The court concluded that the DPPA bore unconstitutionally on state governments. The Seventh and Tenth Circuits roundly criticized Condon . Congress is free, the courts argued, to regulate the activities of the states, so long as Congress does not attempt to commander the legislative processes of the states. 16 Congress is not limited, the courts continued, to regulating the states only through generally applicable laws, as the Fourth Circuit had urged. Laws may be enacted that fall exclusively on the states, especially when similar laws already regulate the conduct of private parties.
Privacy law is a prime example.
A litany of laws has long regulated private handling of data. Although the DPPA bears solely on states, it is merely a continuation of an existing scheme of regulation that applies to private and public entities alike. Nor does the DPPA commandeer the administrative processes of the states, the courts argued. Under this argument, the Seventh and Tenth Circuits concluded that Congress had properly passed the DPPA pursuant to its powers under the Commerce Clause. The DPPA raises novel questions of privacy law that were largely sidestepped by the courts.