Ives v. Bath & Body Works, LLC

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE Michael Ives v. Civil No. 23-cv-432-LM Opinion No. 2024 DNH 034 P Bath & Body Works, LLC O R D E R Plaintiff Michael Ives brings this putative class action against defendant Bath & Body Works, LLC, alleging that defendant violated the New Hampshire Driver Privacy Act (“Driver Privacy Act”), RSA 260:14, by transmitting information from plaintiff’s driver’s license to a third party without his consent. Presently before the court is defendant’s motion to dismiss for lack of standing pursuant to Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim upon which relief may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). See doc. no. 16. For the following reasons, the court finds that plaintiff has sufficiently alleged standing but fails to state a claim upon which relief may be granted. The court therefore grants the motion to dismiss. STANDARDS OF REVIEW There are two ways to challenge a court’s subject-matter jurisdiction under Rule 12(b)(1). Freeman v. City of Keene, 561 F. Supp. 3d 22 , 25 (D.N.H. 2021). First, the defendant may challenge the sufficiency of the allegations relied upon in the complaint to support jurisdiction. Id. Alternatively, the defendant can challenge the accuracy of the complaint’s jurisdictional allegations. Id. The court’s standard of review differs depending on the challenge brought. Id. Where a defendant challenges the sufficiency of the complaint’s jurisdictional facts, the standard of review is the same as the Rule 12(b)(6) standard. Id. Where a defendant challenges the accuracy of the plaintiff’s allegations, those allegations “are entitled to no presumptive weight,” and “the court must address the merits of the jurisdictional claim by resolving the factual disputes between the parties.” Valentin v. Hosp. Bella Vista, 254 F.3d 358, 363 (1st Cir. 2001). Here, defendant challenges only the sufficiency of the facts alleged in the complaint that would support the existence of jurisdiction. Therefore, the court considers both of defendant’s arguments for dismissal under the 12(b)(6) standard. Under Rule 12(b)(6), the court must accept the factual allegations in the complaint as true, construe reasonable inferences in the plaintiff’s favor, and “determine whether the factual allegations in the plaintiff’s complaint set forth a plausible claim upon which relief may be granted.” Foley v. Wells Fargo Bank, N.A., 772 F.3d 63, 68, 71 (1st Cir. 2014) (quotation omitted). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Analyzing plausibility is “a context-specific task” in which the court relies on its “judicial experience and common sense.” Id. at 679 . BACKGROUND The court draws the following factual summary from the limited allegations in the complaint. Within the last three years, plaintiff has made multiple returns to one of defendant’s retail stores in Manchester, New Hampshire. He did not present a receipt for his items at the time of these returns. When customers make nonreceipted returns at defendant’s stores, defendant provides them with store credit via “stored value cards,” which are similar to gift cards. In addition to making nonreceipted returns, plaintiff has also made purchases using store credit on stored value cards at this same retail location within the last three years. When making non-receipted returns or purchasing items using in-store credit, defendant required plaintiff to present his driver’s license. Defendant then transmitted information on plaintiff’s driver’s license to an entity known as “The Retail Equation.” According to the complaint, The Retail Equation provides software used by retailers to analyze customers’ shopping habits in order to determine whether a particular transaction may be fraudulent. Plaintiff alleges that he was not aware that defendant would transmit the information on plaintiff’s license to a third party in order to process his transactions. Plaintiff brought the instant putative class action in New Hampshire Superior Court on or about July 28, 2023. His complaint alleges two claims against defendant, both of which arise under the Driver Privacy Act. Defendant removed plaintiff’s action to this court on or about September 13, 2023, pursuant to the Class Action Fairness Act of 2005 (“CAFA”), Pub. L. No. 109-2, 119 Stat. 4 (codified in scattered sections of 28 U.S.C.).1 DISCUSSION Plaintiff’s first claim alleges that defendant violated RSA 260:14, IX(a) by disclosing information on his driver’s license to The Retail Equation. That subparagraph provides in pertinent part: A person is guilty of a misdemeanor if such person knowingly discloses information from a department record to a person known by such person to be an unauthorized person . . . . Each such unauthorized disclosure . . . shall be considered a separate offense. RSA 260:14, IX(a). His second claim alleges that defendant violated RSA 260:14, IX(b) by engaging in this same conduct. That subparagraph provides that a “person is guilty of a class B felony if, in the course of business, such person knowingly sells, rents, offers, or exposes for sale motor vehicle records to another person in violation of this section.” RSA 260:14, IX(b). Although both subparagraphs speak in terms of criminal liability, another provision of the statute states that “any person aggrieved by a violation of this section may bring a civil action.” RSA 260:14, X. A successful 1 The court notes that this action is one of several materially identical putative class actions recently removed to this court alleging that retailers violate the Driver Privacy Act when they provide customers’ driver’s license information to The Retail Equation. See Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---, 2023 WL 8787578 (D.N.H. Dec. 19, 2023) (appeal filed); Bourgeois v. The Gap, Inc., Civ. No. 23-cv-394LM-TSM, 2023 WL 9689611 (D.N.H. Dec. 20, 2023); Bourgeois v. The TJX Cos., Inc., Civ. No. 23-cv-354-PB (D.N.H. Jan. 5. 2024); see also Stewart v. Burlington Coat Factory Warehouse Corp., Civ. No. 23-cv-468-JL-TSM. plaintiff may obtain the greater of actual damages or statutory damages of $2,500 “for each violation,” as well as attorneys’ fees and costs. Id. Defendant moves to dismiss both counts. First, defendant argues that plaintiff lacks standing to maintain this action because he fails to allege an actual, concrete injury. Second, defendant argues that plaintiff fails to state a claim because the Driver Privacy Act does not provide for liability in these circumstances. The court must first consider standing. See Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94-95 (1998). I. Plaintiff Plausibly Alleges Standing Article III of the Constitution limits federal courts’ jurisdiction to “Cases” and “Controversies.” U.S. Const. art III, § 2. “The doctrine of standing emanates from the case-or-controversy requirement; it ‘developed . . . to ensure that federal courts do not exceed their authority as it has been traditionally understood.’” Freeman, 561 F. Supp. 3d at 30 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330 , 338 (2016)) (alteration in Freeman). For a plaintiff to have standing, he must have suffered a “concrete” injury. TransUnion LLC v. Ramirez, 594 U.S. 413 , 424 (2021). “A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Spokeo, 578 U.S. at 340. A concrete injury may be tangible or intangible. Id. Tangible harms include “traditional . . . harms, such as physical harms and monetary harms.” TransUnion, 594 U.S. at 425. Intangible harms include “injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” such as “disclosure of private information.” Id. History is an important touchstone “[b]ecause the doctrine of standing derives from the case-orcontroversy requirement, and because that requirement in turn is grounded in historical practice.” Spokeo, 578 U.S. at 340-41. However, a plaintiff’s alleged injury for standing purposes need not be “an exact duplicate” of a harm traditionally recognized as constituting the basis for a cause of action. TransUnion, 594 U.S. at 424. Moreover, where a legislature has conferred a cause of action for violation of a statutory prohibition, the legislature’s “judgment is instructive and important” in discerning whether the plaintiff has suffered an intangible yet concrete harm. Spokeo, 578 U.S. at 341. “Courts must afford due respect to [a legislature’s] decision to impose a statutory prohibition or obligation on a defendant, and to grant a plaintiff a cause of action to sue over the defendant’s violation of that statutory prohibition or obligation.” TransUnion, 594 U.S. at 425. Indeed, a “legislature may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’” Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 , 621 (7th Cir.) (quoting Spokeo, 578 U.S. at 341), amended on denial of reh’g en banc, 2020 WL 6534581 (7th Cir. 2020). Where a plaintiff plausibly alleges the deprivation of certain “procedural right[s] granted by statute . . . [he] need not allege any additional harm beyond the one [the legislature] has identified.” Spokeo, 578 U.S. at 342 (emphasis omitted). However, the creation of a cause of action for a statutory violation cannot “automatically” confer standing upon the plaintiff. Id. at 341. Thus, a “bare procedural violation” does not confer standing. Id.; see also TransUnion, 594 U.S. at 427 (“Article III grants federal courts the power to redress harms that defendants cause plaintiffs, not a freewheeling power to hold defendants accountable for legal infractions.” (quoting Casillas v. Madison Ave. Assocs., Inc., 926 F.3d 329, 332 (7th Cir. 2019) (Barrett, J.)). At the end of the day, although a legislature’s judgment is entitled to consideration, the “creation of a statutory prohibition . . . and a cause of action does not relieve courts of their responsibility to independently decide whether a plaintiff has suffered a concrete harm under Article III.” TransUnion, 594 U.S. at 426. Importantly, “standing in no way depends on the merits of the plaintiff’s contention that particular conduct is illegal.” Hochendoner v. Genzyme Corp., 823 F.3d 724, 734 (1st Cir. 2016) (quoting Warth v. Seldin, 422 U.S. 490, 500 (1975)). “For standing purposes, we accept as valid the merits of [plaintiff’s] legal claims . . . .” Fed. Election Comm’n v. Cruz, 596 U.S. 289 , 298 (2022). Thus, in assessing a motion to dismiss for lack of standing, the “only question is, putting the merits aside, whether [plaintiff] plausibly alleges [he] was injured under [his] theory of the underlying legal claim.” Laufer v. Acheson Hotels, LLC, 50 F.4th 259 , 267 (1st Cir. 2022), vacated and remanded on other grounds, 144 S. Ct. 18 (2023). As noted, plaintiff alleges that defendant disclosed information on his driver’s license to a third party without plaintiff’s knowledge or consent in violation of the Driver Privacy Act.2 Defendant contends that the unauthorized disclosure of information on plaintiff’s driver’s license does not constitute a concrete injury sufficient to confer standing. Although defendant acknowledges that the unauthorized disclosure of private information can be a concrete injury in some circumstances, defendant contends that the information contained within a driver’s license is not private because persons routinely show their license to strangers and because most of the information contained in a driver’s license is readily discernible (such as hair color) or is a matter of public record (such as a person’s legal address). The Fourth Circuit considered a closely analogous set of facts in Garey v. James S. Farrin, P.C., 35 F.4th 917 (4th Cir. 2022). The defendants in that case were a group of personal injury lawyers who obtained car accident reports from law enforcement agencies and private entities. 35 F.4th at 919. The defendants used the personal information revealed on those reports—the names and addresses of the drivers—to solicit clients. Id. The drivers who received the defendants’ solicitations brought suit alleging that the defendants violated the Driver Privacy Act’s federal counterpart, the Driver’s Privacy Protection Act (“DPPA”), 18 U.S.C. § 2721 et seq. Id. at 919-20. Like New Hampshire’s Driver Privacy Act, DPPA establishes a cause of action against persons who obtain or use personal information from motor vehicle records for an unauthorized purpose. See 18 U.S.C. § 2724 (a); Garey, 35 F.4th at 2 For purposes of resolving the standing issue and in keeping with the standing inquiry at the motion to dismiss stage, the court will assume that defendant’s alleged actions violated the Driver Privacy Act and that defendant’s alleged conduct is actionable under that Act. 920. Applying TransUnion, the Fourth Circuit held that the plaintiffs alleged a privacy injury that was closely related to the common law tort of invasion of privacy, “which has long provided a basis for recovery at common law.” Garey, 35 F.4th at 921 (quotation omitted). The court reasoned that, by enacting DPPA, “Congress responded to the harms of actual people by creating a cause of action that protects their particular and concrete privacy interests.” Id. at 922 (quoting Krakauer v. Dish Network, LLC, 925 F.3d 643, 653 (4th Cir. 2019)). The court follows the Fourth Circuit’s reasoning in Garey. Here, plaintiff has alleged that defendant disclosed information from his driver’s license without his knowledge or consent on multiple occasions. He alleges that this information included, among other things, his name, his driver identification number, his address, and medical or disability information. See doc. no. 5 at 3. Plaintiff has adequately alleged an invasion of his privacy that bears a sufficiently close relationship to a harm traditionally recognized in American law. See Garey, 35 F.4th at 921-22; see also TransUnion, 594 U.S. at 425 (recognizing that disclosure of private information can be sufficient to confer standing). Further support for the existence of standing is found in the Seventh Circuit’s opinion in Bryant v. Compass Group USA, Inc.3 At issue there was an Illinois state law that required any entity collecting persons’ “biometric identifiers or information” (such as their fingerprints or their facial features for facial recognition 3 While Bryant preceded the Supreme Court’s opinion in TransUnion, the Seventh Circuit has held that Bryant remains good law post-TransUnion. See Cothron v. White Castle Sys., Inc., 20 F.4th 1156 , 1161 (7th Cir. 2021). technology) to obtain the written, informed consent of persons whose information was acquired, and established a cause of action for any person whose biometric information was obtained in violation of the statute. Bryant, 958 F.3d at 619. The plaintiff’s employer installed the defendant’s fingerprint-operated vending machines in the employer’s cafeteria, and the plaintiff used the vending machines. Id. The defendant failed to inform the plaintiff that her biometric identifier was being collected and did not obtain her written consent to collect, store, or use her fingerprint. Id. Although it was uncontested that the plaintiff knew her fingerprint was being collected and stored, she brought a putative class action alleging that the defendant failed to obtain her informed, written consent in violation of the Illinois state law. Id. at 619-20. The plaintiff originally brought her action in Illinois state court, but the defendant removed pursuant to CAFA. Id. at 620. The plaintiff thereafter moved to remand, arguing that federal jurisdiction did not exist because her complaint failed to allege a concrete injury for standing purposes.4 Id. The district court granted the motion to remand, finding that the plaintiff’s allegations did not support standing, but the court of appeals granted the defendant’s petition to appeal the remand order and took up the standing issue. Id.; see 28 U.S.C. § 1453 (c) (allowing for discretionary appeal of remand to state court of class action previously removed to federal court under CAFA). 4 The Seventh Circuit noted that Illinois state law does not have as stringent a standing requirement as exists under the case-or-controversy requirement. See 958 F.3d at 622. On appeal, the Seventh Circuit held that the plaintiff had alleged an injury sufficient to confer Article III standing. By collecting the plaintiff’s fingerprint information without her informed consent, the defendant committed “no bare procedural violation; it was an invasion of her private domain.” 958 F.3d at 624. The court analogized the defendant’s alleged conduct to the common law tort of trespass, which seeks to protect an individual’s personal rights in his or her land. See id.; see also Spokeo, 578 U.S. at 344 (Thomas, J., concurring) (explaining that “courts historically presumed that the plaintiff suffered a de facto injury merely from having his personal, legal rights invaded. Thus, when one man placed his foot on another’s property, the property owner needed to show nothing more to establish a traditional case or controversy”). Moreover, the requirement to obtain a person’s informed consent to collect their biometric data was not an ancillary requirement of the at-issue Illinois law; it was at the law’s “heart.” 958 F.3d at 626. Indeed, the manifest purpose of the statute “is to ensure that consumers understand, before providing their biometric data, how that information will be used, who will have access to it, and for how long will it be retained.” Id. Highlighting “[t]he judgment of [the] Illinois[ ] General Assembly . . . that the sensitivity of biometric information and the risk of . . . privacy . . . harm that may result from its dissemination necessitates that people be given the opportunity to make informed choices about to whom and for what purpose they will relinquish control of that information,” the court found that a failure to obtain a person’s informed consent in violation of the Illinois law constituted a concrete injury for Article III purposes. Id. The Seventh Circuit’s analysis in Bryant supports standing here. While at least some of the information contained in a person’s driver’s license is readily observable, so too are a person’s facial features for purposes of biometric identification. The mere fact that a person’s information may be readily observable or a matter of public record does not mean that the unauthorized intrusion upon such information fails to establish a concrete injury. A person’s yard may be visible from a public street; that does not give passersby the right to intrude upon private property. See Spokeo, 578 U.S. at 344 (Thomas, J., concurring). Indeed, the very existence of the Driver Privacy Act contemplates that certain information contained within “department records” and “motor vehicle records” may not be disclosed except in accordance with the Act, even if that information might be publicly available elsewhere. See RSA 260:14, IX(a)-(b).5 Far from a mere technical violation, the unauthorized disclosure of drivers’ records is at the “heart” of the Driver Privacy Act. See DeVere v. Att’y Gen., 146 N.H. 762, 764-65 (2001) (explaining the genesis of the Driver Privacy Act and noting its “general rule that motor vehicle ‘records shall not be public records or open to the inspection of any person’” (quoting RSA 260:14, II(a))); Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---, 2023 WL 8787578 , at *3-4 (D.N.H. Dec. 19, 2023) (explaining restrictions imposed by the Driver Privacy Act). Plaintiff is not “merely seeking to ensure a defendant’s 5 The First Circuit has recognized that the misuse of a person’s name—which is otherwise generally public information—may constitute an injury in fact for standing purposes. See Webb v. Injured Workers Pharm., LLC, 72 F.4th 365 , 373 (2023). ‘compliance with regulatory law,’” TransUnion, 594 U.S. at 427 (quoting Spokeo, 578 U.S. at 345 (Thomas, J., concurring)), he is seeking vindication for “a violation of [his] own rights . . . an invasion of [his] private domain,” Bryant, 958 F.3d at 624. Defendant’s arguments against the existence of standing are not persuasive. Defendant points to district court orders in other circuits in which courts have found that the unauthorized disclosure of information within a driver’s license failed to state various claims upon which relief could be granted. See Rasmussen v. Chisago Cnty., 991 F. Supp. 2d 1065, 1078-79 (D. Minn. 2014) (plaintiff’s allegations failed to meet the “high threshold of offensiveness and expectation of privacy” needed to state claim for intrusion upon seclusion under Minnesota state law); Rollins v. City of Albert Lea, 79 F. Supp. 3d 946, 957-59 (D. Minn. 2014) (plaintiff failed to plausibly allege dissemination of “highly personal matters representing the most intimate aspects of human affairs” necessary to state claim for violation of constitutional right to privacy (quotation omitted)); Sutherland v. Massa, Case No. 08-5129-CV-SW-RED, 2010 WL 11545751 , at *2 (W.D. Mo. Sept. 16, 2010) (plaintiff failed to plausibly allege that disclosure of information in driver’s license “would be highly offensive to a reasonable person” as required to state claim for invasion of privacy claim under Missouri state law); Phillips v. Bailey, 337 F. Supp. 2d 804, 806-07 (W.D. Va. 2004) (plaintiff failed to state § 1983 claim for violation of his Fourth Amendment rights because plaintiff did not have a reasonable expectation of privacy in information shared with a third party such as the DMV). In none of these cases, however, did the court consider whether the plaintiff had Article III standing.6 While intangible harms bearing “a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts” confer standing to sue, TransUnion, 594 U.S. at 425, Article III does “not require an exact duplicate,” id. at 433. Garey and Bryant show that the unauthorized disclosure of personal information from a driver’s license in violation of a statutory prohibition may constitute a concrete injury sufficient to confer standing— especially where that unauthorized disclosure causes the plaintiff to “suffer[ ] injury in precisely the form the statute was intended to guard against.” Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982); see also Spokeo, 578 U.S. at 342 (explaining that “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute an injury in fact”). Here, the harm plaintiff alleges bears a sufficiently close relationship to an invasion of privacy traditionally recognized in American law, even if that harm is not a mirror image of the specific causes of action that were at issue in the cases defendant relies upon. Defendant also argues that plaintiff lacks standing because he does not allege he suffered monetary harm as a result of the unauthorized disclosure. However, 6 While defendant also cites, in a footnote, to cases where district courts in other circuits have found that the disclosure of information on driver’s licenses failed to confer Article III standing, these were data breach cases that concerned the requirement that a plaintiff’s injury be imminent, not the requirement that a plaintiff’s injury be concrete. Here by contrast, defendant does not argue that the injury plaintiff complains of is not imminent—nor could it, since plaintiff alleges that the disclosure of his driver’s license information in violation of the Driver Privacy Act has already occurred. while “actual economic loss . . . is the prototypical concrete harm,” Gustavsen v. Alcon Labs., Inc., 903 F.3d 1, 8 (1st Cir. 2018), concrete harms also include intangible harms that are “actionable without wallet injury,” Amrhein v. eClinical Works, LLC, 954 F.3d 328 , 331 (1st Cir. 2020). Here, plaintiff has sufficiently alleged an intangible harm for the reasons discussed above. For these reasons, the court finds that plaintiff has sufficiently alleged standing at the motion to dismiss stage. The court next considers defendant’s second ground for dismissal: whether plaintiff has stated a claim upon which relief can be granted. II. Plaintiff Fails to State a Claim Upon Which Relief Can Be Granted The complaint in this case is materially identical to the complaint before this court in Home Depot. See Home Depot, 2023 WL 8787578 , at *1.7 The court finds that neither Count I nor Count II of plaintiff’s complaint states a claim upon which relief can be granted for the same reasons the identical causes of action failed to state claims in Home Depot. With respect to Count I, plaintiff’s driver’s license is not a “department record” within the meaning of RSA 260:14, IX(a). With respect to Count II, his driver’s license is not a “motor vehicle record” within the meaning of RSA 260:14, IX(b), and plaintiff failed to plausibly allege that defendant sold, rented, offered, or exposed for sale his driver’s license or the information contained therein. 7 For this reason, the court denies defendant’s request for a hearing on its motion to dismiss. The clerk of court is directed to enter judgment and close the case. SO ORDERED. OL La □□□ fferty United és District Judge ZL April 18, 2024 ce: Counsel of Record — 16 —