Diamond v. Hastie

          ORDER

          KRISTI K. DuBOSE, CHIEF UNITED STATES DISTRICT JUDGE

         This matter came before the Court on a February 7, 2019 evidentiary hearing regarding Diamond's Motion for Class Certification (Docs. 78, 79) and Defendant's opposition (Doc. 83), evidence and argument presented at the February 7, 2019 hearing, the parties' post-hearing supplemental briefing (Docs. 97, 100), and Notice of Withdrawal of Labarron Yates (Doc. 87).

         I. Background^[1]

         This proposed class action centers on alleged violations of the Drivers' Privacy Protection Act, 18 U.S.C. § 2721, et. seq. (DPPA) and privacy rights per Title 42 U.S.C. § 1983. The "DPPA prohibits the obtainment or disclosure of personal information from motor vehicle records for any use not permitted under the fourteen specific exceptions delineated in § 2721(b) the Act. 18 U.S.C. § 2722(a)." Baas v. Fewless, 886 F.3d 1088, 1090 (11^th Cir. 2018). As explained in Maracich v. Spears, 570 U.S. 48, 57-58 (2013):

To obtain a driver's license or register a vehicle, state DMVs, as a general rule, require an individual to disclose detailed personal information, including name, home address, telephone number, Social Security number, and medical information. See Reno v. Condon, 528 U.S. 141, 143…(2000)…..

The DPPA provides that, unless one of its exceptions applies, a state DMV “shall not knowingly disclose or otherwise make available” “personal information” and “highly restricted personal information.” §§ 2721(a)(1)-(2). “[P]ersonal information” is “information that identifies an individual, including [a]...driver identification number, name, address ..., [or] telephone number, ... but does not include information on vehicular accidents, driving violations, and driver's status.” § 2725(3). “[H]ighly restricted personal information” is defined as “an individual's photograph or image, social security number, [and] medical or disability information.” § 2725(4). The DPPA makes it unlawful “for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title.” § 2722(a). A person “who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains.” § 2724(a).

The DPPA's disclosure ban is subject to 14 exceptions set forth in § 2721(b), for which personal information “may be disclosed.” ….

         On April 14, 2015 (amended on August 18, 2017 and September 22, 2017), Named Plaintiff Anitra Diamond (Diamond) -- individually and on behalf of all others similarly situated - - filed a class action complaint alleging that Defendant Kimberly Hastie^[2] (Hastie) unlawfully obtained, used and/or disclosed personal information of Mobile, Alabama citizens (email addresses) from motor vehicle records in violation of the Drivers' Privacy Protection Act, 18 U.S.C. § 2721, et. seq. (DPPA) (Count I) and in violation of their privacy rights under Title 42 U.S.C. § 1983 (Count II). (Docs. 1, 28, 36 (amended)). Concerning the DPPA violations (Count I) Diamond alleges that:

…During August 2013, Defendant Hastie, acting under color of the law, and in the course and scope of her employment, knowingly and under misinterpretation of federal law, authorized, directed, ratified, approved, acquiesced in, committed, or participated in, acts and practices in direct violation of the DPPA when she ordered an employee of the Mobile County License Commission to access Plaintiffs' and the Class Members' Personal Information contained in motor vehicle records.

Hastie ordered the employee to access motor vehicle records and gather the email addresses of all Mobile County residents who reside within the city limits and place that Personal Information onto an electronic storage device (a “thumb drive”).

Hastie then ordered that the Personal Information be provided to the campaign of a local political candidate. Non-parties Chad Tucker (“Tucker”) and Strateco, LLC (“Strateco”), knowingly received the Personal Information and utilized it in order promote a local political candidate, a purpose not permitted under the DPPA.

(Doc. 36 at 5).^[3] Diamond's' DPPA count (Count I) specifies that Hastie's "accessing, obtaining, disclosing and/or using" the motor vehicle records violate Section 2724(a) of the DPPA. (Id. at 9). Email addresses constitute "personal information" under DPPA. United States v. Hastie, 854 F.3d 1298, 1303-1304 (11^th Cir. 2017) (an email address is personal information protected by the DPPA because it is information that identifies an individual). Based on Hastie's conduct, Diamond seeks -- per Section 2724(b)(1) -- liquidated damages of $2, 500, per individual, per occurrence (each instance Hastie unlawfully obtained, used, and/or disclosed protected personal information); punitive damages; and attorneys' fees.^[4]

         In Count II, with regard to Section 1983, Diamond alleges that she had a reasonable expectation of privacy as to the personal information provided to the Mobile County License Commission, and that Hastie deprived her of her rights to privacy as secured by the DPPA.^[5] (Doc. 36 at 11). From this, Diamond claims attorneys' fees and costs. (Id. at 12).

         On November 12, 2018, Diamond moved to certify a class of similar situated individuals, asserting that certification is proper because the requirements of Federal Rules of Civil Procedure Rule 23(a) and Rule 23(b)(3) are satisfied. (Doc. 78). Specifically, Diamond contends that:

…The License Commission issues driver's licenses and automobile titles and maintains motor vehicle registrations for residents of Mobile County….The License Commission maintains a website, which requires users to provide their email addresses for all online transactions….The License Commission also instructs tellers at its offices to obtain email addresses from licensed drivers and motor vehicle owners….

….Brad Bray, the manager of information technology….downloaded a list of email addresses onto a flash drive and delivered it to Hastie's secretary… The flash drive contained approximately 30, 853 email addresses…Hastie gave the flash drive containing the email addresses to the Stimpson campaign, and the Stimpson campaign sent out Hastie's endorsement to those email addresses….

In 2015, a federal grand jury returned a superseding indictment against defendant Hastie. ….Count 17 charged Hastie with violating the DPPA by disclosing the email addresses collected by the License Commission to a political consulting firm to tout Hastie's support for a mayoral candidate.….

The jury found defendant Hastie guilty of violating the DPPA.….Hastie appealed…the Eleventh Circuit affirmed….[and]….among other things, held that the term “personal information” in the DPPA includes e-mail addresses, and thus defendant Hastie's knowing release of drivers' e-mail addresses to a third party violated the DPPA.….

(Id.) Diamond requests that she be designated representatives of the following class:^[6]

All persons who had email addresses in the custody of the Mobile County License Commission which were disclosed by defendant Kimberly Hastie to Chad Tucker and Strateco, LLC.

Excluded from the class are: defendant Hastie and her immediate family; all persons who make a timely election to be excluded from the class; the judges to whom this case is assigned and immediate family members thereof.

(Doc. 78 at 2-3, 25). Moreover, Diamond requests certification of these causes of action:

Any claims for statutory damages under the Drivers' Privacy Protection Act, 18 U.S.C. § 2724(a), and 42 U.S.C. § 1983, premised upon disclosures of personal information by defendant Hastie to Chad Tucker and/or Strateco LLC.

(Id. at 25).

         As grounds, Diamond contends that certification under Rule 23(a) is proper because: 1) the class of over 30, 000 plaintiffs is sufficiently numerous to render joinder impracticable; 2) defendant Hastie obtained, used, and/or disclosed DPPA protected personal information of each class member in an identical manner and therefore there are numerous issues of law and facts common to each class member: 3) the claims of the class representatives are typical of, if not identical to, the claims of the class as a whole; and 4) the class representative will fairly and adequately protect the interests of the class. (Doc. 78). Diamond adds that certification under Rule 23(b)(3) is proper because: "Hastie obtained, used, and/or disclosed the DPPA protected personal information of each class member in identical fashion; therefore, common questions of law and fact predominate over individual questions. Moreover, given the size of the proposed class, the utilization of the class action device is superior to other available methods of litigation and, as such, represents the most fair and efficient mode of adjudicating this controversy." (Id.)

         Hastie opposes the motion, asserting -- in part -- that: 1) the proposed class is so numerous that joinder of all members is impractical; 2) questions of law and fact are not common to class members; 3) the named plaintiffs are not typical of claims of the proposed class; and 4) Plaintiffs assert a Section 1983 claim as to which there is no statutory liquidated damages amount and class certification is not superior. (Doc. 83). Hastie also highlights a myriad of "issues" and "questions" regarding the flash drive at issue, the status of the emails (defunct, containing typos, etc.), and more, as undermining the Rule 23 class requirements. (Id.)

         II. Yates

         On January 25, 2019, Plaintiff Labarron Yates filed a notice of withdrawal stating that he "no longer seeks to serve as a named Plaintiff or class representative[.]" (Doc. 87 at 1). Yates' Notice of Withdrawal is GRANTED, and Yates is REMOVED as a "named plaintiff" and/or proposed class representative, and Anitra Diamond is the only "named plaintiff" and proposed class representative presently before the Court. As such, from this point forward, the Court will reference Diamond as the plaintiff (or as Plaintiff in the singular) in assessing this case.

         III. Class Certification - Relevant Law

         Diamond moves for class certification under Rules 23(a) and 23(b)(3). Per Family Med. Pharm., LLC v. Trxade Group, Inc., 2017 WL 1042079, *3-4 (S.D. Ala. Mar. 17, 2017):

“Under Rule 23, certification is proper where the proposed [class satisfies] an implicit ascertainability requirement, the four requirements listed in Rule 23(a), and the requirements listed in any of Rule 23(b)(1), (2), or (3).” Karhu v. Vital Pharms, Inc., 621 Fed.Appx. 945, 946 (11th Cir. 2015) (citing Little v. T-Mobile USA, Inc., 691 F.3d 1302, 1304 (11th Cir. 2012)). Also, “[f]or a district court to certify a class action, the named plaintiffs must have standing[.]” Vega v. T-Mobile USA, Inc., 564 F.3d 1256, 1268 (11th Cir. 2009) (quoting Klay v. Humana, Inc., 382 F.3d 1241, 1250 (11th Cir. 2004)).

As to the ascertainability requirement, “Rule 23 implicitly requires that the “proposed class is adequately defined and clearly ascertainable.” Karhu, 621 Fed.Appx. at 946 (citing Little, 691 F.3d at 1304) (internal quotation marks omitted). The Eleventh Circuit requires that the class definition “contain[ ] objective criteria that allow for class members to be identified in an administratively feasible way.” Id…As to the second requirement, “[i]n order to establish ascertainability, the plaintiff must propose an administratively feasible method by which class members can be identified” Id. at 947. “Identifying class members is administratively feasible when it is a ‘manageable process that does not require much, if any, individual inquiry.' ” Id. at 946 (quoting Bussey v. Macon Cty. Greyhound Park, Inc., 562 Fed.Appx. 782, 787 (11th Cir. 2014)).

         The Rule 23(a) requirements for certification of any class action are: “(1) numerosity (‘a class [so large] that joinder of all members is impracticable'); (2) commonality (‘questions of law or fact common to the class'); (3) typicality (named parties' claims or defenses “are typical…of the class”'; and (4) adequacy of representation (representatives ‘will fairly and adequately protect the interests of the class').” Amchem Prod., Inc. v. Windsor, 521 U.S. 591, 613 (1997); Vega v. T-Mobile, USA, Inc., 564 F.3d 1256, 1268 (11^th Cir. 2009) (same). Moreover, at least one of the three requirements in Rule 23(b) must be satisfied. Little v. T-Mobile USA, Inc., 691 F.3d 1302, 1304 (11^th Cir. 2012); Klay v. Humana, Inc., 382 F.3d 1241, 1250 (11^th Cir. 2004), abrogated in part on other grounds by Bridge v. Phoenix Bond & Indem. Co., 553 U.S. 639 (2008); Palm Beach Golf Ctr.-Boca, Inc. v. Sarris, 311 F.R.D. 688, 698 (S.D. Fla. 2015). In this case, Diamond alleges that she meets the requirements of Rule 23(b)(3) which requires that the Court find that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating the controversy.

         Further, “[t]he burden of proof to establish the propriety of class certification rests with the advocate of the class.” Valley Drug Co. v. Geneva Pharms., Inc., 350 F.3d 1181, 1187 (11^th Cir. 2003). Finally, while overall a district court's decision to grant class certification lies within its sound discretion, Gulf Oil v. Bernard, 452 U.S. 89, 100 (1981), the court must nevertheless conduct a “rigorous analysis” that “consider[s] the merits of the case to the degree necessary to determine whether the requirements of Rule 23 will be satisfied[]” Vega, 564 F.3d at 1266.

         As explained in Vega:

….“Although the trial court should not determine the merits of the plaintiffs' claim at the class certification stage, the trial court can and should consider the merits of the case to the degree necessary to determine whether the requirements of Rule 23 will be satisfied.” Valley Drug, 350 F.3d at 1188 n. 15 (citing Gen. Tel. Co. of the Southwest v. Falcon, 457 U.S. 147, 160…. (1982)); see Coopers & Lybrand v. Livesay, 437 U.S. 463, 469 & n. 12…(1978) (“[t]he class determination generally involves considerations that are ‘enmeshed in the factual and legal issues comprising the plaintiff's cause of action.' ... ‘The more complex determinations required in Rule 23(b)(3) class actions entail even greater entanglement with the merits.' ”) (emphasis and citations omitted); Huff v. N.D. Cass Co. of Ala., 485 F.2d 710, 714 (5th Cir.1973) (en banc) (“It is inescapable that in some cases there will be overlap between the demands of [Rule] 23(a) and (b) and the question of whether plaintiff can succeed on the merits.”); Castano, 84 F.3d at 744 (“Going beyond the pleadings is necessary, as a court must understand the claims, defenses, relevant facts, and applicable substantive law in order to make a meaningful determination of the certification issues.”)….

Vega, 564 F.3d at 1265-1266 (footnotes omitted).

         IV. Standing

         As the Eleventh Circuit has made clear, “analysis of class certification must begin with the issue of standing.” Griffin v. Dugger, 823 F.2d 1476, 1482 (11^th Cir. 1987). “The question of whether an individual has standing to raise a claim is particularly important in the class action context because, before the court ever reaches the question of whether the individual's claims and the class claims will share common questions, it must decide whether the individual has a cognizable claim at all.” Likes v. DHL Exp., 288 F.R.D. 524, 528 (N.D. Ala. 2012).

         Diamond does not specifically allege Article III standing in the operative complaint (Doc. 36) or motion for class certification (Doc. 78). Presumably, however, Diamond bases her standing on the allegation that she is a "Mobile County Alabama citizen[] who provided [her] email addresses to the License Commission while renewing [her] driver's licenses -- which were later 'pulled from the Mobile County License Commission's database and provided to a representative of a local political campaign for a purpose that was not authorized by Plaintiff.'” (Doc. 78 at 7).

         Although Hastie generally states in her answer that Diamond lacks standing (Doc. 41 at 6), she makes no substantive argument in her briefing regarding standing. At this point, the Court finds that Diamond has cognizable DPPA and Section 1983 claims, and thus standing to proceed.

         V. Rule 23(a) requirements

         As summarized by the Eleventh Circuit in Landeros v. Pinnacle Recovery, Inc., 692 Fed.Appx. 608, 611 (11^th Cir. 2017) (footnote omitted) (affirming the district court's denial of class certification):

Rule 23(c) directs a district court, “[a]t [the] earl[iest] practicable time after a person sues or is sued as a class representative, ... [to] determine by order whether to certify the action as a class action.” Fed.R.Civ.P. 23(c)(1)(A). While it is sometimes possible to decide the propriety of class certification from the face of the complaint, see Mills v. Foremost Ins. Co., 511 F.3d 1300, 1309 (11th Cir. 2008), the Supreme Court has “emphasized that it may be necessary for the court to probe behind the pleadings before coming to rest on the certification question.” Comcast Corp. v. Behrend, 569 U.S. 27…(2013) (internal quotation marks omitted). In fact, the determination usually should be predicated on more information than the complaint itself provides, and it “will frequently entail overlap with the merits of the plaintiff's underlying claim.” Id. (internal quotation marks omitted). After all, “class determination generally involves considerations that are enmeshed in the factual and legal issues comprising the plaintiff's cause of action.” Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 351…. (quoting Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 160…(1982)).

Moreover, “because class actions are an exception to our constitutional tradition of individual litigation, ” Brown v. Electrolux Home Prods., Inc., 817 F.3d 1225, 1233 (11th Cir. 2016), a district court has great responsibility to adhere to the framework of Rule 23. Id. [ ] Hence, if the district court has reservations about whether the Rule 23 requirements have been satisfied, it should refuse to grant class certification until the parties have assuaged the district court's doubts. Id. at 1233-34.

         Diamond seeks Rule 23(a) class certification for the DPPA claims and the Section 1983 claims (intertwining those claims).

         A. Numerosity

         Rule 23(a)(1) requires a class to be “so numerous that joinder of all members is impracticable.” In the Eleventh Circuit, a class of less than 21 is inadequate while a class of more than 40 is adequate. See, e.g., Cox v. Am. Cast Iron Pipe Co., 784 F.2d 1546, 1553 (11^th Cir. 1986); Helms v. ConsumerInfo.com, Inc., 236 F.R.D. 561, 564 (N.D. Ala. 2005). Per Diamond, the Defendant unlawfully disclosed the email addresses of over 30, 000 Mobile County residents, such that it would be impracticable to join all of these citizens. Additionally, Diamond asserts that ...