Durham v. City of Charlotte

UNITED STATES DISTRICT COURT

WESTERN DISTRICT OF NORTH CAROLINA

CHARLOTTE DIVISION

3:21-cv-00638-RJC-DSC

HEATHER NICOLE DURHAM, on )

behalf of herself and others similarly )

situated, )

)

Plaintiff, )

) ORDER

v. )

)

CITY OF CHARLOTTE, )

)

Defendant. )

THIS MATTER is before the Court on Defendant’s Motion for Summary

Judgement, Plaintiff’s Motion to Certify the Class, and Plaintiff’s Motion for

Summary Judgment. For the reasons set forth below, Defendant’s Motion for

Summary Judgment, (Doc. No. 39), is DENIED; Plaintiff’s Motion to Certify Class

(Doc. No. 36), is GRANTED; and Plaintiff’s Motion for Summary Judgment, (Doc.

No. 32), is GRANTED.

I. BACKGROUND

Each year, numerous car accidents occur across North Carolina. When these

accidents rise to the statutorily required level, a report called a DMV-349 must be

completed by the investigating officer. These forms include the name, address, and

driver’s license number of the person involved in the accident. This case arises from

the alleged improper disclosure of DMV-349 reports from the Charlotte-Mecklenburg

Police Department (CMPD) Records Division that contained the personal information

of Plaintiff and others similarly situated.

A. DMV-349 Accident Reports

The North Carolina DMV assigns each North Carolina-licensed driver a license

number which originates with DMV, and DMV enters each driver’s name, date of

birth, address, and license number into its database. (Doc. No. 1 at ¶¶ 14–15, 17; Doc.

No. 19 at ¶¶ 14–15, 17).

When an accident occurs, North Carolina law requires that a law enforcement

officer create an accident report using a form DMV-349 for each reportable motor

vehicle accident. N.C. Gen. Stat § 20-4.01(33b); N.C. Gen. Stat. § 20-166.1(e). (Doc. 1

at ¶ 27; Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 8–9, 18, 21). The standardized DMV-

349 report form is published by NCDMV and is used by all local municipal and county

law enforcement agencies in North Carolina as well as the N.C. State Highway Patrol

to report motor vehicle crashes and the circumstances surrounding the crashes to

NCDMV. (Doc. No. 39-2, Decl. of N. Crum, at ¶¶ 9, 18).

Defendant City of Charlotte “is a North Carolina municipal corporation,

chartered by the General Assembly of North Carolina, organized and operating under

the laws of North Carolina, located in Mecklenburg County, North Carolina.” (Doc. 1

at ¶ 2). The Charlotte-Mecklenburg Police Department (“CMPD”) is a component of

the City. (Doc. No. 1 at ¶ 3).

Accidents that occur within the Charlotte city limits are investigated by

CMPD. See N.C. Gen. Stat. § 20-166.1(a). CMPD officers who complete the DMV-349

in connection with an accident investigation must comply with the then-current

edition of the NCDMV Instruction Manual for the DMV-349. (Doc. 1 at ¶ 28; Doc. No.

39-2, Decl. of N. Crum, at ¶¶ 10–12). When a reporting officer at CMPD has a DMV-

349 report approved by a supervisor, it is in turn submitted to NCDMV for review

and certification by NCDMV. (Doc. No. 39-2, N. Crum Declaration, at ¶ 16).

CMPD officers investigate tens of thousands of accidents each year. (Doc. No.

19 at ¶ 45). When CMPD officers complete DMV-349 forms, they routinely access

either the drivers’ licenses or the DMV database which contains the drivers’ personal

information found on the drivers’ licenses; such officers obtain drivers’ personal

information from these sources, including drivers’ names, addresses, and driver’s

license numbers. (Doc. No. 1 at ¶ 35; Doc. No. 19 at ¶ 35).

CMPD officers use a software program called ReportBeam to assist in

preparing DMV-349 reports. (Doc. No. 19 at ¶ 34; Doc. No. 32-1, CMPD Depo. I, at

11:9–12:7, 13:10–16; Doc. No. 33-1, CST Dep., at 10:24–11:5). When CMPD officers

use ReportBeam to complete an accident report, they have the option to enter a

driver’s license number into their computer to do a computer search for a driver’s

personal information on file in North Carolina DMV’s database. (Doc. No. 32-3,

CMPD Dep. III, at 22:14–25).

Nathan Crum explained that he and other BLET instructors—past and

present—always train CMPD police recruits not to use the auto-populate F-11

function when filling out the demographic information in a DMV-349, but rather to

fill in the individual’s information such as driver’s license number, name, address,

etc. manually on the report. He also testified that using the auto-populate F-11

function could result in an inappropriate disclosure of restricted information from

secure law enforcement information systems. (Doc. No. 39-6, N. Crum Dep., at 27:13–

28:4).

But, if an officer uses the “autopopulate” feature, the officer can select the

driver’s information from the results returned from the DMV database and then press

the F11 key. (Doc. No. 32-1, CMPD Dep. I, at 20:13-22:1; Doc. No. 32-3, CMPD Dep.

III, at 22:14-25). The F11 key causes the officer’s computer to automatically fill-in the

blanks on the DMV-349 form with the driver’s personal information, including her

name and address. (Doc. No. 32-1, CMPD Dep. I, at 25:4–10, 118:20–119:8). This is

known as the “autopopulate” feature. (Doc. No. 32-1, CMPD Dep. I, at 20:13–25.

When a CMPD officer autopopulates the DMV-349, the driver’s name and address

come from the DMV database. (Doc. No. 32-1, CMPD Dep. I, at 21:20–22:5, 25:4–10;

Doc. No. 32-4, Prince Aff., at ¶¶ 4–7). When a CMPD officer completes an accident

report, ReportBeam software records and stores the data for each CMPD DMV-349

in a database on a server. (Doc. No. 33-1, CST Dep., at 93:23—94:25).

When the CMPD officer has auto-populated a driver’s information on to the

DMV-349, the ReportBeam software inserts a “dataclip” into the ReportBeam

database in association with that particular report. The presence of the “dataclip”

associated with a particular report shows that the CMPD officer used the auto-

populate feature to insert the driver’s personal information taken from the DMV

database into the accident report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3; Doc. No. 33-

3, Supp. Selvaraj Decl. ¶¶ 2(d), 3).

B. Plaintiff’s Accident

In December 2017, Plaintiff was a driver in a motor vehicle accident in the city

limits of Charlotte, North Carolina. (Doc. No. 32-8, Pl’s. Decl., at ¶ 4). At the time of

Plaintiff’s accident, Plaintiff was licensed by the State of North Carolina to drive

motor vehicles. (Doc. No. 32-8, Pl’s. Decl., at ¶ 3). Her North Carolina driver’s license

was issued by the North Carolina Division of Motor Vehicles (“NCDMV”). (Doc. No.

32-8, Pl’s. Decl., at ¶ 3). Further, Plaintiff was required to provide her name and

address to NCDMV as a condition of obtaining a driver’s license. (Doc. No. 32-8, Pl’s.

Decl., at ¶ 3).

Plaintiff’s accident was a reportable crash as defined by N.C.G.S. § 20-

4.01(33b). (Doc. 1 at ¶ 64; Doc. No. 9 at ¶ 64; Doc. 1-2 at 1). Further, Plaintiff’s motor

vehicle crash occurred within the City of Charlotte, so under N.C. Gen. Stat. § 20-

166.1(a), the CMPD was the law enforcement agency with jurisdiction over the scene

of the Accident. (Doc. 1 at ¶ 65).

A CMPD officer investigated Plaintiff’s accident. (Doc. No. 32-8, Pl’s. Decl., at

¶ 4). On December 4, 2017, the CMPD officer who investigated Plaintiff’s wreck

completed a DMV-349 containing Plaintiff’s full name, address, date of birth, driver

license number, and telephone number. (Doc. No. 1 at ¶ 67; Doc. No. 19 at ¶ 67; Doc.

No. 1-2). At CMPD, the police officer who investigates a crash submits the DMV-349

Report to a supervisor for review which is then submitted to the NCDMV. (Doc. No.

39-2, N. Crum Declaration, at ¶ 15–17).

The DMV-349 accident report which the CMPD officer completed for Plaintiff’s

accident contained Plaintiff’s name and address. (Doc. No. 1-2, Accident Report, at 1).

At the time of the accident, Plaintiff’s name was Heather Nicole Mack. (Doc. No. 32-

8, Pl’s. Decl., at 1; Doc. No. 1-2 at 1). Plaintiff explained that she never told the officer

her middle name which is “Nicole” as shown on the DMV-349 accident report (Doc.

No. 32-8, Pl’s. Decl., at ¶ 5). Plaintiff does not recall the officer asking her for her

address, and she does not recall telling the officer her address. (Doc. No. 32-8, Pl’s.

Decl., at ¶ 5). Plaintiff has reviewed the accident report which shows her nine-digit

zip code, and she knows that she did not provide that information to the officer orally

because she did not know her nine-digit zip code. (Doc. No. 32-8, Pl’s. Decl., at ¶ 5).

She did not tell the officer her driver’s license number. (Doc. No. 32-8, Pl’s. Decl., at

¶ 5).

C. Distribution of Reports

From 2007 or earlier until late 2020, CMPD placed one or more copies of each

recent DMV-349 accident report on the front desk of its records division so that

anyone who came into the division could personally view the information contained

on each of the DMV-349. (Doc. No. 19 at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 12:1–

13:21).

CMPD made its DMV-349s available to the public at all 13 division offices

within the City of Charlotte. (Doc. No. 32-1, CMPD Dep. I, at 135:4–136:13). The

DMV-349s that CMPD made available to the public included the names, addresses,

and driver’s license numbers of the persons involved in traffic accidents. (Doc. No. 32-

6, CMPD Dep. II, at 31:19–24; Doc. No. 32-1, CMPD Dep. I, 168:9–17). CMPD knew,

since at least 2011 until through at least 2017, that marketers, including law firms

that CMPD employees referred to as “ambulance chasers,” acquired reports in bulk

directly from its records division. (Doc. No. 32-6, CMPD Dep. II, at 18:16—20:5).

CMPD nevertheless did not redact any of the personal information on the DMV-349s

it made available to the public. (Doc. No. 19 at ¶ 53; Doc. No. 32-1, CMPD Dep. I, at

147:9–23; Doc. No. 32-6, CMPD Dep. II, at 31:19–24). Each accident report involving

a licensed driver contained a driver’s license number which originates with and is

assigned by DMV. (Doc. No. 32-1, CMPD Dep. I, at 168:14-22).

Via its records division, CMPD provided copies of its accident reports to Digital

Solutions, who sent runners to CMPD in order to obtain the reports so that it could

sell them to marketers. (Doc. No. 32-9, Creech Decl. I, at ¶¶ 2, 4–5). Digital Solutions,

in turn provided the accident reports to personal injury attorneys, including James

S. Farrin, P.C. (“Farrin”). (Doc. No. 32-9, Creech Decl. I, at ¶ 7; Doc. No. 32-10,

Sanchez Decl., at ¶ 5).

Farrin then harvested personal information from the accident reports and

placed that information on a mailing-list spreadsheet. (Doc. No. 32-10, Sanchez Decl.,

at ¶ 7). According to a declaration made by Plaintiff’s attorney regarding his review

of the Farrin spreadsheets, Plaintiff’s accident report is among those which CMPD

provided to Digital Solutions as Plaintiff’s name and address are contained on the

Farrin Spreadsheet. (Doc. No. 32-13, Stradley Decl., at ¶¶ 3–4). Farrin, as a general

practice, then mailed letters to each person listed on the Farrin Spreadsheet. (Doc.

No. 32-10, Sanchez Decl., at ¶ 8).

Plaintiff has not provided written consent to allow anyone to disclose or use

her personal information, from a motor vehicle record, for marketing purposes or for

any other purpose. (Doc. No. 32-8, Pl’s. Decl., at ¶ 8).

D. Plaintiff Receives Marketing Letters

In 2017, shortly after Plaintiff’s accident, Plaintiff began receiving in the mail

marketing letters from attorneys who were soliciting her to hire them to assert a legal

claim arising out of the accident. (Doc. No. 32-8, Pl’s. Decl., at ¶ 7). Plaintiff does not

recall which firms they were from and she lacks a copy of the letters. (Doc. No. 32-8,

Pl.’s Decl., at ¶ 7).

Plaintiff explains that she was harmed in the following ways by Defendant’s

disclosure of her accident report showing her personal information:

1. Defendant invaded and violated her privacy rights to protected personal

information; As a result of Defendant’s improperly disclosing her name,

address, and other personal information from the accident report,

marketers were able to obtain that information and use it to create,

process, and mail advertising letters;

2. Defendant exposed her DPPA-protected personal information to

marketers and their office personnel who processed the marketing

letters and to people who handled the mail for the postal service and to

any others who saw the mail;

3. When the marketing letters arrived at Plaintiff’s house, she had to

expend time and attention to retrieve them from her mailbox and open

and/or dispose of the letters;

4. When Plaintiff received the advertising letters shortly after the

accident, she was shocked and upset that advertisers could so quickly

learn that she had been in a wreck and so quickly get so much relevant

personal information about her, and she questioned how that could

possibly be legal;

5. When she got the advertising letters shortly after the accident, she was

irritated that marketing attorneys were immediately soliciting business

to pursue legal claims so soon after the accident.

(Doc. No. 32-8, Pl’s. Decl., at ¶ 9; Doc. No. 32-11, Pl.’s Depo., at 19:5–22:11).

E. Connecting Data to DMV Records

Plaintiff’s expert, Sankar Selvaraj, has examined stored ReportBeam

computer data including Plaintiff’s accident report. (Doc. No. 33-2, Selveraj Decl., at

¶ 2; Doc. No. 33-3, Supp. Selvaraj Decl., at ¶ 2(b)). This data for Plaintiff’s Accident

Report contains a “dataclip” containing Plaintiff’s full name, address, and date of

birth. (Doc. No. 33-2, Selveraj Decl., at ¶ 3; (Doc. No. 33-3, Supp. Selvaraj Decl., at ¶

3). Plaintiff’s information contained in the “dataclip” matches her data shown on the

Accident Report. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj

Decl., ¶ 3(4)). Hence, the “dataclip” shows that the CMPD auto-populated Plaintiff’s

name, address, and date of birth onto the Accident Report from the DMV database

and that no changes were made to Plaintiff’s auto-populated name, address, or date

of birth. (Doc. No. 33-2, Selvaraj Decl., at ¶ 3(d); Doc. No. 33-3, Supp. Selvaraj Decl.,

Ex. 14, ¶ 3(4)).

F. Lack of CMPD Records

CMPD kept neither a record of which DMV-349 reports actually were placed

out for viewing in the CMPD Records Division nor which reports were viewed or by

whom. There is no record from CMPD that a representative of Digital Solutions

viewed or collected DMV-349 reports at the CMPD Records Division. (Doc. No. 39-5,

Decl. of Kiersten Frost, at ¶¶ 6–7).

G. Procedural History

On November 30, 2021, Plaintiff Heather Nicole Durham filed this putative

class action. (Doc. No. 1). Defendant City of Charlotte filed a Motion to Dismiss on

several grounds, including lack of standing. (Doc. No. 7). On October 13, 2022, this

Court adopted Magistrate Judge Cayer’s Memorandum & Recommendation, (Doc.

No. 14), granting the motion as to Plaintiff’s claim for declaratory and injunctive relief

but finding that Plaintiff had established standing as to her claims for liquidated

damages. (Doc. No. 17).

In January 2023, this case was stayed pending the outcome of the appeal in

Hensley v. City of Charlotte before the Fourth Circuit. (Doc. No. 22). Plaintiff filed her

Motion for Summary Judgment, (Doc. No. 32), and Motion to Certify Class, (Doc. No.

36), on December 1, 2023. Defendant filed its Motion for Summary Judgment on the

same day. (Doc. No. 39).

II. STANDARD OF REVIEW

Summary judgment shall be granted “if the movant shows that there is no

genuine dispute as to any material fact and the movant is entitled to judgment as a

matter of law.” Fed. R. Civ. P. 56(a). A factual dispute is genuine “if the evidence is

such that a reasonable jury could return a verdict for the nonmoving party.”

Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A fact is material only if it

might affect the outcome of the suit under governing law. Id. The movant has the

“initial responsibility of informing the district court of the basis for its motion, and

identifying those portions of the pleadings, depositions, answers to interrogatories,

and admissions on file, together with the affidavits, if any, which it believes

demonstrate the absence of a genuine issue of material fact.” Celotex Corp. v. Catrett,

477 U.S. 317, 323 (1986) (internal citations omitted). “The burden on the moving

party may be discharged by ‘showing’ . . . an absence of evidence to support the

nonmoving party’s case.” Id. at 325.

Once this initial burden is met, the burden shifts to the nonmoving party. The

nonmoving party “must set forth specific facts showing that there is a genuine issue

for trial.” Id. at 322 n.3. The nonmoving party may not rely upon mere allegations

or denials of allegations in his pleadings to defeat a motion for summary judgment.

Id. at 324. Instead, “Rule 56(e) . . . requires the nonmoving party to go beyond the

pleadings and by her own affidavits, or by the depositions, answers to interrogatories,

and admissions on file, designate specific facts showing that there is a genuine issue

for trial.” Id. The nonmoving party must present sufficient evidence from which “a

reasonable jury could return a verdict for the nonmoving party.” Anderson, 477 U.S.

at 248; accord Sylvia Dev. Corp. v. Calvert Cty., Md., 48 F.3d 810, 818 (4th Cir. 1995).

The Fourth Circuit has concluded that “evidence, which is inadmissible at trial,

cannot be considered on a motion for summary judgment. Maryland Highways

Contractors Ass'n, Inc. v. State of Md., 933 F.2d 1246, 1251–52 (4th Cir. 1991) (finding

that inadmissible hearsay evidence could not be considered on a motion for summary

judgment) (citing Rohrbough v. Wyeth Laboratories, Inc., 916 F.2d 970, 973–74 n.8

(4th Cir.1990); Garside v. Osco Drug, Inc., 895 F.2d 46, 50 (1st Cir.1990); Randle v.

LaSalle Telecommunications, Inc., 876 F.2d 563, 570 n.4 (7th Cir.1989); Pink Supply

Corp. v. Hiebert, Inc., 788 F.2d 1313, 1319 (8th Cir. 1986)).

When ruling on a summary judgment motion, a court must view the evidence

and any inferences from the evidence in the light most favorable to the nonmoving

party. Anderson, 477 U.S. at 255. “Where the record taken as a whole could not lead

a rational trier of fact to find for the nonmoving party, there is no genuine issue for

trial.” Ricci v. DeStefano, 557 U.S. 557, 586 (2009) (citations omitted). The mere

argued existence of a factual dispute does not defeat an otherwise properly supported

motion. Anderson, 477 U.S. at 248. If the evidence is merely colorable or is not

significantly probative such that a jury could not return a verdict for the other party,

summary judgment is appropriate. Id. at 249–50 (cleaned up).

“A district court has broad discretion in deciding whether to certify a

class.” Thorn v. Jefferson-Pilot Life Ins. Co., 445 F.3d 311, 317 (4th Cir. 2006)

(quoting Lienhart v. Dryvit Sys., Inc., 255 F.3d 138, 146 (4th Cir. 2001)). In the

execution of this discretion, a court must accept the substantive allegations of the

complaint as true and “interpret Rule 23 in such a manner as to promote justice and

judicial efficiency.” Farrar & Farrar Dairy, Inc. v. Miller-St. Nazianz, Inc., 254

F.R.D. 68, 72 (E.D.N.C. 2008); Di Biase v. SPX Corp., No. 314CV00656RJCDSC, 2017

WL 4366994, at *2 (W.D.N.C. Oct. 2, 2017). Nonetheless, the burden of establishing

certification remains with the party seeking class certification. Thorn v. Jefferson-

Pilot Life Ins. Co., 445 F.3d 311, 321–22 (4th Cir. 2006). A class “may only be certified

if the trial court is satisfied, after a rigorous analysis, that the prerequisites of Rule

23(a) have been satisfied.” Gen Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 161

(1982). Then, if a plaintiff meets all of the requirements of Fed. R. Civ. P. (23)(a), the

plaintiff must show that the putative class also fits into one of the three categories

enumerated in Rule 23(b). Fed. R. Civ. P. 23(b).

III. DISCUSSION

A. Defendant’s Motion to Dismiss and Motion for Summary Judgment

Defendant moves the Court to dismiss the action for lack of standing, or in the

alternative, to grant summary judgment in favor of Defendant, finding that the City

of Charlotte is not a “person” as defined by the relevant statute. (Doc. No. 39 at 1).

The Drivers Privacy Protection Act provides that “[a] person who knowingly

obtains, discloses or uses personal information, from a motor vehicle record, for a

purpose not permitted under this chapter shall be liable to the individual to whom

the information pertains, who may bring a civil action in a United States district

court.” 18 U.S.C. § 2724(a). Thus, there is a private right of action when a person

violates the DPPA.

1. Lack of Standing

The plaintiff bears the burden of proving that subject matter jurisdiction

exists. Evans v. B.F. Perkins Co., a Div. of Standex Int’l Corp., 166 F.3d 642, 647 (4th

Cir. 1999). “When . . . a defendant challenges the existence of subject matter

jurisdiction in fact, the plaintiff bears the burden of proving the truth of such facts by

a preponderance of the evidence.” U.S. ex rel. Vuyyuru v. Jadhav, 555 F.3d 337, 347

(4th Cir. 2009). “When a defendant challenges subject matter jurisdiction pursuant

to Rule 12(b)(1), the district court is to regard the pleadings as mere evidence on the

issue and may consider evidence outside the pleadings without converting the

proceeding to one for summary judgment. Evans, 166 F.3d at 647 (cleaned up).

A court will analyze standing in a class action “based on the allegations of

personal injury made by the named plaintiffs.” Baehr v. Creig Northrop Team, P.C.,

953 F.3d 244, 252 (4th Cir. 2020) (citing Hutton v. Nat'l Bd. of Exam'rs in Optometry,

Inc., 892 F.3d 613, 620 (4th Cir. 2018)). At the summary judgment stage, “the named

plaintiff is obliged to ‘set forth by affidavit or other evidence specific facts’ that, when

taken as true, establish each element of Article III standing.” Id. at 253 (quoting

Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992); and then citing Libertarian

Party of Virginia v. Judd, 718 F.3d 308, 313 (4th Cir. 2013)). “Once threshold

individual standing by the class representative is met, a proper party to raise a

particular issue is before the court [and] there is no further, separate ‘class action

standing’ requirement.” Carolina Youth Action Project; D.S. by & through Ford v.

Wilson, 60 F.4th 770, 779 (4th Cir. 2023) (citing 1 Newberg and Rubenstein on Class

Actions § 2:1 (6th ed. 2022)).

“The irreducible constitutional minimum of standing consists of three

elements. The plaintiff must have (1) suffered an injury in fact, (2) that is fairly

traceable to the challenged conduct of the defendant, and (3) that is likely to be

redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338

(2016), as revised (May 24, 2016) (cleaned up). A plaintiff “cannot establish a

cognizable injury simply by pleading a statutory violation.” Garey v. James S. Farrin,

P.C., 35 F.4th 917, 921 (4th Cir. 2022) (citing Spokeo, 578 U.S. at 341).

As to “injury in fact,” in Garey, the Fourth Circuit held that the plaintiffs had

Article III standing to pursue claims for damages under the DPPA because they

established a legally cognizable privacy injury. 35 F.4th at 922. Specifically, plaintiffs

alleged under the DPPA that their privacy was invaded by the defendants who

knowingly obtained their personal information for an impermissible purpose. Id. The

court of appeal reasoned that like in Krakauer “injuries to personal privacy have long

been ‘recognized in tort law and redressable through private litigation.’” Id. (quoting

Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 653 (4th Cir. 2019)). Thus, the

plaintiffs in Garey had alleged a legally cognizable privacy injury. Id.

Here, Plaintiff’s alleged injury is similar to the injury claimed in Garey.

Plaintiff articulates a privacy violation through the disclosure of a motor vehicle

record for impermissible purposes under DPPA. Consistent with Garey, Plaintiff can

establish the “injury in fact” prong required for standing.

Moving on to the “fairly traceable” element, Plaintiff argues that both the

undisputed evidence and Defendant’s own admissions1 prove that Defendant

unlawfully disclosed Plaintiff’s DPPA-protected information. (Doc. No. 44 at 10).

1 Plaintiff claims that in its answer, “Defendant admits that it published Plaintiff’s

unredacted crash report, which contains DPPA-protected personal information, at its

records desk.” (Doc. No. 44 at 11). Defendant asserts that Plaintiff’s argument is a

mischaracterization of Defendant’s answer by leaving out that the admissions were

made upon “information and belief.” (Doc. No. 51 at 6). In general, a party is bound

by the admissions of its pleadings. Lucas v. Burnley, 879 F.2d 1240, 1242 (4th Cir.

1989); see also Butts v. Prince William Cnty. Sch. Bd., 844 F.3d 424, 432 n.3 (4th Cir.

Arguing that Plaintiff’s injury is not “fairly traceable” to Defendant’s conduct,

Defendant relies upon Hensley v. City of Charlotte, No. 3:20-CV-00482-KDB-DSC,

2023 WL 2533083, at *1 (W.D.N.C. Mar. 15, 2023). Defendant contends that Hensley

“is largely indistinguishable from the instant case,” and thus, Plaintiff is without

standing. The Court is not persuaded.

In Hensley, the district court found that the plaintiff lacked standing “because

he ha[d] not alleged in the relevant pleadings that his injury was the result of a

wrongful disclosure of his personal information by the City” in violation of the DPPA.

2023 WL 2533083, at *1. The Court observed that Plaintiff’s allegations asserted that

CMPD records and LexisNexis both made information available to the public and the

complaint did not allege that “a member of the public who viewed Hensley’s Accident

Report at the records division solicited [him].” Id. at *2. The Court concluded that the

complaint failed to allege that the plaintiff’s injury was traceable to the City’s alleged

wrongful conduct. Id. at *4.

The Court reasoned that Plaintiff’s standing depended “on an allegation that

he suffered his injury from a disclosure of Plaintiff’s accident report from the CMPD

counter,” and fatal to the plaintiff’s claim, CMPD/the City kept no record of which

accident reports were viewed or by whom, and Hensley could not show that “he

2016). However, this Court has recognized that the phrase “on information and belief”

is “a lawyer shorthand expression of uncertainty.” In re Thiel, No. 1:14-CV-168, 2015

WL 773401, at *4 n.4 (W.D.N.C. Feb. 24, 2015), aff’d, 627 F. App’x 272 (4th Cir. 2016).

Thus, the Court does not find Defendant CMPD to have admitted the allegations

asserted by Plaintiff where Defendant noted that these allegations were admitted

“upon information and belief.”

received a solicitation as a result of the disclosure of DPPA protected personal

information at the CMPD counter rather than the PRUS/LexisNexis website.” Id. at

*3 (quotations omitted).

The Court described the plaintiff’s affidavits attempting to establish

traceability as “wholly speculative and internally inconsistent in describing how the

law firm solicitation might have come to Plaintiff.” Id. at *4. In addressing the specific

evidence, the Court explained Plaintiff’s evidence from Digital Solutions’ this way:

[Digital Solutions] says that it gathers reports “in a variety of ways” and

it is only its President’s “best recollection” in July 2021 that from

September 2017 to the end of the year it accessed crash reports from

CMPD by gathering hard copies from the department. Significantly,

however, Digital Solutions does not say that it provided actual accident

reports to clients, but instead says that it takes information from the

reports which it puts into an excel spreadsheet format that is its product.

Id. at *4. Further, the Farrin law firm declaration denied “that it received any

spreadsheets from Digital Solutions but instead claims that it prepared its own

internal spreadsheets from actual accident reports.” Id. The Court concluded that the

plaintiff failed to “establish whether the law firm in fact even had Plaintiff’s accident

report or, if so, where it came from.” Id. Thus, the Court concluded that the plaintiff

failed to allege that the injury was traceable to the City’s alleged DPPA violation and

was without standing. Id.

In sum, the Hensley causal chain breaks between Digital Solutions and the

Farrin law firm. Digital Solutions may have received accident reports from CMPD

which it used to create spreadsheets that the Farrin law firm never received. Because

the Farrin law firm had its own accident reports that it used to make spreadsheets,

but Digital Solutions never claimed to have provided the actual reports to clients,

there was no link between the law firm’s accident reports and CMPD’s record counter.

Defendant argues that Plaintiff suffers from the same insufficient evidence as

the plaintiff in Hensley. (Doc. No. 39-1 at 14–17). Defendant contends that “Plaintiff

has no personal knowledge of the most fundamental facts alleged in her Complaint

that would go toward establishing a concrete and particularized injury traceable to

the City.” (Doc. No. 39-1 at 15). In response, Plaintiff argues that the evidence leaves

no other possibility than that Defendant unlawfully disclosed Plaintiff’s accident

report to Digital Solutions. (Doc. No. 44 at 10).

Based on a declaration of Plaintiff’s attorney, Plaintiff’s name and address

appears in the Farrin firm’s spreadsheets. (Doc. No. 32-13, Stradley Decl., at ¶ 4). A

declaration from Eric Sanchez at the Farrin firm details that it only obtained accident

reports that were released to the public by CMPD through its agreement with Digital

Solutions. (Doc. No. 32-10, Sanchez Decl., at ¶ 5). The Farrin Firm reviewed the

accident reports it received and created its own spreadsheets “to inform its ability to

communicate in writing with persons involved in accidents to introduce the Firm’s

services.” (Id. at ¶ 7). As a general practice, the Farrin Firm would send a mailing

that corresponded to each listing on the spreadsheets it created. (Id. at ¶ 8). Further,

based on a declaration from Kevin Creech, at Digital Solutions, Digital solutions

received accident reports, beginning in September 2017, only from sending runners

to retrieve the reports from the CMPD division. (Doc. No. 32-9, Creech Decl., at ¶ 5).

Digital Solutions then provided the accident reports to the Farrin law firm. (Id. at ¶

7).

It is also established that from at least 2007 until late 2020, Defendant placed

one or more copies of its recently created DMV-349s on the front desk of its records

division such that anyone who came into the records division could view the

information on each DMV-349. (Doc. No. 1 at ¶ 49; Doc. No. 19 at ¶ 49). No redactions

were ever made in the reports made available at the CMPD records counter. (Doc.

No. 1 at ¶ 53; Doc. No. 19 at ¶ 53). When Plaintiff was involved in a motor vehicle

accident in December of 2017, a DMV-349 was prepared. (Doc. No. 1 at ¶ 64; Doc. No.

19 at ¶ 64).

In this case, Plaintiff does not suffer from the same traceability deficiencies

that were present in Hensley. Unlike Hensley, Digital Solutions does say that it

provided actual accident reports to clients, thus the causal chain is not broken in the

same way. The accident reports went from the CMPD records counter to Digital

Solutions and then to the Farrin firm and into the Farrin firm’s spreadsheets. Thus,

Plaintiff has established that she suffered an injury in fact, that is fairly traceable to

the challenged conduct of Defendant, and that is likely to be redressed by a favorable

judicial decision. See Spokeo, 578 U.S. at 338. Accordingly, dismissal for lack of

standing is not appropriate, and Defendant’s Motion to Dismiss for lack of standing

is denied.

2. “Person” Subject to the DPPA

The Drivers Privacy Protection Act makes it “unlawful for any person

knowingly to obtain or disclose personal information, from a motor vehicle record, for

any use not permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a). The

statute provides for private cause of action against a violator: “A person who

knowingly obtains, discloses or uses personal information, from a motor vehicle

record, for a purpose not permitted under this chapter shall be liable to the individual

to whom the information pertains, who may bring a civil action in a United States

district court.” 18 U.S.C. § 2724(a). The statute also defines the term “person” as

follows: “‘person’ means an individual, organization or entity, but does not include a

State or agency thereof.” 18 U.S.C. § 2725(2).

Defendant City of Charlotte argues that it is an agency of North Carolina and,

therefore, not a person under the DPPA and not subject to a private cause of action.

(Doc. No. 39-1 at 1). Defendant proffers that North Carolina state law compels the

result that the City of Charlotte is not a “person” for purposes of the DPPA. In

response, Plaintiff asserts that municipalities like the City of Charlotte are “persons”

under the DPPA as a matter of federal law. (Doc. No. 44 at 12–13).

In interpreting the statute, the Court will look first to the statute’s language,

giving the words used their ordinary meaning. Dwoskin v. Bank of Am., N.A., 888

F.3d 117, 119 (4th Cir. 2018) (quoting Roberts v. Sea-Land Services, Inc., 566 U.S. 93,

100 (2012)). Further, in general, application of federal law does not depend upon State

law, unless there is a plain indication otherwise. Mississippi Band of Choctaw

Indians v. Holyfield, 490 U.S. 30, 43 (1989).2 The goal, of course, is uniform

application of statutes nationwide. Id. at 43–44; see also Brooks v. Maryland Gen.

Hosp., Inc., 996 F.2d 708, 714 (4th Cir. 1993) (“While the federal courts may give

effect to state law in interpreting the scope of a federal statute if Congress has evinced

an intention to give state law persuasive or binding effect, even when a federal

statutory provision contains significant gaps, the courts have been reluctant to infer

such intent and resort to reference to state law due to concern for uniformity in the

nation’s law.” (citations omitted)).

Section 2721 provides for permissible use of personal information “by any

government agency, including any court or law enforcement agency, in carrying out

its functions, or any private person or entity acting on behalf of a Federal, State, or

local agency in carrying out its functions” and “in connection with any civil, criminal,

administrative, or arbitral proceeding in any Federal, State, or local court or agency

or before any self-regulatory body, including the service of process, investigation in

anticipation of litigation, and the execution or enforcement of judgments and orders,

or pursuant to an order of a Federal, State, or local court.” 18 U.S.C. § 2721(b)(1),

(b)(4).

Plaintiff directs the Court to the statute’s mention of a “local agency,” which is

mentioned in addition to a State agency. (Doc. No. 44 at 14). Generally, if Congress

uses specific language in one section but does not use that same language in another

2 The Court finds no indication in the statute that it should consult North Carolina

law to determine if Defendant City of Charlotte is a “person” under DPPA.

section, it is assumed that Congress acted intentionally in its inclusion and exclusion

of the language at issue. Russello v. United States, 464 U.S. 16, 23 (1983). Language

in section 2725 that a State agency is excluded from the definition of “person,” without

any mention of a “local agency” also being excluded from the definition casts serious

doubt on Defendant’s not-a-person argument.

Numerous courts have concluded that a municipality does not act as a “State

or agency thereof” under DPPA and is a person under the act. The Eleventh Circuit

has expressed that the definition of “person” under section 2725 “does not exclude

municipal agencies such as sheriff’s departments,” and that “it would be a feat of

statutory reconstruction to sever the term ‘person’ as it appears in section 2722(a)

and section 2724(a) from the remedies enumerated in section 2724(b).” Truesdell v.

Thomas, 889 F.3d 719, 724 (11th Cir. 2018). District courts have also concluded that

municipalities are not excluded from liability. See Orduno v. Pietrzak, No. CV 14-

1393 ADM/DTS, 2017 WL 4354686, at *9 (D. Minn. Sept. 29, 2017), aff’d, 932 F.3d

710 (8th Cir. 2019) (concluding based on the text of the statute that “the statute

contemplates direct liability for municipal entities like the City”); Potocnik v. Carlson,

No. 13-CV-2093 (PJS/HB), 2016 WL 3919950, at *7 (D. Minn. July 15, 2016)

(“Congress specifically exempted states and state agencies from the definition of

“person” under the DPPA, [but] Congress conspicuously did not exempt

municipalities.”); Santarlas v. Minner, No. 5:15-CV-103-OC-30PRL, 2015 WL

3852981, at *3 (M.D. Fla. June 22, 2015) (“Although a state and its agencies, such as

a department of motor vehicles, are exempt from the civil penalties provided for under

the DPPA, cities and municipalities are not.”); Margan v. Niles, 250 F. Supp. 2d 63,

75 (N.D.N.Y. 2003) (“[P]ursuant to 18 U.S.C. § 2724(a), states and state agencies are

expressly exempted from civil liability under the DPPA. Municipalities are not. . . .

[D]ifferential treatment of states and state departments of motor vehicles provides

no basis upon which to conclude that Congress intended to treat municipalities

different than other ‘persons.’”).

Diverging from the aforementioned district court decisions, Defendant argues

that Gaston concluded that a municipality is not a person under DPPA. (Doc. No. 39-

1 at 18). Defendant is mistaken.

In its order, the Court noted that “any failure by a state or state agency,

including a DMV or city acting within the scope of its governmental authority, is not

subject to a private right of action under section 2724(a) because a ‘State or agency

thereof’ is not defined as a ‘person’ under the DPPA, although they are plainly subject

to the DPPA’s disclosure restrictions described in section 2721(a) and subject to a

potential civil penalty under 18 U.S.C. § 2723.” Gaston v. LexisNexis Risk Sols., Inc.,

483 F. Supp. 3d 318, 350 n.29 (W.D.N.C. 2020). The Court also noted that “[a]

subordinate division of the state, like a city administrative unit is a state agency.” Id.

at 348 n.25 (citing Smith v. Hefner, 235 N.C. 1, 68 S.E.2d 783 (1952)).

Yet, throughout its order, the Court makes clear that the disclosure of accident

reports is subject to the DPPA. The Court explained that “the very essence of the

DPPA is to limit the disclosure of information that had previously been made widely

available as a public record; so, . . . it would be nonsensical to hold that a permissible

governmental ‘function’ under the DPPA is to publicly disclose personal information

in a ‘public record.’” 483 F. Supp. 3d at 346.

Further, the Court explained that a municipality was considered a State

agency under the DPPA only to the extent it acted within the scope of its

governmental authority, stating the following:

the gathering of personal information to prepare the Crash Reports is a

government function permitted by section 2721(b)(1) in the same way

that gathering personal information to create a driver’s license or motor

vehicle registration is permitted by the act. However, once the

information is lawfully obtained, the disclosure of the information, in

and of itself, is not an independent governmental function that is

permitted by the DPPA (absent redaction or a separate permitted use).

483 F. Supp. 3d at 346 n.20. The Court made clear that impermissible disclosure of

DPPA-protected information is not a government function. Thus, Gaston does not

hold that Defendant cannot be subject to a private cause of action under the DPPA

for disclosure of DPPA-protected information.

In sum, the Court finds Defendant’s argument that it is not a “person” subject

to suit under DPPA unavailing. Accordingly, Defendants’ Motion for Summary

Judgment is denied. Having denied Defendant’s Motion to Dismiss and Motion for

Summary Judgment, the Court turns to Plaintiff’s Motion for Summary Judgment

and Plaintiff’s Motion to Certify Class.

B. Plaintiff’s Motion for Class Certification

Plaintiff seeks class certification in this action under the DPPA. The purported

class of persons is defined as follows:

Those (1) who were listed as North Carolina-licensed drivers on DMV-

349s completed by CMPD officers within the Class Period [November

30, 2017–June 30, 2018]; (2) whose name appears on a Farrin

Spreadsheet; and (3) whose North Carolina driver’s license number is

shown on the DMV-349 or the Same Address Box for the person is

checked “Yes” on the DMV-349.

(Doc. No. 37 at 11). Plaintiff also brings the action on behalf of a subclass consisting

of all members of the Class whose personal information was auto-populated onto a

DMV-349. (Id. at 11–12).

In opposition, Defendant reiterates its arguments, which are addressed above,

regarding standing and maintains that it is not a “person” subject to a private right

of action under DPPA. (Doc. No. 45). Defendant does not challenge Plaintiff’s

arguments on the specific factors required for class certification but instead makes

general objections to Plaintiff’s evidence procured during the Hensley litigation and

analyzed by Plaintiff’s expert in this case. (Id. at 22–24).

“The class action is ‘an exception to the usual rule that litigation is conducted

by and on behalf of the individual named parties only.’” Comcast Corp. v. Behrend,

569 U.S. 27, 33 (2013) (citing Califano v. Yamasaski, 442 U.S. 682, 700–701 (1979)).

To meet this exception, a party seeking to maintain a class action “must affirmatively

demonstrate his compliance” with Rule 23 of the Federal Rules of Civil Procedure.

Id. (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011)). This rule

requires a two-part test for certifying a class.

First, the plaintiff must establish the four requirements under Rule 23(a):

(1) the class is so numerous that joinder of all members is

impracticable;

(2) there are questions of law or fact common to the class;

(3) the claims or defenses of the representative parties are typical of

the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the

interests of the class.

Fed. R. Civ. P. 23(a); see also Gunnells v. Healthplan Servs., 348 F.3d 417, 423 (4th

Cir. 2003). These basic prerequisites are commonly referred to as numerosity,

commonality, typicality, and adequacy, respectively. See id.

Second, if a plaintiff meets all of the requirements of Fed. R. Civ. P 23(a), the

plaintiff must show that the putative class also fits into one of the three categories

enumerated in Rule 23(b). Fed. R. Civ. P. 23(b); Amchem Prod., Inc. v. Windsor, 521

U.S. 591, 614 (1997). Here, Plaintiff seeks certification under Rule 23(b)(3), which

requires that “the questions of law or fact common to class members predominate

over any questions affecting only individual members, and that a class action is

superior to other available methods for fairly and efficiently adjudicating the

controversy.”

1. Rule 23(a) Factors

a. Numerosity

To bring a class action, the class must be so numerous that joinder of all

members is impracticable. Fed. R. Civ. P. 23(a)(1). “No specified number is needed to

maintain a class action.” Brady v. Thurston Motor Lines, 726 F.2d 136, 145 (4th Cir.

1984) (quoting Cypress v. Newport News General & Nonsectarian Hospital Ass’n, 375

F.2d 648, 653 (4th Cir. 1967)). For determining whether the numerosity requirement

is met, it is not necessary to demonstrate with precision the number of persons in a

purported class—reasonable estimates are sufficient. Simpson v. Specialty Retail

Concepts, 149 F.R.D. 94, 98 (M.D.N.C. 1993) (citations omitted). Large class sizes

alone may allow a court to presume the impracticability of joinder. Olvera-Morales v.

Int’l Lab. Mgmt. Corp., 246 F.R.D. 250, 256 (M.D.N.C. 2007). The Fourth Circuit has

recognized classes of 74 persons, or as low as 18 persons, can meet the numerosity

requirement. Brady, 726 F.2d at 145.

Plaintiff demonstrates that the proposed class and subclass each consist of at

least several thousand persons. (Doc. No. 37 at 14; Doc. No. 1 at ¶¶ 45–47; Doc. No.

19 at ¶45–47). Thus, the numerosity requirement is met.

b. Commonality

To certify a class action, there must be questions of law or fact common to the

class. Fed. R. Civ. P. 23(a)(2). The commonality prerequisite requires a plaintiff to

show that the class members share both a common contention and a common injury.

Wal-Mart Stores, 564 U.S. at 349–50. “That common contention, moreover, must be

of such a nature that it is capable of classwide resolution—which means that

determination of its truth or falsity will resolve an issue that is central to the validity

of each one of the claims in one stroke.” Id. at 350. Further, the “test for commonality

is not demanding, and is met when there is at least one issue whose resolution will

affect all or a significant number of the putative class members.” Bussian v.

DaimlerChrylser Corp., No. 104CV00387, 2007 WL 1752059, at *5 (M.D.N.C. June

18, 2007) (citing Woodard v. Online Info. Servs., 191 F.R.D. 502, 505 (E.D.N.C. 2000)).

Here, all members of the proposed class are subject to the ultimate question of

“whether Defendant violated the DPPA by disclosing class members’ unredacted

personal information from motor vehicle records without a permissible purpose.”

(Doc. No. 37 at 15; Doc. No. 1 at ¶ 113). The resolution of this question will affect all

of the persons in the proposed class. Thus, the commonality element is satisfied.

c. Typicality:

Rule 23 also requires that the claims or defenses of the representative plaintiff

be typical of the claims or defenses of the class. Fed. R. Civ. P. 23(a)(3). “The typicality

requirement is met where the claims asserted by the named plaintiffs arise from the

same course of conduct and are based on the same legal theories as the claims of the

unnamed class members.” Tatum v. R.J. Reynolds Tobacco Co., 254 F.R.D. 59, 65

(M.D.N.C. 2008) (cleaned up). This requirement has “consistently been held to mean

that his claim cannot be antagonistic to the claims of other members.” DeLoach v.

Philip Morris Companies, Inc., 206 F.R.D. 551, 555 (M.D.N.C. 2002) (citation

omitted). In other words, the named plaintiff’s interest must be “sufficiently aligned”

with the interest of the class to ensure confidence in the named plaintiff’s “ability to

adequately represent its interests.” Olvera-Morales, 246 F.R.D. at 258. “Typicality

tends to merge with commonality, insofar as both serve as guideposts for determining

whether under the particular circumstances maintenance of a class action is

economical and whether the named plaintiff’s claim and the class claims are so

interrelated that the interests of the class members will be fairly and adequately

protected in their absence.” Soutter v. Equifax Info. Servs., LLC, 498 F. App’x 260,

264 (4th Cir. 2012) (cleaned up).

Here, the interests of Plaintiff Durham appear to be aligned with the interests

of the class. No antagonism exists between the claims as the claims of the named

plaintiff “arise from the same course of conduct” and are based “on the same legal

theories as the class members.” Both the named plaintiff and the class seek to

establish Defendant’s liability and to recover damages based upon Defendant’s

disclosure of DPPA-protected information. (Doc. No. 37 at 17). Plaintiff’s DMV-349,

like the DMV-349 of the class, shows her driver’s license number and has the Address

Box checked. Likewise, Plaintiff and the subclass contend that their personal

information maintained by NCDMV was auto-populated into their respective crash

reports. Therefore, the typicality requirement is met.

d. Adequacy of representation

Class certification also requires that the representative parties will fairly and

adequately protect the interests of the class. Fed. R. Civ. P. 23(a)(4). “The adequacy

inquiry serves to uncover conflicts of interest between named parties and the class

they seek to represent.” Sharp Farms v. Speaks, 917 F.3d 276, 295 (4th Cir. 2019)

(cleaned up). “A class representative must be part of the class and possess the same

interest and suffer the same injury as the class members.” Id. (cleaned up). Adequacy

of representation is divided into two prongs: (1) the party’s attorney must be qualified,

experienced and generally able to conduct the proposed litigation and (2) the litigants

must not be involved in a collusive suit and plaintiff must not have interests

antagonistic to the remainder of the class. DeLoach v. Philip Morris Companies, Inc.,

206 F.R.D. 551, 556 (M.D.N.C. 2002).

Here, as noted in the prior section, Plaintiff does not have interests which are

antagonistic to the class. Further, Plaintiff’s counsel appears qualified, experienced,

and generally able to conduct the litigation. Thus, the representative parties will

fairly and adequately protect the interests of the class.

2. Rule 23(b)(3)

Plaintiff seeks certification under Rule 23(b)(3), which requires that “the

questions of law or fact common to class members predominate over any questions

affecting only individual members, and that a class action is superior to other

available methods for fairly and efficiently adjudicating the controversy.” These two

requirements are labeled “predominance” and superiority.”

“In conducting the predominance analysis, a court first characterizes issues as

common or individual.” In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig.,

341 F.R.D. 128, 155 (D. Md. 2022), vacated and remanded sub nom. In re Marriott

Int’l, Inc., 78 F.4th 677 (4th Cir. 2023), and reinstated by In re Marriott Int’l Customer

Data Sec. Breach Litig., 345 F.R.D. 137 (D. Md. 2023) (citing 2 Newberg § 4:50 (5th

ed. 2021)). “Rule 23(b)(3) is normally satisfied where there is an essential common

factual link, such as standardized documents and practices, even though the nature

and amount of damages may differ among class members.” Id. (quoting In re TD

Bank, N.A. Debit Card Overdraft Fee Litig., 325 F.R.D. 136, 154 (D.S.C. 2018)).

“The Rule 23(b)(3) predominance inquiry tests whether proposed classes are

sufficiently cohesive to warrant adjudication by representation.” Amchem Prod., Inc.

v. Windsor, 521 U.S. 591, 623 (1997). The question is whether a plaintiff suing under

the DPPA is likely to be in the same position as many other people and can rely

largely on common proof to make out her claim. See Krakauer v. Dish Network, L.L.C.,

925 F.3d 643, 656 (4th Cir. 2019) (explaining that a plaintiff bringing a claim under

a particular statute was likely to be in the same position as a great many other people

and can rely largely on common proof to make out his claim” and certifying the class

under Rule 23(b)(3)).

Plaintiff presents the following questions of law and fact as common to the

class:

1. Whether a DMV-349 in which the Same Address Box is checked “Yes”

is a motor vehicle record;

2. Whether a DMV-349 which openly displays a driver’s license number

is a motor vehicle record;

3. Whether Defendant, by providing unredacted accident reports at its

Records Division, knowingly disclosed protected personal

information from a motor vehicle record;

4. Whether Defendant, by disclosing an unredacted version of each

Class member’s DMV-349, knowingly disclosed information from a

motor vehicle record for a purpose not permitted under the DPPA;

5. Whether Defendant, because of its failure to comply with 18 U.S.C.

§ 2721(c) is estopped to deny, or is otherwise precluded from

contesting, Plaintiff’s contention that each Class member’s

information was obtained without a permissible purpose; and

6. Whether Defendant is estopped to deny, or is otherwise precluded

from contesting, an individual Class member’s claim that at least one

item of his personal information on his DMV-349 came from his

motor vehicle record.

(Doc. No. 37 at 20). Here, there are common issues among the class members that are

subject to the same proof. Members of the class claim the same disclosure of DPPA-

protected information from the CMPD records division for marketing purposes. The

resolution of the questions above will permit resolutions of the class members claims.

Further, the class members ask only for liquidated damages, thus there is not a need

for individualized damage calculations.

Four factors are considered when analyzing superiority: (1) the class members’

interests in individually controlling the prosecution or defense of separate actions; (2)

the extent and nature of any litigation concerning the controversy already begun by

or against class members; (3) the desirability or undesirability of concentrating the

litigation of the claims in the particular forum; and (4) the likely difficulties in

managing a class action. Fed. R. Civ. P. 23(b)(3).

Here, Plaintiff is unaware of any pending litigation raising similar issues

against Defendant and the cost of litigating this case on an individual basis is

impractical. Further, this Court is the appropriate forum for litigating this matter,

and no potential management issues are foreseen.

3. Ascertainability

A class must also be ascertainable to be certified. Under the ascertainability

principle, “a class cannot be certified unless a court can readily identify the class

members in reference to objective criteria.” Krakauer, 925 F.3d at 655 (quoting EQT

Prod. Co. v. Adair, 764 F.3d 347, 358 (4th Cir. 2014)).

The class members can be clearly identified from Farrin spreadsheets and the

CMPD accident reports. In addition, the subclass can be identified by methods

identified by Plaintiff’s expert to determine which DMV-349s were filled out using

auto-populate.

In response to Plaintiff’s motion in regard to ascertainability of the subclass,

Defendant argues that Plaintiff failed to serve an expert designation and violated the

protective order in Hensley by utilizing confidential proprietary discovery obtained in

the course of litigating that case. (Doc. No. 45 at 1, 22–24). There is no indication in

the record that Plaintiff failed to serve an expert designation. Further, the protective

order in this case specifically refers to “documents, testimony, and information” that

has and may be sought, produced, or exhibited in both “this case” and Hensley. (Doc.

No. 29 at 1–2). It appears to the Court that the parties expressly contemplated use of

materials procured in litigating Hensley in the case at bar. Thus, use of those

materials cannot be said to violate the protective order in Hensley, and at this point,

the Court finds no reason to exclude that evidence.

In sum, Plaintiff seeks certification of the following class:

Those (1) who were listed as North Carolina-licensed drivers on DMV-

349s completed by CMPD officers within the Class Period [November

30, 2017–June 30, 2018]; (2) whose name appears on a Farrin

Spreadsheet; and (3) whose North Carolina driver’s license number is

shown on the DMV-349 or the Same Address Box for the person is

checked “Yes” on the DMV-349.

(Doc. No. 37 at 11). Plaintiff also seeks certification of a subclass consisting of all

members of the Class whose personal information was auto-populated onto a DMV-

349. (Id. at 11–12).

The Court finds, as detailed in the next section below, that all of the DMV-349

Crash Reports in which the box ‘Same address as driver’s license’ is checked are

“motor vehicle records” as defined by the statute. The Court does not consider

whether other characteristics of the DMV-349 accident reports would result in a

classification as a “motor vehicle record.” The Court also does not address whether a

driver’s license is a “motor vehicle record” under the statute. Accordingly, the Court

limits the class definition such that only those with a “motor vehicle record” disclosed

are part of the class. The class is defined as follows:

Those (1) who were listed as North Carolina-licensed drivers on DMV-

349s completed by CMPD officers within the Class Period [November

30, 2017–June 30, 2018]; (2) whose name appears on a Farrin

Spreadsheet; and (3) the Same Address Box for the person is checked

“Yes” on the DMV-349.

Plaintiff has established the requirements for class certification under Rule 23

for the class, as defined by the Court, and subclass which consists of all members of

the class whose personal information was auto-populated onto a DMV-349. Therefore,

Plaintiff’s Motion to Certify Class is granted, and the class is certified.

C. Plaintiff’s Motion for Summary Judgment

Plaintiff asks this Court to grant summary judgment for herself, and the

members of the class and subclass, on claims for statutory damages under the DPPA

because the uncontradicted evidence shows that Defendant systematically violated

the DPPA by providing copies of police traffic accident reports, containing protected

information, to a marketing support company. (Doc. No. 34 at 2). Defendant responds

by reiterating its arguments that Plaintiff lacks standing and that Defendant is a

state agency that cannot be subject to a private cause of action. Further, Defendant

argues that Plaintiff cannot show the elements of a DPPA violation through

admissible evidence. (Doc. No. 52 at 8).3

As noted above, the Drivers Privacy Protection Act provides that “[a] person

who knowingly obtains, discloses or uses personal information, from a motor vehicle

record, for a purpose not permitted under this chapter shall be liable to the individual

to whom the information pertains, who may bring a civil action in a United States

district court.” 18 U.S.C. § 2724(a).

To establish a claim under the DPPA, Plaintiff must show that Defendant (1)

knowingly obtained, disclosed, or used “personal information,” (2) from a “motor

vehicle record,” (3) for a purpose not permitted under the statute. 18 U.S.C. § 2724(a);

Thomas v. George, Hartz, Lundeen, Fulmer, Johnstone, King, & Stevens, P.A., 525

F.3d 1107, 1111 (11th Cir. 2008); see Hatch v. LexisNexis Risk Sols., Inc., No.

319CV00449KDBDCK, 2020 WL 1042256, at *3 (W.D.N.C. Mar. 3, 2020); Wilcox v.

Swapp, 330 F.R.D. 584, 594 (E.D. Wash. 2019).

1. Knowingly obtained, disclosed, or used ‘personal information’

The requirement that the defendant act “knowingly” only applies to the

obtaining, disclosing, or using of the DPPA-protected information, and does not

3 In addition to the arguments addressed in more depth in the class certification

section regarding confidential information from Hensley, Defendant asserts that

Plaintiff’s “post-deposition Declaration statements that are inconsistent with her

deposition testimony are incapable of creating a genuine issue of material fact.” (Doc.

No. 52 at 2–3). Having reviewed both Plaintiff’s deposition and declaration, the Court

fails to see the inconsistencies that Defendant asserts.

require that the defendant knowingly violated the statute. Wilcox, 330 F.R.D. at 594–

95; Wiles v. Worldwide Info., Inc., 809 F. Supp. 2d 1059, 1080 (W.D. Mo. 2011).

“Personal information” is “information that identifies an individual, including

an individual’s photograph, social security number, driver identification number,

name, address (but not the 5-digit zip code), telephone number, and medical or

disability information, but does not include information on vehicular accidents,

driving violations, and driver’s status.” 18 U.S.C. § 2725.

Here, the evidence shows that Defendant knowingly disclosed Plaintiff’s

personal information. Plaintiff was involved in an accident on December 4, 2017. The

CMPD officer who investigated Plaintiff’s wreck completed a DMV-349 containing

Plaintiff’s full name, address, date of birth, driver’s license number, and telephone

number. (Doc. No. 1, at ¶ 67; Doc. No. 19, at ¶ 67; Doc. No. 1-2; Doc. No. 32-8 at ¶ 5).

At CMPD, the police officer who investigates a crash submits the DMV-349 Report to

a supervisor for review which is then submitted to the NCDMV. (Doc. No. 39-2, N.

Crum Declaration, at ¶ 15–17).

CMPD, from 2007 or earlier until late 2020, placed one or more copies of each

recent DMV-349 accident report on the front desk of its records division so that

anyone who came into the division could personally view the DMV-349. (Doc. No. 19

at ¶ 49; Doc. No. 32-6, CMPD Dep. II, at 11:7–12:25). Defendant has never redacted

personal information as defined by the DPPA from any DMV-349 made publicly

available at the CMPD records division. (Doc. No. 1, at ¶ 53; Doc. No. 19, at ¶ 53).

As noted in the standing analysis above, a declaration of Plaintiff’s attorney

states that Plaintiff’s name and address appear in the Farrin firm’s spreadsheets.

(Doc. No. 32-13, Stradley Decl., at ¶ 4). A declaration from Eric Sanchez at the Farrin

Firm details that it only obtained accident reports that were released to the public by

CMPD through its agreement with Digital Solutions. (Doc. No. 32-10, Sanchez Decl.,

at ¶ 5).

The Farrin Firm reviewed the accident reports it received and created its own

spreadsheets. (Id. at ¶ 7). Based on a declaration from Kevin Creech, at Digital

Solutions, Digital Solutions received accident reports, beginning in September 2017,

from sending runners to retrieve the reports from the CMPD records division. (Doc.

No. 32-9, Creech Decl., at ¶ 5). Digital Solutions then provided the accident reports

to the Farrin law firm. (Id. at ¶ 7). This establishes a knowing disclosure of Plaintiff’s

personal information that is protected under the DPPA.

Further, CMPD not only knew of the disclosure but since at least 2011, CMPD

knew that marketers, including law firms that CMPD employees referred to as

“ambulance chasers,” acquired reports in bulk directly from its records division. (Doc.

No. 32-6, CMPD Dep. II, at 13:22–14:14, 15:2–17:12, 18:16–20:5).

Here, there is no genuine dispute as to any material fact from which a

reasonable jury could conclude that the accident reports of Plaintiff and those

similarly situated were not knowingly disclosed. The only evidence presented shows

that the accident reports were disclosed from the CMPD records division and made

their way to Digital Solutions and then to the Farrin firm. Thus, Plaintiff has

established that CMPD knowingly disclosed her “personal information.”

2. From a ‘motor vehicle record’

To succeed in establishing her claim under DPPA, Plaintiff must show that

Defendant disclosed “personal information” from a “motor vehicle record.” Garey v.

James S. Farrin, P.C., 35 F.4th 917, 929 (4th Cir. 2022) (“[A] DPPA plaintiff must

allege and prove that the defendant obtained the plaintiff'’s personal information

‘from a motor vehicle record.’”). A “motor vehicle record” under the DPPA is “any

record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor

vehicle registration, or identification card issued by a department of motor vehicles.”

18 U.S.C. § 2725(1).

In determining what meets the definition of a “motor vehicle record,” this Court

in Gaston found that “all of the DMV Form 349 Crash Reports in which the box ‘Same

address as driver’s license’ is checked are ‘motor vehicle records’ under the statutory

definition.” 483 F. Supp. 3d at 336. The Court concluded that “the accident report is

plainly a record that ‘pertains to’ the driver’s license and thus qualifies as a ‘motor

vehicle record’ under the DPPA,” reasoning that “[r]egardless of whether the initial

source of the address information was the accident participant’s records in the DMV

database (using the F11 function), or a driver’s license, or if the driver’s license was

only used to confirm earlier provided information, everyone who has access to the

Crash Reports knows the address on that individual’s driver’s license just the same

as if they had the person’s driver’s license in their hands.” Id. at 337.

In Garey, the Fourth Circuit did not reach the question of whether an accident

report was a “motor vehicle record,” but noted that the Court in Gaston determined

that it was. Garey, 35 F.4th at 927. As Defendant observes, the Fourth Circuit

expressed doubt regarding whether “motor vehicle records” include accident reports.

The Fourth Circuit explained the following:

On the one hand, there is a non-frivolous textual argument that

an accident report is a “record that pertains to a motor vehicle operator’s

permit,” because the report indicates whether a driver’s address is the

same as that shown on their license. Indeed, a district court in our

circuit recently held that the exact same kind of accident report at issue

here is a “motor vehicle record” within the meaning of the DPPA. On the

other hand, several courts have limited a DPPA “motor vehicle record”

to those documents held by a state DMV, which would exclude the

accident reports in question. We need not and do not reach this question,

because the Plaintiffs have failed to preserve this argument.

Garey v. James S. Farrin, P.C., 35 F.4th 917, 927–28 (4th Cir. 2022) (citations

omitted). Ultimately, the court of appeal did not decide the issue of whether an

accident report is a “motor vehicle record” under the DPPA, so it remains an open

question in the Fourth Circuit.

Since the Fourth Circuit’s ruling in Garey, another district court in the Fourth

Circuit has found that when it is not disputed that the personal information

contained in each accident report came from a NCDMV database, those reports are a

“motor vehicle record.” McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F.

Supp. 3d 769, 777 (M.D.N.C. 2023).

The Court concludes that all of the DMV-349 Crash Reports in which the box

‘Same address as driver’s license’ is checked are motor vehicle records under the

statutory definition. Plaintiff’s accident report and the accident reports of the class

members include that checked box. Thus, the personal information disclosed from the

DMV-349 accident reports with the appropriate box checked are disclosed from a

“motor vehicle record.”

However, even if an accident report standing alone is not considered a “motor

vehicle record,” Plaintiff has also established that the personal information in the

accident reports which contain “dataclips” came from the DMV database. (Doc. No.

34 at 17–19). When using the ReportBeam software, the F11 key causes the officer’s

computer to automatically fill-in the blanks on the DMV-349 form with the driver’s

personal information, including her name and address. (Doc. No. 32-1, CMPD Dep. I

at 25:4–10, 118:20–119:8). Using auto-populate for the DMV-349, means the driver’s

name and address come from the DMV database. (Doc. No. 32-1, CMPD Dep. I at

21:20–22:1, 25:4–10, 119:2–120:8; Doc. No. 32-4, Prince Aff., at ¶¶ 4–7).

The presence of the “dataclip” associated with a particular report shows that

the CMPD officer used the auto-populate feature to insert the driver’s personal

information taken from the DMV database into the accident report. (Doc. No. 33-2,

Selvaraj Decl. at ¶ 3; Doc. No. 33-3, Supp. Selvaraj Decl. ¶¶ 2(d), 3).

In opposition, Defendant contends, as its witness Nathan Crum explained, that

he and other BLET instructors—past and present—always train CMPD police

recruits not to use the auto-populate F-11 function when filling out the demographic

information in a DMV-349, but rather to fill in the individual’s information such as

driver’s license number, name, address, etc. manually on the report. Defendant uses

this information to assert that officer’s do not use the F-11 function.

Viewing the facts in the light most favorable to Defendant, the Court concludes

that a reasonable jury could not find in favor of Defendant. Defendant does not

meaningfully dispute the fact that a “dataclip” shows that the information in an

accident report originated with the DMV database. Instead, Defendant challenges

how the evidence was obtained and contends that officers were trained not to auto-

populate the information into the accident report. This is insufficient to create a

genuine issue of material fact.

In sum, the Court concludes that a DMV-349 accident report where the “Same

address as driver’s license” is checked is a “motor vehicle record” as a matter of law.

Thus, the disclosure of personal information from this report for an impermissible

purpose is a violation of the DPPA. Accident reports belonging to Plaintiff and the

class members have the “Same address as driver’s license” box checked, and are thus,

“motor vehicle records” subject to DPPA protection. Further, even if the DMV-349

accident reports could not be said to be “motor vehicle records,” Plaintiff has

established that the presence of a “dataclip” indicates that the materials were auto-

populated from the DMV database. Thus, even if the definition of a “motor vehicle

record” is limited to documents held by a state DMV, Plaintiff can still prevail by

showing the information came from the DMV database. See Maracich v. Spears, 570

U.S. 48, 52 (2013) (“Respondents are trial lawyers . . . [who] obtained names and

addresses of thousands of individuals from the South Carolina DMV in order to send

[attorney solicitation materials].”); see also Garey, 35 F.4th at 927.

3. For a purpose not permitted under the statute

Marketing is not a permissible purpose for disclosing protected information

from motor vehicle records under the DPPA. Maracich v. Spears, 570 U.S. 48, 66–67

(2013).

Here, Plaintiff’s evidence shows that CMPD knew, since at least 2011, that

marketers, including law firms that CMPD employees referred to as “ambulance

chasers,” acquired reports in bulk directly from its records division. (Doc. No. 32-6,

CMPD Dep. II, at 18:16–20:6). CMPD nevertheless did not redact any of the personal

information on the DMV-349s it made available to the public. (Doc. No. 19 at ¶ 53;

Doc. No. 32-1, CMPD Dep. I, at 147:9–20; Doc. No. 32-6, CMPD Dep. II, at 31:19–24).

Defendant asserts that the purpose of disclosure, to the extent that reports

were disclosed, was not improper because the information was made available

pursuant to North Carolina public records law and an opinion of the North Carolina

attorney general. (Doc. No. 52 at 7). See 2005 N.C. AG Lexis 1. This argument has

failed at least once before, and the Court finds no reason to reach a different result

now. See Gaston, 483 F. Supp. 3d at 346–47 (concluding that “to the extent that

CMPD provides such records to the public without redacting that personal

information or limiting disclosure only for those uses permitted by the DPPA then it

is in violation of the statute” whether or not they are “public records” and reasoning

that “it would completely undermine the purpose of the DPPA if a state could simply

designate a document containing personal information subject to DPPA protection as

a ‘public record’ and thereby avoid complying with its restrictions’); see also

McClatchy Co. v. Town of Chapel Hill, N. Carolina, 657 F. Supp. 3d 769, 777

(M.D.N.C. 2023) (rejecting the argument that a police department’s release of

personal information in response to a public records request falls within the

“sovernment function” exception to the DPPA).

4. Damages

Further, section 2724 provides that a person who violates the statute “shall be

liable to the individual to whom the information pertains” and that “[t]he court may

award... actual damages, but not less than liquidated damages in the amount of

$2,500.” 18 U.S.C. § 2724.

Plaintiff seeks only liquidated statutory damages. Because Plaintiff has shown

a violation of DPPA as a matter of law, she, and those similarly situated, are entitled

to statutory damages. Accordingly, Plaintiffs Motion for Summary Judgment is

granted.

IV. CONCLUSION

IT IS, THEREFORE, ORDERED that:

1. Defendant’s Motion to Dismiss and Motion for Summary Judgment, (Doc.

No. 39), are DENIED;

2. Plaintiff's Motion to Certify Class, (Doc. No. 36), is GRANTED; and

3. Plaintiff's Motion for Summary Judgment, (Doc. No. 32), is GRANTED.

Signed: September 24, 2024

4 Cn Of

43 Robert J. Conrad, Jr. : es

TInited Statec Tyictrict Tnidoe ee a