"[I]f inaccurate information falls into a government database, does it make a sound?" Partly affirming summary judgment for the defendant in Owner-Operator Indep. Drivers Ass'n, v. DOT, No. 16-5355 (D.C. Cir. Jan. 12, 2018), the U.S. Court of Appeals for the D.C. Circuit answered its own question in the negative and held that a handful of truck drivers lacked standing to sue over the existence of allegedly inaccurate driver information in a government database. However, the court also ruled that two truck drivers about whom information was disseminated could overcome the Spokeo bar that sunk the claims of their peers and permitted their claims to go forward. In doing so, the appeals court helped clarify what actions in the digital realm rise to the level of concrete harm.
Plaintiffs in Owner-Operator were five commercial truck drivers and their industry association. Pursuant to federal regulations, the drivers' safety records were contained in the Motor Carrier Management Information System, which employers may access through the Department of Transportation's (DOT) Pre-Employment Screening Program. Each of the plaintiff drivers successfully challenged safety citations they had received in court, and then asked to have the citation reports removed from the safety record database.
However, because the database displayed only initial citations and not adjudicated outcomes, their requests were rejected and the safety records of two of the drivers, including the citations, were shared through the Pre-Employment Screening Program. The drivers and the association then sued, alleging the DOT was failing to ensure the accuracy of the database. The DOT moved for summary judgment, arguing (among other things) that the drivers lacked Article III standing because they failed to show concrete injury in fact. The trial court agreed and dismissed the case.
On appeal, the D.C. Circuit considered the dismissal de novo and focused on whether the DOT's failure to discharge its statutory duty to ensure the accuracy of information in its database was a sufficiently concrete injury. The court found the existence of inaccurate information in the DOT database was not alone sufficient to constitute a concrete injury. First, the drivers failed to identify any historical or common-law analog where the mere existence of inaccurate information, absent dissemination (unlike libel or slander), amounts to concrete injury. Second, nothing in the statutory provisions regarding the database created legal rights which, if violated, would give rise to Article III standing.
However, the D.C. Circuit did explain that the two drivers about whom inaccurate information was disseminated had suffered concrete harm and could satisfy the post-Spokeo standard for Article III standing. The court noted that its decision turned on the specific facts of the drivers' case and that "it is possible that the mere existence of inaccurate information in a government database could cause concrete harm depending on how that information is to be used."
The Owner-Operator ruling sheds light on how other courts may rule in cases dealing with access to databases containing personally identifying information (PII) and dissemination of that information. As the D.C. Circuit pointed out, the concerns in such a case differ from those implicated by cyberattacks because, among other things, a hacker might have "both the intent and the ability to use that [PII] for ill." More generally, the decision adds to the growing body of case law on post-Spokeo standing where the alleged injury stems from the publication of information. Notably, the Owner-Operator ruling came at the summary judgment stage rather than on a motion to dismiss, where more judicial guidance exists.
This article is presented for informational purposes only and is not intended to constitute legal advice.
