Norma Wiles v. Ascom Transport System, Inc.

NOT RECOMMENDED FOR FULL-TEXT PUBLICATION

File Name: 12a0448n.06

FILED

No. 11-5342

Apr 30, 2012

UNITED STATES COURT OF APPEALS LEONARD GREEN, Clerk

FOR THE SIXTH CIRCUIT

NORMA WILES, THOMAS WILES, )

THERESA GIBSON and WANTA EVITT, ) ON APPEAL FROM THE

) UNITED STATES DISTRICT

Plaintiffs-Appellants, ) COURT FOR THE WESTERN

) DISTRICT OF KENTUCKY

v. )

) OPINION

ASCOM TRANSPORT SYSTEM, INC., dba )

ACS TRANSPORT SOLUTIONS, INC., )

)

Defendant-Appellee. )

BEFORE: COLE and McKEAGUE, Circuit Judges; and ZATKOFF, District Judge.*

Zatkoff, District Judge. Plaintiffs-Appellants, each of whom is a Kentucky resident holding

a driver’s license issued by the Commonwealth of Kentucky, filed this suit on behalf of themselves

and all others similarly situated, claiming that Defendant-Appellee1 violated the Driver’s Privacy

Protection Act, 18 U.S.C. § 2721 et seq. (the “DPPA”), Plaintiffs’ common law right to privacy and

42 U.S.C. § 1983 when Defendant obtained in bulk, used, resold and/or disclosed Plaintiffs’ personal

*

The Honorable Lawrence P. Zatkoff, United States District Judge for the Eastern District

of Michigan, sitting by designation.

1

Defendant-Appellee Ascom Transport System, Inc., dba ACS Transport Solutions, Inc., is

the only defendant named in the appeal, as it was Ascom Transport System, Inc.’s motion to dismiss

the district court decided and, as a result, dismissed the action in its entirety. The other named

defendants to Plaintiffs’ lawsuit at the time of its dismissal were Downtown Owensboro, Inc.; Jones

& Wenner Insurance; Nationwide Debt Recovery Service, Inc.; Tennessee Valley Authority; and

Xerox Corporation.

No. 11-5342

Wiles v. Ascom

information contained in the Commonwealth of Kentucky’s motor vehicle records without a

permissible purpose under the DPPA.2 The district court held that the bulk purchase of motor

vehicle records without a specific need for every record does not violate the DPPA and ultimately

granted Defendant’s motion to dismiss Plaintiffs’ Third Amended Complaint. We affirm.

I. BACKGROUND

On January 10, 2010, Plaintiffs instituted a proposed class action lawsuit against numerous

defendants. Plaintiffs sought protection from, and the recovery of statutory damages for, each

defendant’s allegedly unlawful obtainment, use and/or disclosure of Plaintiffs’ protected personal

information contained in the motor vehicle records of the Commonwealth of Kentucky’s

Transportation Cabinet (hereinafter, the “K.T.C.”). Over the course of the next year, Plaintiffs filed

numerous complaints against an ever-evolving list of defendants, numerous motions to dismiss were

filed and numerous defendants were dismissed for a variety of reasons. Ultimately, the district court

approved Plaintiffs’ motion to file a third amended complaint on December 3, 2010, and Plaintiffs

filed their Third Amended Complaint the same day.

The Third Amended Complaint contained allegations against Defendant and each of the

defendants set forth in footnote 1, supra. Plaintiffs alleged, in relevant part, the following:

17. Defendants’ [sic] obtained the K.T.C. Database, and continued

updates thereto, in violation of relevant state and federal laws[,] including certain

provisions and protections afforded to each and every Kentucky resident by the

2

An amicus brief in support of allowing bulk disclosures under the DPPA was filed by The

Coalition for Sensible Public Records Access, a non-profit organization dedicated to promoting the

principle of open public records access, and The Consumer Data Industry Association, an

international trade association.

-2-

No. 11-5342

Wiles v. Ascom

[DPPA]. More specifically, the Defendants knowingly obtained Plaintiffs’ protected

personal information outside of any of the requisite permissible purposes enumerated

by the DPPA and in violation of Plaintiffs’ privacy rights. Moreover, each Defendant

. . . misrepresented to the K.T.C. that they [sic] had a permissible purpose for each

and every record and as to the personal information of each and every person therein

when they [sic] did not. Defendants knew that they had (and know they have) no

permissible purpose for each and every private personal record but obtained them

regardless.

*****

25. The K.T.C. only sells “personal information” from a motor vehicle

record to “persons” who represent that they have a lawful purpose for the

information.

26. Once a “person” certifies to the K.T.C. that they have [sic] a lawful

purpose for the personal information and/or have obtained requisite consent, the

K.T.C. provides that person with a copy of the ENTIRE DATABASE of names,

addresses and other personal information - millions of persons’ DPPA-protected

personal information. In other words, the K.T.C. simply hands over to a third-party

the DPPA-protected personal information of millions of Kentuckians. Of course

before doing so, the obtaining party must agree to indemnify the K.T.C. for any

damages as a result of obtainment.

*****

29. When each of the Defendants purchased the ENTIRE DATABASE,

those Defendants executed a contract with the K.T.C. whereby they specifically

claimed to possess a proper purpose for obtaining the information. Such was clearly

a misrepresentation because the Defendants had no purpose or intended use for the

private information of each and every personal record included in the database.

*****

31. First, each of the Defendants . . . violated the DPPA by unlawfully

obtaining the “personal information” of the Plaintiff[s] and putative class from the

K.T.C.’s “motor vehicle records” . . . Each of the Defendants also violated the DPPA

by unlawfully using and disclosing the “personal information” of the Plaintiff[s] and

putative class from the K.T.C.’s “motor vehicle records” . . .

-3-

No. 11-5342

Wiles v. Ascom

32. Second, each of the Defendants did not, and still do not, have a

permissible purpose to purchase the K.T.C.’s ENTIRE DATABASE of DPPA

protected personal information. Moreover, none of the Defendants obtained the

information with prior written consent thereto by the Plaintiffs (which, as previously

stated, include members of the Putative Class).

Based on the foregoing allegations, Plaintiffs claimed that Defendant violated: (1) the DPPA by

knowingly obtaining (Count I), disclosing (Count II) and using (Count III) personal information from

K.T.C. motor vehicle records for a purpose not permitted under the DPPA, (2) Plaintiffs’ common

law right to privacy (Count IV), and (3) 42 U.S.C. § 1983 (Count V).

On December 3, 2010, the district court also issued a memorandum opinion and order.

Relying on the reasoning set forth in a recent Fifth Circuit case, the district court held that the bulk

purchase of vehicle records without a specific need for every record does not violate the DPPA. See

Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010), cert. denied, ___ U.S. ___, 131 S.Ct. 908

(2011) (“A person who buys DMV records in bulk does so for the purpose of making permissible

actual use of information therein under [the DPPA], even if that person does not actually use every

single item of information therein”). The district court also instructed the parties that it would

consider dismissal of specific elements of the Third Amended Complaint affected by its ruling.

Shortly thereafter, Defendant filed a motion to dismiss the Third Amended Complaint. On February

17, 2011, the district court granted Defendant’s motion to dismiss and entered judgment in favor of

Defendant and the other named defendants. Plaintiffs timely appealed. This Court has jurisdiction

to review the final judgment of the district court under 28 U.S.C. § 1291.

-4-

No. 11-5342

Wiles v. Ascom

II. ANALYSIS

A. Standard of Review

We review the grant of a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6)

de novo, see Harbin-Bey v. Rutter, 420 F.3d 571, 575 (6th Cir. 2005), and may “affirm the district

court’s dismissal of a plaintiff’s claims on any grounds, including grounds not relied upon by the

district court.” Hensley Mfg. v. ProPride Inc., 579 F.3d 603, 609 (6th Cir. 2009). In determining

whether a party has failed to state a claim, we construe the complaint in the light most favorable to

the non-moving party and accept all factual allegations as true. See Harbin-Bey, 420 F.3d at 575.

To survive a Rule 12(b)(6) motion to dismiss, a complaint “need contain only ‘enough facts to state

a claim to relief that is plausible on its face.’” Paige v. Coyner, 614 F.3d 273, 277 (6th Cir. 2010)

(quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

B. The Driver’s Privacy Protection Act of 1994

As this Court recently stated:

The federal DPPA was enacted in response to growing concerns over the ease

with which stalkers and other criminals could obtain personal information from state

departments of motor vehicles. Reno v. Condon, 528 U.S. 141, 143–44, 120 S.Ct.

666, 145 L.Ed.2d 587 (2000). Congress was also concerned about the practice in

many states of selling personal information from motor vehicle records to businesses,

marketers, and others for, at times, significant revenue. Id. The DPPA, held to be

a proper exercise of the power to regulate interstate commerce, established a

regulatory scheme that both mandates and restricts the disclosure of personal

information from records maintained by state motor vehicle departments. Id. at 148,

120 S.Ct. 666.

At all times relevant to this case, the DPPA, as amended, imposed the

following general prohibitions against the disclosure of personal information

obtained from an individual's motor vehicle record:

-5-

No. 11-5342

Wiles v. Ascom

(a) In general.—A State department of motor vehicles, and any officer,

employee, or contractor thereof, shall not knowingly disclose or otherwise

make available to any person or entity:

(1) personal information, as defined in 18 U.S.C. [§ ] 2725(3), about any

individual obtained by the department in connection with a motor vehicle

record, except as provided in subsection (b) of this section; or

(2) highly restricted personal information, as defined in 18 U.S.C. § 2725(4),

about any individual obtained by the department in connection with a motor

vehicle record, without the express consent of the person to whom such

information applies, except uses permitted in subsections (b)(1), (b)(4),

(b)(6), and (b)(9); Provided, That subsection (a)(2) shall not in any way affect

the use of organ donation information on an individual’s driver’s license or

affect the administration of organ donation initiatives in the States.

18 U.S.C. § 2721(a)(1)–(2) (emphasis added). “Personal information” is defined as

“information that identifies an individual, including an individual’s photograph,

social security number, driver identification number, name, address (but not the

5–digit zip code), telephone number, and medical or disability information.” Id. at

§ 2725(3). “Highly restricted personal information” is defined as “an individual’s

photograph or image, social security number, medical or disability information.” Id.

at § 2725(4).

Section 2721(b) carves out both mandatory and permissive exceptions to the

general prohibitions in subsection (a). Id. at § 2721(b). First, states must disclose

personal information for use in carrying out the purposes of several federal statutes

not relevant here. Second, states may disclose personal information (subject to §

2721(a)(2)), for any of the permissible uses or purposes listed in § 2721(b)(1)–(14).

Eleven of these permissible uses—including for “use in the normal course of

business” under § 2721(b)(3)—authorize nonconsensual disclosure of personal

information. Id. at § 2721(b)(1)–(10) and (14). The other three permissible uses

require the express consent of the persons to whom the information pertains. Id. at

§ 2721(b)(11)–(13).

The DPPA also regulates the “resale or redisclosure” of personal information

in § 2721(c), which provides, in pertinent part, that: “An authorized recipient of

personal information (except a recipient under subsection (b)(11) or (12)) may resell

or redisclose the information only for a use permitted under subsection (b) (but not

for uses under subsection (b)(11) or (b)(12)).” Id. at § 2721(c) (emphasis added).

Subsection (c) also imposes a record-keeping obligation on “[a]ny authorized

-6-

No. 11-5342

Wiles v. Ascom

recipient (except a recipient under subsection (b)(11)) that resells or rediscloses

personal information covered by this chapter” to keep for five years “records

identifying each person or entity that receives information and the permitted purpose

for which the information will be used and must make such records available to the

motor vehicle department upon request.” Id.[*]

The DPPA makes it unlawful for “any person knowingly to obtain or disclose

personal information, from a motor vehicle record, for any use not permitted under

[§ ] 2721(b),” or “to make false representation to obtain any personal information

from an individual’s motor vehicle record.” 18 U.S.C. § 2722(a)–(b). A person who

knowingly violates the DPPA is subject to criminal fine, id. at § 2723(a), and may

be held civilly liable for actual damages (but not less than $2,500 in liquidated

damages), punitive damages, attorney fees, and appropriate equitable relief[.] [I]d.

at § 2724. A “person” is defined as an individual, organization or entity, “but does

not include a State or agency thereof[.]”[I]d. at § 2725(2). Instead, the Attorney

General may impose civil penalties if a state has a policy or practice of “substantial

noncompliance” with the DPPA[.] [I]d. at § 2723(b) (civil penalty of not more than

$5,000 per day).

____________________

[*] Disclosure under subsections (b)(11) (for any use) and (b)(12) (for bulk distributions for surveys,

marketing or solicitation) is permissible “if the State has obtained the express consent of the person

to whom such personal information pertains.” Id. at § 2721(b)(11)–(12) (as amended eff. June 1,

2000).

Roth v. Guzman, 650 F.3d 603, 606-07 (6th Cir. 2011) (footnotes omitted).

1. Bulk Obtainment and Use

The basis for Plaintiffs’ DPPA claims (and their apparent basis for alleging that Defendant

misrepresented that it had a permissible purpose for obtaining the drivers’ personal information) is

that “Defendant[] had no purpose or intended use for the private information of each and every

personal record included in the database.” R. 158, Third Am. Compl., ¶29 (emphasis added). Thus,

the issue before this Court is whether, assuming Defendant asserted a permissible purpose to the

K.T.C. for obtainment of personal information in motor vehicle records, such purpose is rendered

-7-

No. 11-5342

Wiles v. Ascom

void because Defendant obtained the drivers’ records for all Kentucky drivers, without showing “a

permissible purpose for each and every record [in the K.T.C. database] and . . . the personal

information of each and every person therein.” In other words, even if Defendant had asserted a

permissible purpose for obtaining such records under § 2721(b), does the bulk obtainment of such

records for the purpose of “stockpiling” such records violate the DPPA?

Shortly after the parties filed their appellate briefs, this Court issued the Roth opinion.

Therein, in the context of deciding a qualified immunity issue, this Court concluded that it was not

clearly established that “‘stockpiling’ or bulk disclosures of personal information for a permissible

purpose under § 2721(b)(3) would violate the DPPA.” Roth, 650 F.3d at 617. The Roth court

extensively cited and relied upon the Fifth Circuit’s opinion in Taylor, supra. Most notably, this

Court stated:

[T]he starting point is the ordinary meaning of the statute. Mills Music, Inc. v.

Snyder, 469 U.S. 153, 164, 105 S.Ct. 638, 83 L.Ed.2d 556 (1985) (“In construing a

federal statute it is appropriate to assume that the ordinary meaning of the language

that Congress employed ‘accurately expresses the legislative purpose.’”) (citation

omitted). If the language of the statute is clear, the plain meaning of the text must be

enforced. United States v. Ron Pair Enters., Inc., 489 U.S. 235, 241, 109 S.Ct. 1026,

103 L.Ed.2d 290 (1989). “The plainness or ambiguity of statutory language is

determined by reference to the language itself, the specific context in which that

language is used, and the broader context of the statute as a whole.” Robinson v.

Shell Oil Co., 519 U.S. 337, 341, 117 S.Ct. 843, 136 L.Ed.2d 808 (1997). When a

plain reading “leads to ambiguous or unreasonable results, a court may look to

legislative history to interpret a statute.” Limited, Inc. v. Comm’r, 286 F.3d 324, 332

(6th Cir. 2002).

[Section] 2721(b)(3) provides that state officials may disclose personal

information “[f]or use in the normal course of business ... to verify the accuracy of

personal information submitted by the individual to the business,” and to correct

inaccurate personal information for the purposes of “preventing fraud by, pursuing

legal remedies against, or recovering on a debt or security interest against the

-8-

No. 11-5342

Wiles v. Ascom

individual.” Plaintiffs interpret the references to “the individual” in § 2721(b)(3) as

unambiguously limiting disclosure to personal information pertaining to one

individual at a time. Defendants counter that “individual” in this subsection does not

refer to how many requests may be made at one time, but rather to the basis for

disclosures permitted under this subsection. The Fifth Circuit, the only circuit to

decide this issue, rejected the same arguments in Taylor v. Acxiom Corp., 612 F.3d

325, 335 (5th Cir.2010), cert. denied, ___ U.S. ___, 131 S.Ct. 908, 178 L.Ed.2d 804

(2011).

Texas, like at least eleven other states, allows persons or entities to purchase

magnetic tapes of the database of driver’s license records upon certification of a

lawful purpose under the DPPA. Id. at 332. The defendants in Taylor were third

parties who did not use all of the records immediately, but maintained databases to

either use in the future (non-resellers) or to resell to others for lawful purposes

(resellers). The plaintiffs in Taylor argued that maintaining records not actually used

was itself an impermissible purpose; in other words, that “‘buying the records in bulk

with an expectation and purpose of valid potential use is not a permissible use under

the DPPA.’” Id. at 334. Examining § 2721(b)(3) in the context of all fourteen

permissible uses under § 2721(b), the court emphasized that only one subsection

limits permissible uses to individual motor vehicle records, while only one other

subsection limits permissible uses to bulk distributions. Id. at 335; compare §

2721(b)(11) (“[f]or any other use in response to requests for individual motor vehicle

records if the State has obtained the express consent of the person to whom such

personal information pertains”), with § 2721(b)(12) (“[f]or bulk distribution for

surveys, marketing or solicitations if the State has obtained the express consent of the

person to whom such personal information pertains”). For the rest of the permissible

uses, the court found there was more than one reasonable interpretation: “individual

release, bulk release, or both.” Id. at 335. The court explained:

It does not make sense that Congress would expressly limit

states to individual distribution with one permissible use if Congress

intended to limit all of the permissible uses to individual distribution.

If Congress intended only individual distribution, one would expect

either Congress to expressly limit all uses or, at least, to remain silent

on the matter. Likewise, if Congress intended only bulk distribution,

it makes no sense to expressly limit one of the fourteen uses to bulk

distribution and not the others. The text of the statute strongly

indicates that it allows both individual and bulk distribution.

Id. at 336. We agree.

-9-

No. 11-5342

Wiles v. Ascom

*****

To resolve the ambiguity, both parties point to aspects of the legislative

history to support their positions but nothing speaks directly to the issue of “bulk”

disclosures under § 2721(b)(3). More generally, Congress expressed an intention “to

strike ‘a critical balance between legitimate governmental and business needs for this

information, and the fundamental right of our people to privacy and safety.’” Russell

v. ChoicePoint Servs., Inc., 300 F.Supp.2d 450, 456 (E.D.La.2004) (quoting 139

Cong. Rec. S15, 763 (1993)). Although plaintiffs rely on statements from the

legislative history reflecting an intention to give individuals control over the release

of their personal information, those statements are again directed at the bulk sale of

personal information for direct marketing purposes.

A statement by the sponsor of the DPPA in the House expressed concern first

with the need to address the ease with which criminals and strangers could obtain

driver's license information and second with the desire to curb the sale of DMV

databases to direct marketers for commercial purposes by requiring consent. Taylor,

612 F.3d at 336–37 (quoting statement of Rep. Moran Feb. 4, 1994, 1994 WL

212698 (F.D.C.H.)). In that same statement, however, the sponsor also expressed the

intention that common uses being made of the information at the time—including by

businesses verifying personal information—should continue unfettered. Id. at 336.

Notably, the amendments to the DPPA, which restricted further the bulk

distribution provision to require express as opposed to implied consent, did not adopt

a consent requirement for disclosure under § 2721(b)(3), or clarify that requests for

disclosure under § 2721(b)(3) should be for one person's records at a time. The Fifth

Circuit was also persuaded by a Department of Justice (DOJ) advisory opinion issued

in October 1998, concluding that the DPPA allowed the State of Massachusetts to

release personal information to a commercial distributor who would disseminate the

information to any other authorized recipients or entities that use the information

solely for authorized purposes. Taylor, 612 F.3d at 339. We agree that the DOJ's

advisory opinion is inconsistent with the notion that bulk distribution is prohibited

by the DPPA. Id.

Finally, the court in Taylor concluded that the plaintiffs’ reading of §

2721(b)(3) would lead to “essentially absurd results,” explaining:

At a checkout line at a grocery store or similar establishment, when

a customer wishes to pay by (or cash) a check, and presents a driver’s

license as identification, it is obviously wholly impractical to require

the merchant for each such customer to submit a separate individual

- 10 -

No. 11-5342

Wiles v. Ascom

request to the state motor vehicle department to verify the accuracy

of the personal information submitted by the customer, under section

2721(b)(3). Any such process would obviously take way too long to

be of any use to either the customer or the merchant, and would

moreover flood the state department with more requests than it could

possibly handle. So, the merchant buys the state department’s entire

data base and from it extracts on that occasion that particular

customer’s information, and later performs the same task as to the

next such customer in the line. Plaintiffs would have us hold that the

merchant violates the DPPA by acquiring the data base even though

every single actual use made of it is an authorized use under section

2721(b), so long as there is at least one name in the data base as to

which no actual use is made.

Id. at 337. The court then analogized the situation to the purchase of a set of legal

reporters, which a lawyer purchases for the purpose of legal research even though the

attorney would never read every opinion in each volume. Id.

As interpreted by the court in Taylor, plaintiffs could not establish a violation

of the DPPA merely because the defendants sold personal information from motor

vehicle records in bulk where the disclosure was for use, or potential use, in “the

normal course of business” under § 2721(b)(3). The purchase in bulk for use as

needed for a permitted purpose under § 2721(b)(3), described by some courts as

“stockpiling,” has been found not to violate the DPPA by several district courts. See,

e.g., Wiles v. ASCOM Transp. Sys., Inc. (Wiles II), No. 3:10–cv–28–H, 2011 WL

672652 (W.D.Ky. Feb. 17, 2011) (unpublished); Cook v. ACS State and Local

Solutions, Inc., 756 F.Supp.2d 1104 (W.D. Mo.2010).[3]

Roth, 650 F.3d at 614-17.

For the same reasons, several other Circuits have reached the same conclusion as the Taylor

court when considering whether “stockpiling” or bulk obtainment/disclosure of personal information

violates the DPPA. See Cook v. ACS State & Local Solutions, Inc., 663 F. 989, 994, 996 (8th Cir.

3

The Wiles district court case and the Cook district court case referenced by the Roth court

are the underlying cases in the appeal currently before this Court and the Cook decision discussed

herein (beginning at the next paragraph), respectively.

- 11 -

No. 11-5342

Wiles v. Ascom

2011) (“The proper focus for courts is not the manner in which the information was acquired, but

the use to which it is eventually put” and “Plaintiffs cannot establish a violation of the DPPA if all

the defendants have done is obtain driver information in bulk for potential use under a permissible

purpose”); Graczyk v. West Publ’g Co., 660 F.3d 275, 279 (7th Cir. 2011) (The DPPA “is concerned

with the ultimate use or uses to which personal information contained in motor vehicle records is

put”); Howard v. Criminal Info. Servs., Inc., 654 F.3d 887, 891, 892 (9th Cir. 2011) (The DPPA

“was written in a way that logically put the focus on the purpose for which the information would

eventually be used–on the ‘end’ sought by the purchaser–not on the reasons for buying it in bulk”

and “the portion of the statute that expresses the permissible purposes explicitly does so in terms of

the ‘use’ of the information. That is what should be considered in determining whether the

acquisition of the information is permitted under the statute.”).

This Court agrees with the reasoning of Roth and the referenced DPPA cases from other

Circuits. Plaintiffs have not cited any case law, legislative history or other “any authority or

persuasive argument for concluding that [the DPPA] clearly and unambiguously limits disclosure

of personal information to one individual at a time.” Roth, 650 F.3d at 615. In contrast, as noted

in several of the cases discussed above, the legislative history clearly establishes that Congress did

not intend to alter the traditional method of bulk disclosures by states, subject to the express

limitations set forth in the DPPA.4

4

In addition to the statements of Congressman Moran set forth in the Taylor and Roth

decisions, supra, several other congressman made similar proclamations regarding the purpose and

scope of the DPPA. See, e.g., 139 Cong. Rec. 29468 (1993) (statement of Senator Boxer, describing

the bill in the Senate as “strik[ing] a critical balance between the legitimate governmental and

- 12 -

No. 11-5342

Wiles v. Ascom

Plaintiffs also contend that “stockpiling” of the personal information is prohibited because

the personal information must be used immediately after it is obtained. Plaintiffs, however, fail to

identify any language in the statute that requires immediate use. They cannot do so because there

is no such language in the DPPA. See Cook, 663 F.3d at 995 (citing Howard, 654 F.3d at 892

(“There is also no problem with Defendants obtaining the personal information for potential future

use, even if they may never use it. The DPPA does not contain a temporal requirement for when the

information obtained must be used for the permitted purpose.”)). This Court therefore declines to

read such a requirement into the statute.

For the foregoing reasons, we hold that bulk obtainment of personal information for a

permissible purpose does not violate the DPPA. We also conclude that, as Defendant obtained the

personal information from the K.T.C. under one or more of the permissible purposes set forth in the

DPPA, Plaintiffs cannot establish a violation of the DPPA if the only alleged wrongdoing Defendant

has committed was obtaining the personal information in bulk for use or potential use.

2. Disclosure (Resale of Personal Information)

The district court dismissed Plaintiffs’ DPPA disclosure claim, finding that Plaintiffs’

“allegations of unauthorized disclosure are deficient because they do not state either a specific

unlawful third party to whom [Defendant] disclosed the data or a specific unlawful disclosure by a

business needs for this information, and the fundamental right of our people privacy and safety”);

140 Cong. Rec. 7929 (1994) (statement of Representative Goss that “The flow of information would

only be denied to a narrow group of people that lack legitimate business. The Amendment defines

‘legitimate business’ broadly, including all the duties of Federal, State, and local law enforcement

agencies and courts, verification and/or correction of personal information, private investigations,

and anything related to the operation of a motor vehicle.”).

- 13 -

No. 11-5342

Wiles v. Ascom

third party.” Again, this is an issue other Circuits have addressed. For example, the Eighth Circuit

recently stated:

Some of the Defendants in this case obtained personal information in bulk from the

Missouri DOR not for their own permissible use, but to sell to third parties who have

permissible uses of their own. There is no dispute that 18 U.S.C. § 2721(c) explicitly

authorizes the resale and redistribution of personal information, however Plaintiffs

contend that this section does not provide a stand-alone justification for businesses

to obtain records from the state. Plaintiffs argue that the DPPA requires resellers to

have their own permissible use for personal information before selling it to third

parties. Plaintiffs interpret the phrase “authorized recipient” under section 2721(c)

as an individual or entity who has an immediate permissible use for the information

under section 2721(b).

The statute does not define “authorized recipient,” and therefore does not provide

direct guidance on this issue. However, Plaintiffs identify no support in either the

language of the statute or the legislative history that suggests an authorized recipient

must have an authorized use. As other courts have pointed out, section 2721(c)

restricts only “authorized recipients,” not “authorized users” or “permissible users”

(which would more closely mirror section 2721(b)). Taylor, 612 F.3d at 338; Russell

v. ChoicePoint Servs. Inc., 300 F.Supp.2d 450, 455–61 (E.D. La. 2004). So long as

personal information is ultimately used only for permitted purposes, it is not clear

why Congress would have intended to regulate who could obtain it. The statute as

a whole is concerned only with the use of the information, not the entity requesting

it. See Russell, 300 F.Supp.2d at 457 (“The plain language of the DPPA is written

in terms of permissible ‘uses' rather than permissible ‘users.’”); Graczyk, 660 F.3d

at 279 (pointing out that the statute permits an agent to obtain information for use by

a business without requiring the agent to have a separate use).

The documentation requirements in section 2721(c) seem to further indicate that

Congress was primarily concerned with the end use of personal information.

Congress provided additional safeguards in section 2721(c) that require resellers to

document each sale to a third party. Section 2721(c) requires that “[a]ny authorized

recipient ... that resells or rediscloses personal information covered by this chapter

must keep for a period of 5 years records identifying each person or entity that

receives information and the permitted purpose for which the information will be

used and must make such records available to the motor vehicle department upon

request.” 18 U.S.C. § 2721(c). These safeguards support our view that Congress was

focused more on the end use of the information than the manner in which it was

obtained.

- 14 -

No. 11-5342

Wiles v. Ascom

The Fifth and the Seventh Circuits have found persuasive support for this view in an

unpublished Department of Justice opinion letter. The letter responded to an inquiry

from the Commonwealth of Massachusetts about whether it was permitted under the

DPPA to provide driver information to a commercial distributor who would resell the

information only to third parties that themselves had permissible uses. See Letter

from Robert C. McFetridge, Special Counsel to the Assistant Attorney Gen., to Peter

Sacks, Office of the Attorney Gen. For the Commonwealth of Mass. (Oct. 9, 1998)

(on file with the Fifth and Seventh Circuits). In response, the DOJ reasoned that the

DPPA “regulated only the ultimate use of personal information without specifying

or restricting who may obtain the information in order to accomplish that authorized

purpose.” Id. The DOJ posited that Massachusetts could provide information to

resellers so long as it could reasonably conclude that the information would be used

only for authorized purposes. Id. We agree with our sister circuits that this is the

most reasonable reading of the statute. See Graczyk, 660 F.3d at 280–81; Taylor, 612

F.3d at 339.

Section 2721(c) explicitly permits the resale of drivers’ information, and it does not

require that resellers must first use the information themselves. We hold that

Plaintiffs cannot establish a DPPA violation by alleging that Defendants obtained

personal information with the sole purpose of selling it to third parties who have

permissible section 2721(b) uses for the information.

Cook, 663 F.3d at 996-97.

We find persuasive the analysis and conclusions of the Eighth Circuit, as well as those of the

Fifth and Seventh and the DOJ, and we hold that obtaining personal information solely for the

purpose of reselling such information is permitted under the DPPA, so long as the personal

information will ultimately be used only for purposes permitted under Section 2721(b).

In this case, Plaintiffs have not alleged that the ultimate “use” of the information is for an

impermissible purpose. Rather, Plaintiffs’ allegations pertaining to the resale/disclosure of the

personal information are based on Defendant allegedly obtaining the personal information for the

sole purpose of reselling it to third parties, without use of such information by Defendant. As stated

by the Eighth Circuit, however, “Section 2721(c) explicitly permits the resale of drivers’

- 15 -

No. 11-5342

Wiles v. Ascom

information, and it does not require that resellers must first use the information themselves.” Id. at

997. Therefore, we find that Plaintiffs have failed to state a claim upon which relief can be granted

because Plaintiffs cannot establish a violation of the DPPA even if Defendant obtained Plaintiffs’

personal information with the sole purpose of selling it to third parties who have a permissible

Section 2721(b) use for such information.

C. Common Law Right to Privacy

Plaintiffs’ common law invasion of privacy claim is based on two theories: (a) unreasonable

intrusion upon the seclusion of another, and (b) unreasonable publicity to another’s private life.

An intrusion upon seclusion claim requires a plaintiff to show: (1) an intentional intrusion

by the defendant, (2) into a matter that the plaintiff has a right to keep private, and (3) that the

intrusion would be highly offensive to a reasonable person. See Restatement (Second) of Torts §

652B; Johns v. Firstar Bank, N.A., No. 2004-CA-001558-MR, 2006 Ky. App. LEXIS 85, at *7 (Ky.

Ct. App. Mar. 24, 2006); Smith v. Bob Smith Chevrolet, Inc., 275 F.Supp.2d 808, 822 (W.D. Ky.

2003). “What constitutes a private matter is dependent upon whether the plaintiff has a reasonable

expectation of privacy in the subject information.” Webb v. Bob Smith Chevrolet, Inc., 2005 WL

2065237, at *6 (W.D. Ky. Aug. 24, 2005) (citing McCall v. Courier-Journal & Louisville Times Co.,

623 S.W.2d 882, 887 (Ky. 1981), cert. denied, 456 U.S. 975 (1982)).

Plaintiffs contend that the district court erred in concluding as a matter of law that

Defendant’s alleged intrusion into Plaintiffs’ privacy was not “highly offensive”– a determination

that is to be made by the trier of fact. This Court need not consider that argument as it finds that

Plaintiffs cannot establish a prima facie intrusion upon seclusion claim, specifically, the second

- 16 -

No. 11-5342

Wiles v. Ascom

element. The DPPA expressly allows the publication of Plaintiffs’ personal information to third

parties under the parameters set forth in Section 2721. As this federal statute authorizes the

disclosure of the personal information, a person whose information is disclosed pursuant to that

statute cannot have a reasonable expectation that such personal information would be kept private.

Accordingly, this Court concludes that Plaintiffs had no reasonable expectation of privacy in the

personal information and, as such, that Plaintiffs’ intrusion upon seclusion claim fails as a matter of

law.

Plaintiffs also challenge the district court’s dismissal of their “publicity given to a private

life” claim, referenced in Restatement (Second) of Torts § 652D as “unreasonable publication.” A

cause of action for unreasonable publication requires that a plaintiff prove that a defendant

publicized material that: (a) would be highly offensive to a reasonable person, and (b) is not of

legitimate concern to the public. Id. Publicizing material “means that the matter is made public, by

communicating to the public at large, or to so many persons that the matter must be regarded as

substantially certain to become one of public knowledge.” Id. cmt. (a). See also Ghassomians v.

Ashland Indep. Sch. Distr., 55 F. Supp. 2d 675, 693 (E.D. Ky. 1998) (citation omitted) (a claim for

unreasonable publicity requires disclosure of private information “in a way substantially certain to

become general knowledge either through dissemination to the public at large or a multitude of

persons.”). In the instant case, Plaintiffs have not alleged that Defendant disclosed, or caused to be

disclosed, Plaintiffs’ personal information to the public at large or a multitude of persons such that

the information could be regarded as substantially certain to become a matter of public knowledge.

- 17 -

No. 11-5342

Wiles v. Ascom

Accordingly, this Court finds that Plaintiffs have failed to state an actionable claim for unreasonable

publication.

Therefore, we conclude that Plaintiffs failed to state a claim for common law invasion of

privacy claim upon which relief can be granted.

D. 42 U.S.C. § 1983 Claim

The district court found that Plaintiffs failed to state a cognizable § 1983 claim because

Defendants are not state actors, as required to impose § 1983 liability, and did not meet the

nexus/symbiotic-relationship test by which private action may be attributed to the state. See Wiles

v. ASCOM Transp. Sys., Inc., No. 3:10-CV-28-H, 2011 WL 672652, at *3 (W.D. Ky. Feb. 17, 2011).

We think the better grounds on which to dismiss Plaintiffs’ § 1983 claims is their failure to

establish any violation of a federal right. Section 1983 “is not itself a source of substantive rights,

but a method for vindicating federal rights elsewhere conferred . . . .” Baker v. McCollan, 443 U.S.

137, 144 n.3 (1979); see also Moldowan v. City of Warren, 578 F.3d 351, 399 (6th Cir. 2009), cert.

denied. Plaintiffs allege they have been deprived of their privacy rights as secured by the DPPA, the

Privacy Act (codified at 5 U.S.C. § 552a),5 and the federal constitution. We have already considered

Plaintiffs’ DPPA claims and found no DPPA violation. Plaintiffs fail to state a Privacy Act claim

because we have previously held that the Privacy Act applies only to federal agencies. Schmitt v.

City of Detroit, 395 F.3d 327, 331 (6th Cir. 2005). And Plaintiffs’ constitutional privacy claims are

5

Plaintiffs’ complaint cites to 5 U.S.C. § 552, the Freedom of Information Act, which

requires federal agencies to make certain information available to the public. We assume Plaintiffs

meant 5 U.S.C. § 552a, the Privacy Act, and construe their complaint accordingly.

- 18 -

No. 11-5342

Wiles v. Ascom

also foreclosed by this Court’s prior case law. As we observed in Lambert v. Hartman, 517 F.3d

433, 440 (6th Cir. 2008), “this court has recognized an informational-privacy interest of

constitutional dimension in only two instances: (1) where the release of personal information could

lead to bodily harm (Kallstrom [v. City of Columbus, 136 F.3d 1055, 1061 (6th Cir. 1998)]), and (2)

where the information released was of a sexual, personal, and humiliating nature (Bloch [v. Ribar,

156 F.3d 673, 683 (6th Cir. 1998)]).” Plaintiffs have not alleged any facts that would support an

inference that the information disclosures here fall into either category. As Plaintiffs have not

established the deprivation of any federal constitutional or statutory right, their § 1983 claims must

fail.

III. CONCLUSION

For the reasons above, we conclude that the district court properly dismissed Plaintiffs’ Third

Amended Complaint for failure to state a claim, and we affirm the order of the district court.

- 19 -