Opinion ID: 218670
Heading Depth: 3
Heading Rank: 1

Heading: Driver's Privacy Protection Act of 1994

Text: The federal DPPA was enacted in response to growing concerns over the ease with which stalkers and other criminals could obtain personal information from state departments of motor vehicles. [2] Reno v. Condon, 528 U.S. 141, 143-44, 120 S.Ct. 666, 145 L.Ed.2d 587 (2000). Congress was also concerned about the practice in many states of selling personal information from motor vehicle records to businesses, marketers, and others for, at times, significant revenue. Id. The DPPA, held to be a proper exercise of the power to regulate interstate commerce, established a regulatory scheme that both mandates and restricts the disclosure of personal information from records maintained by state motor vehicle departments. Id. at 148, 120 S.Ct. 666. At all times relevant to this case, the DPPA, as amended, imposed the following general prohibitions against the disclosure of personal information obtained from an individual's motor vehicle record: (a) In general.A State department of motor vehicles, and any officer, employee, or contractor thereof, shall not knowingly disclose or otherwise make available to any person or entity: (1) personal information, as defined in 18 U.S.C. [§ ] 2725(3), about any individual obtained by the department in connection with a motor vehicle record, except as provided in subsection (b) of this section; or (2) highly restricted personal information, as defined in 18 U.S.C. § 2725(4), about any individual obtained by the department in connection with a motor vehicle record, without the express consent of the person to whom such information applies, except uses permitted in subsections (b)(1), (b)(4), (b)(6), and (b)(9); Provided, That subsection (a)(2) shall not in any way affect the use of organ donation information on an individual's driver's license or affect the administration of organ donation initiatives in the States. 18 U.S.C. § 2721(a)(1)-(2) (emphasis added). Personal information is defined as information that identifies an individual, including an individual's photograph, social security number, driver identification number, name, address (but not the 5-digit zip code), telephone number, and medical or disability information. Id. at § 2725(3). Highly restricted personal information is defined as an individual's photograph or image, social security number, medical or disability information. Id. at § 2725(4). Section 2721(b) carves out both mandatory and permissive exceptions to the general prohibitions in subsection (a). Id. at § 2721(b). First, states must disclose personal information for use in carrying out the purposes of several federal statutes not relevant here. Second, states may disclose personal information (subject to § 2721(a)(2)), for any of the permissible uses or purposes listed in § 2721(b)(1)-(14). Eleven of these permissible usesincluding for use in the normal course of business under § 2721(b)(3)authorize nonconsensual disclosure of personal information. Id. at § 2721(b)(1)-(10) and (14). The other three permissible uses require the express consent of the persons to whom the information pertains. Id. at § 2721(b)(11)-(13). The DPPA also regulates the resale or redisclosure of personal information in § 2721(c), which provides, in pertinent part, that: An authorized recipient of personal information (except a recipient under subsection (b)(11) or (12)) may resell or redisclose the information only for a use permitted under subsection (b) (but not for uses under subsection (b)(11) or (b)(12)). Id. at § 2721(c) (emphasis added). Subsection (c) also imposes a record-keeping obligation on [a]ny authorized recipient (except a recipient under subsection (b)(11)) that resells or rediscloses personal information covered by this chapter to keep for five years records identifying each person or entity that receives information and the permitted purpose for which the information will be used and must make such records available to the motor vehicle department upon request. Id. [3] The DPPA makes it unlawful for any person knowingly to obtain or disclose personal information, from a motor vehicle record, for any use not permitted under [§ ] 2721(b), or to make false representation to obtain any personal information from an individual's motor vehicle record. 18 U.S.C. § 2722(a)-(b). A person who knowingly violates the DPPA is subject to criminal fine, id. at § 2723(a), and may be held civilly liable for actual damages (but not less than $2,500 in liquidated damages), punitive damages, attorney fees, and appropriate equitable relief, id. at § 2724. A person is defined as an individual, organization or entity, but does not include a State or agency thereof, id. at § 2725(2). Instead, the Attorney General may impose civil penalties if a state has a policy or practice of substantial noncompliance with the DPPA, id. at § 2723(b) (civil penalty of not more than $5,000 per day).