Opinion
Case No. 4:09cv302-RH/WCS.
November 17, 2010.
Lance August Harke, Howard Mitchell Bushman, Harke Clasby Bushman LLP, Miami Shores, FL, Don Paul Saxton, Saxton Law Firm LLC, Mitchell L. Burgess, Burgess Lamb PC, Ralph K. Phalen, Law Offices of Ralph K. Phalen, Kansas City, MO, for Plaintiff.
Enoch Jonathan Whitney, Thomas F. Congdon, Florida Attorney General, Tallahassee, FL, for Defendants.
ORDER STRIKING THE DEFENDANTS' SECOND SUMMARY-JUDGMENT MOTION
This class action arises under the Driver's Privacy Protection Act, 18 U.S.C. §§ 2721- 25. The plaintiff asserts that the defendants — employees of the Florida Department of Highway Safety and Motor Vehicles — violated the Act by unlawfully disclosing personal information of Florida drivers in bulk.
The deadline for filing a summary-judgment motion was May 28, 2010. See Order of January 29, 2010, ECF No. 37. Each side filed a timely summary-judgment motion. The motions were denied on July 1, 2010. See Order Denying Summary-Judgment Motions, ECF No. 68.
Without seeking leave to file a further summary-judgment motion out of time, the defendants now have filed what amounts to an untimely second summary-judgment motion, relying in part on a substantially different theory of the case than the defendants asserted previously.
The plaintiff has moved to strike the second summary-judgment motion. This order grants the motion but does so without prejudice to the defendants' assertion of their new theory at trial. And a case-management conference will be set at which an issue will be the most efficient means for addressing the defendants' new theory.
I
The Driver's Privacy Protection Act (sometimes referred to in this order as "the Act") prohibits a state department of motor vehicles or its representative from disclosing "personal information" from driver records except as permitted by the statute. See 18 U.S.C. § 2721. "Personal information" means
information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status.Id. § 2725(3). The exceptions to the ban on disclosure include these:
(1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.
(2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.
(3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only —
(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and
(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.
(4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.
(5) For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.
(6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.
(7) For use in providing notice to the owners of towed or impounded vehicles.
(8) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.
(9) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver's license that is required under chapter 313 of title 49.
(10) For use in connection with the operation of private toll transportation facilities.
(11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.
(12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.
(13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.
(14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.18 U.S.C. § 2721(b).
A later provision limits the downstream disclosure of "personal information" by a person who receives it from a state or its representative:
Resale or redisclosure. — An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (12)). An authorized recipient under subsection (b)(11) may resell or redisclose personal information for any purpose. An authorized recipient under subsection (b)(12) may resell or redisclose personal information pursuant to subsection (b)(12). Any authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.18 U.S.C. § 2721(c).
II
The defendants worked for the Florida Department of Highway Safety and Motor Vehicles. They had a role in disclosing personal information of Florida drivers in bulk to a private corporation, Shadowsoft, Inc. Shadowsoft disclosed the information to another entity, The Source for Public Data, which in turn made the information available over the internet.
III
The Act explicitly creates a private right of action against a "person who knowingly obtains, discloses or uses personal information" other than for a permissible " purpose." Id. § 2724(a)(1) (emphasis added). Violations of the Act also are actionable under 42 U.S.C. § 1983. See Collier v. Dickinson, 477 F.3d 1306, 1310-11 (11th Cir. 2007).
As this language makes clear, a defendant who had a role in improperly disclosing a plaintiff's personal information is not necessarily liable to the plaintiff. The Act imposes liability only on a defendant who "knowingly" discloses information for an impermissible "purpose." So liability turns on what a defendant knows and on the defendant's purpose.
The same words are not used in § 1983, but § 1983 ordinarily requires that a defendant act intentionally or with deliberate indifference. So a defendant's knowledge remains part of the analysis.
Moreover, under both the Driver's Privacy Protection Act and § 1983, a defendant who is a public employee may invoke the defense of qualified immunity. Qualified immunity applies to damages claims against public employees and protects "all but the plainly incompetent or those who knowingly violate the law." Malley v. Briggs, 475 U.S. 335, 341, 106 S.Ct. 1092, 1096, 89 L. Ed. 2d 271 (1986). See generally Hope v. Pelzer, 536 U.S. 730, 122 S.Ct. 2508, 153 L. Ed. 2d 666 (2002); Harlow v. Fitzgerald, 457 U.S. 800, 102 S.Ct. 2727, 73 L. Ed. 2d 396 (1982). Thus a public employee may be held individually liable for damages only if, on the facts known or reasonably believed by the employee, the employee's conduct violates clearly established law.
IV
In their original, timely summary-judgment motion, the defendants asserted that they did not act with the requisite knowledge because Shadowsoft said it would use the information only for a permissible purpose. Indeed, the contract so required. But the contract did not articulate a permissible purpose for disclosing the information to Shadowsoft or for Shadowsoft's further disclosure of the information. Nor would an ostensible purpose — even one set out in a contract — necessarily establish the parties' actual purpose. See, e.g., Dixon County v. Field, 111 U.S. 83, 92, 4 S.Ct. 315, 28 L. Ed. 360 (1884) (stating that a recital in bonds under which they would conform to the law, when in fact they do not, "will not make them so"); United States v. Leonard, 529 F.3d 83, 90 (2d Cir. 2008) (collecting Supreme Court cases that rely on the substance of a transaction over contract formalisms in determining what constitutes a "security"); Daughtrey v. Honeywell, Inc., 3 F.3d 1488, 1492 (11th Cir. 1993) ("The employment status of an individual for the purposes of ERISA is not determined by the label used in the contract between the parties."); Spirides v. Reinhardt, 613 F.2d 826, 832-33 (D.C. Cir. 1979) ("Courts generally look to the substance of a contract rather than its form, and, although contract language may be indicative to some degree of the intention of the parties, it is not necessarily controlling.").
The order denying the defendants' first summary-judgment motion concluded — correctly — that the record did not establish the actual purpose for the defendants' disclosure of the personal information. It was true then, and it is still true, that the record does not establish without factual dispute (1) the actual purpose for making the information available to Shadowsoft, (2) whether, as required by § 2721(c), Shadowsoft and The Source for Public Data have limited their downstream disclosures to "a use permitted under" § 2721(b), or (3) whether the defendants knew or intended — or were deliberately indifferent to the possibility — that Shadowsoft or The Source for Public Data would make downstream disclosures in excess of those authorized by § 2721(c). The plaintiffs apparently assert — and for all this record reflects a reasonable fact finder could conclude — that the actual purpose for disclosing the information to Shadowsoft was to generate revenue for the state, without regard to the privacy interests of Florida drivers or to the strictures of the Drivers' Privacy Protection Act.
These conclusions remain correct even though the defendants have filed new declarations in support of the second summary-judgment motion. Moreover, the new declarations contradict the declarants' own prior deposition testimony in important respects and fail to provide an explanation for the discrepancy. To the extent of the conflict, the new declarations would not entitle the defendants to summary judgment, even if they would otherwise be sufficient to do so. See, e.g., Lattimer v. Roaring Toyz, Inc., 660 F.3d 1224, 1237 (11th Cir. 2010); Van T. Junkins Assocs., Inc. v. U.S. Indus., Inc., 736 F.2d 656, 657 (11th Cir. 1984) ("When a party has given clear answers to unambiguous questions which negate the existence of any genuine issue of material fact, that party cannot thereafter create such an issue with an affidavit that merely contradicts, without explanation, previously given clear testimony.").
V
There are good reasons for setting a deadline for a summary-judgment motion. A deadline ordinarily allows the parties and the court to avoid wasteful repetition and to plan wisely for the orderly presentation of the case. This case is an example: the defendants could have asserted all of their arguments from the outset, thus allowing the plaintiff to respond once, rather than twice, and allowing the court to address the issues once, rather than twice. By any measure, the defendants' approach has wasted their own resources and those of the plaintiff and the court. And the new motion has delayed the litigation.
It bears noting, too, that the defendants' first and second summary-judgment motions have both included plainly unfounded arguments that have served only to obscure any legitimate defenses. Thus, for example, the defendants seem to assert, in their second summary-judgment motion, that they are entitled to summary judgment because they are state employees whose actions accorded with state law; any violation, they seem to say, was only that of the state itself, not the employees. But the assertion that compliance with state law necessarily exonerates a state employee from liability under federal law is plainly wrong. Were it otherwise, the schools — or at least the state universities — might still be segregated. Indeed, acting under color of state law is a prerequisite to liability under § 1983, not a defense to liability under § 1983. Compliance with state law sometimes affects the qualified-immunity analysis, but qualified immunity is a defense only to a damages claim, not to a claim for injunctive or declaratory relief.
Leave to file the second summary-judgment motion, including assertions like this, will not be granted.
In reaching this conclusion, I have not overlooked the defendants' assertion that I have authority to reconsider a summary-judgment ruling prior to the entry of judgment. Of course I have that authority. But the only substantial basis for seeking reconsideration of the original ruling is a new theory that was not raised in the defendants' (timely) first summary-judgment motion. The fact that more recent decisions of other courts have accepted the new theory does not explain why the defendants did not raise the theory in their first motion. The issue now is not whether I should reconsider the denial of the earlier motion, but whether I should allow a new, untimely motion raising a new theory. As a matter of discretion, I choose — at least at this point, prior to convening a case-management conference — not to allow an out-of-time summary-judgment motion that raises a theory not presented earlier.
VI
The new theory does, however, merit discussion. The order denying the first summary-judgment motion said that state officials could disclose personal information to Shadowsoft only for a permitted purpose listed in § 2721(b). The order concluded:
A defendant will not be liable if two things are both true. First, when participating in the disclosure of the information to Shadowsoft, the defendant understood that Shadowsoft would hold the information and disclose it only for a permissible purpose, for example, to a legitimate business wishing "to verify the accuracy of personal information submitted by [an] individual to the business" or "to obtain the correct information" if the information provided by the individual is incorrect. 18 U.S.C. § 2721(b)(3). And second, when participating in the disclosure of the information to Shadowsoft, the defendant believed that in making any downstream disclosure for a permissible purpose, Shadowsoft would be acting "on behalf of [the Department of Highway Safety and Motor Vehicles] in carrying out its functions." Id. § 2721(b)(1). The same analysis — with an additional layer — would apply to any intentional disclosure to The Source for Public Data.
Order Denying Summary Judgment Motions, ECF No. 68 at 5 (emphasis added).
As the defendants correctly note in their second summary-judgment motion, the Fifth Circuit has more recently entered a ruling that, if followed here, would exonerate a defendant who meets the first of the two requirements set out in the Order Denying Summary-Judgment Motions, even if the defendant does not meet the second requirement. See Taylor v. Acxiom Corp., 612 F.3d 325 (5th Cir. July 14, 2010). A district court has reached a similar result. See Young v. W. Publ'g Corp., No. 09-22426-CIV, 2010 WL 2867699 (S.D. Fla. July 20, 2010); see also Graczyk v. W. Publ'g Corp., No. 09 C 4760, 2009 WL 5210846 (N.D. Ill. Dec. 23, 2009); Russell v. ChoicePoint Servs., Inc., 300 F. Supp. 2d 450 (E.D. La. 2004). The theory, essentially, is that when a state discloses personal information to a reseller who will further disclose the information for a use permitted under § 2721(b), the state discloses the information "for" the permitted use, even if that was not the state's own purpose in disclosing the information to the reseller. Under this theory, a state's disclosure to a reseller who would in turn disclose the information for a permitted use would be proper, even if the reseller would not be acting "on behalf of [the Department of Highway Safety and Motor Vehicles] in carrying out its functions." § 2721(b)(1). The theory might be correct and, even if not correct, might at least exonerate the defendants from the damages claim — on the ground that they did not violate clearly established law. These issues will need to be addressed in due course.
VII
For these reasons,
IT IS ORDERED:
1. The plaintiff's motion, ECF No. 72, to strike the defendants' second summary-judgment motion, ECF No. 71, is GRANTED. The second summary-judgment motion is struck.
2. By separate notice, the clerk must set a case-management conference by telephone for the first available time on or after December 1, 2010. The attorneys must confer in advance on the schedule for further proceedings, including the most efficient method for submitting the defendants' new theory, whether the case should be mediated, and when the case should be set for trial.