Opinion
Civil Action No. 3:05CV-594-H.
July 28, 2006
MEMORANDUM OPINION
Plaintiff, Tony Rufra ("Rufra") was accused of committing a series of bank robberies in Louisville, Kentucky. U.S. Bankcorp, Inc. (the "Bank") actually discovered exculpatory evidence within its banking records and provided it to authorities. Nevertheless, Rufra has now filed suit against the Bank for its conduct during the investigation of those robberies. Rufra asserts a federal claim under the Right to Financial Privacy Act ("RFPA") as well as numerous related state law claims. The Bank has moved to dismiss the complaint.
The motion raises the issue of the extent to which the RFPA prohibits a bank from voluntarily disclosing confidential customer information to authorities that may be relevant to an ongoing criminal investigation. The unusual circumstances of this case create some difficulty in the analysis. However, the Court ultimately concludes that Rufra has not stated any claim under either the RFPA or state law.
I.
We now know that in 2002, a man named David Brankle ("Brankle") committed a series of bank robberies in Louisville, Kentucky. He robbed a U.S. Bank on June 19, 2002; a 5/3 Bank on September 3rd; and the same U.S. Bank branch on September 19th. Even after three robberies no one could identify the robber and, therefore, Brankle's identity as the culprit had alluded authorities.
In a strange coincident, however, on September 23rd the teller from 5/3 Bank robbery spotted Tony Rufra while he was grocery shopping just outside of the bank. She thought that Rufra looked like the man who had robbed her. The teller called the Kentucky state police and reported her suspicions. The police secured a warrant for Rufra's arrest on all three robberies, which were believed to have been committed by the same man. After the arrest, police officers questioned the manager and the two tellers who had witnessed the robberies at the U.S. Bank branch. They presented a six-person photo line up to each of them. All three of these individuals positively identified Rufra as the robber.
However, a few days later, the Bank employees, realizing that they had actually recognized Rufra as a customer recanted their identifications. Then the manager and one of the tellers "retrieved plaintiff's personal bank account information and realized that he posted a personal transaction on September 3, 2002, when the robber was robbing the 5/3 Bank." First Amended Complaint ¶ 12. The Bank employees "then retrieved the account information and the surveillance tape of the transaction and initiated contact with the law enforcement agency to disclose the private financial records of the plaintiff." First Amended Complaint ¶ 13. The banking information and the surveillance tape provided Rufra with an alibi.
At this point in time, Rufra was still in custody. Unfortunately, the authorities did not act upon this information with any great dispatch. After spending approximately three months in state custody, Rufra was ultimately set free and the charges against him were dismissed. Brinkle, the man who actually committed the robberies, was located and convicted. Rufra's lawsuit arises from his displeasure that the Bank provided the confidential but exonerating information directly to law enforcement officials, rather than to him or his attorneys. On a motion to dismiss claims under Fed.R.Civ. 12(b)(6), a court is to construe all of the allegations of the pleading in the light most favorable to the plaintiff and accepted as true. Bovee v. Coopers Lybrand C.P.A., 272 F.3d 356, 360 (6th Cir. 2001). Dismissal is proper only if the plaintiff can prove no set of facts in support of its claims that would entitle it to relief. Id.
II.
In Count I of his complaint, Rufra alleges that the Bank violated his rights under the Right to Financial Privacy Act ("RFPA") by disclosing his financial records — such as the date, time and location of his personal banking transactions — to law enforcement authorities. Indeed, § 3403(a) declares that financial institutions may not provide "any Government authority access to or copies of, or the information contained in, the financial records of any customer except in accordance with the provisions of this title." However, the RFPA's ban on such disclosures is far from absolute. It seeks to balance the customers' right of privacy and the need of law enforcement agencies to obtain financial records pursuant to legitimate investigations. Anderson v. La Junta State Bank, 115 F.3d 756, 758 (10th Cir. 1997). This case raises three issues addressing that balance: (1) whether the complaint alleges sufficient involvement of the federal government to trigger application of the RFPA; (2) whether the disclosures were authorized under section 3403 despite the bank's lack of subjective suspicion; and (3) if so, whether the Bank disclosed more information than the RFPA permits.
A.
As an initial matter, the Bank argues that Rufra has not alleged a prima facie case under the RFPA because he has failed to allege that it turned over his records to federal authorities. In the complaint, Rufra alleges that the Bank disclosed his financial records to "law enforcement" without specifying whether the agents were state or federal. He also asserts that the robberies prompted a "cooperative investigation by the FBI and local law enforcement" and that "FBI agents investigated the crimes alongside St. Matthews Police Department."
Section 3401 of the RFPA defines "[g]overnment authority" as "any agency or department of the United States, or any officer, employee, or agent thereof." As a result, the RFPA does not apply to the disclosure of financial records to state and local agencies. See United States v. Zimmerman, 957 F. Supp. 94, 96 (N.D. W.Va. 1997); Sornberger v. First Midwest Bank, 278 F. Supp. 2d 935, 938 (C.D. Ill. 2002). In Sornberger, the plaintiffs, like Rufra, were suspects in an ongoing bank robbery investigation. They alleged RFPA violations arising from disclosure of financial records to the state police "and/or" agents of the FBI. The district court conceded that the Act does not apply "if the FBI was not conducting its own investigation but was merely assisting a state investigation." Sornberger, 278 F. Supp. at 939. However, construing the complaint as favorably as possible to the plaintiffs, the court interpreted the allegation to mean that "any evidence the FBI shared with state authorities was obtained in the course of an investigation conducted simultaneously by the United States and not one solely in support of an ongoing state investigation"; and therefore, the court denied the bank's motion to dismiss on that ground. Id.
The Court agrees with that view of § 3401 and applies it similarly here. Rufra's complaint alleges that his records were accessed for use in an investigation conducted by the federal government. The mere fact that state officials ultimately arrested Rufra does not mean that the FBI's involvement was "purely courtesy assistance to the state investigation." Id. Bank robbery is a federal crime under 18 U.S.C. § 2113. The FBI had an independent federal interest in the investigation. The complaint alleges that the FBI investigated the crimes alongside the state authorities. Therefore, the Court concludes that the complaint alleges sufficient federal activity to trigger application of the RPFA.
B.
The Bank did not disclose its records pursuant to either a valid subpoena, court order, or consent from the customer, all of which entitle the government to obtain financial records under the RFPA. The Bank argues, nevertheless, that § 3403(c) protects the alleged disclosures. Under that subsection, a financial institution may notify a Government authority that it has "information which may be relevant to a possible violation of a statute or regulation." 18 U.S.C. § 3403(c). In such circumstances, the financial institution may provide the customer's name or other identifying information and "the nature of the suspected illegal activity." See id. According to Rufra, the § 3403(c) exemption is inapplicable because the Bank did not suspect Rufra of any wrongdoing at the time it disclosed his records. In his complaint, Rufra alleges that the tellers had already realized that Rufra was not the robber by the time the Bank disclosed his records.
On its face, § 3403(c) does not expressly require a bank to subjectively believe a customer is guilty of a crime before turning over his records to the government. However, Rufra cites Sornberger to support his statutory interpretation. In that case, the plaintiffs, like Rufra, had been wrongfully accused of bank robbery. After direct questioning by government investigators, the bank disclosed information contained in the plaintiffs' financial records. The plaintiffs argued that the disclosure was not authorized by section 3403(c) because the bank did not subjectively believe that they had committed the robbery at the time. The court dismissed the plaintiffs' claim, however, holding that "requiring suspicion of a particular individual is only appropriate when the financial institution is providing unsolicited information to a federal authority." Sornberger, 278 F. Supp. 2d at 940. The court reasoned that because the bank turned over the plaintiffs' records after direct questioning by a federal authority, "the "[G]overnment's suspicion of a particular individual — no matter how tenuous-is sufficient to meet the relevancy requirements of § 3403(c)" regardless of whether the bank suspected that individual as well. Id. at 942. Rufra seizes on the court's language and argues that the Bank's disclosure was unsolicited in this case and, therefore, had no authority to do so without individual suspicion of his guilt. This Court, however, finds the Sornberger analysis unpersuasive on this point.
As described above, the language of section 3403(c) contains only three express limitations. The information disclosed must: (1) be "relevant to a possible violation of the law"; (2) it must concern an "individual, corporation or account involved in" suspected illegal activity; and (3) it must concern the nature of the suspected illegal activity. As a matter of logic, information can meet all three of these limitations even if the bank disclosing that information does not suspect any particular individual of a crime. Therefore, requiring subjective suspicion in any case, as the Sornberger court suggested, would impose limiting language upon the statute that is not already present.
A subjective suspicion requirement would create considerable conceptual difficulty in cases like this. A bank is, of course, a business entity that employs various individuals. A subjective suspicion requirement asks a court to determine whether a bank believed that a particular individual was guilty of a crime. But how is a court supposed to make that determination? Does it depend on what the teller making the disclosures believes? Does it depend on what the bank's management believes? What if they disagree? The question is particularly troubling in a case like this one involving bank robbery. In the typical bank robbery, the identity of the perpetrator is unknown. So, focusing suspicion on a particular individual is especially difficult.
Here, the Bank was right to believe that the information disclosed was relevant to a possible violation of law and that it concerned an individual involved in suspected illegal activity. Apparently, at that time, Rufra was the only suspect in a cooperative investigation conducted by the FBI and the Kentucky state police. The manager and two tellers at the Bank had independently identified him as the robber in a photo lineup, as had the teller at the 5/3 Bank. Although the Bank employees later recanted the identifications, the teller at the 5/3 Bank had not. Even though the Bank no longer subjectively believed that Rufra was guilty, it knew that others did. The information it possessed was "relevant to a possible violation" as § 3403(c) requires. Consequently, to disclose such information in these circumstances does not offend the RFPA.
C.
Rufra also argues that the Bank disclosed more information than § 3403(c) authorizes. He does not dispute the bank's authority to disclose his name and account number. As described above, Rufra was the only suspect in an ongoing bank robbery investigation. Accordingly, his name and account number were involved in suspected illegal activity, as required by § 3403(c). The real issue is whether the bank was authorized to disclose the information regarding the date and time of his personal transactions — the very information that established Rufra's alibi.
The relevant statutory provision provides that "[s]uch information may include only the name or other identifying information concerning any individual, corporation or account involved in and the nature of any suspected illegal activity." 12 U.S.C. § 3403(c). Unpacked, that sentence supplies two limitations. First, any identifying information must concern an individual or account that is involved in suspected illegal activity. Second, any other information must concern the nature of the suspected illegal activity. Rufra reads these limitations to mean that the information must describe activities giving rise to the institution's suspicions. However, this Court believes that Rufra's interpretation is unduly narrow.
The "nature of the suspected illegal activity" has been defined broadly by other federal courts. See, e.g., Sornberger, 278 F. Supp. 2d at 942 ("the motive for a criminal action would definitely be included in the `nature' of the illegal activity"); Miranda De Villalba, v. Coutts Co. (USA) Intern., 250 F.3d 1351, 1354 (11th Cir. 2001) (the mention of the amount of a wire transfer in a money laundering case does not exceed the "nature of the suspected illegal activity" because what made the request suspicious was its size, even though the size of the transfer was not a specific element of the crime); United States v. Lewis, 411 F.3d 838 (7th Cir. 2005) (holding that information regarding a customer's physical presence at the bank under suspicious circumstances constituted disclosable information under section 3403(c)). Therefore, there is no question that a bank could disclose information regarding the date and time of a customer's personal transactions if that information were suspicious.
The only difference is that here the information tended to prove that the customer did not commit the bank robbery. No portion of the statute expressly requires information to be incriminating and if Congress had intended to include such a requirement, it could have done so. This Court does not agree, therefore, that a bank's liability depends entirely upon the evidentiary effect of the information disclosed.
Rufra's interpretation also runs contrary to the purpose of the RFPA as a whole. The Tenth Circuit described the RFPA's purpose in Anderson v. La Junta State Bank, 115 F.3d 756 (10th Cir. 1997):
The RFPA was enacted in response to a pattern of government abuse in the area of individual privacy and was intended "to protect the customers of financial institutions from unwarranted intrusion into their records while at the same time permitting legitimate law enforcement activity by requiring federal agencies to follow" established procedures when seeking a customer's financial records.Id. at 758 (quoting Neece v. IRS, 922 F.2d 573, 575 (10th Cir. 1990)). Here, the Bank voluntarily disclosed evidence relevant to an ongoing investigation. If this is illegal, it would inhibit the truth-finding function of criminal investigations, which is what Congress intended to promote by enacting § 3403(c).
Rufra also contends that the Bank violated RFPA by failing to notify him that the bank had disclosed his financial records. To be sure, it may have been better practice for the Bank to notify Rufra before turning over the evidence in this case. However, nothing in the RFPA requires the Bank to do so. Presumably this is because in the typical case notifying the customer that he is a suspected criminal could impede the investigation, creating an incentive for him to flee. 12 U.S.C. § 3404. The only related provision merely states that "a customer may authorize disclosure under section 3402(1) of this title. . . ."
Based on the foregoing, the Court concludes that Rufra can prove no set of facts that would entitle him to relief under the RFPA; and therefore, dismissal is appropriate.
III.
In Counts II, III, and IV, Rufra asserts claims against the Bank under Kentucky law for negligent and intentional infliction of emotional distress (Count II), for infringement of his right to privacy (Count IV) and breach of contract (Count III). The first two of these claims assert that the Bank violated the law by disclosing Rufra's financial records to law enforcement personnel and by failing to notify him of those disclosures. In the last claim, Rufra alleges that the Bank violated its own standard retail banking agreement ("Agreement") which included an express promise by the Bank not to disclose any financial information about him to any third party absent consent or other obligation under law or a valid court order.
Section 3403(c) preempts state and local privacy law to the extent that such law prohibits the voluntary disclosure of the type of information covered by that subsection:
Any financial institution, or officer, employee, or agent thereof, making a disclosure of information pursuant to [ 12 U.S.C. § 3403(c)], shall not be liable to the customer under any law or regulation of the United States or any constitution, law, or regulation of any State or political subdivision thereof, for such disclosure or for any failure to notify the customer of such disclosure.12 U.S.C. § 3403(c); see also Blakely v. United States, 276 F.3d 853, 869 (6th Cir. 2002) (section 3403(c) preempts state-law claim for fraud); Waye v. Commonwealth Bank, 846 F. Supp. 321, 324 (W.D. Pa. 1994) (holding that § 3403 barred plaintiff's negligence and bad faith claims against bank for reporting to federal authorities that plaintiffs were involved in a check kiting scheme, which they claim was untrue). Consequently, under the plain language of § 3403, Rufra is barred from asserting a state cause of action against the Bank for its disclosure of his financial records or for its failure to notify Rufra of such disclosure.
IV.
In Count V, Rufra alleges that the Bank placed him in a false light by identifying him as the bank robber and by failing to notify him that it had exculpatory records in its possession. In McCall v. Courier-Journal Louisville Times Co., 623 S.W.2d 882, 888 (Ky. 1981), the Kentucky Supreme Court expressly recognized a cause of action for "false light" invasion of privacy. In that case, the court adopted the Restatement (Second) of Torts § 652E (1976), which illustrates the requirements for establishing a "false light" invasion of privacy. Id. That section imposes liability on a defendant who "gives publicity to a matter concerning another that places the other before the public in a false light." Restatement (Second) of Torts § 652E (1976). The term "publicity" is defined in section 652D to mean "that the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Restatement (Second) of Torts § 652D, cmt. a (1976).
In this case, there is no allegation that the Bank publicized its suspicion of Rufra to the public at large. Instead, Rufra alleges that the Bank discussed the matter exclusively with investigators employed by the St. Mathews Police Department and the FBI. Therefore, Rufra can prove no set of facts that would entitle Rufra to relief under these allegations.
V.
In Count VI, Rufra asserts a claim against the Bank for negligent training and supervision. Kentucky law recognizes that an employer can be liable for the negligent training and supervision of its employees. See Turner v. Pendennis Club, 19 S.W.3d 117, 121-22 (Ky.Ct.App. 2000). Rufra alleges that the Bank employees misidentified him as the robber because they were negligently trained and supervised. He says that they succumbed to "law enforcement tricks and compulsion tactics" and that they would not have done so if they had received adequate training and supervision.
An employer may be held liable for negligent supervision and training only if he or she knew or had reason to know of the risk that the employment created. See Booker v. GTE.net LLC, 350 F.3d 515, 517 (6th Cir. 2003) (interpreting Kentucky law of negligent supervision); see also Restatement (Second) of Agency § 213, cmt. c (1958) (an employer's directions to employees "may be negligent because the principal does not anticipate circumstances which he should realize are likely to arise"). Here, the First Amended Complaint is devoid of "either direct or inferential allegations with respect to all material elements necessary," Id. (internal quotation and citation omitted), to recover under the theory of negligent supervision and negligent training. Specifically, Rufra's complaint fails to allege that the Bank knew or should have known that law enforcement personnel would intentionally trick and coerce the tellers to misidentify customers suspected of criminal activity. Absent such knowledge, the Bank cannot be held liable for negligent supervision and training, and Rufra has failed to state a claim upon which relief can be granted.
Rufra also alleges that the Bank was negligent in training and supervising its employees with respect to the application of the bank's privacy policies and the RFPA. Assuming, arguendo, that the Bank breached its duty to customers by failing to train employees as alleged, that breach is negligence in the abstract only in the instant case. That negligence could not be a proximate cause of the injury to Rufra because this Court has already held as a matter of law that the Bank employees did not violate its privacy policy or the RFPA in this case.
The Court will enter an order consistent with this Memorandum Opinion. cc: Counsel of Record