Opinion
3:21-cv-213-E-BN
08-23-2022
AARON MULVEY, Plaintiff, v. VERTAFORE, INC., Defendant.
FINDINGS, CONCLUSIONS, AND RECOMMENDATION OF THE UNITED STATES MAGISTRATE JUDGE
DAVID L. HORAN UNITED STATES MAGISTRATE JUDGE
This case has been referred to the undersigned United States magistrate judge for pretrial management pursuant to 28 U.S.C. § 636(b) and an order of reference from United States District Judge Ada Brown. See Dkt. No. 31.
Defendant Vertafore, Inc. has filed a Motion to Dismiss Plaintiff's Third Amended Complaint. See Dkt. No. 47. Plaintiff Aaron Mulvey has filed an opposition in response to the motion, see Dkt. No. 50, and Vertafore has filed a reply, see Dkt. No. 60.
For the reasons explained below, the Court should grant Vertafore's motion to dismiss [Dkt. No. 47].
Background
This putative class action is brought by Plaintiff Aaron Mulvey (“Mulvey”), “a licensed and registered driver in the State of Texas,” on behalf of himself and approximately 27.7 million Texas driver's license holders whose “motor vehicle records were obtained by [Vertafore].” Dkt. No. 42-1 at 3, 5-6. Defendant Vertafore, Inc. (“Vertafore”) is an insurance software provider that, as part of its services, accesses and stores personal information of Texas drivers. See id. at 5-6.
In November 2020, Vertafore gave public notice that files that it had stored on an unsecured external server containing Texas motor vehicle records had been accessed without authorization (the “data breach”). See Dkt. No. 47 at 5. Mulvey filed his original Complaint on January 31, 2021, following the filing of two related actions that similarly alleged violations of the Driver's Privacy Protection Act (“DPPA”) 18 U.S.C. § 2725(2) stemming from the data breach. See Allen v. Vertafore, Inc., No. 4:20-cv-4139 (S.D. Tex.) (the “Allen Class Action”); Masciotra v. Vertafore, Inc., No. 1:20-cv-3603 (D. Colorado) (the “Masciotra Class Action”).
In April 2021, arguing that there was substantial overlap between Masciotra and Allen, Vertafore successfully moved to transfer the Masciotra action to the Southern District of Texas under the first-to-file rule. See Masciotra v. Vertafore, Inc., No. 20-cv-3603-WJM-NYW, 2021 WL 1720860, at *4 (D. Colo. Apr. 30, 2021).
On March 16, 2021, Mulvey filed his First Amended Complaint, see Dkt. No. 16, still alleging a single claim under the DPPA but removing all references to the November data breach and instead alleging that Vertafore illegally obtained and disclosed the personal information of Texas driver's license holders that it has received from the Texas Department of Motor Vehicles (“TXDMV”) since 2015. See id.
On March 26, 2021, Vertafore filed a motion to transfer this case to the Southern District of Texas, see Dkt. No. 16, and on May 7, 2021, the Court stayed the case pending the motion's resolution. See Dkt. No. 28.
But, in June 2021, the Southern District of Texas dismissed the Allen Class Action, rending the first-to-file rule no longer applicable to the instant case. See Allen v. Vertafore, Inc., No. 4:20-cv-4139, 2021 WL 3148870, at *1 (S.D. Tex. June 14, 2021), rep. and rec. adopted, 2021 WL 3144469 (S.D. Tex. July 23, 2021), aff'd, 28 F.4th 613 (5th Cir. 2022).
And so, on April 25, 2022, the Court dismissed Vertafore's motion to transfer as moot and granted Mulvey's motion to file a Second Amended Complaint adding claims against a Florida plaintiff and asserting allegations on behalf of a Florida subclass that Vertafore had improperly obtained Florida driver's license data from the Florida Department of Highway Safety and Motor Vehicles. See Dkts. No. 37 & 38. Two weeks later, Mulvey motioned to file a Third Amended Complaint [Dkt. No. 42], dropping the Florida plaintiff and claims, which this Court granted. See Dkt. No. 44.
Vertafore now moves to dismiss the Third Amended Complaint (“TAC”) under Federal Rule of Civil Procedure 12(b)(1), arguing that Mulvey lacks Article III standing, and under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim on which relief can be granted. See Dkt. No. 47.
Legal Standards and Analysis
I. Article III Standing
Vertafore first argues that Mulvey lacks Article III standing to sue under the DPPA because he suffered no actual damages and fails to allege a sufficiently concrete risk of future harm that would entitle him to injunctive relief.
A. Legal Standard
“Article III confines the federal judicial power to the resolution of ‘Cases' and “Controversies.'” TransUnion LLC v. Ramirez, 141 S.Ct. 2190, 2203 (2021). “‘One element of the case-or-controversy requirement'” is that plaintiffs “must establish that they have standing to sue.” Clapper v. Amnesty Int'l USA, 568 U.S. 398, 408 (2013) (quoting Raines v. Byrd, 521 U.S. 811, 818 (1997)); see Lujan v. Defs. Of Wildlife, 504 U.S. 555 (1992). (“[T]he core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III.”).
It is well settled that “the issue of standing is one of subject matter jurisdiction,” Cobb v. Cent. States, 461 F.3d 632, 635 (5th Cir. 2006), and thus Rule 12(b)(1) allows a defendant to move to dismiss a case before filing an answer “when the court lacks the statutory or constitutional power to adjudicate the claim.” In re FEMA Trailer Formaldehyde Prods. Liab. Litig., 668 F.3d 281, 286 (5th Cir. 2012) (quotation omitted).
The party invoking federal jurisdiction bears the burden of establishing standing, see Clapper, 568 U.S. at 412; and, to avoid dismissal under Rule 12(b)(1), “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief,” Ramirez, 141 S.Ct. at 2203 (citing Lujan, 504 U.S. at 560-61). “Where, as here, a case is at the pleading stage, [Plaintiffs] must ‘clearly ... allege facts demonstrating' each element.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)).
“These standing requirements are equally applicable in class actions.” Singh v. RadioShack Corp., 882 F.3d 137, 151 (5th Cir. 2018). And so named plaintiffs who represent a class must allege and show that they personally have been injured. See id. (quoting Simon v. E. Ky. Welfare Rights Org., 426 U.S. 26, 40 n. 20, 96 S.Ct. 1917, 48 L.Ed.2d 450 (1976)). “And standing is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” Ramirez, 141 S.Ct. at 2208 (citing Davis v. Federal Election Commission, 554 U.S. 724, 734 (2008); Friends of the Earth, Inc. v. Laidlaw Environmental Services (TOC), Inc., 528 U.S. 167, 185 (2000).
B. Plaintiff has Article III standing to bring his claims
Vertafore argues that Mulvey fails to meet the first element of standing because he has not sufficiently pled an injury in fact.
To establish an injury in fact, Plaintiffs must show they suffered “an invasion of a legally protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (internal citations omitted).
As Mulvey points out, the Fifth Circuit has previously addressed standing in the context of a DPPA suit, reasoning that, where plaintiffs “allege that the defendants have used their personal information in a manner that is prohibited by the DPPA . . . their allegations fulfill the three requirements of the ‘irreducible constitutional minimum of standing': an injury in fact (i.e., the invasion of an interest which the plaintiffs argue is legally protected), which was caused by the defendants and which would be redressed by a judgment against the defendants.” Taylor v. Acxiom Corp., 612 F.3d 325, 340 (5th Cir. 2010) (Dennis, J. concurring) (paraphrasing the Court's holding at 340 n.15).
But the United States Supreme Court has since further fleshed out the standard for determining whether an alleged harm constitutes an injury in fact conferring standing. See Spokeo, 578 U.S. 330; Ramirez, 141 S.Ct. 2190. The Court has explained that, while certain “tangible” harms (such as physical or monetary harms) “readily qualify as concrete injuries under Article III .. . . [v]arious intangible harms can also be concrete.” Ramirez, 141 S.Ct. 2190 (citing Spokeo, 578 U.S. at 34041). A mere violation of a statute does not “automatically satisf[y] the injury-in-fact requirement” on its own when only a “bare procedural violation” has occurred, but “the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury-in-fact” - and, in these instances, a plaintiff “need not allege any additional harm beyond the one Congress has identified.” Spokeo, 578 U.S. at 342.
To determine whether a statutory violation is the type of violation that meets this bar, “it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Id.; see also Ramirez, 141 S.Ct. at 2 204 (citing, as examples, reputational harms; disclosure of private information; intrusion upon seclusion; abridgement of free speech; and infringement on free exercise).
In this case, Mulvey alleges two concrete harms stemming from Vertafore's alleged conduct: (i) Vertafore knowingly obtained, used, and redisclosed sensitive personal identifying information contained in TXDMV records without authorization; and (ii) Mulvey and the proposed class members suffered loss of control over their sensitive personal data and continue to suffer imminent and ongoing risk and fear involving their own personal safety and that of family members residing in their households. See Dkt. No. 42-1 at 14-15. To redress these harms, Plaintiffs seek liquidated damages under the DPPA and injunctive relief to prevent further disclosure of their personal data. See id. at 24-25.
Assuming without finding that Vertafore did violate the DPPA, the question remains whether Plaintiffs' alleged injuries are sufficiently concrete to confer standing to pursue actual damages or injunctive relief. Vertafore argues that neither alleged harm confers standing because Mulvey expressly excludes any assertion of actual harm in his DPPA claim and his “speculative allegations of potential future injury [are insufficient] to support a claim for injunctive relief.” Dkt. No. 47 at 11. The undersigned considers each of these arguments below.
1. Liquidated Damages
Vertafore's first argument, that “Plaintiff, who has expressly excluded from his DPPA claim any assertion of actual arm, does not (and cannot) adequately plead an injury in fact sufficient to support a claim for liquidated damages under the DPPA” is unavailing. Id.
As an initial matter, Vertafore appears to conflate Article III's requirement that a plaintiff allege they have been concretely harmed by a defendant's statutory violation with a requirement that a plaintiff seek actual damages. While it is the case that the proposed class excludes “any natural persons seeking actual damages from Defendant Vertafore for violations of the [DPPA],” that does not mean that Mulvey cannot or has not alleged actual harm. Dkt. No. 42-1 at 17.
This confusion appears to stem from the DPPA's remedies provision, which states: “The court may award - actual damages, but not less than liquidated damages in the amount of $2,500.” 18 U.S.C. § 2724(b)(1). Presumably reading this provision to mean that proving actual damages is a condition precedent to receiving liquidated damages, Vertafore asserts that, because the putative class excludes anyone seeking actual damages, Plaintiffs are precluded from - and thus lack standing for -recovering liquidated damages under the DPPA.
While the Fifth Circuit has not resolved the issue of whether a plaintiff must prove actual damages in order to recover liquidated damages, the United States Courts of Appeal for the Third and Eleventh Circuits have, and their reasoning is instructive.
In Kehoe v. Fidelity Federal Bank & Trust, the Eleventh Circuit, “[c]onsidering the relevant text of the DPPA as buttressed by instructive dicta in Doe v. Chao, 540 U.S. 614 (2004),” held that a “plaintiff need not prove a measure of actual damages to recover liquidated damages under the DPPA, and certainly need not prove actual damages to recover the other types of remedies listed in § 2724(b).” 421 F.3d 1209 (11th Cir. 2005).
Likewise, the Third Circuit in Pichler v. UNITE agreed that “‘[t]here is no language in sub-section (b)(1) that confines liquidated damages to people who suffered actual damages.'” 542 F.3d 380 (3d Cir. 2008). Additionally, the Court found support for its construction in the common law of privacy, which frequently provides privacy tort victims with a monetary award calculated without proving actual damages because of the difficulty of measuring such damages. Pichler, 542 F.3d at 399 (citing Doe, 540 U.S. at 621 n.3). Given this difficulty, the Court reasoned that
the inclusion of the phrase “liquidated damages” supports the conclusion that the plain language of the DPPA aims to compensate not just those violations that can be shown to have caused actual damages. Liquidated damages have long been used as a substitute for actual damages in situations where “damages are uncertain in nature or amount or are unmeasurable.” Rex Trailer Co. v. United States, 350 U.S. 148, 153, 76 S.Ct. 219, 100 L.Ed. 149 (1956). Further, we have just observed that the damages flowing from privacy violations have historically been considered “quintessential example[s] of damages that are uncertain and possibly unmeasurable.” Kehoe, 421 F.3d at 1213. We believe it would make little sense, as a matter of statutory construction, for Congress to have inserted the phrase “liquidated damages” into § 2724(b)(1) if the only compensable violations of the DPPA were those for which the damages could be calculated precisely.Id. at 399.
Vertafore argues that both of these cases pre-date Ramirez, and that neither addresses the issue of whether a plaintiff has standing to pursue liquidated damages under the DPA without alleging actual injury. While this line of arguments might affect a standing analysis insofar as a finding that eligibility for liquidated damages being contingent on proving actual damages could affect redressability, Vertafore does not purport to challenge redressability. And, as already explained, Mulvey's choice to seek liquidated damages rather than actual damages as a remedy for Vertafore's purported statutory violation is distinct from, and does not affect whether, Plaintiffs suffered actual harm.
As to whether Mulvey has established an injury in fact under the standard set out in Spokeo and Ramirez, Mulvey has sufficiently alleged a concrete harm conferring standing.
Mulvey argues that, in enacting the DPPA, “Congress recognized the potential harm to privacy from the unauthorized access to drivers' personal information” and this “intangible harm associated with the violation of the DPPA's substantive protections is consonant with the common law tradition of lawsuits for invasion of privacy.” Id. at 15-16. Both Texas and the Fifth Circuit recognize the tort of invasion of privacy based on disclosure of private facts, which allows a plaintiff to recover from a defendant who publicizes private (i.e., intimate or embarrassing) information, the publication of which would be highly offensive to a reasonable person, and which is not of legitimate public concern. See Lowe v. Hearst Communications, Inc., 478 F.3d 246, 250 (5th Cir. 2007) (citing Star-Telegram, Inc. v. Doe, 915 S.W.2d 471, 473-74 (Tex.1995)). And the Supreme Court has recognized that Congress chose to protect “an individual's right to privacy in his or her motor vehicle records,” in effect codifying protections for violations of a substantive right to privacy, and specifically identified disclosure of private facts as an analog harm traditionally recognized as providing a basis for suit. Maracich v. Spears, 133 S.Ct. 2191, 2200 (2013); Ramirez, 141 S.Ct. at 2204.
Here, Mulvey's claim that (1) Vertafore “disclosed plaintiffs' motor vehicle records to its customers, the more than 20,000 insurance agencies, some 1,000 carriers, and managing general agents” without authorization; (2) a use which the DPPA cognizes as “‘highly offensive' per se”; because (3) Vertafore had no permissible purpose for doing so, alleges a harm that bears a close relationship to the harm associated with the tort of disclosure of private facts. Dkt. No. 42-1 at 8, 13. In other words, the harm from having one's sensitive personal data sent to tens of thousands of recipients bears a close relationship to the harm of having private facts about one's life publicized. See Ramirez, 141 S.Ct. at 2209 (explaining that, “[i]n looking to whether a plaintiff 's asserted harm has a ‘close relationship' to a harm traditionally recognized as providing a basis for a lawsuit in American courts, we do not require an exact duplicate”).
In addition to arguing that Vertafore's allegedly illegal obtainment, use, and disclosure of Plaintiffs' personal information itself constitutes a concrete harm, Mulvey asserts that this loss of privacy in his personal data caused harm in the form of ongoing fear and imminent risk of future harm. See Dkt. No. 42-1 at 15.
“The risk of real harm ... can sometimes satisfy the requirement of concreteness.” Ramirez, 141 S.Ct. at 2210 (quoting Spokeo, 578 U.S. at 341-42). But, to establish standing to recover damages, a plaintiff must demonstrate either that the “risk of future harm materialized” or that they were “independently harmed by their exposure to the risk - that is, that they suffered some other injury (such as emotional injury) from the mere risk [of the harm].” Id. at 2211.
Mulvey did not allege that a risk of future harm materialized. While the TAC vaguely states that “[f]uture harm could take the form of something as mundanely annoying as junk mail or as serious as identity theft, stalking, or battery,” and that Plaintiffs “face ... fear involving ... their own personal safety,” Mulvey does not specifically identify in the TAC what future harm (aside from continued unauthorized use and redisclosure) that he anticipates they might suffer. Dkt. No. 42-1 8,15. Nor does he allege that he or any class member has experienced any of the downstream harms noted above.
And, while Mulvey asserts in his Opposition to Vertafore's motion to dismiss that he and the prospective class members' “harm includes emotional distress for actual harm and a risk of future harm,” he neither alleges emotional injury in the TAC nor offers any facts demonstrating that Plaintiffs suffered any emotional distress as a result of Vertafore's alleged DPPA violations.
Plaintiffs' allegations of future risk of harm are not sufficiently concrete to confer standing to pursue damages - but Plaintiffs may pursue a claim for damages based on the alleged actual harm.
2. Injunctive Relief
Plaintiffs also seek injunctive relief, for which they must separately demonstrate standing. See Friends of the Earth, 528 U.S. at 185. Unlike in a suit for damages, risk of future harm can satisfy the concrete-harm requirement in the context of a claim for injunctive relief to prevent the harm from occurring, so long as the risk of harm is sufficiently imminent and substantial. See Ramirez, 141 S.Ct. at 2210.
Vertafore argues that Plaintiffs' allegation of imminent and ongoing risk and fear involving their and their families' personal safety constitutes a speculative risk of future harm that is insufficient to confer standing for injunctive relief. The undersigned agrees.
As discussed above, Plaintiffs vague allegation of fear for personal safety is insufficiently specific or substantial to afford relief. And Plaintiffs do not allege any fact showing how these unspecified downstream harms are imminent.
But Plaintiffs do allege a sufficiently substantial and imminent risk of future harm in the form of Vertafore's continued use and redisclosure of their previously obtained personal information. In the TAC, Mulvey contends that Vertafore obtained Texas motor vehicle records for a period of approximately five years, accessing the data by unauthorizedly downloading files from a portal provided by the TXDMV to QQ Solutions, Inc., an authorized user which Vertafore acquired. See Dkt. No. 42-1 at 10-11. The TAC further states that Vertafore, despite being informed by the TXDMV that it is not an authorized recipient of Texas drivers' personal information, “continues to use and redisclose the motor vehicles previously obtained,” using its software to create databases of Plaintiffs personal information that are disclosed to Vertafore's commercial customers. Id. at 12, 16. This use and redisclosure, which Mulvey asserts is an invasion of his and the prospective class members' substantive right to privacy codified by the DPPA, has been “occurring on a continuous basis since August 31, 2015” and “continu[es] to date.” Id. at 7, 13. Mulvey argues that, “[w]ithout remedy, [their substantive privacy rights] will continue to be violated by Defendant Vertafore.” Id. at 16.
Plaintiffs have established standing for injunctive relief against ongoing or future use and disclosure of their previously obtained personal information.
II. Failure to State a Claim
Vertafore next argues that even if Plaintiffs have Article III standing, they have failed to state a claim upon which relief can be granted.
A. Legal Standard
In deciding a Federal Rule of Civil Procedure 12(b)(6) motion, the Court must “accept all well-pleaded facts as true, viewing them in the light most favorable to the plaintiff.” In re Katrina Canal Breaches Litig., 495 F.3d 191, 205B06 (5th Cir. 2007). To state a claim upon which relief may be granted, Plaintiffs must plead “enough facts to state a claim to relief that is plausible on its face, @ Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007), and must plead those facts with enough specificity “to raise a right to relief above the speculative level.” Id. at 555. “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).
While, under Federal Rule of Civil Procedure 8(a)(2), a complaint need not contain detailed factual allegations, Plaintiffs must allege more than labels and conclusions, and, while a court must accept all of the Plaintiffs' allegations as true, it is “not bound to accept as true a legal conclusion couched as a factual allegation.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 555). A threadbare or formulaic recitation of the elements of a cause of action, supported by mere conclusory statements, will not suffice. See id. But, “to survive a motion to dismiss” under Twombly and Iqbal, a plaintiff need only “plead facts sufficient to show” that the claims asserted have “substantive plausibility” by stating “simply, concisely, and directly events” that Plaintiff contends entitle him or her to relief. Johnson v. City of Shelby, Miss., 574 U.S. 10, 12 (2014) (per curiam) (citing Fed.R.Civ.P. 8(a)(2)-(3), (d)(1), (e)); accord N. Cypress Med. Ctr. Operating Co. v. Cigna Healthcare, 781 F.3d 182, 191 (5th Cir. 2015) (“To survive a Rule 12(b)(6) motion to dismiss, the complaint does not need detailed factual allegations, but it must provide the plaintiff's grounds for entitlement to relief B including factual allegations that, when assumed to be true, raise a right to relief above the speculative level.” (footnote and internal quotation marks omitted)).
B. Plaintiff has failed to state a claim
To survive a motion to dismiss claims under the DPPA, a plaintiff must sufficiently plead that: (1) the defendant knowingly obtained, disclosed, or used personal information; (2) from a motor vehicle record; (3) for a purpose not permitted. See 18 U.S.C. § 2724(a); Taylor v. Acxiom Corp., 612 F.3d 325, 335 (5th Cir. 2010).
Vertafore argues that Plaintiffs have failed to adequately allege the first and third elements and, so, their claims must be dismissed. See Dkt. No. 47 at 13 (emphasis and internal citations omitted).
As an initial matter, the parties disagree about whether the statute's mens rea requirement applies to merely the fact of obtaining, disclosing, or use of the information, or whether it requires that the defendant have knowingly obtained, disclosed, or used the information for an improper purpose. But the Fifth Circuit has expressly held that “[t]he plain meaning of the third factor is that it is only satisfied if shown that obtainment, disclosure, or use was not for a purpose enumerated under § 2721(b).” Taylor, 612 F.3d at 335 (cleaned up); see also Reno v. Condon, 528 U.S. 141 (2000) (the section 2724 cause of action is for knowingly obtaining, disclosing, or using the information “for a use other than those specifically permitted by the DPPA”).
And the construction of the mens rea requirement does not alter the outcome, because Plaintiffs do not adequately plead that Vertafore obtained, disclosed, or used their data for an impermissible purpose, knowingly or otherwise.
Mulvey puts forth two arguments related to Vertafore's purportedly improper obtainment, disclosure, and use of Plaintiffs' MVR information: (1) that Vertafore is not an authorized recipient of TXDMV records and thus never had a permissible purpose for obtaining, disclosing, or using Plaintiffs' information; and (2) alternatively, Vertafore knowingly obtained, disclosed, and used Plaintiffs' information for purposes that involved direct marketing.
Mulvey first suggests that Vertafore had no permissible purpose for obtaining, disclosing, or using TXMDV records and that any purpose for which those records were obtained, disclosed, or used was, by default, impermissible, subjecting Vertafore to liability under Section 2724(a). This argument has some merit.
The DPPA prohibits state departments of motor vehicles from knowingly disclosing or otherwise making available to any person or entity personal information from a motor vehicle, with fourteen exceptions - the “[permissible uses” listed in Section 2721(b) - one of which permits disclosure “[f]or use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.” 18 U.S.C. § 2721(a)-(b). Section 2722 makes it unlawful for any person to (a) knowingly obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) and (b) make any false representation to obtain such information from a motor vehicle record. Separately, Section 2724 creates a private right of civil action against anyone who knowingly obtains, discloses, or uses personal information for an impermissible purpose.
The question is whether Mulvey pleaded sufficient facts alleging “more than a sheer possibility” that Vertafore lacked any permissible use to handle Plaintiffs' data that would allow the Court to infer that Vertafore's admitted obtainment, disclosure, or use was impermissible under Section 2724(a). See Iqbal, 556 U.S. at 678.
Mulvey makes several allegations related to this argument, including that Vertafore surreptitiously acquired TXDMV records by accessing its QQ Solution's portal in violation of state law and the DPPA; and that Vertafore is not, as it claims, an insurance support organization, and thus cannot claim that its handling of the data falls within one of the DPPA's permissible uses.
Mulvey's allegations that the Texas Department of Motor Vehicles concluded Vertafore was not an authorized recipient of MVRS due to state contract and licensing issues, even if true, are insufficient to support a claim under the DPPA, which makes no mention of authorized recipients and only prohibits obtainment for a use not permitted. See 18 U.S.C. §§ 2722, 2724.
Mulvey's assertion that Vertafore is not an insurance support organization could support a DPPA claim, for the reasons discussed above. But Mulvey does not argue this, nor does he allege any facts in the TAC allowing the Court to infer this possibility. Mulvey raises this allegation for the first time in his Opposition. See Dkt. No. 58 at 4 n.7, 21-25. The Court may not consider allegations outside of the pleadings on a motion to dismiss. See Dorsey v. Portfolio Equities, Inc., 540 F.3d 333, 338 (5th Cir. 2008); Roebuck v. Dothan Sec., Inc., 515 Fed.Appx. 275, 280 (5th Cir. 2013) (“When deciding a Rule 12(b)(6) motion to dismiss, the district court is limited to the allegations set forth in the complaint.”). And Mulvey may not amend his complaint by offering new arguments in response to a motion to dismiss. See Continental Auto. Sys., Inc. v. Avanci, LLC., 27 F.4th 326, 333 n.9 (5th Cir. 2022).
And, while the DPPA does not define the term “insurance support organization,” the TAC is replete with allegations suggesting Vertafore offers insurance support services, specifically in the area of “rating,” a use category the DPPA explicitly permits. See, e.g., Dkt. No. 42-1 at 5 (“Operating as an Insurance Software Solutions for Carriers, Agencies Brokers, MGAs, and MGUs, Defendant Vertafore reportedly develops software for more than 20,000 insurance agencies, some 1,000 carriers, and managing general agents.”); Id. at 6 (alleging that Vertafore, through its acquired company QQ Solutions, “offer[s] ... a comparative rater product to provide real time quotes from over 150 carriers”); 18 U.S.C. § 2721(b)(6). As Vertafore points out, Mulvey's own allegations in his amended complaint contradict his novel Opposition argument that Vertafore is not an insurance support organization.
And Texas courts considering related cases concluded that Vertafore is an insurance support organization for purposes of the DPPA. See, e.g., Allen, 2021 WL 3148870 at *4 (“'Vertafore is an insurance software company that provides enterprise software solutions” for the insurance industry. Thus, Vertafore's purpose of managing the affected data files is a covered permissible use under 18 U.S.C. § 2721(b)(6), which covers uses by ‘any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.'” (internal citations omitted)).
Mulvey has not pleaded sufficient factual allegations to permit the Court to conclude that Vertafore lacked any permissible purpose for obtaining, disclosing, or using Plaintiffs' personal information.
Mulvey's argument that Vertafore knowingly obtained, disclosed, and used the TXDMV data for an affirmatively impermissible purpose likewise fails because Mulvey does not raise this argument in the TAC. In his Opposition, Mulvey asserts that Vertafore “knowingly obtained Plaintiff and the putative class members' motor vehicle records from the TXDMV ... then knowingly used and disseminated these MVRs to third parties for purposes that involved direct marketing.” Dkt. No. 58 at 17 (citing to Plaintiff's Third Amended Complaint, Dkt. No. 42-1 at 16). But nowhere in the TAC does Mulvey allege, or offer facts suggesting, that Vertafore obtained, disclosed, or used TXDMV record data in connection with any product or activity involving direct marketing.
Mulvey has not pleaded any facts allowing this Court to infer more than a mere possibility that Vertafore violated the DPPA, and his claims should be dismissed.
III. Leave to Amend
At the conclusion of his Opposition, Mulvey requests that, “[s]hould this Court conclude that Plaintiff's factual allegations are deficient, or any pleadings should be struck as redundant, immaterial, or impertinent,” the Court should grant him “leave to amend his complaint and plead additional factual allegations consistent with the Court's order and to cure any defect.” Dkt. No. 58 at 26.
The Fifth Circuit has held that “Rule 15(a) applies where plaintiffs expressly requested to amend even though the request was not contained in a properly captioned motion paper.” United States ex rel. Willard v. Humana Health Plan of Tex. Inc., 336 F.3d 375, 387 (5th Cir. 2003) (internal quotations omitted). “A formal motion is not always required, so long as the requesting party has set forth with particularity the grounds for the amendment and the relief sought.” Id. But “a bare request in an opposition to a motion to dismiss - without any indication of the particular grounds on which the amendment is sought, ... does not constitute a motion within the contemplation of Rule 15(a).” Id.
Mulvey's two-sentence request does not expressly request with particularity that he be given leave to amend; nor does it offer any indication of the grounds on which the Court should permit an amendment. See id.; see also, e.g., WeInfuse, LLC v. InfuseFlow, LLC, No. 3:20-cv-1050-L, 2021 WL 1165132, at *8 (N.D. Tex. Mar. 26, 2021) (finding that “passing or oblique reference to possibly amending [] pleadings” in a footnote stating that “if the Court determines that there is any defect in [plaintiff's] pleading, [he] respectfully requests the opportunity to amend such pleading to cure any arguable defect” did not constitute an express request to amend).
And, if granted, this would be Mulvey's fourth amended complaint. While Rule 15(a) provides that leave to amend shall be freely given “when justice so requires,” creating a “strong presumption in favor of granting leave to amend,” “leave to amend properly may be denied when the party seeking leave has repeatedly failed to cure deficiencies by amendments previously allowed and when amendment would be futile.” FED. R. CIV. P. 15(a)(2); Fin. Acquisition Partners, LP v. Blackwell, 440 F.3d 278, 291 (5th Cir. 2006); Foman v. Davis, 371 U.S. 178, 182 (1962). Mulvey has had ample opportunity to perfect his pleadings and state his claims. And, having provided no indication of what additional allegations a fifth complaint would include, Mulvey has failed to establish that allowing him to further amend his pleadings would not be futile or unnecessarily delay the resolution of this action.
The Court should deny Plaintiff's request to amend his pleadings and dismiss his claims with prejudice.
Recommendation
For the reasons explained above, the Court should deny Defendant Vertafore's motion to dismiss under Rule 12(b)(1) and grant its motion to dismiss under Rule 12(b)(6) and dismiss Mulvey's claims with prejudice and, in so doing, deny as moot the Motion for Class Certification [Dkt. No. 23]. See Conditt v. Owens, 457 Fed.Appx. 420, 422 (5th Cir. 2012).
A copy of these findings, conclusions, and recommendation shall be served on all parties in the manner provided by law. Any party who objects to any part of these findings, conclusions, and recommendation must file specific written objections within 14 days after being served with a copy. See 28 U.S.C. § 636(b)(1); FED. R. CIV. P. 72(b). In order to be specific, an objection must identify the specific finding or recommendation to which objection is made, state the basis for the objection, and specify the place in the magistrate judge's findings, conclusions, and recommendation where the disputed determination is found. An objection that merely incorporates by reference or refers to the briefing before the magistrate judge is not specific. Failure to file specific written objections will bar the aggrieved party from appealing the factual findings and legal conclusions of the magistrate judge that are accepted or adopted by the district court, except upon grounds of plain error. See Douglass v. United Services Auto. Ass'n, 79 F.3d 1415, 1417 (5th Cir. 1996).