Summary
In Welch, the complaint indicated that the plaintiffs' personal information had been made available on the internet and that any internet user could access it for no reason or on a whim.
Summary of this case from Kost v. HuntOpinion
Case No. 4:09cv302-RH/WCS.
January 5, 2010.
Lance August Harke, Howard Mitchell Bushman, Harke Clasby LLP, Miami, FL, Mitchell L. Burgess, Burgess Lamb PC, Ralph K. Phalen, Law Offices of Ralph K. Phalen, Kansas City, MO, for Plaintiff.
George Lee Waas, Tallahassee, FL, for Defendants.
ORDER DENYING MOTIONS TO DISMISS
This case arises under the Driver's Privacy Protection Act, 18 U.S.C. §§ 2721- 25. In his first amended class-action complaint, the plaintiff asserts that the defendant officials of the Florida Department of Highway Safety and Motor Vehicles violated the Act by unlawfully disclosing personal information of Florida drivers in bulk. The defendants have moved to dismiss. This order denies the motion.
I. Standards on a Motion To Dismiss
The Supreme Court recently set forth the standards governing a motion to dismiss:
Federal Rule of Civil Procedure 8(a)(2) requires only "a short and plain statement of the claim showing that the pleader is entitled to relief." Specific facts are not necessary; the statement need only "'give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.'" Bell Atlantic Corp. v. Twombly, 550 U.S. [544, 555, 127 S. Ct. 1955, 167 L. Ed. 2d. 929 (2007)] (quoting Conley v. Gibson, 355 U.S. 41, 47[, 78 S. Ct. 99, 2 L. Ed. 2d 80] (1957)). In addition, when ruling on a defendant's motion to dismiss, a judge must accept as true all of the factual allegations contained in the complaint. Bell Atlantic Corp., supra, at [555] (citing Swierkiewicz v. Sorema N.A., 534 U.S. 506, 508, n. 1[, 122 S. Ct. 992, 152 L. Ed. 2d 1] (2002); Neitzke v. Williams, 490 U.S. 319, 327[, 109 S. Ct. 1827, 104 L. Ed. 2d 338] (1989); Scheuer v. Rhodes, 416 U.S. 232, 236[, 94 S. Ct. 1683, 40 L. Ed. 2d 90] (1974)).Erickson v. Pardus, 551 U.S. 89, 127 S. Ct. 2197, 2200, 167 L. Ed. 2d 1081 (2007). The court must accept the complaint's allegations as true "even if [the allegations are] doubtful in fact." Twombly, 550 U.S. at 555.
A complaint thus "does not need detailed factual allegations." Id. Nor must a complaint allege with precision all the elements of a cause of action. See Swierkiewicz, 534 U.S. at 514-15 (rejecting the assertion that a Title VII complaint could be dismissed for failure to plead all the elements of a prima facie case).
But neither is a conclusory recitation of the elements of a cause of action alone sufficient. A complaint must include more than "labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Twombly, 550 U.S. at 555. A complaint must include "allegations plausibly suggesting (not merely consistent with)" the plaintiff's entitlement to relief. Id. at 557. The complaint must set forth facts — not mere labels or conclusions — that "render plaintiffs' entitlement to relief plausible." Id. at 569 n. 14.
A district court thus should grant a motion to dismiss unless "the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. ___, 129 S. Ct. 1937, 1949 (2009) (emphasis added). This is so because
the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions. Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice. . . . [Federal] Rule [of Civil Procedure] 8 marks a notable and generous departure from the hyper-technical, code-pleading regime of a prior era, but it does not unlock the doors of discovery for a plaintiff armed with nothing more than conclusions.Id. at 1949-50 (emphasis added).
II. The Driver's Privacy Protection Act
The Driver's Privacy Protection Act prohibits the disclosure of "personal information" obtained by a state department of motor vehicles. Id. § 2721(a). "Personal information" means
information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status.Id. § 2725(3).
There are exceptions to the ban on disclosures. One exception is for "use by any government agency . . . in carrying out its functions, or any private person or entity acting on behalf of [an] agency in carrying out its functions." Id. § 2721(b)(1).
III. The Allegedly Unlawful Disclosure
The first amended complaint alleges that the defendants willfully disclosed personal information of Florida drivers, in bulk, to a private corporation, Shadowsoft, Inc. The first amended complaint alleges further that Shadowsoft disclosed the information to another entity, The Source for Public Data, which in turn made the information available on the internet. The first amended complaint alleges that the defendants disclosed the information without the drivers' consent, and that doing so did not come within any of the exceptions to the Driver's Privacy Protection Act's ban on disclosures.
IV. The Sufficiency of the Allegations
In their motions to dismiss, the defendants do not deny that the plaintiff's "personal information" has been made available on the internet. The defendants do not deny that an internet user can access the information for any or no reason — or on a whim. The defendants do not deny that making the information available in this manner violates the Driver's Privacy Protection Act.
The defendants say, though, that they made the information available only for a lawful purpose. They seem to assert that the very fact that they are driver's-license officials, or that they have authority to disclose the information for a permissible purpose, means that their disclosure constituted "use" of the information by a "government agency . . . in carrying out its functions," id. § 2721(b)(1), regardless of whether the actual disclosure was otherwise for a proper purpose. That is not so. If any disclosure by a public official was automatically proper, there could never be a claim under the Act against a public official. The statutory language does not support such a conclusion, and the law of the circuit is to the contrary. See Collier v. Dickinson, 477 F.3d 1306 (11th Cir. 2007) (reversing the dismissal of a claim under the Act against officials of the Florida Department of Highway Safety and Motor Vehicles).
The defendants also have filed copies of the contracts under which, they say, the information was provided to Shadowsoft. The defendants assert that under the contracts, the information was to be used only for a proper purpose. Whether the contracts may properly be considered on the motions to dismiss — without converting them to summary-judgment motions — is not clear. See, e.g., Day v. Taylor, 400 F.3d 1272 (11th Cir. 2005) (noting that a contract may be considered on a motion to dismiss without converting it into a summary-judgment motion only if the contract is "central to the plaintiff's claim" and undisputed). But it does not matter. The contracts do not specify a proper purpose for the disclosures to Shadowsoft and do not specify the uses and further disclosures that Shadowsoft will and will not make. Moreover, courts have recognized time and again that a contract's self-serving recitals do not bind third parties. See, e.g., Dixon County v. Field, 111 U.S. 83, 92, 4 S. Ct. 315, 28 L. Ed. 360 (1884) (stating that a recital in bonds under which they would conform to the law, when in fact they do not, "will not make them so"); United States v. Leonard, 529 F.3d 83, 90 (2d Cir. 2008) (collecting Supreme Court cases that rely on the substance of a transaction over contract formalisms in determining what constitutes a "security"); Daughtrey v. Honeywell, Inc., 3 F.3d 1488, 1492 (11th Cir. 1993) ("The employment status of an individual for the purposes of ERISA is not determined by the label used in the contract between the parties."); Spirides v. Reinhardt, 613 F.2d 826, 832-33 (D.C. Cir. 1979) ("Courts generally look to the substance of a contract rather than its form, and, although contract language may be indicative to some degree of the intention of the parties, it is not necessarily controlling."). The first amended complaint alleges that the defendants disclosed the information for no permissible purpose and that the information wound up on the internet. If that is true, the plaintiff will be entitled to recover.
To be sure, the first amended complaint perhaps could have provided greater detail. But it is hard to plead a negative with great specificity; that there was no permissible purpose for the disclosure is about as precise as one could be. Twombly and Iqbal do not require useless details; they call instead for a context-specific inquiry into the adequacy of a pleading. In this context, alleging specifically that there was a disclosure, and alleging generally that there was no proper purpose for the disclosure, is enough.
The first amended complaint thus sufficiently alleges a violation of the Act. The law of the circuit is that the Act creates a private right of action and, in addition, may be enforced through 42 U.S.C. § 1983. See Collier, 477 F.3d at 1309-11.
Whether the first amended complaint sufficiently alleges each defendant's role in the violation is less clear. The allegations against any individual defendant are sparse, perhaps because the plaintiff has no way of knowing precisely who did what. But each defendant was apparently directly involved in the allegedly improper disclosure at issue. The defendants do not seem to raise this as a basis for dismissal, and in any event the allegations seem as clear as those held sufficient in Collier. In sum, the first amended complaint states a claim on which relief may be granted.
V. Qualified Immunity
The defendants assert that, as public officials or employees, they have qualified immunity. Qualified immunity protects "all but the plainly incompetent or those who knowingly violate the law." Malley v. Briggs, 475 U.S. 335, 341, 106 S. Ct. 1092, 1096, 89 L. Ed. 2d 271 (1986); see generally Hope v. Pelzer, 536 U.S. 730, 122 S. Ct. 2508, 153 L. Ed. 2d 666 (2002); Harlow v. Fitzgerald, 457 U.S. 800, 102 S. Ct. 2727, 73 L. Ed. 2d 396 (1982). Thus a public officer or employee may be held individually liable only if his or her conduct violates clearly established law.
In Collier, the Eleventh Circuit held that the Driver's Privacy Protection Act itself clearly establishes the illegality of the prohibited disclosures. Under Collier, the first amended complaint is sufficient to survive a motion to dismiss based on qualified immunity. In due course a defendant may be able to establish that any disclosure in which he or she participated was proper, but the first amended complaint alleges the contrary.
VI. Other Defenses
The defendants advance other arguments that warrant only a brief mention. They say the first amended complaint should be dismissed for lack of standing. But the plaintiff alleges that his own information was improperly disclosed, and he seeks an award of damages. He plainly has standing to pursue his own damages claim based on the improper disclosure of his own personal information.
The defendants say they have Eleventh Amendment immunity. But the law is settled that a claim for damages against a state official in his or her individual capacity is not barred by the Eleventh Amendment. See, e.g., Hafer v. Melo, 502 U.S. 21, 30-31, 112 S. Ct. 358, 116 L. Ed. 2d 301 (1991); Hobbs v. Roberts, 999 F.2d 1526, 1528 (11th Cir. 1993). And a claim for an injunction against a state official based on a violation of federal law is not barred by the Eleventh Amendment. See, e.g., Ex Parte Young, 209 U.S. 123, 28 S. Ct. 441, 52 L. Ed. 714 (1908). The first amended complaint does not exceed these bounds.
Finally, the defendants say the first amended complaint should be dismissed for failure to join an indispensable party — Shadowsoft or The Source for Public Data. The theory seems to be that a plaintiff must sue all wrongdoers simultaneously or he can sue none at all. But that of course is incorrect. A plaintiff ordinarily may choose to sue one of several tortfeasors without suing the rest. See, e.g., Temple v. Synthes Corp., Ltd., 498 U.S. 5, 7, 111 S. Ct. 315, 111 S. Ct. 315, 112 L. Ed. 2d 263 (1990) ("It has long been the rule that it is not necessary for all joint tortfeasors to be named as defendants in a single lawsuit. . . .").
VII. Conclusion
The first amended complaint adequately alleges a violation of the Driver's Privacy Protection Act. Under Collier, the allegations are sufficient to withstand the motions to dismiss. Accordingly,
IT IS ORDERED:
The defendants' motions to dismiss (documents 16 18) are DENIED.