Opinion ID: 1967106
Heading Depth: 1
Heading Rank: 3

Heading: Access to Personal Information.

Text: Many state and federal statutes limit or prohibit access to records maintained by government. See generally 76 C.J.S. Records § 74, at 149-151 (1994). Congress added to this growing list of statutes in 1994 by enacting the Driver's Privacy Protection Act (DPPA). 18 U.S.C. §§ 2721-2725 (1994 & Supp.2001). This Act generally regulates the authority of state motor vehicle departments to disclose personal information maintained in their records. DeVere v. Attorney Gen., 146 N.H. 762, 781 A.2d 24, 26 (2001). Congress enacted the Act largely in response to the mounting public safety concerns over the easy access by stalkers and other criminals of personal information maintained by state motor vehicle departments. [2] Congress also sought to curb the common practice by many states of selling information in motor vehicle records to businesses, marketers, and individuals. Reno v. Condon, 528 U.S. 141, 143-44, 120 S.Ct. 666, 668, 145 L.Ed.2d 587, 591 (2000). The federal act generally restricts states from disclosing personal information in a driver's motor vehicle record to any person or entity without the driver's affirmative consent. Id. at 144-45, 120 S.Ct. at 669, 145 L.Ed.2d at 592 (citing 18 U.S.C. § 2721, as amended). Thus, the general ban imposed on the disclosure of personal information does not apply if a driver consents to the release of the data. Id. The Act defines the restricted personal information two ways. First, it defines personal information to mean information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information.... See 18 U.S.C. § 2725(3). It then defines highly restricted personal information, to mean an individual's photograph, social security number, or medical or disability information. See id. § 2725(4). Despite the general prohibition against disclosure of personal information contained in motor vehicle records, Congress understood that there are legitimate reasons for the dissemination of such information. Thus, the Act carves out exceptions for both mandatory and permissive disclosure. First, states must disclose personal information for use in carrying out the provisions of certain federal statutes. See id. § 2721(b). Second, states are given discretionary authority to disclose personal information for a number of purposes. The DPPA lists eleven categories of reasons or purposes for the nonconsensual discretionary disclosure of information. Id. § 2721(b)(1)-(10), (14); see also Maginnis, 51 S.C. L.Rev. at 809. These categories are: For use by any government agency or by any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions, § 2721(b)(1); for use in connection with car safety, car theft, and promotion of driver's safety, § 2721(b)(2); for use by a business to verify personal information submitted to it and to prevent fraud or to pursue legal remedies if the information submitted to the business is inaccurate, § 2721(b)(3); in connection with court, agency, or self-regulatory proceedings, § 2721(b)(4); for research purposes so long as the information is not further disclosed, § 2721(b)(5); for use by insurers, § 2721(b)(6); to notify motor vehicle owners that their vehicle has been towed or impounded, § 2721(b)(7); for use by licensed private investigators for the purposes permitted under the DPPA, § 2721(b)(8); for use by an employer to obtain or verify information, § 2721(b)(9); in connection with private toll transportation services, § 2721(b)(10); and for any state authorized purpose relating to the operation of a motor vehicle or public safety, § 2721(b)(14). The Act also lists three categories or reasons for disclosure based on expressed consent of the person to whom the information pertains. 18 U.S.C. § 2721(b)(11)-(13). States may disclose personal information if the use falls within one of the fourteen categories, and may disclose highly restricted personal information only for uses permitted in 18 U.S.C. § 2721(b)(1), (b)(4), (b)(6), and (b)(9). Id. § 2721(a)(1). The DPPA also permits the limited resale or redisclosure of personal information. Id. § 2721(c). Thus, the disclosure restrictions of the Act apply not only to state government, but also apply to persons or entities who have obtained the information from motor vehicle departments. See Reno, 528 U.S. at 146, 120 S.Ct. at 669, 145 L.Ed.2d at 592-93. Generally, an authorized recipient of a driver's personal information may resell or redisclose the information only for a permissible purpose. 18 U.S.C. § 2721(c). There are substantial fines and penalties imposed for state agencies or private persons who violate the provisions of the Act, in addition to liability in civil proceedings. See id. § 2723. Following in the footsteps of the DPPA, our legislature amended section 321.11 to provide that records of the Department of Transportation are open to public inspection except those made confidential and not permitted to be open under the DPPA. Iowa Code § 321.11(1) (as amended). The statute declares that personal information shall not be disclosed to a requestor, except as provided in 18 U.S.C. § 2721, unless the person whose personal information is requested has expressly consented. Iowa Code § 321.11(2). Personal information is defined under section 321.11(2) to mean: [I]nformation that identifies a person, including a person's photograph, social security number, driver's license number, name, address, telephone number, and medical or disability information, but does not include information on vehicular accidents, driving violations, and driver's status or a person's zip code. This definition is nearly identical to the definition under the DPPA. Yet, unlike the DPPA, the statute does not distinguish between personal information and highly restricted personal information. It does, however, limit the disclosure of a person's photograph to specific persons or agencies. Id. § 321.11(4). The statute further prohibits the release of personal information, with limited exceptions, when disclosure of the information is requested by the presentation of a registration plate number. Id. § 321.11(3).
Worldwide centers on the manner the DPPA permits disclosure of personal information to support its claim to access of the information. Under each category, disclosure is ultimately permitted based on the use of the information. Thus, Worldwide argues that its use falls within the various categories because the reformatting of the information onto disks facilitates the usefulness of the information, and it only sells its computer disk to those who would be permissible users of the information under one of the authorized categories of use. Worldwide asserts this satisfies the purposes behind the DPPA because its use of the information not only assists those who are properly authorized to utilize the information, but the restrictions on its consumer base also protects the privacy interest sought to be maintained by Congress. [3] Before we turn to examine Worldwide's claims in light of the relevant statutes, it is important to recognize that our goal in construing statutes is to ascertain the legislative intent. Perkins v. Madison County Livestock & Fair Ass'n, 613 N.W.2d 264, 269 (Iowa 2000). This is done by first focusing on the language used by the legislature. Id. In doing so, we consider the statute in its entirety and interpret its provisions in relationship to the whole. State v. Carpenter, 616 N.W.2d 540, 542 (Iowa 2000). This provides us the best opportunity to discern the interpretation and construction that best effects the purpose of the statute. See State v. Iowa Dist. Ct., 620 N.W.2d 271, 273 (Iowa 2000). The language of the DPPA as a whole makes it plain that Congress and, in turn, our legislature, sought to limit access to personal information in state motor vehicle records by both protecting citizens from the improper use of such information, while allowing access for legitimate purposes or uses. At the same time, it imposed a gatekeeping function on the state departments of motor vehicles to exercise discretion to disclose personal information when used for the purposes described in subsection (b). Thus, disclosure essentially depends on the use sought for the information, and the states are charged with the responsibility to ensure that disclosure is limited to those circumstances where Congress determined that the use for the information trumps the competing privacy interest. Yet, we do not read the statute to permit disclosure in the manner asserted by Worldwide. Our review of the disclosure requirements of 18 U.S.C. § 2721(b) reveals some of the categories of permissible uses identify a specific user. See § 2721(b)(1) (use by government agency or private person); § 2721(b)(3) (use by legitimate business); § 2721(b)(6) (use by insurer); § 2721(b)(8) (use by private investigative agency); § 2721(b)(9) (use by employer); § 2721(b)(13) (use by any requester with written consent). Other categories solely consider the manner of use. See § 2721(b)(2) (use in connection with motor vehicle safety, prevention of motor vehicle theft, and promotion of driver's safety); § 2721(b)(4) (use in connection with court and agency proceedings); § 2721(b)(5) (use in research activities); § 2721(b)(7) (use in providing notice to owners that their vehicle has been towed or impounded); § 2721(b)(10) (use in connection with private toll transportation services); § 2721(b)(11) (for any use when consent is obtained); § 2721(b)(12) (for bulk distribution of surveys, marketing or solicitations when consent obtained); and § 2721(b)(14) (any state authorized purpose pertaining to the operation of a motor vehicle or public safety). Yet, even the permissible users of nonconsensual information are limited in the manner the information may be used. See § 2721(b)(1) (for use by a government agency in carrying out its functions ); § 2721(b)(3) (use by business to verify or to obtain information); § 2721(b)(6) (use by insurer in connection with claims investigation); § 2721(b)(8) (use by private investigator for any permitted purpose); § 2721(b)(9) (use by employer to obtain or verify information); § 2721(b)(13) (use by requester if based on written consent). Thus, for example, a government agency could not receive personal information under § 2721(b)(1) if the information was being used for a private purpose. See DeVere, 781 A.2d at 29. Similarly, a private entity could not obtain personal information if used for a private purpose or if the entity was otherwise not acting on behalf of a government agency in carrying out its functions. See 18 U.S.C. § 2721(b)(1). Additionally, a licensed private investigator could not receive personal information under § 2721(b)(8) if the information was not being used for one of the permitted purposes. Id. § 2721(b)(8). In fact, a user is permitted access to information only when the information will be used for the permitted purpose, subject only to two exceptions. The Act imposes no restrictions on the type of use when the requester of the information has obtained consent of the individual to whom the information pertains. Id. § 2721(b)(13). Likewise, any type of use will support disclosure when in response to requests the State previously had obtained the express consent of the person to whom the information pertains. Id. § 2721(b)(11). We think this approach taken by Congress to the dissemination of personal information in motor vehicle records contemplates that the person or entity requesting disclosure of the personal information also be the person or entity that will use the information for the statutory purpose. Thus, nonconsensual disclosure of information is permitted only for approved uses, and disclosure is not permitted if the requester is not seeking to use the information for the statutory purpose. The statute does not permit disclosure to a nonuser, who only seeks information to redisclose it for use under a permitted purpose. Redisclosure of the information is allowed only for a permitted purpose and can only occur if the information was initially disclosed by the state to an authorized recipient. Id. § 2721(c). Clearly, any other interpretation would render the statute impractical, and essentially render the state incapable of performing its gatekeeping function under the statute. The important task of protecting individual privacy interests recognized by Congress would be undermined by permitting a requester to determine the eligibility to receive the information. Thus, the claimed restrictions on Worldwide's customer base do not justify disclosure under the Act. Worldwide must itself be an authorized user. Worldwide argues that its process of placing the information onto disks for authorized users to use is itself a use of the information for a statutory purpose. Worldwide emphasizes that its disks benefit authorized users, such as law enforcement agencies, by allowing them to quickly and efficiently utilize the information. We understand how the computerization of records benefits legitimate users of the information, but we think Congress would have specifically identified reformatting information as an authorized use if it intended to permit disclosure of the information for that purpose. Congress provided a long list of uses but failed to include the use engaged in by Worldwide. Generally, the express mention of one thing in a statute implies the exclusion of others. Callender v. Skiles, 591 N.W.2d 182, 186 (Iowa 1999). Thus, when a legislative body delineates exceptions, it is presumed that no others were created or intended. Elliott v. Iowa Dep't of Pub. Safety, 374 N.W.2d 670, 672 (Iowa 1985). Clearly, Congress did not provide a specific category of use for businesses like Worldwide. Instead, we think Congress envisioned that the categories of use relate to the actual use of the information that directly serves the permitted purpose and involve those entities that carry out such purposes. We recognize, as well, that the disks marketed by Worldwide do not serve any of the categories of purposes in any manner until the disks are actually sold. Thus, the actual and specific use of the information by Worldwide does not fit into any permitted purpose under the statute until resale. Yet, resale or redisclosure to authorized users is not the test for disclosure by the state, and redisclosure to an authorized recipient alone does not satisfy the test of disclosure. See 18 U.S.C. § 2721(c). Worldwide cannot utilize the use of another person or entity to support disclosure. Notwithstanding, Worldwide argues that it, at least, is entitled to personal information for distribution to government agencies under § 2721(b)(1) and for distribution to private investigators under § 2721(b)(8). Subsection (b)(1) permits disclosure: For use by any government agency, including any court or law enforcement agency, in carrying out its functions, or any private person or entity acting on behalf of a Federal, State, or local agency in carrying out its functions. Worldwide asserts that it is acting on behalf of a Federal, State, or local agency in carrying out its functions by reformatting the information onto disks for use by various government agencies. A review of the evidence in this case reveals Worldwide is not acting on behalf of any government agency in carrying out its functions by reformatting the information onto disks. Worldwide is a private business that computerizes information that can relate to a government function in a general way, but it does not act as a government agency and does not act for a government agency. It sells and markets its disks to a vast array of entities, including lawyers, private investigators, insurance companies, and others. Clearly, it acts for itself and does not carry out a function of government. A private entity does not act for government, and carry out government functions, by manufacturing a product used by government. Thus, Worldwide qualifies as a private entity under the language of § 2721(b)(1), but does not use the information for the permitted purpose that would enable the Department to exercise its discretion to disclose the information. For the same reason, Worldwide does not fall within the discretionary disclosure category for private investigators. Although Worldwide is a licensed private investigator, its use of the information does not fit within any permitted purpose as required under 18 U.S.C. § 2721(b)(8). We conclude the use of the information by Worldwide does not support disclosure. The purpose for which Worldwide seeks the information does not fall within any purpose delineated in 18 U.S.C. § 2721(b).
Worldwide next asserts that it is an agent of its customers and if the customer is authorized to receive the information under the statute, it is authorized to receive the information as an agent of the customer. It is not necessary for us to determine if Congress or our legislature intended the information to be disclosed under an agency theory. Clearly, the relationship between Worldwide and its customers falls far short of an agency relationship. An agency relationship results only when there is an understanding between the parties that creates a fiduciary relationship under which the fiduciary is subject to the directions of the principal and acts on account of the principal. Benson v. Webster, 593 N.W.2d 126, 130 (Iowa 1999). Worldwide is not subject to control of its customers and does not act on account of its customers. The relationship, plain and simple, is one of seller and buyer, and Worldwide cannot artificially create an agency relationship by designating the relationship as an agency in its request forms. See Ward v. Mgmt. Analysis Co. Employee Disability Benefit Plan, 135 F.3d 1276, 1284 (9th Cir.1998) (existence of agency relationship is not governed by a party's stipulation).