CLIFTON, Circuit Judge:
These appeals involve two essentially identical actions filed in two different states, Oregon and Washington, by different groups of Plaintiffs, each of which seeks to represent a class. The actions seek damages on the ground that Plaintiffs' personal information was obtained by Defendants in violation of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721-2725. That statute provides that personal information from state driver license databases can be obtained, disclosed, or used only for certain specified purposes. Each of the Defendants purchased driver record information in bulk so it would have the information available for its future use. Plaintiffs do not complain that the ultimate use of the information by any of the Defendants was for purposes not permitted under the DPPA. They argue, however, that the DPPA forbids bulk purchasing of drivers' personal information for future use because obtaining the information for future use is not itself a permitted purpose
States collect personal information about individuals who obtain driver licenses including "name, address, telephone number, vehicle description, Social Security number, medical information, and photograph." Reno v. Condon, 528 U.S. 141, 143, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). This information is included in a database containing the personal information of all drivers licensed in the state. "States, in turn, sell this personal information to individuals and businesses." Id.
Defendants are companies engaged in a variety of businesses that utilize the information from driver records in various ways. For example, Oregonian Publishing is a newspaper company that uses the information in reporting stories involving the operation or safety of motor vehicles. Criminal Information Services, Inc. is a company that performs background checks. It uses the information to verify personal information submitted by the person about whom the background check is being performed. Automotive.com uses the information to perform research about motor vehicles. AMPCO is a parking lot management business that uses the information to check information provided by its customers and to provide notice to owners of towed or impounded vehicles. For these companies it is neither efficient nor cost-effective to request records individually each time they have a need for the information or to be limited to getting the information during business hours when the state agency is open. Instead, they purchase the entire database from the state and access specific information when the need arises.
The DPPA enumerates specific purposes for which it is permissible to obtain, disclose, or use personal information contained in a motor vehicle record. Plaintiffs allege that purchasing the entire database for future use, which Plaintiffs refer to as stockpiling, is not a permitted purpose under the DPPA.
Both cases were dismissed on the ground that Plaintiffs failed to state a claim under the DPPA, with both district courts rejecting Plaintiffs' argument that acquiring the information in bulk and stockpiling it was an improper purpose under the statute. Plaintiffs appealed the decisions in both cases. We consolidated the appeals for argument and now consolidate them for decision.
The DPPA was enacted as an amendment to the Violent Crime Control and Law Enforcement Act of 1994. It seeks to curtail the improper sale of personal information from motor vehicle records while allowing individuals, governments, and businesses to access the information if they have acceptable reasons.
The DPPA has two main parts. First, it enumerates purposes for which personal information from a motor vehicle record can be disclosed.
Section 2724(a) "sets forth the three elements giving rise to liability, i.e., that a defendant (1) knowingly obtained, disclosed or used personal information, (2) from a motor vehicle record, (3) for a purpose not permitted." Thomas v. George, Hartz, Lundeen, Fulmer, Johnstone, King and Stevens, P.A., 525 F.3d
The grant of a motion to dismiss is reviewed de novo. Cohen v. Stratosphere Corp., 115 F.3d 695, 700 (9th Cir.1997). We must construe the allegation made in the complaints in Plaintiffs' favor. Gordon v. City of Oakland, 627 F.3d 1092, 1095 (9th Cir.2010).
We conclude that Plaintiffs have not stated a claim because stockpiling information for a permitted use does not constitute a violation under the DPPA. Plaintiffs' allegation that Defendants obtained the information for the improper purpose of stockpiling misconstrues the meaning of "purpose."
Purpose is defined as "something that one sets before himself as an object to be attained; an end or aim to be kept in view." Webster's Third New International Dictionary (2002) 1847; see Merriam-Webster's Collegiate Dictionary, 10th ed. (2002) 947 ("something set up as an object or end to be attained"); Black's Law Dictionary 9th ed. (2009) 1356 ("an objective, goal, or end").
Stockpiling was plainly not Defendants' purpose for obtaining the information, as that term is used in the statute. The object or end to be attained by Defendants in obtaining the driver record information — the reason they wanted the information — was not just to have it available. Defendants obtained the information so that they would be able to use it. Plaintiffs do not allege that the ultimate uses intended by Defendants, such as checking the information of customers or in connection with matters of motor vehicles or driver safety, were not permitted purposes.
Plaintiffs' argument confuses Defendants' purposes for obtaining the information with Defendants' reasons for obtaining the information in bulk form. It is certainly true that Defendants had one or more reasons for obtaining the information in bulk. By purchasing the entire database in bulk rather than waiting to obtain individual records when they were needed, Defendants no doubt wanted to make their access to the information easier when the time came to use it and probably hoped to get the information at less cost as compared with the expenses of requesting one record at a time. But that was not, in any real sense, the "purpose" for obtaining the information. Someone who buys toilet paper in a package of 48 rolls from a warehouse store, for example, ordinarily buys it for the same purpose as the person who buys it one roll at a time. That it might save money or extra trips to the store to buy in bulk isn't why the toilet paper is bought in the first place.
The DPPA is concerned with the use to which the information will be put. The portion of the statute that lists the permissible reasons for getting the information, subsection 2721(b), is entitled "Permissible uses." The list of permissible purposes repeatedly speaks in terms of the "use" to which the information will be put. See note 2 above. If Congress aimed to prohibit the sale of a state's driver record database in bulk, the statute could have and presumably would have said as much. Instead, the statute was written in a way that logically put the focus on the purposes for which the information would eventually be used — on the "end" sought by the purchaser — not on the reason for buying it in bulk.
Plaintiffs argue that the DPPA prohibits more than just the "use" of driver information, noting that a civil action for damages may be brought against any "person who knowingly obtains, discloses or uses personal information ... for a purpose not permitted." 18 U.S.C. § 2724(a) (emphasis added). Thus, they contend, we should
There is also no problem with Defendants obtaining the personal information for potential future use, even if they may never use it. The DPPA does not contain a temporal requirement for when the information obtained must be used for the permitted purpose. Nor is there a requirement that once the information is obtained for a permitted purpose that it actually be used at all. The DPPA only requires that Defendants obtained the information for a permitted purpose. Plaintiffs have not alleged that Defendants have used the information for a purpose not permitted, nor have they disputed Defendants' statements that they only access or use information about a specific individual when they have a permitted purpose.
Two other circuits have addressed similar claims, the Fifth and Sixth Circuits, and both have rejected them. See Taylor v. Acxiom Corp., 612 F.3d 325, 340 (5th Cir.2010), cert. denied ___ U.S. ___, 131 S.Ct. 908, 178 L.Ed.2d 804 (2011) ("A person who buys DMV records in bulk does so for the purpose of making permissible actual use of information therein under [the DPPA], even if that person does not actually use every single item of information therein."); Roth v. Guzman, 650 F.3d 603, 614-17 (6th Cir.2011) (citing Taylor). We agree.
We conclude that Plaintiffs have failed to allege that Defendants had an improper purpose under the DPPA for obtaining their personal information. The complaints were properly dismissed for failure to state a claim.
18 U.S.C. § 2721(b).