The Fourth Circuit recently affirmed the Middle District of North Carolina’s grant of summary judgment in favor of the Defendants in a Driver’s Privacy Protection Act (“DPPA”) case, Garey v. Farrin, Case Nos. 21-1478, 21-1480.  In its opinion, the Fourth Circuit agreed with the district court’s ruling that the Plaintiffs had standing to assert their damages claims.  However, the Court held that summary judgment in favor of defendants was appropriate because Plaintiffs’ personal information were not obtained from drivers’ licenses or DMV databases—putting it outside the scope of the DPPA.

The Defendants—a number of personal injury lawyers—obtained car accident reports from North Carolina law enforcement agencies and private data brokers.  The reports included the names and addresses of the drivers involved in those accidents.  The Defendants then purportedly used that information to mail unsolicited attorney advertising materials to some of the drivers.  The Plaintiffs—the drivers who received advertising materials from the Defendants—filed suit and asserted violations of the DPPA.  The district court held that the Plaintiffs had standing to bring suit for damages, but rejected the Plaintiffs’ claims on the merits, granting summary judgment to the Defendants.  On appeal, the Fourth Circuit affirmed, albeit on narrower grounds than those on which the district court relied.

The Fourth Circuit agreed with the district court’s assessment that the Plaintiffs lacked standing to assert claims for injunctive relief.  The Plaintiffs alleged that the Defendants had obtained their driver’s information in violation of the DPPA.  They did not, however, plead that the Defendants continued to wrongfully obtain their driver’s license information after the filing of the lawsuit or otherwise allege that any wrongful conduct by the Defendants was ongoing or imminent.  Thus, the Plaintiffs lacked standing to assert claims for injunctive relief because they did not allege any non-speculative, imminent danger.  The Court noted this outcome was consistent with the Supreme Court’s ruling in Ramirez last year (which the Fourth Circuit was previously instructed to use a basis for reconsidering another Article III decision, as covered by CPW).  [Note: the Court found Article III satisfied on other grounds]

The parties also sought to present several issues of first impression in the Fourth Circuit including whether a driver’s license is a “motor vehicle record,” whether the DPPA applies to records outside the possession of a state DMV, and whether the DPPA’s restrictions on the obtaining, use, and dissemination of records impinge on the First Amendment.  Instead, the Fourth Circuit affirmed the district court on a much narrower ground.

The Fourth Circuit determined that, under the DPPA’s private right of action, the plaintiff must allege and prove that the defendant obtained the plaintiff’s personal information from a motor vehicle record.  As you may recall, to fall within the DPPA’s narrow private right of action, a defendant must have obtained a plaintiff’s personal information “from a motor vehicle record.”  18 U.S.C. § 2724(a) (emphasis supplied).  In this case, the Plaintiffs did not dispute that none of the Defendants obtained any information “from” a motor vehicle record.  Rather, the Plaintiffs alleged that the Defendants obtained their personal information that was derived from a motor vehicle record—which the Fourth Circuit explained was insufficient to prove a DPPA claim.

In reaching this conclusion, the Fourth Circuit analyzed the legislative history of the DPPA, and noted that the words “derived from” were intentionally removed by Congress in the process of drafting the language of the DPPA.  Thus, the legislative history clarified the plain text: the DPPA imposes civil liability only on a defendant who obtains personal information from a motor vehicle record, but not on a defendant who merely obtains personal information that can be linked back to (i.e., derived from) such a record.  Accordingly, the Fourth Circuit expressly disagreed with courts in other circuits that have found violations of the DPPA so long as the personal information at issue could be traced back to a motor vehicle record.

The Fourth Circuit’s holding was narrow and straightforward: a DPPA plaintiff must allege and prove that the defendant obtained the plaintiff’s personal information from a motor vehicle record.  Because the Defendants obtained the Plaintiffs’ personal information from accident reports—and not expressly from motor vehicle records—the Defendants were entitled to summary judgment on the Plaintiffs’ DPPA claims.