Liability of Transportation Entity for the Unintentional Release of Secure Data or the Intentional Release of Monitoring Data on Movements or Activities of the Public (2016)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

9III. WHETHER PRIVACY RIGHTS UNDER THE UNITED STATES CONSTITUTION APPLY TO PERSONAL AND LOCATIONAL DATA A. Introduction Privacy law in the United States is said to be a “disorganized body of law”80 lacking a “comprehen- sive national regulatory structure.”81 Instead of a unified approach, privacy rights are created sporadi- cally for a specific reason, often in response to changes in technology.82 Privacy rights have been defined as the right to control the dissemination of one’s information83 and to be free from government intrusion.84 Although a “cluster of constitutional rights” protects citizens from various forms of government intrusion, deci- sions by the United States Supreme Court in recent years have narrowed an individual’s zone of privacy protected by the U.S. Constitution.85 B. Evolution of Privacy Rights In 1890, Samuel D. Warren and Louis D. Brandeis published an article entitled, “The Right to Pri- vacy,”86 in which they articulated the basis of a right to privacy in the United States.87 The authors pos- ited that an individual should have a legal remedy when the press “overstep[s] in every direction in the obvious bounds of propriety and of decency.”88 Warren and Brandeis argued that the publishing of private facts “appeal[s] to the weak side of human nature” and “usurps the place of interest in brains capable of other things,” thus necessitating in their view the need to protect individuals’ privacy.89 Although they recognized six limitations on the right to privacy,90 they argued not only that society should uphold an individual’s privacy rights, but also that a violation of privacy rights should be remediable either by compensation or, in rare cases, by an injunction.91 Following the Warren and Brandeis article, some courts held that privacy rights were fundamentally rooted in natural law,92 yet other courts rejected claims that a right to pri- vacy existed.93 A leading case on privacy rights is the United States Supreme Court’s 1965 decision in Griswold v. Connecticut,94 which held that there is a right to pri- vacy under the U.S. Constitution.95 In Griswold, the petitioners were physicians who had provided their patients with contraceptives in violation of Connect- icut law.96 When the petitioners argued that the Connecticut statute violated the Fourteenth Amend- ment, the Court agreed that they had “standing to raise the constitutional rights of the married people with whom they had a professional relationship.”97 However, the Court also held that there is a consti- tutional right to privacy, because the “specific guar- antees in the Bill of Rights have penumbras, formed by emanations from those guarantees that help give them life and substance. Various guarantees create zones of privacy.”98 Thus, the “right of association” is guaranteed by the First Amendment; the “right of the people to be secure in their persons, houses, papers, and effects[] against unreasonable searches and seizures” is secured by the Fourth Amendment; and a “zone of privacy which government may not force [a person] to surrender to his detriment” exists under the Fifth Amendment.99 Because the constitutional guarantees created a zone of privacy, a “governmental purpose to control or prevent activities constitutionally subject to state regulation may not be achieved by means which sweep unnecessarily broadly and thereby invade the 80 Alain J. Lapter, How the Other Half Lives (Revisited): Twenty Years Since Midler v. Ford, A Global Perspective on the Right of Publicity, 15 Tex. iNTeLL. pROp. L.J. 239, 247 (2007) [hereinafter Lapter]. 81 Douma and Deckenbach, supra note 2, at 300. 82 Garry, Douma, and Simon, supra note 2, at 102. 83 J. Thomas McCarthy, The Rights of Publicity and Pri- vacy, at § 1.6 (2013) (citing United States Department of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 761, 109 S. Ct. 1468, 1775-1776, 103 L. Ed. 2d 774, 788 (1989)) [hereinafter McCarthy]. 84 Ken Gormley, One Hundred Years of Privacy, 1992 Wis. L. Rev. 1335, 1361 (1992). 85 McCarthy, supra note 83, at § 5.57. 86 Samuel D. Warren and Louis D. Brandeis, The Right to Privacy, 4 haRv. L. Rev. 193 (1890) [hereinafter Warren & Brandeis]. 87 McCarthy, supra note 83, at § 1.10. 88 Warren & Brandeis, supra note 86, at 196. 89 Id. 90 Id. at 214–19. 91 Id. at 219–20. 92 McCarthy, supra note 83, at § 1.16 (citing Roberson v. Rochester Folding Box Co., 171 N.Y. 538, 64 N.E. 442 (N.Y. 1902)). 93 Id. § 1.17 (citing Pavesich v. New England Life Ins. Co., 122 Ga. 190, 50 S.E. 68 (Ga.1905)). 94 381 U.S. 479, 85 S. Ct. 1678, 14 L. Ed. 2d 510 (1965). 95 Griswold, 381 U.S. at 485–486, 85 S. Ct. at 1682, 14 L. Ed. 2d at 515–516. 96 Id. at 480, 85 S. Ct. at 1679, 14 L. Ed. 2d at 512 (cit- ing cONN. geN. sTaT. §§ 53-32, 54-196 (1958)). 97 Id. at 484, 85 S. Ct. at 1681, 14 L. Ed. 2d at 514. 98 Id. (citation omitted). There is a zone of privacy because of the constitutional “right of association” and the “right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures.” See id. (quoting U.S. cONsT. amends. I and IV). 99 Id at 480–481, 85 S. Ct. at 1679, 14 L. Ed. 2d at 512.

10 area of protected freedoms.”100 In a concurring opin- ion, Justice Goldberg stated that because personal liberties are grounded in “traditions and conscience,” people’s liberties are “not confined to the specific terms of the Bill of Rights.”101 After the Griswold decision, the Supreme Court and lower courts interpreted the scope of privacy rights to include a “seemingly disparate cluster of constitutional rights against government intru- sion.”102 As privacy rights evolved after Griswold, they came to include protection against “government intrusion into a person’s mind and thought pro- cesses,”103 “intrusion into a person’s zone of private seclusion,”104 and “intrusion into a person’s right to make certain personal decisions, such as whether to use contraceptives or have an abortion.”105 However, more recent jurisprudence has limited the zone of privacy established by the Griswold case and its progeny. Rather than expand the zone of privacy so that it would apply to an individual’s right to control the collection of personal data or its dissemination, the Supreme Court has narrowed the zone.106 Thus, pres- ently, there is neither a “specific constitutional right to privacy,” nor is there a constitutional right to privacy in one’s personal or locational information.107 In 1977, in Whalen v. Roe,108 the Supreme Court unanimously held “that New York State had the right to collect data about individuals and create a database if for the public good and with adequate security measures taken to protect the privacy and identification of individuals.”109 In an opinion by Justice Stevens, the Court stated that it was not “unaware of the threat to privacy implicit in the accumulation of vast amounts of personal informa- tion in computerized data banks or other massive government files…, much of which is personal in character and potentially embarrassing or harmful if disclosed.”110 Justice Stevens continued: The right to collect and use such data for public purposes is typically accompanied by a concomitant statutory or regu- latory duty to avoid unwarranted disclosures. Recognizing that in some circumstances that duty arguably has its roots in the Constitution, nevertheless New York’s statutory scheme, and its implementing administrative procedures, evidence a proper concern with, and protection of, the indi- vidual’s interest in privacy. We therefore need not, and do not, decide any question which might be presented by the unwarranted disclosure of accumulated private data— whether intentional or unintentional—or by a system that did not contain comparable security provisions.111 The Whalen Court held that the record did “not establish an invasion of any right or liberty pro- tected by the Fourteenth Amendment.”112 In a 1981 Fifth Circuit case, Fadjo v. Coon,113 the plaintiff alleged that the State of Florida had con- spired with others to divulge “the most private details” of the plaintiff ’s life.114 The court recognized a privacy right in the plaintiff ’s confidential infor- mation, but held that the right had to be balanced against any state interest in disclosure. Although the plaintiff had alleged the other elements required for a § 1983 action, discussed in Section III.E, the question for the Fifth Circuit was “whether Fadjo has alleged [the] deprivation of a constitutional right.”115 The Fifth Circuit stated that [t]he privacy right has been held to protect decision making when the decision in question relates to matters such as “marriage, procreation, contraception, family relationships, and child rearing and education.” …Matters falling outside the scope of the decision making branch of the privacy right may yet implicate the individual’s interest in nondisclosure or confidentiality.116 The court held that Fadjo clearly states a claim under the confidentiality branch of the privacy right. He does not claim that the state lacked authority to obtain personal information from him while pursuing a criminal investigation. However, even if the information was properly obtained, the state may have invaded Fadjo’s privacy in revealing it to Julson and the insurance companies. Alternatively, although the state could compel Fadjo’s testimony it could delve into his pri- vacy only in pursuit of aims recognized as legitimate and proper. Implicit in both formulations of the complaint is the allegation that no legitimate state purpose existed sufficient to outweigh the invasion into Fadjo’s privacy.117 The court reversed the district court’s dismissal of the complaint.118 100 Id. at 485, 85 S. Ct. at 1682, 14 L. Ed. 2d at 515–516 (internal citation omitted). 101 Id. at 486, 85 S. Ct. at 1683, 14 L. Ed. 2d at 516–517 (Goldberg, J., concurring). 102 McCarthy, supra note 83, at § 5.57. 103 Id. (citing Ramie v. City of Hedwig Village, Tex., 765 F.2d 490, 492 (5th Cir. 1985)). 104 Id. (citing Stanley v. Georgia, 394 U.S. 557, 89 S. Ct. 1243, 22 L. Ed. 2d 542 (1969)). 105 Id. See Paul v. Davis, 424 U.S. 693, 713, 96 S. Ct. 1155, 1166, 47 L. Ed. 2d 405, 421 (1976); Bowers v. Hardwick, 478 U.S. 186, 106 S. Ct. 2841, 92 L. Ed. 2d 140 (1986). 106 Phillips and Kohm, supra note 1, at P6. 107 Id. at P4. 108 429 U.S. 589, 97 S. Ct. 869, 51 L. Ed. 2d 64 (1977). 109 Phillips and Kohm, supra note 1, at P6. 110 Whalen, 429 U.S. at 605, 97 S. Ct. at 879, 51 L. Ed. 2d at 77 (emphasis added). 111 Id. at 605–606, 97 S. Ct. at 879, 51 L. Ed. 2d at 77. 112 Id. at 606, 97 S. Ct. at 879–880, 51 L. Ed. 2d at 77. 113 633 F.2d 1172 (5th Cir. 1981). 114 Id. at 1174. 115 Id. at 1175. 116 Id. (citations omitted). 117 Id. (emphasis added). 118 Id. at 1177.

11 In Fadjo, the court seems to be clear that when confidentiality is the privacy issue, “a balancing standard is appropriate as opposed to [a] compelling state interest analysis that is required when the autonomy of decision making is at issue.”119 The Fadjo court did not hold that when the confidential- ity of personal information is at stake the govern- mental interest has to be compelling, but did indi- cate that “‘more than mere rationality must be demonstrated’ to justify a state intrusion.”120 In 1987 in Borucki v. Ryan,121 the First Circuit agreed that since the Griswold decision, a “‘right of personal privacy, or a guarantee of certain areas or zones of privacy, does exist under the Constitu- tion.’”122 Nevertheless, the court held that the right to privacy does not emanate from the “penumbra of other fundamental rights” but is “founded” in the Fourteenth Amendment’s “concept of personal lib- erty.”123 Although recognizing that the Third and Fifth Circuits had held “that there is an indepen- dent right of confidentiality applicable to personal information contained in medical, financial, and other personal records,”124 the Borucki court held that “‘[t]he personal rights found in this guarantee of personal privacy must be limited to those which are ‘fundamental’ or ‘implicit within the concept of ordered liberty….’”125 The court observed that “[m]ost of the courts finding a right of confidentiality had used a balancing test to assess violations of that right;”126 however, the court held that the plaintiff ’s complaint based on the prosecutor’s disclosure of information about the plaintiff ’s competency to stand trial in another case failed to state a claim.127 In its opinion in Borucki, the court was guided by the Supreme Court’s decision in 1976 in Paul v. Davis.128 In Paul, although the plaintiff had been arrested but not convicted of shoplifting, the state police had distributed a flyer identifying the plaintiff as an “active shoplifter.” The Borucki court stated: Under Paul, an allegation that government dissemination of information or government defamation has caused damage to reputation, even with all attendant emotional anguish and social stigma, does not in itself state a cause of action for violation of a constitutional right; infringement of more “tangible interests” … must be alleged as well.129 In a similar analysis in Kallstrom v. City of Columbus,130 the Sixth Circuit held that it is only when an individual’s privacy interest is one of “con- stitutional dimension” that the court will find it nec- essary to “balance an individual’s interest in nondis- closure of informational privacy against the public’s interest in and need for the invasion of privacy….”131 Moreover, as the same court would explain later in Lambert v. Hartman,132 the Supreme Court has iden- tified only two types of interests that come within the substantive due process protection of the Four- teenth Amendment. The first interest has to do with “independence in making certain kinds of important decisions,” such as “matters relating to procreation, marriage, contraception, family relationships, and child rearing and education.”133 The second privacy interest recognized by the Supreme Court is “in avoiding disclosure of personal matters.”134 Nevertheless, in regard to the privacy interest in avoiding disclosure of personal data, the Sixth Cir- cuit stated in Lambert that the court had “recognized an informational-privacy interest of constitutional dimension in only two instances: (1) where the release of personal information could lead to bodily harm …, and (2) where the information released was of a sexual, personal, and humiliating nature….”135 The Lambert court stated that the holdings in Whalen, and in Nixon v. Administrator of General Services,136 had been “narrowly construed” so as “‘to extend the right to informational privacy only to interests that implicate a fundamental liberty 129 Borucki, 827 F.2d at 842-843 (citations omitted). 130 136 F.3d 1055, 1061 (6th Cir. 1998) (overruled in part as stated in Frost v. Blom, 2011 U.S. Dist. LEXIS 52571 (W.D. Mo. May 17, 2011) (stating that the Eighth Circuit has rejected the Kallstrom decision because the court “erroneously applied a negligence standard instead of the subjective deliberate indifference standard”) (citation omitted)). 131 Id. at 1061 (citation omitted). 132 517 F.3d 433 (6th Cir. 2008), cert. denied, 2009 U.S. LEXIS 272 (U.S., Jan. 12, 2009). 133 Id. at 440 (citations omitted) (internal quotation marks omitted). 134 Id. (citations omitted) (internal quotation marks omitted). 135 Id. 136 433 U.S. 425, 97 S. Ct. 2777, 53 L. Ed. 2d (1977). 119 Id. at 1176 (citations omitted) (emphasis added). 120 Id. (citations omitted). 121 827 F.2d 836, 839 (1st Cir. 1987). 122 Id. at 839 (quoting Roe v. Wade, 410 U.S. 113, 152, 93 S. Ct. 705, 35 L. Ed. 2d 147 (1973)). 123 Id. (citing Roe v. Wade, 410 U.S. 113, 153, 93 S. Ct. 705, 35 L. Ed. 2d 147 (1973) and Whalen v. Roe, 429 U.S. 589, 598–599 N 23, 97 S. Ct. 869, 51 L. Ed. 2d 64 (1977)). 124 Id. at 845 (citing United States v. Westinghouse Elec- tric Corp., 638 F.2d 570 (3d Cir. 1980); Plante v. Gonzalez, 575 F.2d 1119, 1132 (5th Cir. 1978); Duplantier v. United States, 606 F.2d 654, 670 (5th Cir. 1979); Fadjo v. Coon, 633 F.2d 1172 (Fifth Cir. 1981)). 125 Borucki, 827 F. 2d at 839 (quoting Roe v. Wade, 410 U.S. 113, 152, 93 S. Ct. 705, 35 L. Ed. 2d 147 (1973)). 126 Id. at 848 (citations omitted) (emphasis added). 127 Id. at 849. 128 424 U.S. 693, 96 S. Ct. 1155, 47 L. Ed. 2d 405 (1976).

12 interest.’”137 The Lambert court’s analysis appears to impose an additional requirement before a constitu- tional privacy interest would be implicated—the state’s action in disclosing personal data must have “created a special danger” that led to the plaintiff ’s harm or humiliation.138 The Lambert court was clear that the govern- ment’s disclosure, for example, of a person’s Social Security number does not rise to the level of a “fun- damental right” or a right that is “‘deeply rooted in this Nation’s history and tradition’ or ‘implicit in the concept of ordered liberty.’”139 It appears, therefore, that there is authority hold- ing that when a privacy interest that comes within the confidentiality branch of privacy law has been violated, the government must show something more than “mere rationality” as justification for dissemi- nating personal information. On the other hand, a privacy interest violated by government intrusion does not implicate a constitutional right unless the privacy interest at stake is a fundamental right or one that is implicit in the concept of ordered liberty. In the latter situation, the privacy interest must be balanced against a compelling governmental inter- est in disclosure. Finally, at least one Supreme Court justice has suggested that state legislatures are better suited than the federal courts to decide whether privacy rights should be enlarged. In a concurring opinion in Riley v. California,140 discussed infra, Justice Alito stated that [i]n light of the growing privacy concerns of modern tech- nology, it would be very unfortunate if privacy protection in the 21st century were left primarily to the federal courts using the blunt instrument of the Fourth Amendment. Legislatures, elected by the people, are in a better position than we are to assess and respond to the changes that have already occurred.141 Justice Alito’s opinion is that the “Court is poorly positioned to understand and evaluate” sensitive privacy interests arising, for example, from the use of modern cell phones.142 In sum, it does not appear that the disclosure by a transportation agency of secure data, including an individual’s PII, or of monitoring or locational data would violate a right to privacy under the U.S. Constitution.143 C. The Fourth Amendment and a Constitutional Right to Privacy Under the Fourth Amendment, “warrantless searches are permissible only when an individual has a substantially reduced expectation of pri- vacy.”144 Although the collection or disclosure of data by transportation agencies may raise privacy issues, the courts have held that a person’s reasonable expectation of privacy is reduced with respect to automobile searches, searches incident to an arrest, and seizures of items in plain view that are believed to be contraband.145 In Katz v. United States,146 the Supreme Court held that because the Federal Bureau of Investiga- tion (FBI) failed to obtain a warrant prior to listen- ing to and recording the petitioner’s conversations, the petitioner’s conviction had to be reversed.147 Rel- evant to the issue of data collection, however, is that the Katz Court stated that “the Fourth Amendment cannot be translated into a general constitutional ‘right to privacy.’”148 Furthermore, “what a person knowingly exposes to the public … is not a subject of Fourth Amendment protection.”149 Although the Supreme Court precedents since Katz fail to show a “clear pattern” on what the “acceptable limits of government action” are under the Fourth Amendment,150 the Supreme Court “has not found information about an individual’s activities in public to be protected.”151 For example, in a 1983 decision in United States v. Knotts,152 Minnesota law enforcement officers had placed a beeper in a drum containing chloroform purchased by the respondent’s codefendants to track them from Minnesota to a cabin in Wisconsin.153 The law enforcement agents obtained a search warrant for the cabin, discovered a drug lab on the premises, and charged the respon- dent with conspiracy to manufacture controlled 137 Lambert, 517 F.3d at 440 (citation omitted). 138 Id. at 439 (citations omitted). 139 Id. at 443 (citations omitted). 140 134 S. Ct. 2473, 2497, 189 L. Ed. 2d 430, 456 (2014) (Alito, J., concurring). 141 Id. at 2497, 189 L. Ed. 2d at 456. 142 Id. at 2497, 189 L. Ed. 2d at 455. 143 See Lambert, 517 F.3d at 440; Phillips and Kohm, supra note 1, at P4. 144 Bourgeois v. Peters, 387 F.3d 1303, 1314 (11th Cir. 2004). 145 Id. at 1314–1315 (citations omitted). 146 389 U.S. 347, 88 S. Ct. 507, 19 L. Ed. 2d 576 (1967). Some courts regard the Katz decision as having been abro- gated or superseded. See, e.g., State v. Earls, 214 N.J. 564, 70 A.3d 630 (2013) (stating abrogated) and United States v. Koyomejian, 946 F.2d 1450 (9th Cir. Cal. 1991) (stating superseded). 147 Katz, 389 U.S. at 358–359, 88 S. Ct. at 514–515, 19 L. Ed. 2d at 586. 148 Id. at 350, 88 S. Ct. at 510, 19 L. Ed. 2d at 581 (foot- notes omitted). 149 Id. at 351, 88 S. Ct. at 511, 19 L. Ed. 2d at 58 (citation omitted). 150 Phillips and Kohm, supra note 1, at P35. 151 Douma and Deckenbach, supra note 2, at 305. 152 460 U.S. 276, 103 S. Ct. 1081, 75 L. Ed. 2d 55 (1983). 153 Knotts, 460 U.S. at 277, 103 S. Ct. at 1083, 75 L. Ed. 2d at 59.

13 substances.154 The respondent argued that his con- viction had to be reversed because the use of the beeper to track his movements violated his right to privacy under the Fourth Amendment.155 The Knotts Court held that there is “no reason- able expectation of privacy” for “a person traveling in an automobile on public thoroughfares.”156 Thus, law enforcement could place a beeper in a container and monitor the movements of the car in which the container was placed.157 The only issue in Knotts was whether the monitoring of the car, not the installation of the beeper in the container, was a vio- lation of the Fourth Amendment. The Court held that the government’s action in monitoring the beeper signals was neither a “search” nor a “seizure” within the meaning of the Fourth Amendment; therefore, a warrant was not required.158 The Court reversed the appellate court’s reversal of the appel- lant’s conviction.159 In 1999, in Wyoming v. Houghton,160 the Supreme Court held that a police officer’s search of a passen- ger’s purse during a traffic stop was a legitimate exception to the warrant requirement of the Fourth Amendment. The Court, in an opinion by Justice Scalia, held that although the search intruded on the passenger’s privacy, “the governmental interests at stake [were] substantial.”161 Furthermore, because a passenger’s privacy interests are “considerably diminished” when the passenger is traveling on a public thoroughfare, the weighing of the passenger’s and the government’s interests “militate in favor of the needs of law enforcement.”162 Being on a public highway does not obviate com- pletely, of course, a person’s right to a reasonable expectation of privacy protected by the Fourth Amendment. In 2009, in Arizona v. Gant,163 the Supreme Court held that a search was not lawful when the arrestee had been “handcuffed[] and locked in the back of the patrol car” on charges of driving with a suspended license.164 The Court held that the police are authorized to search a vehicle incident to an arrest only when the person under arrest was unsecured and within reaching distance of the passenger compartment at the time of the search.165 The Court stated that “[a]lthough we have recognized that a motorist’s privacy interest in his vehicle is less substantial than in his home…the for- mer interest is nevertheless important and deserv- ing of constitutional protection.”166 In 2010, Justice Kennedy stated in his opinion for the Court in City of Ontario v. Quon167 that “[t]he judiciary risks error by elaborating too fully on the Fourth Amendment implications of emerging tech- nology before its role in society has become clear.”168 Justice Kennedy stated that the Court would refrain from issuing a broad ruling that may fail to consider the evolution of technology and society’s response to developments; thus, it was “preferable to dispose of this case on narrower grounds.”169 In 2012, in United States v. Jones,170 the Court held that the government’s warrantless installation of a GPS device on a vehicle to monitor it was a search under the Fourth Amendment.171 Jones, the owner and operator of a night club in Washington, DC, became the target of an investigation by a joint FBI and Metropolitan Police task force on suspicion of trafficking in narcotics. Based on the results of prior surveillance, the government sought and obtained a warrant from a federal court in the Dis- trict of Columbia authorizing the use of an electronic tracking device to be installed on a Jeep vehicle reg- istered in the name of Jones’s wife. However, the GPS tracking device was installed in Maryland. The government conceded that it had failed to comply with the warrant, but argued that a warrant was not needed.172 Over a 4-week period, the device relayed over 2,000 pages of data. The government ultimately obtained a multiple count indictment for conspiracy and the possession of cocaine with the intent to dis- tribute it. The U.S. District Court for the District of Columbia granted in part and denied in part a motion to suppress the data obtained from the GPS. The court suppressed the admission of data obtained while the Jeep was parked in a garage adjacent to the Jones’s residence, but allowed the admission of 154 Id. at 277–279, 103 S. Ct. at 1084, 75 L. Ed. 2d at 59–60. 155 Id. at 279, 103 S. Ct. at 1084, 75 L. Ed. 2d at 60. 156 Id. at 281, 103 S. Ct. at 1085, 75 L. Ed. 2d at 62. 157 Id. at 277–280, 103 S. Ct. at 1083–1084, 75 L. Ed. 2d at 59–60. 158 Id. at 284–285, 103 S. Ct. at 1087, 75 L. Ed. 2d at 64 (quoting United States v. Knotts, 662 F.2d 515, 518 (8th Cir. 1981) (internal citation omitted)). 159 Id. at 285, 103 S. Ct. at 1087, 75 L. Ed. 2d at 64. 160 526 U.S. 295, 119 S. Ct. 1297, 143 L. Ed. 2d 408 (1999). 161 Id. at 304, 119 S. Ct. at 1302, 143 L. Ed. 2d at 417. 162 Id. at 303, 306, 119 S. Ct. at 1302–1303, 143 L. Ed. 2d at 417. 163 556 U.S. 332, 129 S. Ct. 1710, 173 L. Ed. 2d 485 (2009). 164 Id. at 335, 129 S. Ct. at 1714, 173 L. Ed. 2d at 491. 165 Id. at 343, 129 S. Ct. at 1719, 173 L. Ed. 2d at 496 (citing New York v. Belton, 453 U.S. 454, 101 S. Ct. 2860, 69 L. Ed. 2d 768 (1981)). 166 Id. at 345, 129 S. Ct. at 1720, 173 L. Ed. 2d at 497 (citation omitted). 167 560 U.S. 746, 130 S. Ct. 2619, 177 L. Ed. 2d 216 (2010). 168 Id. at 759, 130 S. Ct. at 2629, 177 L. Ed. 2d at 227. 169 Id. at 760, 130 S. Ct. at 2630, 177 L. Ed. 2d at 227. 170 132 S. Ct. 945, 181 L. Ed. 2d 911 (2012). 171 Id. at 948–949, 181 L. Ed. 2d at 917. 172 Id. at 948 and N 1, 181 L. Ed. 2d at 917 and N 1.

14 the remaining data on the basis that “‘[a] person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his move- ments from one place to another.’”173 The U.S. Circuit Court for the District of Columbia reversed the con- viction because of the admission of evidence obtained by a “warrantless use of the GPS device….”174 In an opinion by Justice Scalia, the Supreme Court unanimously affirmed the circuit court’s deci- sion. In the opinion, Justice Scalia explained that the Court was not abandoning prior precedent holding that the Fourth Amendment “‘protects people, not places,’”175 and that a violation of the Fourth Amend- ment occurs when government officers violate a per- son’s “‘reasonable expectation of privacy….’”176 After noting that the Court has deviated from its prior “property-based approach,” Justice Scalia explained that the Court’s decision in Jones was entirely con- sistent with its prior decisions because “the Katz reasonable-expectation-of-privacy test has been added to, not substituted for, the common-law tres- passory test.”177 In other cases when the government installed a beeper, it did so in property that belonged to a third party and before the property came into the possession of the defendant, with the consent of the original owner of the property; thus, there was no violation of the Fourth Amendment.178 In this case, Jones possessed the Jeep before “the Government trespassorily inserted the information- gathering device,” a detail that put the Jones case “on a much different footing.”179 Thus, the “physical intrusion” that occurred in the Jones case “would have been considered a ‘search’ within the meaning of the Fourth Amendment when it was adopted.”180 The methods of data collection discussed in the digest do not involve a warrantless physical tres- pass and search as occurred in the Jones case. A violation of the Fourth Amendment occurs when the government violates a person’s reasonable expectation of privacy without a warrant.181 Justice Scalia’s opinion in Jones stated that “[s]ituations involving merely the transmission of electronic signals without trespass would remain subject to Katz analysis.”182 The Court stated that it “has to date not deviated from the understanding that mere visual observation does not constitute a search.”183 The Court reiterated that “‘[a] person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another.’”184 The Court did not decide whether the collection of the same information electronically without trespass- ing, which is available already by visual observa- tion, would be an unconstitutional invasion of pri- vacy. The Court opined that attempting to answer the question in the Jones case would “lead[] us needlessly in additional thorny problems.”185 The Court’s opinions in Gant, Jones, and Quon illustrate the Supreme Court’s appreciation of the privacy issues presented by the use of technology to collect and retain data on individuals. In a con- curring opinion in Jones, Justice Sotomayor observed that the use of electronic surveillance may “‘alter the relationship between a citizen and government in a way that is inimical to demo- cratic society.’”186 Thereafter, in 2014 in Riley v. California,187 the Court held that absent a warrant, the police might not search digital information on a cell phone seized from an individual who has been arrested.188 The Court’s reasoning was that, because cell phones contain “vast quantities of personal infor- mation,” searches of cell phones are distinguish- able from other physical searches.189 Searches of cell phones “implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse.”190 Finally, the Court observed that the “fact that technology now allows an indi- vidual to carry such [private] information in his hand does not make the information any less wor- thy of the protection for which the Founders fought.”191 In sum, the Court has held that individuals using public highways have a diminished expectation of 173 Id. at 948, 181 L. Ed. 2d at 917 (citation omitted). 174 Id. at 949, 181 L. Ed. 2d at 917 (citation omitted). 175 Id. at 950, 181 L. Ed. 2d at 918 (citation omitted). 176 Id. at 950, 181 L. Ed. 2d at 916–919 (citations omitted). 177 Id. at 952, 181 L. Ed. 2d at 921 (emphasis added). 178 Id. (discussing and distinguishing cases). 179 Id. 180 Id. at 949, 181 L. Ed. 2d at 918. 181 Id. at 949, 181 L. Ed. 2d at 919 (citing Katz v. United States, 389 U.S. 347, 360, 88 S. Ct. 507, 196 L. Ed. 2d 576 (1967)). 182 Id. at 953, 181 L. Ed. 2d at 922. 183 Id. at 953, 181 L. Ed. 2d at 922 (citing Kyllo, 533 U.S. at 31–32, 121 S. Ct. 2038, 150 L. Ed. 2d 941). 184 Id. at 953, 181 L. Ed. 2d at 923 (citation omitted). 185 Id. at 954, 181 L. Ed. 2d at 923. 186 Id. at 956, 181 L. Ed. 2d at 925 (Sotomayor, J., con- curring) (quoting United States v. Cuevas-Perez, 640 F.3d 272, 285 (7th Cir. 2011)). 187 134 S. Ct. 2473, 189 L. Ed. 2d 430 (2014). 188 Id. at 2485, 2495, 189 L. Ed. 2d at 442, 452. 189 Id. at 2485, 189 L. Ed. 2d at 442. 190 Id. at 2488, 189 L. Ed. 2d at 446. 191 Id. at 2495, 189 L. Ed. 2d at 452.

15 privacy.192 It appears that using technology to enhance and record the visual observation of motor- ists on public highways is not a violation of a consti- tutional right to privacy. On the other hand, the gov- ernment’s attachment of a GPS device to a vehicle owned or used by one suspected of a crime without a warrant, or the government’s seizure of a cell phone in a vehicle without a warrant, are entirely different matters and distinguishable from the routine collec- tion of secure data or monitoring data by transpor- tation agencies. D. Whether There Is an Implied Constitutional Claim for a Privacy Violation In 1971, in Bivens v. Six Unknown Named Agents of the Federal Bureau of Narcotics,193 the United States Supreme Court held that an implied cause of action exists for a violation of an individual’s rights under the Fourth Amendment.194 More recently, in Ashcroft, the Court explained that “[i]n the limited settings where Bivens does apply[] the implied cause of action is the ‘federal analog to suits brought against state officials under… § 1983.’”195 In Bivens, without a warrant for a search or for an arrest, Federal Bureau of Narcotics agents entered the petitioner’s apartment, arrested him in front of his family, and searched his apartment for narcotics.196 The Supreme Court held that the Fourth Amendment operates as a limitation upon the exercise of federal power regardless of whether the State in whose jurisdiction that power is exercised would prohibit or penalize the identical act if engaged in by a private citizen. It guarantees to citizens of the United States the absolute right to be free from unreasonable searches and seizures carried out by virtue of federal authority. And “where feder- ally protected rights have been invaded, it has been the rule from the beginning that courts will be alert to adjust their remedies so as to grant the necessary relief.”197 The Bivens Court held that an implied cause of action exists under the Fourth Amendment when a petitioner “can demonstrate an injury consequent upon the violation by federal agents of his Fourth Amendment rights” and that the petitioner may “redress his injury…in the federal courts.”198 The jurisprudence since Bivens on whether par- ticular conduct supports a specific constitutional claim for which there is an implied right of action has been inconsistent with the courts recognizing some claims while dismissing others.199 A decision on whether to recognize a Bivens claim has depended in part on an evaluation of the particular constitu- tional claim and on whether there were “available alternative remedies.”200 Legislation in 1974 and 1988 has affected Bivens claims. The Federal Tort Claims Act (FTCA) pre- cludes claims for certain intentional torts against the United States under 28 U.S.C. § 1346(a)(2). In 1974, however, Congress amended the FTCA to allow claims for assault, battery, false imprison- ment, false arrest, abuse of process, or malicious prosecution caused by acts or omissions of United States investigative or law enforcement officers. The amendment together with 28 U.S.C. § 2679(b)(2)(A) “specifically preserves and ratifies the Bivens rem- edy.”201 However, the amendment to the FTCA does not appear to be relevant to the subject matter of this digest. On the other hand, the Federal Employees Liabil- ity Reform and Tort Compensation Act of 1988 192 Knotts, 460 U.S. at 281, 103 S. Ct. at 1085, 75 L. Ed. 2d at 62. See also California v. Carney, 471 U.S. 386, 390–394, 105 S. Ct. 2066, 2068–2071, 85 L. Ed. 2d 406, 412–415 (1956); United States v. Moreno, 1994 U.S. App. LEXIS 31365, at *1 (9th Cir. 1994); South Dakota v. Opperman, 428 U.S. 364, 368, 96 S. Ct. 3092, 3096, 49 L. Ed. 2d 1000, 1004–1005 (1976); Cardwell v. Lewis, 417 U.S. 583, 590– 591, 94 S. Ct. 2464, 2469–2470, 41 L. Ed. 2d 325, 334–336 (1974); Commonwealth v. Gary, 625 Pa. 183, 196, 91 A.3d 102, 110–112 (Pa. 2013). See also People v. Case, 220 Mich. 379, 388–989, 190 N.W. 289, 292 (Mich. 1922). 193 403 U.S. 388, 91 S. Ct. 1999, 29 L. Ed. 2d 619 (1971) (holding that the plaintiff was entitled to redress for his injuries caused by the federal agents’ violation of his Fourth Amendment rights), on remand, 456 F.2d 1339 (2d Cir. N.Y. 1972) (holding that the federal agents were not immune from damages suits based upon allegations of constitutional violations, but the defenses of good faith and reasonable belief were available). 194 Bivens, 403 U.S. at 389, 91 S. Ct. at 2001, 29 L. Ed. 2d at 622. 195 Ashcroft, 556 U.S. at 675, 129 S. Ct. at 1948, 173 L. Ed. 2d at 882 (citations omitted). 196 Bivens, 403 U.S. at 389, 91 S. Ct. at 2001, 29 L. Ed. 2d at 622. 197 Id. at 392, 91 S. Ct. at 2002, 29 L. Ed. 2d at 624 (cita- tion omitted). 198 Id. at 397, 91 S. Ct. at 2004, 29 L. Ed. 2d at 627. See Yorinsk v. Imbert, 39 F. Supp. 3d 218–220 (D.D.C. 2014) (holding that constitutional tort claims brought pursuant to Bivens do not authorize injunctive relief) and Dorwart v. Caraway, 2002 MT 240, P44, 312 Mont. 1, 15, 58 P.3d 128, 136 (Mont. 2002) (holding that “the Bivens line of authority buttressed by § 874A of the Restatement (Sec- ond) of Torts are sound reasons for applying a cause of action for money damages for violations of those self-exe- cuting provisions of the Montana Constitution”). See also Wood v. Moss, 134 S. Ct. 2056, 2066, 188 L. Ed. 2d 1039, 1050–1051 (2014) (holding that the “implied right of action for damages against federal officers” extends to First Amendment claims). 199 James E. Pfander and David Baltmanis, Rethinking Bivens: Legitimacy and Constitutional Adjudication, 98 geO. L. J. 117, 118 (2009) [hereinafter Pfander and Baltmanis]. 200 Id. at 121, 126. 201 Id. at 131

16 (Westfall Act) may have some relevance to the digest.202 In the Westfall Act, Congress “virtually” immunized federal government officials from liabil- ity under state common law by “substituting the government as a defendant under the FTCA for these claims,” while “preserving the right of individ- uals to pursue Bivens actions for a ‘violation of the Constitution of the United States.’”203 Under 28 U.S.C. § 2679(d)(1), if the Attorney General certifies that a defendant employee was acting within the scope of his office or employment at the time of the incident out of which the claim arose, any civil action or proceeding commenced upon such claim in a United States district court shall be deemed an action against the United States under the provisions of this title and all references thereto, and the United States shall be substituted as the party defendant. Nevertheless, a “plaintiff must still allege and prove an actionable constitutional violation and overcome any qualified immunity defense.”204 In addition, the availability of alternative federal rem- edies could preclude a Bivens claim.205 The prevailing view on the viability of Bivens claims is that, first, “the Westfall Act changed the nature of the Bivens question” by immunizing fed- eral employees from private lawsuits based on acts performed within the scope of their employment and converting them into FTCA suits against the United States.206 Second, the “the Westfall Act…explicitly preserves actions “‘brought for a violation of the Constitution of the United States.’”207 Writers have argued that in 2012 the Supreme Court in Minneci v. Pollard208 “endorsed the prevailing reading of the Westfall Act as preempting state law remedies against federal officials, even for conduct that vio- lates the Constitution.”209 Thus, “[a] federal official who commits a constitutional tort is not subject to liability under state law (because of the Westfall Act), and no statute similar to § 1983 makes federal officials liable under federal law for violating another person’s constitutional rights.”210 Thus, the Westfall Act “leaves the federal Bivens action as the sole remedy against [a federal] official,”211 but “the Court has essentially abandoned the practice of recogniz- ing implied rights of action to enforce federal statu- tory rights.”212 Another scholar writing on privacy law and post- Bivens cases argues that the Supreme Court is unlikely to create new Bivens claims for violations of privacy and highlights several obstacles to a Bivens claim against a federal official.213 First, as discussed in the article, in 2009 in Ashcroft v. Iqbal,214 Justice Kennedy stated that the Court in Bivens “recognized for the first time an implied private action for dam- ages against federal officers alleged to have violated a citizen’s constitutional rights.”215 However, Justice 202 Federal Employees Liability Reform and Tort Compensation Act of 1988 (Westfall Act), Pub. L. No. 100-694, 102 Stat. 4563. 203 Pfander and Baltmanis, supra note 199, at 131. See also heNRy cOheN aNd viviaN s. chU, cONg. ReseaRch seRv., fedeRaL TORT cLaiMs acT 16 (April 27, 2009) [hereinafter Cohen and Chu] (stating that the Westfall Act immunizes a federal employee from liability under state law but that a federal employee may be sued for violating the Constitu- tion or violating a federal statute that authorizes suit against an individual). 204 Pfander and Baltmanis, supra note 199, at 132. 205 Id. 206 Carlos M. Vazquez and Stephen I. Vladeck, State Law, the Westfall Act, and the Nature of the Bivens Ques- tion, 161 U. pa. L. Rev. 509, 517 (2013) (citing 28 U.S.C. § 2679(b)) [hereinafter Vazquez and Vladeck]. 28 U.S.C. § 2679(b) (2015) states: (1) The remedy against the United States provided by sections 1346(b) and 2672 of this title for injury or loss of property, or personal injury or death arising or resulting from the negligent or wrongful act or omis- sion of any employee of the Government while acting within the scope of his office or employment is exclusive of any other civil action or proceeding for money dam- ages by reason of the same subject matter against the employee whose act or omission gave rise to the claim or against the estate of such employee. Any other civil action or proceeding for money damages arising out of or relating to the same subject matter against the employee or the employee’s estate is precluded with- out regard to when the act or omission occurred. (2) Paragraph (1) does not extend or apply to a civil action against an employee of the Government— (A) which is brought for a violation of the Constitu- tion of the United States, or (B) which is brought for a violation of a statute of the United States under which such action against an individual is otherwise authorized. (Emphasis added). 207 Vazquez and Vladeck, supra note 206, at 517 (quot- ing 28 U.S.C. § 2679(b)(2)(A) (quoted in the preceding footnote)). 208 132 S. Ct. 617, 181 L. Ed. 2d 606 (2012). 209 Vazquez and Vladeck, supra note 206, at 517 (citing 132 S. Ct. 617, 623, 181 L. Ed. 2d 606 (2012)). 210 Cohen and Chu, supra note 203, at 18. 211 Vazquez and Vladeck, supra note 206, at 517. See also Pfander and Baltmanis, supra note 199, at 123 (stat- ing that “[t]oday, Bivens provides the only generally avail- able basis on which individuals can seek an award of dam- ages for federal violations of constitutional rights”). 212 Pfander and Baltmanis, supra note 199, at 126 (cit- ing Wilkie v. Robbins, 551 U.S. 537 (2007)). 213 A. Michael Froomkin, Symposium: Security Breach Notification Six Years Later: Government Data Breaches, 24 BeRkeLey Tech. L.J. 1019, 1055 (2009) [hereinafter Froomkin]. 214 556 U.S. 662, 129 S. Ct. 1937, 173 L. Ed. 2d 868 (2009). 215 Id. at 675, 129 S. Ct. at 1947, 173 L. Ed. 2d at 882 (citation omitted).

17 Kennedy also wrote that “[b]ecause implied causes of action are disfavored, the Court has been reluc- tant to extend Bivens liability ‘to any new context or new category of defendants.’”216 Even when Bivens claims have been allowed, a 2009 Government Accountability Office (GAO) report concluded that the likelihood of an eventual monetary recovery in a Bivens case is quite rare.217 A second obstacle to Bivens claims is that “[g]overnment officials may not be held liable for the unconstitutional conduct of their subordinates under a theory of respondeat superior.”218 Because vicarious liability does not apply in a Bivens case (or in § 1983 actions), each government official who is a defendant in a Bivens case must be shown to have violated the Constitution; otherwise, a plaintiff does not have a cognizable claim against that defendant.219 Third, a particularly difficult obstacle to a Bivens claim is the defense of qualified immunity, discussed in the next subsection.220 Finally, a threshold, and likely dispositive issue that would preclude a Bivens claim, as well as a § 1983 claim, is that there is no case holding that the collection or dissemination of one’s personal or locational data violates a right to privacy under the U.S. Constitution. E. Whether There Is a Section 1983 Claim for an Intentional or Unintentional Release of Data As discussed, a Bivens claim against federal offi- cials is the “federal analog” to 42 U.S.C. § 1983 claims against state officials.221 However, it does not appear that a complaint against transportation agency offi- cers or employees for a violation of an individual’s right to privacy based on a disclosure of secure data or monitoring data would state a claim under § 1983. Section 1983 states in part that “[e]very person who, under color of any statute, ordinance, regula- tion, custom, or usage, of any State or Territory or the District of Columbia, subjects, or causes to be subjected, any citizen of the United States or other person within the jurisdiction thereof to the depri- vation of any rights, privileges, or immunities secured by the Constitution and laws, shall be liable to the party injured….”222 As explained in Toomer v. Garrett,223 a state and state officials acting in their official capacities are not “persons” within the meaning of § 1983 actions for money damages,224 but they are considered per- sons for § 1983 purposes when they are sued for injunctive relief.225 When state officials are sued under § 1983 in their individual capacities, they may be held liable for damages.226 However, when state officials are sued in their individual capacities, the defense of qualified immunity will shield them from personal liability, unless it is shown that they have caused an injury by violating a known, clearly established constitutional or statutory right.227 Thus, the qualified immunity doctrine may shield completely an official’s conduct even though the con- duct violated the Constitution.228 As one scholar explains the defense, if a reasonable official could have believed that his or her actions were lawful, then the doctrine operates to excuse some “reason- able ignorance” of the law.229 The rationale for the doctrine is that it permits officials to be decisive and exercise their judgment for the public good but 216 Id. at 675, 129 S. Ct. at 1947, 173 L. Ed. 2d at 882 (citations omitted). 217 Cohen and Chu, supra note 203, at 21. 218 Ashcroft, 556 U.S. at 676, 129 S. Ct. at 1948, 173 L. Ed. 2d at 882 (citing Monell v. Dep’t of Soc. Servs., 436 U.S. 658, 691, 98 S. Ct. 2018, 56 L. Ed. 2d 611 (1978) (finding no vicarious liability for a municipal “person” under 42 U.S.C. § 1983)); Dunlop v. Munroe, 11 U.S. 242, 7 Cranch 242, 269, 3 L. Ed. 329 (1812) (A federal official’s liability “will only result from his own neglect in not properly superintending the discharge” of his subordi- nates’ duties.); Robertson v. Sichel, 127 U.S. 507, 515– 516, 8 S. Ct. 1286, 1290, 32 L. Ed. 203, 206 (1888) (“A public officer or agent is not responsible for the misfea- sances or positive wrongs, or for the nonfeasances, or negligences, or omissions of duty, of the sub-agents or servants or other persons properly employed by or under him, in the discharge of his official duties.”). 219 Ashcroft, 556 U.S. at 676, 129 S. Ct. at 1948, 173 L. Ed. 2d at 882. The Court further stated that: Absent vicarious liability, each Government offi- cial, his or her title notwithstanding, is only liable for his or her own misconduct. In the context of determin- ing whether there is a violation of a clearly estab- lished right to overcome qualified immunity, purpose rather than knowledge is required to impose Bivens liability on the subordinate for unconstitutional dis- crimination; the same holds true for an official charged with violations arising from his or her superintendent responsibilities. Id. at 677, 129 S. Ct. at 1949, 173 L. Ed. 2d at 883 (emphasis added). 220 Cohen and Chu, supra note 203, at 21. 221 Ashcraft, 556 U.S. at 675, 129 S. Ct. at 1948, 173 L. Ed. 2d at 882. 222 42 U.S.C. § 1983 (2015). 223 155 N.C. App. 462, 574 S.E.2d 76 (2002). 224 Id. at 472, 574 S.E.2d at 86 (citation omitted). 225 Id. 226 Id. at 473, 574 S.E.2d at 86. 227 Id., citing Andrews v. Crump, 144 N.C. App. 68, 75–76, 547 S.E.2d 117, 122, disc. review denied, 354 N.C. 215, 553 S.E.2d 907 (2001) (quoting Harlow v. Fitzgerald, 457 U.S. 800, 818, 102 S. Ct. 272, 773 L. Ed. 2d 396, 410 (1982)). 228 Barbara E. Armacost, Qualified Immunity: Igno- rance Excused, 51 vaNd. L. Rev. 581, 584 (1998) [herein- after Armacost]. 229 Id.

18 provides them with a “margin of error” when they “make reasonable mistakes about the exact bound- aries of constitutional law….”230 Or, stated differ- ently, “qualified immunity protects from liability all but the ‘plainly incompetent’ or the official who could not reasonably have believed that [his or her] actions were lawful.”231 In Harlow v. Fitzgerald,232 a § 1983 action, the Supreme Court held that government officials who are acting within their discretionary authority but who are sued in their individual capacities have qualified immunity as long as “their conduct does not violate clearly established statutory or constitu- tional rights of which a reasonable person would have known.”233 For government officials to have acted within the scope of their discretionary author- ity means that their “actions were (1) undertaken pursuant to the performance of [their official] duties and (2) within the scope of [their] authority.”234 In Borucki v. Ryan,235 the First Circuit relied on Harlow in holding that the defendant was entitled to qualified immunity, because the “alleged right of pri- vacy was not clearly established as of the date” of the alleged violation of a right to privacy.236 The Borucki court appears to attach an additional requirement, one that goes beyond determining whether a consti- tutional or statutory right has been clearly estab- lished: “when the law requires a balancing of compet- ing interests, it may be unfair to charge an official with knowledge of the law in the absence of a previ- ously decided case with clearly analogous facts.”237 In Toomer, a former state government employee alleged that the Secretary of the North Carolina DOT disclosed the plaintiff ’s personnel file to the news media. The plaintiff alleged that the file con- tained his Social Security number and other PII, as well as the history and details of a settlement of a personnel claim between the plaintiff and the DOT.238 In response to the plaintiff ’s substantive due process claim, the court held that “one’s privacy interest in the information contained in personnel files does not fall under the recognized fundamental right to privacy” that exists for personal and family decisionmaking.239 However, the plaintiff’s allegations were sufficient to state a claim for a violation of the Fourth Amend- ment’s protection “against arbitrary government action that is so egregious that it ‘shocks the con- science’ or offends a ‘sense of justice.’”240 In Toomer, the defendants allegedly “acted with a high level of culpa- bility, including deliberate indifference, malice, willful- ness, and retaliation. While intentional conduct is that ‘most likely’ to meet the test, that alone will not suf- fice; the conduct must be ‘intended to injure in some way unjustifiable by any government interest.’”241 Thus, “[a]rbitrary acts that have an abusive purpose and lack legitimate justification violate due process.”242 The court held that the North Carolina DOT’s Secre- tary’s action in disclosing Toomer’s personnel file was “outside the scope of authority, [done] maliciously, in bad faith, and for retaliatory reasons.”243 Another privacy case against state officials is Collier v. Dickinson,244 in which the plaintiffs sued execu- tive-level officials with the Florida Department of Highway Safety and Motor Vehicles for selling the plaintiffs’ personal information to mass marketers in violation of the DPPA.245 In addition to a claim under the DPAA, the plaintiffs filed a § 1983 claim. Stating that the court’s decision was consistent with prior precedent in the Eleventh Circuit, the Collier court held there was no constitutional right to pri- vacy that had been violated.246 There was, however, a statutory violation of privacy, because the “DPPA clearly, unambiguously, and expressly creates a stat- utory right which may be enforced” by the plain- tiffs.247 Although the defendants argued that the DPAA’s “comprehensive enforcement scheme” was incompatible with enforcement under § 1983,248 the 230 Id. at 586. 231 Id. at 600 (citing Malley v. Briggs, 475 U.S. 335, 341 (1986) and quoting Anderson v. Creighton, 483 U.S. 635, 638 (1987) (stating that qualified immunity obtains "as long as [the officials’] actions could reasonably have been thought consistent with the rights they were alleged to have vio- lated")). 232 457 U.S. 800, 814, 102 S. Ct. 2727, 73 L. Ed. 2d 396 (1982). 233 Id. at 818, 102 S. Ct. 2727, 73 L. Ed. 2d 396 (citation omitted). 234 Lenz v. Winburn, 51 F.3d 1540, 1545 (11th Cir. 1995) (citations omitted) (internal quotation marks omitted). 235 827 F.2d 836, 837 (1st Cir. 1987) (citations omitted). 236 Id. 237 Id. at 848 (footnote omitted) (citations omitted) (emphasis added). 238 Toomer, 155 N.C. App. at 467, 574 S.E.2d at 83. 239 Id. at 469, 574 S.E.2d at 84 (citing Kallstrom, supra). 240 Id. at 470, 574 S.E.2d at 84 (citing United States v. Salerno, 481 U.S. 739, 746, 107 S. Ct. 2095, 95 L. Ed. 2d 697, 708 (1987), County of Sacramento v. Lewis, 523 U.S. 833, 118 S. Ct. 1708, 140 L. Ed. 2d 1043 (1998), State v. Guice, 141 N.C. App. 177, 541 S.E.2d 474 (2000)). 241 Id. (citation omitted) (some internal quotation marks omitted). 242 Id. at 474, 574 S.E.2d at 84. Under the circumstances of the Toomer case, the intentional disclosure also stated a § 1983 claim for a violation of the Equal Protection Clause of the United States Constitution. Id. at 477, 574 S.E.2d at 89. 243 Id. at 481, 574 S.E.2d at 91. 244 477 F.3d 1306 (11th Cir. 2007). 245 Id. at 1307. 246 Id. at 1308. 247 Id. at 1308–1309. 248 Id. at 1311.

19 court disagreed, holding that the DPAA and § 1983 enforcement mechanisms are “complementary.”249 Because the statutory language gave the defendants “clear notice…that releasing the information…vio- lated federal law,” the defendants were not entitled to qualified immunity.250 In Kiminski v. Hunt,251 in which a federal court in Minnesota dismissed claims brought under the DPPA, the court likewise dismissed the plaintiffs’ § 1983 claim. The complaint alleged that defendant John Hunt (Hunt), a former employee of the Min- nesota Department of Natural Resources (DNR), accessed the motor vehicle record data of the plain- tiffs, as well as the data of 5,000 other individuals.252 The complaint sought to hold various state defen- dants, namely employees of the Minnesota Depart- ment of Public Safety and DNR and the agencies’ commissioners in their official capacities, liable under the DPPA and § 1983.253 The court granted the state defendants’ motion (which did not include Hunt) to dismiss the § 1983 action for failure to state a claim.254 The court held that in a § 1983 action, the “plaintiff must allege deprivation of a right secured by the Constitution and laws of the United States and must show that the deprivation was committed by a person acting under color of state law.”255 As held by the court in Borucki, it is not enough that a general right exists, “otherwise ‘plaintiffs would be able to convert the rule of qualified immunity…into a rule of virtually unqualified liability simply by alleging violation of extremely abstract rights.’”256 In Kiminski, the court dismissed the plaintiffs’ § 1983 claim because there was “no constitutional right to privacy in the information protected by the DPPA.”257 The court observed that the Eighth Cir- cuit has held that even for medical information, there is “no blanket constitutional privacy protec- tion….”258 Unlike the Eleventh Circuit’s decision in Collier, the court in Kiminski also held that a § 1983 claim for a violation of the DPPA was precluded “because the DPPA explicitly provides for a comparatively restrictive private cause of action” that is “inconsistent” with a § 1983 claim.259 In Kraege v. Busalacchi,260 the plaintiff likewise alleged that state employees had released their per- sonal information in violation of the DPPA.261 Wisconsin’s policy was to permit Wisconsin driver information to be released to purchasers who agree to use it for permissible purposes, a policy that the defendant employees followed.262 The court held that the defendants did not misread or misjudge the state policies but simply had followed the policy; the crux of the plaintiff ’s complaint had to do with the policy, not with the defendants’ choices.263 Therefore, the claims were “substantially against the State of Wisconsin” and thus were barred by the doctrine of sovereign immunity.264 Finally, a disclosure, of course, could be made by contractors charged with the responsibility to collect and safeguard data. Section 1983 requires that a violator act under color of law, but “‘does not require that the accused be an officer of the State. It is enough that he is a willful participant in joint activ- ity with the State or its agents….’”265 Although it appears that a contractor could be subject to § 1983, it would have to be shown that a transportation agency’s agent violated a known, established consti- tutional right to privacy. In sum, unless the Supreme Court recognizes a constitutional right to privacy in secure or monitoring data, it appears that a complaint against transporta- tion agency officers or agents for a disclosure of such data would fail to state a claim under § 1983. It has been held that there is no constitutional right to pri- vacy even in the PII of the type protected by the DPPA or in an employee’s personnel file.266 A violation of a statute (e.g., the DPPA) may be the basis of a § 1983 claim in courts permitting a claim both under the statute and under § 1983. (More recent authority holds that there is a claim only under the DPAA.) Unlike the DPAA, discussed in Section IV.C, there is presently no federal statute that protects personal and locational data of the type found in secure data or monitoring data collected by transportation agencies. Moreover, in the absence of a clearly established constitutional or statutory right to privacy of which a 249 Id. 250 Id. at 1312. 251 2013 U.S. Dist. LEXIS 157829, at *1 (D. Minn. 2013). 252 Id. at *2. 253 Id. at *1. 254 Id. at *2, 43. 255 Id. at *25 (citing West v. Atkins, 487 U.S. 42, 48, 108 S. Ct. 2250, 101 L. Ed. 2d 40 (1988)). 256 Borucki, 827 F.2d at 838 (citations omitted). 257 Kiminski, 2013 U.S. Dist. LEXIS 157829, at *40 (citation omitted). 258 Id. at *42 (citing Cooksey v. Boyer, 289 F.3d 513, 517 (8th Cir. 2002)). 259 Id. at *31, 35. 260 687 F. Supp. 2d 834 (W.D. Wis. 2009). 261 18 U.S.C. §§ 27211–27225. 262 Kraege, 687 F. Supp. 2d at 839. 263 Id. at 836. 264 Id. at 835. 265 Fadjo, 633 F.2d 1172, 1175 (5th Cir. 1981) (citations omitted). 266 Kiminski, 2013 U.S. Dist. LEXIS 157829, at *40 (citation omitted).