Angela Kay SHAMBOUR Plaintiff-Appellant v. CARVER COUNTY; City of Cottage Grove; City of Dundas; City of Farmington; City of Lonsdale; City of Northfield; Ramsey County; Rice County; City of St. Paul; City of West St. Paul; Michael Campion, in his individual capacity as the Commissioner of the Department of Public Safety; Ramona Dohman, in her capacity as the Commissioner of the Department of Public Safety; John and Jane Does (1-100), acting in their individual capacity as supervisors, officers, deputies, staff, investigators, employees or agents of the other governmental agencies; Department of Public Safety Does (1-30), acting in their individual capacity as officers, supervisors, staff, employees, independent contractors or agents of the Minnesota Department of Public Safety; Entity Does (1-30), including cities, counties, municipalities, and other entities sited in Minnesota Defendants-Appellees, 709 F. App'x 837

PER CURIAM. Angela Shambour brought suit against various Minnesota individuals, cities, counties, and law-enforcement entities, alleging numerous violations of the Data Privacy Protection Act (“the DPPA” or “the Act”), 18 U.S.C. §§ 2721-2725. The district court dismissed the majority of these claims as time-barred, for failure to state an actionable DPPA claim, or both. For the reasons discussed below, we affirm. The DPPA restricts the use and distribution of personal information contained in motor-vehicle records.

The Act outlines fourteen purposes for which government employees may access such records — including, as relevant here, law-enforcement functions. See id. § 2721(b). Access for unenumerated purposes constitutes a violation of the DPPA, see id. § 2722(a), which provides that “[a] person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this

chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court,” id. § 2724. Shambour, a former law-enforcement officer, discovered through an audit report in 2013 that her Driver and Vehicle Services (DVS) records had been accessed fifty-nine times between 2003 and 2011. She alleged that there was no reason for officials to access her information except that her appearance “changed noticeably” since her time as an officer.

As such, she hypothesized that individuals viewed her record out of romantic attraction or curiosity about the changes in her appearance. She filed this action on February 28, 2014 against: (1) unknown individuals who accessed her records (“Individual Defendants”); (2) their supervisors (“Supervisor Defendants”); (3) the cities and counties that employed the Individual Defendants (“Entity Defendants”);

(4) Mona Dohman and Michael Campion in their individual capacities as Commissioners of the Department of Public Safety from 2003 to 2011 (“Commissioners”); and (5) unidentified officers, supervisors, employees, staff, independent contractors, and agents of the Department of Public Safety (“DPS Does”). She alleged that these parties violated her statutory, constitutional, and, common-law privacy rights by accessing or allowing access to her DVS records.

The district court determined that many of Shambour’s DPPA claims were time-barred under the applicable four-year statute of limitations, see 28 U.S.C. § 1658, and it dismissed all claims based on alleged violations occurring before February 28, 2010. The court then denied dismissal of the claims against the Individual Defendants based on conduct that occurred after February 28, 2010 — finding those claims were sufficiently pled — while granting dismissal on all non-time-barred claims against the Supervisor Defendants, Entity Defendants, Commissioners, and DPS Does (collectively “the Defendants”).

The court found that the Defendants merely allowed individual officers and government officials access to personal information to carry out law-enforcement functions. Thus, even though the Individual Defendants may have acted with impermissible purposes when obtaining or using Shambour’s personal information, the court found that the Defendants could not be held liable for even the non-time-barred DPPA claims because Shambour did not allege any facts indicating that Individual Defendants were given access to DVS records for any reason other than law-enforcement purposes.

After the district court dismissed her claims against the Defendants, Shambour settled and voluntarily dismissed the two claims against Individual Defendants that arose from access occurring after February 28, 2010. She now appeals the dismissal of her DPPA claims against the Defendants. We review a district court’s grant of a motion to dismiss de novo. Cook v. ACS State & Local Sols., Inc., 663 F.3d 989, 992 (8th Cir. 2011). To survive a motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Braden v.

Wal-Mart Stores, Inc., 588 F.3d 585, 594 (8th Cir. 2009) (quotations omitted). Shambour argues that her DPPA claims against the Defendants are not time-barred because the four-year statute of limitations starts when the unlawful accesses are discovered. Defendants disagree, arguing that binding Eighth Circuit'precedent holds that the limitations period commences as soon as a violation occurs. Furthermore, Defendants contend that under the Supreme Court’s recent decision in Spokeo v. Robins, — U.S. -, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016), Shambour lacks standing to bring her claims. Because

Article III standing is jurisdictional, see id. at 1547, we begin with the Defendants’ Spokeo argument and conclude with Shambour’s statute-of-limitations claim. Our task is simplified, however, by recent Eighth Circuit precedents deciding these exact issues. In Heglund v. City of Grand Rapids, we applied the Supreme Court’s decision in Spokeo and found that plaintiffs alleging DPPA violations had suffered an injury in fact and thus had standing to bring suit. No. 16-3063, 871 F.3d 572, 576-78, 2017 WL 3910116, at *2-3 (8th Cir. Sept. 7, 2017).

Spokeo held that the “bare procedural violation” of a statutory right does not in and of itself constitute an injury in fact, for “Article III requires a concrete injury even in the context of a statutory violation.” 136 S.Ct. at 1549.

Thus, even though the Fair Credit Reporting Act requires consumer, reporting agencies to “follow reasonable procedures to assure maximum possible accuracy” of consumer reports and imposes liability on “[a]ny person who willfully fails to comply with any requirement [of the Act],” id. at 1545 (citations omitted), the plaintiff in Spokeo lacked standing based on his allegation of a mere procedural violation. Id. at 1550.

In applying this analysis to the DPPA context, Heglund first identified the relevant interest as “[a]n individual’s control of information concerning her person” and the relevant harm as an invasion of privacy. 871 F.3d at 577-78, 2017 WL 3910116, at *3.

Then, in determining whether this intangible harm constituted an injury in fact, the court followed Spok-eo’s direction to “consider Congress’ judgment and whether the alleged intangible harm has a close relationship to a harm that traditionally provided a basis for suit in the Anglo-American legal system.” Id. 871 F.3d at 577, at *2 (citing Spokeo, 136 S.Ct. at 1549). The court first noted that, “[i]n enacting the DPPA, Congress recognized the potential harm to privacy from state officials accessing drivers’ personal information for improper reasons.” Id. 871 F.3d at 577, at *3 (citing Maracich v.

Spears, 570 U.S. 48, 133 S.Ct. 2191, 2195, 186 L.Ed.2d 275 (2013)). Heglund then explained that the intangible harm associated with the violation of the DPPA’s substantive protections is consonant with the “common law tradition of lawsuits for invasion of privacy.” Id. (citation omitted). Accordingly, the court held that a DPPA violation is sufficient to establish an injury in fact for the purposes of

Article III standing. Id. The Defendants’ claim here— that Shambour has alleged a bare procedural violation of the DPPA without a concrete injury — is the exact argument that Heglund rejected. Thus, because this case is indistinguishable from Heglund, we hold that Shambour has standing as to her DPPA claims. Because Shambour has standing, we turn to her arguments concerning the dismissal of her DPPA claims against the Defendants. In McDonough v.

Anoka County, we “conelude[d] that the statute of limitations for these DPPA violations began to run when the violations occurred.” 799 F.3d 931, 943 (8th Cir. 2015); see also Tichich v. City of Bloomington, 835 F.3d 856, 866 (8th Cir. 2016), cert. denied, — U.S. -, 137 S.Ct. 2246, 198 L.Ed.2d 678 (“The present appeals ... are governed by our holdings in [McDonough], one of which is that the four-year statute of limitations set forth in 28 U.S.C. § 1658(

a) begins to run when a DPPA violation occurs.”). At oral argument and in her briefs, Shambour conceded that, unless this panel overturns McDonough and Tichitch, all of her DPPA claims against the Defendants are time-barred. We refuse to do so, for “it is a cardinal rule in the Eighth Circuit that one panel is bound by the decision of a prior panel.” Elmore v. Harbor Freight Tools USA, Inc., 844 F.3d 764, 767 (8th Cir. 2016) (quotations, citations, and alterations omitted). As a result, the four-year statute of limitations applies, and none of Shamb-our’s DPPA claims are timely.

We therefore affirm the dismissal of Shambour’s DPPA claims against the Defendants. . The Honorable Richard H, Kyle, United States District Judge for the District of Minnesota.