January 3, 2012
John Stone, Senior Attorney, National Legal Research Group
It should not come as a surprise to most people that when an individual gets a driver's license from a State, he or she necessarily gives the State some personal information that is then stored in a database for use by the Division of Motor Vehicles ("DMV"). Typically this information includes name, address, telephone number, vehicle description, Social Security number, some medical information, and a photograph. What may not be so commonly known is that the States legally can and do turn around and sell that information to individuals, businesses, and other governmental entities.
There are some federal statutory limits on the States' ability to sell DMV driver record information. In a recent case, Howard v. Criminal Information Services, 654 F.3d 887 (9th Cir. 2011), the Ninth Circuit heard appeals from two essentially identical class actions that had been filed in two different states, by different groups of plaintiffs, seeking damages on the ground that their personal information had been obtained by defendant companies in violation of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721–2725. That statute provides that personal information from state driver's license databases can be obtained, disclosed, or used only for certain specified purposes. The 14 enumerated permissible purposes include, in addition to those directly related to motor vehicles, such purposes as court or law enforcement functions; verification of information by businesses, including employers; research activities; and insurance purposes. All in all, the list and scope of permissible purposes for obtaining DMV information on drivers is rather broad, and it is little wonder that companies decide to mine these databases.
In the case before the Ninth Circuit, a newspaper company had used the information in reporting stories involving the operation or safety of motor vehicles. Another company had found the information helpful in performing background checks; it used the information to verify personal information submitted by the person about whom the background check was being performed. Another of the defendants had used the information to perform research about motor vehicles. A parking lot management business had used the information to check information provided by its customers and to provide notice to owners of towed or impounded vehicles. These businesses had determined that it is neither efficient nor cost‑effective to request records piecemeal—that is, individually, each time they had a need for the information—or to be limited to getting the information during business hours when the state agency is open. Instead, they purchased the entire database from the State "in bulk" so as to be able to access specific information as and when the need arose.
Thus, in the consolidated cases, each of the defendants had purchased driver record information in advance and in bulk so that it would have the information available for its possible future use. The plaintiffs did not complain that the ultimate use of the information by any of the defendants had been for a purpose not permitted under the DPPA. They argued, however, that the DPPA forbids bulk purchasing of drivers' personal information for future use, because obtaining the information for future use is not itself a permitted purpose under the DPPA. Joining other courts that had dealt with similar claims, the Ninth Circuit concluded that the defendants' actions, sometimes referred to as "stockpiling" information, were not unlawful under the DPPA, and it affirmed the dismissal of the actions by the federal district courts.
The plaintiffs' allegation that the defendants had obtained the information for the improper purpose of stockpiling misconstrued the meaning of "purpose." "Purpose" is defined as something that one sets before oneself as an object to be attained, an end or aim to be kept in view. Stockpiling was plainly not the defendants' "purpose" for obtaining the information, as that term is used in the statute. The object or end to be attained by the defendants in obtaining the driver record information—the reason they wanted the information—was not just to have it available: The defendants had obtained the information so that they would be able to use it for eventual or ultimate purposes that the plaintiffs conceded were allowed by the statute.
The plaintiffs' argument also confused the defendants' purposes for obtaining the information with their reasons for obtaining the information in bulk form. By purchasing the entire database in bulk rather than waiting to obtain individual records when they were needed, the defendants no doubt wanted to make their access to the information easier when the time came to use it, and they also probably hoped to get the information at a lower cost than would be incurred by requesting one record at a time. But those were not, in any real sense, the "purposes" for obtaining the information. At this point in its reasoning, the court employed an unusual, though apt, analogy:
Someone who buys toilet paper in a package of 48 rolls from a warehouse store, for example, ordinarily buys it for the same purpose as the person who buys it one roll at a time. That it might save money or extra trips to the store to buy in bulk isn't why the toilet paper is bought in the first place.
Id. at 890.
The court observed that if Congress had meant to prohibit the sale of a State's driver record database in bulk, the statute could have, and presumably would have, said as much. Instead, the legislation was written in a way that logically put the focus on the purposes for which the information would eventually be used—on the "end" sought by the purchaserCnot on the reason for buying it in bulk.
It also did not save the plaintiffs' case that the acquired personal information had been obtained for its potential for future use and, as to the majority of records, might never actually be used. The DPPA does not contain a time requirement for when the information obtained must be used for the permitted purpose. Nor is there a requirement that the information actually be used at all once it has been obtained for a permitted purpose.
The Ninth Circuit drew upon precedents reaching the same outcome on similar challenges under the DPPA in other federal circuits. See Taylor 10833 v. Acxiom Corp., 612 F.3d 325, 340 (5th Cir. 2010) ("A person who buys DMV records in bulk does so for the purpose of making permissible actual use of information therein under [the DPPA], even if that person does not actually use every single item of information therein."), cert. denied, 131 S. Ct. 908 (2011); Roth v. Guzman, 650 F.3d 603, 614-17 (6th Cir. 2011) (citing Taylor, 612 F.3d 325).
