Date: 05-07-2018

Case Style:

Case Number: 16-4123

Judge: Murphy

Court: United States Court of Appeals for the Eighth Circuit on appeal from the District of Minnesota (Hennepin County)

Plaintiff's Attorney:

Defendant's Attorney:

Description: Juan Bautista Berenguer sued various municipalities and their employees,
alleging violations of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§
2721–25. After the issuance of our opinions in McDonough v. Anoka County, 799
F.3d 931 (2015), and Tichich v. City of Bloomington, 835 F.3d 856 (2016),
Berenguer conceded that only his claims against the City of Bloomington and the City
of Shakopee were timely and plausible. Defendants' motions to dismiss for failure
to state a claim were granted by the district court,1 which ruled that Berenguer had
failed to plead frequent suspicious accesses by either Bloomington or Shakopee.
Berenguer appeals, and we affirm.
I.
Juan Bautista Berenguer is a former Major League Baseball player who pitched
for two World Series winners: the 1984 Detroit Tigers and the 1987 Minnesota
Twins. After retiring from baseball in 1992, he settled in Minnesota where he lives
today. Berenguer requested an audit by the Minnesota Department of Public Safety
in May 2014. The audit revealed that officers from over thirty different departments
had accessed his information more than 125 times after 2005. Berenguer requested
1The Honorable David S. Doty, United States District Judge for the District of
Minnesota.
-2-
further information, which revealed that on several occasions officers had also
accessed the names of his children, Jody and Andrew Berenguer.
The DPPA prohibits state motor vehicle departments from disclosing personal
information contained in a record except for uses explicitly permitted by the statute.
See 18 U.S.C. § 2721(a)–(b). Any "person who knowingly obtains, discloses or uses
personal information, from a motor vehicle record, for a purpose not permitted" is
liable to the individual accessed. Id. § 2724. A court may award an individual whose
personal information has been improperly accessed "actual damages, but not less than
liquidated damages in the amount of $2,500," attorney fees, and also punitive
damages when there is "proof of willful or reckless disregard of the law." Id. § 2724.
On December 10, 2014, Berenguer filed suit against thirty-six municipalities,
the current and former commissioners of the Minnesota Department of Public Safety,
hundreds of John and Jane Does, and fifty Entity Does. Berenguer's complaint
alleged that these entities and individuals had violated the DPPA by accessing or
disclosing his personal information without a permissible purpose. Many of the
defendants moved to dismiss the claims as insufficiently pled and barred by the
statute of limitations. Berenguer's case was informally stayed pending decisions in
other cases with similar issues. After Tichich was decided in 2016, the district court
asked the parties to submit supplemental briefs to address the potential impact of
prior decisions on Berenguer's claims.
Berenguer's supplemental brief to the district court conceded that only his
claims against the cities of Bloomington and Shakopee were timely under
McDonough. Berenguer's audit showed 2 that employees at the Shakopee police
2The statute of limitations for DPPA violations begins to run when a violation
occurs. McDonough, 799 F.3d at 943. Claimed violations occurring more than four
years prior to the filing of a complaint are thus time barred. Id.
-3-
department had obtained his information on four different occasions between 2005
and 2011—once within the statute of limitations. Employees at the Bloomington
police department had accessed it nineteen times between 2005 and 2011. The audits
for Berenguer's children revealed five simultaneous accesses by employees at
Bloomington and Shakopee (four from Bloomington and one from Shakopee). Only
one of these accesses came within the statute of limitations (one by the Bloomington
police department). The district court concluded that the accesses had not shown an
impermissible purpose and granted defendants' motions to dismiss. Berenguer
appeals.
II.
As a preliminary matter, defendants argue for the first time on appeal that
Berenguer lacks Article III standing to bring his DPPA claim because he did not
demonstrate an injury in fact.
Article III standing requires "(1) an injury that is (2) 'fairly traceable to the
defendant's allegedly unlawful conduct' and that is (3) 'likely to be redressed by the
requested relief.'" Lujan v. Defenders of Wildlife, 504 U.S. 555, 590 (1992) (quoting
Allen v. Wright, 468 U.S. 737, 751 (1984)). Although Congress cannot evade Article
III's standing requirement by conferring the right to sue on a person who would not
otherwise have standing, Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1548 (2016),
Congress may "elevate de facto concrete injuries, whether tangible or intangible, into
legally cognizable injuries." Heglund v. Aitkin County, 871 F.3d 572, 577 (8th Cir.
2017). When considering whether an intangible harm constitutes an injury in fact,
courts examine whether the alleged harm "has a close relationship to a harm that has
traditionally been regarded as providing a basis for a lawsuit in English or American
courts." Spokeo, 136 S. Ct. at 1549.
-4-
A person's control over information concerning her person was a cognizable
concept in the common law as an invasion of privacy, Heglund, 871 F.3d at 577–78,
and Congress has explained that the DPPA was intended as protection against
"potential harm to privacy from state officials accessing drivers' personal information
for improper reasons." Id. at 577. Such intangible harm provides standing for
Berenguer. See id. at 578.
III.
Defendants argue and the district court held, however, that Berenguer failed to
plead a plausible claim for relief. We review grants of motions to dismiss de novo.
McDonough, 799 F.3d at 945.
In order to succeed in a DPPA lawsuit, a plaintiff must establish that a
defendant "1) knowingly 2) obtained, disclosed, or used personal information, 3) from
a motor vehicle record, 4) for a purpose not permitted." Id. A DPPA complaint thus
must plead "enough fact[s] to raise a reasonable expectation that discovery will reveal
evidence" that defendants obtained the plaintiff's information for an impermissible
purpose. See Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 556 (2007).
"[G]eneralized allegations" that are "merely consistent with the liability" of a
defendant "stop[] short of the line between possibility and plausibility of entitlement
to relief" and are insufficient to meet the pleading standards. McDonough, 799 F.3d
at 947 (quoting Twombly, 550 U.S. at 557). When a complaint does not allege
"concerted activity," a plaintiff must plead something more to survive a motion to
dismiss. Id.
Courts evaluate each defendant's alleged conduct independently in order to
ensure that the plaintiff has pled sufficient facts to show an impermissible purpose by
each defendant. Id. at 946. That does not mean that we assess the allegations in
-5-
isolation, however. Id. We read the complaint as a whole and consider all claims
when assessing the plausibility of those timely filed. Id.
One way for a plaintiff to "nudge the allegations across the line of plausibility"
is to plead frequent accesses and suspicious access timing patterns. Id. at 947; see
also Tichich, 835 F.3d at 866–67. When determining whether the number of alleged
accesses is frequent, "sequential accesses occurring within a several-minute time
span" should be considered as one. Id. at 867. In McDonough, we identified three
categories of suspicious access patterns that might give rise to a plausible claim:
1) accesses on the same day as or within a few hours of accesses by
other, unrelated entities during the limitations period; 2) multiple latenight
accesses during the limitations period; or 3) a history of frequent
suspicious accesses fitting the above criteria, even if prior to the
limitations period, coupled with accesses within the limitations period.
Id. at 950. It is significant if a complaint alleges evidence of local fame, of a
relationship between the plaintiff and particular officers, or of an access timed with
a significant event that could spark an interest in the plaintiff's personal information.
Tichich, 835 F.3d at 866. We have concluded, for example, that a plaintiff had pled
a suspicious access pattern by alleging more than a hundred accesses—including late
night accesses—within the statute of limitations period. In another illustrative
example, one plaintiff's information was accessed by different agencies more than a
hundred times within a week. See McDonough, 799 F.3d at 951–53. In contrast, a
different case with eighteen accesses within its limitations period, only one of which
was a late night access, was not found to be suspicious. See Tichich, 835 F.3d at
870–71.
Berenguer does not allege that more than one agency accessed his information
on the same day within the statute of limitations period. Nor does he allege any late
-6-
night accesses within that period. Shakopee employees accessed his information four
times between 2005 and 2011; only one was during the early morning, and only one
fell within the limitations period. Including sequential accesses by the same user,
Berenguer's information was accessed by Bloomington employees twelve times
between 2005 and 2011. Only two of those occurred within the statute of limitations
period, and each access was by a different user. The fact that the records of his
children were accessed at the same time as his own on several occasions is
insufficient to establish a pattern of suspicious accesses. These simultaneous
accesses occurred months apart, and only one was within the statute of limitations
period. None "reveal a pattern that would indicate that they were unlawful or
unpermitted." See id. at 868. Berenguer thus failed to plead sufficient facts to show
an impermissible purpose by the defendants. See McDonough, 799 F.3d at 946.

Outcome: For these reasons, we affirm the judgment of the district court.

Plaintiff's Experts:

Defendant's Experts:

Comments: