member" is not "entitled to a different injunction" then alleged individual differences do not counsel against certification of a class under Rule 23(b)(2). See Wal-Mart Stores, Inc. v. Dukes , 564 U.S. 338, 360, 131 S.Ct. 2541, 180 L.Ed.2d 374 (2011) (emphasis in original). Here, Plaintiffs seek a single injunction applicable to the class as a whole, which is fully consistent with Dukes.

17 Defendants also argue that the Court should not certify Plaintiffs’ proposed Rule 23(b)(2) class because of Plaintiffs’ request for monetary relief in the form of liquidated damages. While Plaintiffs assert that this request is only "incidental" to their requested injunctive relief, the Court finds otherwise and Plaintiffs will not be permitted to recover monetary damages in connection with the certified Rule 23(b)(2) class, see Dukes , 564 U.S. at 364-65, 131 S.Ct. 2541. And, Plaintiff's request for monetary relief with respect to other potential classes does not bar certification of a class seeking only injunctive relief under Rule 23(b)(2). See Adkins v. Facebook, Inc. , 424 F. Supp. 3d 686, 698 (N.D. Cal. 2019) (certifying a 23(b)(2) class while denying a 23(b)(3) class).

Finally, although they did not raise this issue in their briefing, at oral argument Defendants argued that Plaintiffs do not have standing to assert their claims for injunctive relief, citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). In Lujan , the Supreme Court explained that to establish standing plaintiffs must show that: (1) they suffered an injury in fact that's concrete and particularized and actual or imminent, not conjectural or hypothetical; (2) there is a causal connection between the injury and the conduct complained of; and (3) the injury can be redressed by a favorable decision. Id. at 560–561, 112 S.Ct. 2130. Because the second and third elements of standing are plainly met here, presumably Defendants contend that the plaintiffs don't have an "injury in fact" so they lack standing. The Court disagrees.

First, "Congress may elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law." Spokeo v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1548, 194 L.Ed.2d 635 (2016). In the DPPA, the statute specifically protects people from all disclosure of personal information from motor vehicle records, except in certain permissible instances. 18 U.S.C. § 2721 – 2722 ; see Whitaker v. Appriss, Inc. , 229 F. Supp. 3d 809, 813 (N.D. Ind. 2017). Thus, impermissible disclosure of a plaintiff's personal information in violation of the DPPA creates statutory harm and confers standing. Graczyk v. W. Publ'g Co. , 660 F.3d 275, 278 (7th Cir. 2011) (relying for standing on Congress, through the DPPA, having defined a particular injury in the form of the " ‘obtain[ment], disclos[ure], or [use],’ 18 U.S.C. § 2724(a), of an individual's personal information").

Moreover, the nature of the injunctive relief sought by the proposed class does not deny Plaintiffs standing. Defendants have obtained the personal information of the class members as discussed above and it still remains available without redaction to those who might request it. Defendants and their fellow class members ought not to have to wait until their information is again used inappropriately to maintain standing. See Appriss , 229 F. Supp. 3d at 816 ; Remijas v. Neiman Marcus Group, LLC , 794 F.3d 688, 693 (7th Cir. 2015) ("[T]he Neiman Marcus customers should not have to wait until hackers commit identity theft or credit-card fraud [after a data breach] in order to give the class standing, because there is an ‘objectively reasonable likelihood’ that such an injury will occur."); See also Adkins , 424 F. Supp. 3d at 698 (certifying a 23(b)(2) class in a data breach action in which plaintiffs sought injunctive relief to require Facebook to implement and maintain certain reasonable security measures, even though Facebook argued it had allegedly "fixed the bug" that caused the data breach).

In Adkins , the Court found that a credible threat of real and immediate harm had been sufficiently alleged because the information: (i) had been sensitive and (ii) had been stolen. Id. at 691, citing Krottner v. Starbucks Corporation , 628 F.3d 1139, 1143 (9th Cir. 2010). Similarly, in this case, not only has the class’ personal information been indisputably obtained, it still remains available for disclosure without redaction or any requirement that it be used for a permitted purpose under the DPPA. The injury-in-fact requirement "helps to ensure that the plaintiff has a personal stake in the outcome of the controversy." Susan B. Anthony List v. Driehaus , 573 U.S. 149, 158, 134 S.Ct. 2334, 189 L.Ed.2d 246, (2014). The personal information obtained and available for disclosure by Defendants assures that plaintiff has such a personal stake in the outcome of the case. Thus, Plaintiffs and the class have established Article III standing.¹⁸ Accordingly, the Court finds Plaintiffs have satisfied the requirements of Rule 23(b)(2) and the Court will certify an "injunctive relief" class and subclass as follows:

18 Defendants also briefly argued that too much time has passed since Plaintiffs’ accidents and suggested that a more "current" accident report victim must be found. The Court is unpersuaded by this argument. If accepted, it would effectively prohibit anyone harmed by Defendants’ conduct from establishing standing because by the time a lawsuit is filed and class certification sought their personal information would, according to Defendants, be "stale" and unlikely to be of further interest to marketers and others who would use the information unlawfully. However, Courts make an exception to the general rules of justiciability for claims like this where a defendant is likely to continue engaging in its conduct but also evade review as soon as a plaintiff files suit. See Campbell-Ewald Co. v. Gomez , 577 U.S. 153, 136 S. Ct. 663, 672, 193 L.Ed.2d 571 (2016) ; Buckeye Tree Lodge & Sequoia Vill. Inn, LLC v. Expedia, Inc. , No. 16-CV-04721-VC, 2019 WL 1170489, at *2–3 (N.D. Cal. Mar. 13, 2019). There is no evidence that Defendants will stop disclosing unredacted personal information contained in North Carolina accident reports without requiring compliance with the DPPA in the absence of an injunction. Therefore, the named plaintiffs have standing to seek injunctive relief.

North Carolina residents whose personal information (as defined by the DPPA) appears on a North Carolina form DMV-349 CMPD vehicle accident report that was created between January 12, 2012 and September 1, 2020 and disclosed by a Defendant to a third party without any contemporaneous record of a purpose permitted by the DPPA. The class does not include any person who gave consent to the disclosure of their personal information by a Defendant.

Subclass – All members of the class whose related accident report indicates that their address in the report is the same as on their driver's license.

Further, the Court will appoint Plaintiffs’ counsel as class counsel for this class under Rule 23(g). In doing so, the Court has considered Plaintiffs’ counsel's long history of handling this matter and demonstrated knowledge of the applicable law; counsel's experience in handling class actions, other complex litigation, and the types of claims asserted in the action; and the resources that counsel will commit to representing the class. See Doc. No. 103-1, pp. 5-11. In sum, the Court finds that Plaintiffs’ counsel will fairly and adequately represent the interests of the class, a finding which Defendants do not challenge.

c) Rule 23(b)(3)

Finally, Plaintiffs seek certification under Rule 23(b)(3). In addition to establishing the requirements of Rule 23(a) have been met as discussed above, to obtain certification under 23(b)(3) the plaintiff must show both that "(1) questions of law and fact common to class members predominate over any questions affecting only individual class members, and (2) that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy." Fed. R. Civ. P. 23(b)(3). Because the Court finds that a class action does not satisfy the final prong of "superiority" it will decline to certify a class under Rule 23(b)(3).¹⁹

19 Because the Court has determined that a class action is not superior in these circumstances it need not and does not reach the issue of predominance beyond noting that the Rule 23(b)(3) predominance inquiry overlaps with the commonality requirement in 23(a)(2), although it is "more demanding" as its focus is "not only on the existence of common questions, but also on how those questions relate to the controversy at the heart of the litigation." See Amchem Prods., Inc. v. Windsor , 521 U.S. 591, 623-24, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997) ; EQT , 764 F.3d at 366.

Notwithstanding evidence of wrongful conduct generally, a class seeking individual monetary damages "cannot be certified ... [if a defendant] will not be entitled to litigate its statutory defenses to individual claims," Dukes , 564 U.S. at 367, 131 S.Ct. 2541. In this action, Defendants argue that the Crash Reports for some class members, including the Plaintiffs themselves, were not disclosed for a purpose that is not permitted by the DPPA. While this defense is not relevant to the Plaintiffs’ claim for declaratory and injunctive relief, which can be proven without determining which Crash Reports were in fact disclosed for an impermissible purpose, Plaintiffs’ proposed Rule 23(b)(3) class seeks money damages for individual class members, which requires that the Court ultimately identify the particular Crash Reports that were improperly disclosed.

As the Court has already found, in many ways representative litigation would be an appropriate vehicle for adjudicating this controversy. Also, Plaintiffs represent that each class member would only be seeking the liquidated damages amount provided by the statute so there would be no need for an individualized assessment of the amount of each class members’ damages. However, in considering "the likely difficulties in managing a class action," Fed. R. Civ. P. 23(b)(3)(D), the Court must also take into account Defendants’ right to challenge whether individual class members are entitled to a statutory damages award. Weighing the benefits and challenges of certifying a class action under these circumstances, the Court finds that a class action is not a superior framework in which to adjudicate Plaintiffs’ money damages claims because of the Defendants’ intention to seek an individualized assessment of the right to recover such damages. Therefore, the Court will decline to certify a class action under Rule 23(b)(3).

B. Summary Judgment

The parties have each filed motions for summary judgment. Defendants raise three arguments in support of their motion. They broadly argue that Defendants’ disclosures of Crash Reports "fall within an express permissible DPPA use," 18 U.S.C. § 2721(b)(1), because they allegedly "act[ed] on behalf of CMPD in carrying out CMPD's obligations under North Carolina's public record laws." Relatedly, Defendants argue that they are entitled to "qualified immunity" because PRUS was allegedly performing a government function and is entitled to the same qualified immunity protections that CMPD would have if it had been made a defendant. Finally, Defendants argue more specifically that Plaintiffs have not offered evidence from which a jury could find that Plaintiffs’ personal information was disclosed for marketing or solicitation in violation of the DPPA or that they suffered actual damages, which Defendants claim must be established before liquidated damages can be awarded.

In its cross motion, Plaintiffs assert that they are entitled to summary judgment because North Carolina Crash Reports are motor vehicle records subject to the DPPA and the reports of their accidents were disclosed by the Defendants for a purpose not permitted by the DPPA (because the Crash Reports were disclosed to, among others, monthly subscribers who may have accessed the information for marketing purposes). Also, Plaintiffs contend that Defendants have violated the DPPA by failing to obtain and maintain records of the permissible uses for which the Crash Reports were disclosed. See 18 U.S.C. § 2721(c).

For the reasons discussed below, the Court finds that Defendants’ conduct is not authorized by the "governmental function" purpose permitted by the DPPA nor are they entitled to "qualified immunity" from liability. Also, with respect to their more specific arguments related to the purpose for which Plaintiffs’ personal information was used, the Court finds that they are not entitled to summary judgment because there are disputed factual issues related to whether Plaintiffs’ information was improperly disclosed. For the same reason, the Court will deny Plaintiffs’ cross motion for summary judgment as to their own claim for liquidated damages. Also, the Court will deny Plaintiffs’ motion for summary judgment based on the alleged violation of 18 U.S.C. § 2721(c) because there is no private right of action to assert this violation.

The Court will, however, grant summary judgment on Plaintiffs’ claims for declaratory and injunctive relief with respect to the Rule 23(b)(2) subclass of those class members whose accident reports indicate that the address in the report matches the address on their driver's license. The Court finds that Defendants have violated the DPPA as a matter of law because the Crash Reports related to that subclass are "motor vehicle records" as discussed earlier and Plaintiffs are entitled to summary judgment because, inter alia , it is undisputed that Defendants make no effort to limit the disclosure of Crash Reports for purposes permitted by the DPPA (and have disclosed the personal information contained in those records for marketing and/or solicitation purposes that are not permitted under the DPPA), even though all records may not have been disclosed (as distinguished from just being "made available") and some records may have been disclosed for permissible purposes. Accordingly, the Court will enjoin the Defendants from continuing any conduct that violates the DPPA.

1. Permissible "Governmental Function" Use under 18 U.S.C. § 2721(b)(1)

Defendants’ first class wide argument in support of their motion for summary judgment is that they have a "permissible use" for their disclosure of the Crash Reports because they are acting "on behalf of" CMPD in making the Crash Reports available as "public records," which they claim qualifies as a permissible DPPA use under 18 U.S.C. § 2721(b)(1). The Court disagrees. First, while the Crash Reports may be public records, see N.C. Gen. Stat. § 20-166.1(i), the disclosure of accident reports is expressly subject to the DPPA. See N.C. Gen. Stat. § 20-43.1(e).

This distinction is neither inconsistent nor remarkable. Indeed, the fundamental purpose of the DPPA is to limit the public disclosure of personal information contained in motor vehicle records. Therefore, while an accident report may be a public record subject to unlimited disclosure with respect to information in the report that is not personal information protected under the DPPA, it would completely undermine the purpose of the DPPA if a state could simply designate a document containing personal information subject to DPPA protection as a "public record" and thereby avoid complying with its restrictions. Simply put, the very essence of the DPPA is to limit the disclosure of information that had previously been made widely available as a public record; so, with due respect to Defendants’ argument, it would be nonsensical to hold that a permissible governmental "function" under the DPPA is to publicly disclose personal information in a "public record."^{20 , 21} This conclusion applies to the Crash Reports whether they are obtained from CMPD or another local law enforcement agency or the state DMV. Defendants argue that because CMPD makes Crash Reports available as "public records" without any restrictions if the reports are obtained in person then they can make the same reports available online without complying with the DPPA. However, as discussed above, whether or not they are "public records," Crash Reports which qualify as "motor vehicle records" or which contain personal information obtained from "motor vehicle records" such as DMV records or driver's licenses are subject to the DPPA. So, to the extent that CMPD provides such records to the public without redacting that personal information or limiting disclosure only for those uses permitted by the DPPA then it is in violation of the statute.²²

20 To be clear, the gathering of personal information to prepare the Crash Reports is a government function permitted by section 2721(b)(1) in the same way that gathering personal information to create a driver's license or motor vehicle registration is permitted by the act. However, once the information is lawfully obtained, the disclosure of the information, in and of itself, is not an independent governmental function that is permitted by the DPPA (absent redaction or a separate permitted use).

21 And, it is familiar doctrine that the prohibition of a federal statute "may not be set at naught by a state statute." Sola Electric Co. v. Jefferson Electric Co. , 317 U.S. 173, 63 S.Ct. 172, 87 L.Ed. 165 (1942).

22 As acknowledged by the parties, the DMV already limits disclosure of Crash Reports in accordance with the DPPA through a standard form (TR-67) so it should not be difficult for CMPD and other local law enforcement agencies to comply with the DPPA.

In the same vein, Defendants’ argument that the fact that Crash Reports are sent in "separate workflows" to DMV and PRUS does not help their cause. Indeed, it would substantially elevate form over substance for the Court to hold that a person cannot obtain a Crash Report from a local DMV office without complying with the DPPA but can go down the street and get the very same report from CMPD (or online from Defendants) without any DPPA redactions or restrictions. On this point, Defendants also cite a 2005 Opinion by the office of the Attorney General of North Carolina ("NCAG") opining on the "legal obligations of the Division of Motor Vehicles (‘DMV’) and local law enforcement agencies upon receiving a request for a copy of a motor vehicle accident report" in view of the DPPA and North Carolina's public records act. See 2005 N.C. AG LEXIS However, that opinion either supports this Court's conclusions or is unpersuasive.²³

23 Indeed, the opinion itself noted that, "[w]e recognize that the courts may eventually provide clarification of the DPPA's requirements which conflicts with the advice offered in this opinion."

In the opinion, the NCAG's office begins by stating that the United States Supreme Court has unanimously ruled that Congress had the power under the Commerce Clause to require the states to comply with the DPPA. Id. at *3. "Therefore, federal law controls, and the State's Public Records Act is preempted by the DPPA where there is a direct conflict." Id. at **3-4, citing Oklahoma ex rel. Oklahoma Dep't of Public Safety v. United States , 161 F.3d 1266, 1272 (10th Cir. 1998) ("the DPPA directly regulates the disclosure of [personal information from motor vehicle records] and preempts contrary state law"), cert. denied, 528 U.S. 1114, 120 S.Ct. 930, 145 L.Ed.2d 810 (2000). The opinion goes on to say:

[I]t is our view that the intent of Congress in enacting the DPPA was to restrict a state department of motor vehicles from releasing certain personal identifying information in records obtained and maintained in connection with the department's responsibility for the regulation of drivers and motor vehicles. Such personal identifying information may be contained within a variety of official motor vehicle records, including accident reports.

In responding to a request for information under North Carolina's Public Records law, the relevant inquiry for DMV must therefore be whether the

document contains personal identifying information about a motor vehicle operator which cannot be disclosed under the DPPA. An accident report will likely include both information which is protected by the DPPA and information which is excepted from the DPPA. ... It is therefore our opinion that motor vehicle accident reports are public records, but should be released only after DMV has redacted personal identifying information in accordance with the DPPA.

Id. at *5 (emphasis added). However, despite this correct interpretation of the relationship between the DPPA and North Carolina's public records law with respect to the DMV, the opinion does not properly apply that conclusion to local law enforcement agencies. Rather, without citation or analysis beyond the conclusory (and incorrect) statement that "the DPPA's restrictions generally apply only to a state department of motor vehicles,"²⁴ the opinion states that local law enforcement agencies should comply with the Public Records Act rather than the DPPA with respect to the exact same accident reports being sent to the DMV (which the opinion then again notes are subject to the DPPA). For the reasons stated above, the Court declines to find any basis either in the text of the statute or its purpose to treat the same accident report differently based on whether it is disclosed by the DMV or another agency of the State.²⁵

24 As discussed above, the DPPA applies to all motor vehicle records as defined by the statute and limits the disclosure of personal information contained in such records by DMVs, local law enforcement agencies and private individuals or entities who obtain that information from them, not just DMVs.

25 A subordinate division of the state like a city administrative unit is a state agency. See Smith v. Hefner , 235 N.C. 1, 68 S.E.2d 783 (1952).

Accordingly, the Court holds that Defendants cannot wrap their profit seeking efforts in the mantle of "public service" to avoid compliance with the DPPA and are not entitled to summary judgment based on a claim that their disclosure of personal information in the Crash Reports was permitted under 18 U.S.C. § 2721(b)(1).

2. Qualified Immunity

Qualified immunity protects government officials performing discretionary functions "from liability for civil damages insofar as their conduct does not violate clearly established statutory or constitutional rights of which a reasonable person would have known." Harlow v. Fitzgerald , 457 U.S. 800, 818, 102 S.Ct. 2727, 73 L.Ed.2d 396 (1982). Accordingly, claims for declaratory and injunctive relief are not affected by qualified immunity. Lefemine v. Wideman , 672 F.3d 292, 303–04 (4th Cir. 2012), citing Roller v. Cavanaugh , 984 F.2d 120, 122 (4th Cir. 1993), overruled in part on other grounds by Ca. Dep't of Corr. v. Morales , 514 U.S. 499, 115 S.Ct. 1597, 131 L.Ed.2d 588 (1995). Therefore, Defendants asserted qualified immunity defense has limited application here where the Court has only certified an injunctive relief class.

Further, Defendants are not entitled to qualified immunity even with respect to Plaintiffs’ claim for liquidated damages. In contracting with PRUS to authorize it to make Crash Reports available subject to the obligations of federal law , the City of Charlotte and CMPD have not violated the DPPA in any manner (because the Defendants could have disclosed the Crash Reports only in accordance with the DPPA). Thus, those governmental actors need no immunity, qualified or otherwise, that could potentially shield someone who is acting on their behalf. Rather, Plaintiffs’ claims in this action are solely focused on whether Defendants ’ conduct violated the DPPA. Indeed, if Defendants violated the DPPA then they have in fact violated their agreements with CMPD. Plainly, a person may not claim "qualified immunity" based on conduct that violates the contract under which they claim the immunity arises. Therefore, Defendants are not entitled to qualified immunity for the claims asserted in this action.

3. Plaintiffs’ Claim for Liquidated Damages

Both parties seek summary judgment on Plaintiffs’ claim for statutory liquidated damages. While the Court finds that Plaintiffs’ Crash Reports are "motor vehicle records" under the DPPA because the reports indicate that their personal address on the report is the same as on their driver's licenses (and thus the record "pertains to" their driver's license), there is a factual dispute among the parties as to whether those reports were disclosed for a purpose not permitted by the statute. On the one hand, Plaintiffs have presented sworn deposition testimony that they received written marketing solicitations soon after the accident that they contend were sent as a result of Defendants’ disclosure of their Crash Reports. However, Plaintiffs do not have copies of the letters soliciting their business nor do they recall the names of the businesses that solicited them. Defendants in turn deny that Plaintiffs have provided sufficient proof of receiving marketing solicitations because of their Crash Report disclosures. While there is evidence, see Doc. No. 126-2, that over 20 businesses had access to the Crash Reports as monthly subscription customers of the Defendants the parties dispute whether Plaintiffs’ reports were simply "made available" to these subscribers or were actually accessed by them.²⁶

26 The Court does not decide here whether Defendants making their database of accident report records "available" to monthly subscribers and others constitutes "disclosure" under the DPPA. However, disclosure certainly occurs as soon as any accident report containing unredacted personal information is accessed by a customer, regardless of whether the customer "downloads" or uses the information. Accessing a record protected by the DPPA to determine if it can be used for marketing purposes or warehousing such records by an end user simply on the possibility that the record may be useful in the future (as distinguished from distributors of information like the Defendants who are permitted to obtain records in bulk for later lawful distribution) are not uses permitted by the DPPA.

It is for the jury not this Court to decide this factual dispute and determine whether it is more likely than not that Plaintiffs’ Crash Reports were disclosed by Defendants for a purpose not permitted by the DPPA. Therefore, both parties’ motions for summary judgment will be denied on Plaintiffs’ claim for statutory liquidated damages.^{27 , 28}

27 Defendants also argue that Plaintiffs must show "actual damages" (such as documented emotional harm) to recover liquidated damages under the DPPA. The Court disagrees. In setting a floor of $2500 in "liquidated damages" in addition to providing a full opportunity to obtain "actual damages" Congress plainly intended not to require proof of "actual damages" to recover "liquidated damages." See, e.g., Pichler v. UNITE , 542 F.3d 380, 397–400 (3d Cir. 2008) ; Kehoe v. Fid. Fed. Bank & Tr. , 421 F.3d 1209 (11th Cir. 2005), cert. denied, 547 U.S. 1051, 126 S.Ct. 1612, 164 L.Ed.2d 353 (2006).

28 Further, as noted above, the Court finds that Plaintiffs have Article III standing to maintain their claims. See Heglund v. Aitkin Cty. , 871 F.3d 572, 577 (8th Cir. 2017) ; Krakauer , 925 F. 3d at 652-654 (finding Article III standing under the analogous TCPA).

4. Claim of DPPA Liability under 18 U.S.C. § 2721(c)

In their Motion for Summary Judgment, Plaintiffs claim that Defendants violated 18 U.S.C. § 2721(c) "by failing to keep any of the records of a permissible purpose for five years." While Defendants acknowledge that they failed to fully comply with this requirement, the DPPA does not provide a private right of action for the absence of the required records.

The limits of the private cause of action under the DPPA is found in section 2724(a). That section only makes liable any person who "knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under [the statute] ...." 18 U.S.C. § 2724 (a). The failure to obtain and keep records for five years identifying each person or entity that receives information and the permitted purpose for which the information will be used under 18 U.S.C. § 2721(c) is not encompassed by that description, even though it is plainly an obligation of the statute and subject to a potential criminal fine under 18 U.S.C. § 2723.²⁹ "Where Congress includes particular language in one section of a statute but omits it in another section of the same Act, it is generally presumed that Congress acts intentionally and purposely in the disparate inclusion or exclusion." Russello v. United States , 464 U.S. 16, 23, 104 S.Ct. 296, 78 L.Ed.2d 17 (1983) (citation and internal quotation marks omitted). Therefore, the Court finds that Plaintiffs may not pursue a private cause of action under section 2724(a) for Defendants’ alleged failure to meet their recordkeeping obligations under section 2721(c).

29 Similarly, any failure by a state or state agency, including a DMV or city acting within the scope of its governmental authority, is not subject to a private right of action under section 2724(a) because a "State or agency thereof" is not defined as a "person" under the DPPA, although they are plainly subject to the DPPA's disclosure restrictions described in section 2721(a) and subject to a potential civil penalty under 18 U.S.C. § 2723.

5. Injunctive Relief for the Rule 23(b)(2) Subclass

Finally, as noted above, the Court will grant summary judgment on Plaintiffs’ claims for declaratory and injunctive relief with respect to the Rule 23(b)(2) subclass³⁰ of those class members whose accident reports indicate that the address in the report matches the address on their driver's licenses. As to the question of whether the Crash Reports are "motor vehicle records" under the DPPA, the Court finds as a matter of law that those reports, as they relate to the members of the subclass, "pertain to" their driver's licenses and are therefore "motor vehicle records" as discussed above.

30 While it is a close question, the Court finds that although Plaintiffs have produced persuasive evidence that the accident reports for many of the class members contain personal information that was obtained from DMV records through the F11 software function or from their driver's licenses, they have not established for the purpose of summary judgment, construing all inferences and evidence for Defendants, that a reasonable jury could not but find that they proved that "it is more likely than not" that their personal information came from motor vehicle records subject to the DPPA.

Moreover, it is undisputed that Defendants make no effort to limit the disclosure of Crash Reports for purposes permitted by the DPPA (and the Court finds that no reasonable jury could fail to determine that Defendants have routinely disclosed the personal information contained in those records for marketing and/or solicitation purposes that are not permitted under the DPPA). Accordingly, the Court declares³¹ that Defendants have violated the DPPA as set forth above and will enjoin the Defendants from continuing any conduct that violates the DPPA³² with respect to the subclass as follows:

31 The Declaratory Judgement Act provides that federal courts "may declare the rights and other legal relations of any interested party." 28 U.S.C. § 2201. The Fourth Circuit has explained that a declaratory judgment action is appropriate "when the judgment will serve a useful purpose in clarifying and settling the legal relations in issue, and ... when it will terminate and afford relief from the uncertainty, insecurity, and controversy giving rise to the proceeding." Centennial Life Ins. Co. v. Poston , 88 F.3d 255, 256 (4th Cir. 1996) (quoting Aetna Cas. & Sur. Co. v. Quarles , 92 F.2d 321, 325 (4th Cir. 1937) ). In short, "declaratory judgments are designed to declare rights so that parties can conform their conduct to avoid future litigation." Hipage Co. v. Access2Go, Inc. , 589 F.Supp.2d 602, 615 (E.D. Va. 2008).

32 While the Court has not granted summary judgment for the class as a whole for the reasons described above, the Court finds that there is abundant evidence that the personal information contained in many of the subclass members’ accident reports came from either the DMV database through the "F11" function or the compelled production of a driver's license at the accident scene such that the Court in the exercise of its discretion under the DPPA to award equitable relief will enjoin Defendants from any conduct that violates the statute, including the disclosure of any personal information (not just the class member's address) that came from the DMV or a driver's license. District courts have broad discretion when fashioning injunctive relief. Ostergren v. Cuccinelli , 615 F.3d 263, 288 (4th Cir. 2010), and an injunction's scope may extend to that which is "necessary to provide complete relief to the plaintiff." Mountain Valley Pipeline, LLC v. Wender , 337 F. Supp. 3d 656, 672 (S.D.W. Va. 2018), citing PBM Prods., LLC v. Mead Johnson & Co. , 639 F.3d 111, 128 (4th Cir. 2011) (quoting Kentuckians for Commonwealth v. Rivenburgh , 317 F.3d 425, 436 (4th Cir. 2003)). In the absence of an injunction prohibiting Defendants from disclosing all personal information subject to the DPPA, the members of the subclass would not receive the "complete relief" to which they are entitled.

Defendants and their officers, agents, servants, employees, and attorneys and those acting in active concert with them are enjoined from disclosing or making access available to CMPD DMV Form 349 vehicle accident reports that include a North Carolina resident's "personal information" as defined in the DPPA and are "motor vehicle records" under the DPPA or contain such personal information sourced from the DMV, a driver's license or other motor vehicle record without redacting the personal information, obtaining the consent of the person whose personal information appears on the record or having a good faith belief³³ that the accident report will be used for a specific purpose permitted by the DPPA (which Defendant shall record and maintain in accordance with 18 U.S.C. § 2721 (c) ).³⁴

33 In forming a "good faith" belief as to whether an accident report is being disclosed for a purpose permitted by the DPPA, Defendants must do more than simply obtain a general representation of a lawful intent to use the record; that is, they must determine the specific purpose for which the record is being disclosed and form a reasonable belief that the stated purpose is at least credible under all the circumstances. Defendants do not, however, have an obligation to independently investigate each proposed use of records subject to the DPPA.

34 Although this injunction does not apply to members of the public outside the certified class, its reasoning is of course generally applicable to all North Carolina accident reports subject to the DPPA as described above, and the Court notes that the DPPA provides the Court discretion to award "punitive damages upon proof of willful or reckless disregard of the law" if future violations of the DPPA are proven. See 18 U.S.C. § 2724 (b)(2).

C. Motion to Appoint Interim Counsel and Motion to Stay

The remaining motions before the Court are Plaintiffs’ Motion to Appoint Interim Counsel and Defendants’ Motion to Stay consideration of the Plaintiffs’ Motion for Summary Judgment. Both of these motions will be denied as moot. The Court is now certifying a class under Rule 23 (b)(2), appointing Plaintiffs’ counsel as class counsel and denying certification of the Plaintiffs’ other proposed classes; therefore, appointment of interim counsel is unnecessary. Similarly, because the Court is declining to certify a class under Rule 23(b)(3), the only type of class which provides potential class members the right to "opt-out" which was the root of Defendants’ concern, and the Court has in any event entered summary judgment for Plaintiffs’ subclass, there is no basis for the Court to further consider the Defendants’ requested stay.

IV. ORDER

NOW THEREFORE IT IS ORDERED THAT:

1. Plaintiff's Motion to Certify Class (Doc. No. 101) is GRANTED in part and DENIED in part as described above;

2. Plaintiffs’ counsel, Larry S. McDevitt, David M. Wilkerson, Eugene C. Covington, Jr. and Chris Cogdill are appointed as class counsel for the certified class pursuant to Rule 23(g) ;

3. Plaintiffs’ Motion for Summary Judgment (Doc. No. 107) is GRANTED in part and DENIED in part as described above;

4. Defendants and their officers, agents, servants, employees, and attorneys and those acting in active concert with them are enjoined from violating the DPPA as described above;

5. Defendants’ Motion for Summary Judgment (Doc. No. 109) is DENIED ;

6. Plaintiffs’ Motion for Appointment of Interim Co-Lead and Liaison counsel (Doc. No. 103) is DENIED as moot;

7. Defendants’ Motion to Stay a ruling on Plaintiffs’ Motion for Summary Judgment (Doc. No. 120) is DENIED as moot; and

8. This case shall proceed to trial on the merits on Plaintiffs’ claim for statutory liquidated damages and the full certified class’ claim for injunctive relief in the absence of a voluntary resolution of the dispute among the parties.

SO ORDERED ADJUDGED AND DECREED.