UNITED STATES of America, Plaintiff-Appellee, v. Kimberly Smith HASTIE, Defendant-Appellant, 854 F.3d 1298

WILLIAM PRYOR, Circuit Judge: This appeal requires us to decide two issues: first, whether the term “personal information” in the Driver’s Privacy Protection Act, 18 U.S.C. §§ 2721(a), 2725(3), includes email addresses; and second, whether the government presented sufficient evidence for the jury to find that the License Commissioner of Mobile County, Alabama, was an “officer, employee, or contractor” of a “State department of motor vehicles,” id. § 2721(a).

During her tenure as License Commissioner of Mobile County, Kimberly Hastie obtained the email addresses of residents of Mobile County from a Commission database. Hastie provided these email addresses to the campaign team for her preferred candidate for mayor of Mobile so that the campaign could send a mass email containing Hastie’s endorsement of the candidate. A jury found Hastie guilty of violating the Driver’s Privacy Protection Act. Because the statutory definition of “personal information” includes email addresses and because sufficient evidence supported the verdict, we affirm. I.

BACKGROUND Kimberly Hastie served as the License Commissioner of Mobile County. The License Commission issues driver’s licenses and automobile titles and maintains motor vehicle registrations for residents of Mobile County. The License Commission is “a collection and disbursal agency” for taxes and fees related to motor vehicles. The License Commission maintains a website, which requires users to provide their email addresses for all online transactions. The License Commission also instructs tellers at its offices to obtain email addresses from licensed drivers and motor vehicle owners.

Both the website and the policy manual of the License Commission include a statement about the Driver’s Privacy Protection Act. Hastie asked Brad Bray, the manager of information technology, to send emails to addresses in the License Commission’s database communicating Hastie’s endorsement of Sandy Stimpson for mayor. Bray refused because “everybody would know that we just used our E-mail database to send out this list.” Instead, he downloaded a list of email addresses onto a flash drive and delivered it to Hastie’s secretary.

Hastie gave the list of email addresses to the Stimpson campaign, and the Stimpson campaign sent out Hastie’s endorsement to those email addresses. When later questioned by the press, Hastie falsely denied that she had released a list of email addresses. In 2015, a federal grand jury returned a superseding indictment against Hastie on 18 counts. Count 17 charged Hastie with violating the Driver’s Privacy Protection Act by disclosing the email addresses collected by the License Commission to a political consulting firm to tout Hastie’s support for a mayoral candidate.

At trial, the district court instructed the jury as follows that the government had to prove beyond a reasonable doubt the following elements for Count 17, including that Hastie worked for a state department of motor vehicles: The defendant is an officer, employee, or contractor of a state department of motor vehicles; the defendant knowingly disclosed or otherwise made available to any person or entity personal information about an individual; the personal information was obtained by the Department of Motor Vehicles in connection with a motor vehicle record; and the personal information was disclosed for any reason other than a reason where the release of such information is specifically permitted.

Trial Tr. Day 7, 1596:15-23, June 3, 2015 (emphasis added). The district court also defined “personal information” as follows to include email addresses: The term “personal information” means information that identifies an individual, including an individual’s E-mail address, photographs, Social Security number, driver’s license, name, address, telephone number, medical or disability information. Personal information does not include information on vehicular accidents, driving violations, and a driver’s status. Id. at 1596:24-1597:5 (emphasis added).

Before the jury returned its verdict, Hastie filed an amended motion for judgment of acquittal. She argued that the statutory definition of “personal information” did not include email addresses and that “the Government has failed to present sufficient evidence from which the jury could find beyond a reasonable doubt that she is an ‘officer, employee, or contractor of a State department of motor vehicles.’ ” The district court denied the motion. The jury found Hastie guilty of violating the Driver’s Privacy Protection Act and not guilty on all other counts.

Hastie filed a renewed motion for judgment of acquittal or, in the alternative, a new trial. The district court denied the motion and sentenced Hastie to pay a fine of $5,000. II. STANDARDS OF REVIEW “We review de novo whether there is sufficient evidence in the record to support a jury’s verdict in a criminal trial, viewing the evidence in the light most favorable to the government, and drawing all reasonable factual inferences in favor of the jury’s verdict.” United States v. Jimi-nez, 564 F.3d 1280, 1284 (11th Cir. 2009). “Statutory

interpretation is a question of law over which we exercise de novo review.” Boca Ciega Hotel, Inc. v. Bouchard Transp. Co., 51 F.3d 235, 237 (11th Cir. 1995). We also “review jury instructions de novo to determine whether they misstate the law or mislead the jury to the prejudice of the objecting party,” United States v. Myers, 972 F.2d 1566, 1572 (11th Cir. 1992), but we give the district court “wide discretion as to the style and wording employed in the-instructions,” Goldsmith v. Bagby Elevator Co., 513 F.3d 1261, 1276 (11th Cir. 2008). III.

DISCUSSION The Driver’s Privacy Protection Act prohibits the disclosure of personal information obtained by a state department of motor vehicles except for certain permissible uses, none of which are relevant to this appeal: (

a) A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity: (1) personal information, as defined in 18 U.S.C. § 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (

b) of this section; ... 18 U.S.C. § 2721(a). The Act defines personal information as “information that identifies an individual.” Id. § 2725(3). We divide our discussion in two parts. First, we explain that sufficient evidence supported the jury’s factual "determination that Hastie was an officer or employee of a State department of motor vehicles. Second, we explain that the definition of “personal information” in section 2725(3) includes email addresses and that the district court did not err in so instructing the jury. A.

The Jury Could Find that the License Commission Is a “State Department of Motor Vehicles. ” The government presented sufficient evidence to support the jury’s verdict that Hastie was an “officer, employee, or contractor” of “[a] State department of motor vehicles” under the Act. 18 U.S.C. § 2721(a).

As the district court acknowledged, Hastie’s status as an officer or employee of a state department of motor vehicles was “an element of the offense” that needed to be proved to the jury as a “question of fact.” The parties do not contest that Hastie served as the License Commissioner for the Mobile County License Commission. But Hastie argues that the government failed to present enough evidence that the Mobile County License Commission “is in fact a ‘State department of motor vehicles’ ” to sustain a conviction. We disagree..

Specific testimony addressed the relationship between the Mobile County License Commission and the State of Alabama. For example, the jury heard evidence that some of the responsibilities of the License Commission as “a collection and disbursal agency” were defined by statute. The jury also heard testimony that the State oversaw aspects of the License Commission; for example, the state revenue commissioner sometimes played a management role, and the License Commission was subject to state ethics training.

And the jury could have found that the Commission determined that it was subject to the Act because it included a statement about the Act on its website and in its policy manual. The jury could have found that the Mobile County License Commission acts for the State when it performs the traditional tasks associated with a state department of motor vehicles. “[T]he law permits jurors to ‘apply their common knowledge, observations and experiences in the affairs of life.’ ” United States v. Gainey, 111 F.3d 834, 836 (11th Cir. 1997) (quoting United States v.

Cruz-Valdez, 773 F.2d 1541, 1546 (11th Cir. 1985) (en banc)). The License Commission issues driver’s licenses and automobile titles and handles motor vehicle registrations for residents of Mobile County, responsibilities commonly known to be within the domain of state departments of motor vehicles. Driver’s licenses and license plates allow drivers to operate their motor vehicles in the State of Alabama and allow individuals to comply with state laws. And the Mobile County License Commission remits fees to the State and implements state laws about vehicle registration. See, e.g., Ala.

Code § 32-6-61 (1975) (“All persons who acquire a motor vehicle which is located in this state and required to be registered in this state ... shall reregister the vehicle with the ... county official authorized and required by law to issue license plates.”); § 32-9-3 (“Any ... state or county license inspectors and their deputies ... shall be authorized ... to enforce the provisions of this chapter.”); cf.

Ex parte Tuscaloosa Cty., 796 So.2d 1100, 1106 (Ala. 2000) (explaining that under Alabama law, a county official “was acting as an agent of the state for purposes of enforcing the state’s business-license laws”). Hastie collected the personal information of drivers as a prerequisite to these transactions traditionally associated with a department of motor vehicles. That Alabama does not house all the functions of a traditional department of motor vehicles in one entity does not change this conclusion.

Hastie argues that because the government concedes that there is no literal “State department of motor vehicles,” in Alabama (but instead an Alabama Department of Revenue, Motor Vehicle Division), the Act does not apply to her.

But the Act does not allow defendants to escape liability because their public employer that issues driver’s licenses and registers motor vehicles is called something other than the “department of motor vehicles.” Because the Mobile County License Commission participates in the state system for vehicle registration and drivers licenses, it does not matter how Alabama labels or organizes that system. “[Vliewing the evidence in the light most favorable to the government” and “drawing all reasonable factual inferences in favor of the jury’s verdict,” Jiminez, 564 F.3d at 1284, the evidence was sufficient for a reasonable jury to have found that Hastie was an employee or officer of a state department of motor vehicles.

B. An Individual’s Email Address is “Personal Information. ” We begin “where courts should always begin the process of legislative

interpretation ... which is with the words of the statutory provision.” Harris v. Garner, 216 F.3d 970, 972 (11th Cir. 2000) (en bane). The Driver’s Privacy Protection Act defines the term “personal information” as “information that identifies an individual, including an individual’s photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver’s status.” 18 U.S.C. § 2725(3). “Definition sections” in statutes “are to be carefully followed.” Antonin Scalia & Bryan A. Garner, Reading Law: The

Interpretation of Legal Texts 225 (2012); see also Fox v. Standard Oil Co., 294 U.S. 87, 96, 55 S.Ct. 333, 79 L.Ed. 780 (1935). Email addresses fall within the ordinary meaning of “information that identifies an individual.” They can “prove” or “establish the identity of’ an individual. Identify, Webster’s New International Dictionary 1236 (2d ed. 1961). Email addresses often expressly include the account holder’s name, affiliated organization, or other identifying information.

With a simple search engine or a service like Spokeo, an email address can also be used to find personal information such as a corresponding username or physical address. The statute does not exclude “monikers created solely for purposes of electronic communication,” as Hastie argues, so long as the moniker identifies an individual. This

interpretation is strengthened by the material similarity between email addresses and the examples in the statute. Because “[associated words bear on one another’s meaning,” Scalia & Garner, supra, at 195, the examples give meaning to the term “personal information.” Email addresses are much like an online version of a physical address or a telephone number: they serve both as a way to find an individual in an online space and as a way to contact a person. Hastie argues that our

interpretation is flawed because we “assume[] a person has an e-mail address,” but this argument is backwards. We ask whether an email address identifies an individual, not whether an individual has an email address. And the examples listed in the statute reveal that “information that identifies an individual” does not require that a single piece of information on its own be sufficient to locate a particular individual. An individual might have multiple phone numbers or one, and an address might be associated with one person or many — the ratio does not need to be 1:1.

The term “personal information” should be read naturally to include facts that can identify an individual, as opposed to facts that in every instance must identify an individual. A recent Seventh Circuit opinion supports our

interpretation of “personal information.” In a civil action under the Act, the Seventh Circuit held that the definition of “personal information” in the Act included birth date, height, weight, hair color, and eye color. Dahlstrom v. Sun-Times Media, LLC, 777 F.3d 937, 942 (7th Cir. 2015). The court acknowledged that the information “does not uniquely single out a particular person as does, for example, a Social Security number,” but stated that the information still “indisputably aids in ‘identifying]’ them.” Id. at 943.

Like a telephone number or a physical address, an email address is “information that identifies an individual.” The list of examples is not exclusive because it is preceded by the word “including.” Hastie argues that the canon of ex-pressio unius applies to the list of examples in the definition and that we cannot add anything to the statutory definition that Congress has not authorized. But “the word include does not ordinarily introduce an exhaustive list.” Scalia & Garner, supra, at 132, 226. The Supreme Court has repeatedly held that the word “including” in a statute signifies enlargement, not limitation.

See,, e.g., Chickasaw Nation v. United States, 534 U.S. 84, 89, 122 S.Ct. 528, 151 L.Ed.2d 474 (2001) (explaining that “including” “emphasizes the fact that that which is within is meant simply to be illustrative”); Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 577, 114 S.Ct. 1164, 127 L.Ed.2d 500 (1994) (explaining that terms like “ ‘including’ ... indicate the ‘illustrative and not limitative’ function of the examples”).

Because “including” signals a list of examples and not an exclusive definition, interpreting the statute to include email addresses does not “add” anything but instead gives meaning to the definition of “information that identifies an individual.” If we limited the definition to only the enumerated examples, we would render the express exclusions superfluous. A statute “should be construed so that effect is given to all its provisions, so that no part will be inoperative or superfluous, void or insignificant.” Hibbs v.

Winn, 542 U.S. 88, 101, 124 S.Ct. 2276, 159 L.Ed.2d 172 (2004) (citation omitted); see also Scalia & Garner, supra, at 174. The definition says that it “does not include information on vehicular accidents, driving violations, and driver’s status” and also excludes the 5-digit zip code. 18 U.S.C. § 2725(3). But if the list were limited to the included examples, there would be no need to exclude anything else. The presence of specific exclusions means this statute is not an exception to the general rule that “includes” is not exhaustive.

The word “including” also defeats Hast-ie’s argument that because Congress specifically included email addresses as an example of “personal information” in the Children’s Online Privacy Protection Act, 15 U.S.C. § 6501(8), Congress intended to exclude it from the Driver’s Privacy Protection Act. Although such an absence is persuasive in comparable exclusive

definitions, see, e.g., Price v. Time, Inc., 416 F.3d 1327, 1341 (11th Cir. 2005) (comparing the legislature’s use of the word “magazine” as opposed to “newspaper” in other contemporary statutes), the absence loses meaning when comparing non-exclusive lists. Especially because the Children’s Online Privacy Protection Act is about online activities, the use of email addresses there does not speak to the absence of email addresses in the Driver’s Privacy Protection Act.

Nor does the rule of lenity require Hastie’s acquittal. “Ambiguity in a statute defining a crime or imposing a penalty should be resolved in the defendant’s favor,” but “[n]aturally, the rule of lenity has no application when the statute is clear.” Scalia & Garner, supra, at 296, 301. “The rule comes into operation at the end of the process of construing what Congress has expressed, not at the beginning as an overriding consideration of being lenient to wrongdoers.” Callanan v. United States, 364 U.S. 587, 596, 81 S.Ct. 321, 5 L.Ed.2d 312 (1961).

Because the Driver’s Privacy Protection Act is not ambiguous, there is no tie to break in favor of Hastie. Although Hastie argues that the rule of lenity should apply because she did not know email addresses were covered by the Act, “ignorance of the law is typically no defense to criminal prosecution,” McFadden v. United States, — U.S. —, 135 S.Ct. 2298, 2304, 192 L.Ed.2d 260 (2015). The Act says that a defendant must knowingly disclose (as opposed to negligently misplace) the information, but the Act does not require knowledge that such disclosure is illegal. Cf. id.

And in any event, the government offered evidence that Hastie was aware of the prohibition because she attempted to hide the source of the emails and later lied about her behavior. Our construction of the statute is broader than Hastie’s

interpretation, but “[t]he mere possibility of articulating a narrower construction ... does not by itself make the rule of lenity applicable,” Smith v. United States, 508 U.S. 223, 239, 113 S.Ct. 2050, 124 L.Ed.2d 138 (1993). The statute is also not “void for vagueness.” The definition of “personal information” is not so vague that it fails to provide fair notice nor does it require state officials to “guess at its contours.” Cf. Gentile v. State Bar of Nevada, 501 U.S. 1030, 1048, 111 S.Ct. 2720, 115 L.Ed.2d 888 (1991). The Seventh Circuit agrees. It held that its

interpretation of “personal information” did not “strain the [Act’s] plain meaning” and as a result, was “clear and precise enough to give a person of ordinary intelligence fair notice about what is required of him.” Dahlstrom, 777 F.3d at 946 (quoting Wis. Right to Life, Inc. v. Barland, 751 F.3d 804, 835 (7th Cir. 2014)). Hastie was fairly convicted of violating the Act.

Finally, because the district court accurately stated the law, it did not err in instructing the jury that “[t]he term ‘personal information’ means information that identifies an individual, including an individual’s email address.” Although perhaps not “all email addresses are ‘personal information,’” see Dissenting Op. at 1311— 12, the district court accurately stated the law when it said that personal information includes an individual’s email address, in the same way that it includes an individual’s telephone number or physical address.

Hastie argues that “[minimally,” the jury should have been allowed to determine whether “personal information” includes email addresses “as a factual question.” But the definition of “personal information” is a matter of statutory

interpretation, which makes it a question of law. See United States v. Wilson, 788 F.3d 1298, 1310 (11th Cir. 2015). That Hastie disagrees with our definition of “personal information” does not remove the authority of the district court to instruct the jury on the law. The dissent correctly states that a district court cannot direct a verdict on an element of the offense, Dissenting Op. at 1308, but the dissent misapprehends the distinction between an instruction that defines an element and one that directs a verdict on that element. In United States v.

Goetz, 746 F.2d 705 (11th Cir. 1984), we explained that the district court “correctly ruled that, as a matter of law, alleged tax returns which do not contain any financial information are not ‘returns’ within the meaning of [the statute].” Id. at 707. A definition that stopped there would have been a permissible statement of the law to the jury. United States v.

Grote, 632 F.2d 387, 391 (5th Cir. 1980) (holding that a jury instruction providing the same definition of tax returns did not direct the verdict, but “merely instructed the jury, in light of the evidence that had been introduced at trial, how it might find the existence of the second element of the offense charged”). But the district court in Goetz “went on to determine that the documents filed by the defendants did not contain any financial information, and concluded that, as a matter of law, these documents were not returns.” 746 F.2d at 708 (emphases added).

The district court “essentially] ... directed a verdict” on that element by conclusively applying the definition to the facts, id., instead of leaving the jury the “responsibility to find the ... element of the offense ... under the charge as given.” Grote, 632 F.2d at 391. We identified the same error in Roe v. United States, 287 F.2d 435 (5th Cir. 1961). The district court “should have told the jury that to convict it must first find that, within the definition of an investment contract given by the Court, these transactions were an investment contract.” Id. at 441 (emphasis added).

The instruction that “assignments of oil and gas leases coupled with collateral agreements ... are investment contracts” was permissible, but the instruction that “the investment contracts described in the first count of this indictment come within the definition” was not. Id. at 440 n.8 (emphasis added).

The Fifth Circuit has since explained that “[i]t is the judge’s duty to instruct the jury concerning th[e] definition [of a security]” and “[o]f course, the question whether a generic type of document, such as a traveler’s check or an equipment lease, may come within the reach of the statute’s prohibition is one of law,” but “[w]hether a particular piece of paper meets that definition ... is for the jury to decide.” United States v. Johnson, 718 F.2d 1317, 1321 n.13 (5th Cir. 1983) (en banc).

Our dissenting colleague rejects our reading of these decisions, but fails to explain how they do not make the very distinctions explained above. The district court would have erred if it had instructed the jury that the emails provided by Ms. Hastie constitute “personal information,” but the district court did not do so. The district court instead provided the jury a definition at a higher level of generality when it explained that “ ‘personal information’ means information that identifies an individual, including an individual’s E-mail address.” Trial Tr. Day 7, 1596:24-1597:5, June 3, 2015.

The dissent asserts that these two instructions are “qualitatively the same,” Dissenting Op. at 1311, but our precedents maintain that they are materially and legally different, see Grote, 632 F.2d at 391. Because a district court may instruct a jury that a generic kind of document is not a return, see Goetz, 746 F.2d at 707-08, and that a generic kind of transaction is an investment contract, see Roe, 287 F.2d at 441, the district court did not err in instructing the jury that a generic identifier (a personal email address) is personal information.

The district court did not “appl[y] the facts to the law, leaving nothing for the jury to determine,” Goetz, 746 F.2d at 709, because the jury was still responsible for deciding whether Hastie shared information that met that legal definition. It is irrelevant that this particular decision was simple; the jury applies the law to the facts “no matter how overwhelming the evidence.” Sullivan v. Louisiana, 508 U.S. 275, 277, 113 S.Ct. 2078, 124 L.Ed.2d 182 (1993).

Contrary to the dissent’s assertion, Dissenting Op. at 1311-12, our ruling also does not conflict with the decision to allow the jury to decide whether Hastie was an “officer” or “employee” of a “State department of motor vehicles,” 18 U.S.C. § 2721(a). In its discretion, the district court perhaps could have defined that statutory language to include county officials who act on behalf of the state, but the district court could not have determined that Hastie was such an officer without running afoul of the Sixth Amendment.

Although there may arise situations where a purported “definition” is incorrect or so specific that it essentially directs the verdict, that problem is not present here. Because the generic definition of “personal information” given by the district court accurately stated the law, the district court did not err in its instructions to the jury. IV. CONCLUSION We AFFIRM Hastie’s judgment of conviction.