Gordon v. Softech International, Inc.

DENNIS JACOBS, Chief Judge,

concurring in part and dissenting in part:

Insofar as the majority opinion superimposes a negligence duty of care on the civil damages remedy of the Driver’s Privacy Protection Act (“the Act”), I respectfully dissent.

I

An industry of “resellers” has arisen to facilitate acquisition by legitimate end-users of information collected by state motor vehicle bureaus. The Act is designed to reduce abuses of the information and invasions of privacy. At the same time, Congress was careful to craft remedies for such abuse that would not impair the useful industry. See, e.g., Protecting Driver Privacy: Hearing on H.R. 3365 Before the Subcomm. on Civil and Const. Rights of the H. Comm. On the Judiciary, 103d Cong. 4 (1994) (statement of bill sponsor *59 Rep. James P. Moran) (“Careful consideration was given to the common uses now made of this information and great efforts were made to ensure that those uses were allowed under this bill.”), available at 1994 WL 212698 ; 145 Cong. Rec. H2522 (daily ed. Apr. 20, 1994) (statement of Rep. Moran) (“[The Act] strikes a critical balance between an individual’s fundamental right to privacy and safety and the legitimate governmental and business needs for this information.”). The civil cause of action is worded in a way well-calculated to target abuses without inflicting collateral damage on the industry itself: “[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be hable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” 18 U.S.C. § 2724 (emphasis added).

The majority opinion states that this language imposes a duty upon resellers to “to make some inquiry before concluding that disclosure is permitted.” Maj. Op. at 54 (emphasis removed). I agree to the extent that resellers should require end-users to specify a legitimate use and give them notice that misuse subjects them to liability. But it is undisputed that Arcanum, the reseller here, did make such inquiry and provide such notice: it required the customer to represent which legitimate purpose was being pursued; it referenced the Act; and it elicited an indemnification in the event of a statutory violation — all of which served to warn the customer that violation of the Act would entail consequences.

So the real holding of the majority opinion is that these measures are not enough, and that resellers have a duty of inquiry to verify the identity of the customer, and to perform related investigations, as though selling a firearm or dispensing a narcotic. That is a negligence standard, and it is a judicial invention that alters the nature of the industry’s service and its economics, and thereby upsets the balance of the Act.

II

The facts of this case arrange themselves into a law school exam question. Defendant Aron Leifer had some run-in with the driver of a car owned by plaintiff Erik Gordon. Leifer jotted down the license plate number, used Docusearch.com to get information associated with the license plate number, and then harassed Gordon. Docusearch.com is a website of defendant Arcanum Investigations, which is owned and operated by defendant Dan Cohn.

As the Docusearch.com website required, Leifer certified that he had a permissible purpose for the information under the Act, and warranted that he would indemnify Arcanum against any breach. But he used an alias (Jack Loren) to submit his request, and falsely selected “Insurance Other” as his permissible purpose from a dropdown menu. Arcanum forwarded the request to defendant Softech International, Inc., for processing. The master services agreement between the companies included a certification from Arcanum that it would only request records for certain purposes permissible under the Act, that it would require its end users to certify compliance, and that it would indemnify Softech against any violation.

Gordon brought a damages action against Leifer under the Act. Leifer had no permissible reason for procuring the license information, got it by false statements (using a false name that did not match his credit card, and a false affiliation with Bodyguards.com, a defunct website), and used the information to violate Gordon’s privacy. Leifer settled the claim. *60 That settlement fulfilled the purposes of the Act. The district court dismissed the claims against all the remaining defendants. I would affirm. The majority vacates the dismissal as to Arcanum and Mr. Cohn.

Ill

“[0]ur inquiry begins with the statutory text, and ends there as well if the text is unambiguous.” BedRoc Ltd., LLC v. United States, 541 U.S. 176, 183 , 124 S.Ct. 1587 , 158 L.Ed.2d 338 (2004). The Act as a whole could be clearer than it is, but Congress made the civil remedy clear enough, given the ends in view: imposing damages on those who abuse the information, while preserving the industry that facilitates its use for fair purposes.

The only mental-state requirement in the civil cause of action is the adverb “knowingly,” which modifies the verbs “obtains, discloses or uses,” which are further modified by the adverbial phrase, “for a purpose not permitted under this chapter....” 18 U.S.C. § 2724 . Civil liability is therefore imposed only on a person who obtains, discloses, or uses personal information knowing that it is for a purpose— such as peddling goods or harassment— that is not legitimate. Leifer is such a person. Arcanum and Softech are not, in my view, because they made disclosure only after eliciting an affirmation of proper purpose, advising as to statutory requirements, and exacting a warranty of indemnification, which made the warning ominous.

The majority opinion superimposes on the statutory wording a duty of (variously) “reasonable inquiry” (Maj. Op. at 50, 56, 56-57), “due care” (54), “reasonable care” (53, 54-55, 56-57), “some inquiry” (53-54), “reasonableness” (55), and “reasonable diligence” (40). These amount to “negligence” (54), and, as applied to this case, they mean that there is a duty of a reseller to make inquiries of the end-user, at least when there are “red flags” (54, 57-58). The flags here are said to be: use of an alias; use of a credit card in a different name (Leifer’s own); use of an entity (Bodyguards.com) that was defunct; and selection of “Insurance Other” from the drop-down menu, which is not a term expressly listed in the statute as a permitted use (though insurance is, see 18 U.S.C. § 2721 (b)(6) and (9)).

The standard adopted by the majority opinion therefore requires at least that a reseller make inquiry and investigation into: the user’s identity, the match between the user’s name and the credit card used, and the current status and activity of the employing entity. Without those inquiries, there would be no red flags; they wave here only by reason of the inquiries made via discovery in litigation. Yet the majority subjects Arcanum and Mr. Cohn to a jury trial because they failed to look for these red flags before releasing Gordon’s driver information. Implicit in that ruling is a requirement that resellers conduct inquiries looking for red flags in every application. And that presupposes personnel who can identify anomalies, and evaluate responses to inquiries (e.g., “I’m using my employer’s credit card”; “Oh, Bodyguards.com is doing business under another name”; etc.). Although the majority opinion persuasively demonstrates that Congress did not intend to impose strict liability, see Maj. Op. at 49-51, the burden imposed by the majority opinion is, in effect, not all that much less.

The standard expressed in the statutory wording, a “knowing” misuse, is straightforward and easy to apply to transactions that are (like these) numerous and fleeting. By contrast, the duty of reasonable inquiry imposed by the majority opinion has no clear boundaries. See, e.g., Cath *61 arine Pierce Wells, A Pragmatic Approach to Improving Tort Law, 54 Vand. L.Rev. 1447, 1452 (2001) (“[N]egligence doctrine has never consisted of the kind of rules that can make outcomes seem predictable and certain.”). It was reasonable for Congress to draw the line at a knowing violation, especially in view of its intent to preserve the industry of resellers (a goal acknowledged in the majority’s rejection of strict liability, see Maj. Op. at 50 — 51). With a clear, logical interpretation of the text available, there is no need to look any further. BedRoc, 541 U.S. at 183 , 124 S.Ct. 1587 .

IV

The majority adduces three arguments in support of imposing a “duty of reasonable care” that would require measures beyond those that Arcanum employed. None of these reasons is convincing.

First, the majority opinion cites legislative history, suggesting that it “supports the conclusion that resellers must exercise some degree of care.” Maj. Op. at 55-56. But the citations reflect only an intent to protect the privacy of drivers’ personal information — a broad objective that does not impose a duty of inquiry and that is compatible with a standard that protects resellers that commit no knowing wrong. The majority opinion thus succumbs to the fallacy that all remedial legislation reflects an intent to advance the remedial purpose by flattening every competing consideration. The majority writes: “Leifer’s threats to Gordon’s family and friends were precisely the sort of acts that Congress sought to curtail.” Maj. Op. at 56. All this statement tells us about the duty of care is that a culpable end-user such as Leifer should be liable, as he would be under my reading as well.

Second, the majority opinion reasons that since the Act allows punitive damages in cases of “willful or reckless disregard of the law,” 18 U.S.C. § 2724 (b)(2), the threshold for generic civil liability must be lower. Maj. Op. at 54-55. But surely the distinction between the actual and punitive damages is “disregard of the law” — and a law can be disregarded only by persons who are aware of it. People in relevant industries will know it, but few others will have sufficient awareness to disregard it when they handle driver records. This Act is not the kind of law imbibed with mother’s milk.

Under a plain text reading, liability for actual or liquidated damages arises for a knowing disclosure made for an impermissible purpose, while punitive damages are available only when that disclosure is made in disregard of restrictions that the actor knows have been implemented by the Act. The punitive damages clause does not refute the requirement of a “knowing” mental state.

Third, the majority writes that the statute only makes sense “logically” if it is associated with a duty of care. 1 Maj. Op. at 53-54 (“Logically, the language makes clear, albeit implicitly, that resellers are obliged to use some care in dis *62 closing personal information obtained from motor vehicle records.”). The thrust of the argument is that, without a duty of care requirement, “an upstream source could always avoid liability by securing a representation that the recipient of personal information had a permissible use,” ie., a certification or an indemnification agreement, both of which were used by Arcanum here. Maj. Op. at 54. The majority fears that this possibility would render the civil remedy “toothless.” Id. I disagree. The civil remedy works admirably in the overall scheme.

The Act, which regulates an activity that uses middlemen, sensibly places civil damages liability on the person who knowingly handles the information for an improper purpose. The Act operates in a way that is reasonable and effective (and thus “logical”). Liability for damages is imposed at the point in the sequence of transactions where there is knowing misconduct. Punitive damages are imposed for wilful or reckless “disregard of the law,” that is, on persons who know about this fairly obscure enactment (usually by virtue of being in the business of violating it). See 18 U.S.C. § 2724 (b)(2). And the act also imposes a criminal fine for knowing violations. See 18 U.S.C. § 2723 . The scheme as a whole induces prudent resellers to warn end-users and to obtain representations of compliance.

In this case, the victim (Gordon) recovered damages from the violator (Leifer). So it cannot be said that the Act was “toothless” in this case. The Act doesn’t have to bite everybody.

The Act treats on an equal footing the end-users, the resellers, and the state motor vehicle bureaus. So one should be able to test the soundness of a ruling on the reseller’s duty by seeing if it can fairly be applied to the motor vehicle bureau as well. It is therefore telling that the majority opinion expressly concedes that its ruling does not apply to the state motor vehicle bureaus. See Maj. Op. at 57 n. 14. Not that I disagree on that score: for my part, I am not sure that every employee of a motor vehicle bureau can be counted on to mobilize as an eager detective.

The measures taken by Arcanum and Softech adequately assured that they would not knowingly make a disclosure for an unpermitted purpose. But the majority opinion remands for a negligence finding as to the website’s instruction that the customer “Must Select One” of the permissible uses from the drop-down menu, and does so on the theory that such an instruction affords no opportunity to state the true reason. In my view, there is no basis for thinking that Leifer would otherwise have revealed his true need for the information (that would be: “I need to harass the registration holder with salacious phone calls”), or that the instruction (“Must Select One”) is an order to pick one even if it is false. A lot of website owners should worry about the implications of the majority opinion.

. The Sixth Circuit managed to "logically" interpret the statute without recognizing a duty of care. See Roth v. Guzman, 650 F.3d 603, 611 (6th Cir.2011) (disclosure is permitted so long as the reseller has a permissible reason to provide the records to the request- or). In fact, the majority opinion in that case ignored express calls from the dissenting opinion to identify such a duty. See id. at 618 (Clay, dissenting) ("The majority opinion circumvents the legal question of what duty the DPPA imposes on Defendants____In doing so, the majority reasons that as long as a requestor represents ... that it will use drivers' personal information in accordance with a DPPA exception, [motor bureau employees] do not violate the Act if they then knowingly disclose that information.”).