This appeal arises from a series of multidistrict litigation cases regarding the disclosure and use of drivers’ personal information under the Driver’s Privacy Protec
*1218
tion Act of 1994 (“DPPA”), 18 U.S.C. §§ 2721-25. The plaintiff-appellants are Florida drivers who received automobile registration renewal mailings from the state, which included advertisements and solicitations. The registration renewals were distributed pursuant to a contract between the Florida Department of Highway Safety & Motor Vehicles (“Florida DHSMV”) and the defendant-appellee, Imagitas, Inc.
1
(“Imagitas”). The plaintiff-appellants assert that use of personal information by the state or its contractors to send commercial solicitations to non-consenting Florida drivers violated the DPPA. Imagitas maintains that its DriverSource program is a permissible use of drivers’ personal information under the DPPA. The district court granted summary judgment holding that “Imagitas has not violated the DPPA in its implementation of the DriverSource program in Florida.”
In re Imagitas, Inc., Drivers’ Privacy Protection Act Litigation,
Nos. 3:07-md-2-J-32HTS, 3:06-cv-690-J-32HTS,
I. BACKGROUND
A. Factual Background
States require individuals to provide personal information, such as name, address, telephone number, Social Security number, medical information, and photograph, as a condition of obtaining a driver’s license or registering an automobile.
See Reno v. Condon,
Responding to privacy and safety concerns, Congress enacted the DPPA to regulate the disclosure and resale of an individual’s personal information from state motor vehicle records. “The DPPA generally prohibits any state DMV, or officer, employee, or contractor thereof, from ‘knowingly disclos[ing] or otherwise mak[ing] available to any person or entity personal information
2
about any individual obtained by the department in connection with a motor vehicle record.
3
’ ”
Condon,
The DPPA’s prohibition against disclosure does not apply if a driver consents to the release of their personal information. As originally enacted, the DPPA contained an opt-out provision which allowed individuals to request that their personal information not be released for marketing purposes.
See
Pub.L. 103-322,108 Stat. 1796, § 300002. If a driver failed to opt-out, their consent to the release of personal information was implied. However, in October 1999 Congress amended the DPPA
*1219
to change the opt-out provision to an express consent opt-in requirement.
See
Pub.L. 106-69, 113 Stat. 986, §§ 350(c), (d), and (e). Under the amended DPPA, states must “obtain a driver’s affirmative consent to disclose the driver’s personal information for use in surveys, marketing, solicitations, and other restricted purposes.”
Condon,
In addition to the express consent provision, the DPPA contains a number of statutory exceptions to the general prohibition against disclosure of drivers’ personal information. See id. In fact, the DPPA requires disclosure of personal information to ensure compliance with various federal statutes concerning motor vehicle safety, theft, and emissions. See 18 U.S.C. § 2721(b). The DPPA also permits disclosure of personal information for a number of limited purposes. See id. One such purpose is to allow government agencies to carry out their functions. See 18 U.S.C. § 2721(b)(1). Under that exception, disclosure is permitted “[f]or use by any government agency” or “any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.” Id.
While the DPPA primarily addresses the disclosure of drivers’ personal information, the DPPA also makes it “unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a) (emphasis added). Thus, third parties who obtain drivers’ personal information for other than a permissible use, are in violation of the DPPA. To ensure compliance, the DPPA provides a civil cause of action to drivers whose personal information has been obtained, disclosed, or used by a person 4 in violation of the DPPA. See 18 U.S.C. § 2724.
As mentioned previously, Florida has a history of generating revenue through the sale of drivers’ personal information. In May 2004, almost four years after the effective date of the DPPA amendment, Florida amended its public records statute to comply with the DPPA’s express consent requirements. See Fla. Stat. § 119.07(3)(aa)(12). However, Florida continued to utilize drivers’ personal information for advertising purposes through a newly formed partnership with the marketing company Imagitas. In July 2004, Imagitas entered into a five year contract with the Florida DHSMV to develop, produce, and distribute registration renewal notices to Florida drivers in participating counties. 5 The registration renewal notices were mailed in official envelopes, which included public service and commercial advertising inserts. Florida’s contract with Imagitas has since ended.
In accordance with their agreement, Imagitas mailed renewal notices to Florida drivers whose motor vehicle registration was scheduled to expire the following month. Imagitas placed public service information mandated by Florida law and commercial solicitations from it’s client-advertisers in the renewal envelopes. Imagitas marketed this service to advertisers as its DriverSource program. Advertisers included Ford Motor Company, Sirius Radio, Home Depot, and DirecTV among others. Advertising revenues were intended *1220 to offset the costs of producing and mailing registration renewals, saving Florida counties from the expense. 6 After program costs and overhead were covered, any remaining profits were shared by Florida and Imagitas. 7
The entire DriverSource program was subject to DHSMV review and Florida controlled all content within the renewal envelopes. Under the terms of the contract, Florida approved each advertisement in writing and retained the right to reject any ads that “may conflict with the best interest of the state at the [DHSMVs] discretion.” DHSMV Contract No. M001-05. In addition, the terms of the contract required the advertising to be in accordance with Florida Statute § 283.58, which authorizes state agencies to “[ejnter into agreements with private vendors for the publication or production of such public information materials ... in return for the right to select, sell, and place advertising that publicizes products or services related to and harmonious with the subject matter of the publication.” Fla. Stat. § 283.58(l)(a).
The Florida DHSMV periodically furnished Imagitas with both a renewal file and a registration file for the DriverSource program. The renewal file, which was updated monthly, contained information on only those drivers scheduled to receive a reminder notice that month. The registration file, which was updated weekly, contained information on all registered drivers within Florida. Together, these files allowed Imagitas to generate a “household view,” which included detailed information about all registered drivers at a particular address. The “household view” allowed Imagitas to selectively target advertising based not only on the vehicle that was up for renewal, but on all vehicles owned by drivers living in the same household. During negotiations with the DHSMV, Imagitas maintained that the “household view” was absolutely critical to creating an effective and economically sustainable advertising program. Neither file was released by Imagitas to its client-advertisers and such release was expressly forbidden by its contract with the DHSMV. Under the contract, Florida retained full ownership of both the renewal and registration files. As such, Imagitas never acquired ownership rights in any of Florida’s data.
In addition to drivers’ personal information, Imagitas analyzed drivers’ vehicle information to develop a marketing profile for each household. Imagitas’s proprietary segmented advertising model used the vehicle identification number, the date of purchase, and the five-digit zip code in determining advertisement placement. The vehicle identification number allowed Imagitas to determine the year, make, and model of each automobile, while the purchase date indicated whether the vehicle was purchased new or used. Once detailed vehicle information was determined for each driver, Imagitas cross-referenced all mailing addresses in the database so that drivers at the same mailing address were treated as a single household. Each household’s vehicle information and five-digit zip code were then used to determine advertisement placement.
B. Procedural Background
Marvin N. Riñe, Jacalyn Smith, Martin Martinez, Violet Beckman, and Randall Heavrin (“plaintiff-appellants”), are Flori *1221 da drivers who received registration renewal mailings from the State of Florida with enclosed advertisements and solicitations pursuant to Florida’s contract with Imagitas. In August 2006, plaintiff-appellants brought this class action against Imagitas on behalf of themselves and all others similarly situated. Plaintiff-appellants allege that, without express consent, Imagitas obtained their personal information from the Florida DHSMV and used that information for a purpose not permitted under the DPPA. Specifically, plaintiff-appellants allege that Imagitas used their personal information for commercial advertising purposes by inserting targeted advertisements and solicitations into the registration renewal mailings. Plaintiff-appellants seek statutory damages of $2,500 for each class representative and class member of 13,700,000 Florida drivers whose personal information was obtained or used in violation of the DPPA.
Nine lawsuits were brought against Imagitas in the following districts: one case in the Middle District of Florida, one case in the Southern District of Florida, two cases in the District of Massachusetts, one case in the District of Minnesota, one case in the Western District of Missouri, one case in the Southern District of New York, and two cases in the Northern District of Ohio. Following our February 2007 decision in
Collier v. Dickinson,
In May 2007, the Judicial Panel on Multidistrict Litigation (“JPML”) ordered that all cases against Imagitas be transferred to the Middle District of Florida for coordinated treatment. Several months later, the JPML also transferred the cases against state officials to the Middle District of Florida. In all, thirteen cases have been coordinated in the Middle District of Florida. The district court determined that the Florida cases should proceed first and ordered a discovery period to be followed by summary judgment motions. Prior to the summary judgment deadline, plaintiff-appellants announced that they had reached a settlement with the Florida state officials. 8 After the Minnesota, Missouri, and Ohio state officials moved to dismiss on qualified immunity grounds, plaintiff-appellants voluntarily dismissed those lawsuits.
In October 2007, Imagitas filed its Motion for Summary Judgment asserting that plaintiff-appellants’ complaint “does not establish a DPPA violation.” Specifically, Imagitas argued that (1) the DPPA does not prohibit states from sharing personal information with its own contractors, (2) the DPPA expressly permits Florida’s disclosures to Imagitas, and (3) the DPPA does not prohibit Florida’s inclusion of solicitations within its registration renewal envelopes. Imagitas also argued that interpreting the DPPA to prevent Florida from using its own information for advertising purposes would violate the First Amendment and that Imagitas is entitled to qualified immunity.
In April 2008, the district court granted Imagitas’s motion for summary judgment holding that “[its] DriverSource program,
*1222
as operated under Imagitas’ contract with Florida, does not violate the ‘letter’ of the DPPA.”
In re Imagitas,
II. STANDARD OF REVIEW
We review the district court’s grant of summary judgment
de novo,
viewing all evidence and any reasonable inferences that might be drawn therefrom in the light most favorable to the non-moving party.
See Acevedo v. First Union Nat. Bank,
III. DISCUSSION
This appeal raises questions concerning what states and their contractors can or cannot do under the DPPA. Specifically, is the act of mailing notices to registered vehicle owners reminding them of the need to complete an annual registration a government function? If so, can the state of Florida include advertisements in such a notice in an effort to generate revenue to offset the cost? If such is a permissible government function, can the state of Florida accomplish this through a contractor? Resolving these questions requires that we engage in an exercise of statutory interpretation.
“As with any question of statutory interpretation, we begin by examining the text of the statute to determine whether its meaning is clear.”
Harry v. Marchant,
Plaintiff-appellants allege that Imagitas violated section 2722(a) of the DPPA, which states: “It shall be unlawful for any person knowingly to obtain or disclose per *1223 sonal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title.” 18 U.S.C. § 2722(a). Imagitas does not dispute that it qualifies as a person under the DPPA and that it knowingly obtained personal information from a motor vehicle record. Imagitas obtained drivers’ names and addresses pursuant to its contract with the Florida DHSMV. As such, the question of Imagitas’s liability is limited to whether its use of plaintiff-appellants’ personal information is permitted under section 2721(b). Put another way, Imagitas is only hable if its DriverSource program was not a permissible use under section 2721(b).
Section 2721(b) authorizes the disclosure of drivers’ personal information for fourteen permissible uses. See 18 U.S.C. § 2721(b)(l)-(14). Imagitas argues that subsection 2721(b)(1), which permits disclosure of personal information “[f]or use by ... any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions,” expressly permits the DriverSource program. 18 U.S.C. § 2721(b)(1). Application of this subsection to Imagitas’s DriverSource program brings us to the heart of the dispute and requires the resolution of two main issues: first, whether the DriverSource program is carrying out a function of the Florida DHSMV; and second, whether Imagitas is a private entity “acting on behalf of’ the Florida DHSMV.
A. Is the DriverSource program carrying out a function of the Florida DHSMV?
Plaintiff-appellants do not dispute that mailing registration renewal notices is a legitimate function of the Florida DHSMV. The dispute here centers on whether the inclusion of commercial advertising in renewal envelopes is a legitimate agency function. However, the DPPA does not define what it means by an agency function. Because the DPPA is a federal statute, its interpretation is a matter of federal law.
See Stein v. Paradigm Mirasol, LLC,
Funding public programs through commercial advertising is a legitimate agency function within Florida. Through various enabling statutes, Florida encourages its agencies to take advantage of commercial advertising to offset program costs and raise revenues. Imagitas relies heavily on Florida Statute § 283.58, which permits Florida agencies to “place advertising” in public information materials as a way of paying “the costs of [the materials’] publication or production....” Fla. Stat. § 283.58(l)(a). In addition to public information materials, Florida permits commercial advertising on public transportation benches and shelters, see Fla. Stat. § 337.408(1), highway right-of-ways, see Fla. Stat. § 479.261, and highway rest area information panels, see Fla. Stat. § 479.28(3). Florida’s contract with Imagitas stated “[t]he purpose of the sale of advertisements for inclusion in the mailings is to secure the distribution of public information materials free to the public, and at no cost to the state....” ITN No. 010-04 § 4.7. As such, the DriverSource *1224 program is carrying out a function of the Florida DHSMV.
B. Is this agency function preempted by the DPPA?
While state agency functions are defined almost exclusively by state law, an otherwise legitimate agency function may be preempted by federal law. Under the Supremacy Clause, any state law that conflicts with federal law is preempted.
Gibbons v. Ogden,
Plaintiff-appellants claim that section 2721(a), which provides that states “shall not knowingly disclose or otherwise make available to any person or entity” drivers’ personal information, 18 U.S.C. § 2721(a) (emphasis added), prohibits Florida from utilizing targeted advertising such as the DriverSource program. Plaintiff-appellants argue that Florida makes drivers’ personal information available to advertisers by sending their targeted solicitations to non-consenting drivers.
Congress wrote section 2721(a) in the disjunctive, which “indicates alternatives and requires that those alternatives be treated separately.”
Brown v. Budget Rent-A-Car Sys., Inc.,
C. Was Imagitas acting on behalf of the Florida DHSMV?
Having determined that the DriverSource program was a legitimate agency function, we now turn to whether Imagitas was a private entity acting on behalf of the Florida DHSMV.
See
18 U.S.C. § 2721(b)(1). Because the phrase “on behalf of’ is not defined in the DPPA, we again look to its ordinary meaning.
See Garcia,
In the district court, Plaintiff-appellants argued that Imagitas was not acting on Florida’s behalf. Plaintiff-appellants raised multiple arguments asserting that Florida’s contract with Imagitas did not require advertising, that Imagitas acted outside of its contract, and that Imagitas was an independent contractor rather than Florida’s agent. The district court rejected these arguments. On appeal, plaintiff-appellants have not restated these arguments nor contended that the district court wrongly decided this issue. Rather, plaintiff-appellants now claim that Imagitas acted on behalf of its advertising clients rather than the Florida DHSMV. We disagree.
Florida Statute § 283.58, authorizes state agencies to “[ejnter into agreements with private vendors” to publish or produce public information materials, financed by the vendor’s right to “select, sell, and place advertising.... ” Fla. Stat. § 283.58(l)(a). Florida’s contract with Imagitas was such an agreement. Prior to entering into its contract with Imagitas, Florida issued an Invitation to Negotiate (“ITN”), which invited private companies to bid on a state contract for furnishing and mailing notices to renew vehicle registrations in containers including public information and advertising. See ITN No. 010-04. The ITN requested proposals by which the advertising revenue would “secure the distribution of public information materials free to the public, and at no cost to the state....” ITN No. 010-04 § 4.7. This evidence demonstrates that the Florida DHSMV actively sought a private entity to administer this program on its behalf. While Imagitas developed and submitted details for the DriverSource program, the initial concept was Florida’s design. Moreover, Florida retained control over the entire DriverSource program. Florida never relinquished ownership of its motor vehicle records and “[t]he entire advertising program [was] subject to DHSMV review.” Technical Proposal § 2.6.2.6. Florida could even require the inclusion of public service information of its choosing. Thus, Imagitas’s administration of the DriverSource program was on behalf of the Florida DHSMV.
Based on the foregoing analysis, we conclude that Imagitas was a private entity acting on behalf of the Florida DHSMV in carrying out its functions. As such, Imagitas obtained drivers’ personal information for a permissible use under section 2721(b)(1) of the DPPA.
D. Does § 2721(b) (12) have to be complied with instead?
Plaintiff-appellants argue that even if subsection 2721(b)(1) generally applies, subsection 2721(b)(12), which specifically addresses the bulk distribution of marketing and solicitation materials, must be complied with instead. Plaintiff-appellants rely on
HCSC-Laundry v. United States
for this conclusion.
Imagitas claims that
Connecticut National Bank v. Germain,
is controlling.
This case more closely resembles
Germain
than
IICSC.
The general/speeific principle of statutory construction, which the Court applied in
HCSC,
is not applicable here because subsection (b)(1) is just as specific as subsection (b)(12). Both are exceptions to the general prohibition against the disclosure of drivers’ personal information. Subsection (b)(1) applies to a situation not addressed by subsection (b)(12) and
vice versa.
Like
Germain,
this case involves two statutory provisions that potentially apply. While these provisions may overlap, they both apply to situations not governed by the other and both must be given effect unless they “pose an either- or proposition.”
Germain,
IV.
Plaintiff-appellants argue that Imagitas and the State of Florida are doing an “end run” around the DPPA, and indeed, the district court thought such an argument was not unreasonable. That may or may not be true. Congress knew what the states were doing when it passed the DPPA. There is nothing in the federal statute that prevents states from including advertisements in such renewal notices and the same statute specifically allows states to operate though private contractors. If this is a loop hole, Congress can remedy this situation. However, we can just as easily conclude that Congress knew exactly what it was doing and through the DPPA put broad limits on the disclosure of personal information while not preventing state agencies from using this method to pay for the cost of such governmental notices.
For the foregoing reasons, the summary judgment of the district court is,
AFFIRMED.
Notes
. Imagitas, Inc., a wholly owned subsidiary of Pitney Bowes, Inc., is a marketing company that has engaged in partnerships with government agencies to combine marketing materials with government informational publications distributed through public mailings and websites. Examples include change of address forms and new resident welcome kits from the United States Postal Service.
. The DPPA defines personal information as "information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status." 18 U.S.C. § 2725(3).
. The DPPA defines motor vehicle record as "any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles.” 18 U.S.C. § 2725(1).
. The DPPA defines person as "an individual, organization or entity, but does not include a State or agency thereof.” 18 U.S.C. 2725(2). Thus, the State of Florida is not a person under the DPPA and is not liable for disclosing drivers' personal information in violation of the DPPA.
. Approximately twenty Florida counties used Imagitas to produce and mail registration renewal notices, including Columbia County, where plaintiff-appellants reside.
. Although not statutorily required, Florida may remind drivers by mail to renew their vehicle registration. See Fla. Stat. § 320.031(1). Florida county tax collectors are responsible for these mailings. See Fla. Stat. §§ 320.030-.031.
. Florida’s share in the profits was negligible, ranging from zero to three percent.
. Despite the parties filing a "Joint Notice of Agreement to Settle” and a subsequent "Letter of Understanding” in October 2007, the case against the Florida state officials appears to remain unresolved.
