UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW HAMPSHIRE

Michael Ives

v. Civil No. 23-cv-432-LM Opinion No.

P Bath & Body Works, LLC

ORDER

Plaintiff Michael Ives brings this putative class action against defendant

Bath & Body Works, LLC, alleging that defendant violated the New Hampshire

Driver Privacy Act (“Driver Privacy Act”), RSA 260:14, by transmitting information

from plaintiff’s driver’s license to a third party without his consent. Presently before

the court is defendant’s motion to dismiss for lack of standing pursuant to Federal

Rule of Civil Procedure 12(b)(1) and for failure to state a claim upon which relief

may be granted pursuant to Federal Rule of Civil Procedure 12(b)(6). See doc. no.

16. For the following reasons, the court finds that plaintiff has sufficiently alleged

standing but fails to state a claim upon which relief may be granted. The court

therefore grants the motion to dismiss.

STANDARDS OF REVIEW

There are two ways to challenge a court’s subject-matter jurisdiction under

Rule 12(b)(1). Freeman v. City of Keene,

, 25 (D.N.H. 2021). First,

the defendant may challenge the sufficiency of the allegations relied upon in the

complaint to support jurisdiction.

Alternatively, the defendant can challenge the accuracy of the complaint’s jurisdictional allegations.

The court’s standard of

review differs depending on the challenge brought.

Where a defendant

challenges the sufficiency of the complaint’s jurisdictional facts, the standard of

review is the same as the Rule 12(b)(6) standard.

Where a defendant challenges

the accuracy of the plaintiff’s allegations, those allegations “are entitled to no

presumptive weight,” and “the court must address the merits of the jurisdictional

claim by resolving the factual disputes between the parties.” Valentin v. Hosp. Bella

Vista,

(1st Cir. 2001).

Here, defendant challenges only the sufficiency of the facts alleged in the

complaint that would support the existence of jurisdiction. Therefore, the court

considers both of defendant’s arguments for dismissal under the 12(b)(6) standard.

Under Rule 12(b)(6), the court must accept the factual allegations in the

complaint as true, construe reasonable inferences in the plaintiff’s favor, and

“determine whether the factual allegations in the plaintiff’s complaint set forth a

plausible claim upon which relief may be granted.” Foley v. Wells Fargo Bank, N.A.,

(1st Cir. 2014) (quotation omitted). A claim is facially plausible

“when the plaintiff pleads factual content that allows the court to draw the

reasonable inference that the defendant is liable for the misconduct

alleged.” Ashcroft v. Iqbal,

(2009). Analyzing plausibility is “a

context-specific task” in which the court relies on its “judicial experience and

common sense.”

.

2 BACKGROUND

The court draws the following factual summary from the limited allegations

in the complaint. Within the last three years, plaintiff has made multiple returns to

one of defendant’s retail stores in Manchester, New Hampshire. He did not present

a receipt for his items at the time of these returns. When customers make non-

receipted returns at defendant’s stores, defendant provides them with store credit

via “stored value cards,” which are similar to gift cards. In addition to making non-

receipted returns, plaintiff has also made purchases using store credit on stored

value cards at this same retail location within the last three years.

When making non-receipted returns or purchasing items using in-store

credit, defendant required plaintiff to present his driver’s license. Defendant then

transmitted information on plaintiff’s driver’s license to an entity known as “The

Retail Equation.” According to the complaint, The Retail Equation provides

software used by retailers to analyze customers’ shopping habits in order to

determine whether a particular transaction may be fraudulent. Plaintiff alleges

that he was not aware that defendant would transmit the information on plaintiff’s

license to a third party in order to process his transactions.

Plaintiff brought the instant putative class action in New Hampshire

Superior Court on or about July 28, 2023. His complaint alleges two claims against

defendant, both of which arise under the Driver Privacy Act. Defendant removed

plaintiff’s action to this court on or about September 13, 2023, pursuant to the Class

3 Action Fairness Act of 2005 (“CAFA”),

Stat. 4 (codified in

scattered sections of 28 U.S.C.).1

DISCUSSION

Plaintiff’s first claim alleges that defendant violated RSA 260:14, IX(a) by

disclosing information on his driver’s license to The Retail Equation. That

subparagraph provides in pertinent part:

A person is guilty of a misdemeanor if such person knowingly discloses information from a department record to a person known by such person to be an unauthorized person . . . . Each such unauthorized disclosure . . . shall be considered a separate offense.

RSA 260:14, IX(a). His second claim alleges that defendant violated RSA 260:14,

IX(b) by engaging in this same conduct. That subparagraph provides that a “person

is guilty of a class B felony if, in the course of business, such person knowingly sells,

rents, offers, or exposes for sale motor vehicle records to another person in violation

of this section.” RSA 260:14, IX(b). Although both subparagraphs speak in terms of

criminal liability, another provision of the statute states that “any person aggrieved

by a violation of this section may bring a civil action.” RSA 260:14, X. A successful

1 The court notes that this action is one of several materially identical putative

class actions recently removed to this court alleging that retailers violate the Driver Privacy Act when they provide customers’ driver’s license information to The Retail Equation. See Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---,

(D.N.H. Dec. 19, 2023) (appeal filed); Bourgeois v. The Gap, Inc., Civ. No. 23-cv-394- LM-TSM,

(D.N.H. Dec. 20, 2023); Bourgeois v. The TJX Cos., Inc., Civ. No. 23-cv-354-PB (D.N.H. Jan. 5. 2024); see also Stewart v. Burlington Coat Factory Warehouse Corp., Civ. No. 23-cv-468-JL-TSM. 4 plaintiff may obtain the greater of actual damages or statutory damages of $2,500

“for each violation,” as well as attorneys’ fees and costs.

Defendant moves to dismiss both counts. First, defendant argues that

plaintiff lacks standing to maintain this action because he fails to allege an actual,

concrete injury. Second, defendant argues that plaintiff fails to state a claim

because the Driver Privacy Act does not provide for liability in these circumstances.

The court must first consider standing. See Steel Co. v. Citizens for a Better Env’t,

(1998).

I. Plaintiff Plausibly Alleges Standing

Article III of the Constitution limits federal courts’ jurisdiction to “Cases” and

“Controversies.” U.S. Const. art III, § 2. “The doctrine of standing emanates from

the case-or-controversy requirement; it ‘developed . . . to ensure that federal courts

do not exceed their authority as it has been traditionally understood.’” Freeman,

561 F. Supp. 3d at 30 (quoting Spokeo, Inc. v. Robins,

, 338 (2016))

(alteration in Freeman). For a plaintiff to have standing, he must have suffered a

“concrete” injury. TransUnion LLC v. Ramirez,

, 424 (2021).

“A ‘concrete’ injury must be ‘de facto’; that is, it must actually exist.” Spokeo,

578 U.S. at 340. A concrete injury may be tangible or intangible. Id. Tangible harms

include “traditional . . . harms, such as physical harms and monetary harms.”

TransUnion, 594 U.S. at 425. Intangible harms include “injuries with a close

relationship to harms traditionally recognized as providing a basis for lawsuits in

American courts,” such as “disclosure of private information.” Id. History is an

5 important touchstone “[b]ecause the doctrine of standing derives from the case-or-

controversy requirement, and because that requirement in turn is grounded in

historical practice.” Spokeo, 578 U.S. at 340-41. However, a plaintiff’s alleged injury

for standing purposes need not be “an exact duplicate” of a harm traditionally

recognized as constituting the basis for a cause of action. TransUnion, 594 U.S. at

424.

Moreover, where a legislature has conferred a cause of action for violation of

a statutory prohibition, the legislature’s “judgment is instructive and important” in

discerning whether the plaintiff has suffered an intangible yet concrete harm.

Spokeo, 578 U.S. at 341. “Courts must afford due respect to [a legislature’s] decision

to impose a statutory prohibition or obligation on a defendant, and to grant a

plaintiff a cause of action to sue over the defendant’s violation of that statutory

prohibition or obligation.” TransUnion, 594 U.S. at 425. Indeed, a “legislature may

‘elevate to the status of legally cognizable injuries concrete, de facto injuries that

were previously inadequate in law.’” Bryant v. Compass Grp. USA, Inc.,

, 621 (7th Cir.) (quoting Spokeo, 578 U.S. at 341), amended on denial of reh’g en

banc,

(7th Cir. 2020). Where a plaintiff plausibly alleges the

deprivation of certain “procedural right[s] granted by statute . . . [he] need not

allege any additional harm beyond the one [the legislature] has identified.” Spokeo,

578 U.S. at 342 (emphasis omitted).

However, the creation of a cause of action for a statutory violation cannot

“automatically” confer standing upon the plaintiff. Id. at 341. Thus, a “bare

6 procedural violation” does not confer standing. Id.; see also TransUnion, 594 U.S. at

427 (“Article III grants federal courts the power to redress harms that defendants

cause plaintiffs, not a freewheeling power to hold defendants accountable for legal

infractions.” (quoting Casillas v. Madison Ave. Assocs., Inc.,

(7th

Cir. 2019) (Barrett, J.)). At the end of the day, although a legislature’s judgment is

entitled to consideration, the “creation of a statutory prohibition . . . and a cause of

action does not relieve courts of their responsibility to independently decide whether

a plaintiff has suffered a concrete harm under Article III.” TransUnion, 594 U.S. at

426.

Importantly, “standing in no way depends on the merits of the plaintiff’s

contention that particular conduct is illegal.” Hochendoner v. Genzyme Corp.,

(1st Cir. 2016) (quoting Warth v. Seldin,

(1975)).

“For standing purposes, we accept as valid the merits of [plaintiff’s] legal

claims . . . .” Fed. Election Comm’n v. Cruz,

, 298 (2022). Thus, in

assessing a motion to dismiss for lack of standing, the “only question is, putting the

merits aside, whether [plaintiff] plausibly alleges [he] was injured under [his]

theory of the underlying legal claim.” Laufer v. Acheson Hotels, LLC,

,

267 (1st Cir. 2022), vacated and remanded on other grounds,

(2023).

As noted, plaintiff alleges that defendant disclosed information on his driver’s

license to a third party without plaintiff’s knowledge or consent in violation of the

7 Driver Privacy Act.2 Defendant contends that the unauthorized disclosure of

information on plaintiff’s driver’s license does not constitute a concrete injury

sufficient to confer standing. Although defendant acknowledges that the

unauthorized disclosure of private information can be a concrete injury in some

circumstances, defendant contends that the information contained within a driver’s

license is not private because persons routinely show their license to strangers and

because most of the information contained in a driver’s license is readily discernible

(such as hair color) or is a matter of public record (such as a person’s legal address).

The Fourth Circuit considered a closely analogous set of facts in Garey v.

James S. Farrin, P.C.,

(4th Cir. 2022). The defendants in that case

were a group of personal injury lawyers who obtained car accident reports from law

enforcement agencies and private entities. 35 F.4th at 919. The defendants used the

personal information revealed on those reports—the names and addresses of the

drivers—to solicit clients. Id. The drivers who received the defendants’ solicitations

brought suit alleging that the defendants violated the Driver Privacy Act’s federal

counterpart, the Driver’s Privacy Protection Act (“DPPA”),

et seq.

Id. at 919-20. Like New Hampshire’s Driver Privacy Act, DPPA establishes a cause

of action against persons who obtain or use personal information from motor vehicle

records for an unauthorized purpose. See

(a); Garey, 35 F.4th at

2 For purposes of resolving the standing issue and in keeping with the standing

inquiry at the motion to dismiss stage, the court will assume that defendant’s alleged actions violated the Driver Privacy Act and that defendant’s alleged conduct is actionable under that Act. 8 920. Applying TransUnion, the Fourth Circuit held that the plaintiffs alleged a

privacy injury that was closely related to the common law tort of invasion of

privacy, “which has long provided a basis for recovery at common law.” Garey, 35

F.4th at 921 (quotation omitted). The court reasoned that, by enacting DPPA,

“Congress responded to the harms of actual people by creating a cause of action that

protects their particular and concrete privacy interests.” Id. at 922 (quoting

Krakauer v. Dish Network, LLC,

(4th Cir. 2019)).

The court follows the Fourth Circuit’s reasoning in Garey. Here, plaintiff has

alleged that defendant disclosed information from his driver’s license without his

knowledge or consent on multiple occasions. He alleges that this information

included, among other things, his name, his driver identification number, his

address, and medical or disability information. See doc. no. 5 at 3. Plaintiff has

adequately alleged an invasion of his privacy that bears a sufficiently close

relationship to a harm traditionally recognized in American law. See Garey, 35

F.4th at 921-22; see also TransUnion, 594 U.S. at 425 (recognizing that disclosure of

private information can be sufficient to confer standing).

Further support for the existence of standing is found in the Seventh Circuit’s

opinion in Bryant v. Compass Group USA, Inc.3 At issue there was an Illinois state

law that required any entity collecting persons’ “biometric identifiers or

information” (such as their fingerprints or their facial features for facial recognition

3While Bryant preceded the Supreme Court’s opinion in TransUnion, the Seventh Circuit has held that Bryant remains good law post-TransUnion. See Cothron v. White Castle Sys., Inc.,

, 1161 (7th Cir. 2021). 9 technology) to obtain the written, informed consent of persons whose information

was acquired, and established a cause of action for any person whose biometric

information was obtained in violation of the statute. Bryant, 958 F.3d at 619. The

plaintiff’s employer installed the defendant’s fingerprint-operated vending machines

in the employer’s cafeteria, and the plaintiff used the vending machines. Id. The

defendant failed to inform the plaintiff that her biometric identifier was being

collected and did not obtain her written consent to collect, store, or use her

fingerprint. Id. Although it was uncontested that the plaintiff knew her fingerprint

was being collected and stored, she brought a putative class action alleging that the

defendant failed to obtain her informed, written consent in violation of the Illinois

state law. Id. at 619-20.

The plaintiff originally brought her action in Illinois state court, but the

defendant removed pursuant to CAFA. Id. at 620. The plaintiff thereafter moved to

remand, arguing that federal jurisdiction did not exist because her complaint failed

to allege a concrete injury for standing purposes.4 Id. The district court granted the

motion to remand, finding that the plaintiff’s allegations did not support standing,

but the court of appeals granted the defendant’s petition to appeal the remand order

and took up the standing issue. Id.; see

(c) (allowing for

discretionary appeal of remand to state court of class action previously removed to

federal court under CAFA).

4 The Seventh Circuit noted that Illinois state law does not have as stringent

a standing requirement as exists under the case-or-controversy requirement. See 958 F.3d at 622. 10 On appeal, the Seventh Circuit held that the plaintiff had alleged an injury

sufficient to confer Article III standing. By collecting the plaintiff’s fingerprint

information without her informed consent, the defendant committed “no bare

procedural violation; it was an invasion of her private domain.” 958 F.3d at 624. The

court analogized the defendant’s alleged conduct to the common law tort of trespass,

which seeks to protect an individual’s personal rights in his or her land. See id.; see

also Spokeo, 578 U.S. at 344 (Thomas, J., concurring) (explaining that “courts

historically presumed that the plaintiff suffered a de facto injury merely from

having his personal, legal rights invaded. Thus, when one man placed his foot on

another’s property, the property owner needed to show nothing more to establish a

traditional case or controversy”). Moreover, the requirement to obtain a person’s

informed consent to collect their biometric data was not an ancillary requirement of

the at-issue Illinois law; it was at the law’s “heart.” 958 F.3d at 626. Indeed, the

manifest purpose of the statute “is to ensure that consumers understand, before

providing their biometric data, how that information will be used, who will have

access to it, and for how long will it be retained.” Id. Highlighting “[t]he judgment of

[the] Illinois[ ] General Assembly . . . that the sensitivity of biometric information

and the risk of . . . privacy . . . harm that may result from its dissemination

necessitates that people be given the opportunity to make informed choices about to

whom and for what purpose they will relinquish control of that information,” the

court found that a failure to obtain a person’s informed consent in violation of the

Illinois law constituted a concrete injury for Article III purposes. Id.

11 The Seventh Circuit’s analysis in Bryant supports standing here. While at

least some of the information contained in a person’s driver’s license is readily

observable, so too are a person’s facial features for purposes of biometric

identification. The mere fact that a person’s information may be readily observable

or a matter of public record does not mean that the unauthorized intrusion upon

such information fails to establish a concrete injury. A person’s yard may be visible

from a public street; that does not give passersby the right to intrude upon private

property. See Spokeo, 578 U.S. at 344 (Thomas, J., concurring). Indeed, the very

existence of the Driver Privacy Act contemplates that certain information contained

within “department records” and “motor vehicle records” may not be disclosed

except in accordance with the Act, even if that information might be publicly

available elsewhere. See RSA 260:14, IX(a)-(b).5 Far from a mere technical violation,

the unauthorized disclosure of drivers’ records is at the “heart” of the Driver Privacy

Act. See DeVere v. Att’y Gen.,

(2001) (explaining the genesis

of the Driver Privacy Act and noting its “general rule that motor vehicle ‘records

shall not be public records or open to the inspection of any person’” (quoting RSA

260:14, II(a))); Smith v. Home Depot U.S.A., Inc., --- F. Supp. 3d ---,

, at *3-4 (D.N.H. Dec. 19, 2023) (explaining restrictions imposed by the

Driver Privacy Act). Plaintiff is not “merely seeking to ensure a defendant’s

5 The First Circuit has recognized that the misuse of a person’s name—which

is otherwise generally public information—may constitute an injury in fact for standing purposes. See Webb v. Injured Workers Pharm., LLC,

, 373 (2023). 12 ‘compliance with regulatory law,’” TransUnion, 594 U.S. at 427 (quoting Spokeo,

578 U.S. at 345 (Thomas, J., concurring)), he is seeking vindication for “a violation

of [his] own rights . . . an invasion of [his] private domain,” Bryant, 958 F.3d at 624.

Defendant’s arguments against the existence of standing are not persuasive.

Defendant points to district court orders in other circuits in which courts have

found that the unauthorized disclosure of information within a driver’s license

failed to state various claims upon which relief could be granted. See Rasmussen v.

Chisago Cnty.,

(D. Minn. 2014) (plaintiff’s allegations

failed to meet the “high threshold of offensiveness and expectation of privacy”

needed to state claim for intrusion upon seclusion under Minnesota state law);

Rollins v. City of Albert Lea,

(D. Minn. 2014) (plaintiff

failed to plausibly allege dissemination of “highly personal matters representing the

most intimate aspects of human affairs” necessary to state claim for violation of

constitutional right to privacy (quotation omitted)); Sutherland v. Massa, Case No.

08-5129-CV-SW-RED,

, at *2 (W.D. Mo. Sept. 16, 2010) (plaintiff

failed to plausibly allege that disclosure of information in driver’s license “would be

highly offensive to a reasonable person” as required to state claim for invasion of

privacy claim under Missouri state law); Phillips v. Bailey,

(W.D. Va. 2004) (plaintiff failed to state § 1983 claim for violation of his

Fourth Amendment rights because plaintiff did not have a reasonable expectation of

privacy in information shared with a third party such as the DMV).

13 In none of these cases, however, did the court consider whether the plaintiff

had Article III standing.6 While intangible harms bearing “a close relationship to

harms traditionally recognized as providing a basis for lawsuits in American courts”

confer standing to sue, TransUnion, 594 U.S. at 425, Article III does “not require an

exact duplicate,” id. at 433. Garey and Bryant show that the unauthorized

disclosure of personal information from a driver’s license in violation of a statutory

prohibition may constitute a concrete injury sufficient to confer standing—

especially where that unauthorized disclosure causes the plaintiff to “suffer[ ] injury

in precisely the form the statute was intended to guard against.” Havens Realty

Corp. v. Coleman,

(1982); see also Spokeo, 578 U.S. at 342

(explaining that “the violation of a procedural right granted by statute can be

sufficient in some circumstances to constitute an injury in fact”). Here, the harm

plaintiff alleges bears a sufficiently close relationship to an invasion of privacy

traditionally recognized in American law, even if that harm is not a mirror image of

the specific causes of action that were at issue in the cases defendant relies upon.

Defendant also argues that plaintiff lacks standing because he does not allege

he suffered monetary harm as a result of the unauthorized disclosure. However,

6 While defendant also cites, in a footnote, to cases where district courts in

other circuits have found that the disclosure of information on driver’s licenses failed to confer Article III standing, these were data breach cases that concerned the requirement that a plaintiff’s injury be imminent, not the requirement that a plaintiff’s injury be concrete. Here by contrast, defendant does not argue that the injury plaintiff complains of is not imminent—nor could it, since plaintiff alleges that the disclosure of his driver’s license information in violation of the Driver Privacy Act has already occurred. 14 while “actual economic loss . . . is the prototypical concrete harm,” Gustavsen v.

Alcon Labs., Inc.,

(1st Cir. 2018), concrete harms also include

intangible harms that are “actionable without wallet injury,” Amrhein v. eClinical

Works, LLC,

, 331 (1st Cir. 2020). Here, plaintiff has sufficiently

alleged an intangible harm for the reasons discussed above.

For these reasons, the court finds that plaintiff has sufficiently alleged

standing at the motion to dismiss stage. The court next considers defendant’s

second ground for dismissal: whether plaintiff has stated a claim upon which relief

can be granted.

II. Plaintiff Fails to State a Claim Upon Which Relief Can Be Granted

The complaint in this case is materially identical to the complaint before this

court in Home Depot. See Home Depot,

, at *1.7 The court finds

that neither Count I nor Count II of plaintiff’s complaint states a claim upon which

relief can be granted for the same reasons the identical causes of action failed to

state claims in Home Depot. With respect to Count I, plaintiff’s driver’s license is

not a “department record” within the meaning of RSA 260:14, IX(a). With respect to

Count II, his driver’s license is not a “motor vehicle record” within the meaning of

RSA 260:14, IX(b), and plaintiff failed to plausibly allege that defendant sold,

rented, offered, or exposed for sale his driver’s license or the information contained

therein.

7 For this reason, the court denies defendant’s request for a hearing on its

motion to dismiss. 15 The clerk of court is directed to enter judgment and close the case.

SO ORDERED.

__________________________ Landya McCafferty United States District Judge

April 18, 2024

cc: Counsel of Record

16