A divided federal appeals panel has revived a lawsuit filed against the owner of a website that sells drivers' personal information by a man who claims his information was sold to another man who used it to harass and threaten him.

Judge Denny Chin (See Profile), writing for a 2-1 majority of the U.S. Court of Appeals for the Second Circuit in Gordon v. Softech International, 12-661-cv, ruled that Southern District Judge Richard Berman (See Profile) should not have dismissed the case against Arcanum Investigations Inc., a private agency that runs the website Docusearch.com.

Chin concluded that Arcanum may have violated the 1994 Driver's Privacy Protection Act, or DPPA, which prohibits state motor vehicle departments and others from disclosing drivers' personal information except for certain limited purposes, like filing insurance claims or to help law enforcement investigations.

However, Chin affirmed Berman's decision to dismiss the case against Softech International Inc., which sold the data to Arcanum.

Judge Rosemary Pooler (See Profile) joined in Chin's opinion, and Judge Dennis Jacobs (See Profile) dissented in part.

The dispute began in October 2009, when the plaintiff, Erik Gordon, was eating in a Manhattan restaurant while his driver waited outside with his car, a vintage London taxi cab. According to court documents, a drunken woman approached the driver and began asking him about the car. When the driver said he didn't want to talk about it, the woman became offended and went into an SUV parked across the street.

Gordon alleges that another man, Aron Leifer, then got out of the SUV and began threatening Gordon's driver. The driver tried to drive away, but Leifer pursued him. Gordon's driver ended up going to a nearby police precinct to wait for Leifer to go away before returning to the restaurant. Leifer maintains that at some point that evening, Gordon's driver struck his car, though Gordon denies this and Leifer never filed an insurance claim.

Leifer did write down Gordon's license number, and the next day he put it into Arcanum's website Docusearch.com, which allows users to find personal information associated with license plate numbers. Arcanum buys this information from Softech, which in turn gets it through agreements with all 50 states' DMVs.

The site prompted Leifer to choose a valid reason under the DPPA for seeking Gordon's information from a drop-down menu. Leifer selected "Insurance Other." Leifer clicked "OK" to a prompt asking him to say that he would not use the information in violation of the DPPA. Asked for his personal information, Leifer provided the site with a false name. After charging $39 to his credit card, he got Gordon's name and home address.

Further searches allowed Leifer to find contact information for Gordon's family and acquaintances. He called Gordon's assistant, his mother and his father's secretary, making threatening comments about Gordon and falsely telling his mother that Gordon had sexually assaulted a woman.

Gordon sued Leifer, Softech and Arcanum for violating the DPPA. Leifer settled with Gordon. However, Gordon alleged that Softech and Arcanum were separately liable.

Gordon argued that Softech and Arcanum should be strictly liable for Leifer's misuse of his information because they allowed him to get it. Even if they were not strictly liable, Gordon argued, they should be liable for violating the DPPA by disclosing his information for a purpose not expressly authorized by the law. He also argued that the companies had a duty to exercise reasonable care before turning over information.

Berman granted summary judgment to both companies (NYLJ, Dec. 5, 2011). Gordon appealed.

Duty of Care for Resellers

Chin, like Berman, ruled that the DPPA did not create any strict liability.

However, he ruled that the DPPA does implicitly created a duty of care for resellers because it creates a right of civil action if information is improperly turned over.

"Logically, the language makes clear, albeit implicitly, that resellers are obliged to use some care in disclosing personal information obtained from motor vehicle records," he wrote. "If resellers may not disclose personal information except as permitted by the DPPA, they must be obliged to make some inquiry before concluding that disclosure is permitted."

Relying on the "mere 'say-so'" of buyers would make the law's remedy "toothless," he said.

Chin said the law's legislative history also supports a duty of care for resellers, since it was intended to protect drivers' privacy.

In light of that goal, he said, it is "inconceivable that a dropdown menu, a check box, and a representation that no laws would be violated could satisfy any reasonable diligence floor."

Jacobs, in his partial dissent, said the majority should have affirmed the dismissal of the case against Arcanum.

He said the majority effectively created a duty for resellers of driver data to investigate their customers "as though selling a firearm or dispensing a narcotic."

"That is a negligence standard, and it is a judicial invention that alters the nature of the industry's service and its economics, and thereby upsets the balance of the Act," he said.

Jacobs noted that granting summary judgment to Arcanum would not let Leifer off the hook, and that, in fact, Gordon had recovered damages from Leifer.

"So it cannot be said that the Act was 'toothless' in this case," he said. "The Act doesn't have to bite everybody."

Jacobs said the opinion seemed to make website owners responsible for misinformation provided by their users.

"A lot of website owners should worry about the implications of the majority opinion," he concluded.

Justin Sher of Sher Tremonte, who represents Gordon, said in an email that, while he believed the decision "should have gone further in some respects," it was "an important victory for individual privacy and safety."

"The Second Circuit's decision holds accountable those who profit from selling—over the Internet and otherwise—the personal information of Americans without their knowledge," he wrote. "We are pleased that the Second Circuit held that resellers of DMV records must conduct a reasonable inquiry concerning the bona fides of their buyers before selling such information. In doing so the Second Circuit read the Driver's Privacy Protection in accordance with Congress's intent—to protect drivers' privacy."

The defendants are represented by Coleen Middleton, of counsel at Wilson Elser Moskowitz Edelman & Dicker, and Gregory Saracino, a partner at Milber, Makris, Plousadis & Seiden. They could not be reached for comment.