483 F.Supp.3d 318
W.D.N.C.
2020
Read the full case

Background

  • Plaintiffs Deloris and Leonard Gaston sued LexisNexis Risk Solutions and PoliceReports.US (PRUS) under the Driver’s Privacy Protection Act (DPPA) after unredacted CMPD DMV-349 crash reports containing their personal information were made available online and to subscription customers.
  • CMPD officers use electronic crash-reporting software (Report Beam) with an F11 function that can populate report fields from DMV/NCIC data; reports also include a checkbox: “Same address as driver’s license.”
  • PRUS obtained and resold thousands of CMPD crash reports (allegedly >250,000) with no redaction and without recording permissible DPPA purposes for downstream users; some subscribers used the data for marketing/solicitation.
  • Plaintiffs sought nationwide and state subclasses and both injunctive relief and statutory (liquidated) damages; defendants argued variable report creation, permissive government-function use, and immunity.
  • The Court certified a limited Rule 23(b)(2) injunctive class (North Carolina CMPD DMV-349 reports, Jan. 12, 2012–Sept. 1, 2020) and a subclass for reports indicating “Same address as driver’s license”; nationwide and Rule 23(b)(3) damages classes were denied.
  • The Court granted injunctive/declaratory relief for the certified subclass (finding those reports are "motor vehicle records" under the DPPA), denied defendants’ summary judgment, and left statutory liquidated-damages claims for trial due to disputed facts on improper use.

Issues

Issue Plaintiff's Argument Defendant's Argument Held
Are CMPD DMV-349 crash reports (or personal info therein) “motor vehicle records” under the DPPA? Crash reports that show the address is the same as on the driver’s license or that are populated from DMV databases "pertain to" driver’s licenses and qualify as motor vehicle records. Crash reports are prepared variably; information may not come from DMV records or a driver’s license, so they are not uniformly motor vehicle records. The Court held that reports with the "Same address as driver’s license" box checked (and reports that otherwise pertain to a DMV record) are motor vehicle records under the DPPA.
Class certification — are proposed classes ascertainable, common, typical, and appropriate under Rule 23(b)? Plaintiffs: class members are identifiable from crash reports; common proof (report form, software practice) supports classwide issues; injunctive and damages classes appropriate. Defendants: source and use of each report vary, requiring individualized inquiries; nationwide scope raises jurisdictional concerns. The Court found the class ascertainable, common, typical, and adequate for a limited Rule 23(b)(2) injunctive class confined to NC CMPD reports and denied nationwide and Rule 23(b)(3) damages class certification.
Is disclosure by PRUS/ LexisNexis a permissible government-function use under 18 U.S.C. § 2721(b)(1)? Plaintiffs: DPPA limits disclosure of personal info even if report is a public record — public-record status cannot defeat DPPA protections. Defendants: making crash reports publicly available for CMPD/public-record purposes qualifies as a permissible governmental use. The Court rejected the government-function defense: public-record status does not override DPPA restrictions, and defendants are not entitled to summary judgment on that ground.
Are defendants entitled to qualified immunity or a private cause of action for failure to comply with § 2721(c) recordkeeping? Plaintiffs: defendants violated § 2721(c) by failing to keep use records and are liable under § 2724(a) for improper disclosures. Defendants: claim qualified immunity and argue § 2721(c) has no private right of action; some disclosures were permissible. The Court held defendants are not entitled to qualified immunity here and that § 2721(c) recordkeeping violations do not create a separate private cause of action under § 2724(a).

Key Cases Cited

  • Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011) (Rule 23 rigorous commonality/typicality analysis)
  • Krakauer v. Dish Network, L.L.C., 925 F.3d 643 (4th Cir. 2019) (class-action standards; ascertainability and injunctive class discussion)
  • Amgen Inc. v. Connecticut Retirement Plans & Trust Funds, 568 U.S. 455 (2013) (limits on merits inquiries at certification)
  • Maracich v. Spears, 570 U.S. 48 (2013) (DPPA interpretation — marketing not a permissible use)
  • Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (statutory violations can confer concrete injury for standing)
  • Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (Article III standing requirements)
  • Harlow v. Fitzgerald, 457 U.S. 800 (1982) (qualified immunity standard)
  • Tyson Foods, Inc. v. Bouaphakeo, 136 S. Ct. 1036 (2016) (representative/aggregate proof permissible in class actions)
  • Celotex Corp. v. Catrett, 477 U.S. 317 (1986) (summary judgment burden-shifting)
  • Anderson v. Liberty Lobby, Inc., 477 U.S. 242 (1986) (summary judgment standard on genuine dispute of material fact)
Read the full case