Howard v. CRIMINAL INFORMATION SERVICES, INC.

OPINION CLIFTON, Circuit Judge: These appeals involve two essentially identical actions filed in two different states, Oregon and Washington, by different groups of Plaintiffs, each of which seeks to represent a class. The actions seek damages on the ground that Plaintiffs’ personal information was obtained by Defendants in violation of the Driver’s Privacy Protection Act (“DPPA”), 18 U.S.C. §§ 2721-2725. That statute provides that personal information from state driver license databases can be obtained, disclosed, or used only for certain specified purposes. Each of the Defendants purchased driver record information in bulk so it would have the information available for its future use. Plaintiffs do not complain that the ultimate use of the information by any of the Defendants was for purposes not permitted under the DPPA. They argue, however, that the DPPA forbids bulk purchasing of drivers’ personal information for future use because obtaining the information for future use is not itself a permitted purpose *889 under the DPPA. Joining other courts which have dealt with similar claims, we conclude that Defendants’ actions were not unlawful under the DPPA and affirm the dismissal of the actions by the district courts. I. Background States collect personal information about individuals who obtain driver licenses including “name, address, telephone number, vehicle description, Social Security number, medical information, and photograph.” Reno v. Condon, 528 U.S. 141, 143, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). This information is included in a database containing the personal information of all drivers licensed in the state. “States, in turn, sell this personal information to individuals and businesses.” Id. Defendants are companies engaged in a variety of businesses that utilize the information from driver records in various ways. For example, Oregonian Publishing is a newspaper company that uses the information in reporting stories involving the operation or safety of motor vehicles. Criminal Information Services, Inc. is a company that performs background checks. It uses the information to verify personal information submitted by the person about whom the background check is being performed. Automotive.com uses the information to perform research about motor vehicles. AMPCO is a parking lot management business that uses the information to check information provided by its customers and to provide notice to owners of towed or impounded vehicles. For these companies it is neither efficient nor cost-effective to request records individual- ly each time they have a need for the information or to be limited to getting the information during business hours when the state agency is open. Instead, they purchase the entire database from the state and access specific information when the need arises. The DPPA enumerates specific purposes for which it is permissible to obtain, disclose, or use personal information contained in a motor vehicle record. Plaintiffs allege that purchasing the entire database for future use, which Plaintiffs refer to as stockpiling, is not a permitted purpose under the DPPA. 1 Both cases were dismissed on the ground that Plaintiffs failed to state a claim under the DPPA, with both district courts rejecting Plaintiffs’ argument that acquiring the information in bulk and stockpiling it was an improper purpose under the statute. Plaintiffs appealed the decisions in both cases. We consolidated the appeals for argument and now consolidate them for decision. II. Discussion The DPPA was enacted as an amendment to the Violent Crime Control and Law Enforcement Act of 1994. It seeks to curtail the improper sale of personal information from motor vehicle records while allowing individuals, governments, and businesses to access the information if they have acceptable reasons. The DPPA has two main parts. First, it enumerates purposes for which personal information from a motor vehicle record can be disclosed. 2 *890 Second, the DPPA creates several enforcement mechanisms. One mechanism is a civil action against any “person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted [by the DPPA].” 18 U.S.C. § 2724(a). Section 2724(a) “sets forth the three elements giving rise to liability, ie., that a defendant (1) knowingly obtained, disclosed or used personal information, (2) from a motor vehicle record, (3) for a purpose not permitted.” Thomas v. George, Hartz, Lundeen, Fulmer, John-stone, King and Stevens, P.A., 525 F.3d *891 1107, 1111 (11th Cir.2008). The burden of proving these elements is on the plaintiffs. Id. at 1113. The grant of a motion to dismiss is reviewed de novo. Cohen v. Stratosphere Corp., 115 F.3d 695, 700 (9th Cir.1997). We must construe the allegation made in the complaints in Plaintiffs’ favor. Gordon v. City of Oakland, 627 F.3d 1092, 1095 (9th Cir.2010). We conclude that Plaintiffs have not stated a claim because stockpiling information for a permitted use does not constitute a violation under the DPPA. Plaintiffs’ allegation that Defendants obtained the information for the improper purpose of stockpiling misconstrues the meaning of “purpose.” Purpose is defined as “something that one sets before himself as an object to be attained; an end or aim to be kept in view.” Webster’s Third New International Dictionary (2002) 1847; see Merriam-Webster’s Collegiate Dictionary, 10th ed. (2002) 947 (“something set up as an object or end to be attained”); Black’s Law Dictionary 9th ed. (2009) 1356 (“an objective, goal, or end”). Stockpiling was plainly not Defendants’ purpose for obtaining the information, as that term is used in the statute. The object or end to be attained by Defendants in obtaining the driver record information — the reason they wanted the information — was not just to have it available. Defendants obtained the information so that they would be able to use it. Plaintiffs do not allege that the ultimate uses intended by Defendants, such as checking the information of customers or in connection with matters of motor vehicles or driver safety, were not permitted purposes. Plaintiffs’ argument confuses Defendants’ purposes for obtaining the information with Defendants’ reasons for obtaining the information in bulk form. It is certainly true that Defendants had one or more reasons for obtaining the information in bulk. By purchasing the entire database in bulk rather than waiting to obtain individual records when they were needed, Defendants no doubt wanted to make their access to the information easier when the time came to use it and probably hoped to get the information at less cost as compared with the expenses of requesting one record at a time. But that was not, in any real sense, the “purpose” for obtaining the information. Someone who buys toilet paper in a package of 48 rolls from a warehouse store, for example, ordinarily buys it for the same purpose as the person who buys it one roll at a time. That it might save money or extra trips to the store to buy in bulk isn’t why the toilet paper is bought in the first place. The DPPA is concerned with the use to which the information will be put. The portion of the statute that lists the permissible reasons for getting the information,, subsection 2721(b), is entitled “Permissible uses.” The list of permissible purposes repeatedly speaks in terms of the “use” to which the information will be put. See note 2 above. If Congress aimed to prohibit the sale of a state’s driver record database in bulk, the statute could have and presumably would have said as much. Instead, the statute was written in a way that logically put the focus on the purposes for which the information would eventually be used — on the “end” sought by the purchaser — not on the reason for buying it in bulk. Plaintiffs argue that the DPPA prohibits more than just the “use” of driver information, noting that a civil action for damages may be brought against any “person who knowingly obtains, discloses or uses personal information ... for a purpose not permitted.” 18 U.S.C. § 2724(a) (emphasis added). Thus, they contend, we should *892 separately examine the “purpose” Defendants had for “obtaining” the information, separate from the ultimate use of the information. But the portion of the statute that expresses the permissible purposes explicitly does so in terms of the “use” of the information. That is what should be considered in determining whether the acquisition of the information is permitted under the statute. There is also no problem with Defendants obtaining the personal information for potential future use, even if they may never use it. The DPPA does not contain a temporal requirement for when the information obtained must be used for the permitted purpose. Nor is there a requirement that once the information is obtained for a permitted purpose that it actually be used at all. The DPPA only requires that Defendants obtained the information for a permitted purpose. Plaintiffs have not alleged that Defendants have used the information for a purpose not permitted, nor have they disputed Defendants’ statements that they only access or use information about a specific individual when they have a permitted purpose. Two other circuits have addressed similar claims, the Fifth and Sixth Circuits, and both have rejected them. See Taylor v. Acxiom Corp., 612 F.3d 325, 340 (5th Cir.2010), cert. denied -U.S. -, 131 S.Ct. 908, 178 L.Ed.2d 804 (2011) (“A person who buys DMV records in bulk does so for the purpose of making permissible actual use of information therein under [the DPPA], even if that person does not actually use every single item of information therein.”); Roth v. Guzman, 650 F.3d 603, 614-17 (6th Cir.2011) (citing Taylor). We agree. III. Conclusion We conclude that Plaintiffs have failed to allege that Defendants had an improper purpose under the DPPA for obtaining their personal information. The complaints were properly dismissed for failure to state a claim. AFFIRMED. Footnotes [1] Specifically, they allege, using identical language in the two complaints, that Defendants have obtained the personal information "so that [they] could save [themselves] time and/or money by not having to go back to the state[s'] offices each time [they] ‘might’ need addition information.” [2] 18 U.S.C. § 2721(b) provides: (b) Permissible uses. — -Personal information referred to in subsection (a) shall be disclosed for use in connection with matters of motor vehicle or driver safety and theft, motor vehicle emissions, motor vehicle product alterations, recalls, or advisories, *890 performance monitoring of motor vehicles and dealers by motor vehicle manufacturers, and removal of non-owner records from the original owner records of motor vehicle manufacturers to carry out the purposes of titles I and IV of the Anti Car Theft Act of 1992, the Automobile Information Disclosure Act (15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.), and chapters 301, 305, and 321-331 of title 49, and, subject to subsection (a)(2), may be disclosed as follows: (1) For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions. (2) For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers. (3) For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only— (A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and (B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual. (4) For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court. (5) For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals. (6) For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting. (7) For use in providing notice to the owners of towed or impounded vehicles. (8) For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection. (9) For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under chapter 313 of title 49. (10) For use in connection with the operation of private toll transportation facilities. (11) For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains. (12) For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains. (13) For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains. (14) For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety- 18 U.S.C. § 2721(b).