The Driver’s Privacy Protection Act

The Act bars a state department of motor vehicles, and its officers, employees, and contractors, from knowingly disclosing personal information obtained in connection with a motor vehicle record, except as the Act allows (2721(a)). It also makes it unlawful for any person to knowingly obtain or disclose that information for a use the Act does not permit, or to make a false representation to get it (2722).

A motor vehicle record is any record that pertains to a motor vehicle operator’s permit, title, registration, or identification card issued by a department of motor vehicles (2725(1)).

Personal information is information that identifies an individual. The definition lists photograph, Social Security number, driver identification number, name, address (but not the 5-digit ZIP code), telephone number, and medical or disability information. It does not include information on vehicular accidents, driving violations, and driver’s status (2725(3)).

Some information gets more protection. Highly restricted personal information means a photograph or image, Social Security number, and medical or disability information (2725(4)). A department may not disclose it without the express consent of the person it concerns, except for uses permitted under 2721(b)(1), (b)(4), (b)(6), and (b)(9). Express consent means consent in writing, including electronic consent with an electronic signature (2725(5)).

Subsection 2721(b) lists 14 permissible uses. For licensed investigators, paragraph (8) is the starting point. It allows use “by any licensed private investigative agency or licensed security service for any purpose permitted under this subsection.” In plain terms, the license is not a purpose. The investigator still needs one of the other uses on the list. The ones most often relevant are these:

• Government functions (b)(1). Use by a government agency, including a court or law enforcement agency, in carrying out its functions, or by a private person or entity acting on its behalf.
• Verification by a business (b)(3). Use in the normal course of business by a legitimate business or its agents, but only to verify personal information the individual submitted to the business. If that information is wrong or out of date, the business may obtain the correct information only to prevent fraud by, pursue legal remedies against, or recover on a debt or security interest against, the individual.
• Legal proceedings (b)(4). Use in connection with a civil, criminal, administrative, or arbitral proceeding in a federal, state, or local court or agency or before a self-regulatory body. This includes service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders, or use under a court order.
• Insurance (b)(6). Use by an insurer, insurance support organization, or self-insured entity, or its agents, employees, or contractors, in connection with claims investigation, antifraud activities, rating, or underwriting.
• Written consent (b)(13). Use by any requester who shows it has the written consent of the individual the information concerns.

Each state runs its own request process and forms. When a request does not fit an exception, the Act lets a state department mail a copy of it to the individual, with a statement that the information will not be released unless the individual waives the right to privacy under the Act (2721(d)).

An authorized recipient may resell or redisclose personal information only for a use permitted under 2721(b), with special rules for recipients under (b)(11) and (b)(12). Any authorized recipient, except one under (b)(11), that resells or rediscloses must keep for 5 years records identifying each person or entity that receives the information and the permitted purpose. The recipient must make those records available to the motor vehicle department on request (2721(c)).

A report to a client that includes this information is a redisclosure, so the client’s purpose must also be permitted.

A person who knowingly violates the Act shall be fined under Title 18 (2723(a)). A state department of motor vehicles with a policy or practice of substantial noncompliance faces a civil penalty imposed by the Attorney General of not more than $5,000 a day for each day of substantial noncompliance (2723(b)).

The individual whose information was misused may sue in federal district court. A person who knowingly obtains, discloses, or uses personal information from a motor vehicle record for a purpose not permitted is liable to that individual (2724(a)). The court may award actual damages, but not less than liquidated damages of $2,500; punitive damages on proof of willful or reckless disregard of the law; reasonable attorney’s fees and litigation costs; and other preliminary and equitable relief (2724(b)).

• The Act ties every request to a purpose. Investigators commonly identify the specific 2721(b) use before a request is made, not after.
• The client’s reason for the work matters. A request that is lawful for the investigator can become unlawful if the information is passed on for a purpose the Act does not permit.
• Many investigators keep a written file note for each request: who asked, the permissible use, and who received the result. That supports the 5-year record-keeping duty in 2721(c).
• State law may add its own limits. Check your state’s motor vehicle agency rules as well as the federal Act.

• 18 U.S.C. 2721, Prohibition on release and use of certain personal information
• 18 U.S.C. 2722, Additional unlawful acts
• 18 U.S.C. 2723, Penalties
• 18 U.S.C. 2724, Civil action
• 18 U.S.C. 2725, Definitions
• 18 U.S.C. chapter 123, official text on govinfo