After Colin Thomas of Miami Beach, Fla., registered his Chevrolet Impala in 2002, his vehicle registration information -- along with 284,000 others -- was sold by the state to a Coral Gables, Fla., law firm researching litigation against car dealerships.
Thomas sued Charles M. Hartz and his law firm, George Hartz Lundeen Fulmer Johnson, claiming the attorneys violated the federal Driver's Privacy Protection Act. The law drastically limiting the release of state motor vehicle data was designed to eliminate easy access to private information after the slaying of an actress by a stalker. The Coral Gables firm said it was just trying to build a case against unscrupulous car dealers.
"He felt violated," said Thomas' attorney, Roger Slade, a partner at Pathman Lewis in Miami.
But the 11th U.S. Circuit Court of Appeals found no abuse of discretion April 24 when U.S. District Judge Jose E. Martinez in Miami granted summary judgment. He ruled Thomas was out of luck because the law firm's work met one of 14 exceptions to the law amended in 2000.
The appeals court also refused to consider whether the law firm waived attorney-client privilege under a work-product exception because the discovery issue wasn't raised before Martinez.
"We were pleased with the decision and thought it correctly decided for reasons both stated in the opinion and in our briefs," said David Palmer Hartnett of Hinshaw & Culbertson of Miami, who represented Hartz and the law firm.
Even though the decision was a setback for privacy proponents pursuing DPPA litigation, it's hardly the death knell.
There's been a proposed settlement in another case before Martinez involving ChoicePoint, an Alpharetta, Ga.-based database firm that provides information to government and industry. The settlement calls for a compliance program. Two other defendants in the case have refused to settle with a class that could be as large as 200 million Americans.
A third Miami lawsuit against the head of the state Department of Highway Safety and Motor Vehicles is seeking class action status. That suit aims to hold the state liable for failing to comply with the law by the deadlines set by Congress.
The 2000 amendment expressively forbids use of the information without a driver's consent while carving out 14 exceptions. It took Florida until 2004 to comply, and the lawsuits aim at database sales by the state during the transition years.
Martinez has all three cases. He has shown exasperation, stating in his order dismissing litigation against the heads of motor vehicles, "This court declines to accompany the parties on their wild ride through constitutional law."
The 11th Circuit resurrected the suit against the state officials February 2007 after Martinez dismissed it, saying the state does not have inherent sovereign immunity on the issue. The 11th Circuit also sided with plaintiffs in 2005 when it ruled in a federal class action suit against Fidelity Federal Bank & Trust of West Palm Beach that actual damages do not have to be proven to collect.
The ruling means plaintiffs only have to show the state violated the DPPA, not that their information was sold and used for nefarious purposes such as identity theft. "The courts are trying to find a middle ground so businesses are not exposed but at the same time people's privacy is protected," said Wayne M. Pathman, whose firm sued the law firm and Fidelity in 2003. He said courts are weighing the right to do business against the right to privacy.
"There's a halfway approach to commerce and privacy, and the courts are going to have to find out what should be protected," he said.
Slade said the litigation poses "some fascinating legal questions." At the center of the dispute are companies whose sole purpose is to mine private information about individuals, often for commercial purposes. States can make a mint selling this information.
"Banks of information are worth a lot of money. It's not just trade in dollars anymore. Information is money," Pathman said.
Pathman Lewis, which sued on Thomas' behalf, also represents auto dealers who are potential targets of a suit by George Hartz.
VAGUE EXCEPTIONS OFFER LOOPHOLES
Many exceptions to the law are no-brainers, such as permitting police to gain access to the information and for employers to use it for employee background checks. But others are open to interpretation such as "for use in research activities" and "investigations in anticipation of litigation."
"This safe harbor allows transactions between state governments, like the department motor vehicles and commercial organizations like data brokers," said Larry Ponemon, who runs the Ponemon Institute in Traverse City, Mich., which is dedicated to protecting consumer information.
Ponemon said the litigation in Florida reflects what's happening in federal courts elsewhere. Courts are wrestling with the issue of sovereign immunity for state officials and who carries the burden of proof on alleged violations.
"It seems like the Florida Bar is pretty aggressive on these issues," Ponemon said. "I don't think a government organization should be held harmless simply because it's government instead of business. It has responsibilities to secure information about the public."
The issue of who regulates the data brokers still has not been determined, he said. Many are mom-and-pop operations with little security control.The proposed settlement with Checkpoint and several other top data collectors -- Experian Information Solutions of Dallas, Reed Elsevier of London, Seisant of Fort Lauderdale and others -- goes beyond the law to create a standard business practices for the industry. The defendants also have agreed to the injunctive relief.
Plaintiffs attorney Tod Aronovitz, who is lead counsel in the data broker case, said he could not comment because litigation is still pending against two defendants. He is also lead counsel in the case against state officials, which is scheduled for trial this summer.
The ChoicePoint settlement notice said the agreement "enhances the protection of each class member's personal information or highly restricts personal information from motor vehicle records. An independent third party will review each settling defendant's compliance procedures."
Meanwhile, attorneys for Thomas are considering an appeal to the U.S. Supreme Court.
While the 11th Circuit said it appeared Thomas' information was used for legitimate purposes, it also placed the burden of proof on the plaintiff. Judge Charles R. Wilson, writing for a panel which included Judges Gerald Tjoflat and Stanley Marcus, said Congress is silent on the burden of proof and it consequently falls on plaintiffs.
"I think the court reversed the natural priority in this instance and put the burden on the wrong party," Slade said.
The defense said in its motion in district court to dismiss Thomas' complaint that the law firm "could not have knowingly violated DPPA since the state of Florida is responsible for assuring compliance." Ponemon said many consumers would never think their driver's license information would be sold by the state and consider the personal information collected by the state to be sacred. Next to a Social Security number, Ponemon said a driver's license is the "Holy Grail" of identity theft.
Ponemon said the litigation boils down to a simple question for the courts: "Where do we want to draw the line? When is it acceptable for the state of Florida to share that information with people with legitimate business?"
