854 F.3d 1298
11th Cir.2017Background
- Kimberly Hastie, Mobile County License Commissioner, obtained county residents’ email addresses from the License Commission’s DMV-related database and gave them to a mayoral campaign, which sent a mass endorsement email. Hastie later denied releasing the list.
- Brad Bray, IT manager, exported the email list to a flash drive after refusing to send the campaign email directly; Hastie’s secretary received the drive and passed addresses to the campaign.
- Hastie was indicted and tried; Count 17 charged a DPPA violation for knowingly disclosing “personal information” obtained from a State department of motor vehicles to a third party for an impermissible purpose.
- At trial the district court instructed the jury that “personal information” under 18 U.S.C. § 2725(3) includes an individual’s email address, and that the government must prove Hastie was an officer/employee/contractor of a State DMV.
- The jury convicted Hastie on the DPPA count; the district court denied acquittal and sentenced her to a $5,000 fine.
- On appeal the Eleventh Circuit affirmed, holding (1) sufficient evidence supported that the Mobile County License Commission functions as part of the State DMV system (so Hastie was an officer/employee) and (2) the statutory phrase “information that identifies an individual” encompasses email addresses.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether § 2725(3) “personal information” includes email addresses | Hastie: email addresses are not listed in the DPPA examples and thus are not covered | Government: email addresses identify individuals and are like listed examples (address, phone) and the list is illustrative ("including") | Held: Email addresses fall within “information that identifies an individual”; district court’s instruction was correct |
| Whether License Commissioner was an officer/employee of a “State department of motor vehicles” under § 2721(a) | Hastie: Mobile County License Commission is not literally a State DMV so DPPA does not apply | Government: Commission performs core DMV functions, is subject to state oversight, remits fees to state and participates in state system | Held: Sufficient evidence supported the jury’s finding that Hastie was an officer/employee of a State DMV |
Key Cases Cited
- United States v. Gaudin, 515 U.S. 506 (Sup. Ct.) (jury must decide every element of the offense)
- Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937 (7th Cir.) (non-unique identifiers may still be "personal information" under the DPPA)
- United States v. Goetz, 746 F.2d 705 (11th Cir.) (trial court erred by applying law to facts and effectively directing verdict on an element)
- United States v. Wilson, 788 F.3d 1298 (11th Cir.) (statutory construction in post-trial sufficiency review regarding “means of identification”)
- Sullivan v. Louisiana, 508 U.S. 275 (Sup. Ct.) (jury verdict requirement and harmless-error principles)