Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:09-cv-04760-Robert W. Gettleman, Judge.
The opinion of the court was delivered by: Williams, Circuit Judge.
Before POSNER, FLAUM, and WILLIAMS, Circuit Judges.
The plaintiffs in this case contend that West Publishing obtains their personal information from state Department of Motor Vehicle ("DMV") records and resells the information in violation of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. § 2722. The district court granted West Publishing's motion to dismiss this lawsuit, finding that the plaintiffs lacked standing. We disagree and conclude that the DPPA creates a federal private right of action for persons who, like the plaintiffs, claim that their personal information has been disclosed in violation of the Act. But, we affirm the district court's dismissal of the plaintiffs' complaint under Federal Rule of Civil Procedure 12(b)(6) because we agree that the DPPA does not prohibit West Publishing from reselling the plaintiffs' personal information to those with permissible uses under the Act.
The plaintiffs, citizens of Illinois, brought a class action on behalf of licensed drivers in several states against West Publishing, asserting claims under the DPPA and for unjust enrichment, and seeking injunctive relief. The plaintiffs contend that West Publishing acquires the personal information contained in motor vehicle records of millions of drivers from state DMVs (or from entities that have acquired the information from state DMVs) for resale in violation of the DPPA.
Before the district court, West Publishing filed a motion to dismiss under Federal Rule of Civil Procedure 12(b)(1), arguing that the plaintiffs did not have standing, and u nd er Federal Rule of Civil Proced ure 12(b)(6), contending that the plaintiffs had failed to state a claim under the DPPA. The district court granted the motion, finding that the plaintiffs did not have standing, that their complaint did not state a claim under the DPPA, and that the plaintiffs' unjust enrichment and injunctive relief claims were derivative of their DPPA claim and also failed. The plaintiffs appeal.
State DMVs require drivers to supply sensitive personal information such as names, addresses, and social security numbers when applying for a driver's license. In 1993, Congress enacted the Driver's Privacy Protection Act to limit how state DMVs can share that personal information with others. Congress passed the DPPA as an amendment to the Violent Crime Control and Law Enforcement Act of 1993 in response to nationwide reports that criminals were obtaining the personal information of their victims from state DMV records with relative ease. See Reno v. Condon, 528 U.S. 141, 143-44 (2000). Congress was also concerned that many states were selling drivers' personal information to individuals, marketers, and businesses without drivers' knowledge or consent. See id.
The DPPA prohibits state DMVs from "knowingly disclosing or otherwise making available to any person or entity personal information . . . about any individual obtained by the department in connection with a motor vehicle record." 18 U.S.C. § 2721(a). It also prohibits private individuals from "knowingly . . . obtain[ing] or disclos[ing] personal information, from a motor vehicle record, for any use not permitted under section 2721(b)." 18 U.S.C. § 2722(a). The DPPA gives aggrieved persons a private right of action:
A person who knowingly obtains, discloses or uses information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.
The DPPA, however, does not prohibit all unconsented disclosures of personal information. It permits (and in some circumstances requires, see § 2721(b) (requiring disclosure in connection with vehicle safety and theft)) disclosure for certain uses. Section 2721(b) of the DPPA lists fourteen permissible uses for which personal information may be disclosed.*fn1
In section 2721(c), the DPPA regulates the resale of personal information. That section provides in pertinent part that, "An authorized recipient of personal information. . . may resell or redisclose the information only for a ...