January 3, 2012
John Stone, Senior Attorney, National Legal Research Group
It should not come as a surprise to most people that when an individual gets a driver's license from a State, he or she necessarily gives the State some personal information that is then stored in a database for use by the Division of Motor Vehicles ("DMV"). Typically this information includes name, address, telephone number, vehicle description, Social Security number, some medical information, and a photograph. What may not be so commonly known is that the States legally can and do turn around and sell that information to individuals, businesses, and other governmental entities.
There are some federal statutory limits on the States' ability to sell DMV driver record information. In a recent case, Howard v. Criminal Information Services, 654 F.3d 887 (9th Cir. 2011), the Ninth Circuit heard appeals from two essentially identical class actions that had been filed in two different states, by different groups of plaintiffs, seeking damages on the ground that their personal information had been obtained by defendant companies in violation of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§ 2721–2725. That statute provides that personal information from state driver's license databases can be obtained, disclosed, or used only for certain specified purposes. The 14 enumerated permissible purposes include, in addition to those directly related to motor vehicles, such purposes as court or law enforcement functions; verification of information by businesses, including employers; research activities; and insurance purposes. All in all, the list and scope of permissible purposes for obtaining DMV information on drivers is rather broad, and it is little wonder that companies decide to mine these databases.
In the case before the Ninth Circuit, a newspaper company had used the information in reporting stories involving the operation or safety of motor vehicles. Another company had found the information helpful in performing background checks; it used the information to verify personal information submitted by the person about whom the background check was being performed. Another of the defendants had used the information to perform research about motor vehicles. A parking lot management business had used the information to check information provided by its customers and to provide notice to owners of towed or impounded vehicles. These businesses had determined that it is neither efficient nor cost‑effective to request records piecemeal—that is, individually, each time they had a need for the information—or to be limited to getting the information during business hours when the state agency is open. Instead, they purchased the entire database from the State "in bulk" so as to be able to access specific information as and when the need arose.
Thus, in the consolidated cases, each of the defendants had purchased driver record information in advance and in bulk so that it would have the information available for its possible future use. The plaintiffs did not complain that the ultimate use of the information by any of the defendants had been for a purpose not permitted under the DPPA. They argued, however, that the DPPA forbids bulk purchasing of drivers' personal information for future use, because obtaining the information for future use is not itself a permitted purpose under the DPPA. Joining other courts that had dealt with similar claims, the Ninth Circuit concluded that the defendants' actions, sometimes referred to as "stockpiling" information, were not unlawful under the DPPA, and it affirmed the dismissal of the actions by the federal district courts.



