Summary
Seventh Circuit affirmed dismissal for lack of standing in a suit under the Driver's Privacy Protection Act (DPPA) alleging that an insurer's website disclosed driver's license numbers. The court held that the plaintiffs failed to allege a concrete injury because driver's license numbers are neutral, non-sensitive information publicly available and not analogous to common-law privacy torts. Additionally, the claimed harms—credit monitoring costs and fraudulent unemployment claims—were not plausibly traceable to the disclosure, as the complaint did not establish a link between the license numbers and the alleged fraud. The dissent argued that the disclosure of personal information under the DPPA is sufficiently similar to the tort of invasion of privacy to satisfy Article III standing.
Topics
Practice areas
Questions Presented
- Whether the plaintiffs have standing to sue under the Driver's Privacy Protection Act and state law, specifically whether they alleged a concrete injury in fact that is fairly traceable to the defendants' disclosure of their driver's license numbers.
Holdings
- The plaintiffs lack standing because they did not plausibly allege a concrete injury in fact traceable to the disclosure of their driver's license numbers. A violation of the DPPA alone is insufficient to establish standing; the injury must be analogous to a common-law tort, and the disclosure of a driver's license number is not analogous to any traditionally recognized harm.
Key quotations
“Remijas holds that the need to pay for a credit-monitoring service is a form of injury because the cost is money out of pocket. Similarly, loss of access to a credit card for even a few days is an injury.” (at 2-3)
“We have held that worry and anxiety are not the kind of concrete injury essential to standing.” (at 3)
“Respondents' contention that they have standing because they incurred certain costs as a reasonable reaction to a risk of harm is unavailing—because the harm respondents seek to avoid is not certainly impending. In other words, [people] cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” (at 4)
“It follows that plaintiffs lack standing to sue, and plaintiffs who lack standing cannot receive either damages or an injunction.” (at 9)
“History and congressional judgment both make clear that the plaintiffs' alleged statutory injuries are adequately concrete to establish Article III standing.” (at 12 (dissent))
Factual background
Midvale Indemnity and American Family Mutual (collectively Midvale) created an 'instant quote' feature on their websites that auto-filled driver's license numbers when a user entered basic identifying information. Anyone could enter a stranger's name and address and receive the license number. Midvale discontinued the feature after noticing unusual activity suggesting misuse, and it notified affected individuals. Three plaintiffs who received notice filed suit under the Driver's Privacy Protection Act and state negligence law, alleging that their driver's license numbers were disclosed and that they suffered injuries including credit monitoring costs, fraudulent unemployment claims, and anxiety.
Procedural history
The district court dismissed the plaintiffs' complaint for lack of standing, concluding that they had not alleged a concrete injury traceable to the defendants' disclosure of their driver's license numbers. The plaintiffs appealed.