Petition for Writ of Certiorari — Derek Allen, et al., Petitioners v. Vertafore, Incorporated

APPENDIX TABLE OF CONTENTS

OPINIONS AND ORDERS

Opinion of the United States Court of Appeals

for the Fifth Circuit (March 11, 2022) ..................... 1a

Judgment of the United States Court of Appeals

for the Fifth Circuit (March 11, 2022) ..................... 8a

Order of the United States District Court for the

Southern District of Texas Houston Division

Adopting Magistrate Judge’s Memorandum and

Recommendation (July 23, 2021) ........................... 10a

Memorandum and Recommendation of the United

States District Court for the Southern District of

Texas Houston Division (June 14, 2021) ............... 12a

STATUTORY PROVISIONS

Driver’s Privacy Protection Act of 1994 .................... 22a

18 U.S.C. § 2721 ................................................. 22a

18 U.S.C. § 2722 ................................................. 27a

18 U.S.C. § 2723 ................................................. 27a

18 U.S.C. § 2724 ................................................. 28a

18 U.S.C. § 2725 ................................................. 28a

OTHER DOCUMENTS

Class Action Complaint

(December 4, 2020) ................................................. 30a

App.1a

OPINION OF THE UNITED STATES COURT

OF APPEALS FOR THE FIFTH CIRCUIT

(MARCH 11, 2022)

UNITED STATES COURT OF APPEALS FOR

THE FIFTH CIRCUIT

________________________

DEREK ALLEN; LEANDRE BISHOP;

JOHN BURNS,

Plaintiffs-Appellants,

v.

VERTAFORE, INCORPORATED,

Defendant-Appellee.

________________________

No. 21-20404

Appeal from the United States District Court

for the Southern District of Texas

USDC No. 4:20-CV-4139

Before: SOUTHWICK, HAYNES,

and HIGGINSON, Circuit Judges.

Stephen A. Higginson, Circuit Judge:

Plaintiffs, Texas driver’s license holders, brought

this action against Vertafore, Inc., for a violation of

the Driver’s Privacy Protection Act, 18 U.S.C. § 2721,

et seq., after Vertafore announced that unauthorized

users had gained access to personal information protected by the statute that Vertafore had stored on

App.2a

unsecured external servers. The district court granted

Vertafore’s motion to dismiss. We AFFIRM.

I.

On November 10, 2020, Vertafore, an insurance

software company, announced that three data files

that it had “stored in an unsecured external storage

service” had been accessed without authorization

sometime between March and August 2020. Those

files contained the driver information of approximately

27.7 million people holding Texas driver’s licenses

issued before February 2019. As of November 2020,

Vertafore’s investigation had not turned up any

evidence that the information accessed without

authorization had been misused.

On December 4, 2020, Plaintiffs filed a putative

class action complaint against Vertafore for a violation

of the Driver’s Privacy Protection Act. Plaintiffs

alleged that “Vertafore knowingly disclosed the Driver’s

License Information of Plaintiffs and approximately

27.7 million other Class members by storing that

information on unsecured external servers.” On January 29, 2021, Vertafore filed a motion to dismiss under

Federal Rule of Civil Procedure 12(b)(1), arguing that

Plaintiffs lacked standing, and under Federal Rule of

Civil Procedure 12(b)(6) for failure to state a claim

upon which relief can be granted.

The magistrate judge held a hearing on the

motion on April 27, 2021 and subsequently recommended that the district court find that Plaintiffs had

standing but that they failed to state a claim. The

magistrate judge noted that “absent from [Plaintiffs’

complaint] is any factual allegation describing how

[Vertafore’s] purported mismanagement of information

App.3a

amounts to a knowing disclosure of personal information for an improper purpose.” Therefore, he concluded

that “Plaintiffs’ allegation that Vertafore knowingly

disclosed their personal information for an improper

purpose is nothing more than a conclusory allegation

or legal conclusion masquerading as a factual conclusion.”

Plaintiffs objected to the magistrate judge’s

Memorandum and Recommendation and asked for an

opportunity to amend their complaint if the district

judge was not inclined to deny Vertafore’s motion.1 On

July 23, 2021, the district court adopted the magistrate judge’s Memorandum and Recommendation in its

entirety and granted Vertafore’s motion to dismiss.

Plaintiffs timely filed this appeal.

II.

We review de novo the district court’s grant of a

motion to dismiss for failure to state a claim. Kennedy

v. Chase Manhattan Bank USA, NA, 369 F.3d 833,

839 (5th Cir. 2004). “To survive a motion to dismiss, a

complaint must contain sufficient factual matter,

accepted as true, to ‘state a claim to relief that is

plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662,

678 (2009) (quoting Bell Atlantic Corp. v. Twombly,

550 U.S. 544, 570 (2007)). In reviewing a motion to

dismiss, we “accept[] all well-pleaded facts as true and

view[] those facts in the light most favorable to the

plaintiff.” Cummings v. Premier Rehab Keller, P.L.L.C.,

948 F.3d 673, 675 (5th Cir. 2020) (internal citation

omitted). But “a complaint’s allegations must make

relief plausible, not merely conceivable, when taken

1 Plaintiffs have not renewed this request in their briefs on appeal.

App.4a

as true.” Inclusive Communities Project, Inc. v. Lincoln

Prop. Co., 920 F.3d 890, 899 (5th Cir. 2019) (internal

citation omitted). “The court’s review is limited to the

complaint, any documents attached to the complaint,

and any documents attached to the motion to dismiss

that are central to the claim and referenced by the

complaint.” Lone Star Fund V (U.S.), L.P. v. Barclays

Bank PLC, 594 F.3d 383, 387 (5th Cir. 2010).

III.

A.

The Driver’s Privacy Protection Act (DPPA) “regulates the disclosure of personal information contained

in the records of state motor vehicle departments.”

Reno P. Condon, 528 U.S. 141, 143 (2000). The DPPA

was enacted in 1994 to respond to at least two concerns: “The first was a growing threat from stalkers

and criminals who could acquire personal information

from state DMVs. The second concern related to the

States’ common practice of selling personal information to businesses engaged in direct marketing and

solicitation.” Maracich P. Spears, 570 U.S. 48, 57 (2013).

The DPPA makes it “unlawful for any person

knowingly to obtain or disclose personal information,

from a motor vehicle record, for any use not permitted

under section 2721(b) of this title.” 18 U.S.C. § 2722(a).

“A person who knowingly obtains, discloses or uses

personal information, from a motor vehicle record, for

a purpose not permitted under [the DPPA] shall be liable

to the individual to whom the information pertains,

who may bring a civil action in a United States district

court.” 18 U.S.C. § 2724(a). “The court may award . . .

actual damages, but not less than liquidated damages

App.5a

in the amount of $2,500. . . . ” § 2724(b). To state a claim

for a violation of the DPPA, the complaint must

adequately allege that “(1) the defendant knowingly

obtain[ed], disclose[d] or use[d] personal information;

(2) from a motor vehicle record; and (3) for a purpose

not permitted.” Taylor P. Acxiom Corp., 612 F.3d 325,

335 (5th Cir. 2010).

B.

Plaintiffs’ complaint alleges that Vertafore knowingly disclosed Plaintiffs’ personal information “by

storing that information on unsecured external servers.” The complaint further states that “the unsecure

servers disclosed” Plaintiffs’ personal information

“[i]n response to the commands of unauthorized individuals and consistent with the manner in which they

were programmed and configured by Vertafore.” In

their motion to dismiss and before us, Vertafore has

argued that Plaintiffs failed to allege both that the

company acted with an impermissible purpose and

that the company made a knowing disclosure. Because

we conclude that Plaintiffs have not alleged a “disclosure” within the meaning of the DPPA, we need not

reach whether Plaintiffs sufficiently alleged that Vertafore acted knowingly and with an impermissible purpose.

We turn, then, to whether any of the allegations

in Plaintiffs’ complaint amount to a disclosure, as that

word is used in the DPPA. When interpreting statutes,

we begin with the text’s plain meaning, “ascertained

by reference to ‘the particular statutory language at

issue, as well as the language and design of the statute

as a whole.’” United States v. Renda, 709 F.3d 472, 481

(5th Cir. 2013) (quoting Frame v. City of Arlington, 657

App.6a

F.3d 215, 224 (5th Cir. 2011)). The DPPA makes it

unlawful to “obtain or disclose personal information,”

and Plaintiffs’ complaint alleges that Vertafore “disclose[d]” Plaintiffs’ personal information. § 2722(a). The

statute does not define “disclose,” see 18 U.S.C. § 2725,

but Black’s Law Dictionary defines the word as “[t]o

bring into view by uncovering; to expose; to make

known; to lay bare; to reveal to knowledge; to free

from secrecy or ignorance, or make known.” BLACK’S

LAW DICTIONARY (6th ed. 1990).

The Plaintiffs argue in their briefs to us that

Vertafore’s disclosure was the act of “plac[ing] the

information onto a server that was readily accessible

to the public,” but this assertion is nowhere in Plaintiffs’ complaint, nor is it supported by the facts

alleged in Plaintiffs’ complaint. The complaint does not

allege, for example, that Vertafore published Plaintiffs’

personal information on a public website or otherwise

placed the information in plain view of any digital

“passer-by.” See Senne v. Village of Palatine, Ill., 695

F.3d 597, 603 (7th Cir. 2012) (en banc) (holding that a

police officer’s placement of a parking ticket on a car

windshield was a disclosure within the meaning of the

DPPA because “[t]he real effect of the placement of the

ticket was to make available Mr. Senne’s motor vehicle

record to any passer-by”).

Instead, the only facts alleged in Plaintiffs’ complaint are that Vertafore stored personal information

on “unsecured external servers” and that unauthorized

users accessed that information. Without more, these

facts do not plausibly state a “disclosure” consistent

with the plain meaning of that word. Nothing about

the words “unsecured” or “external” implies exposure

to public view, and the mere fact that unauthorized

App.7a

users managed to access the information does not

imply that Vertafore granted or facilitated that access.

After all, we would hardly say that personal information was “disclosed” if it was kept in hard copy and the

papers were stolen out of an unlocked, but private,

storage facility. See Enslin P. Coca-Cola Co., 136 F.

Supp. 3d 654, 658-59, 671 (E.D. Pa. 2015) (concluding

that “privately holding [personal information], even in

an unsecured manner, does not constitute a ‘voluntary

disclosure’ under the DPPA” where personal information was stored unencrypted on laptops that were stolen

from company property by an employee), aff’d, 739 F.

App’x 91 (3d Cir. 2018).

Though at this stage of the proceedings we draw

all reasonable inferences in Plaintiffs’ favor, the inference Plaintiffs ask us to draw—from “stored on unsecured external servers” to “disclosed”—is not reasonable.

See Iqbal, 556 U.S. at 678.2 Because Plaintiffs have

not alleged a disclosure within the meaning of the DPPA,

their complaint fails to state a plausible claim for

relief.

IV.

For the foregoing reasons, the judgment of the

district court is AFFIRMED.

2 Plaintiffs cite no case in which insufficiently secure data storage

constituted a “disclosure” within the meaning of the DPPA.

App.8a

JUDGMENT OF THE UNITED STATES COURT

OF APPEALS FOR THE FIFTH CIRCUIT

(MARCH 11, 2022)

UNITED STATES COURT OF APPEALS FOR

THE FIFTH CIRCUIT

________________________

DEREK ALLEN; LEANDRE BISHOP;

JOHN BURNS,

Plaintiffs-Appellants,

v.

VERTAFORE, INCORPORATED,

Defendant-Appellee.

________________________

No. 21-20404

Appeal from the United States District Court

for the Southern District of Texas

USDC No. 4:20-CV-4139

Before: SOUTHWICK, HAYNES,

and HIGGINSON, Circuit Judges.

JUDGMENT

This cause was considered on the record on appeal

and the briefs on file.

IT IS ORDERED and ADJUDGED that the

judgment of the District Court is AFFIRMED.

App.9a

IT IS FURTHER ORDERED that Appellants pay

to Appellee the costs on appeal to be taxed by the

Clerk of this Court.

App.10a

ORDER OF THE UNITED STATES DISTRICT

COURT FOR THE SOUTHERN DISTRICT OF

TEXAS HOUSTON DIVISION ADOPTING

MAGISTRATE JUDGE’S MEMORANDUM

AND RECOMMENDATION

(JULY 23, 2021)

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF TEXAS

HOUSTON DIVISION

________________________

DEREK ALLEN, ET AL.,

Plaintiffs,

v.

VERTAFORE, INC.,

Defendant.

________________________

Civil Action No. 4:20-cv-04139

Before: George C. HANKS, JR.,

United States District Judge.

ORDER ADOPTING MAGISTRATE JUDGE’S

MEMORANDUM AND RECOMMENDATION

On March 18, 2021, Defendant’s Motion to Dismiss

Pursuant to Rule 12(b)(1) and 12(b)(6) (Dkt. 38) was

referred to United States Magistrate Judge Andrew

M. Edison under 28 U.S.C. § 636(b)(1)(B). Dkt. 43. Judge

Edison filed a Memorandum and Recommendation on

App.11a

June 14, 2021, recommending that Defendant’s Motion

to Dismiss Pursuant to Rule 12(b)(1) and 12(b)(6) (Dkt.

38) be GRANTED. See Dkt. 55.

On June 16, 2021, Plaintiffs filed their Objections.

In accordance with 28 U.S.C. § 636(b)(1)(C), this Court

is required to “make a de novo determination of those

portions of the [magistrate judge’s] report or specified

proposed findings or recommendations to which objection [has been] made.” After conducting this de novo

review, the Court may “accept, reject, or modify, in whole

or in part, the findings or recommendations made by

the magistrate judge.” Id.; see also Fed. R. Civ. P. 72

(b)(3).

The Court has carefully considered the Objections;

the Memorandum and Recommendation; the pleadings;

and the record. The Court ACCEPTS Judge Edison’s

Memorandum and Recommendation and ADOPTS it

as the opinion of the Court. It is therefore ORDERED

that:

(1) Judge Edison’s Memorandum and Recommendation (Dkt. 55) is APPROVED AND

ADOPTED in its entirety as the holding of

the Court; and

(2) Defendant’s Motion to Dismiss Pursuant to

Rule 12(b)(1) and 12(b)(6) (Dkt. 38) is GRANTED.

It is so ORDERED.

SIGNED at Houston, Texas, this 23rd day of July,

2021.

/s/ George C. Hanks, Jr.

United States District Judge

App.12a

MEMORANDUM AND RECOMMENDATION OF

THE UNITED STATES DISTRICT COURT FOR

THE SOUTHERN DISTRICT OF TEXAS

HOUSTON DIVISION

(JUNE 14, 2021)

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF TEXAS

HOUSTON DIVISION

________________________

DEREK ALLEN, ET AL.,

Plaintiffs,

v.

VERTAFORE, INC.,

Defendant.

________________________

Civil Action No. 4:20-cv-04139

Before: Andrew M. EDISON,

United States Magistrate Judge.

MEMORANDUM AND RECOMMENDATION

Before me is Defendant’s Motion to Dismiss Pursuant to Rule 12(b)(1) and 12(b)(6). Dkt. 38. After carefully

reviewing the legal briefing, analyzing the relevant

case law, and hearing oral argument, I recommend

that Defendant’s Motion to Dismiss be GRANTED.

App.13a

BACKGROUND

This putative class action is brought by Plaintiffs

Derek Allen, Leandre Bishop, and John Burns on behalf

of themselves and approximately 27.7 million other

individuals who were issued Texas driver’s licenses prior

to February 2019 (collectively, “Plaintiffs”). Defendant

Vertafore, Inc. (“Vertafore”) is an insurance software

company that provides enterprise software solutions,

specifically management systems, content management

and workflow, sales tools, compliance, rating, and comprehensive agency solutions for the insurance industry.

The facts underlying this suit began in early 2020.

Between March and August 2020, Vertafore determined that because of human error, three data files

containing driver information for Texas driver’s licenses

issued before February 2019 had been inadvertently

stored in an unsecured external storage service that

appeared to have been accessed without authorization

(the “data breach”). The files contained Texas driver

license numbers, as well as names, dates of birth,

addresses, and vehicle registration histories. The files

did not contain any Social Security numbers or financial

account information. Vertafore publicly disclosed the

data breach via press release dated November 2020

(the “Press Release”). See Dkt. 38-1.

On December 4, 2020, shortly after Vertafore disclosed the data breach, Plaintiffs filed this suit. Plaintiffs contend that Vertafore is liable for violating the

Driver’s Privacy Protection Act of 1994 (“DPPA”).

Vertafore has moved to dismiss for lack of Article III

App.14a

standing and failure to state a claim. I address each

argument in turn.1

SUBJECT-MATTER JURISDICTION

Vertafore first argues that the Complaint should

be dismissed because Plaintiffs fail to allege Article III

standing.

A.

Legal Standard

Federal Rule of Civil Procedure Rule 12(b)(1) allows

a defendant to move to dismiss a case before filing an

answer “when the court lacks the statutory or constitutional power to adjudicate the claim.” In re FEMA

Trailer Formaldehyde Prods. Liab. Litig., 668 F.3d

281, 286 (5th Cir. 2012) (quotation omitted). District

courts may grant a motion to dismiss for lack of subjectmatter jurisdiction based on: “(1) the complaint alone;

(2) the complaint supplemented by undisputed facts

in the record; or (3) the complaint supplemented by

undisputed facts plus the court’s resolution of disputed

facts.” Clark v. Tarrant Cnty., 798 F.2d 736, 741 (5th

Cir. 1986).

To determine whether there is jurisdiction to

hear a case, “federal courts must look to the sources of

their power, Article III of the United States Constitution and congressional statutory grants of jurisdiction.”

Tercero v. Tex. Southmost Coll. Dist., 989 F.3d 291, 298

(5th Cir. 2021). Article III of the Constitution empowers

federal courts to hear “cases” or “controversies” arising

1 On January 21, 2021, I held a Pre-Motion Conference with all

parties. I extended an invitation to Plaintiffs to re-plead their

claims before I entertained this motion to dismiss. Plaintiffs

declined that invitation.

App.15a

under the Constitution or federal law. U.S. CONST. art.

III, § 2. There is no case or controversy if the plaintiff

has no standing to sue. See Lujan v. Defs. of Wildlife,

504 U.S. 555 (1992). (“[T]he core component of standing is an essential and unchanging part of the case-orcontroversy requirement of Article III.”).

The party invoking federal jurisdiction has the

burden of establishing subject-matter jurisdiction.

Palacios v. Dep’t of Homeland Sec., 434 F. Supp. 3d

500, 505 (S.D. Tex. 2020). To avoid dismissal under

Rule 12(b)(1), Plaintiffs must show “(1) an injury in fact,

(2) a sufficient causal connection between the injury

and the conduct complained of, and (3) a likelihood

that the injury will be redressed by a favorable decision.” Soniat v. Tex. Real Est. Comm’n, 721 F. App’x

398, 399 (5th Cir. 2018) (cleaned up).

B.

Discussion

The Fifth Circuit has addressed Article III standing in a DPPA suit before. The unanimous majority

in Taylor v. Acxiom Corp. explained the Article III

standing issue as follows:

Article III standing . . . is present. It is

undisputed that the DPPA protects from

certain uses or disclosures personal information of plaintiffs and creates a federal cause of

action for same, and that such personal information of plaintiffs was actually included in

the challenged bulk distributions by Texas

DPS. Moreover, plaintiffs’ claim that such

bulk distributions (including the personal

information of these plaintiffs) are prohibited,

and constitute a disclosure or use made illegal,

App.16a

by the DPPA which affords plaintiffs a federal cause of action for such disclosure or use

of their personal information, though clearly

without merit, is nevertheless not wholly

insubstantial and frivolous, and hence gives

the district court jurisdiction to decide whether

or not the DPPA does preclude such distributions or uses.

612 F.3d 325, 340 n.15 (5th Cir. 2010). Similarly, if not

more succinctly, Judge Dennis wrote a concurrence

describing the Article III standing issue as follows:

The plaintiffs in this case have Article III

standing for the reason stated in footnote 15

of the majority opinion: they allege that the

defendants have used their personal information in a manner that is prohibited by the

DPPA. Thus, their allegations fulfill the three

requirements of the irreducible constitutional

minimum of standing: an injury in fact (i.e.,

the invasion of an interest which the plaintiffs

argue is legally protected), which was caused

by the defendants and which would be redressed by a judgment against the defendants.

It is firmly established that the absence of

a valid (as opposed to arguable) cause of action

does not implicate subject-matter jurisdiction. Thus, our holding that the plaintiffs

have failed to state a valid claim under the

DPPA does not alter the fact that the plaintiffs have Article III standing.

Id. at 340–41 (Dennis, J., concurring) (cleaned up).

In this case, Plaintiffs have alleged that they were

issued driver’s licenses before February 2019 and the

App.17a

data breach affected Texas driver’s licenses issued

before February 2019. Plaintiffs contend that Vertafore

inadvertently storing sensitive data files on the wrong

servers amounts to a disclosure prohibited by the DPPA,

which may be redressed by a judgment against Vertafore. While it is true that there are strong arguments

against Plaintiffs’ claim, which I address in the context

of Rule 12(b)(6), the allegations presented here are

sufficient to establish Article III standing. Consequently, Taylor compels me to conclude that Article

III standing exists in this case.2 See also Sistrunk,

2016 WL 9450445, at *4–6 (explaining that an allegation

of the specific type of harm sought to be remedied by

Congress in enacting the DPPA is sufficiently concrete

to provide Article III standing under Spokeo, Inc. v.

Robins, 136 S. Ct. 1540 (2016)).

FAILURE TO STATE A CLAIM

Vertafore next argues that even if Plaintiffs have

Article III standing, they have failed to state a claim.

A.

Legal Standard

When evaluating a motion to dismiss for failure

to state a claim, a court must accept “all well-pleaded

facts as true and view[] those facts in the light most

favorable to the plaintiff.” Cummings v. Premier Rehab

2 Vertafore attacks Taylor’s discussion of Article III standing as

mere dicta. While it is true the Taylor court discussed Article III

standing in an abundance of caution, I nonetheless find the

appellate court’s discussion instructive and worthy of consideration. See Sistrunk v. TitleMax, Inc., No. SA-14-CA-628-RP(HJB),

2016 WL 9450445, at *9 (W.D. Tex. Aug. 26, 2016) (“Even dicta

from a non-precedential decision may be persuasive, . . .especially

decisions from the appellate court.” (emphasis omitted)).

App.18a

Keller, P.L.L.C., 948 F.3d 673, 675 (5th Cir. 2020)

(quotation omitted). “To survive a motion to dismiss,

a complaint must contain sufficient factual matter,

accepted as true, to state a claim to relief that is

plausible on its face.” Id. (quotation omitted). Under

this standard, a court must demand “more than a sheer

possibility that a defendant has acted unlawfully. Where

a complaint pleads facts that are merely consistent

with a defendant’s liability, it stops short of the line

between possibility and plausibility of entitlement to

relief.” Id. (quotation omitted). In ruling on a motion

to dismiss, “[t]he court’s review is limited to the complaint, any documents attached to the complaint, and

any documents attached to the motion to dismiss that

are central to the claim and referenced by the complaint.”

Lone Star Fund V (U.S.), L.P. v. Barclays Bank PLC,

594 F.3d 383, 387 (5th Cir. 2010).

B.

Discussion

Boiled down, Vertafore argues that “to adequately

allege a DPPA violation there must be well-pled allegations that [it obtained, disclosed, or used personal

information from a motor vehicle record] (1) knowingly

and (2) for an improper purpose—neither of which is

present here.” Dkt. 38 at 20 (emphases omitted).

Plaintiffs disagree, arguing that by inadvertently

storing sensitive data files on the wrong servers,

Vertafore knowingly disclosed their personal information for an impermissible purpose. I agree with

Vertafore’s understanding of the factual allegations

required to adequately state a DPPA claim:

The DPPA creates liability when three elements are met: (1) the defendant knowingly

App.19a

obtains, discloses[,] or uses personal information; (2) from a motor vehicle record; and

(3) for a purpose not permitted. 18 U.S.C.

§ 2724(a). The plain meaning of the third

factor is that it is only satisfied if shown that

obtainment, disclosure, or use was not for a

purpose enumerated under § 2721(b).3

Taylor, 612 F.3d at 335 (cleaned up). Vertafore’s argument attacks elements one and three.

I have closely reviewed the Class Action Complaint

for specific factual allegations demonstrating or suggesting that Vertafore knowingly disclosed Plaintiffs’

personal information for an improper purpose. I see

no such facts. In a single sentence of the Complaint,

Plaintiffs state that “Vertafore knowingly disclosed the

Driver’s License Information of Plaintiffs and approximately 27.7 million other Class members by storing

that information on unsecured external servers.”

Dkt. 1 at 6–7. Plaintiffs then go on to declare that “[i]n

response to the commands of unauthorized individuals

and consistent with the [way] they were programmed

and configured by Vertafore, the unsecure servers disclosed Plaintiffs’ and Class members’ Driver’s License

Information to the unauthorized Individuals.” Id.

at 7. Notably absent from this assertion is any factual

allegation describing how this purported mismanagement of information amounts to a knowing disclosure

of personal information for an improper purpose.

3 While § 2721(a) states a general prohibition on the release and

use of certain personal information from State motor vehicle

records, § 2721(b) expressly lists fourteen permissible uses of the

same information. See 18 U.S.C. § 2721.

App.20a

To be clear, the facts alleged in the Complaint

describe Vertafore as having stored the data on servers

under Vertafore’s control, meaning the data was never

actually knowingly disclosed to anyone outside of

Vertafore. The factual allegations also plainly state

that anyone that may have obtained the data did so

in an unauthorized manner, which undercuts the

notion that Vertafore knowingly disclosed the data to

those unauthorized individuals for any specific purpose. Moreover, I see no factual allegation explaining

the improper purpose of the purported impermissible

disclosure. Plaintiffs clearly detail that “Vertafore is

an insurance software company that provides enterprise

software solutions” for the insurance industry. Dkt. 1 at

3. Thus, Vertafore’s purpose of managing the affected

data files is a covered permissible use under 18 U.S.C.

§ 2721(b)(6), which covers uses by “any insurer or

insurance support organization, or by a self-insured

entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud

activities, rating or underwriting.” As if all these

deficiencies are not enough, the Press Release on

which Plaintiffs exclusively base their claim, outright

states that the affected data files had been “inadvertently stored in an unsecured external storage service”

and describes Vertafore’s efforts to remediate the

problem.4 Dkt. 38-1 at 2. Importantly, Plaintiffs have

not offered any factual enhancement disputing the

facts as stated in the Press Release.

4 I am free to reference the Press Release because it is central to

Plaintiffs’ claim, Plaintiffs specifically reference the Press Release

in the Complaint, and Vertafore attached the Press Release to its

motion to dismiss. See Lone Star Fund, 594 F.3d at 387.

App.21a

In sum, I find that Plaintiffs’ allegation that Vertafore knowingly disclosed their personal information

for an improper purpose is nothing more than a

conclusory allegation or legal conclusion masquerading

as a factual conclusion. See ABC Arbitrage Plaintiffs

Grp. v. Tchuruk, 291 F.3d 336, 348 (5th Cir. 2002). As

explained by the Fifth Circuit, this “will not suffice to

prevent dismissal under Rule 12(b)(6).” Id.

CONCLUSION

For the reasons stated above, I recommend that

Vertafore’s Motion to Dismiss (Dkt. 38) be GRANTED.

The Clerk shall provide copies of this Memorandum and Recommendation to the respective parties

who have fourteen days from the receipt to file written

objections pursuant to Federal Rule of Civil Procedure

72(b) and General Order 2002–13. Failure to file

written objections within the time period mentioned

shall bar an aggrieved party from attacking the

factual findings and legal conclusions on appeal.

SIGNED this 14th day of June 2021.

/s/ Andrew M. Edison

United States Magistrate Judge

App.22a

DRIVER’S PRIVACY PROTECTION ACT OF 1994

18 U.S.C. § 2721

§ 2721. Prohibition on release and use of certain

personal information from State

(a) In general. A State department of motor vehicles,

and any officer, employee, or contractor thereof,

shall not knowingly disclose or otherwise make

available to any person or entity:

(1) personal information, as defined in 18 U.S.C.

2725(3), about any individual obtained by

the department in connection with a motor

vehicle record, except as provided in subsection (b) of this section; or

(2) highly restricted personal information, as

defined in 18 U.S.C. 2725(4), about any individual obtained by the department in connection with a motor vehicle record, without the

express consent of the person to whom such

information applies, except uses permitted

in subsections (b)(1), (b)(4), (b)(6), and (b)(9):

Provided, That subsection (a)(2) shall not in

any way affect the use of organ donation information on an individual’s driver’s license or

affect the administration of organ donation

initiatives in the States.

(b) Permissible uses. Personal information referred

to in subsection (a) shall be disclosed for use in

connection with matters of motor vehicle or driver

safety and theft, motor vehicle emissions, motor

vehicle product alterations, recalls, or advisories,

performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal

App.23a

of non-owner records from the original owner

records of motor vehicle manufacturers to carry

out the purposes of titles I and IV of the Anti Car

Theft Act of 1992, the Automobile Information

Disclosure Act (15 U.S.C. 1231 et seq.), the Clean

Air Act (42 U.S.C. 7401 et seq.), and chapters 301,

305, and 321-331 of title 49 [49 USCS §§ 30101 et

seq., 30501 et seq., 32101 et seq.–33101 et seq.],

and, subject to subsection (a)(2), may be disclosed

as follows:

(1) For use by any government agency, including

any court or law enforcement agency, in carrying out its functions, or any private person or

entity acting on behalf of a Federal, State, or

local agency in carrying out its functions.

(2) For use in connection with matters of motor

vehicle or driver safety and theft; motor vehicle

emissions; motor vehicle product alterations,

recalls, or advisories; performance monitoring

of motor vehicles, motor vehicle parts and

dealers; motor vehicle market research activities, including survey research; and removal

of non-owner records from the original owner

records of motor vehicle manufacturers.

(3) For use in the normal course of business by

a legitimate business or its agents, employees,

or contractors, but only—

(A) to verify the accuracy of personal information submitted by the individual to

the business or its agents, employees, or

contractors; and

(B) if such information as so submitted is

not correct or is no longer correct, to

App.24a

obtain the correct information, but only

for the purposes of preventing fraud by,

pursuing legal remedies against, or

recovering on a debt or security interest

against, the individual.

(4) For use in connection with any civil, criminal,

administrative, or arbitral proceeding in any

Federal, State, or local court or agency or

before any self-regulatory body, including the

service of process, investigation in anticipation of litigation, and the execution or

enforcement of judgments and orders, or

pursuant to an order of a Federal, State, or

local court.

(5) For use in research activities, and for use in

producing statistical reports, so long as the

personal information is not published,

redisclosed, or used to contact individuals.

(6) For use by any insurer or insurance support

organization, or by a self-insured entity, or

its agents, employees, or contractors, in connection with claims investigation activities,

antifraud activities, rating or underwriting.

(7) For use in providing notice to the owners of

towed or impounded vehicles.

(8) For use by any licensed private investigative

agency or licensed security service for any

purpose permitted under this subsection.

(9) For use by an employer or its agent or insurer

to obtain or verify information relating to

a holder of a commercial driver’s license that

App.25a

is required under chapter 313 of title 49 [49

USCS §§ 31301 et seq.].

(10) For use in connection with the operation of

private toll transportation facilities.

(11) For any other use in response to requests for

individual motor vehicle records if the State

has obtained the express consent of the person

to whom such personal information pertains.

(12) For bulk distribution for surveys, marketing

or solicitations if the State has obtained the

express consent of the person to whom such

personal information pertains.

(13) For use by any requester, if the requester

demonstrates it has obtained the written

consent of the individual to whom the information pertains.

(14) For any other use specifically authorized

under the law of the State that holds the

record, if such use is related to the operation

of a motor vehicle or public safety.

(c) Resale or redisclosure. An authorized recipient of

personal information (except a recipient under

subsection (b)(11) or (12)) may resell or redisclose

the information only for a use permitted under

subsection (b) (but not for uses under subsection

(b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal

information for any purpose. An authorized

recipient under subsection (b)(12) may resell or

redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except

a recipient under subsection (b)(11)) that resells

App.26a

or rediscloses personal information covered by

this chapter [18 USCS §§ 2701 et seq.] must keep

for a period of 5 years records identifying each

person or entity that receives information and the

permitted purpose for which the information will

be used and must make such records available to

the motor vehicle department upon request.

(d) Waiver procedures. A State motor vehicle department may establish and carry out procedures

under which the department or its agents, upon

receiving a request for personal information that

does not fall within one of the exceptions in

subsection (b), may mail a copy of the request to

the individual about whom the information was

requested, informing such individual of the request,

together with a statement to the effect that the

information will not be released unless the individual waives such individual’s right to privacy

under this section.

(e) Prohibition on conditions. No State may condition or

burden in any way the issuance of an individual’s

motor vehicle record as defined in 18 U.S.C.

2725(1) to obtain express consent. Nothing in this

paragraph shall be construed to prohibit a State

from charging an administrative fee for issuance

of a motor vehicle record.

App.27a

18 U.S.C. § 2722

§ 2722. Additional unlawful acts

(a) Procurement for unlawful purpose. It shall be

unlawful for any person knowingly to obtain or

disclose personal information, from a motor

vehicle record, for any use not permitted under

section 2721(b) of this title [18 USCS § 2721(b)].

(b) False representation. It shall be unlawful for any

person to make false representation to obtain

any personal information from an individual’s

motor vehicle record.

18 U.S.C. § 2723

§ 2723. Penalties

(a) Criminal fine. A person who knowingly violates

this chapter [18 USCS §§ 2721 et seq.] shall be

fined under this title.

(b) Violations by State department of motor vehicles.

Any State department of motor vehicles that has

a policy or practice of substantial noncompliance

with this chapter [18 USCS §§ 2721 et seq.] shall

be subject to a civil penalty imposed by the Attorney General of not more than $5,000 a day for

each day of substantial noncompliance.

App.28a

18 U.S.C. § 2724

§ 2724. Civil action

(a) Cause of action. A person who knowingly obtains,

discloses or uses personal information, from a

motor vehicle record, for a purpose not permitted

under this chapter [18 USCS §§ 2721 et seq.]

shall be liable to the individual to whom the information pertains, who may bring a civil action in

a United States district court.

(b) Remedies. The court may award—

(1)

actual damages, but not less than liquidated

damages in the amount of $2,500;

(2) punitive damages upon proof of willful or

reckless disregard of the law;

(3) reasonable attorneys’ fees and other litigation

costs reasonably incurred; and

(4) such other preliminary and equitable relief

as the court determines to be appropriate.

18 U.S.C. § 2725

§ 2725. Definitions

In this chapter [18 USCS §§ 2721 et seq.]—

(1) “motor vehicle record” means any record that

pertains to a motor vehicle operator’s permit,

motor vehicle title, motor vehicle registration,

or identification card issued by a department

of motor vehicles;

(2) “person” means an individual, organization

or entity, but does not include a State or

agency thereof;

App.29a

(3) “personal information” means information

that identifies an individual, including an

individual’s photograph, social security

number, driver identification number, name,

address (but not the 5-digit zip code), telephone number, and medical or disability

information, but does not include information

on vehicular accidents, driving violations,

and driver’s status.[;]

(4) “highly restricted personal information” means

an individual’s photograph or image, social

security number, medical or disability information; and

(5) “express consent” means consent in writing,

including consent conveyed electronically

that bears an electronic signature as defined

in section 106(5) of Public Law 106-229 [15

USCS § 7006(5)].

App.30a

CLASS ACTION COMPLAINT

(DECEMBER 4, 2020)

IN THE UNITED STATES DISTRICT COURT FOR

THE SOUTHERN DISTRICT OF TEXAS

HOUSTON DIVISION

________________________

DEREK ALLEN, LEANDRE BISHOP, AND JOHN

BURNS, INDIVIDUALLY AND ON BEHALF OF

ALL OTHERS SIMILARLY SITUATED,

Plaintiffs,

v.

VERTAFORE, INC.,

Defendant.

________________________

Case No. 4:20-cv-4139

CLASS ACTION COMPLAINT

Plaintiffs Derek Allen, Leandre Bishop, and John

Burns (“Plaintiffs”), individually and on behalf of all

others similarly situated, upon personal knowledge of

facts pertaining to themselves and on information

and belief as to all other matters, by and through

undersigned counsel, bring this Class Action Complaint

against Defendant Vertafore, Inc. (“Vertafore” or

“Defendant”).

App.31a

NATURE OF THE ACTION

1. Plaintiffs bring this class action on behalf of

themselves and approximately 27.7 million other

individuals (“Class members”) whose private and

confidential information, including Texas driver’s

license numbers, as well as names, dates of birth,

addresses and vehicle registration histories (collectively,

“Driver’s License Information”) was knowingly stored

by Vertafore on unsecured external servers and

accessed by and disclosed to unauthorized third parties

(the “Data Breach”). As a result of the Data Breach,

Plaintiffs’ and Class members’ highly sensitive Driver’s

License Information was disclosed to criminals.

2. The acts of Vertafore, as described more particularly below, were in violation of the Driver’s Privacy Protection Act, 18 U.S.C. §§ 2721, et seq. (“DPPA”).

PARTIES

3. Plaintiff Derek Allen is a citizen of the State of

Texas, and resides in Houston, Texas. Since prior to

February 2019, Allen has had a Texas driver’s

license.

4. Plaintiff Leandre Bishop is a citizen of the

State of Texas, and resides in El Paso, Texas. Since

prior to February 2019, Bishop has had a Texas

driver’s license.

5. Plaintiff John Burns is a citizen of the State

of Texas, and resides in Plano, Texas. Since prior to

February 2019, Burns has had a Texas driver’s license.

6. Defendant Vertafore, Inc., is a Delaware corporation, and its principal place of business is located

in Denver, Colorado.

App.32a

JURISDICTION AND VENUE

7. This Court has subject matter jurisdiction over

this action pursuant to 28 U.S.C. § 1331, because this

civil action arises under statutes of the United States,

specifically the Driver’s Privacy Protection Act, 18

U.S.C. § 2721, et seq.

8. The Court has personal jurisdiction over

Vertafore, because Vertafore is authorized to do business and in fact does business in Texas, and Vertafore

has sufficient minimum contacts with and otherwise

intentionally avails itself of the markets in Texas

through its promotion, marketing, and sale of its

insurance technology products and services.

9. Venue properly lies in this district pursuant to

28 U.S.C. § 1391, because a substantial part of the

events giving rise to the claims occurred in this judicial district and Plaintiff Allen resides in this judicial

district.

FACTUAL ALLEGATIONS

10. Vertafore is an insurance software company

that provides enterprise software solutions, specifically

management systems, content management and workflow, sales tools, compliance, rating, and comprehensive agency solutions.

11. On November 10, 2020, Vertafore—a selfdescribed leader in modern insurance technology—

announced that: (1) between March 11, 2020, and

August 1, 2020, Vertafore caused Plaintiffs’ and

approximately 27.7 million Class members’ Driver’s

License Information to be stored on unsecure external

servers; and (2) Plaintiffs’ and other Class members’

App.33a

Driver’s License Information was disclosed to and

accessed by unknown third parties.

12. Vertafore’s notice provided:

Vertafore recently determined that as a result

of human error, three data files were inadvertently stored in an unsecured external

storage service that appears to have been

accessed without authorization.

The files, which included driver information

for licenses issued before February 2019,

contained Texas driver license numbers, as

well as names, dates of birth, addresses and

vehicle registration histories.

13. Vertafore reported to the Texas Department

of Motor Vehicles that the three data files that were

compromised as a result of the Data Breach contained

the Driver’s License Information of Approximately

27.7 million people.

14. Vertafore has represented that it maintained

the Driver’s License Information of approximately

27.7 million Class members to support some of its

insurance rating solutions.

15. When analyzing the background of the Data

Breach, one commenter noted: “This breach is yet

another example of a company leaving a server and

critical information unsecured without any protection,

an unfortunate trend that has been the cause of many

recent breaches.” Tim Sandle, Looking behind the

Vertafore data breach, Digital Journal (Nov. 21, 2020),

http://www.digitaljournal.com/tech-and-science/

technology/looking-behind-the-vertafore-databreach/

article/581178 (quoting Vinay Sridhara, CTO, Balbix).

App.34a

16. Congress enacted the Driver’s Privacy Protection Act to curb the dissemination of motor vehicle

records in response to a series of crimes and abuses—

most notably, the 1989 murder of actress Rebecca

Schaeffer by an obsessed fan who obtained her address

from the California department of motor vehicles.

17. As a result of Vertafore’s violation of the DPPA,

Plaintiffs’ and Class members’ privacy has been

violated, their Driver’s License Information is now in

the hands of criminals, and they face a substantially

increased risk of identity theft and identity fraud.

CLASS ALLEGATIONS

18. Pursuant to Fed. R. Civ. P. 23, Plaintiffs bring

this action individually and on behalf of the following

class of individuals (the “Class”):

All persons whose Texas driver’s license

information was stored by Vertafore on an

unsecured external storage service online

and accessed without authorization.

19. Excluded from the Class are Vertafore and its

affiliates, officers, directors, assigns, successors, and

the Judge(s) assigned to this case.

20. Numerosity: Because the Class is estimated

to include more than 27.7 million individuals, joinder

of all Class members is impracticable and the numerosity requirement is satisfied.

21. Typicality: Plaintiffs’ claims are typical of

Class members’ claims. Plaintiffs and all Class members were injured through Vertafore’s uniform

misconduct—the storage of their Driver’s License

Information on unsecured servers—and assert identical

App.35a

claims against Vertafore. Accordingly, Plaintiffs’ claims

are typical of Class members’ claims.

22. Adequacy: Plaintiffs’ interests are aligned

with the Class as they seek to represent other similarly

situated individuals and have retained counsel with

significant experience in prosecuting complex class

action cases, including cases involving alleged privacy

and DPPA violations. Plaintiffs and their counsel

intend to prosecute this action vigorously. The Class’s

interests are well-represented by Plaintiffs and their

counsel.

23. Superiority: A class action is the superior—

and only realistic—mechanism to fairly and efficiently

adjudicate Plaintiffs’ and other Class member’s claims.

The injury suffered by each individual Class member

is relatively small in comparison to the burden and

expense of individual prosecution of complex and

expensive litigation. It would be very difficult if not

impossible for Class members individually to effectively

redress Vertafore’s wrongdoing. Even if Class members

could afford such individual litigation, the court

system could not. Individualized litigation presents a

potential for inconsistent or contradictory judgments.

Individualized litigation increases the delay and

expense to all parties, and to the court system,

presented by the complex legal and factual issues of

the case. By contrast, the class action device presents

far fewer management difficulties and provides the

benefits of single adjudication, economy of scale, and

comprehensive supervision by a single court.

24. Commonality and Predominance: The following

questions common to all Class members predominate

over any potential questions affecting individual Class

members:

App.36a



whether Vertafore engaged in the wrongful

conduct alleged herein;



whether Vertafore knowingly disclosed

Plaintiffs’ and other Class members’ Driver’s

License Information for a purpose not permitted under the DPPA; and



whether Plaintiffs and Class members are

entitled to statutory damages and equitable

relief and, if so, in what nature and amount.

25. Given that Vertafore has engaged in a common

course of conduct as to Plaintiffs and the Class,

identical injuries and statutory violations are involved,

and common questions outweigh any potential individual questions.

COUNT I

VIOLATION OF THE DRIVER’S PRIVACY

PROTECTION ACT

26. Plaintiffs reallege and incorporate all previous allegations as though fully set forth herein.

27. The DPPA, 18 U.S.C. § 2722(a), prohibits any

person, organization, or entity from knowingly obtaining

or disclosing “personal information, from a motor

vehicle record, for a purpose not permitted under

[§ 2721(b) of the DPPA].”

28. The DPPA defines “motor vehicle record” to

mean “any record that pertains to a motor vehicle

operator’s permit, motor vehicle title, motor vehicle

registration, or identification card issued by a department of motor vehicles.” 18 U.S.C. § 2725(1).

29. The DPPA defines “personal information” to

mean “information that identifies an individual,

App.37a

including an individual’s photograph, social security

number, driver identification number, name, address

(but not the 5-digit zip code), telephone number, and

medical or disability information, but does not include

information on vehicular accidents, driving violations,

and driver’s status.” 18 U.S.C. § 2725(3).

30. Vertafore knew Plaintiffs’ and other Class

members’ Driver’s License Information was obtained

from the Texas Department of Motor Vehicles.

31. In violation of the DPPA, Vertafore knowingly

disclosed the Driver’s License Information of Plaintiffs

and approximately 27.7 million other Class members

by storing that information on unsecured external

servers.

32. In response to the commands of unauthorized

individuals and consistent with the manner in which

they were programmed and configured by Vertafore,

the unsecure servers disclosed Plaintiffs’ and Class

members’ Driver’s License Information to the unauthorized individuals.

33. Pursuant to 18 U.S.C. § 2724(b), as a result of

Vertafore’s violation of the DPPA, Plaintiffs’ and

Class members are entitled to actual damages, but not

less than liquidated damages in the amount of $2,500.

PRAYER FOR RELIEF

Plaintiffs, individually and on behalf of the Class,

by and through undersigned counsel, respectfully

request that the Court grant the following relief:

A.

Certify this case as a class action pursuant

to Fed. R. Civ. P. 23(a) and (b)(3), and, pursuant

to Fed. R. Civ. P. 23(g), appoint Plaintiffs as

App.38a

class representatives and their counsel as

class counsel.

B.

Award Plaintiffs and Class members actual

and statutory damages to the maximum extent

allowable;

D.

Award Plaintiffs and Class members prejudgment and post-judgment interest to the

maximum extent allowable.

E.

Award Plaintiffs and Class members reasonable attorneys’ fees, costs, and expenses, as

allowable.

F.

Award Plaintiffs and Class members such

other favorable relief as allowable under law

or at equity.

Respectfully submitted,

/s/ Cory S. Fein

Cory S. Fein (Texas Bar No. 06879450)

Cory Fein Law Firm

712 Main Street, Suite 800

Houston, TX 77002

(281) 254-7717

(530) 748-0601 (fax)

cory@coryfeinlaw.com

Ben Barnow (pro hac vice to be filed)

Erich P. Schork (pro hac vice to be filed)

Anthony L. Parkhill (pro hac vice to be filed)

Barnow and Associates, P.C.

205 West Randolph Street,

Suite 1630

Chicago, Illinois 60602

App.39a

Tel: (312) 621-2000

b.barnow@barnowlaw.com

e.schork@barnowlaw.com

aparkhill@barnowlaw.com

Benjamin F. Johns (pro hac vice to be filed)

Samantha E. Holbrook (pro hac vice to be filed)

Andrew W. Ferich (pro hac vice to be filed)

Alex M. Kashurba (pro hac vice to be filed)

Chimicles Schwartz Kriner & Donaldson-Smith LLP

One Haverford Centre

361 Lancaster Avenue

Haverford, PA 19041

Tel: (610) 642-8500

bfj@chimicles.com

seh@chimicles.com

awf@chimicles.com

amk@chimicles.com

Counsel for Plaintiffs