Opinion
1:16CV925
09-29-2017
JONATHAN HATCH, MARK DVORSKY, and SHATERIKA NICHOLSON, on behalf of themselves and others similarly situated, Plaintiffs, v. MICHAEL A. DEMAYO, individually; THE LAW OFFICES OF MICHAEL A. DEMAYO, P.C.; LAW OFFICES OF MICHAEL A. DEMAYO, L.L.P.; JASON E. TAYLOR, individually; LAW OFFICES OF JASON E. TAYLOR, P.C.; BENJAMIN T. COCHRAN, individually; HARDISON & COCHRAN, PLLC; CARL B. NAGLE, individually; NAGLE & ASSOCIATES, P.A.; JOHN J. GELSHENEN, individually; DAVIS & GELSHENEN LLP; MARK I. FARBMAN, individually, MARK FARBMAN, P.A.; TED A. GREVE, individually; TED A. GREVE & ASSOCIATES, P.A.; CHRISTOPHER T. MAY, individually and ESTWANIK AND MAY, P.L.L.C; Defendants.
MEMORANDUM OPINION AND ORDER
Plaintiffs initiated this action alleging that the above-named Defendants violated the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. § 2721, et seq. (ECF Nos. 1, 5.) Before the Court are the following two motions to dismiss filed by Defendants: (1) Motion to Dismiss First Amended Complaint, filed by Defendants Mark I. Farbman and Mark Farbman, P.A., (collectively, "the Farbman Defendants"); and (2) Motion to Dismiss, filed by Michael A. DeMayo, Law Offices of Michael A. DeMayo, P.C., Law Offices of Michael A. DeMayo, LLP, Jason E. Taylor, Law Offices of Jason E. Taylor, P.C., Benjamin T. Cochran, Hardison & Cochran, PLLC, Carl B. Nagle, Nagle & Associates, P.A., John J. Gelshenen, Davis & Gelshenen, LLP, Ted A. Greve, Ted A. Greve & Associates, P.A., Christopher T. May, and Estwanik and May, PLLC, (collectively, "the DeMayo Defendants"). (ECF Nos. 21, 23.) For the reasons set forth below, each motion will be denied.
I. BACKGROUND
Based on the allegations in Plaintiff's First Amended Complaint (the "Complaint"), each Plaintiff is a driver of a vehicle that was involved in a motor vehicle accident. (ECF No. 5 ¶¶ 27, 39, 51.) A law enforcement officer was sent to the scene of each accident to conduct an investigation. (Id. ¶¶ 28, 40, 52.) At the accident scene involving Plaintiff Johnathan Hatch, the investigating officer requested and obtained Plaintiff Hatch's driver's license. (Id. ¶ 29.) Likewise, the investigating officer at the accident scene involving Plaintiff Mark Dvorksy requested and obtained Plaintiff Dvorsky's driver's license. (Id. ¶ 41.) Each investigating officer prepared an accident report, known as a DMV-349, using information directly from the driver's licenses of Plaintiffs Hatch and Dvorsky. (Id. ¶¶ 29, 41.) The information included Plaintiffs Hatch's and Dvorsky's names, addresses, dates of birth, telephone numbers and driver's license numbers. (Id. ¶¶ 29, 41.) Plaintiffs allege that the source of this information was the North Carolina Division of Motor Vehicles ("NCDMV"). (Id. ¶¶ 29, 41.) The officers also verified that the information reflected on Plaintiffs Hatch's and Dvorsky's driver's licenses was correct. (Id. ¶¶ 30, 42.) Each officer then "checked a box on the DMV-349 to indicate" that the actual address of Plaintiffs Hatch and Dvorsky matched the address on each of their driver's licenses. (Id. ¶¶ 30, 42.)
Plaintiffs filed a First Amended Complaint on July 29, 2016. (ECF No. 5.)
At the accident scene involving Plaintiff Shaterika Nicholson ("the Nicholson Accident"), the investigating officer "obtained Plaintiff Shaterika Nicholson's name from first responders already on the scene." (Id. ¶ 53.) The investigating officer then "returned to his patrol car and . . . entered Plaintiff Shaterika Nicholson's name in the vehicle's onboard computer, which, in turn, accesse[d] the NCDMV database," and identified Plaintiff Nicholson by her driver's license number. (Id.) The "onboard computer" prompted the investigating officer to enter Plaintiff Nicholson's "DMV information into the DMV-349, which is a self-populating computer form." (Id.) The officer selected the electronic option for Plaintiff Nicholson's full name and address to be entered on the DMV-349 computer form." (Id.) The officer also entered Plaintiff Nicholson's vehicle registration information onto the DMV-349. (Id. ¶ 54.) Plaintiffs allege that the "source of this information was the NCDMV database accessed by the onboard computer in [the investigating officer's] patrol car." (Id. ¶ 54.) A completed DMV-349 form for each accident involving Plaintiffs was filed with each officer's police department, which, in turn, filed each DMV-349 form with the NCDMV. (Id. ¶¶ 32, 44, 55.)
Defendants are North Carolina attorneys and law firms that, within a few days of each accident involving Plaintiffs, obtained a copy of each accident report. (Id. ¶¶ 33, 45, 56.) Each Defendant allegedly "obtained the DMV-349[s] . . . or personal information from a motor vehicle record procured by an agent from a copy of the DMV-349, for the sole and specific purpose of marketing [that] Defendant[']s legal services." (Id. ¶¶ 34, 46, 57.) Using information from the DMV-349 forms, including Plaintiffs' names and addresses, Defendants addressed and mailed "marketing materials" to each Plaintiff's address. (Id. ¶¶ 36, 48, 59.)
The instant lawsuit arises from Plaintiffs' allegations that Defendants' conduct violates the DPPA. Defendants have each moved to dismiss the Complaint for lack of subject-matter jurisdiction and failure to state a claim, pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure. (ECF Nos. 21, 23.)
II. STANDARDS OF REVIEW
A. Rule 12(b)(1)
Under Rule 12(b)(1), a party may seek dismissal based on the court's "lack of subject-matter jurisdiction." Fed. R. Civ. P. 12(b)(1). Subject-matter jurisdiction is a threshold issue that relates to the court's power to hear a case and must be decided before a determination on the merits of the case. Constantine v. Rectors & Visitors of George Mason Univ., 411 F.3d 474, 479-80 (4th Cir. 2005). A motion under Rule 12(b)(1) raises the question of "whether [the plaintiff] has a right to be in the district court at all and whether the court has the power to hear and dispose of [the] claim." Holloway v. Pagan River Dockside Seafood, Inc., 669 F.3d 448, 452 (4th Cir. 2012). The burden of proving subject-matter jurisdiction rests with the Plaintiff. McNutt v. Gen. Motors Acceptance Corp., 298 U.S. 178, 189 (1936); Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). When evaluating a Rule 12(b)(1) motion to dismiss, a court should grant the motion "only if the material jurisdictional facts are not in dispute and the moving party is entitled to prevail as a matter of law." Richmond, Fredericksburg & Potomac R.R. Co. v. United States, 945 F.2d 765, 768 (4th Cir. 1991). On a motion to dismiss for lack of standing, the court must construe the complaint in the plaintiff's favor, accepting as true the factual allegations in the complaint. Warth v. Seldin, 422 U.S. 490, 501 (1975); see also Kerns, 585 F.3d at 192.
A motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil Procedure "challenges the legal sufficiency of a complaint," including whether it meets the pleading standard of Rule 8(a)(2). Francis v. Giacomelli, 588 F.3d 186, 192 (4th Cir. 2009). Rule 8(a)(2) requires a complaint to contain "a short and plain statement of the claim showing that the pleader is entitled to relief," Fed. R. Civ. P. 8(a)(2), thereby "giv[ing] the defendant fair notice of what the . . . claim is and the grounds upon which it rests." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)).
"To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). A complaint may fail to state a claim upon which relief can be granted in two ways: first, by failing to state a valid legal cause of action, i.e., a cognizable claim, see Holloway, 669 F.3d at 452; or second, by failing to allege sufficient facts to support a legal cause of action, see Painter's Mill Grille, LLC v. Brown, 716 F.3d 342, 350 (4th Cir. 2013).
While a court's evaluation of a Rule 12(b)(6) motion to dismiss is "generally limited to a review of the allegations of the complaint itself," a court can properly consider documents "attached to the complaint as exhibits." Goines v. Valley Cmty. Servs. Bd., 822 F.3d 159, 165-66 (4th Cir. 2016). A court may also consider a "document submitted by the movant that was not attached to or expressly incorporated in a complaint, so long as the document was integral to the complaint and there is no dispute about the document's authenticity." Id. at 166. Here, no party has challenged the authenticity of the various documents attached to Defendants' motions to dismiss. Therefore, in addition to considering the documents attached to Plaintiffs' Complaint, the Court also considers the exhibits attached to the instant motions to dismiss.
III. DISCUSSION
A. Article III Standing
The Farbman Defendants and the DeMayo Defendants move to dismiss the Complaint on a number of grounds, including that Plaintiffs lack Article III standing to assert a claim under the DPPA. (See ECF Nos. 21, 23.) Because standing is a threshold issue, the Court will, first, address this basis for dismissal. See Warth, 422 U.S. at 517-18 (stating that standing is a "threshold determinant[ ] of the propriety of judicial intervention").
Under Article III of the United States Constitution, the jurisdiction of a federal court is limited to cases and controversies. U.S. Const. art. III, § 2. Standing to sue, therefore, "ensure[s] that federal courts do not exceed their authority." Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). To establish constitutional standing at the motion to dismiss stage, Plaintiffs must plausibly allege that they have: "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Id. Plaintiffs bear the burden of establishing these elements. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). "Where, as here, a case is at the pleading stage, [Plaintiffs] must 'clearly . . . allege facts demonstrating' each element." Spokeo, 136 S. Ct. at 1547 (quoting Warth, 422 U.S. at 518).
Relying in large measure on the Supreme Court's decision in Spokeo, Inc. v. Robins, Defendants argue that Plaintiffs lack Article III standing to sue because "their allegations are divorced from any concrete harm," (ECF No. 22 at 9 (internal quotation marks omitted)), and they have failed to allege any actual damages, (see ECF No. 24 at 9-13). Plaintiffs essentially argue that they have Article III standing because they have alleged the precise type of harm encompassed by the DPPA—invasion of privacy—which is an injury closely related to harms traditionally regarded as providing a basis for recovery at common law. (See ECF No. 26 at 11-17.) Plaintiffs further argue that they have alleged substantial, rather than merely procedural, violations of the DPPA. (Id.)
In Spokeo, the Supreme Court reiterated that to establish the first element of standing—injury in fact—"a plaintiff must show that he or she suffered 'an invasion of a legally protected interest' that is 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.'" Id. at 1548 (quoting Lujan, 504 U.S. at 560). As to concreteness, the Court clarified that "[a] concrete injury must be de facto; that is, it must actually exist," and it must be "real, and not abstract." Id. (internal quotation marks omitted). As further explained by the Court, however, "'[c]oncrete' is not . . . necessarily synonymous with 'tangible,'" for intangible injuries can also be concrete. Id. at 1549. Thus, to determine "whether an intangible harm constitutes injury in fact," a court should consider the following: (i) the judgment of Congress which "is well positioned to identify intangible harms that meet minimum Article III requirements"; and (ii) whether the alleged intangible harm bears a close relationship to "harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts." Id.
Congress, in its judgment, may elevate "de facto injuries that were previously inadequate in law" to the status of legally cognizable, concrete injuries. Lujan, 504 U.S. at 578. The Supreme Court has cautioned, however, that this "does not mean that a plaintiff automatically satisfies the injury-in-fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right." Spokeo, 136 S. Ct. at 1549. In elaborating on the connection between standing and a concrete injury, the Court explained that "Article III standing requires a concrete injury even in the context of a statutory violation." Id. Thus, a plaintiff cannot "allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III." Id. Nonetheless, "the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact" such that "a plaintiff . . . need not allege any additional harm beyond the one Congress has identified." Id.
In this case, Plaintiffs have alleged the following concrete harm:
[a]s a direct and proximate result of the acts and conduct and DPPA violations by Defendants[,] . . . Plaintiffs . . . have suffered damage to their respective privacy rights and interests protected by the DPPA when personal information from a motor vehicle record, as defined by the DPPA, was obtained, disclosed or used by Defendants without consent or permission.(ECF No. 5 ¶ 86.) North Carolina, like most states, recognizes invasion of privacy as a common-law cause of action. See Flake v. Greensboro News Co., 195 S.E. 55, 63, 64 (N.C. 1938) (finding that there is a state-law cause of action for invasion of the right to privacy); see also Renwick v. News and Observer Publ'g. Co., 312 S.E. 2d 405, 411 (N.C. 1984) (stating that "[t]he tort of invasion of privacy is . . . recognized, in one or more of its forms, in a majority of jurisdictions"). See generally Potocnik v. Carlson, No. 13-CV-2093 (PJS/HB), 2016 WL 3919950, at *2 (D. Minn. July 15, 2016) (explaining that "the viewing of private information without lawful authority[,] has a close relationship to invasion of the right to privacy, a harm that has long provided a basis for tort actions in the English and American courts"). Invasion of privacy has long provided a basis of recovery under four distinct torts: intrusion upon seclusion, public disclosure of private facts, publication of facts that portray a plaintiff in a false light, and appropriation of a plaintiff's name or likeness. William L. Prosser, Privacy, 48 Cal. L. Rev. 383, 389 (1960). While these torts are distinct, "each involves interference with the interest of the individual in leading, to some reasonable extent, a secluded and private life, free from the prying eyes, ears and publications of others." Restatement (Second) of Torts § 652A cmt. b (Am. Law Inst. 1977).
Plaintiffs' alleged harm, therefore, is closely related to the invasion of privacy, which has long provided a basis for recovery at common law. Specifically, Plaintiffs' allegation bears a close relationship to the interest protected by the invasion of privacy torts, namely, leading a secluded and private life. Plaintiffs may not be able to state a claim under one of the four invasion of privacy torts on the basis of their alleged harm, however, the concreteness inquiry only asks whether an alleged harm is closely related to a cognizable harm, Potocnik, 2016 WL 3919950, at *3 (concluding that in Spokeo, "the Court made clear that an injury that would not give rise to recovery in a tort action could nevertheless be sufficiently concrete to give a plaintiff standing to seek recovery in a statutory action"). Accordingly, the Court concludes that Plaintiffs' allegation that Defendants obtained, disclosed, or used Plaintiffs' personal information without consent sets forth a concrete injury.
Despite Defendants' contention that Plaintiffs' alleged intangible harm is not the sort of harm targeted by Congress in enacting the DPPA, (see ECF No. 22 at 13), the Supreme Court has recognized that, in enacting the DPPA, Congress chose to protect "an individual's right to privacy in his or her motor vehicle records," Maracich v. Spears, 133 S. Ct. 2191, 2200 (2013). The DPPA was enacted by Congress in 1994 to address two specific concerns: (i) "a growing threat from stalkers and criminals who could acquire personal information from state DMVs"; and (ii) "the States' common practice of selling personal information to businesses engaged in direct marketing and solicitation." Id. at 2198. As reflected in the DPPA's legislative history, Congress sought to "give[ ] drivers the ability to restrict release of personal information for reasons that are . . . incompatible [with] the reasons it was collected. In doing so, it strikes a critical balance between an individual's fundamental right to privacy and safety and the legitimate governmental and business needs for this information." 140 Cong. Rec. H2522 (daily ed. Apr. 20, 1994) (statement of Rep. Moran). The statute, therefore, "regulates the disclosure of personal information contained in the records of state motor vehicle departments." Maracich, 133 S. Ct. at 2195. In addition to its prohibition on the disclosure of personal information, the DPPA also prohibits "obtaining or using personal information from a motor vehicle record." Pavone v. Law Offices of Anthony Mancini, Ltd., 205 F. Supp. 3d 961, 967 (N.D. Ill. 2016); see 18 U.S.C. §§ 2722(a), 2724(a). Specifically, the DPPA makes it "unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record," for any use other than the fourteen "[p]ermissible uses" enumerated in 18 U.S.C. § 2721(b)(1)-(14). 18 U.S.C. § 2722(a). Under the DPPA, "[a] person who knowingly obtains, discloses, or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable." Id. § 2724(a).
Defendants cite two cases as persuasive authority in support of their argument that Plaintiffs have failed to assert a concrete injury and therefore lack standing. The first of these cases, Braitberg v. Charter Communications, Inc., 836 F.3d 925 (8th Cir. 2016), involved a suit brought by a plaintiff against a cable company for allegedly retaining his personal information in violation of the Cable Communications Policy Act, 47 U.S.C. § 551(e). Braitberg, 836 F.3d at 926. There, the court concluded that the plaintiff lacked Article III standing because he failed to allege an injury in fact. Id. at 930. The court reasoned that, among other things, the plaintiff did not allege that the defendant "disclosed the information to a third party," or that the defendant "used the information in any way during the disputed period." Id. The court further held that "the retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts." Id. This case is distinguishable from the present case because Plaintiffs here have specifically alleged that Defendants obtained, disclosed, and used their protected personal information, without consent or permission, for marketing and solicitation of their legal services, (see ECF No. 5 ¶¶ 78-86), which are impermissible uses under the DPPA.
In the second case cited by Defendants, Smith v. Ohio State University, 191 F. Supp. 3d 750 (S.D. Ohio 2016), the plaintiffs filed a lawsuit against their employer alleging violations of the Fair Credit Reporting Act ("FCRA"), 15 U.S.C. § 1681 et seq. Smith, 191 F. Supp. 3d at 753. The plaintiffs in that case alleged that, during the hiring process, the defendant sought their consent to access their credit reports in order to conduct a background investigation prior to hiring. Id. Plaintiffs alleged that "they were injured by having their privacy and statutory rights [under the FCRA] violated." Id. There, the court concluded that it "cannot find that Plaintiffs have suffered an injury-in-fact from [defendant's] alleged breach of the FCRA" because "Plaintiffs admitted that they did not suffer . . . a concrete [injury] as a result of [defendant's] alleged breach." Id. at 757 (emphasis added). Plaintiffs here make no such admission. Instead, as previously noted, Plaintiffs have specifically set forth allegations of concrete harm. The Court, therefore, finds this case similarly unpersuasive.
Defendants also argue that Plaintiffs lack standing because their allegations of harm constitute mere procedural violations, divorced from any concrete injuries. However, Plaintiffs' allegations encompass more than just procedural violations of the statute. Rather, Plaintiffs allege that Defendants engaged in the substantive conduct that the DPPA seeks to prohibit—obtaining, disclosing, and using personal information for a purpose other than that outlined in the statute. See Whitaker v. Appriss, Inc., 229 F. Supp. 3d 809, 815 (N.D. Ind. 2017) ("In Congress's judgment, once a plaintiff's information is disclosed or obtained for a prohibited purpose, the damage is already done."); see also Heglund v. Aitkin Cty, No. 16-3063, 2017 WL 3910116, at *3 (8th Cir. Sept. 7, 2017) (finding that "[t]he intangible harm associated with an alleged violation of the DPPA's substantive protections is sufficient for the [plaintiffs] to establish an injury in fact").
The Farbman Defendants further contend that Plaintiffs suffered no concrete harm in being sent a copy of their "own publicly available accident report[s]." (ECF No. 22 at 9.) Specifically, the Farbman Defendants argue that "it is 'difficult to imagine how' sending a person a copy of his own publicly available accident report 'without more, could work any concrete harm.'" (Id. (quoting Spokeo, 136 S. Ct. at 1550).) In support of this contention, the Farbman Defendants cite to Pavone v. Law Offices of Anthony Mancini, Ltd., 205 F. Supp. 3d 961 (N.D. Ill. 2016), a district court case with facts similar to the case at bar. There, the plaintiff alleged in his lawsuit that the defendant violated the DPPA by obtaining the plaintiff's personal information from an accident report and using that information to solicit the plaintiff's business. Pavone, 205 F. Supp. 3d at 962. In citing to this case, the Farbman Defendants assert that the Pavone court held "that a law firm's disclosure of plaintiff's personal information to plaintiff himself cannot violate the DPPA's privacy regime." (ECF No. 61 at 9.) Defendants appear to misconstrue that court's opinion which goes on to state, that such a finding "does not mean [plaintiff's] suit comes to an end"; for "[t]he DPPA does not just prohibit disclosure[,] it also prohibits obtaining or using personal information from a motor vehicle record," and the defendant "indisputably obtained and used the information that is at issue." Pavone, 205 F. Supp. 3d at 967. Likewise, here, Plaintiffs allege that Defendants obtained, disclosed, and used Plaintiffs' personal information from a motor vehicle record. Plaintiffs further allege that such conduct proximately caused each Plaintiff to "suffer[ ] damage to their respective privacy rights and interests." (ECF No. 5 ¶ 86.)
Based on the above, the Court concludes that Plaintiffs' allegations are sufficient to allege a concrete injury under the DPPA. Given that the remaining two elements of the standing analysis are not in dispute, the Court concludes that Plaintiffs have standing to sue under the DPPA, and Defendants' motions to dismiss for lack of standing will be denied.
B. Zone of Interests
Defendants argue that Plaintiffs' claims also fail because "they are based on purported interests that do not lie within the 'zone of interests' that the DPPA protects." (ECF No. 22 at 13; see ECF No. 24 at 16-17.) The Farbman Defendants also contend that the only parties targeted by DPPA are parties who "directly ask[ ] the DMV for information and the DMV itself." (ECF No. 22 at 16.)
"Whether a plaintiff comes within the zone of interests is an issue that requires [the court] to determine, using traditional tools of statutory interpretation, whether a legislatively conferred cause of action encompasses a particular plaintiff's claim." Lexmark Int'l, Inc. v. Static Control Components, Inc., 134 S. Ct. 1377, 1387 (2014) (internal quotation marks omitted). Thus, a statutory cause of action is presumed to extend "only to plaintiffs whose interests fall within the zone of interests protected by the law invoked." Id. at 1388 (internal quotation marks omitted). In making such a determination, courts employ well-settled principles of statutory interpretation which provide that when a statute is unambiguous on its face, courts need not look any further to interpret the statute. See Mallard v. U.S. Dist. Court for the So. Dist. of Iowa, 490 U.S. 296, 300 (1989) ("Interpretation of a statute must begin with the statute's language."); Carcieri v. Salazar, 555 U.S. 379, 387 (2009) (stating that where "the statutory text is plain and unambiguous," the statute must be applied "according to its terms").
Here, the plain text of the DPPA provides that, "[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court." 18 U.S.C. § 2724(a). Observing statutory interpretation principles, the Court finds that the unambiguous language of the DPPA extends a cause of action to Plaintiffs in this suit, who have alleged that Defendants knowingly obtained, disclosed, and used their protected personal information without consent, from an alleged motor vehicle record, for marketing purposes, which is not a permitted use under the DPPA. (See ECF No. 5 ¶¶ 77-85.) The Court will, therefore, deny Defendants' motions to dismiss on the ground that Plaintiffs' injuries do not fall within the zone of interests that Congress sought to protect.
The Farbman Defendants also argue that, under the rule of lenity, if the DPPA is at all ambiguous, it must be construed in Defendants' favor. (ECF No. 22 at 29-30.) "The rule of lenity requires ambiguous criminal laws to be interpreted in favor of the defendants subjected to them." United States v. Santos, 553 U.S. 507, 513 (2008). The rule of lenity is also applicable in the civil context where an ambiguous statute has criminal applications. See, e.g., United States v. Thompson/Center/Arms Co., 504 U.S. 505, 517-18 (1992). Although the DPPA has a criminal application (in that it imposes a criminal fine, see 18 U.S.C. § 2723(a)), for the reasons discussed throughout this Opinion, the Court finds the language of the DPPA unambiguous and the rule of lenity, therefore, inapplicable. See Maracich, 133 S. Ct. at 2209 (stating that "[t]here is no room for the rule of lenity where the text and structure of the DPPA" is clear).
C. The DPPA Applies to Defendants' Alleged Conduct
The Farbman Defendants further argue that they cannot be held liable under the DPPA because "the statute simply does not apply to Defendants' conduct, even if the allegations in the . . . Complaint are taken as true," and the Complaint, therefore, fails to state a claim. (ECF No. 22 at 18.) In particular, the Farbman Defendants, citing to section 2721(a)(1) of the statute, assert that "[t]he DPPA only regulates the disclosure of information held by a state DMV." (Id. at 18-19.)
Section 2721(a) of the statute states as follows:
A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity . . . personal information, as defined in 18 U.S.C. [§] 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section[.]18 U.S.C. §§ 2721(a)(1).
The Court rejects these arguments, which fly in the face of the precise language of the DPPA. To be sure, section 2721(a)(1) of the DPPA prohibits the knowing use or disclosure of protected "personal information" by State DMVs, as well as their employees and agents. 18 U.S.C. § 2721(a)(1). However, section 2724(a) of the statute also ascribes liability to anyone "who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under [the DPPA]." Id. § 2724(a). In accordance with "one of the most basic interpretive canons" of statutory interpretation, "[a] statute should be construed so that effect is given to all its provisions, so that no part will be inoperative or superfluous, void or insignificant." Corley v. United States, 556 U.S. 303, 314 (2009) (alteration in original) (quoting Hibbs v. Winn, 542 U.S. 88, 101 (2004)). Accordingly, giving effect to the entire statute, including section 2721(a) on which Defendants rely, as well as section 2724(a), the Court concludes that the DPPA covers information knowingly disclosed by a state DMV as well as information that is knowingly obtained, disclosed, or used by any person. Nowhere in the statute does it state that it applies so as to limit liability in the manner argued by Defendants. As such, the Court denies Defendants' motions to dismiss for failure to state a claim on this basis.
D. Accident Reports
In a related argument, Defendants contend that because the accident reports that Defendants obtained are not protected "motor vehicle records," they are not liable under the DPPA. (ECF No. 22 at 20-21; ECF No. 24 at 19-22.) Plaintiffs argue, in part, that "even if the Court views a DMV-349 to not be a motor vehicle record . . . it is the DPPA protected 'personal information' that is important and not the specific records or form in which that information may happen to be contained." (ECF No. 26 at 31.) The Court agrees with Plaintiffs.
Plaintiffs allege that Defendants impermissibly obtained and used information deemed "personal information" under the statute. (ECF No. 5 ¶¶ 33-36, 45-48, 56-59, 78-86.) Under the DPPA, "personal information" includes "information that identifies an individual, including an individual's . . . name [and] address . . . but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3). Based on its plain language defining the types of information protected under the statute, the Court finds that Plaintiffs' allegations that Defendants obtained and used their names and addresses for an impermissible use is sufficient to plausibly state a claim for relief under the DPPA. See Pavone v. Law Offices of Anthony Mancini, Ltd., 118 F. Supp. 3d 1004, 1006 (N.D. Ill. 2015) (explaining that the DPPA "only excludes . . . information about the accident, not the personal information that is included in accident reports").
The Court is likewise unpersuaded by Defendants' argument that Plaintiffs have failed to state a claim for relief under the DPPA because of the state law requirement that accident reports be made public in North Carolina. Plaintiffs' allegations in this suit are not that Defendants accessed the accident reports themselves, but rather that, in violation of the DPPA, Defendants obtained, used or disclosed protected personal information contained in the reports for an unpermitted use (i.e., marketing of Defendants' legal services) in violation of the DPPA. The Court will therefore deny Defendants' motions to dismiss on this basis.
Under North Carolina state law, reports of a vehicular accident "made by law enforcement officers and medical examiners are public records." N.C. Gen. Stat. § 20-166.1(i). In addition, under North Carolina's Public Records Act, the public can "obtain copies of . . . public records and public information free or at minimal cost unless otherwise specifically provided by law." Id. § 132-1(b).
The Court notes that Defendants assert that the North Carolina Attorney General's office "has formally examined" the interplay between the DPPA and the state's public records law requiring public access to accident reports. (ECF No. 22 at 38; see ECF No. 24 at 31-33. See also ECF No. 22-3; ECF No. 24-4.) Defendants argue that the Attorney General, in its Advisory Opinion, found that the DPPA and North Carolina's public records law with respect to public availability of accident reports "co-exist." (ECF No. 22 at 39; see ECF Nos. 22-3, 24-4.) Notwithstanding any findings made by the Attorney General, it is well-settled that where state law conflicts with federal law, state law is invalidated. See Hillsborough Cty. v. Automated Med. Labs., Inc., 471 US. 707, 712 (1985) (explaining that the Supremacy Clause of the United States Constitution, "invalidates state laws that interfere with, or are contrary to, federal law" (citation omitted)). This principle is explicitly acknowledged by the Attorney General who states in the Advisory Opinion that, "federal law controls, and the State's Public Records Act is preempted by the DPPA where there is a direct conflict." (ECF No. 61-2 at 2.) The Advisory Opinion goes on to state that "[w]e recognize that the courts may eventually provide clarification of the DPPA's requirements which conflicts with the advice offered in this opinion." (Id. at 4.)
E. The DPPA's Exclusion of Information on Vehicular Accidents
Defendants also argue that the statute specifically excludes "information on vehicular accidents," which is the information they obtained and used. (ECF No. 22 at 21-23; ECF No. 24 at 18-19.) Defendants are correct that in the statute, "Congress carved out 'information on vehicular accidents' from the types of personal information protected by the Act." (ECF No. 22 at 22; see ECF No. 24 at 18.) The statute is structured such that it, first, defines the types of information that constitute "personal information"—i.e., names and addresses—after which it next identifies the types of information that do not constitute "personal information"—i.e., "information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3).
Although Defendants seek to characterize the information they obtained and used as "information on vehicular accidents," Plaintiffs specifically allege that Defendants violated the statute by impermissibly obtaining and using their names and addresses, (see ECF No. 5 ¶¶ 33-36, 45-48, 54-59), "not [by] obtaining . . . information related to the accident (e.g., vehicles involved, road conditions, times of day, etc.)," Pavone v. Meyerkord & Meyerkord, LLC, 118 F. Supp. 3d 1046, 1050 (N.D. Ill. 2015). Plaintiffs' allegations, therefore, concern Defendants' conduct with respect to Plaintiffs' names and addresses, which is information explicitly included in the definition of "personal information" protected under the DPPA. Accordingly, the Court finds that it need not look any further than the plain language of the statute to conclude that it applies to Defendants' underlying conduct as alleged in the Complaint, and Defendants' motions to dismiss on this ground will be denied.
F. Defendants' Alleged Use of Plaintiffs' Personal Information does not fall under DPPA Exceptions
Defendants further argue that the following two exceptions in the DPPA "expressly allow the disclosure highlighted by the . . . Complaint." (ECF No. 22 at 25; see ECF No. 24 at 22-26.) These exceptions provide that "[p]ersonal information [as defined in the statute] . . . may be disclosed as follows": (i) "[f]or use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions," 18 U.S.C. § 2721(b)(1); and (ii) [f]or any other use specifically authorized under [state law], if such use is related to the operation of a motor vehicle or public safety," id. § 2721(b)(14). Defendants' discussions in support of this argument rely on the function of local law enforcement agencies, which, under state law, are required to ensure that their law enforcement officers and agents complete accident reports for all "reportable crashes," which are then "open to inspection by the general public," N.C. Gen. Stat. § 20-166.1(i). Defendants fail to show, however, how the actions of the local law enforcement agencies preclude any liability that Defendants may have for their own alleged conduct. To the extent that the above exceptions allow law enforcement agencies to use or disclose Plaintiffs' personal information, neither exception immunizes liability for Defendants' alleged disclosure of personal information for marketing or solicitation purposes. Defendants are not government or law enforcement agencies, nor are they entities "acting on behalf of a Federal, State, or local agency in carrying out its functions," 18 U.S.C. § 2721(b)(1). Nor is it alleged that Defendants used the information obtained for a use "related to the operation of a motor vehicle or public safety," id. § 2721(b)(14). Taking Plaintiffs' allegations as true, Defendants are attorneys and law firms who obtained and used Plaintiffs' protected personal information for the purpose of marketing legal services. (See generally ECF No. 5.) As such, to the extent that DPPA exceptions described in 18 U.S.C. §§ 2721(b)(1) and (b)(14) may apply to law enforcement agencies, such exceptions do not apply to the alleged conduct of Defendant attorneys and law firms in the present action. See Graczyk v. W. Publ'g Co., 660 F.3d 275, 279 (7th Cir. 2011) (explaining that "the DPPA as a whole . . . is concerned with the ultimate use or uses to which personal information contained in motor vehicle records is put"). Defendants' motions to dismiss the Complaint on this basis must, therefore, be denied.
A "Reportable Crash," as defined by N.C. Gen. Stat. § 20-4.01(33b), is "[a] crash involving a motor vehicle that results in one or more of the following: [i] [d]eath or injury of a human being[;] [ii] [t]otal property damage of one thousand dollars ($1,000) or more, or property damage of any amount to a vehicle seized [for certain driving offenses]." N.C. Gen. Stat. § 20-4.01(33b).
G. Commercial Speech
Defendants further argue that Plaintiffs' proposed interpretation of the DPPA violates the First Amendment's protection of commercial speech because it "would categorically prohibit attorneys from 'using' lawfully obtained public information to advertise their legal service." (ECF No. 22 at 35; see ECF No. 24 at 35-37.) According to Defendants, such a content-based prohibition on commercial speech fails to survive intermediate scrutiny. (ECF No. 22 at 35.) In response, Plaintiffs argue that "the First Amendment should not and does not provide protection to persons who unlawfully obtain information and thereafter use or disclose that information for unlawful purposes." (ECF No. 26 at 35.)
Attorney advertising is a form of commercial speech. See Shapero v. Ky. Bar Ass'n, 486 U.S. 466, 472 (1988) (stating that "[l]awyer advertising is in the category of constitutionally protected commercial speech"). As such, it would be subject to intermediate scrutiny, which requires that any State regulation occur "in a manner no more extensive than reasonably necessary to further substantial [government] interests." In re R.M.J., 455 U.S. 191, 207 (1982). See Shapero, 486 U.S. at 472 ("Commercial speech that is not false or deceptive and does not concern unlawful activities . . . may be restricted only in the service of a substantial governmental interest, and only through means that directly advance that interest." (citation omitted)). However, such First Amendment protection applies only to commercial speech concerning a lawful activity. Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of N.Y., 447 U.S. 557, 566 (1980).
Here, Plaintiffs allege that Defendants knowingly obtained and used protected personal information from a motor vehicle record in violation of the DPPA. (ECF No. 5 ¶¶ 33-36, 45-48, 56-59, 78-86.) At this stage, Plaintiffs' allegations, taken as true, plausibly allege unlawful activity that is not protected under the First Amendment. See Central Hudson Gas & Elec. Corp., 447 U.S. at 566. While the issue of whether Defendants have, in fact, engaged in such unlawful conduct is to be borne out on a more developed record, given the current posture of the case, Defendants' motions to dismiss on this ground will be denied.
IV. CONCLUSION
The Court concludes that Plaintiffs have plausibly alleged sufficient facts to establish standing to sue under the DPPA. Accordingly, each Defendant's motion to dismiss Plaintiffs' First Amended Complaint for lack of standing under Rule 12(b)(1) will be denied. The Court further concludes that because Plaintiffs have stated a cognizable claim for relief under the DPPA, each Defendant's motion to dismiss for failure to state a claim under Rule 12(b)(6) will likewise be denied.
For the reasons stated herein, the Court enters the following:
ORDER
IT IS THEREFORE ORDERED that the Farbman Defendants' Motion to Dismiss First Amended Complaint, (ECF No. 21), is DENIED.
IT IS FURTHER ORDERED that the DeMayo Defendants' Motion to Dismiss, (ECF No. 23), is DENIED.
This, the 29th day of September, 2017.
/s/ Loretta C. Biggs
United States District Judge