There are not many federal statutes that hand a plaintiff a fixed dollar figure for a wrong she cannot describe in medical terms. The Driver’s Privacy Protection Act is one. If a police officer pulls up your driver’s license record because he recognized your name, and no permissible purpose covers it, 18 U.S.C. § 2724(b)(1) authorizes “actual damages, but not less than liquidated damages in the amount of $2,500.” No physician, no wage loss, no therapy records. One improper lookup, $2,500.
That is the reason these cases exist. It is also the reason almost every one of them is smaller than the audit report that started it — because the four-year clock runs from the lookup, and the only way you learn about the lookup is to ask the State for a report that nobody tells you exists.
In Krekelberg v. City of Minneapolis, a Minneapolis police officer’s own audit showed roughly a thousand accesses by more than forty agencies over nine years. By trial, the live claims against the City were 74 accesses by 58 officers. Everything else had been dismissed, settled, or timed out. Slip op. at 2–3, No. 20-1362 (8th Cir. Mar. 19, 2021).
What is protected, and what is not
Three definitions in § 2725 do the sorting.
A “motor vehicle record” is “any record that pertains to a motor vehicle operator’s permit, motor vehicle title, motor vehicle registration, or identification card issued by a department of motor vehicles.” § 2725(1).
“Personal information” is:
information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status.
§ 2725(3). That carve-out matters. A query that returns nothing but crash history, citations, and license status is outside the Act.
“Highly restricted personal information” is a smaller set — “an individual’s photograph or image, social security number, medical or disability information.” § 2725(4). It gets its own rule in § 2721(a)(2): a DMV may not release it without express consent “except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9).” Four of the fourteen exceptions, not all of them.
And “person” is defined to exclude the sovereign: “an individual, organization or entity, but does not include a State or agency thereof.” § 2725(2). Minnesota’s Department of Public Safety is not a “person” who can be sued under § 2724. The commissioner in an individual capacity can be, and cities and counties can be — which is where the money is.
The fourteen permissible uses, in full
Half of this litigation is an argument about whether one of these applies, so here they are, complete. Section 2721(b) opens with a mandatory disclosure clause for a defined set of federal statutory purposes, and then provides that personal information, “subject to subsection (a)(2), may be disclosed as follows”:
- Government function. “For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions.”
- Vehicle and driver safety. “For use in connection with matters of motor vehicle or driver safety and theft; motor vehicle emissions; motor vehicle product alterations, recalls, or advisories; performance monitoring of motor vehicles, motor vehicle parts and dealers; motor vehicle market research activities, including survey research; and removal of non-owner records from the original owner records of motor vehicle manufacturers.”
- Verifying information the individual gave a business. “For use in the normal course of business by a legitimate business or its agents, employees, or contractors, but only— (A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and (B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.”
- Litigation. “For use in connection with any civil, criminal, administrative, or arbitral proceeding in any Federal, State, or local court or agency or before any self-regulatory body, including the service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or pursuant to an order of a Federal, State, or local court.”
- Research and statistics. “For use in research activities, and for use in producing statistical reports, so long as the personal information is not published, redisclosed, or used to contact individuals.”
- Insurance. “For use by any insurer or insurance support organization, or by a self-insured entity, or its agents, employees, or contractors, in connection with claims investigation activities, antifraud activities, rating or underwriting.”
- Towing. “For use in providing notice to the owners of towed or impounded vehicles.”
- Licensed investigators and security services. “For use by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.”
- Commercial driver’s licenses. “For use by an employer or its agent or insurer to obtain or verify information relating to a holder of a commercial driver’s license that is required under chapter 313 of title 49.”
- Private toll facilities. “For use in connection with the operation of private toll transportation facilities.”
- Individual records with express consent. “For any other use in response to requests for individual motor vehicle records if the State has obtained the express consent of the person to whom such personal information pertains.”
- Bulk marketing with express consent. “For bulk distribution for surveys, marketing or solicitations if the State has obtained the express consent of the person to whom such personal information pertains.”
- Written consent obtained by the requester. “For use by any requester, if the requester demonstrates it has obtained the written consent of the individual to whom the information pertains.”
- State-authorized uses tied to vehicles or public safety. “For any other use specifically authorized under the law of the State that holds the record, if such use is related to the operation of a motor vehicle or public safety.”
“Express consent” is defined in § 2725(5) as “consent in writing, including consent conveyed electronically that bears an electronic signature as defined in section 106(5) of Public Law 106-229.”
Two adjacent provisions get missed. Section 2721(c) limits resale and redisclosure to uses permitted under subsection (b), and imposes a recordkeeping duty on any authorized recipient that resells or rediscloses: it “must keep for a period of 5 years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request.”
Section 2722 adds two freestanding prohibitions. Under (a), “It shall be unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under section 2721(b) of this title.” Under (b), “It shall be unlawful for any person to make false representation to obtain any personal information from an individual’s motor vehicle record.” And § 2723 supplies the public enforcement side — a criminal fine for a knowing violation, and a civil penalty against a state DMV “of not more than $5,000 a day for each day of substantial noncompliance.”
Exception (b)(4) is narrower than lawyers want it to be
In Maracich v. Spears, 570 U.S. 48 (2013), lawyers pulled thousands of names and addresses from the South Carolina DMV to recruit plaintiffs for a suit they had already filed, and defended on the litigation exception. The Court held at 52:
In light of the text, structure, and purpose of the DPPA, the Court now holds that an attorney’s solicitation of clients is not a permissible purpose covered by the (b)(4) litigation exception.
The reasoning travels well beyond lawyers. Read broadly enough to reach any conceivable link between the data and a potential dispute, the Court explained at 60–61, subsection (b)(4) “would undermine in a substantial way the DPPA’s purpose of protecting an individual’s right to privacy in his or her motor vehicle records.” Then the sentence to keep:
The “in connection with” language in (b)(4) must have a limit.
Who is a defendant, and what does the plaintiff have to prove?
Section 2724(a) is one sentence:
A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.
The Eighth Circuit breaks it into four elements: the defendant “1) knowingly 2) obtained, disclosed, or used personal information, 3) from a motor vehicle record, 4) for a purpose not permitted.” Loeffler v. City of Anoka, 893 F.3d 1082, 1085 (8th Cir. 2018).
Looking is obtaining. Defendants have argued for years that an officer who pulls up a screen and reads it has not “obtained” anything. The Eighth Circuit rejected that in McDonough v. Anoka County, 799 F.3d 931, 944 (8th Cir. 2015):
Because the personal information at issue is intangible in nature, it is gained or acquired when it is accessed or observed. Congress could not have intended to require physical procurement of intangible information. In the context of the DPPA, the word “obtain” unambiguously includes access and observation of the data.
And nothing has to be done with it. McDonough again, at 945: “under § 2724, obtaining Drivers’ information without a permissible purpose, regardless of whether that information is subsequently used, violates the DPPA.” Reading § 2724 to require use would make the word “obtains” surplusage.
The employer pays. The DPPA says nothing about vicarious liability, so the Eighth Circuit imported the background rules Congress legislated against in 1994. In Orduno v. Pietrzak, 932 F.3d 710, 718 (8th Cir. 2019), a police chief accessed a city administrator’s data for personal reasons — conduct the Eighth Circuit accepted was outside the scope of his employment — and the City was still liable, because under Restatement (Second) of Agency § 219(2)(d) a principal answers for an agent “aided in accomplishing the tort by the existence of the agency relation.” The chief “used a government-issued computer and official credentials to obtain Orduno’s private information, and he could not have done so but for his official position.”
Even when the officer walks on limitations, the city does not. This is the holding that surprises defense counsel. In Krekelberg, 72 individual-officer claims were dismissed as untimely, and the City argued the corresponding vicarious-liability claims had to go with them under Restatement (Second) of Agency § 217B(2). The Eighth Circuit disagreed: a limitations dismissal is not a “judgment on the merits” of the agent’s conduct, and “that section does not prohibit the City from being held vicariously liable for them.” Slip op. at 7.
But punitive damages against the city are a different question. Orduno affirmed the refusal to allow punitive damages against the City, because § 2724(b)(2) conditions them on “proof of willful or reckless disregard of the law” and there was no evidence city officials knowingly caused the chief’s conduct. 932 F.3d at 717. In Krekelberg, telling the jury the City would cover “any damages” assessed against two officers was itself reversible error, and the $150,000-per-officer punitive award for a single access each was the proof of prejudice. Slip op. at 14.
The remedies, in full, from § 2724(b) — “The court may award—”
(1) actual damages, but not less than liquidated damages in the amount of $2,500;
(2) punitive damages upon proof of willful or reckless disregard of the law;
(3) reasonable attorneys’ fees and other litigation costs reasonably incurred; and
(4) such other preliminary and equitable relief as the court determines to be appropriate.
Note what is not in that list. The Eighth Circuit pointed out in Krekelberg that “18 U.S.C. § 2724(b) does not expressly provide for emotional distress damages,” and assumed without deciding that they are available because no party had challenged the point. Slip op. at 9 n.5. Anyone building a damages case on emotional distress is building on an open question.
The four-year clock, and why it eats most of the file
The DPPA has no limitations period. The catch-all in 28 U.S.C. § 1658(a) supplies one: “a civil action arising under an Act of Congress enacted after the date of the enactment of this section may not be commenced later than 4 years after the cause of action accrues.”
The fight is over “accrues.” Plaintiffs argued the discovery rule — the claim accrues when the driver gets the audit and learns of the lookups. The Eighth Circuit said no. McDonough, 799 F.3d at 943: “In light of the foregoing policy considerations, as well as the text and structure of § 1658, we conclude that the statute of limitations for these DPPA violations began to run when the violations occurred. We thus affirm the dismissal of claims of violations that occurred more than four years prior to the filing of the complaints.”
The court’s reasoning was that DPPA violations “are not by their nature self-concealing,” and that if the Fair Credit Reporting Act — a statute built to protect sensitive personal data against identity theft — “does not govern an area of the law that cries out for application of a discovery rule,” then neither does the DPPA. Id. Orduno records that the point is now foreclosed in this circuit. 932 F.3d at 720 n.2.
I do not think that rule is defensible as policy, and I say so plainly: the State does not notify you, the database does not notify you, and a driver has no way to know a lookup happened until she affirmatively requests an audit. But it is the law here, and it dictates the sequence of every case.
Two practical consequences follow.
Time-barred accesses still matter — for one purpose and no other. McDonough held that pre-limitations accesses “may be considered in assessing the plausibility of timely claims.” 799 F.3d at 946. But they cannot ground damages. Krekelberg reversed a $285,000 verdict in part because 850 stale or settled accesses were admitted at trial. The court held it “an abuse of discretion to admit this evidence because the risk of unfair prejudice substantially outweighed its probative value, which was minimal,” and that “[n]one of these 850 accesses should have been considered in the jury’s damages calculation, which should have been based solely on the 74 non-time-barred, unsettled access claims.” Slip op. at 9. A limiting instruction did not save it: “a limiting instruction is not a cure for any and all Rule 403 errors.” Slip op. at 10. Plead them as background; keep them out of the damages case.
Name the individual defendants before the clock kills them. In Krekelberg, the plaintiff had to subpoena the officers’ names, and the amended complaint adding them came nearly eighteen months into the case. It did not relate back, and many of those officers were dismissed as time-barred. Slip op. at 3. The audit report gives you dates and agencies; it does not always give you names. Move for expedited discovery on identity the week you file.
The Minnesota layer
Minnesota did not write its own classification rule for driver’s license data. It adopted the federal one — and froze it.
Before this year, Minn. Stat. § 171.12, subd. 7(a), read, in relevant part: “Data on individuals provided to obtain a driver’s license or Minnesota identification card shall be treated as provided by United States Code, title 18, section 2721, as in effect on May 23, 2005, and shall be disclosed as required or permitted by that section. The commissioner shall disclose the data in bulk form upon request to an authorized recipient under United States Code, title 18, section 2721.”
Two things about that sentence. First, the cross-reference is static: whatever § 2721 said on May 23, 2005, is what Minnesota law says today, regardless of later congressional amendment. Second — and this is what the 2026 Legislature changed — the old text made disclosure mandatory for every § 2721 use, permissible ones included, and made bulk disclosure mandatory too.
Laws 2026, ch. 97, art. 2, § 2, struck that. As amended, paragraph (a) provides that the data “must be treated as provided by United States Code, title 18, section 2721, as in effect on May 23, 2005, must be disclosed as required by that section, and may be disclosed as permitted by that section,” and that “[t]he commissioner may disclose the data in bulk form upon request to an authorized recipient under United States Code, title 18, section 2721.” Required disclosures remain required; permissible ones are now discretionary, and bulk release is now the commissioner’s call. Article 2 of that act carries no effective-date clause of its own, and the governor signed the chapter on 18 May 2026, so the default in Minn. Stat. § 645.02 supplies the date: August 1, 2026 for an act without appropriation items, July 1 for one that has them. Chapter 97 is a policy act whose only appropriation language sits in a grant-extension article that carries its own effective date. Read it either way — the amendment was law before this piece ran. As of this writing, the Revisor’s on-screen text of subdivision 7 still displays the pre-amendment version under a pending-amendment banner — read the session law, not the screen.
The same act, at art. 2, § 4, added a new subdivision 7d classifying data the commissioner maintains under § 171.07, subdivisions 5 to 7, 11 to 13, 15, and 17 to 20 as “private data on individuals, as defined in section 13.02, subdivision 12” — the chapter 13 classification that means not public, but accessible to the subject.
The audit trail is a public record, and it is the whole case
Subdivision 1a of § 171.12 is the provision every plaintiff’s lawyer in this area should have memorized:
All queries and responses, and all actions in which data are entered, updated, accessed, shared, or disseminated, must be recorded in a data audit trail. Data contained in the audit trail are public to the extent the data are not otherwise classified by law.
That is the evidence. Every access, logged, and public by default. Subdivision 1a also requires the commissioner to impose discipline on an individual who “willfully entered, updated, accessed, shared, or disseminated data in violation of state or federal law,” to forward willful unauthorized access “to the appropriate prosecuting authority for prosecution,” and to arrange “an independent biennial audit of the driver and vehicle services information system” whose results “are public,” with a summary report to the legislature within 30 days.
The audit’s timestamps are not decoration. In Mallak v. Aitkin County, 9 F. Supp. 3d 1046 (D. Minn. 2014), a public defender’s audit showed roughly 190 accesses between 2003 and 2012. What carried the complaint past Rule 12 was the detail: searches run by name rather than plate or license number, by a person with strong community ties and no criminal history — and searches, as the court noted at 1058, “conducted at about three and four o’clock in the morning.”
That case went on to produce Mallak v. City of Baxter, 823 F.3d 441 (8th Cir. 2016), where four officers who could not give a definitive permissible explanation for their lookups were denied qualified immunity, and the Eighth Circuit dismissed their interlocutory appeal for lack of jurisdiction at 444, because “the appellants’ entitlement to sovereign immunity hinges on factual questions regarding the circumstances under which they accessed Mallak’s personal information.” Id. at 448. An officer who cannot remember why he ran your name does not get out on immunity.
The state-law claim that runs two years longer
Chapter 13 supplies a parallel remedy against the government entity. Minn. Stat. § 13.08, subd. 1:
Notwithstanding section 466.03, a responsible authority or government entity which violates any provision of this chapter is liable to a person or representative of a decedent who suffers any damage as a result of the violation, and the person damaged … may bring an action against the responsible authority or government entity to cover any damages sustained, plus costs and reasonable attorney fees. In the case of a willful violation, the government entity shall, in addition, be liable to exemplary damages of not less than $1,000, nor more than $15,000 for each violation. The state is deemed to have waived any immunity to a cause of action brought under this chapter.
Three differences from the federal claim are worth the ink. The chapter 13 action requires actual damage, where § 2724 does not. Its exemplary damages for a willful violation run $1,000 to $15,000 per violation — a wider band than the federal $2,500 floor. And it reaches the government entity, with the state’s immunity expressly waived, where § 2725(2) puts the State outside the DPPA entirely.
Chapter 13 contains no limitations period of its own. I read Minn. Stat. § 541.05, subd. 1(2) — six years for an action “upon a liability created by statute, other than those arising upon a penalty or forfeiture or where a shorter period is provided by section 541.07” — to supply it, which makes the state claim two years longer than the federal one. That gap is worth pleading around, and it is worth raising early rather than after the federal claims have been trimmed. Section 13.09 adds that a willful violation of chapter 13 “is guilty of a misdemeanor” and “constitutes just cause for suspension without pay or dismissal of the public employee.”
For the mechanics of demanding your own data from a Minnesota agency, see how a data practices request actually works; for how chapter 13 sits alongside Minnesota’s two other privacy statutes, see the three privacy regimes. Driver data is not the only law-enforcement record with its own classification scheme layered on top of chapter 13 — body-worn camera data under § 13.825 runs on a separate set of exceptions and a separate retention floor, and the two requests are often worth making together.
What I do with one of these files
- Request the DVS audit in writing, and request the full range — not the last four years. You need the stale accesses to plead plausibility even though you cannot collect on them.
- Read the timestamps and the query type first. A 3 a.m. lookup run by name is worth more than fifty daytime lookups run by plate number.
- File before the four-year edge on the oldest live access, and treat the filing date as the only date that matters. Every week of delay is $2,500 leaving the file.
- Get names immediately. Subpoena the agencies for the identity of each accessor and amend at once. Krekelberg is the cautionary tale on relation back.
- Sue the employing city or county along with the individual. Orduno and Krekelberg make the entity liable for the agent’s personal snooping on official credentials, and the entity survives the agent’s limitations defense.
- Plead the chapter 13 claim against the entity too, for the longer period and the $1,000–$15,000 exemplary band.
- Keep the stale accesses out of the damages case. Krekelberg vacated a $285,000 verdict over exactly that error, and a limiting instruction did not save it.
- Do not build the case on emotional distress alone. The liquidated figure is what the statute guarantees; emotional distress under the DPPA remains, in the Eighth Circuit’s own words, assumed rather than decided.
If the accessor is a private party rather than a government employee, the analysis shifts to § 2722 and the (b)(3), (b)(6), and (b)(8) exceptions, and the tort claims run alongside — see Minnesota’s invasion of privacy tort. Where the accessor is a public employee, the personnel side of the file is governed by § 13.43, which makes the existence and outcome of the resulting discipline public.
Madgett Law, LLC
We bring and defend Driver’s Privacy Protection Act claims in the District of Minnesota, and the companion Minnesota Government Data Practices Act claims that go with them — pulling and reading the DVS audit trail, identifying the individual accessors, testing each claimed permissible purpose under § 2721(b), and litigating the limitations and vicarious-liability questions that decide how much of the audit report is actually a case. If you have received a driver’s license data audit and cannot explain who was looking at you, call 612-470-6529 or send us a message.
Sources: 18 U.S.C. § 2721 — subsec. (a)(1)–(2) (DMV prohibition; highly restricted personal information released only with express consent except uses permitted in (b)(1), (b)(4), (b)(6), and (b)(9)), subsec. (b) introductory clause and paragraphs (1)–(14) (the fourteen permissible uses, quoted in full), subsec. (c) (resale and redisclosure limited to permitted uses; five-year recordkeeping of each recipient and permitted purpose), subsec. (d) (waiver procedures), subsec. (e) (no conditioning issuance of a record to obtain express consent). 18 U.S.C. § 2722 — subsec. (a) (unlawful to knowingly obtain or disclose personal information for a use not permitted under § 2721(b)), subsec. (b) (unlawful to make false representation to obtain personal information). 18 U.S.C. § 2723 — subsec. (a) (criminal fine for a knowing violation), subsec. (b) (civil penalty against a state DMV of not more than $5,000 a day for each day of substantial noncompliance). 18 U.S.C. § 2724 — subsec. (a) (cause of action; “knowingly obtains, discloses or uses”; liability to the individual to whom the information pertains; suit in a United States district court), subsec. (b)(1)–(4) (remedies: actual damages but not less than $2,500 liquidated; punitive damages on proof of willful or reckless disregard; reasonable attorneys’ fees and litigation costs; other preliminary and equitable relief). 18 U.S.C. § 2725 — para. (1) (definition of “motor vehicle record”), para. (2) (definition of “person,” excluding a State or agency thereof), para. (3) (definition of “personal information,” excluding vehicular accidents, driving violations, and driver’s status), para. (4) (definition of “highly restricted personal information”), para. (5) (definition of “express consent”). 28 U.S.C. § 1658(a) (four-year catch-all limitations period for civil actions arising under post-1990 Acts of Congress). Federal statutory text retrieved from uscode.house.gov, prelim edition, text in effect August 29, 2026.
*Maracich v. Spears, 570 U.S. 48 (2013), read from the Caselaw Access Project (https://static.case.law/us/570/cases/0048-01.json; star pagination via https://static.case.law/us/570/html/0048-01.html): at 52 (holding that an attorney’s solicitation of clients is not a permissible purpose under the (b)(4) litigation exception); at 61 (“The ‘in connection with’ language in (b)(4) must have a limit.”). McDonough v. Anoka County, 799 F.3d 931 (8th Cir. 2015), read from CAP (https://static.case.law/f3d/799/cases/0931-01.json): at 943 (occurrence rule; limitations period runs from the violation, not from discovery; dismissal of accesses more than four years before filing affirmed); at 944 (“obtain” unambiguously includes access and observation of intangible data); at 945 (obtaining without a permissible purpose violates § 2724 regardless of subsequent use); at 946 (pre-limitations accesses may be considered in assessing the plausibility of timely claims). Loeffler v. City of Anoka, 893 F.3d 1082 (8th Cir. 2018), read from CAP (https://static.case.law/f3d/893/cases/1082-01.json): at 1085 (four elements of a DPPA claim). Orduno v. Pietrzak, 932 F.3d 710 (8th Cir. 2019), read from CAP (https://static.case.law/f3d/932/cases/0710-01.json): at 715 ($15,000 liquidated damages on six admitted violations; $85,000 punitive award against the officer; no actual damages; fee award of $141,197.30 on a $427,761.01 request); at 717 (§ 2725(2) excludes a State or agency thereof; no direct municipal liability and no punitive damages against the City absent proof of willful or reckless disregard); at 718 (vicarious liability under Restatement (Second) of Agency § 219(2)(d); the chief was “aided in accomplishing the tort” by his official position); at 720 n.2 (discovery-rule argument foreclosed by McDonough). Mallak v. Aitkin County, 9 F. Supp. 3d 1046 (D. Minn. 2014) (Civil No. 13-2119 (DWF/LIB)), read from CAP (https://static.case.law/f-supp-3d/9/cases/1046-01.json): at 1049 (approximately 190 accesses between 2003 and 2012, learned from a March 2013 DPS audit); at 1058 (audit detail, including 3 a.m. and 4 a.m. searches run by name, sufficient to state a plausible claim). Mallak v. City of Baxter, 823 F.3d 441 (8th Cir. 2016) (Nos. 15-1815, 15-1819), read from CAP (https://static.case.law/f3d/823/cases/0441-01.json): at 444 (facts; four-year dismissal below; summary judgment granted to officers with a definitive, uncontested, permissible explanation); at 445 (genuine issue of material fact as to the four remaining officers’ purposes); at 448 (immunity turns on factual questions; interlocutory appeal dismissed for lack of jurisdiction). Krekelberg v. City of Minneapolis, No. 20-1362 (8th Cir. Mar. 19, 2021), read from the Eighth Circuit’s own published opinion PDF at https://ecf.ca8.uscourts.gov/opndir/21/03/201362P.pdf: slip op. at 2–3 (approximately one thousand accesses by more than forty agencies between 2003 and 2012; 74 accesses by 58 officers at trial; $285,000 compensatory verdict; $150,000 punitive against each of two officers); at 3 (amended complaint adding officers did not relate back; many dismissed as time-barred); at 7 (a limitations dismissal is not a “judgment on the merits” under Restatement (Second) of Agency § 217B(2); vicarious-liability claims against the City survive); at 9 (Rule 403 error in admitting 850 stale or settled accesses; none should have entered the damages calculation, which should have rested solely on the 74 timely, unsettled claims); at 10 (a limiting instruction is not a cure for any and all Rule 403 errors); at 9 n.5 (§ 2724(b) does not expressly provide for emotional distress damages; availability assumed without deciding); at 14 (indemnification instruction was an abuse of discretion); at 15 (judgment vacated and remanded for a new trial). A reporter citation for Krekelberg could not be verified from a primary or archival source — the Caselaw Access Project’s coverage ends in mid-2020 — so it is cited here by case name, docket number, court, and date, with pin cites to the court’s own slip opinion.
Minn. Stat. § 171.12 — subd. 1a (data audit trail of all queries, responses, and actions; audit-trail data public to the extent not otherwise classified; mandatory discipline for willful violations; referral of willful unauthorized access for prosecution; independent biennial audit with public results and a legislative report within 30 days), subd. 7(a) (driver’s license data treated as provided by 18 U.S.C. § 2721 “as in effect on May 23, 2005”), subd. 7(d) (residence address classified as private data on request, with a service-of-process address). Minn. Stat. § 13.02, subd. 12 (definition of “private data on individuals”). Minn. Stat. § 13.08, subd. 1 (civil action notwithstanding § 466.03; damages, costs, and reasonable attorney fees; exemplary damages of not less than $1,000 nor more than $15,000 for each willful violation; state’s immunity waived). Minn. Stat. § 13.09(a)–(b) (willful violation is a misdemeanor and just cause for suspension without pay or dismissal). Minn. Stat. § 541.05, subd. 1(2) (six years for an action upon a liability created by statute other than one arising upon a penalty or forfeiture) — the article states the author’s reading that this supplies the chapter 13 limitations period; no Minnesota decision is cited for that proposition. Minn. Stat. § 645.02 (an act other than one making appropriations, with no different date specified, takes effect August 1 next following final enactment; an act having appropriation items takes effect the following July 1). Session law: Laws 2026, ch. 97 (S.F. No. 4760), art. 2, § 2 (amending § 171.12, subd. 7 — striking “shall” for “must,” replacing “and shall be disclosed as required or permitted by that section” with “must be disclosed as required by that section, and may be disclosed as permitted by that section,” and replacing “The commissioner shall disclose the data in bulk form” with “The commissioner may disclose the data in bulk form”), art. 2, § 3 (amending subd. 7c), art. 2, § 4 (adding subd. 7d classifying § 171.07 identifier and designation data as private data on individuals); article 2 contains no effective-date clause, and the chapter was presented to the governor 14 May 2026 and signed 18 May 2026. Session law retrieved from https://www.revisor.mn.gov/laws/2026/0/Session+Law/Chapter/97/; Minnesota statutory text retrieved from the Minnesota Office of the Revisor of Statutes (2025 edition and 2025 Supplement). Currency warning: § 171.12 carries a banner stating that subdivisions 7 and 7c were amended and subdivision 7d added by the 2026 Regular Session; the on-screen text of those subdivisions is pre-amendment and the session law controls. Bold emphasis within quoted statutory text is added; the ellipsis in the § 13.08, subd. 1, block quote omits the phrase “or a representative in the case of private data on decedents or confidential data on decedents.” This article is general legal information about Minnesota and federal law, not legal advice, and reading it does not create an attorney–client relationship. Whether a particular lookup had a permissible purpose is a fact question, and the limitations analysis turns on dates specific to each access. No outcome is promised or implied.