Charles Davenport v. Farmers Ins. Group

HEANEY, Circuit Judge. Plaintiffs Charles Davenport and Brent Johnson brought this suit on behalf of themselves and others similarly situated, alleging that Defendants Farmers Insurance Group, Illinois Farmers Insurance Company, Paul Peterson, and Does 1 through 50 (collectively referred to as Farmers) violated the Minnesota Insurance Fair Information Reporting Act (MI-FIRA) by collecting and disclosing their personal information without first providing them notice and securing their written authorization. Farmers moved to dismiss for failure to state a claim, arguing that the federal Fair Credit Reporting Act (FCRA) preempted the MIFIRA. Although the district court found that the FCRA did not preempt the MIFIRA, it nonetheless granted Farmers’ motion, concluding that the MIFIRA did not require Farmers to notify the plaintiffs or obtain their written authorization before gathering their personal information. We affirm in part and reverse in part. BACKGROUND Since the district court decided this matter based on a motion to dismiss, we recite the facts as alleged in the complaint, viewing them in the light most favorable to the plaintiffs. Schaller Tel. Co. v. Golden Sky Sys., Inc., 298 F.3d 736, 740 (8th Cir.2002). Charles Davenport and Brent Johnson 1 are both Minnesota residents who have purchased property and automobile insurance policies from Farmers for over ten years. Farmers sells insurance, and is licensed to do business in Minnesota. Within the last five years, Farmers obtained the plaintiffs’ personal information, including credit reports, for purposes unrelated to any claims made by them. Farmers did not provide Davenport or Johnson any notice of its intent to procure this information, nor did it receive written authorization from Davenport or Johnson to do so. On February 3, 2003, Davenport and Johnson filed suit on behalf of themselves and others similarly situated, alleging violations of Minnesota law. Specifically, they argued that Farmers violated the MI-FIRA by collecting and disclosing personal information about policyholders and potential policyholders without first notifying them or receiving written authorization to procure such information. Farmers moved to dismiss for failure to state a claim, arguing that federal law preempted the MIFIRA because the FCRA allows the collection and disclosure of such information without any notice to or authorization from consumers. The district court determined that the MIFIRA was not preempted by the FCRA, but that the MIFIRA did not provide the plaintiffs any relief because it allowed disclosure of personal information without written authorization where such disclosure was permitted by another law, such as the FCRA. Accordingly, the district court granted Farmers’ motion, and this appeal followed. ANALYSIS We review the district court’s order dismissing a complaint for failure to state a claim de novo, granting no deference to its interpretation of either federal *842 or state law. Raz v. United States, 343 F.3d 945, 947 (8th Cir.2003) (per curiam) (citations omitted). “When considering a motion to dismiss, we take the complaint’s material allegations as true and liberally construe the complaint in the plaintiffs favor.” Rued v. City of Pacific, 327 F.3d 651, 652 (8th Cir.2003). Minnesota, through the MIFIRA, regulates the collection and disclosure of consumers’ personal information by insurance companies doing business in the state. See generally Minn.Stat. §§ 72A.494-72A.505. The federal government, through the FCRA, also governs the collection, retention, and use of consumer information, including credit reports. See generally 15 U.S.C. §§ 1681-1681x. Where state law is inconsistent with the FCRA “with respect to the collection, distribution, or use of any information on consumers,” the FCRA preempts state law, but “only to the extent of the inconsistency.” 15 U.S.C. § 1681t(a). The plaintiffs first contend that Farmers violated the MIFIRA by failing to notify them before obtaining their personal information, including credit reports. 2 According to the MIFIRA, insurance companies doing business in Minnesota must notify applicants and policyholders if the company intends to obtain their personal information, and must state its purpose in collecting such information. Minn.Stat. § 72A.494, subds. 1, 4. The FCRA also regulates the use of personal information such as credit reports, by those who use the reports, such as insurance companies. See, e.g., 15 U.S.C. § 1681m (detailing the duties and obligations of users of consumer reports). The FCRA does not, however, specifically require insurance companies to notify consumers before obtaining their personal information, nor does it affirmatively permit the procurement of such information without first providing notice to consumers. Farmers would have us hold that the MIFIRA is inconsistent with the FCRA simply because the MIFIRA regulated a matter not addressed by the FCRA. We decline to interpret Congress’s silence with regard to any notice requirement to signify its intent to prohibit states from enacting their own regulations on the issue. Federal law may preempt state law in three instances: 1) where Congress expressly indicates that the law is meant to preempt state law; 2) where federal law and state law conflict; and 3) where federal law occupies the entire legislative domain of an issue. Bank of Am. Nat’l Trust & Sav. Ass’n v. Shirley, 96 F.3d 1108, 1112 (8th Cir.1996). “When Congress has spoken expressly, however, the preemptive scope of the federal law is governed entirely by the express language.” Id. (quoting Weber v. Heaney, 995 F.2d 872, 875 (8th Cir.1993)). The FCRA makes clear that it is not intended to occupy the entire regulatory field with regard to consumer reports. See 15 U.S.C. § 1681t(a) (stating the FCRA “does not annul, alter, affect, or exempt any person subject to the provisions of this sub-chapter from complying with the laws of any State with respect to the collection, distribution, or use of any information on *843 consumers, except to the extent that those laws are inconsistent with any provision of [the FCRA]”); Credit Data of Ariz., Inc. v. Arizona, 602 F.2d 195, 197 (9th Cir.1979); Lin v. Universal Card Servs. Corp., 238 F.Supp.2d 1147, 1152 (N.D.Cal.2002); Hughes v. Fidelity Bank, 709 F.Supp. 639, 640-41 (E.D.Pa.1989). On the contrary, the statute plainly limits its preemption of state regulations “only to the extent of the inconsistency” with those regulations. 15 U.S.C. § 1681t(a). Moreover, the Federal Trade Commission (FTC) issued commentary on the FCRA in order to clarify any doubt regarding its meaning. 16 C.F.R. § 600.1(b). This commentary reiterates that the FCRA was not intended to usurp the entire field of consumer report law: “State law is pre-empted by the FCRA only when compliance with inconsistent State law would result in violation of the FCRA.” 16 C.F.R. Pt. 600, App. § 622. In fact, the FTC included an example of a permissible state regulation which bears close resemblance to the facts before us: “A State law requirement that an employer provide notice to a consumer before ordering a consumer report ... would not be pre-empted, because a party that complies with such provisions would not violate the FCRA.” Id. We find this commentary particularly analogous since employers and insurance companies are treated similarly with respect to the acquisition of consumer reports under the FCRA. Compare 15 U.S.C. § 1681b(a)(3)(B) (permitting a consumer reporting agency to release a consumer report for employment purposes) with 15 U.S.C. § 1681(a)(3)(C) (permitting same for purpose of underwriting insurance for the consumer). As the district court correctly noted, the FCRA allows consumer reporting agencies to furnish consumer reports to insurance companies for the purpose of underwriting insurance involving that consumer without first getting the consumer’s permission. 15 U.S.C. § 1681b(a)(3)(C). The plaintiffs have never maintained, however, that Farmers is a consumer reporting agency. Indeed, Farmers agrees that “[i]n the context of the allegations in Plaintiffs’ Complaint, Farmers is considered a user of consumer reports.” (Appellee’s Br. at 5.) The fact that the FCRA does not require consumer reporting agencies to notify insurance consumers that their reports may be examined is irrelevant to the issue of whether states may require insurance companies, as users of the reports, to provide notice before obtaining those reports. Farmers directs us to the FTC commentary stating that an insurance company may “obtain a consumer report to decide whether or not to issue a policy to the consumer, the amount and terms of coverage, the duration of the policy, the rates or fees charged, or whether or not to renew or cancel a policy.” 16 C.F.R. Pt. 600, App. § 604(3)(C). Farmers suggests that this lends support to its argument that the FCRA relieves them of any obligation to provide notice to consumers prior to procuring their consumer reports. We disagree. This section of the commentary merely reaffirms that the FCRA allows insurance companies to obtain the reports for the purpose of insurance underwriting; it does not speak at all to the issue of notice. The MIFIRA’s requirement that insurance companies notify consumers before collecting their personal information does not conflict with the FCRA and is consistent with relevant FTC commentary regarding supplemental state laws. We therefore find that the MIFIRA’s notice provisions are not preempted by the FCRA. The district court agreed that the plaintiffs’ notice claim was not preempted by federal law. Rather, it turned to a subdivision of the MIFIRA stating that “[personal or privileged information may *844 be disclosed without a written authorization if permitted or required by another law.” Minn.Stat. § 72A.502, subd. 6. Reasoning that the FCRA clearly permitted disclosure of such information, see 15 U.S.C. § 1681b(a)(3)(C), it found the MI-FIRA inapplicable. We find the district court erred in dismissing the plaintiffs’ claims in their entirety based solely on subdivision 6 of Minnesota Statute section 72A.502. First, subdivision 6, by its own terms, only applies to claims alleging the improper disclosure of personal information. Minn. Stat. § 72A.502, subd. 6. Moreover, subdivision 6 is a limitation of liability for acts that would otherwise constitute violations of Minnesota Statute section 72A.502. An allegation that an insurer failed to provide consumers notice before collecting personal information is distinct from a claim that the insurer improperly disclosed that information. Each is governed by separate sections of the MIFIRA. Compare Minn. Stat. § 72A.502 (regulating the practice of insurance companies disclosing personal information) with Minn.Stat. § 72A.494 (requiring insurance companies to notify consumers prior to collecting such information). Thus, while subdivision 6 of section 72A.502 allows Farmers to disclose consumers’ personal information when another law permits such disclosure, it does not absolve Farmers of responsibility for failing to provide notice pursuant to section 72A.494 before collecting that information. We next address the plaintiffs’ claims that Farmers violated the MIFIRA by collecting and disclosing their personal information without first obtaining their written authorization. According to the MIFIRA, An insurer, insurance agent, or insurance-support organization must not disclose any personal or privileged information about a person collected or received in connection with an insurance transaction without the written authorization of that person except as authorized by this section. An insurer, insurance agent, or insurance-support organization must not collect personal information about a policyholder or an applicant not relating to a claim from sources other than public records without a written authorization from the person. Minn.Stat. § 72A.502, subd. 1. To the extent that the plaintiffs maintain that Farmers violated the MIFIRA not getting their written permission before disclosing their personal information, the claim merits little discussion. As noted above, the MIFIRA allows personal information to be “disclosed without a written authorization if permitted or required by another law.” Minn.Stat. § 72A.502, subd. 6. As contemplated by the MIFIRA, disclosure of such reports is permitted by another law-the FCRA. This is so because when Farmers is disclosing the plaintiffs’ personal information, it is no longer a user of the reports, but is furnishing the reports to others. Under limited circumstances, the FCRA permits furnishers of consumer reports to release them to third parties without obtaining consumers’ written authorization. 15 U.S.C. § 1681b. Since the disclosure of the plaintiffs’ personal information is “permitted ... by another law,” Minn.Stat. § 72A.502, subd. 6, Farmers was not required to obtain the plaintiffs’ written permission before furnishing the information to others. We affirm the portion of the district court’s order finding the plaintiffs failed to state a claim under the MIFIRA for the unauthorized disclosure of their personal information. While subdivision 6 of Minnesota Statute section 72A.502 yields to the FCRA with regard to the disclosure of personal information, it does not address the collection *845 of that information. The MIFIRA speaks in mandatory language: insurers “must not collect personal information about a policyholder or an applicant not relating to a claim from sources other than public records without a written authorization from the person.” Minn.Stat. § 72A.502, subd. 1. As with the plaintiffs’ claim that Farmers did not adequately notify them before obtaining their personal information, the FCRA is silent as to the issue of whether Farmers is permitted to collect such information without first obtaining written permission. Here, too, we decline to read Congress’s silence as evidence it intended to preempt a state law which does not directly conflict with the FCRA. Accord 15 U.S.C. § 1681t(a). With no statement from either the FCRA or the MIFIRA exempting Farmers from liability, we find the district court erred in holding that the plaintiffs did not state a claim under the MIFIRA for Farmers’ failure to obtain written authorization before collecting their personal information. 3 CONCLUSION The plaintiffs appeal the district court’s order dismissing their suit for failure to state a claim under the MIFIRA. We agree with the district court that the MI-FIRA is not preempted by the FCRA. We further find, however, that the plaintiffs have sufficiently alleged that Farmers violated the MIFIRA by obtaining and collecting their personal information without first notifying them or procuring their written authorization to do so. We reverse the district court’s judgment to the contrary, and remand for proceedings consistent with this opinion. Footnotes [1] Davenport and Johnson purport to represent a class of those similarly situated. Reference to the two named plaintiffs applies equally to the putative class unless otherwise noted. [2] At oral argument, Farmers suggested that the plaintiffs' so-called "notice” claim was not properly raised by the plaintiffs in their complaint. Paragraph 3 of the complaint, however, alleges that Farmers "unlawfully obtain[ed] ... the private financial, credit, and other confidential and personal information of its policy holders and applicants ... without notice to plaintiffs.” (J.A. at 2 (emphasis added)). Particularly in light of our directive to "liberally construe the complaint in the plaintiff's favor,” Rued, 327 F.3d at 652, we find Farmers’s contention to be without merit. [3] Since the filing of this suit, the MIFIRA has been amended to state that no written authorization is required for the collection and use of a numeric product referred to as an insurance score or credit score that is used by a licensed insurance agent exclusively for the purpose of underwriting or rating an insurance policy, if the agent informs the policyholder or prospective policyholder requesting the insurance coverage that an insurance score or credit score will be obtained for the purpose of underwriting or rating the policy. Minn.Stat. § 72A.501, subd. 2(c). Farmers contends that this amendment simply clarifies that its conduct was always permitted under the MIFIRA, but has provided no authority for this proposition. Moreover, the plaintiffs have alleged Farmers unlawfully obtained their personal information, a universe of data larger than the "numeric product referred to as an insurance score or credit score’’ referred above. See Minn.Stat. § 72A.491, subd. 17 (defining personal information to broadly include any information "from which judgments can be made about an individual's character, habits, avocations, finances, occupation, general reputation, credit, health, or any other personal characteristics”).