United States Court of Appeals
                              For the Eighth Circuit
                          ___________________________

                                  No. 17-3437
                          ___________________________

   Samantha Orduno, individually and on behalf of all others similarly situated,

                         lllllllllllllllllllllPlaintiff - Appellant,

                                             v.

   Richard Pietrzak, in his individual capacity as the Chief of Police of the City of
      Dayton; City of Dayton; Michael Campion, in his individual capacity as
  Commissioner of the Minnesota Department of Public Safety; Ramona Dohman,
in her individual capacity as Commissioner of the Minnesota Department of Public
   Safety; John and Jane Does, employees of the Minnesota Department of Public
    Safety in their individual capacities as officers, supervisors, staff, employees,
  independent contractors or agents of the Minnesota Department of Public Safety;
 John and Jane Does 1-120, acting in their individual capacity as supervisors in the
                                    City of Dayton,

                        lllllllllllllllllllllDefendants - Appellees.
                           ___________________________

                                  No. 17-3486
                          ___________________________

   Samantha Orduno, individually and on behalf of all others similarly situated,

                          lllllllllllllllllllllPlaintiff - Appellee,

                                             v.

Richard Pietrzak, in his individual capacity as the Chief of Police of the City of Dayton,

                               lllllllllllllllllllllDefendant,
                                  City of Dayton,

                      lllllllllllllllllllllDefendant - Appellant,

  Michael Campion, in his individual capacity as Commissioner of the Minnesota
   Department of Public Safety; Ramona Dohman, in her individual capacity as
Commissioner of the Minnesota Department of Public Safety; John and Jane Does,
   employees of the Minnesota Department of Public Safety in their individual
  capacities as officers, supervisors, staff, employees, independent contractors or
 agents of the Minnesota Department of Public Safety; John and Jane Does 1-120,
      acting in their individual capacity as supervisors in the City of Dayton,

                            lllllllllllllllllllllDefendants.
                                    ____________

                    Appeals from United States District Court
                    for the District of Minnesota - Minneapolis
                                   ____________

                          Submitted: February 12, 2019
                             Filed: August 1, 2019
                                 ____________

Before LOKEN, COLLOTON, and KELLY, Circuit Judges.
                          ____________

COLLOTON, Circuit Judge.

      Samantha Orduno sued police chief Richard Pietrzak, the City of Dayton,
Minnesota, and other public officials for alleged violations of the Driver’s Privacy
Protection Act (DPPA), 18 U.S.C. § 2724. Orduno moved to certify a class of all




                                          -2-
persons whose information Pietrzak impermissibly obtained, but the district court1
denied the motion. Pietrzak then admitted liability for six violations of the DPPA,
and a jury awarded Orduno $85,000 in punitive damages, but no actual damages. The
court ruled that Orduno failed to present sufficient evidence that the City was directly
liable for any violations of the DPPA, but authorized the jury’s finding that the City
was vicariously liable for Pietrzak’s actions.

       Orduno appeals the district court’s denial of class certification and its rulings
on the City’s direct liability, the exclusion of certain evidence, the award of attorneys’
fees, the denial of expert costs, and the application of the DPPA’s statute of
limitations. On cross-appeal, the City challenges the imposition of vicarious liability
for Pietrzak’s violations of the DPPA. We affirm.

                                            I.

       The saga began when a photocopy of Samantha Orduno’s paycheck receipt was
discovered in a copy machine of the City of Dayton’s main office in November 2012.
Orduno, the city administrator for Dayton, was on vacation at the time, and had not
given anyone permission to copy her financial records. When she learned of the
discovery, Orduno believed that the photocopy was a sign of a possible data privacy
violation within the city administration.

       Orduno recruited Lynne Bankes, the police chief of nearby White Bear Lake,
Minnesota, to investigate the incident. Orduno told Bankes that Dayton Police Chief
Richard Pietrzak was her primary suspect, because he had twenty-four-hour access
to City Hall and possibly some ill will towards Orduno.



      1
       The Honorable Ann D. Montgomery, United States District Judge for the
District of Minnesota.

                                           -3-
      Bankes inquired with the Minnesota Department of Motor Vehicle Services
whether Orduno’s personal information had been accessed in Minnesota’s Driver and
Vehicle Services database. The Department provided Bankes with a printout showing
fourteen searches of the database for Orduno’s information between January 19,
2010, and October 4, 2012. Pietrzak made seven of these queries. Bankes noticed
that Pietrzak searched for Orduno based on her name, rather than her vehicle
information, leading Bankes to suspect that Pietrzak was not investigating a traffic
stop and had no legitimate law enforcement purpose for accessing Orduno’s
information.

       Bankes requested that the Department send her a list of Pietrzak’s accesses
over the preceding six months. The response listed more than 850 people, including
family members, other employees of the police department and city administration,
and persons from surrounding communities. Bankes noticed that “very few” of these
accesses were based on a license plate number. In a written report, Bankes concluded
that Pietrzak violated the Minnesota Data Practices Act, noted the possibility of
charging him with a gross misdemeanor for committing misconduct as a public
officer or employee, and opined that there was “no excuse” for his behavior in
making improper or illegal access to the database.

      In May 2014, Orduno sued Pietrzak under the DPPA, alleging that he
unlawfully obtained her private information and the private information of around
850 other people. Orduno also named the City of Dayton and other public officials
as defendants, claiming that the City and these officials had enabled Pietrzak to
access the database and then failed to monitor him adequately to prevent his unlawful
conduct. The district court dismissed the claims against the city officials for failure




                                         -4-
to state a claim, and granted in part a motion to dismiss by Pietrzak and the City based
on the four-year statute of limitations.2

       Orduno then moved to certify a class defined as follows:

       Individuals whose Minnesota driver’s license records were obtained
       without a purpose or purposes permitted under the DPPA by Defendant
       Richard Pietrzak from May 2, 2010 through the present date while
       Defendant Richard Pietrzak was employed by Defendant City of Dayton.

The court denied the motion, concluding that the proposed class failed to satisfy the
numerosity and predominance requirements of Federal Rule of Civil Procedure
23(a)(1) and (b)(3).

      Orduno later obtained an audit of Pietrzak’s use of the database from 2003
through 2012, and she sought leave to file a motion for reconsideration of the denial
of class certification. The court denied her request, reasoning that the additional
evidence would not allow the proposed class to satisfy the predominance standard
under Rule 23(b)(3).

       After the district court set the case for trial, Pietrzak filed an amended answer
in which he admitted to obtaining Orduno’s private information for an impermissible
purpose on six occasions within the limitations period. The City continued to deny
direct and vicarious liability. Before trial, the district court ruled that the City could
be held vicariously liable for Pietrzak’s actions as police chief, but not directly liable,


      2
        Orduno argues on appeal that the statute of limitations should begin to run
when the plaintiff discovers (or with due diligence should have discovered) a
violation of the DPPA, rather than when the violation occurs, but concedes that her
contention is foreclosed by McDonough v. Anoka County, 

, 943 (8th Cir.
2015).

                                           -5-
as there was no evidence that the City had an impermissible purpose in granting
Pietrzak access to the database. The court ordered that evidence of time-barred
obtainments and viewing of data about nonparties was inadmissible because it was
irrelevant to Orduno’s damages and was substantially more prejudicial than probative.
The court also excluded evidence of the City’s actions in the wake of Bankes’s report,
including whether the City disciplined Pietrzak.

      After a three-day trial, the jury returned a verdict awarding Orduno $85,000 in
punitive damages, but no actual damages. The court awarded another $15,000 in
liquidated damages. Orduno moved for $427,761.01 in attorneys’ fees and costs.
The court awarded fees of $141,197.30 and denied costs of a forensic expert.

                                           II.

       Orduno first argues that the district court erred in denying her motion to certify
a class under Federal Rule of Civil Procedure 23(b)(3). We review a district court’s
denial of class certification for abuse of discretion. Sandusky Wellness Ctr., LLC v.
MedTox Sci., Inc., 

, 995 (8th Cir. 2016).

       To obtain certification of a class seeking damages under that rule, a plaintiff
must satisfy the four prerequisites of Rule 23(a), including that “the class is so
numerous that joinder of all members is impracticable.” The plaintiff also must meet
the requirements of Rule 23(b)(3), including that “questions of law or fact common
to class members predominate over any questions affecting only individual
members.” See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 

, 460
(2013). The district court ruled that Orduno’s proposed class failed to satisfy the
numerosity requirement of Rule 23(a) and the predominance requirement of Rule
23(b)(3). We conclude that the court did not abuse its discretion on the question of
predominance, and that ground is sufficient to affirm the ruling.



                                          -6-
       “The predominance inquiry ‘asks whether the common, aggregation-enabling,
issues in the case are more prevalent or important than the non-common, aggregation-
defeating, individual issues.’” Tyson Foods, Inc. v. Bouaphakeo, 

,
1045 (2016) (quoting 2 William B. Rubenstein, Newberg on Class Actions § 4:49, at
195-96 (5th ed. 2012)). Where too many individual questions predominate over
common ones, certification is inappropriate. E.g., Webb v. Exxon Mobil Corp., 

, 1156-57 (8th Cir. 2017); Ebert v. Gen. Mills, Inc., 

, 479-80
(8th Cir. 2016).

       To prove a violation of the DPPA, Orduno must demonstrate that Pietrzak
“knowingly” used personal information, “from a motor vehicle record, for a purpose
not permitted” by law. 18 U.S.C. § 2724(a). Orduno argues that common facts and
questions of law predominate, because the circumstances for each access of the
database were the same: “the Dayton Police Chief entered the individuals’ names
into the [Driver and Vehicle Services] database while he was on duty and obtained
their personal information and viewed their photographs.”

        The mere fact that Pietrzak obtained information, however, does not establish
liability under the Act. Pietrzak was the police chief when he accessed the database,
and the DPPA permits use by a law enforcement agency in carrying out its functions.
18 U.S.C. § 2721(b)(1). The district court correctly observed that class members
would “need to present evidence of the circumstances under which their particular
information was accessed” to address whether Pietrzak’s purpose in searching the
database was impermissible. The circumstances of each obtainment will vary from
class member to class member, so the court properly concluded that “common
questions” would not predominate over individual determinations.

      Orduno argues that her proposed class included only individuals whose
information Pietrzak obtained impermissibly, so there is no need for case-by-case
determinations. But Orduno cannot solve the predominance problem by creating a

                                        -7-
so-called “fail-safe class,” in which the class is defined to preclude membership
unless a putative member would prevail on the merits. That sort of class “is
prohibited because it would allow putative class members to seek a remedy but not
be bound by an adverse judgment—either those ‘class members win or, by virtue of
losing, they are not in the class’ and are not bound.” Young v. Nationwide Mut. Ins.
Co., 

, 538 (6th Cir. 2012) (quoting Randelman v. Fid. Nat’l Title Ins.
Co., 

, 352 (6th Cir. 2011)); accord Messner v. Northshore Univ.
HealthSystem, 

, 825 (7th Cir. 2012). A fail-safe class is also
unmanageable, see Fed. R. Civ. P. 23(b)(3)(D), because the court cannot know to
whom notice should be sent. Kamar v. RadioShack Corp., 375 F. App’x 734, 736
(9th Cir. 2010). Insofar as the fail-safe class is a means to establish predominance,
its independent shortcomings are an alternative basis to affirm the denial of
certification. See Adashunas v. Negley, 

, 604 (7th Cir. 1980).

      Orduno complains that the district court should have allowed her to move for
reconsideration of class certification. She claims that additional evidence gained
through a full audit of Pietrzak’s database accesses, which showed 15,870
obtainments of private information from 2003 to 2012, demonstrated that she satisfied
the numerosity requirement under Rule 23(a). But this new evidence does not alter
the calculus on the predominance issue, and predominance was an independent
ground for denying the motion to certify. The court thus did not abuse its discretion
in denying leave.

                                        III.

                                         A.

      Orduno next contends that the district court erred in concluding that the City
was not directly liable to her under the DPPA. The DPPA makes civilly liable any
“person” who impermissibly “obtains, discloses or uses personal information, from

                                         -8-
a motor vehicle record.” 18 U.S.C. § 2724(a). The statute defines “person” to
include an “organization or entity,” not including “a State or agency thereof.” 

       To prove liability under the DPPA, Orduno must show that the City “1)
knowingly 2) obtained, disclosed, or used personal information, 3) from a motor
vehicle record, 4) for a purpose not permitted.” Loeffler v. City of Anoka, 

, 1085 (8th Cir. 2018) (internal quotation omitted). Orduno failed to present
sufficient evidence to show that the City had an impermissible purpose when it
granted Pietrzak access to the database. Pietrzak was the police chief and had
legitimate law enforcement reasons for consulting the database. See 18 U.S.C.
§ 2721(b)(1). Orduno alleges that the City authorized and acquiesced in Pietrzak’s
misuse of the database, but she did not present evidence showing that the City
knowingly allowed Pietrzak “to access the database for any reason other than
performing [his] law-enforcement duties, a purpose permitted by the DPPA.”

. Without evidence that city officials knowingly caused
Pietrzak’s impermissible actions, the City cannot be directly liable. And without
“proof of willful or reckless disregard of the law,” it follows that the district court
properly declined to allow punitive damages against the City. See 18 U.S.C.
§ 2724(b)(2).

       Orduno suggests that Pietrzak, as police chief, was a policymaker for the City,
and that his own actions were thus tantamount to unlawful conduct by the City. Cf.
Monell v. Dep’t of Soc. Servs., 

, 694 (1978). Assuming without deciding
that a plaintiff under the DPPA may pursue a claim for municipal liability based on
the Monell standards that govern municipal liability under 42 U.S.C. § 1983,
Pietrzak’s clandestine use of the database still cannot “fairly be said to represent
official policy.” 

. Pietrzak admitted that the six obtainments
within the limitations period “were not for any use in carrying out any law
enforcement, governmental, judicial or litigation-related function.” He accessed the

                                         -9-
database for personal reasons, not under the auspices of official policymaking
authority, so his actions did not represent a policy of the City. See Pembaur v. City
of Cincinnati, 

, 481-84 (1986). The district court thus properly refused
to entertain direct liability against the City.

                                           B.

       In its cross-appeal, the City challenges the judgment that the City was
vicariously liable for Pietrzak’s violations of the DPPA. The district court determined
that Pietrzak was acting within “the scope of the employment” or “the agency
relationship” with the City when he accessed the database, so that vicarious liability
applied. The City maintains, however, that liability under the DPPA “rests solely
with the accessor of the information,” and that only Pietrzak should be liable.

       The DPPA does not address vicarious liability, but we assume that “when
Congress creates a tort action, it legislates against a legal background of ordinary tort-
related vicarious liability rules and consequently intends its legislation to incorporate
those rules.” Meyer v. Holley, 

, 285 (2003). When the DPPA became
law in 1994, it was well established that agents could bind their principals and render
them liable when the agents were acting within the scope of their real or apparent
authority. See Burlington Indus., Inc. v. Ellerth, 

, 755-56, 758-60
(1998); Am. Soc’y of Mech. Eng’rs, Inc. v. Hydrolevel Corp., 

, 565-66
(1982). Under the “ordinary tort-related vicarious liability rules” then prevailing, a
principal also was liable for an agent’s actions outside the scope of his employment
when the agent was “aided in accomplishing the tort by the existence of the agency
relation.” Restatement (Second) of Agency § 219(2)(d) (Am. Law Inst. 1958); see
also 

.

      Accepting that Pietrzak was acting outside the scope of his employment when
he impermissibly accessed the database, he nevertheless was “aided in accomplishing

                                          -10-
the tort” by his position as police chief. Pietrzak used a government-issued computer
and official credentials to obtain Orduno’s private information, and he could not have
done so but for his official position. The City argues that the “aided in the agency
relation” rule of vicarious liability has been abandoned by the most recent
Restatement published in 2006. See Restatement (Third) of Agency § 7.07 (Am. Law
Inst. 2006). But the relevant inquiry is what background principles were well
established when the DPPA became law in 1994, and the Restatement (Second) of
Agency prevailed then. Under that standard, the district court did not err in allowing
vicarious liability. See, e.g., Potocnik v. Carlson, No. 13-CV-2093 (PJS/HB), 

, at *6-8 (D. Minn. July 15, 2016); Margan v. Niles, 

,
75 (N.D.N.Y. 2003).

       The City also argues that vicarious liability is inappropriate here because the
DPPA provides for both civil and criminal liability. See 18 U.S.C. § 2723. The only
provisions at issue in this case, however, concern civil liability. Even where an act
provides for both civil and criminal penalties, it is appropriate to consider background
tort-related principles in determining the scope of civil liability. See 

(addressing civil liability under the Sherman Act). That the City may
be vicariously liable for damages based on the DPPA’s incorporation of tort-related
rules does not imply that the City is subject to criminal liability under the same
standard. Background rules of criminal responsibility, for example, provide that a
principal ordinarily is not criminally liable for the conduct of an agent who is not
acting for the benefit of the principal. See United States v. Basic Constr. Co., 

, 573 (4th Cir. 1983) (per curiam); United States v. One Parcel of Land, 

, 322 (7th Cir. 1992) (Posner, J., dissenting). We hold only that the district
court correctly construed the civil action provisions of the DPPA to incorporate
background tort-related rules of vicarious liability.3


      3
       The City does not argue on appeal that vicarious liability for punitive damages
is judged under a different standard than vicarious liability for actual or liquidated

                                         -11-
                                         IV.

      Orduno raises two arguments concerning the district court’s exclusion of
evidence at trial. We afford substantial deference to the district court’s evidentiary
rulings and review for abuse of discretion. See Shelton v. Consumer Prods. Safety
Comm’n, 

, 1009 (8th Cir. 2002).

       Orduno first claims that the district court erred by excluding evidence of other
occasions on which Pietrzak obtained driver’s license data. Orduno sought to present
evidence that Pietrzak obtained data about other persons in Minnesota and about
Orduno on occasions outside the limitations period. The district court concluded that
because Pietrzak admitted liability, and the jury’s task was to determine damages
flowing from the six unlawful obtainments, evidence of other obtainments was
properly excluded under Federal Rule of Evidence 403. We conclude that there was
no abuse of discretion. Allowing evidence of other obtainments risked encouraging
the jury to award damages based on time-barred incidents for which Pietrzak could
not be liable, or based on harm suffered by persons other than Orduno. The court
permissibly ruled that the disputed evidence lacked probative value and carried too
great a risk of unfair prejudice, confusing the issues, and wasting time in mini-trials
over the propriety of other obtainments. See Fed. R. Evid. 403.

       Second, Orduno challenges the court’s exclusion of evidence concerning the
City’s response to Pietrzak’s misconduct. The district court ruled that evidence of the
City’s official response was inadmissible because it did not cause any damages: “The
damages flowed from the six illegal obtainments and the admission of liability.” R.
Doc. 287, at 30. Orduno argues that evidence of the City’s inaction supported a

damages, so the point is waived, and we do not address it. Cf. Marston v.
Minneapolis Clinic of Psychiatry & Neurology, Ltd., 

, 312 (Minn.
1983); Restatement (Second) of Agency § 217C; Restatement (Second) of Torts
§ 909.

                                         -12-
larger award of punitive damages, because Pietrzak was not otherwise disciplined for
his wrongful conduct by the City. But where no question of the City’s direct liability
was before the jury, the court did not abuse its discretion in focusing the trial on the
harm that Pietrzak’s six admitted violations caused Orduno.

       Orduno next complains that the district court abused its discretion in
disallowing sixty percent of her requested attorneys’ fees and denying the
reimbursement of expert costs. Under the DPPA, a court may award “reasonable
attorneys’ fees and other litigation costs reasonably incurred.” 18 U.S.C.
§ 2724(b)(3). The starting point for determining attorneys’ fees is the “lodestar,”
which is calculated by multiplying the number of hours reasonably expended by the
reasonable hourly rate. See Hensley v. Eckerhart, 

, 433 (1983). The
party seeking fees bears the burden of establishing entitlement to an award and
documenting the appropriate hours and hourly rates. 

We review the
district court’s award of fees for abuse of discretion. See Miller v. Dugan, 

, 831 (8th Cir. 2014).

       The court first rejected forty percent of Orduno’s requested fees due to
excessive billing and overstaffing. The court found that Orduno’s case was “not
factually complex,” and that “the legal issues involved are not particularly novel or
difficult.” After the dismissal of time-barred claims and the denial of class
certification, the lawsuit boiled down to “one individual’s accesses of Orduno’s
information on six occasions.” The court observed that the volume of discovery and
motion practice was relatively modest (ten depositions and five motions), and that the
legal issues had recurred in dozens of cases filed in the district. The court ultimately
concluded that a team of eight lawyers, from two law firms, was unnecessary to
litigate Orduno’s case, and that the hours billed were excessive.

      In awarding fees, district courts must be mindful of both “redundant” and
“excessive” hours. 

. Here, the court cited areas where

                                         -13-
Orduno’s team seemed overstaffed and spent more time than necessary to complete
a task. Despite the factual complexity of Orduno’s complaint, the case was
narrowed—as of eighteen months before trial—to Pietrzak’s six impermissible
obtainments. The trial itself was simplified greatly by Pietrzak’s admission of
liability, and it focused primarily on damages arising from alleged emotional distress.
We afford great deference to a district court’s on-the-ground assessment of whether
requested fees are excessive, and we are not convinced to second-guess the ruling
here.

       The court reduced the requested amount of fees by another twenty percent
based on Orduno’s limited success. Degree of success is an important factor in
determining a reasonable award of attorneys’ fees. 

The court properly
took into account that Orduno’s case was the first to obtain punitive damages in
Minnesota, and that the result exposed misconduct by a police chief and potentially
deterred future misconduct. At the same time, however, Orduno failed to demonstrate
that she suffered any actual damages, and she succeeded in obtaining only $15,000
in liquidated damages after requesting more than $1,000,000. The degree of success
was partial. The district court did not abuse its discretion in reducing the requested
award by twenty percent on that basis.

       Orduno also objects to the court’s denial of reimbursement for the costs of a
forensic expert who extracted data from Pietrzak’s work computer. But “absent
explicit statutory or contractual authorization for the taxation of the expenses of a
litigant’s witnesses as costs, federal courts are bound by the limitations set out in 28
U.S.C. § 1821 and § 1920.” Crawford Fitting Co. v. J.T. Gibbons, Inc., 

,
445 (1987). The DPPA does not explicitly authorize the taxation of the expert
witness fees as costs, and neither § 1821 nor § 1920 allows them. The district court
thus did not err in declining to award the requested costs.

                                   *       *       *

                                         -14-
       For the foregoing reasons, the judgment of the district court is affirmed. The
City’s motion to strike portions of Orduno’s appendix and brief is denied.
                       ______________________________




                                        -15-