IMTCA Two-Year Limitations Period Governs Iowa Code § 692.6 Misuse-of-Confidential-Data Claims, with “Injury” Occurring at the Time of the Violation

I. Introduction

Case: Victoria Abrahamson, Hana Schroeder, Jody Schroeder, Terry Schroeder, Samantha Johnson, Bre Ahna Boggess f/k/a Bre Ahna Payne, Rebecca Bates, Tawni Hanson, Darby Jones, Hunter Miner, and the State of Iowa, ex rel. v. Benjamin Scheevel, individually and in his official capacity as Officer for the Estherville Police Department, Brent Shatto, individually and in his official capacity as Chief of the Estherville Police Department, City of Estherville, Iowa (Iowa Supreme Court, Jan. 30, 2026).

The case arises from allegations that a municipal police officer, Benjamin Scheevel, repeatedly accessed and disseminated confidential criminal history and intelligence data about ten local residents for improper personal purposes—allegedly including harassment of women and assisting a private vehicle repossessor. The plaintiffs sued Scheevel, the Chief of Police (Brent Shatto), the City of Estherville, and the bond surety (Acadia Insurance Company), asserting statutory and common-law theories rooted in Iowa’s confidentiality regime in chapter 692.

The central issues were (1) whether the Iowa Municipal Tort Claims Act (IMTCA) two-year statute of limitations in Iowa Code § 670.5 applies to claims brought under Iowa Code § 692.6, despite § 692.6’s “notwithstanding” language; and (2) when “injury” occurs for limitations purposes when the statute provides damages for the violation itself, even if the plaintiff learns of the violation years later.

II. Summary of the Opinion

The Iowa Supreme Court affirmed the court of appeals, reversed the district court, and remanded for dismissal. The court held:

  1. The IMTCA’s two-year limitations period in § 670.5 applies to all plaintiffs’ claims against the municipality and municipal employees, including the § 692.6 claim.
  2. For a § 692.6 misuse-of-confidential-data claim, a legally compensable injury occurs at the time of the violation (wrongful access/dissemination), not when the plaintiff later discovers it or later experiences emotional distress.
  3. Because the petition alleged all wrongful access/dissemination occurred no later than May 3, 2019, and suit was not filed until July 7, 2023, the action is time-barred under the IMTCA.

III. Analysis

A. Precedents Cited

1. IMTCA limitations: “date of injury,” no discovery rule

The court’s limitations analysis rests on a consistent IMTCA line holding that the two-year clock runs from the date of injury, not from accrual or discovery:

  • Montgomery v. Polk County, 278 N.W.2d 911, 917 (Iowa 1979) (en banc): quoted for the proposition that “Time to sue ... runs from the wrongful death, loss, or injury ... .” The court uses this to reinforce that IMTCA limitations are not “discovery-based.”
  • Venckus v. City of Iowa City, 930 N.W.2d 792, 807–08 (Iowa 2019): relied upon to reiterate that the IMTCA bars claims not filed within two years “as measured from the date of injury rather than date of accrual,” and that the IMTCA lacks “accrual” language.
  • Doe v. New Lond. Cmty. Sch. Dist., 848 N.W.2d 347, 354 (Iowa 2014): used to explain the textual reason for IMTCA’s strict approach—its “absence of language like ‘accrue’ or ‘accrual’ ... to suggest” an alternative start date.
  • Benskin, Inc. v. W. Bank, 952 N.W.2d 292, 298–99 (Iowa 2020), and Shumate v. Drake Univ., 846 N.W.2d 503, 507 (Iowa 2014): supply the motion-to-dismiss framework and confirm that limitations may be resolved on the pleadings when the bar is obvious from the petition.

2. Accrual and “legal injury” doctrine (tort limitations principles)

Although IMTCA turns on “injury,” the court anchors the “injury” determination in Iowa’s broader “legal injury” doctrine—when the law recognizes an invasion of right sufficient to sue:

  • Diggan v. Cycle Sat, Inc., 576 N.W.2d 99, 102 (Iowa 1998), quoting Sandbulte v. Farm Bureau Mut. Ins., 343 N.W.2d 457, 462 (Iowa 1984): invoked for the general rule that a cause of action accrues when the party “has a right to institute and maintain a suit.” (The court also notes Sandbulte was “overruled on other grounds” by Langwith v. Am. Nat’l Gen. Ins., 793 N.W.2d 215 (Iowa 2010), and “superseded by statute” in part—signaling that the quoted accrual principle remains usable for the point made.)
  • Vaudt v. Wells Fargo Bank, N.A., 4 N.W.3d 45, 52 (Iowa 2024): cited for the “complete and present cause of action” formulation.
  • Skadburg v. Gately, 911 N.W.2d 786, 793 (Iowa 2018), quoting Chrischilles v. Griswold, 150 N.W.2d 94, 99 (Iowa 1967): reinforces the same accrual baseline.
  • Bevel v. Civ. Serv. Comm’n, 426 N.W.2d 380, 382 (Iowa 1988): cited to the same effect.
  • Baie v. Rook, 273 N.W. 902, 903 (Iowa 1937), quoting Ogg v. Robb, 162 N.W. 217, 220–21 (Iowa 1917): provides the key “legal injury” statement the court uses to reject the plaintiffs’ attempt to define injury as emotional distress arising upon discovery. The quoted rule is that if the act itself constitutes a legal injury (a completed wrong), limitations run from the act “be the actual damage however slight,” and later-developing damages do not restart the clock.

3. Interpreting privacy harms and intrusion

  • Koeppel v. Speirs, 808 N.W.2d 177, 185 (Iowa 2011): plaintiffs relied on this intrusion-upon-seclusion case for the proposition that “harm from intrusion arises when the plaintiff reasonably believes an intrusion has occurred.” The court distinguishes it: § 692.6 makes the violation itself actionable with a statutory minimum, so “legal harm occurs ... as soon as the confidential data are accessed,” not when belief/discovery arises.

4. Federal analogue (liquidated damages and start of limitations)

  • McDonough v. Anoka County, 799 F.3d 931, 942–43 (8th Cir. 2015): cited as persuasive authority interpreting the Driver’s Privacy Protection Act, 18 U.S.C. § 2724. Because the DPPA provides liquidated damages, the Eighth Circuit held limitations run from the violation because the plaintiff then has a complete cause of action. Iowa uses that logic to reinforce the same conclusion under § 692.6.

5. “Foundation of the action” (limitations characterization)

To dispose of the plaintiffs’ common-law invasion of privacy and conspiracy counts—pleaded as violations of chapter 692—the court invokes its “substance over label” approach:

  • Legg v. W. Bank, 873 N.W.2d 763, 774 (Iowa 2016): “we look to the foundation of the action.”
  • Hallett Constr. Co. v. Meister, 713 N.W.2d 225, 230 (Iowa 2006), quoting Bob McKiness Excavating & Grading, Inc. v. Morton Bldgs., Inc., 507 N.W.2d 405, 411 (Iowa 1993): courts look to “the actual nature of the action” to determine limitations consequences. Here, because chapter 692 is the foundation, the “injury” timing tracks the chapter 692 violation timing.

B. Legal Reasoning

1. The “notwithstanding” clause in § 692.6 does not displace IMTCA § 670.5

The district court read § 692.6’s phrase—“Notwithstanding any provisions of chapter 669 or 670 to the contrary”—as overriding the IMTCA limitations period, thereby allowing the general five-year limitations period (and its discovery rule) to govern.

The Supreme Court rejects that approach for two core textual/structural reasons:

  • § 692.6 expressly contemplates actions “under chapter 669 or 670.” If § 692.6 categorically displaced chapter 670, that opening authorization would be internally inconsistent. The court thus reads “notwithstanding” more narrowly—aimed at provisions that would otherwise defeat the liability and damages consequences that § 692.6 mandates.
  • A statute of limitations is not “contrary” to liability; it regulates timing. The court reasons that § 670.5 is not “contrary” to § 692.6’s damages remedy in any meaningful way, because any limitations period (including the plaintiffs’ preferred general statute) limits when that remedy may be pursued.

The court also flags a practical implication: if “notwithstanding” meant § 692.6 overrides all of chapters 669/670, then a state defendant could be sued under § 692.6 while bypassing the Iowa Tort Claims Act administrative claims process (Iowa Code §§ 669.3, .5(1)). The court views that as an implausibly broad reading.

2. “Injury” under IMTCA occurs when § 692.6 is violated

Having determined § 670.5 applies, the decisive question becomes the date of “injury.” The plaintiffs argued that—because they primarily sought emotional-distress damages—the injury did not occur until they learned of the misuse in 2021–2022.

The court holds that § 692.6 itself defines a legally compensable injury at the moment of the violation:

  • § 692.6 imposes liability “for each violation” and guarantees “in no case shall the award for damages be less than one hundred dollars.”
  • This statutory minimum functions like liquidated damages: it confirms that the law deems the violation itself to be a completed wrong producing an actionable injury—without needing proof of downstream consequences.

Therefore, each plaintiff had “a complete and present cause of action” no later than May 3, 2019 (the resignation date and the petition’s latest alleged misconduct date). Under IMTCA, the absence of a discovery rule means later awareness does not alter the start of the limitations period.

3. Plaintiffs cannot “redefine” injury by electing narrower damages

The plaintiffs attempted to avoid the limitations bar by emphasizing they were not seeking statutory minimum damages, but rather emotional distress. The court responds with the Baie/Ogg “legal injury” principle: when an act is itself a legal injury, limitations run from the act, and later-developing damages do not create a new limitations period. A plaintiff cannot extend limitations by limiting requested damages to harms experienced later.

4. Common-law counts fall with the statute-based foundation

Counts two and three were pled as common-law invasion of privacy and civil conspiracy, but the petition defined the wrongful conduct entirely in terms of “in violation of Chapter 692.” Applying Legg v. W. Bank and Hallett Constr. Co. v. Meister, the court treats chapter 692 as the foundation, making the same “violation = injury” timing dispositive. Thus, those counts were also time-barred under § 670.5.

C. Impact

  • Strict filing window for municipal-data-misuse suits: Plaintiffs bringing claims against municipalities or municipal officers for wrongful access/dissemination of confidential criminal history or intelligence data must file within two years of the violation, even if they do not learn of it until later.
  • § 692.6 treated as an “immediate injury” statute: By anchoring injury to the violation (supported by the $100 minimum), the decision makes § 692.6 functionally similar to liquidated-damages privacy statutes: the wrong is complete upon access/dissemination.
  • Limits the reach of “notwithstanding” clauses: The ruling signals that “notwithstanding” language in remedial statutes will not lightly be read to displace procedural regimes like municipal/state tort-claims timing and processes, absent clearer textual direction.
  • Pleading strategy is constrained: Recasting chapter-692-based wrongs as common-law invasion-of-privacy or conspiracy will not avoid IMTCA’s timing rules where chapter 692 remains the “foundation of the action.”

IV. Complex Concepts Simplified

  • IMTCA (Iowa Municipal Tort Claims Act): A statute governing when and how you may sue cities and their employees. It includes a two-year time limit in § 670.5.
  • “Date of injury” vs. “discovery”: Under IMTCA, time usually starts when the legally recognized injury happens, not when the plaintiff finds out. This case holds the “injury” happened when the confidential data were wrongfully accessed/disseminated.
  • Discovery rule: A doctrine that (in some contexts) starts the limitations clock when the plaintiff discovers or should discover the injury. The plaintiffs conceded IMTCA does not generally allow it, and the court did not apply it here.
  • “Legal injury”: An invasion of a right that the law recognizes as immediately actionable, even if later harm (like emotional distress) develops afterward.
  • Statutory minimum damages ($100): A legislative signal that the violation itself is compensable; you do not need to prove additional harm to have a complete claim.
  • “Notwithstanding” clause: A drafting device that gives one provision priority over conflicting provisions. Here, it was read narrowly—protecting § 692.6’s damages/liability remedy, not eliminating IMTCA’s procedural limitation period.

V. Conclusion

The Iowa Supreme Court’s decision establishes a clear rule for municipal-defendant cases involving misuse of confidential criminal history or intelligence data: IMTCA’s two-year statute of limitations applies to § 692.6 claims, and the limitations period begins when the violation occurs, not when the plaintiff later discovers the violation or experiences emotional distress.

By tying “injury” to the violation itself—reinforced by § 692.6’s minimum damages—the court both narrows the practical reach of delayed-discovery arguments in this setting and confirms that plaintiffs must act promptly, even when the misconduct is inherently difficult to detect.