Sept. 26, 2023 – Plaintiffs whose driver’s license numbers were disclosed by an insurance company’s website lacked standing to bring a lawsuit under the Driver’s Privacy Protection Act (DPPA), the U.S. Court of Appeals for the Seventh Circuit has ruled in  Baysal v. Midvale Indemnity Co., No. 22-1892 (Aug. 22, 2023).

Judge Frank Easterbrook wrote the majority opinion (2-1), joined by Chief Judge Diane Sykes. Judge Kenneth Ripple dissented.

Disclosed on Websites

Two insurance companies, Midvale Indemnity Company and American Family Mutual Insurance Company, S.I. (Midvale), created a feature on their respective websites that provided instant quotes for auto insurance.

Would-be applicants received a quote after supplying basic identifying information, including name and home address.

To speed the process, the website auto-populated some information, including the number of the applicant’s driver’s license, after the applicant supplied the identifying information.

That meant that a visitor to either website could obtain another person’s driver’s license number by entering the person’s name and home address.

Lawsuit Under DPPA

Midvale disabled the autofill feature after it observed activity on the websites that suggested people were misusing the websites.

The company then notified people whose information had been improperly disclosed.

Three of the people who received the notice, including Alp Baysal, sued Midvale under the DPPA, in the U.S. District Court for the Western District of Wisconsin.

The district court concluded that the plaintiffs lacked standing and dismissed the lawsuit. The plaintiffs appealed.

Concrete Injury Required

Judge Easterbrook began his opinion for the majority by noting that under Seventh Circuit caselaw, a person who’s been injured by a data breach or leak must show a concrete injury.

But he noted that the district court had determined that any concrete injuries suffered by the plaintiffs were not traceable to the disclosure of their driver’s license numbers by the websites.

The plaintiffs argued that the disclosure of their driver’s license numbers caused them worry and anxiety, which led them to take steps including purchasing credit monitoring services.

But Easterbrook pointed out that the Seventh Circuit has held that worry and anxiety are not a concrete injury sufficient to confer standing.

“If they were, almost everyone could litigate about almost anything, because just about everything anyone does causes some other people to fret,” Judge Easterbrook wrote.

The plaintiffs also argued that someone filed bogus claims for unemployment benefits in New York in the name of the two of the plaintiffs.

Easterbrook acknowledged that such claims could cause injury. However, he reasoned that potential injury wasn’t enough; to confer standing, the injury must have already occurred or be “certainly impending.”

“Guesswork of that kind is not enough, however,” Judge Easterbrook wrote. “The injury must be traceable to the asserted wrong and likely rather than speculative.”

What About Damages Provision in DPPA?

The plaintiffs next argued that the fact Congress provided for a liquidated damages remedy in the DPPA was sufficient to confer standing.

But Easterbrook concluded that U.S. Supreme Court caselaw cut against that argument.

That caselaw, Judge Easterbrook pointed out, directed lower courts to respect a determination by Congress that concrete harms deserve remedies.

But, he concluded, the DPPA doesn’t identify any specific compensable harm. Consequently, under Supreme Court caselaw, a court must decide whether the injury asserted by the plaintiffs had a common-law analog.

Easterbrook concluded that there was no such analog to the plaintiffs’ asserted injuries.

He pointed out that the Seventh Circuit had held that the omission of the disputed status of a debt on a credit report was analogous to defamation, and the illegal collection and release of biometric information was analogous to trespass.

But the disclosure of the plaintiffs’ driver’s license numbers was different, Judge Easterbrook concluded, because a driver’s license number has no potential for embarrassment and its disclosure does not invade a driver’s privacy.

“It is a neutral fact derived from a public records system, a fact legitimately known to many private actors and freely revealed to banks, insurers, hotels, and others,” Easterbrook wrote.

As a result, he concluded, the plaintiffs lacked standing to sue.

Dissent: Majority Ignores Congress’s Judgment

Judge Ripple argued in his dissent that the majority had misapplied Supreme Court caselaw regarding the role a statutory violation plays in analyzing a standing issue.

“The identification of a historical or common-law analog will be useful to demonstrate the concreteness of the alleged injury, but, as the Court has made clear, we are not looking for an ‘exact duplicate,’” Ripple wrote.

Judge Ripple pointed out that, according to the legislative history, protecting drivers’ privacy and safeguarding their personal information were among the aims Congress had in enacting the DPPA.

Furthermore, he pointed out, in enacting the DPPA, Congress decided it was wise to restrict the disclosure and sale of motor vehicle records.

“Congress’s judgment on this matter, in other words, is highly ‘instructive’ for our consideration of the concreteness of the alleged injury,” Ripple wrote.

Judge Ripple argued that the majority, in performing its standing analysis, gave too little consideration to Congress’s judgment.

“By failing to recognize and respect Congress’s legislative authority, we undermine the very purpose of standing law – preserving the separation of powers – and ‘effect[] a direct and complete frustration of Congress’ attempt to regulate commerce in the manner that it has chosen,” Ripple wrote.

Judge Ripple also argued that the disclosure of the plaintiff’s driver’s license numbers was analogous to the tort of invasion of privacy.

“It seems that the majority’s real problem with the plaintiff’s position is that the driver’s license numbers are not sensitive or private enough to be analogous to any historical or common law injury traditionally recognized in American courts,” Ripple wrote.

“Again, that is not our judgment to make, and it oversteps the instructions of the Supreme Court.”