Miller v. Image Data LLC , 91 F. App'x 122 ( 2004 )

F I L E D
United States Court of Appeals
Tenth Circuit
UNITED STATES COURT OF APPEALS
FEB 23 2004
TENTH CIRCUIT
PATRICK FISHER
Clerk
MARY HELEN MILLER, on behalf of
herself and all others similarly
situated,
Plaintiff - Appellant/Cross- Nos. 02-1007 and 02-1031
Appellee, (Colorado)
(D.Ct. No. 99-S-481)
v.
IMAGE DATA LLC,
Defendant - Appellee/Cross-
Appellant,
and
ROBERT C. HOUVENER,
individually and in his official
capacity,
Defendant.
ORDER AND JUDGMENT *
Before EBEL, Circuit Judge, PORFILIO, Senior Circuit Judge, and O’BRIEN,
Circuit Judge.
*
This order and judgment is not binding precedent except under the doctrines of
law of the case, res judicata and collateral estoppel. The court generally disfavors the
citation of orders and judgments; nevertheless, an order and judgment may be cited under
the terms and conditions of 10th Cir. R. 36.3.
Mary Helen Miller brought suit against Image Data LLC alleging violations
of the Driver’s Privacy Protection Act (“Driver’s Privacy Act”), 18 U.S.C. §§
2721-2725, and Colo. Rev. Stat. § 42-1-206. 1 Both Miller and Image Data filed
motions for summary judgment. The court granted Image Data’s motion, denied
Miller’s, and, in a separate judgment, ordered each party to pay its own fees and
costs. Miller appeals the district court’s grant of summary judgment to Image
Data and the denial of her motion, while Image Data cross-appeals the court’s
determination of costs. Exercising jurisdiction under 28 U.S.C. § 1291, we
AFFIRM the district court’s ruling on summary judgment and REVERSE and
REMAND its ruling on costs.
I. Background
Image Data is a high tech start-up company formed to commercially
develop its True ID® system technology. The technology allows an individual’s
digitized photographic image to be displayed on a small monitor at the point of a
transaction, enabling identity verification. Soon after the company’s formation,
its principals engaged in discussions with federal and state government officials,
including Colorado, to tout the potential of their technology in preventing identity
fraud. These discussions culminated in several contracts relevant to this case.
1
Colo. Rev. Stat. § 42-1-206 was repealed by Laws 1999, Ch. 298, § 4, eff. Aug.
4, 1999; deleted by Laws 1999, Ch. 118, § 3, eff. April 16, 1999) after a public outcry
regarding the security and potential use of the information sold to Image Data.
-2-
One contract involved Image Data and the United States Secret Service, the
federal agency primarily responsible for combating identity-based crimes. After
Image Data spoke with several federal legislators regarding the scope of identity
fraud and potential solutions to the problem, Congress earmarked $1.46 million
dollars in October 1997 (federal fiscal year 1998) to fund a pilot project testing
the possible technological approach to the problem. The funds were appropriated
to the Secret Service, who in turn, contracted with Image Data in late 1997 to
implement a pilot project. The project was designed with two objectives: (1) to
“show the technical and financial feasibility of using remotely stored digital
portrait images to securely perform positive identification of patrons putting forth
financial instruments for negotiation or identity documents for access to
services[,]” and (2) to “demonstrate how the technology can be used to prevent
the issuance and use of counterfeit driver licenses at the state level . . . . ” (App.
Vol. I, p. 136.) The parties disagree whether Image Data informed the Colorado
officials of the ongoing negotiations for the Secret Service pilot project.
While Image Data was cultivating the federal contract, it was also in
discussions with Colorado officials regarding the purchase of the data found on
Colorado drivers’ licenses. Because the Colorado officials wanted to be sure the
purchase was legally valid, they proposed legislation which was passed in 1997,
Colo. Rev. Stat. § 42-1-206. Subsection (3)(a) of that statute allowed the sale of
-3-
driver’s license information “if such items are to be used solely for the prevention
of fraud, including, but not limited to, use in mechanisms intended to prevent the
fraudulent use of credit cards, debit cards, checks, or other forms of financial
transactions.”
Following passage of the legislation, on November 14, 1997, Image Data
and the State of Colorado entered into a contract to allow Image Data to purchase
from the Colorado Department of Motor Vehicles (DMV), “copies of
photographs, electronically stored photographs, or digitized images from driver’s
license records and to sell the companion demographic data for identity
verification to prevent fraud . . . .” 2 (App. Vol. I, p. 82.) The contract echoed the
language found in Colo. Rev. Stat. 42-1-206(3)(a) to establish the parameters of
the sale.
Miller, a Colorado resident with a valid driver’s license and whose DMV
information was presumably sold to Image Data, brought suit alleging Image
Data: 1) procured information from the DMV for purposes other than the
prevention of financial fraud in violation of the Driver’s Privacy Act, 18 U.S.C. §
2The two types of data identified in the contract include “image data” and
“demographic data.” (App. Vol. I, p. 83.) Image data is defined as “all images possessed
by the state or its agents of the holders of Colorado drivers licenses and state
identification cards . . .” (Id.) “Demographic data” is defined as the data appearing on the
face of the card, including “the holder’s name, address, . . . card number, social security
number, date of birth, sex, height, weight, hair color and eye color . . . .” (Id.)
-4-
2722(a), and Colo. Rev. Stat. § 42-1-206 (3)(a); and 2) obtained the DMV
information without disclosing its involvement with the Secret Service in
violation of § 2722(b). 3 The district court concluded Image Data’s proposed use
of the DMV information was permitted under § 2722(a), and Miller could not
assert a private cause of action under § 2722(b). This appeal and cross appeal
followed.
II. Standard of Review
We review rulings on summary judgment de novo applying well-settled
standards. Koch v. Koch Indus., Inc., 203 F.3d 1202, 1212 (10th Cir.), cert.
denied, 531 U.S. 926 (2000). Summary judgment is appropriate "if the pleadings,
depositions, answers to interrogatories, and admissions on file, together with the
affidavits, if any, show that there is no genuine issue as to any material fact and
that the moving party is entitled to a judgment as a matter of law." Fed. R. Civ.
P. 56(c).
III. Driver’s Protection Privacy Act
“The DPPA [Driver’s Privacy Act] regulates the disclosure and resale of
personal information contained in the records of state DMV’s by limiting the
3
Miller also filed suit against Robert Houvener, former president of Image Data,
in his individual and official capacities. The district court dismissed her claim against
Houvener with prejudice. This ruling is not challenged on appeal.
-5-
state’s ability to disclose a driver’s personal information without her consent. 4
Reno v. Condon, 528 U.S. 141, 143-44 (2000). This prohibition extends to the
state and to persons who have obtained the information from the state. Id. at 146
(citing 18 U.S.C. § 2721(c)). However, the restricted disclosure of personal
information is subject to a number of mandatory and permissive statutory
exceptions. 5 18 U.S.C. § 2721(b)(1)-(14).
Section 2722 defines unlawful acts as follows:
(a) Procurement for unlawful purpose. – It shall be unlawful for any
person knowingly to obtain or disclose personal information, from a
motor vehicle record, for any use not permitted under section 2721(b)
of this title.
(b) False representation. – It shall be unlawful for any person to
make false representation to obtain any personal information from an
individual’s motor vehicle record.
The Driver’s Privacy Act authorizes a private right of action in federal court when
“[a] person . . . knowingly obtains, discloses or uses personal information, from a
motor vehicle record, for a purpose not permitted under this chapter” and the
Such consent cannot be implied, but must be affirmatively obtained. Reno v.
4
Condon, 528 U.S. 141, 144-45 (2000).
5
The Driver’s Privacy Act mandates certain information regarding various matters
in connection with motor vehicles shall be disclosed “to carry out the purposes of [T]itles
I and IV of the Anti-Car Theft Act of 1992, the Automobile Information Disclosure Act
(15 U.S.C. 1231 et seq.), the Clean Air Act (42 U.S.C. 7401 et seq.), and chapters 301,
305, and 321331 of [T]itle 49. . . .” 18 U.S.C. § 2721(b).
-6-
information pertains to the individual bringing suit. 18 U.S.C. § 2724.
A. 18 U.S.C. § 2722(a) & Colo. Rev. Stat § 42-1-206
Miller maintains Image Data violated Colo. Rev. Stat. § 42-1-206 (and as a
result, the Driver’s Privacy Act) because the Colorado statute limits the sale of
personal information solely for use in preventing financial fraud. She contends
the contract between Image Data and the Secret Service regarding the True ID®
technology could and would be used for purposes beyond preventing financial
fraud, 6 and therefore, the data was procured for a purpose not permitted under the
Driver’s Privacy Act. We disagree.
Image Data admits its True ID® technology could be utilized for any
number of purposes, including purposes beyond those raised by Miller. However,
the record indicates no reasonable factual dispute as to Image Data’s purpose in
procuring the DMV information. Image Data’s application for the pilot project
and the contractually-required reports to the Secret Service establish the
technology was used to prevent financial fraud. Even considering the potential
uses of the technology, Image Data did not violate either state or federal statute.
Colorado law provides DMV information may be sold “solely for the prevention
of fraud, including, but not limited to, use in mechanisms intended to prevent
6
Miller identifies purposes such as “insurance and medicaid fraud; terrorism;
underage drinking; drug crimes; government payments fraud; border-jumping . . . airlines
and [] gun control.” (Appellant Br., p. 22.)
-7-
the fraudulent use of credit cards, debit cards, checks, or other forms of financial
transactions.” Colo. Rev. Stat. § 42-1-206 (emphasis added). The term “fraud”
as used in the statute is not limited by context or express definition and thus takes
on its “generic meaning that includes virtually any kind of deception or unfair
way of inducing another to surrender rights or property.” In re Attorney D., 57
P.3d 395, 402 (Colo. 2002); see also Black’s Law Dictionary (7th Ed. 1999)
(Fraud is “[a] knowing misrepresentation of the truth or concealment of a material
fact to induce another to act to his or her detriment . . . . [a] misrepresentation
made recklessly without belief in its truth to induce another person to act.”).
Image Data’s “identity verification” or “identity fraud” applications were
ultimately intended to prevent fraud, financial and otherwise, by preventing the
deceptive use of a false identity. Consequently, Image Data did not procure the
Colorado DMV information in violation of Colorado law.
Moreover, the permissive disclosure exceptions found in 18 U.S.C.
§ 2721(b) include a broad range of purposes aimed at preventing fraud generally.
The various types of “identity-verification” or “identity-fraud” objected to by
Miller fall squarely within several of the Driver’s Privacy Act’s fourteen
permissive disclosure exceptions. Driver’s license information may be sold for
“use by any government agency . . . or any private person or entity acting on
behalf of a Federal, State, or local agency in carrying out its functions . . . .” 18
-8-
U.S.C. § 2721(b)(1). The information may also be sold for use in the normal
course of business by a business, or its agents, employees or contractors to verify
the accuracy of personal information submitted by the individual to the business.
18 U.S.C. § 2721(b)(3)(A). Further, this section specifically allows “[a]n
authorized recipient of personal information [with certain exceptions not
applicable here to] resell or redisclose the information only for a use permitted
under subsection (b) . . . .” 18 U.S.C. § 2721(c).
Because the permitted uses of DMV information are not limited to the
prevention of financial fraud, but include the present and potential applications of
Image Data’s True ID® technology, Image Data did not violate § 2272(a) or Colo.
Rev. Stat. § 42-1-206. We therefore affirm the district court’s grant of summary
judgment on this claim.
B. 18 U.S.C. § 2722(b)
Miller also appeals the district court’s determination that no express or
implied private cause of action exists under § 2722(b), contending one may be
implied because of the nature and purpose of the Privacy Act in protecting
individual privacy. We disagree.
Whether “a statute creates a cause of action, either expressly or by
implication, is basically a matter of statutory construction, such that what must
ultimately be determined is whether Congress intended to create the private
-9-
remedy asserted.” Southwest Air Ambulance, Inc. v. City of Las Cruces, 268 F.3d
1162, 1169 (10th Cir. 2001) (quoting Transamerica Mortgage Advisors, Inc. v.
Lewis, 444 U.S. 11, 16 (1979)). The “construction and applicability of a federal
statute is a question of law, which we review de novo." Allison v. Bank One-
Denver, 289 F.3d 1223, 1235 n.2 (10th Cir. 2002). Even assuming Miller was
harmed by a § 2722(b) violation, this “does not automatically give rise to a
private cause of action in favor of that person.” Southwest Air, 268 F.3d at 1169,
(quoting Transamerica Mortgage Advisors, 444 U.S. at 16).
The Driver’s Protection Act separates unlawful activity into two distinct
categories. Section 2722(a) identifies securing or disclosing personal information
for an impermissible use. In contrast, § 2722(b) prohibits the use of false
representations to obtain the information. The private right of action created
under 18 U.S.C. § 2724(a) reiterates the statutory language found in § 2722(a),
but contains no similar reference to the false representation language in
§ 2722(b). Thus, the logical inference from the structure and express language of
the Driver’s Privacy Act reveals Congress’ intent to create a private right of
action under § 2722(a), but to leave the enforcement of a violation of § 2722(b) to
the United States Department of Justice.
IV. Cross Appeal--Costs
Image Data appeals the district court’s separate order requiring each party
-10-
to pay their own fees and costs. We review an award of costs for an abuse of
discretion. Munoz v. St. Mary-Corwin Hosp., 221 F.3d 1160, 1170 (10th Cir.
2000). “[C]osts other than attorney’s fees shall be allowed as of course to the
prevailing party unless the court otherwise directs . . . .” Fed. R. Civ. P.
54(d)(2003). This rule “creates a presumption that the prevailing party shall
recover costs [and]. . . the district court must provide a valid reason for not
awarding costs to a prevailing party.” Cantrell v. International Bhd. of Elec.
Workers, AFL-CIO, Local 2021, 69 F.3d 456, 459 (10th Cir.1995). The district
court refused to award costs to Image Data, the prevailing party, without
explanation. Therefore, we have no record on which to base our review and must
remand this issue to the district court. Munoz, 221 F.3d at 1170. Consequently,
the portion of the district court’s December 6, 2002 judgment ordering each party
to pay its own fees and costs is REVERSED and REMANDED in accordance with
Munoz, supra.V. Conclusion
The district court’s determination granting summary judgment in favor of
Image Data, and denying Miller’s motion for summary judgment is AFFIRMED.
The court’s denial of costs is REVERSED, and the matter is REMANDED for
-11-
further proceedings consistent with this order and judgment.
Entered by the Court:
Terrence L. O’Brien
United States Circuit Judge
-12-