[*714] Samantha Orduno sued police chief Richard Pietrzak, the City of Dayton, Minnesota, and other public officials for alleged violations of the Driver's Privacy Protection Act (DPPA), 18 U.S.C. § 2724 . Orduno moved to certify a class of all persons whose information Pietrzak impermissibly obtained, but the district court ^[1] denied the motion. Pietrzak then admitted liability for six violations of the DPPA, and a jury awarded Orduno $85,000 in punitive damages, but no actual damages. The court ruled that Orduno failed to present sufficient evidence that the City was directly liable for any violations of the DPPA, but authorized the jury's finding that the City was vicariously liable for Pietrzak's actions.

Orduno appeals the district court's denial of class certification and its rulings on the City's direct liability, the exclusion of certain evidence, the award of attorneys' fees, the denial of expert costs, and the application of the DPPA's statute of limitations. On cross-appeal, the City challenges the imposition of vicarious liability for Pietrzak's violations of the DPPA. We affirm.

I.

The saga began when a photocopy of Samantha Orduno's paycheck receipt was discovered in a copy machine of the City of Dayton's main office in November 2012. Orduno, the city administrator for Dayton, was on vacation at the time, and had not given anyone permission to copy her financial records. When she learned of the discovery, Orduno believed that the photocopy was a sign of a possible data privacy violation within the city administration.

Orduno recruited Lynne Bankes, the police chief of nearby White Bear Lake, Minnesota, to investigate the incident. Orduno told Bankes that Dayton Police Chief Richard Pietrzak was her primary suspect, because he had twenty-four-hour access to City Hall and possibly some ill will towards Orduno.

Bankes inquired with the Minnesota Department of Motor Vehicle Services whether Orduno's personal information had been accessed in Minnesota's Driver and Vehicle Services database. The Department provided Bankes with a printout showing fourteen searches of the database for Orduno's information between January 19, 2010, and October 4, 2012. Pietrzak made seven of these queries. Bankes noticed that Pietrzak searched for Orduno based on her name, rather than her vehicle information, leading Bankes to suspect that Pietrzak was not investigating a traffic stop and had no legitimate law enforcement purpose for accessing Orduno's information.

Bankes requested that the Department send her a list of Pietrzak's accesses over the preceding six months. The response listed more than 850 people, including family members, other employees of the police department and city administration, and persons from surrounding communities. Bankes noticed that "very few" of these accesses were based on a license plate number. In a written report, Bankes concluded that Pietrzak violated the Minnesota Data Practices Act, noted the possibility[*715] of charging him with a gross misdemeanor for committing misconduct as a public officer or employee, and opined that there was "no excuse" for his behavior in making improper or illegal access to the database.

In May 2014, Orduno sued Pietrzak under the DPPA, alleging that he unlawfully obtained her private information and the private information of around 850 other people. Orduno also named the City of Dayton and other public officials as defendants, claiming that the City and these officials had enabled Pietrzak to access the database and then failed to monitor him adequately to prevent his unlawful conduct. The district court dismissed the claims against the city officials for failure to state a claim, and granted in part a motion to dismiss by Pietrzak and the City based on the four-year statute of limitations. ^[2]

Orduno then moved to certify a class defined as follows:

Individuals whose Minnesota driver's license records were obtained without a purpose or purposes permitted under the DPPA by Defendant Richard Pietrzak from May 2, 2010 through the present date while Defendant Richard Pietrzak was employed by Defendant City of Dayton.

The court denied the motion, concluding that the proposed class failed to satisfy the numerosity and predominance requirements of Federal Rule of Civil Procedure 23(a)(1) and (b)(3).

Orduno later obtained an audit of Pietrzak's use of the database from 2003 through 2012, and she sought leave to file a motion for reconsideration of the denial of class certification. The court denied her request, reasoning that the additional evidence would not allow the proposed class to satisfy the predominance standard under Rule 23(b)(3).

After the district court set the case for trial, Pietrzak filed an amended answer in which he admitted to obtaining Orduno's private information for an impermissible purpose on six occasions within the limitations period. The City continued to deny direct and vicarious liability. Before trial, the district court ruled that the City could be held vicariously liable for Pietrzak's actions as police chief, but not directly liable, as there was no evidence that the City had an impermissible purpose in granting Pietrzak access to the database. The court ordered that evidence of time-barred obtainments and viewing of data about nonparties was inadmissible because it was irrelevant to Orduno's damages and was substantially more prejudicial than probative. The court also excluded evidence of the City's actions in the wake of Bankes's report, including whether the City disciplined Pietrzak.

After a three-day trial, the jury returned a verdict awarding Orduno $85,000 in punitive damages, but no actual damages. The court awarded another $15,000 in liquidated damages. Orduno moved for $427,761.01 in attorneys' fees and costs. The court awarded fees of $141,197.30 and denied costs of a forensic expert.

II.

Orduno first argues that the district court erred in denying her motion to certify a class under Federal Rule of Civil Procedure 23(b)(3). We review a district court's denial of class certification for abuse of discretion.

[*716] Sandusky Wellness Ctr., LLC v. MedTox Sci., Inc. , 821 F.3d 992 , 995 (8th Cir. 2016).

To obtain certification of a class seeking damages under that rule, a plaintiff must satisfy the four prerequisites of Rule 23(a), including that "the class is so numerous that joinder of all members is impracticable." The plaintiff also must meet the requirements of Rule 23(b)(3), including that "questions of law or fact common to class members predominate over any questions affecting only individual members." See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds , 568 U.S. 455 , 460, 133 S.Ct. 1184 , 185 L.Ed.2d 308 (2013). The district court ruled that Orduno's proposed class failed to satisfy the numerosity requirement of Rule 23(a) and the predominance requirement of Rule 23(b)(3). We conclude that the court did not abuse its discretion on the question of predominance, and that ground is sufficient to affirm the ruling.

"The predominance inquiry 'asks whether the common, aggregation-enabling, issues in the case are more prevalent or important than the non-common, aggregation-defeating, individual issues.' " Tyson Foods, Inc. v. Bouaphakeo , --- U.S. ----, 136 S. Ct. 1036 , 1045, 194 L.Ed.2d 124 (2016) (quoting 2 William B. Rubenstein, Newberg on Class Actions § 4:49, at 195-96 (5th ed. 2012) ). Where too many individual questions predominate over common ones, certification is inappropriate. E.g. , Webb v. Exxon Mobil Corp. , 856 F.3d 1150 , 1156-57 (8th Cir. 2017) ; Ebert v. Gen. Mills, Inc. , 823 F.3d 472 , 479-80 (8th Cir. 2016).

To prove a violation of the DPPA, Orduno must demonstrate that Pietrzak "knowingly" used personal information, "from a motor vehicle record, for a purpose not permitted" by law. 18 U.S.C. § 2724 (a). Orduno argues that common facts and questions of law predominate, because the circumstances for each access of the database were the same: "the Dayton Police Chief entered the individuals' names into the [Driver and Vehicle Services] database while he was on duty and obtained their personal information and viewed their photographs."

The mere fact that Pietrzak obtained information, however, does not establish liability under the Act. Pietrzak was the police chief when he accessed the database, and the DPPA permits use by a law enforcement agency in carrying out its functions. 18 U.S.C. § 2721 (b)(1). The district court correctly observed that class members would "need to present evidence of the circumstances under which their particular information was accessed" to address whether Pietrzak's purpose in searching the database was impermissible. The circumstances of each obtainment will vary from class member to class member, so the court properly concluded that "common questions" would not predominate over individual determinations.

Orduno argues that her proposed class included only individuals whose information Pietrzak obtained impermissibly, so there is no need for case-by-case determinations. But Orduno cannot solve the predominance problem by creating a so-called "fail-safe class," in which the class is defined to preclude membership unless a putative member would prevail on the merits. That sort of class "is prohibited because it would allow putative class members to seek a remedy but not be bound by an adverse judgment-either those 'class members win or, by virtue of losing, they are not in the class' and are not bound." Young v. Nationwide Mut. Ins. Co. , 693 F.3d 532 , 538 (6th Cir. 2012) (quoting Randleman v. Fid. Nat'l Title Ins. Co. , 646 F.3d 347 , 352 (6th Cir. 2011) ); accord Messner v. Northshore Univ. HealthSystem , 669 F.3d 802 , 825 (7th Cir. 2012). A[*717] fail-safe class is also unmanageable, see Fed. R. Civ. P. 23(b)(3)(D), because the court cannot know to whom notice should be sent. Kamar v. RadioShack Corp. , 375 F. App'x 734 , 736 (9th Cir. 2010). Insofar as the fail-safe class is a means to establish predominance, its independent shortcomings are an alternative basis to affirm the denial of certification. See Adashunas v. Negley , 626 F.2d 600 , 604 (7th Cir. 1980).

Orduno complains that the district court should have allowed her to move for reconsideration of class certification. She claims that additional evidence gained through a full audit of Pietrzak's database accesses, which showed 15,870 obtainments of private information from 2003 to 2012, demonstrated that she satisfied the numerosity requirement under Rule 23(a). But this new evidence does not alter the calculus on the predominance issue, and predominance was an independent ground for denying the motion to certify. The court thus did not abuse its discretion in denying leave.

III.

A.

Orduno next contends that the district court erred in concluding that the City was not directly liable to her under the DPPA. The DPPA makes civilly liable any "person" who impermissibly "obtains, discloses or uses personal information, from a motor vehicle record." 18 U.S.C. § 2724 (a). The statute defines "person" to include an "organization or entity," not including "a State or agency thereof." Id. § 2725(2).

To prove liability under the DPPA, Orduno must show that the City "1) knowingly 2) obtained, disclosed, or used personal information, 3) from a motor vehicle record, 4) for a purpose not permitted." Loeffler v. City of Anoka , 893 F.3d 1082 , 1085 (8th Cir. 2018) (internal quotation omitted). Orduno failed to present sufficient evidence to show that the City had an impermissible purpose when it granted Pietrzak access to the database. Pietrzak was the police chief and had legitimate law enforcement reasons for consulting the database. See 18 U.S.C. § 2721 (b)(1). Orduno alleges that the City authorized and acquiesced in Pietrzak's misuse of the database, but she did not present evidence showing that the City knowingly allowed Pietrzak "to access the database for any reason other than performing [his] law-enforcement duties, a purpose permitted by the DPPA." Loeffler , 893 F.3d at 1085 . Without evidence that city officials knowingly caused Pietrzak's impermissible actions, the City cannot be directly liable. And without "proof of willful or reckless disregard of the law," it follows that the district court properly declined to allow punitive damages against the City. See 18 U.S.C. § 2724 (b)(2).

Orduno suggests that Pietrzak, as police chief, was a policymaker for the City, and that his own actions were thus tantamount to unlawful conduct by the City. Cf. Monell v. Dep't of Soc. Servs. , 436 U.S. 658 , 694, 98 S.Ct. 2018 , 56 L.Ed.2d 611 (1978). Assuming without deciding that a plaintiff under the DPPA may pursue a claim for municipal liability based on the Monell standards that govern municipal liability under 42 U.S.C. § 1983 , Pietrzak's clandestine use of the database still cannot "fairly be said to represent official policy." Monell , 436 U.S. at 694 , 98 S.Ct. 2018 . Pietrzak admitted that the six obtainments within the limitations period "were not for any use in carrying out any law enforcement, governmental, judicial or litigation-related function." He accessed the database for personal reasons, not under the auspices of official policymaking authority, so his actions did not represent a policy of the City. See [*718] Pembaur v. City of Cincinnati , 475 U.S. 469 , 481-84, 106 S.Ct. 1292 , 89 L.Ed.2d 452 (1986). The district court thus properly refused to entertain direct liability against the City.

B.

In its cross-appeal, the City challenges the judgment that the City was vicariously liable for Pietrzak's violations of the DPPA. The district court determined that Pietrzak was acting within "the scope of the employment" or "the agency relationship" with the City when he accessed the database, so that vicarious liability applied. The City maintains, however, that liability under the DPPA "rests solely with the accessor of the information," and that only Pietrzak should be liable.

The DPPA does not address vicarious liability, but we assume that "when Congress creates a tort action, it legislates against a legal background of ordinary tort-related vicarious liability rules and consequently intends its legislation to incorporate those rules." Meyer v. Holley , 537 U.S. 280 , 285, 123 S.Ct. 824 , 154 L.Ed.2d 753 (2003). When the DPPA became law in 1994, it was well established that agents could bind their principals and render them liable when the agents were acting within the scope of their real or apparent authority. See Burlington Indus., Inc. v. Ellerth , 524 U.S. 742 , 755-56, 758-60, 118 S.Ct. 2257 , 141 L.Ed.2d 633 (1998) ; Am. Soc'y of Mech. Eng'rs, Inc. v. Hydrolevel Corp. , 456 U.S. 556 , 565-66, 102 S.Ct. 1935 , 72 L.Ed.2d 330 (1982). Under the "ordinary tort-related vicarious liability rules" then prevailing, a principal also was liable for an agent's actions outside the scope of his employment when the agent was "aided in accomplishing the tort by the existence of the agency relation." Restatement (Second) of Agency § 219(2)(d) (Am. Law Inst. 1958) ; see also Ellerth , 524 U.S. at 758-59 , 118 S.Ct. 2257 .

Accepting that Pietrzak was acting outside the scope of his employment when he impermissibly accessed the database, he nevertheless was "aided in accomplishing the tort" by his position as police chief. Pietrzak used a government-issued computer and official credentials to obtain Orduno's private information, and he could not have done so but for his official position. The City argues that the "aided in the agency relation" rule of vicarious liability has been abandoned by the most recent Restatement published in 2006. See Restatement (Third) of Agency § 7.07 (Am. Law Inst. 2006). But the relevant inquiry is what background principles were well established when the DPPA became law in 1994, and the Restatement (Second) of Agency prevailed then. Under that standard, the district court did not err in allowing vicarious liability. See, e.g. , Potocnik v. Carlson , No. 13-CV-2093 (PJS/HB), 2016 WL 3919950 , at *6-8 (D. Minn. July 15, 2016) ; Margan v. Niles , 250 F. Supp. 2d 63 , 75 (N.D.N.Y. 2003).

The City also argues that vicarious liability is inappropriate here because the DPPA provides for both civil and criminal liability. See 18 U.S.C. § 2723 . The only provisions at issue in this case, however, concern civil liability. Even where an act provides for both civil and criminal penalties, it is appropriate to consider background tort-related principles in determining the scope of civil liability. See Hydrolevel , 456 U.S. at 570-74 , 102 S.Ct. 1935 (addressing civil liability under the Sherman Act). That the City may be vicariously liable for damages based on the DPPA's incorporation of tort-related rules does not imply that the City is subject to criminal liability under the same standard. Background rules of criminal responsibility, for example, provide that a principal ordinarily is not criminally liable for the[*719] conduct of an agent who is not acting for the benefit of the principal. See United States v. Basic Constr. Co. , 711 F.2d 570 , 573 (4th Cir. 1983) (per curiam); United States v. One Parcel of Land , 965 F.2d 311 , 322 (7th Cir. 1992) (Posner, J., dissenting). We hold only that the district court correctly construed the civil action provisions of the DPPA to incorporate background tort-related rules of vicarious liability. ^[3]

IV.

Orduno raises two arguments concerning the district court's exclusion of evidence at trial. We afford substantial deference to the district court's evidentiary rulings and review for abuse of discretion. See Shelton v. Consumer Prods. Safety Comm'n , 277 F.3d 998 , 1009 (8th Cir. 2002).

Orduno first claims that the district court erred by excluding evidence of other occasions on which Pietrzak obtained driver's license data. Orduno sought to present evidence that Pietrzak obtained data about other persons in Minnesota and about Orduno on occasions outside the limitations period. The district court concluded that because Pietrzak admitted liability, and the jury's task was to determine damages flowing from the six unlawful obtainments, evidence of other obtainments was properly excluded under Federal Rule of Evidence 403. We conclude that there was no abuse of discretion. Allowing evidence of other obtainments risked encouraging the jury to award damages based on time-barred incidents for which Pietrzak could not be liable, or based on harm suffered by persons other than Orduno. The court permissibly ruled that the disputed evidence lacked probative value and carried too great a risk of unfair prejudice, confusing the issues, and wasting time in mini-trials over the propriety of other obtainments. See Fed. R. Evid. 403.

Second, Orduno challenges the court's exclusion of evidence concerning the City's response to Pietrzak's misconduct. The district court ruled that evidence of the City's official response was inadmissible because it did not cause any damages: "The damages flowed from the six illegal obtainments and the admission of liability." R. Doc. 287, at 30. Orduno argues that evidence of the City's inaction supported a larger award of punitive damages, because Pietrzak was not otherwise disciplined for his wrongful conduct by the City. But where no question of the City's direct liability was before the jury, the court did not abuse its discretion in focusing the trial on the harm that Pietrzak's six admitted violations caused Orduno.

Orduno next complains that the district court abused its discretion in disallowing sixty percent of her requested attorneys' fees and denying the reimbursement of expert costs. Under the DPPA, a court may award "reasonable attorneys' fees and other litigation costs reasonably incurred." 18 U.S.C. § 2724 (b)(3). The starting point for determining attorneys' fees is the "lodestar," which is calculated by multiplying the number of hours reasonably expended by the reasonable hourly rate. See Hensley v. Eckerhart , 461 U.S. 424 , 433, 103 S.Ct. 1933 , 76 L.Ed.2d 40 (1983). The party seeking fees bears the burden of establishing entitlement to an[*720] award and documenting the appropriate hours and hourly rates. Id. at 437 , 103 S.Ct. 1933 . We review the district court's award of fees for abuse of discretion. See Miller v. Dugan , 764 F.3d 826 , 831 (8th Cir. 2014).

The court first rejected forty percent of Orduno's requested fees due to excessive billing and overstaffing. The court found that Orduno's case was "not factually complex," and that "the legal issues involved are not particularly novel or difficult." After the dismissal of time-barred claims and the denial of class certification, the lawsuit boiled down to "one individual's accesses of Orduno's information on six occasions." The court observed that the volume of discovery and motion practice was relatively modest (ten depositions and five motions), and that the legal issues had recurred in dozens of cases filed in the district. The court ultimately concluded that a team of eight lawyers, from two law firms, was unnecessary to litigate Orduno's case, and that the hours billed were excessive.

In awarding fees, district courts must be mindful of both "redundant" and "excessive" hours. Hensley , 461 U.S. at 434 , 103 S.Ct. 1933 . Here, the court cited areas where Orduno's team seemed overstaffed and spent more time than necessary to complete a task. Despite the factual complexity of Orduno's complaint, the case was narrowed-as of eighteen months before trial-to Pietrzak's six impermissible obtainments. The trial itself was simplified greatly by Pietrzak's admission of liability, and it focused primarily on damages arising from alleged emotional distress. We afford great deference to a district court's on-the-ground assessment of whether requested fees are excessive, and we are not convinced to second-guess the ruling here.

The court reduced the requested amount of fees by another twenty percent based on Orduno's limited success. Degree of success is an important factor in determining a reasonable award of attorneys' fees. Id. at 436 , 103 S.Ct. 1933 . The court properly took into account that Orduno's case was the first to obtain punitive damages in Minnesota, and that the result exposed misconduct by a police chief and potentially deterred future misconduct. At the same time, however, Orduno failed to demonstrate that she suffered any actual damages, and she succeeded in obtaining only $15,000 in liquidated damages after requesting more than $1,000,000. The degree of success was partial. The district court did not abuse its discretion in reducing the requested award by twenty percent on that basis.

Orduno also objects to the court's denial of reimbursement for the costs of a forensic expert who extracted data from Pietrzak's work computer. But "absent explicit statutory or contractual authorization for the taxation of the expenses of a litigant's witnesses as costs, federal courts are bound by the limitations set out in 28 U.S.C. § 1821 and § 1920." Crawford Fitting Co. v. J.T. Gibbons, Inc. , 482 U.S. 437 , 445, 107 S.Ct. 2494 , 96 L.Ed.2d 385 (1987). The DPPA does not explicitly authorize the taxation of the expert witness fees as costs, and neither § 1821 nor § 1920 allows them. The district court thus did not err in declining to award the requested costs.

* * *

For the foregoing reasons, the judgment of the district court is affirmed. The City's motion to strike portions of Orduno's appendix and brief is denied.