On May 19, 2016, the United States Court of Appeals for the Eleventh Circuit affirmed the dismissal of Driver’s Privacy Protection Act (“DPPA”) claims because they were time barred under the statute of limitations.  

Toni Foudy was a deputy sheriff in the Florida counties of St. Lucie and Indian River.  Ms. Foudy alleged that while she was a deputy sheriff, law enforcement agents harassed her and her husband, Shaun (the “Foudys”).  The Foudys claimed that the agents accessed their private personal information via Florida’s Driver and Vehicle Information Database in ways that violated the DPPA.  The Foudys filed their initial DPPA lawsuit in federal district court on December 31, 2012.  The DPPA prohibits state motor vehicle departments and their employees from knowingly disclosing or making available personal information contained in a motor vehicle record, unless a statutory exception permits such conduct.  The initial lawsuit identified various people and entities as defendants, including several cities and counties.

The district court severed the Foudys’ claims, dismissed most of the defendants, ordered the Foudys to file separate actions against any remaining or former defendants by August 15, 2014, and noted that any new actions would be “considered a continuation of [the] original action for statute of limitations purposes.”  Subsequently, the Foudys filed 13 separate actions, including one that identified Miami-Dade County, Florida (“Miami-Dade”), as a defendant.  Miami-Dade filed a motion to dismiss predicated on the expiration of the applicable statute of limitations.  The district court agreed with Miami-Dade and dismissed the lawsuit with prejudice.  The Foudys appealed to the Eleventh Circuit.

The DPPA does not have its own statute of limitations.  Consequently, 28 U.S.C. § 1658(a)’s catchall statute of limitations applies.  Subsection 1658(a) states the following: “Except as otherwise provided by law, a civil action arising under an Act of Congress . . . may not be commenced later than 4 years after the cause of action accrues.”  The parties agreed that Subsection 1658(a) governed, but they disagreed on when the statute of limitations clock had started to tick.  The Foudys argued that their DPPA claims accrued when they discovered the alleged violations (the “discovery rule”).  Miami-Dade contended that the DPPA claims accrued when the alleged violations occurred (the “occurrence rule”).

Ultimately, the Eleventh Circuit concluded that the statute of limitations clock for the Foudys’ DPPA claims had started when the alleged violations occurred.  The reasoning for the Eleventh Circuit’s conclusion had two core aspects.  First, the Court acknowledged that “in the absence of a clear Congressional directive or a self-concealing violation, the court should not graft a discovery rule onto a statute of limitations.”  With that background condition in mind, the Court determined that the Foudys’ alleged “‘DPPA violations [we]re not by their nature self-concealing,’ nor d[id] they ‘cry out’ for application of the discovery rule.”  Second, the Court examined the structure of Section 1658.  That section’s other component, Subsection 1658(b), states that “[n]otwithstanding subsection (a), a private right of action that involves a claim of [securities] fraud, deceit, manipulation, or contrivance . . . may be brought not later than the earlier of . . . 2 years after the discovery . . . [or] 5 years after such violation.”  The presence of a discovery rule and an occurrence rule in Subsection 1658(b) demonstrated to the Court that “at the time Congress amended § 1658 to add subsection (b), it knew how to write statutory text that differentiated between the discovery and occurrence rules and yet chose to preserve as the general rule the more ambiguous language of § 1658(a).”  From those two lines of reasoning, the Eleventh Circuit concluded that the district court correctly used the occurrence rule for the purposes of statute of limitations calculations.

The Eleventh Circuit’s decision is important because it increases clarity in one part of the data privacy legal ecosystem.  Going forward, a potential plaintiff will know that when he is in the Eleventh Circuit and has a data privacy claim governed by Subsection 1658(a), the relevant date for statute of limitations calculations is the date that the alleged violation occurred, not the date he discovered the alleged violation.

A copy of the Eleventh Circuit’s decision is available by clicking here.

Reporter, Barrett R. H. Young, Washington, D.C., +1 202 626 2928, bryoung@kslaw.com.