ORDER

SUSAN RICHARD NELSON, District Judge.

This matter is before the Court on cross motions for summary judgment.1 Defendant Cities of Burnsville, Dayton, Roseville, and Wayzata and individual Defendants David Luchsinger, Richard Pietrzak, Dennis Mooney, and Timothy McCarthy (collectively, the "Moving Defendants") filed a Motion for Summary Judgment ("Moving Defs.' Mot. for Summ. J.") [Doc. No. 228].) Plaintiff Patricia Mae Kerr Karasov also filed a Motion for Partial Summary Judgment ("Pl.'s Mot. for Partial Summ. J.") [Doc. No. 238] as to portions of her claims against the Moving Defendants. For the reasons set forth below, the Moving Defendants' Motion for Summary Judgment is granted in part and denied in part and Plaintiff's Motion for Partial Summary Judgment is granted in part and denied in part.

I. BACKGROUND

This suit stems from Plaintiff's allegations that the Moving Defendants improperly accessed her personal driver's license information in violation of the Driver's Privacy Protection Act ("DPPA"). On the parties' cross motions for summary judgment, the Court recounts the facts that are undisputed between the parties and notes where material disputes arise.

A. Facts

1. Plaintiff Patricia Mae Kerr Karasov

Plaintiff Patricia Mae Kerr Karasov ("Karasov") served as a Hennepin County District Court Judge from 1995 until 2013. (Aff. of Stephanie A. Angolkar ("First Angolkar Aff.") [Doc. No. 231], Ex. 1 ("Karasov Dep.") at 152 [Doc. No. 231-1].) Prior to that time, she worked as an Assistant County Attorney for Hennepin County. (Id.) Between 2009 and 2010, Karasov was investigated by Minnesota's Board of Judicial Standards (the "Board") for allegedly living outside of her judicial district, tax fraud, and refusal to cooperate with the investigation. (See id. at 16-20.) She believes the complaint against her was made public in October of 2010. (See id. at 16-17.) The Board held hearings on the complaint in January of 2011. (See id. at 110.) Local media covered this investigation and the ensuing hearings, but Karasov is not exactly sure when the coverage began. (Id. at 17, 47, 81.) None of the Moving Defendants were in involved with the investigation or hearings. (Id. at 110-11.)

As a public figure, Karasov took certain steps to guard against personal information, like her home address, being publicly available. (See id. at 97-98.) However, in 2013, Karasov was notified by the Department of Natural Resources that one of its employees had used his law enforcement credentials to access Karasov's—and other women's—personal information in the Department of Vehicle Service's ("DVS") database ("DVS Database") for voyeuristic reasons. (Id. at 29, 50-51, 95-96.) Karasov was deeply concerned by this incident and decided to request an audit report showing the instances in which her DVS records were accessed. (Id. at 28-29.) That audit revealed that numerous other male law enforcement officers had accessed her personal driver's license information over the course of several years. (Id. at 96.) Learning about these accesses, for which Karasov could discern no legitimate purpose, caused her a great deal of anxiety about issues ranging from identity theft, to her professional reputation, to her personal safety. (See id. at 95-97, 108-09.) As she describes it, "all these people have guns and they know where I live. And I don't know who the outlier is. And that causes me anxiety. Causes me to feel distressed. And there is nothing I can do about it." (Id. at 97.)

2. Defendants Timothy McCarthy and the City of Wayzata

Defendant Timothy McCarthy ("McCarthy") is a police officer for Defendant City of Wayzata ("Wayzata"). (First Angolkar Aff., Ex. 2 ("McCarthy Dep.") at 5 [Doc. No. 231-2].) In this capacity, McCarthy has access to and uses the DVS Database by virtue of a user name and password provided by Wayzata. (Id. at 17-19.) Prior to 2011, McCarthy knew he was supposed to use the DVS Database only for business-related purposes, yet admits to looking up friends, family members, and people in the media out of personal curiosity. (Id. at 23, 34, 42-43.)

McCarthy knew Karasov because he worked with her during the time she was an Assistant County Attorney. (Id. at 12.) However, he cannot recall having any interactions with her since she became a judge in 1995. (Id. at 13.) He was not involved in the Board's investigation of Karasov. (Id. at 15.)

On September 9, 2010, McCarthy accessed Karasov's personal information in the DVS Database. (Id. at 15-16; Aff. of Sonia Miller-Van Oort ("First Van Oort Aff.") [Doc. No. 241], Ex. E ("DVS Database Audit Report") at 1 [Doc. No. 241-5].) When questioned about the reason for accessing her information McCarthy explained as follows:

(McCarthy Dep. at 14-15.) There is no evidence in the record that Karasov was the subject of a Wayzata police investigation, was pulled over in a traffic stop in Wayzata, or had any contact with the Wayzata police department around this time that could explain McCarthy's access of her information.

3. Defendants Dennis Mooney and the City of Roseville

During the relevant period, Defendant Dennis Mooney ("Mooney") was a police officer for Defendant City of Roseville ("Roseville"), but has since retired. (First Angolkar Aff., Ex. 3 ("Mooney Dep.") at 9-10 [Doc. No. 231-3].) By virtue of his position as a police officer, Mooney had access to the DVS Database and used it to carry out some of his law enforcement duties. (See id. at 20-21.) Mooney understood that he was only to use the DVS Database for law enforcement reasons, not personal reasons. (Id. at 22-23.)

Mooney does not know Karasov or her family. (Id. at 40, 46.) He does remember Karasov being in the news during the Board's investigation and believes that this was his only knowledge of her prior to this lawsuit. (See id. at 52, 58.) Mooney was not involved with the Board's investigation of Karasov. (Id. at 32-33.) He cannot recall any law enforcement need to access Karasov's information in the DVS Database. (Id. at 50-51.)

On October 13, 2010, Mooney accessed Karasov's personal information on the DVS Database. (Id. at 49; DVS Database Audit Report at 1.) Mooney does not remember why he accessed Karasov's information. (Mooney Dep. at 49-50.) There is no evidence in the record that Karasov was the subject of a Roseville police investigation, was pulled over in a traffic stop in Roseville, or had any contact with the Roseville police department around this time that could explain Mooney's access of her information.

4. Defendants Richard Pietrzak and the City of Dayton

Defendant Richard Pietrzak ("Pietrzak") is currently retired, but during the relevant period served as chief of police for Defendant City of Dayton ("Dayton"). (First Angolkar Aff., Ex. 4 ("Pietrzak Dep.") at 18 [Doc. No. 231-4].) Prior to serving in that role, Pietrzak held other law enforcement positions in Minnesota. (Id. at 18, 23-25.) As a police officer, including as Chief in Dayton, Pietrzak regularly used the DVS Database to carry out a variety of law enforcement functions. (Id. at 67-69, 81.) However, Pietrzak also looked up individuals in the database for personal reasons, like checking the driving records of his ex-wife and daughters, finding the Hennepin County Sheriff's address for a Christmas card, and looking up his deceased father. (Id. at 136-43.) Pietrzak claims he did not know that using the DVS Database for personal reasons was impermissible when he engaged in these accesses. (Id. at 143-46.)

Pietrzak has no personal or professional relationship with Karasov. (Id. at 102.) He believes that he knows of her only through hearing about the Board's investigation in the news. (See id. at 100-03.) However, Pietrzak was not involved with that investigation. (See id. at 84-85.) Pietrzak is not aware of any contact between the Dayton police department and Karasov during his time as Chief. (Id. at 103-04.)

On January 4 and 5, 2011, Pietrzak accessed Karasov's personal information on the DVS Database. (DVS Database Audit Report at 1.) He does not remember accessing this information or his reason for doing so. (Pietrzak Dep. at 201.) There is no evidence in the record that Karasov was the subject of a Dayton police investigation, was pulled over in a traffic stop in Dayton, or had any contact with the Dayton police department around this time that could explain Pietrzak's access of her information.

5. Defendants David Luchsinger and the City of Burnsville

Defendant David Luchsinger ("Luchsinger") is a police officer for Defendant City of Burnsville ("Burnsville"). (First Angolkar Aff., Ex. 4 ("Luchsinger Dep.") at 7, 9 [Doc. No. 231-5].) By virtue of his position as a police officer, Luchsinger had access to the DVS Database and used it to carry out some of his law enforcement duties. (Id. at 15-16.)

Luchsinger does not know Karasov or her family personally. (Id. at 67-68, 70.) All he knows about Karasov is what he read and heard about the Board's investigation of her in the news. (Id. at 66-67.) However, Luchsinger was not involved with the Board's investigation of Karasov. (Id. at 65.)

On January 5, 2011, Luchsinger accessed Karasov's personal information in the DVS Database. (DVS Database Audit Report at 2.) Luchsinger does not remember accessing Karasov's information on this occasion or his reason for doing so. (Luchsinger Dep. at 74-76.) He admits it is possible he accessed her information based on his curiosity after reading a newspaper article about the Board's investigation. (Id. at 76-77.) Luchsinger is unaware of any law enforcement reason for his access of Karasov's information. (Id. at 77.) There is no evidence in the record that Karasov was the subject of a Burnsville police investigation, was pulled over in a traffic stop in Burnsville, or had any contact with the Burnsville police department around this time that could explain Luchsinger's access of her information.

6. How the Audit Report Tracks Database Accesses

The DVS Database tracks when an individual's information is accessed and, upon request, an audit report provides information about these accesses such as—the date and time the access occurred, the agency and specific user accessing the information, and the type of information viewed. (See DVS Database Audit Report; Aff. of Stephanie A. Angolkar in Opp. to Pl.'s Mot. for Partial Summ. J. ("Angolkar Aff. in Opp.") [Doc. No. 244], Ex. 1 ("Jacobson Dep.")3 at 152-53 [Doc. No. 244-1].) Law enforcement using the DVS Database can search for an individual in a variety of ways, including by name, driver's license number, or license plate number. (See Jacobson Dep. at 61-62, 138-39, 242.) Once an officer locates the individual's record within the database, he/she can make further "queries" or select various "tabs" depending on the particular information he/she wishes to view for that individual (e.g., photos, addresses, driving record, motor vehicle information, etc.) (Id. at 144-48, 150-51, 247.)

Important here is how audit reports track and present accesses of information in the DVS Database. An officer's initial access of an individual's record appears as one "line" on the audit report. (Id. at 139-40, 245-46.) From the "main page" for that individual, the officer can then select a tab or run a query for particular information. (Id. at 144-45, 247-48.) If a query is made or a tab selected within the same minute of the initial access, it does not appear as an additional line on the audit report. (Id. at 145-46, 227-28, 255, 259-60.) As a result, any and all activity on an individual's DVS Database profile within a given minute is displayed as a single line on an audit report, regardless of how many tabs within the profile are selected. (Id. at 258-60.) However, if an officer views a particular tab of information from one minute to the next (e.g., 9:37am into 9:38am), or selects a new tab more than one minute after his/her last selection, this fact will be displayed as another line on the audit report.4 (See id. at 150-52, 247-48, 254-55, 258-60.)

The audit report for Karasov's DVS record shows two lines related to McCarthy's access on September 9, 2010. (DVS Database Audit Report at 1.) It shows one line related to Mooney's access on October 13, 2010. (Id.) The report shows five lines associated with Pietrzak's accesses—four lines related to the access on January 4, 2011 and one for the access on January 5, 2011. (Id.) Finally, the report shows one line related to Luchsinger's access on January 5, 2011. (Id. at 2.) The parties do not dispute how the audit report tracks and presents accesses of information within the database. However, as described below, they do dispute how this report should be used to calculate the number of DPPA violations—if the accesses were improper.

B. Procedural History

In May of 2014, Karasov brought suit against a variety of municipal entities (including Burnsville, Dayton, Roseville, and Wayzata) and John and Jane Doe defendants alleging that they violated the DPPA by accessing her driver's license information without a permissible purpose. (See Compl. [Doc. No. 1].) Initially, Karasov could not name specific individuals as defendants because the Department of Public Safety ("DPS")—which oversees DVS—would not provide that information without a subpoena or court order. (Aff. of Sonia Miller-Van Oort in Opp. ("Van Oort Aff. in Opp.") at ¶ 2 [Doc. No. 248].) Many of the Defendants Karasov did name immediately moved to dismiss her claims. (Id. at ¶ 3.) Karasov's counsel had attempted to engage in discovery to acquire the names of individual defendants in other DPPA cases with a similar posture, but "this was met with resistance." (Id.) Based on this prior experience, Karasov's counsel did not attempt to discovery the names of individual Defendants until after the Court ruled on the motions to dismiss and the parties held their Rule 26(f) conference. (See id.)

The Court granted in part and denied in part the motions to dismiss on January 8, 2015. (See Doc. No. 98.) That order was subsequently amended on February 3, 2015. (See Doc. No. 102.) Shortly thereafter, the parties held their Rule 26(f) conference wherein Karasov "clearly advised Defendants of [her] intention to amend her Complaint to add individual defendants after their identities were disclosed. . . ." (Van Oort Aff. in Opp. at ¶ 3.) Defendants did not object. (Id.) However, it was not until May 26, 2015 that Karasov subpoenaed DPS for the names of the individuals who accessed her DVS records. (Id. at ¶ 4.)

DPS provided the individuals' names on June 25, 2015. (Id.) Karasov sought a stipulation from Defendants allowing her to amend her complaint in early July of 2015, but they refused under after Karasov filed a motion for leave to amend. (Id. at ¶ 5.) It was not until October of 2015 that Karasov filed an amended complaint naming individual Defendants (including Luchsinger, Pietrzak, Mooney, and McCarthy). (See First Am. Compl. [Doc. No. 173].)

The Moving Defendants (Burnsville, Dayton, Roseville, Wayzata, Luchsinger, Pietrzak, Mooney, and McCarthy) now move for summary judgment on Karasov's claims against them. (Moving Defs.' Mot. for Summ. J.) They filed a Memorandum of Law in Support ("Defs.' Mem. in Supp.") [Doc. No. 230] and Reply in Support ("Defs.' Reply") [Doc. No. 250]. Karasov filed a Memorandum of Law in Opposition ("Pl.'s Mem. in Opp.") [Doc. No. 246].

Karasov also moves for partial summary judgment on some elements of her claims against the Moving Defendants. (Pl.'s Mot. for Partial Summ. J.) She filed a Memorandum of Law in Support ("Pl.'s Mem. in Supp.") [Doc. No. 240] and Reply in Support ("Pl.'s Reply") [Doc. No. 253]. The Moving Defendants filed a Memorandum in Opposition ("Defs.' Mem. in Opp.") [Doc. No. 243].

II. DISCUSSION

A. Legal Standard

Summary judgment is proper if, drawing all reasonable inferences in favor of the non-moving party, there is no genuine issue as to any material fact and the moving party is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 322-23 (1986); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 249-50 (1986); Morriss v. BNSF Ry. Co., 817 F.3d 1104, 1107 (8th Cir. 2016). "Summary judgment procedure is properly regarded not as a disfavored procedural shortcut, but rather as an integral part of the Federal Rules as a whole, which are designed `to secure the just, speedy, and inexpensive determination of every action.'" Celotex, 477 U.S. at 327 (quoting Fed. R. Civ. P. 1).

The party moving for summary judgment bears the burden of showing that the material facts in the case are undisputed. Id. at 323. However, a party opposing summary judgment "`may not rest upon the mere allegation or denials of his pleading, but . . . must set forth specific facts showing that there is a genuine issue for trial,' and `must present affirmative evidence in order to defeat a properly supported motion for summary judgment.'" Ingrassia v. Schafer, 825 F.3d 891, 896 (8th Cir. 2016) (quoting Anderson, 477 U.S. at 256-57). "[T]he nonmoving party must `do more than simply show that there is some metaphysical doubt as to the material facts.'" Conseco Life Ins. Co. v. Williams, 620 F.3d 902, 910 (8th Cir. 2010) (quoting Matsushita Elec. Indus. Co., v. Zenith Radio Corp., 475 U.S. 574, 586 (1986)). Summary judgment is proper where the nonmoving party fails "`to make a showing sufficient to establish the existence of an element essential to that party's case. . . .'" Walz v. Ameriprise Fin., Inc., 779 F.3d 842, 844 (8th Cir. 2015) (quoting Celotex, 477 U.S. at 322). While the moving party bears the burden of showing that the facts are undisputed, a judge is not confined to considering only the materials cited by the parties, and "it may consider other materials in the record." Fed. R. Civ. P. 56(c)(3).

B. The Driver's Privacy Protection Act

The DPPA was enacted to address privacy concerns about the personal information held by state departments of motor vehicles, like Minnesota's DVS. See Maracich v. Spears, 133 S.Ct. 2191, 2198 (2013). "Personal information" includes "an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information. . . ." 18 U.S.C. § 2725(3). In relevant part, the DPPA makes it unlawful "for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title." 18 U.S.C. § 2722(a). The statute lists fourteen "permissible uses" when a driver's personal information may be obtained and disclosed. See 18 U.S.C. § 2721(b)(1)-(14). Relevant here, such information may be obtained or disclosed "[f]or use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions." 18 U.S.C. § 2721(b)(1).

The DPPA provides a civil cause of action for those whose personal information is improperly accessed. 18 U.S.C. § 2724. "To establish a DPPA violation, [a plaintiff] must prove that the Defendants 1) knowingly 2) obtained, disclosed, or used personal information, 3) from a motor vehicle record, 4) for a purpose not permitted." McDonough v. Anoka Cty., 799 F.3d 931, 945 (8th Cir. 2015), cert. denied sub nom. McDonough v. Anoka Cty., Minn., 136 S.Ct. 2388 (2016).

C. The Moving Defendants' Motion for Summary Judgment5

The Moving Defendants argue that they are entitled to summary judgment for one or more of the following reasons. First, they contend that Karasov's Amended Complaint does not relate back to her original Complaint and thus her claims against Luchsinger, Pietrzak, Mooney, and McCarthy (collectively, the "Officers") are time barred. (See Defs.' Mem. in Supp. at 6-12.) Second, they claim that the Officers are entitled to qualified immunity. (See id. at 13-16.) Third, the Moving Defendants contend that Burnsville, Dayton, Roseville, and Wayzata (collectively, the "Cities") are neither directly nor vicariously liable for the Officers' accesses of Karasov's DVS record. (See id. at 16-21.) Fourth, they assert that Karasov lacks Article III standing to bring her claims because she has not suffered an injury in fact. (See id. at 22-24.) Fifth, the Moving Defendants argue that Summer's claims are barred by the rule of lenity because the phrase "in carrying out its functions" in 18 U.S.C. § 2721(b)(1) is vague and ambiguous. (See id. at 24-27.) The Court addresses these arguments in turn.

1. Relation Back

The Moving Defendants argue that Karasov's DPPA claims against the Officers are time barred because her First Amended Complaint—wherein she first named the Officers as an individual Defendants—does not relate back to her original Complaint. (See id. at 6-12.) Specifically, they contend that Karasov's failure to name the Officers was not a "mistake" under Federal Rule of Civil Procedure 15(c)(1) ("Rule 15(c)(1)"), but instead was caused by a "lack of knowledge" and hence her amended complaint does not relate back. (See id. at 8-9.) Karasov argues that relating back is appropriate here because the Officers had constructive notice of her claims when she first brought suit in 2014 and she amended to name the Officers as soon as was practicable under the circumstances. (See Pl.'s Mem. in Opp. at 40.) Specifically, she contends that it is unfair not to allow her claims to relate back because she could not have discovered the Officers' names or amended her complaint before she did. (See Doc. No. 247 at 23-35.)

The DPPA carries a four-year statute of limitations that begins to run at the time of the improper access. McDonough, 799 F.3d at 942-43. The Officers accessed Karasov's information between September 2010 and January 2011. Karasov first brought her DPPA claims in May of 2014, within the four-year statute of limitations, but did not amend her complaint to name Jackson until October of 2015, well outside the statute of limitations. Thus, unless Karasov's amended complaint relates back, her DPPA claims against the Officers are time barred.

Rule 15(c)(1) provides that an amendment to the pleadings relates back to the date of the original pleading in relevant part when:

Fed. R. Civ. P. 15(c)(1)(B)-(C). The Supreme Court held that a "mistake" contemplated by Rule 15(c)(1)(C)(ii) is "`[a]n error, misconception, or misunderstanding; an erroneous belief.'" Krupski v. Costa Crociere S. p. A., 560 U.S. 538, 548 (2010) (quoting Black's Law Dictionary 1092 (9th ed.2009)).

This Court, addressing identical arguments under nearly identical circumstances, previously held that initially naming John and Jane Doe defendants is not the sort of mistake as to the proper party's identity contemplated by Rule 15(c)(1)(C). See Rollins v. Albert Lea, et al., 14-cv-299 (SRN/HB), slip op. at 18-21 (Doc. No. 237) (D. Minn. Nov. 17, 2016). Numerous other courts in this District recently reached the same conclusion. See Taylor v. City of Amboy, No. 14-cv-0722 (PJS/TNL), 2016 WL 5417190, at *2 (D. Minn. Sept. 27, 2016); Engebretson v. Aitkin Cty., No. 14-cv-1435 (ADM/FLN), 2016 WL 5400363, at *5-6 (D. Minn. Sept. 26, 2016); Krekelberg v. Anoka Cty., No. 13-cv-3562 (DWF/TNL), 2016 WL 4443156, at *5-6 (D. Minn. Aug. 19, 2016); Potocnik v. Carlson, No. 13-cv-2093 (PJS/HB), 2016 WL 3919950, at *5 (D. Minn. July 15, 2016); Heglund v. Aitkin Cty., No. 14-cv-296 (ADM/LIB), 2016 WL 3093381, at *5-6 (D. Minn. June 1, 2016). The Court adopts its reasoning from Rollins and applies it here.

Karasov did not make a "mistake" when she initially brought her DPPA claims against numerous John and Jane Doe defendants. Rather, she lacked knowledge about the identities of these individuals. Karasov's counsel—based on her experience in other DPPA cases—elected not to seek discovery related to the Doe defendants in this matter until after the motions to dismiss were resolved. As a result, Karasov did not serve discovery aimed at acquiring the names of the Doe defendants until May of 2015, several months after the statute of limitations lapsed on her claims against the Officers. These facts do not constitute a mistake as to the identity of a party under Rule 15(c)(1)(C)(ii), nor do they present a scenario warranting the tolling of the statute of limitations. See Engebretson, 2016 WL 5400363 at *6 (refusing to apply the doctrine of equitable estoppel where the defendants did not engage in any misleading conduct regarding the identity of the appropriate parties); Krekelberg, 2016 WL 4443156 at *6 (same); Potocnik, 2016 WL 3919950 at *5 (same). Thus, Karasov's claims against the Officers are dismissed because they are time barred.

Like in Rollins, neither party offers any argument about what effect, if any, the dismissal of Karasov's claims against the Officers has on her claims against the Cities (the Officers' employers). See Rollins, 14-cv-299 (SRN/HB), slip op. at 21. Karasov named the Cities in her original complaint and thus her claims against them do not suffer from the same timeliness issues as those against the Officers. At least one court in this District found that even where DPPA claims against individual defendants are time barred, claims against the defendant-employers—premised on vicarious liability—are not, so long as those employers were named before the statute of limitations expired. See Taylor, 2016 WL 5417190 at *4 n.5, *5 n.8. At a minimum, where the parties have not adequately briefed whether DPPA claims against a defendant-employer survive even when the claims against a defendant-employee are dismissed, courts decline to award summary judgment in favor of the defendant-employer on this basis. See Potocnik, 2016 WL 3919950 at *8. The Court follows its reasoning in Rollins and—to the extent the Moving Defendants argue that the Cities are entitled to summary judgment because Karasov's claims against the Officers are time barred—declines to award summary judgment on that basis. See Rollins, 14-cv-299 (SRN/HB), slip op. at 21.

2. Qualified Immunity

The Moving Defendants assert that the Officers are entitled to qualified immunity against Karasov's DPPA claims.6 (Defs.' Mem. in Supp. at 12-16.) First, they argue that Karasov has "no evidence these individual officers accessed her driver's license record out of personal interest or curiosity" and instead merely "speculates" about the Officers' reasons for their accesses. (Id. at 12-13.) Second, they contend that "Karasov cannot cite any court decision that `clearly established' a DPPA violation when an officer does not remember why six years ago he ran her record when he does not know her. . . ." (Id. at 16.)

Karasov argues that the record does not allow this Court to find, as a matter of law, that any of the Officers are entitled to qualified immunity. (See Pl.'s Mem. in Opp. at 19-28.) Specifically, she contends that recent case law holds that an officer's inability to remember why he/she accessed an individual's personal information precludes summary judgment on the basis of qualified immunity. (Id. at 20.) Karasov further asserts that the record shows that each of the Officers was familiar with the publicity surrounding the Board's investigation, accessed her records during the time that investigation was in the news, and that none of them can provide a law enforcementrelated reason for accessing her information. (See id. at 24-26.) Karasov also argues that it was clearly established since the DPPA's enactment in 1994 that accessing drivers' personal information without a permissible purpose is unlawful. (See id. at 27-28.)

Qualified immunity protects government officials from liability "unless the official's conduct violates a clearly established constitutional or statutory right of which a reasonable person would have known." Brown v. City of Golden Valley, 574 F.3d 491, 495 (8th Cir. 2009). Determining whether qualified immunity applies involves a two-part analysis: (1) whether the facts show the violation of a constitutional or statutory right, and (2) whether that right was clearly established at the time of the alleged misconduct. Saucier v. Katz, 533 U.S. 194, 201 (2001); see Brown, 574 F.3d at 496. Courts may address the prongs of the qualified immunity analysis in whatever order they deem appropriate based on the circumstances of a case. Pearson v. Callahan, 555 U.S. 223, 236 (2009).

The Court will first consider whether the rights afforded by the DPPA were clearly established when the Officers accessed Karasov's personal information. A right is "sufficiently clear" when "a reasonable official would understand that what he is doing violates that right." Hope v. Pelzer, 536 U.S. 730, 739 (2002). However, this does not mean "that an official action is protected by qualified immunity unless the very action in question has previously been held unlawful, but it is to say that in the light of pre-existing law the unlawfulness must be apparent." Id. (quotations and citations omitted). "The relevant, dispositive inquiry is whether it would be clear to a reasonable officer that the conduct was unlawful in the situation he confronted." Saucier, 533 U.S. at 194-95.

The Officers argue that "Karasov cannot cite any court decision that `clearly established' a DPPA violation when an officer does not remember why six years ago he ran her record when he does not know her and did not look up her record out of curiosity or for personal reasons." (Defs.' Mem. in Supp. at 16.) This argument is without merit for at least three reasons. First, Hope rejects the suggestion that Karasov must produce case law specific to the particular circumstances of this case. Second, whether the Officers can recall why they accessed Karasov's information is irrelevant to whether her rights under the DPPA were clearly established at the time. Third, numerous courts have held that the DPPA's prohibition against accessing driver's personal information without a permissible purpose was clearly established since shortly after the statute's enactment in 1994. See McDonough, 799 F.3d at 944 n.6; Rollins, 14-cv-299 (SRN/HB), slip op. at 24; Mallak v. Aitkin Cty., 9 F.Supp.3d 1046, 1063 (D. Minn. 2014); Engebretson, 2016 WL 5400363 at *10; Heglund, 2016 WL 3093381 at *6. In 2010 and 2011—when the Officers accessed Karasov's information—any reasonable officer would have understood that it was unlawful to access a driver's personal information without a permissible purpose.

Next, the Court considers whether the record allows it to conclude as a matter of law that the Officers accessed Karasov's information for a permissible purpose (i.e., in furtherance of a government function). The Eighth Circuit recently concluded that suspicious patterns of accesses, such as those "correspond[ing] with a significant event," (e.g., an individual being featured in the news) are relevant to establishing DPPA claims. See McDonough, 799 F.3d at 947. It also held that where officers cannot offer "definitive explanation[s] for why they accessed [a plaintiff's] data[,]" it is appropriate to deny summary judgment on the basis of qualified immunity. See Mallak v. City of Baxter, 823 F.3d 441, 446-47 (8th Cir. 2016).

None of the Officers can remember why they accessed Karasov's personal information. None of them can give any law enforcement-related reason for their access of her personal information (e.g., Karasov was the subject of a traffic stop in their jurisdiction, Karasov was the subject of a criminal investigation in their jurisdiction, Karasov contacted them for assistance, they needed to get a warrant signed by Karasov, etc.). All of the Officers remember hearing about the Board's investigation into Karasov in the news at approximately the same time the audit report shows that they accessed her DVS record. Most of the Officers admit it is possible, if not probable, that they looked up Karasov after hearing or reading news reports about that investigation. On this record, the Court cannot conclude as a matter of law that the Officers are entitled to qualified immunity. See Mallak v. City of Baxter, 823 F.3d at 446-47; Taylor, 2016 WL 5417190 at *5 (denying the defendants summary judgment on the basis of qualified immunity because, even though the court "agree[d] with defendants that their proffered reasons for accessing [the plaintiff's DVS records] qualify as legitimate law-enforcement purposes[,]" a jury could conclude "that their proffered reasons are false and that they actually accessed [the plaintiff's records]" for an improper purpose).

3. Direct and Vicarious Liability

The Moving Defendants argue that the Cities are neither directly nor vicariously liable for any of Karasov's DPPA claims. (See Defs.' Mem. in Supp. at 16-21.) They contend that there is no direct liability because Karasov produced no evidence that the Cities knowingly accessed her personal information without a permissible purpose. (See id. at 16-17.) The Moving Defendants further claim that applying vicarious liability under the DPPA would be inconsistent with the statute's purpose in that it would upset the balance Congress struck between privacy concerns and the interest of government agencies in carrying out their functions. (Id. at 17-20.) Finally, they contend that even if vicarious liability applies, the Cities are not liable for the Officers' accesses because they were done outside the scope of the Officers' employment. (Id. at 20-21.)

Karasov argues that the DPPA specifically envisioned direct liability for entities like the Cities when it defined the term "person" to include non-State organizations and entities. (See Pl.'s Mem. in Supp. at 28-32.) She contends that the Cities could only act through their agents, the Officers, and did so by providing them with access to the DVS Database—meaning the Cities are directly liable for their Officers' knowing accesses of Karasov's personal information without a permissible purpose. (See id. at 32.) Karasov further argues that nearly every court outside of this District has found that municipal entities may be held vicariously liable for the DPPA violations of their employees. (See id. at 32-40.)

The Court first addresses direct liability. This Court has previously held that the DPPA allows for municipal entities like the Cities to be held directly liable. See Rollins, end of the inquiry. To establish liability, there must be evidence that the defendant-entity itself knowingly gave its employees access to drivers' license records for an impermissible purpose. Rollins, 14-cv-299 (SRN/HB), slip op. at 27-28; Engebretson, 2016 WL 5400363 at *7; Weitgenant v. Patten, No. 14-cv-255 (ADM/FLN), 2016 WL 1449572, at *5 (D. Minn. Apr. 12, 2016); see also Potocnik, 2016 WL 3919950 at *6 ("There is no evidence that the City facilitated access to the database for any reason other than to enable its officers to carry out their law-enforcement duties, which is a purpose permitted by the DPPA."); Jessen v. Blue Earth Cty., No. 14-cv-1065 (RHK/JSM), 2014 WL 5106870, at *4 (D. Minn. Oct. 10, 2014) ("Common sense suggests, and nothing in the Complaint alleges otherwise, that Blue Earth County provided DVS access to lawenforcement personnel for law-enforcement reasons. Therefore, Plaintiffs fail to plausibly allege that Blue Earth County or Supervisor Does personally used, disclosed, or obtained personal information for a non-permitted purpose.").

There is no evidence that the Cities knowingly provided the Officers with access to the DVS Database for an impermissible purpose. Instead, Karasov argues that because the Cities could only act through their officers, the Officers' knowingly impermissible accesses of her personal information are attributable to the Cities. (See Pl.'s Mem. in Opp. at 32.) But, this is an argument for vicarious liability. See Rollins, 14-cv-299 (SRN/HB), slip op. at 28; Taylor, 2016 WL 5417190 at *3 ("Taylor also argues that the municipal defendants are directly liable because they employed officers who allegedly violated the DPPA. . . . [T]his is an argument for vicarious, not direct, liability."); Potocnik, 2016 WL 3919950 at *6 (same). Thus, the Court holds that the Cities are not directly liable for Karasov's DPPA claims.

The Moving Defendants' argument that the Cities cannot be vicariously liable under the DPPA is unavailing. Two courts in this District previously rejected the idea that defendant-entities could be vicariously liable under the DPPA. See Weitgenant, 2016 WL 1449572 at *6-7; Jessen, 2014 WL 5106870 at *4 n.4. However—and more recently—other courts in this District, including this Court, held that defendant-entities may be vicariously liable under the DPPA. See Rollins, 14-cv-299 (SRN/HB), slip op. at 29-30; Taylor, 2016 WL 5417190 at *2; Engebretson, 2016 WL 5400363 at *8 (Judge Montgomery noted that she previously held vicarious liability did not apply to defendantentities in Weitgenant, but changed her mind in light of other recent District decisions); Potocnik, 2016 WL 3919950 at *6-7. Courts in other districts have similarly found defendant-entities may be vicariously liable under the DPPA. Schierts v. City of Brookfield, 868 F.Supp.2d 818, 821-22 (E.D. Wis. 2012); Menghi v. Hart, 745 F.Supp.2d 89, 98-99 (E.D.N.Y. 2010), aff'd, 478 F. App'x 716 (2d Cir. 2012); Margan v. Niles, 250 F.Supp.2d 63, 72-75 (N.D.N.Y. 2003).

The Moving Defendants argue that the Cities are not vicariously liable because the Officers' accesses were outside the scope of their employment. However, Karasov's theory appears to be that the Cities are vicariously liable because the Officers had apparent, or actual, authority to access her personal information by virtue of their employment as police officers for the Cities. (See Pl.'s Mem. in Opp. at 32.) Liability under the actual/apparent authority theory encompasses cases where tortious conduct is made possible or facilitated by actual agency. See Faragher v. City of Boca Raton, 524 U.S. 775, 801-02 (1998); Taylor, 2016 WL 5417190 at *2.

To summarize, the Court concludes as a matter of law that the Cities are not directly liable for Karasov's DPPA claims. However, the Cities are not entitled to summary judgment in their favor on the theory that they cannot be held vicariously liable for those claims. The record contains facts that are sufficient to allow Karasov to pursue her claims on the theory that the Cities are vicariously liable, by virtue of apparent or actual authority, for the Officers' accesses of her personal information.

4. Standing

The Moving Defendants argue that Karasov lacks the Article III standing necessary to assert her DPPA claim, citing the Supreme Court's recent decision in Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016), as revised (May 24, 2016). (See Defs.' Mem. in Supp. at 22-24.) Specifically, they contend that she has not suffered an "injury in fact" and that the DPPA's statutorily prescribed damages do not provide her with standing. (See id. at 22-23.) Karasov argues that the Moving Defendants' "injury in fact" standard was in fact rejected in Spokeo and that she satisfies the standard actually articulated in that case. (See Pl.'s Mem. in Opp. at 16-17.) Furthermore, she contends that she does not rely solely on statutory damages for standing, but rather has alleged that she suffered actual damages—emotional distress caused by the invasion of her privacy through these improper accesses. (See id. at 18-19; Karasov Dep. at 95-97, 108-09.)

Several courts in this District, including this Court, recently addressed the issue of standing in the context of the DPPA. Each one concluded that the plaintiffs had the required injury in fact (sometimes referred to as "concrete injury") by virtue of pleading an invasion of their right to privacy as a result of these impermissible accesses. Rollins, 14-cv-299 (SRN/HB), slip op. at 31-33; Engebretson, 2016 WL 5400363 at *4; Krekelberg, 2016 WL 4443156 at *2-3; Potocnik, 2016 WL 3919950 at *2-3; see Taylor, 2016 WL 5417190 at *2. Each court also held that emotional distress could qualify as the necessary injury in fact. See Rollins, 14-cv-299 (SRN/HB), slip op. at 32-33; Engebretson, 2016 WL 5400363 at *4; Krekelberg, 2016 WL 4443156 at *3; Potocnik, 2016 WL 3919950 at *3.

The Court holds that the Moving Defendants are not entitled to summary judgment on the basis of Karasov's standing to bring her claims. Karasov has standing "even if [she] can show nothing more than that defendants invaded her privacy by unlawfully obtaining information about her from the DVS database." See Potocnik, 2016 WL 3919950 at *3. Even if this invasion of privacy were not enough for standing, Karasov "has also offered evidence that she suffered actual injury in the form of emotional distress." See id.

5. Rule of Lenity

Finally, the Moving Defendants argue that they are entitled to summary judgment because the government function exception, 18 U.S.C. § 2721(b)(1), is ambiguous and thus the rule of lenity precludes Karasov's DPPA claims. (See Defs.' Mem. in Supp. at 24-26.) Karasov contends that the DPPA is not ambiguous and the rule of lenity does not apply. (See Pl.'s Mem. in Opp. at 41-42.)

The rule of lenity generally applies to the interpretation of criminal statutes and requires that ambiguity in those statutes be resolved in a defendant's favor so as not to convict or punish an individual on the basis of an ambiguous statute. See Bifulco v. United States, 447 U.S. 381, 387 (1980). It is at-best debatable whether that rule has any applicability in the context of the DPPA. See Maracich, 133 S. Ct. at 2209 (considering civil application of the DPPA under 18 U.S.C. § 2724 and concluding that "[i]n this framework, there is no work for the rule of lenity to do"). Assuming that the rule is applicable to the DPPA's civil section, it would require that "after considering text, structure, history, and purpose [of the DPPA], there remains a grievous ambiguity or uncertainty in the statute such that the Court must simply guess as to what Congress intended." Barber v. Thomas, 560 U.S. 474, 488 (2010).

At least two courts in this District, including this Court, rejected the argument that the government function exemption of the DPPA is subject to the rule of lenity. Rollins, 14-cv-299 (SRN/HB), slip op. at 33-34; Taylor, 2016 WL 5417190 at *5. The Supreme Court similarly rejected the idea that the rule of lenity applied to another one of the permissible purpose exemptions. See Maracich, 133 S. Ct. at 2209 (considering 18 U.S.C. § 2721(b)(4)).

Assuming without deciding that the rule of lenity has any applicability to the DPPA in this case, the Court finds—as it did in Rollins—that the challenged provision, 18 U.S.C. § 2721(b)(1), does not contain any grievous ambiguity or uncertainty. See Rollins, 14-cv-299 (SRN/HB), slip op. at 34-35; Barber, 560 U.S. at 488. The Moving Defendants are correct that the DPPA does not explicitly state what constitutes a "government function" in every possible circumstance. But this does not amount to grievous ambiguity. It is well-established, and the Moving Defendants do not argue otherwise, that accessing a driver's personal information out of curiosity or for other personal reasons is a violation of the DPPA. See Rollins, 14-cv-299 (SRN/HB), slip op. at 34; Taylor, 2016 WL 5417190 at *5; Engebretson, 2016 WL 5400363 at *9; see also Mallak, 823 F.3d at 446 (noting that the appellant-municipalities "do not dispute that accessing an individual's data to satisfy some personal interest constitutes a violation of clearly established law under the DPPA"). By definition then, an officer's access of a driver's information based on curiosity or other personal reasons cannot be in furtherance of a government function. Karasov alleges that the Officers accessed her personal information for purely personal reasons (i.e., their curiosity about her after hearing about the Board's investigation) and provides evidence in support of these allegations. Thus, the rule of lenity cannot form the basis for granting the Moving Defendants summary judgment.

D. Plaintiff's Motion for Summary Judgment

Karasov asks that the Court determine, as a matter of law, the number of potential DPPA violations committed by the Moving Defendants. (See Pl.'s Mem. in Supp. at 10-12; Pl.'s Reply at 6-13.) She also contends that the Court may conclude as a matter of law that the Moving Defendants are each subject to a cumulative liquidated damages award for any DPPA violations they committed. (See Pl.'s Mem. in Supp. at 12-15; Pl's Reply at 15-20.) The Moving Defendants argue that the number of potential violations is an issue of fact for a jury to decide. (See Defs.' Mem. in Opp. at 11-13.) They also assert that Karasov is not entitled to any damages because she has not suffered any actual pecuniary harm. (See id. at 13-16.)

1. Calculating the Number of Potential DPPA Violations7

Karasov argues that the number of potential DPPA violations committed by the Moving Defendants may be determined as a matter of law. (See Pl.'s Mem. in Supp. at 10-12; Pl.'s Reply at 6-13.) She contends that each time the Officers accessed (or "obtained") her personal information without a permissible purpose, they violated the DPPA. (Pl.'s Mem. in Supp. at 10.) Karasov asserts that every time the Officers viewed a new tab within the DVS Database that constituted a separate obtainment—and thus a separate violation—since each tab contained different parts of her personal information (e.g., photo, address, driving record, motor vehicle information, etc.). (Pl.'s Mem. in Supp. at 11.) However, if the audit report shows that the same tab was viewed for consecutive minutes, Karasov agrees that this counts as a single obtainment. (Pl.'s Reply at 8.) Based on the DVS Database Audit Report, Karasov argues that the Moving Defendants committed the following number of potential DPPA violations:

(Pl.'s Mem. in Supp. at 11-12.)

The Moving Defendants argue that the number of obtainments is for a jury to determine. (Defs.' Mem. in Opp. at 11-13.) Specifically, they disagree with Karasov's method for "counting" the number of potential violations based on the audit report. (Id.) For instance, the Moving Defendants contend that clicking on separate tabs of a driver's information should not count as separate obtainments because all of a driver's information is available once an officer initially accesses that driver's DVS record. (Id. at 12.)

The Court first considers whether "clicking" on various tabs of information within an individual's DVS records count as separate obtainments. This issue was recently addressed in this District as follows:

Potocnik, 2016 WL 3919950 at *14. This holding comports with the testimony of Kim Jacobson that once an individual's record is located within the DVS Database, all his/her information is available to the person accessing that record. (See Jacobson Dep. at 144-48, 150-51, 247-48.) This Court previously adopted Potocnik's reasoning in Rollins and does so again here. See 14-cv-299 (SRN/HB), slip op. at 41. Based on this ruling and the undisputed record, it is possible for the Court to determine how many potential violations of the DPPA the Moving Defendants committed. See supra Part I.A.5. The parties do not dispute that the audit report shows that Mooney and Luchsinger each accessed Karasov's personal information a single time. (DVS Database Audit Report at 1-2.) Thus, they each potentially violated the DPPA one time.

The audit report shows five lines associated with Pietrzak's accesses of Karasov's information. (Id. at 1.) Four of those lines are associated with his access on January 4, 2011. Two of the January 4 lines show that from 9:02am until 9:03am, Pietrzak viewed one tab of Karasov's DVS record. (Id.) Since Karasov agrees that consecutive audit lines showing that the same tab of information was viewed from one minute to the next count as a single obtainment, presumably she agrees these two lines evidence one potential DPPA violation. (See Pl.'s Reply at 8.) The third and fourth lines for January 4 show that at 9:05am, Pietzrak accessed another tab of Karasov's information, but that this tab contained information associated with Karasov's current and former driver's license numbers. (DVS Database Audit Report at 1 (note the "Accessed Data" column); Jacobson Dep. at 262-63 (explaining that the information associated with a driver's old license number is "tied together" with that driver's new license number in the DVS records).) However, since all of Karasov's personal information, past and present, was available to Pietzrak once he accessed her DVS record, these lines do not represent additional potential violations. See Rollins, 14-cv-299 (SRN/HB), slip op. at 41-42; Potocnik, 2016 WL 3919950 at *14. Finally, Pietrzak again accessed Karasov's information on January 5, 2011. This counts as a single potential DPPA violation. Thus, the Court holds that Pietrzak potentially violated the DPPA twice, once on January 4, 2011 and again on January 5, 2011.

Finally, the audit report shows two lines associated with McCarthy's access of Karasov's information on September 9, 2010. (DVS Database Audit Report at 1.) These lines indicate that McCarthy viewed a particular tab of Karasov's information, but that this tab contained information associated with Karasov's current and former driver's license numbers. As just described, since all of Karasov's personal information, past and present, was available to McCarthy once he accessed her DVS record, these lines do not represent separate potential violations. Thus, the Court holds that McCarthy potentially violated the DPPA once.

To summarize, the Court holds that the following potential DPPA violations are discernable from the undisputed record:

2. Liquidated Damages

Karasov argues that she is entitled to no less than $2,500 in damages for each violation of the DPPA committed by the Moving Defendants. (See Pl.'s Mem. in Supp. at 12-15.) Specifically, she contends that if a particular Defendant committed multiple DPPA violations, she is entitled to a cumulative award of liquidated damages (e.g., two DPPA violations would entitle her to at least $5,000 in damages). (Id. at 13-14.) The Moving Defendants argue that Karasov is not entitled to any damages because she has not shown that she suffered any actual pecuniary harm.8 (Defs.' Mem. in Opp. at 13-15.) They also contend that even if Karasov is entitled to liquidated damages, those damages should not be calculated cumulatively. (Id. at 15-16.)

The DPPA addresses damages for violations of the statute as follows:

18 U.S.C. § 2724(b)(1)-(4) (emphasis added).

Given the discretionary language of the statute, when it comes to fashioning the appropriate award of damages, a court may grant cumulative awards (i.e., $2,500 per violation). Pichler v. UNITE, 542 F.3d 380, 394 (3d Cir. 2008); Ela v. Destefano, No. 613CV491ORL28KRS, 2015 WL 7839723, at *5 (M.D. Fla. Dec. 2, 2015); see Kehoe v. Fid. Fed. Bank & Trust, 421 F.3d 1209, 1217 (11th Cir. 2005). However, a cumulative award of liquidated damages is not automatic, but rather subject to an assessment of the circumstances of each case. Ela, 2015 WL 7839723 at *5. Similarly, a court should consider the various types of damages (e.g., actual, punitive, liquidated) that are appropriate when fashioning an award. Kehoe, 421 F.3d at 1217.

It is premature for the Court to decide whether a cumulative award of liquidated damages is appropriate. The issue of what, if any, DPPA violations occurred must be resolved by a jury. Similarly, a jury must consider whether any actual or punitive damages are appropriate. Attorneys' fees and costs must also be resolved. Only after these determinations are made can the Court fashion the appropriate damages award pursuant to 18 U.S.C. § 2724(b) and the circumstances of this case. Thus, the Court declines to rule on whether a cumulative award of liquidated damages is appropriate, but holds that the parties may raise the issue again at a later time.

Finally, the Court briefly addresses the Moving Defendants' argument regarding actual pecuniary damages. The defendant in Potocnik raised a nearly identical argument—that he was entitled to summary judgment because "actual damages" were limited to pecuniary damages, not non-economic harm like emotional distress, and the plaintiff had failed to establish that she suffered any such damages. 2016 WL 3919950 at *12. The Potocnik Court rejected this argument in a well-reasoned opinion that the Court adopts here. See id. at *12-13. Judge Schiltz held that the invasions of privacy the DPPA was meant to protect against,

Id. at *12; see Rollins, 14-cv-299 (SRN/HB), slip op. at 45-46.

III. CONCLUSION

The Moving Defendants' Motion for Summary Judgment is granted in part. Karasov's DPPA claims against Luchsinger, Pietrzak, Mooney, and McCarthy are dismissed because they are time barred. Furthermore, Burnsville, Dayton, Roseville, and Wayzata are not directly liable for Karasov's DPPA claims, but they may be vicariously liable for any improper accesses by the Officers. The Moving Defendants' motion is in all other respects denied.

Karasov's Motion for Partial Summary Judgment is granted in part. In the event it is relevant to calculating the damages award in this matter, the Court holds as a matter of law that the Moving Defendants committed the following number of potential DPPA violations:

Karasov's motion is in all other respects denied.

IV. ORDER

Based on the submissions and the entire file and proceedings herein, IT IS HEREBY ORDERED that: