Allen v. Vertafore, 28 F.4th 613

Vertafore stored three data files on unsecured external storage; unauthorized access occurred between March and August 2020.
Files contained driver information for about 27.7 million Texas license holders (licenses issued before Feb 2019).
As of Vertafore’s November 2020 notice, its investigation found no evidence the accessed data had been misused.
Plaintiffs filed a putative class action under the Driver’s Privacy Protection Act (DPPA), alleging Vertafore "knowingly disclosed" personal information by storing it on unsecured external servers.
The magistrate judge recommended the court find standing but conclude the complaint failed to plausibly allege a DPPA "disclosure" or that Vertafore acted knowingly for an improper purpose.
The district court adopted the recommendation and dismissed for failure to state a claim; plaintiffs appealed.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether storing driver data on unsecured external servers and subsequent unauthorized access constitutes a "disclosure" under the DPPA	Storing data on unsecured external servers made the information readily accessible and thus was a disclosure	Mere insecure storage and unlawful third-party access do not equal a statutory "disclosure" absent publication or facilitation by the data holder	No. The complaint did not plausibly allege a "disclosure"; unsecured storage plus unauthorized access is insufficient
Whether plaintiffs adequately alleged Vertafore acted knowingly and for an impermissible purpose under the DPPA	Alleged Vertafore "knowingly disclosed" by storing data on insecure servers	Complaint lacks factual allegations showing Vertafore knew of or intended an improper disclosure	Court did not reach this merits question because it disposed of the claim for failure to allege disclosure; dismissal affirmed

Kennedy v. Chase Manhattan Bank USA, N.A., 369 F.3d 833 (5th Cir. 2004) (standard of review for Rule 12(b)(6))
Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (plausibility standard for complaints)
Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (pleading must state plausible claim)
Cummings v. Premier Rehab Keller, P.L.L.C., 948 F.3d 673 (5th Cir. 2020) (treat well-pleaded facts as true on dismissal)
Inclusive Communities Project, Inc. v. Lincoln Prop. Co., 920 F.3d 890 (5th Cir. 2019) (plausibility over conceivability)
Lone Star Fund V (U.S.), L.P. v. Barclays Bank PLC, 594 F.3d 383 (5th Cir. 2010) (limits on materials considered on Rule 12(b)(6))
Reno v. Condon, 528 U.S. 141 (U.S. 2000) (DPPA regulates disclosure of DMV records)
Maracich v. Spears, 570 U.S. 48 (U.S. 2013) (legislative purposes behind DPPA)
Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. 2010) (elements of a DPPA claim)
Senne v. Village of Palatine, Ill., 695 F.3d 597 (7th Cir. 2012) (example of a physical placement constituting disclosure under DPPA)
Enslin v. Coca-Cola Co., 136 F. Supp. 3d 654 (E.D. Pa. 2015) (holding unsecured but private data storage is not a voluntary disclosure under DPPA)