The opinion of the court was delivered by: Nanette K. Laughrey United States District Judge Jefferson City, Missouri
Plaintiffs Emily Roberts and Sarah E. Smith brought this class action against Defendants, The Source for Public Data, L.P. ("Public Data"), Shadowsoft, Inc. ("Shadowsoft"), and Omar Davis, Julie Allen, Karen Dudenhoeffer, Ruth Otto, and Patricia Vincent -- Missouri Department of Revenue ("DOR") officials sued in their individual capacities. Plaintiffs claimed violations of the Drivers Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721, et seq., as well as 42 U.S.C. § 1983 and the Missouri Merchandising Practices Act.
Before the Court are three motions for summary judgment. One was filed by Defendants Allen, Dudenhoeffer, Otto, and Vincent [Doc. # 245]; one was filed by Defendant Davis [Doc. # 247]; and the third summary judgment motion was filed by Plaintiffs [Doc. # 246]. For the following reasons, the Court grants Defendants' motions and denies Plaintiffs' motion.
A. The Uncontroverted Facts
The Court has considered the parties' statements of facts and finds that the following facts are undisputed and supported by evidence. In order to receive access to Missouri drivers' personal information, Form 4678 must be submitted to the Missouri DOR for review.
The version of Form 4678 used during the time period identified in Plaintiffs' Complaint listed a series of exceptions to the DPPA, allowing the requestor to obtain drivers' personal information -- including social security numbers -- from DOR records.
Shadowsoft requested access to Missouri drivers' personal information and claimed that it was entitled to the information under the "business use" exception to the DPPA. [Doc. # 254, Ex. 8.] The entire Missouri driver's license file was disclosed to Shadowsoft in the years 2001, 2003, twice in 2004, twice in 2005, twice in 2006, twice in 2007, and again in 2008. [Doc. # 254, Ex. 7.] Public Data received Missouri drivers' personal information from Shadowsoft.
Defendant Julie Allen was the Customer Services Director for the Missouri DOR from February 2004 to November of 2008. She oversaw the Divisions of Taxation and Motor Vehicle and Driver Licensing. Defendant Allen had approximately 1,200 employees working under her. Allen was responsible for the department which disclosed information to Shadowsoft. She had not reviewed the Form 4678 sent in by Shadowsoft, as it predated her tenure at the Missouri DOR.
Defendant Karen Dudenhoeffer has been a Revenue Manager at Missouri DOR since January 2008. Her duties involve managing a staff of approximately 50 employees, overseeing public information, including record sales such as the disclosure of driver's license and motor vehicle information. Defendant Dudenhoeffer did not participate in the creation of Form 4678, and does not remember ever reviewing Shadowsoft's Form 4678. The department and employees that Karen Dudenhoeffer oversees are responsible for verifying the applications for Missouri drivers' personal information submitted by businesses such as Shadowsoft. The last disclosure of Missouri drivers' personal information to Shadowsoft occurred on January 22, 2008. Dudenhoeffer did not authorize that request.
Defendant Ruth Otto has been a Revenue Manager for the DOR since December of 1996. She is currently a Revenue Manager in the Motor Vehicle and Driver Licensing Division. Defendant Otto is not in charge of promulgating DOR policies or procedures. Otto did not review Shadowsoft's Form 4678 when it was submitted in 2001.
Defendant Patricia Vincent was the Director of the Missouri DOR from January 2005 until November 2007. When Defendant Vincent took over, there were policies and procedures in effect setting forth the circumstances under which drivers' personal information could be sold in bulk, and she did not amend them. Vincent has not seen the Form 4678 submitted by Shadowsoft, was not involved in the decision to approve Shadowsoft's access to Missouri drivers' personal information, and does not know who approved it.
Defendant Omar Davis was the Director of the Missouri DOR from December 31, 2007 until January 12, 2009. Defendant Davis had been General Counsel for the Missouri DOR from July 2006 through October 2006. During the period between October 2007 and December 31, 2007, Davis served as Director of the Department of Labor and Industrial Relations. Shadowsoft applied for and obtained access to the driver's license data base before Davis was employed by the Missouri DOR. Davis did not approve Shadowsoft's application for security access to Missouri drivers' personal information. Prior to learning of the allegations of Shadowsoft's misuse of Missouri drivers' personal information, Defendant Davis does not think he saw Form 4678. That form predated Davis at the Missouri DOR. Davis had not heard of Shadowsoft or Public Data until late February 2008, shortly before he ended Shadowsoft's access to drivers' personal information in response to a February 20, 2008 letter from the Missouri Attorney General's Office.
The Missouri DOR policy on the DPPA was issued on September 13, 1997, and was revised on September 1, 2008. There was also a policy issued on September 13, 1997, and revised on March 12, 2002. There is no evidence that any of the Defendants violated any of the DOR's policies and procedures regarding driver's license data information sold to Shadowsoft.
The Missouri DOR started an audit process in late 2007, sending out a questionnaire in December 2007. The audit was part of a project to develop a record system to address the DPPA requirement of keeping records of those parties to whom personal information is resold. Defendant Otto contacted Shadowsoft to request information when DOR was conducting the audit. The results of the audit did not change Shadowsoft's eligibility to receive bulk disclosures of Missouri drivers' personal information from the DOR. Shadowsoft was subsequently approved to receive the entire Missouri driver's license file on January 28, 2008.
In February 2008, the Missouri Attorney General filed a state court action against Public Data, claiming that it was permitting access to information in violation of state and federal law. That month, the Missouri Attorney General sent a letter to Defendant Davis indicating that "highly confidential personal drivers license information that the Department of Revenue is charged with protecting is being used for illegal and improper purposes." [Doc. # 254, Ex. 12.] The Missouri Attorney General further requested that Davis "take whatever steps are necessary to ensure that Missourians' personal and confidential information is not made available to those who would misuse it or sell it to others who will." Id.
On February 22, 2008, Defendant Dudenhoeffer sent a letter to Bruce Stringfellow of Shadowsoft. Defendant Otto drafted the letter, which stated:
This letter is in reference to the complete driver license file that you receive from the Missouri Department of Revenue (Department) on a semi-annual basis.
Department records reflect that your request for access to driver license record information has been made for the purpose of "use in the normal course of business . . . to verify the accuracy of personal information submitted by the individual to the business or its agents, employees or contractors." It has been determined, however, that such purpose serves only as a basis for requesting access to individual driver records, and not the entire driver license record database. ...