Judge rules state not liable for snooping into records at DNR

A federal judge has dismissed a series of class action claims against the state relating to a former Department of Natural Resources employee who allegedly snooped into thousands of driver's license records.

Five lawsuits seeking class action status were filed following revelations last winter that John Hunt, a former administrative manager at the DNR, allegedly accessed driver's license records 19,000 times — often while he was off duty. The suits were brought on behalf of the 5,000 people who received data breach letters.

U.S. District Judge Joan Ericksen on Friday afternoon granted a motion by Attorney General Lori Swanson's office to dismiss the cases, sparing state agencies from what Swanson's office said this spring would be potentially "catastrophic" exposure to millions of dollars in damages. The suits, which were consolidated, targeted both the DNR and the state Department of Public Safety, which oversees the Driver and Vehicle Services (DVS) database.

The would-be class action cases regarding the Hunt incident are separate from the more than 20 lawsuits that have been filed against local governments across Minnesota over similar driver's license data snooping — most of which also list the state as a defendant. Those cases were not affected by Friday's ruling, but Ericksen's order may offer a glimpse into whether taxpayers will be held liable in those matters.

"We are extremely pleased with this ruling," said Sara Grewing, city attorney for St. Paul, a defendant in several DVS lawsuits claiming a total of $5.5 million in damages. St. Paul was not a defendant in the Hunt case. "The attorney general's office did just an excellent job arguing this case."

A legislative audit in February concluded that the DVS database, which contains photographs, addresses and driving records on Minnesotans with a license, was being routinely misused by public employees. It is protected by federal law against improper use.

In a filing this spring, the attorney general's office said that the Hunt suits could prove catastrophic if damages of $2,500 per violation were imposed — as outlined in federal statutes.

Ericksen said Friday the state could not be held liable for Hunt's actions. "The complaint alleges no facts that make it plausible that the defendants 'knowingly' gave defendant Hunt database access 'for a purpose not permitted' by the DPPA [Drivers Privacy Protection Act]."

Noting that Ericksen did not find the state liable for its monitoring and control of the DVS database, Grewing said "we think the same logic applies to municipal government."

Whether local governments will be able to similarly leave other lawsuits depends partly on whether they are defending their employees in court. While Hunt was terminated, most other employees accused of misuse continue to work at their respective governments.

Ericksen's 27-page order also cites other federal court decisions, finding that there is not a constitutional right to privacy for motor vehicle record information. Plaintiffs said that included addresses, photographs, age, weight, height, eye color and sometimes medical and disability information.

"None of that data qualifies as so extremely personal as to trigger constitutional — as opposed to statutory — privacy protection," Ericksen wrote.

The judge said she was not addressing whether Hunt's actions themselves were a violation. "This order expresses no opinion on that issue, but assumes for purposes of the motion [to dismiss], that defendant Hunt's conduct with regard to plaintiffs' personal information violated the DPPA," Ericksen wrote.

Hunt was accused of making 11,747 queries of the data while off duty, almost exclusively on women. Criminal charges said he kept an encrypted file on his computer containing 172 DVS photographs. Many of the lookups were of high-profile women, including judges, police officers and news reporters.

Staff writer Bill McAuliffe contributed to this report.