ABRAHAMSON v. SCHEEVEL (2026)

I. Introduction.

Iowa law takes a public official's misuse of confidential criminal history data and intelligence data seriously—so seriously, in fact, that it deems wrongful access or dissemination alone to be an act for which damages can be recovered, without proof of anything else. See Iowa Code § 692.6 (2023). This case involves a municipal police officer who allegedly accessed and disseminated the confidential data of ten citizens for his own improper purposes. The improper purposes included harassing some of the women involved and aiding a private repossessor of vehicles.

The ten citizens have sued, and the defendants have raised the statute of limitations. Under the relatively short time limitations of the Iowa Municipal Tort Claims Act (IMTCA), each plaintiff had only two years to file suit from the date of injury. See id. § 670.5. Yet according to the allegations of the petition, all the improper access and dissemination occurred prior to May 3, 2019—i.e., the date when the police officer resigned—whereas the plaintiffs did not sue until July 7, 2023.

We agree with the court of appeals that this action is time-barred. Although the plaintiffs allege that they did not become aware of the improper access and dissemination or suffer emotional injury from it until 2021 or 2022, Iowa law provided each plaintiff a complete cause of action no later than 2019, because each plaintiff suffered a legally compensable injury from the moment that their confidential data were accessed and disseminated. We therefore affirm the decision of the court of appeals, reverse the ruling of the district court, and remand for dismissal of this action.

II. Facts and Procedural History.

This case arises out of a disturbing series of allegations involving a former officer of the Estherville Police Department. The plaintiffs are residents of the Estherville area.

According to the petition, Officer Ben Scheevel was hired by the Estherville Police Department in 2015. While working as a police officer, until he resigned on May 3, 2019, Scheevel improperly accessed confidential law enforcement databases to obtain information about the plaintiffs. This included repeated searches in the National Crime Information Center database, the Iowa On-Line Warrants and Criminal Justice Information Network, and the Traffic and Criminal Software database. Scheevel also improperly accessed the driver's license database.

Scheevel used some of the information for his own personal purposes, for example, to repossess vehicles on behalf of a private company. Scheevel also harassed and stalked some of the plaintiffs who were women, either in person or via text and social media.

On April 12, 2019, the stepmother of lead plaintiff Victoria Abrahamson complained about Scheevel's conduct to Estherville Chief of Police Brent Shatto. Shatto initially brushed off the concerns. However, on April 15, he put Scheevel on administrative leave while he conducted an investigation. On May 1, Shatto completed his investigation and, based on the results, he “gave Scheevel the option to resign.” Scheevel quit two days later. Shatto allegedly knew about but didn't mention to others that there had been improper access to criminal history and intelligence data.

On April 8, 2022, Scheevel was charged in an eighty-four-count trial information with stalking, ongoing criminal conduct, misconduct in office, perjury, and unauthorized access to or dissemination of criminal history data in violation of Iowa Code section 692.7 (2019). Another officer was also criminally charged; he is alleged to have assisted Scheevel in his improper searches on Abrahamson but is not named a defendant in the current petition.

On July 7, 2023, the plaintiffs filed this action in Emmet County District Court against Scheevel, Shatto, the City of Estherville, and Acadia Insurance Company, as the surety on Scheevel's and Shatto's bonds. The plaintiffs’ petition asserts four counts: (1) a statutory claim under section 692.6 for improper dissemination, request, and receipt of criminal history or intelligence data; (2) a common law invasion of privacy of claim based on violations of chapter 692; (3) a common law conspiracy claim based on violations of chapter 692; and (4) an action on the bond based on section 64.18 and the misconduct alleged in the prior counts.¹ See id. § 64.18 (2023); id. ch. 692; id. § 692.6

The plaintiffs do not allege that any improper access to or dissemination of data occurred after May 3, 2019, when Scheevel resigned. However, plaintiff Abrahamson alleges that she did not become aware of the wrongful access to and dissemination of her criminal history or intelligence data until a disclosure occurred in a separate lawsuit on July 9, 2021. The remaining plaintiffs allege that they did not become aware of the wrongful access to and dissemination of their criminal history or intelligence data until March or April 2022, around the time when the criminal charges were brought against Scheevel.

The defendants filed a pre-answer motion to dismiss. They argued that any alleged misconduct ended by May 3, 2019, that the plaintiffs had not filed suit until July 7, 2023, and that their action was therefore barred by the two-year statute of limitations in the IMTCA. See id. § 670.5 (“[A] person who claims damages from any municipality or any officer, employee or agent of a municipality for or on account of any wrongful death, loss, or injury within the scope of section 670.2 or section 670.8 or under common law shall commence an action therefor within two years after the alleged wrongful death, loss, or injury.”). The defendants also maintained that no discovery rule is available under the IMTCA. See, e.g., Montgomery v. Polk County, 278 N.W.2d 911, 917 (Iowa 1979) (en banc) (“Time to sue ․ runs from the wrongful death, loss, or injury ․”).

The plaintiffs resisted. They conceded that the IMTCA applied and that no discovery rule was available. Yet they urged that the injuries they had pleaded, i.e., emotional distress, could not have occurred before each plaintiff became aware of Scheevel's wrongful acts in 2021 or 2022. In the plaintiffs’ words: “[T]he forces wrongfully put in motion by Officer Scheevel and Chief Shatto didn't produce an injury until each Plaintiff became aware of Officer Scheevel's wrongful acts.”

Following a hearing, the district court denied the motion. It first ruled sua sponte that the plaintiffs’ count one—for violations of Iowa Code section 692.6—was not governed by the two-year statute of limitations in the IMTCA. It noted that section 692.6 states that a person or governmental body proven to have violated chapter 692 shall be liable for damages, costs, expenses, and reasonable attorney fees “notwithstanding any provisions of chapter 6[6]9 [or] 670 to the contrary.” (Quoting id.) This language, according to the district court, supplanted the two-year IMTCA statute of limitations in section 670.5, leaving the section 692.6 action subject to the general five-year statute of limitations in Iowa Code section 614.1(4) for “all other actions not otherwise provided for,” which includes a discovery rule.

The district court also concluded that the remaining counts should not be dismissed because “the date of injury for purposes of Count II and Count III is the date the Plaintiffs discovered the wrongful acts of Defendant Scheevel and the alleged involvement of others in said wrongful acts.”²

The defendants applied for an interlocutory appeal. See Iowa R. App. P. 6.104(1). We granted the application and transferred the case to the court of appeals. In a 4–1 decision, the court of appeals reversed the district court and remanded for dismissal of counts one through three. One member of the panel dissented. Although she agreed with the rest of the panel that counts one, two, and three were all governed by the IMTCA's two-year statute of limitations, she agreed with the district court that the plaintiffs did not suffer injuries until they learned that Scheevel had improperly accessed their confidential data.

We granted the plaintiffs’ application for further review.

III. Standard of Review.

“We review a district court's ruling on a motion to dismiss for the correction of errors at law.” Benskin, Inc. v. W. Bank, 952 N.W.2d 292, 298 (Iowa 2020) (quoting Shumate v. Drake Univ., 846 N.W.2d 503, 507 (Iowa 2014)). “For purposes of reviewing a ruling on a motion to dismiss, we accept as true the petition's well-pleaded factual allegations, but not its legal conclusions.” Id. (quoting Shumate, 846 N.W.2d at 507). “A defendant may raise the statute of limitations by a motion to dismiss if it is obvious from the uncontroverted facts contained in the petition that the applicable statute of limitations bars the plaintiff's claim for relief.” Id. at 299 (quoting Venckus v. City of Iowa City, 930 N.W.2d 792, 809 (Iowa 2019)).

IV. Legal Analysis.

A. Does the IMTCA's Statute of Limitations Apply to All Claims? We first consider whether the IMTCA's statute of limitations applies to damage claims against a municipality or a municipal employee under Iowa Code section 692.6.

The IMTCA has its own distinctive statute of limitations for damage actions against a municipality or municipal employee. Subject to one exception not at issue here, the plaintiff must commence their action “within two years after the alleged wrongful death, loss, or injury.” Id. § 670.5. Thus, our court has “repeatedly held the IMTCA bars any claim not filed within the requisite time period as measured from the date of injury rather than date of accrual.” Venckus, 930 N.W.2d at 807–08 (citing cases). “We reached this conclusion based upon the absence of language like ‘accrue’ or ‘accrual’ in the IMTCA to suggest that something other than the date of injury might be the starting point for the statute of limitations.” Doe v. New Lond. Cmty. Sch. Dist., 848 N.W.2d 347, 354 (Iowa 2014).

Nonetheless, the district court reasoned that damage claims against municipalities and municipal employees under Iowa Code section 692.6 receive different treatment. Section 692.6 states,

Any person may institute a civil action for damages under chapter 669 or 670 or to restrain the dissemination of the person's criminal history data or intelligence data in violation of this chapter. Notwithstanding any provisions of chapter 669 or 670 to the contrary, any person, agency, or governmental body proven to have disseminated or to have requested and received criminal history data or intelligence data in violation of this chapter shall be liable for actual damages and exemplary damages for each violation and shall be liable for court costs, expenses, and reasonable attorney fees incurred by the party bringing the action. In no case shall the award for damages be less than one hundred dollars.

Id. (emphasis added). The district court took the view that the phrase “notwithstanding any provisions of chapter 669 or 670 to the contrary” means that “no provision in Iowa Code Chapter 669 or 670 can defeat a claim under Iowa Code § 692.6 if the elements of [a section] 692.6 claim are proven.” So section 692.6 trumps section 670.5.

The court of appeals had another view. It applied the notwithstanding qualifier only to the clause that came afterward. Thus, as the court of appeals analyzed the matter, the notwithstanding phrase in section 692.6 “only overrides a provision of chapter 670 that is contrary to the rest of that sentence—imposing liability for actual damages, exemplary damages, costs, expenses, and attorney fees.”

The plaintiffs ask us to adopt the district court's reasoning. They argue that section 692.6 renders section 670.5 inapplicable. Therefore, we should find that count one is governed by the general statute of limitations in Iowa Code section 614.1(4) and the discovery rule therein.

We think the court of appeals has the sounder interpretation. For one thing, as the court of appeals points out, the first sentence of Iowa Code section 692.6 authorizes the plaintiff to commence “a civil action for damages under chapter 669 or 670.” (Emphasis added.) So plainly some parts of chapters 669 and 670 apply to section 692.6 claims. What parts? The parts that govern the cause of action as opposed to the parts that directly eliminate liability or damages. See Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 126 (2012) (“A dependent phrase that begins with notwithstanding indicates that the main clause that it introduces or follows derogates from the provision to which it refers.”). Thus, for example, in an appropriate case, section 692.6 could trump the liability and damage exclusions of section 670.4(1). But the statute of limitations is different.

Section 670.5’s statute of limitations is not really “contrary” to the damages liability authorized by section 692.6. It is just a statute of limitations, which regulates the time period for bringing actions. It is no more “contrary” to that damages liability than any other statute of limitations would be, such as the default statute of limitations in section 614.1(4) favored by the plaintiffs.

We also consider the breadth of what the plaintiffs are arguing. If the plaintiffs were correct, then a plaintiff bringing a section 692.6 claim against the state or a state official could entirely bypass the administrative claims process of the Iowa Tort Claims Act. See Iowa Code §§ 669.3, .5(1) (describing the administrative claims process). Compliance with that administrative process would also be “contrary” to the damages liability established by section 692.6.

For these reasons, we conclude that the IMTCA's statute of limitations governs all the claims brought by the plaintiffs.

B. Calculating the Date of Injury. Since the IMTCA's statute of limitations applies, we must now determine the date of injury—the starting point for the statute of limitations. See id. § 670.5 (“within two years after the alleged ․ injury”). The plaintiffs argue that they did not suffer injury until they learned in 2021 or 2022 that their confidential data had been previously accessed by Scheevel. They contend that this is when they first suffered mental distress and the other harms for which they are asking compensation.³

Section 692.6 is not a model of clarity, as we noted almost fifty years ago. Feeney v. Scott County, 290 N.W.2d 885, 891 (Iowa 1980) (“Again, the act is not clear; it does not elaborate on what constitutes a ‘request and recei[pt] in violation of this chapter’ under section 692.6.” (alteration in original)). Still, it seems clear that the triggering event for liability under section 692.6 is a violation. See Iowa Code § 692.6 (“shall be liable for actual damages and exemplary damages for each violation”). And, under the terms of the statute, any violation results in an immediate injury. We know that because the statute authorizes recovery of a minimum of $100, regardless of whether any other damages are proven. See id. (“In no case shall the award for damages be less than one hundred dollars.”).

This means that regardless of what other harms the plaintiffs may have incurred later, each of them suffered an injury for which they could have sued at the time Scheevel misused their confidential data. That occurred on or before May 3, 2019.

“The general rule is that a cause of action accrues when the aggrieved party has a right to institute and maintain a suit.” Diggan v. Cycle Sat, Inc., 576 N.W.2d 99, 102 (Iowa 1998) (quoting Sandbulte v. Farm Bureau Mut. Ins., 343 N.W.2d 457, 462 (Iowa 1984), overruled on other grounds by, Langwith v. Am. Nat'l Gen. Ins., 793 N.W.2d 215 (Iowa 2010), superseded by statute, 2011 Iowa Acts ch. 70, § 45 (codified at Iowa Code § 522B.11(7) (Supp. 2011))); see also Vaudt v. Wells Fargo Bank, N.A., 4 N.W.3d 45, 52 (Iowa 2024) (“A claim ordinarily accrues, thereby triggering the relevant limitations period, when a plaintiff has a complete and present cause of action.” (quoting 51 Am. Jur. 2d Limitation of Actions § 128, West (database updated Feb. 2024))); Skadburg v. Gately, 911 N.W.2d 786, 793 (Iowa 2018) (“Generally, ‘a cause of action accrues when the aggrieved party has a right to institute and maintain a suit.’ ” (quoting Chrischilles v. Griswold, 260 Iowa 453, 150 N.W.2d 94, 99 (1967), superseded by statute on other grounds, 1975 Iowa Acts ch. 239, § 26 (codified at Iowa Code § 614.1(9) (1977)))); Bevel v. Civ. Serv. Comm'n, 426 N.W.2d 380, 382 (Iowa 1988) (“Generally, the statute of limitations begins to run at a time when a complete cause of action has accrued.”)

Simply stated, the plaintiffs had a complete cause of action on which they could have sued no later than May 3, 2019. Because the discovery rule does not apply to claims under the IMTCA, see Venckus, 930 N.W.2d at 807–08, they cannot bring an action over four years later.

We think our reasoning is supported by federal precedent interpreting a federal statute that fulfills a similar role—the Driver's Privacy Protection Act (DPPA). See 18 U.S.C. § 2724. The DPPA provides, “A person who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under this chapter shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” Id. § 2724(a). The DPPA also authorizes $2,500 in liquidated damages for a violation. Id. § 2724(b)(1). Reading this statute, the United States Court of Appeals for the Eighth Circuit has concluded that the statute of limitations for a civil action under the DPPA starts to run when a violation occurs, because (among other things) this is when the plaintiff has a complete and present cause of action on which they can sue. McDonough v. Anoka County, 799 F.3d 931, 942–43 (8th Cir. 2015).

The plaintiffs cite to Koeppel v. Speirs, an invasion of privacy case where we said that “harm from intrusion arises when the plaintiff reasonably believes an intrusion has occurred.” 808 N.W.2d 177, 185 (Iowa 2011). But Koeppel was a different case. The defendant installed a camera in a bathroom with the intent of spying on his two female assistants. Id. at 178. The plaintiff—one of the assistants—discovered the camera the next day. Id. at 179. During that time, the camera had not functioned properly; it had produced static or a “no signal” message. Id. at 178–79. We reversed the district court's grant of summary judgment to the defendant, though, on the basis that a reasonable person in the plaintiff's situation would have believed her privacy had been invaded when she discovered a camera in the bathroom that was capable of operation. Id. at 185.

The present case is distinguishable because legal harm occurs under section 692.6 as soon as the confidential data are accessed, see Iowa Code § 692.6, not when a reasonable person would believe their confidential data had been accessed.⁴

Relatedly, the plaintiffs insist that they are not pursuing statutory damages; they only want to recover damages for emotional harm. But the plaintiffs cannot avoid the running of the statute of limitations by limiting the damages they are seeking for a single wrong. As we have said,

The test to determine when the statute of limitations begins to run against an action sounding in tort is whether the act causing the damage does or does not of itself constitute a legal injury; that is, an injury giving rise to a cause of action because it is an invasion of some right of plaintiff․ [I]f the act of which the injury is the natural sequence is of itself a legal injury to plaintiff, a completed wrong, the cause of action accrues, and the statute begins to run from the time the act is committed, be the actual damage however slight, and the statute will operate to bar a recovery, not only for the present damages, but for damages developing subsequently and not ascertainable at the time of the wrong done; for in such a case the subsequent increase in the damages resulting gives no new cause of action. Nor does plaintiff's ignorance of the tort or injury, at least if there is no fraudulent concealment by defendant, postpone the running of the statute until the tort or injury is discovered. Where the doing of an act is attended immediately by resulting actual damage, the statute begins to run at once.

Baie v. Rook, 223 Iowa 845, 273 N.W. 902, 903 (1937) (quoting Ogg v. Robb, 181 Iowa 145, 162 N.W. 217, 220–21 (1917)).

In Baie v. Rook, we held that the statute of limitations on a statutory cause of action against a county recorder for failing to properly index a chattel mortgage began to run at the time of the faulty indexing, and not when a second mortgage was recorded. Id. That was true even though the plaintiff-mortgagee alleged that she did not sustain a loss or injury until she was deprived of her security by a second mortgagee obtaining a mortgage on the same property. Id.

Additionally, although the plaintiffs do not distinguish among their counts for date of injury purposes, it should be noted that counts two and three are framed as common law claims for invasion of privacy and civil conspiracy. Does this mean that something like the Koppel definition of injury applies? We believe not, because both counts two and three define the tort purely in terms of violations of chapter 692:

Defendants disseminated Plaintiffs’ criminal history data in violation of Chapter 692.

․ Defendants requested and received Plaintiffs’ criminal history data in violation of Chapter 692.

․ Defendants disseminated Plaintiffs’ Intelligence Data in violation of Chapter 692.

․ Defendants requested and received Plaintiffs’ Intelligence Data in violation of Chapter 692.

․

․ Defendants unreasonably intruded upon the solitude and seclusion of Plaintiffs by disseminating Plaintiffs’ criminal history data in violation of Chapter 692.

․ Defendants unreasonably intruded upon the solitude and seclusion of Plaintiffs by requesting and receiving Plaintiffs’ criminal history data in violation of Chapter 692.

․ Defendants unreasonably intruded upon the solitude and seclusion of Plaintiffs by disseminating Plaintiffs’ Intelligence Data in violation of Chapter 692.

․ Defendants unreasonably intruded upon the solitude and seclusion of Plaintiffs by requesting and receiving Plaintiffs’ criminal history data in violation of Chapter 692.

․

․ Defendants engaged in a civil conspiracy with others to disseminate, or request and receive, in violation of Chapter 692.

“In order to determine the appropriate statute of limitations for a cause of action, we look to the foundation of the action.” Legg v. W. Bank, 873 N.W.2d 763, 774 (Iowa 2016); see also Hallett Constr. Co. v. Meister, 713 N.W.2d 225, 230 (Iowa 2006) (“[W]e look beyond the label placed on the claim by the parties and instead focus on ‘the actual nature of the action’ to determine the applicable limitations period.” (quoting Bob McKiness Excavating & Grading, Inc. v. Morton Bldgs., Inc., 507 N.W.2d 405, 411 (Iowa 1993))). Here, chapter 692 is the foundation of the common law claims. And, as we have already explained, the violations of chapter 692 and the initial legal injuries all occurred no later than May 3, 2019.

V. Conclusion.

For the foregoing reasons, we reverse the ruling of the district court, affirm the decision of the court of appeals, and remand for dismissal of this action.

Decision of Court of Appeals Affirmed; District Court Ruling Reversed and Case Remanded.

FOOTNOTES

1.   Iowa Code section 64.18 provides, “All bonds of public officers shall run to the state, and be for the use and benefit of any corporation, public or private, or person injured or sustaining loss, with a right of action in the name of the state for its or the corporation's or person's use.”

2.   With respect to count four, the action on the bond, the district court found that it was “not a separate cause of action unto itself” and denied the motion “insofar as [the bond] serves as a potential remedy for judgment.”

3.   In other words, even if a discovery rule doesn't apply, the plaintiffs argue that no injury occurred until they discovered the wrongdoing.

4.   Moreover, Koeppel involved a camera that didn't work. 808 N.W.2d at 178–79. Koeppel doesn't address whether a person who had been spied on with a functioning camera—analogous to Sheevel's consummated acts of improper access and dissemination here—would have had a cause of action for the mere act of spying without proof of emotional harm.

Mansfield, Justice.