The U.S. Court of Appeals for the Seventh Circuit recently affirmed a trial court’s dismissal of a purported data leak class action alleging unauthorized disclosure of driver’s license numbers. In so ruling, the Court held that the plaintiffs did not demonstrate a concrete injury traceable to the disclosure of their driver’s license numbers, and therefore lacked Article III standing.
A copy of the opinion in Baysal v. Midvale Indemnity Company is available at: Link to Opinion.
An auto insurance company created an “instant quote” feature on their websites. Anyone who supplied basic identifying information could receive a quote for auto insurance. Each site would autofill some information, including the number of the applicant’s driver’s license. Anyone could enter a stranger’s name and home address, which caused the form to disclose the number of the stranger’s driver’s license.
The insurer discontinued the autofill feature after observing unusual activity suggesting misuse and notified people whose information had been disclosed improperly. Three consumers who received the insurer’s notice filed a purported class action under the federal Driver’s Privacy Protection Act (DPPA), 18 U.S.C. 2721–25.
The trial court held that the consumers lacked standing, having failed to show a concrete injury traceable to the disclosure.
On appeal, the consumers contended that the disclosure injured them by causing worry and anxiety, which led to other steps, such as paying for credit monitoring. However, the Seventh Circuit held that worry and anxiety are not the kind of concrete injury essential for Article III standing. See Wadsworth v. Kross, Lieberman & Stone, Inc., 12 F.4th 665, 668–69 (7th Cir. 2021). Additionally, the Court noted that the expense of credit-monitoring did not stem from the asserted wrong because a driver’s license number cannot be used to obtain credit in someone else’s name. See Amnesty International USA, 568 U.S. 398, 416 (2013).
The consumers also alleged that bogus unemployment insurance claims were filed in New York in the names of two of them, but the Seventh Circuit observed that the complaint was silent on what harm came from the purported insurance claims or how knowledge of a driver’s license number could facilitate this kind of fraud. A suit fails for lack of standing unless the complaint plausibly alleges concrete injury caused by the asserted wrong. See, e.g., Department of Education v. Brown, 143 S. Ct. 2343 (2023). Here, the Court held that the complaint did not do so.
In response, the consumers maintained that a violation of the DPPA is enough by itself to establish standing because Congress provided for an award of “liquidated damages” when actual damages cannot be shown. 18 U.S.C. §2724(b)(1). However, the Seventh Circuit held that this line of argument is incompatible with TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021), and Spokeo, Inc. v. Robins, 578 U.S. 330 (2016).
Specifically, Spokeo and TransUnion rejected the proposition that Congress can create standing just by requiring payment in the absence of an injury. Nevertheless, the Court pointed out that these decisions did mandate that courts should respect a legislative determination that concrete harms need remedies. The DPPA here does not identify any particular compensable harm, so the Court noted that TransUnion and Spokeo say that, in this situation, courts should inquire whether what the plaintiff asserts as an injury has a historical or common-law analog.
The Seventh Circuit could not identify any states that make disclosure of a driver’s license number tortious and remarked that the consumers could not either. The Court reasoned that this is because a driver’s license number is not potentially embarrassing or an intrusion on seclusion; it is a neutral fact derived from a public records system, a fact legitimately known to many private actors and freely revealed to banks, insurers, hotels, and others.
Accordingly, the Seventh Circuit concluded that the consumers did not plausibly allege that the insurer’s disclosure of their driver’s license numbers caused them any injury, and the disclosure of a number in common use by both public and private actors does not correspond to any tort. Thus, the Court affirmed the trial court’s dismissal of the consumers’ claims for lack of standing.
