Driver’s Privacy Protection Act

Driver’s Privacy Protection Act
Name	Driver’s Privacy Protection Act
Enacted by	United States Congress
Enacted	1994
Citations	18 U.S.C. § 2721–2725
Signed by	William J. Clinton
Date signed	1994-10-28
Status	in force

Driver’s Privacy Protection Act

The Driver’s Privacy Protection Act (DPPA) is a United States federal law enacted in 1994 to restrict access to and use of personal information in state motor vehicle records after concerns following the Murder of Selena and other incidents. It establishes a federal statutory scheme governing disclosure by state Department of Motor Vehicles agencies and creates civil remedies against improper disclosure, drawing on precedents from Privacy Act of 1974 debates and legislative responses to Privacy International-era privacy incidents in the early 1990s.

Background and Legislative History

Congress debated the DPPA in the context of incidents involving misuse of motor vehicle information, including the Murder of Rebecca Schaeffer, the Murder of Selena, and public concern spurred by cases like Koons v. United States-era privacy discussions. Sponsors included members of the 103rd United States Congress and committees such as the United States Senate Committee on Commerce, Science, and Transportation and the United States House Committee on Energy and Commerce. Legislative hearings referenced positions advanced by advocacy groups like Electronic Frontier Foundation, American Civil Liberties Union, and industry stakeholders including the American Association of Motor Vehicle Administrators and the National Motorists Association. The Act interacted with earlier statutory frameworks including the Freedom of Information Act and the Privacy Act of 1974 and reflected concerns raised during the tenure of Janet Reno and policy debates involving Newt Gingrich-era proposals.

Provisions and Scope

The statute regulates access to personal information maintained by state motor vehicle agencies such as the California Department of Motor Vehicles, Florida Department of Highway Safety and Motor Vehicles, and the New York Department of Motor Vehicles. It defines "personal information" to include items like name, address, and driver's license number, aligning with privacy concepts discussed in cases like Roe v. Wade-era confidentiality and administrative-law treatments exemplified by Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc.. The DPPA prescribes obligations for disclosure and record-keeping comparable to provisions in statutes such as the Health Insurance Portability and Accountability Act of 1996 for protected categories and echoes themes present in Griswold v. Connecticut privacy jurisprudence. Agencies must establish policies to limit dissemination of records to entities including courts like the United States District Court for the Southern District of New York or investigative bodies such as the Federal Bureau of Investigation, subject to statutory criteria.

Exceptions and Permissible Uses

The statute enumerates exceptions allowing disclosure for purposes such as law enforcement by entities like the Drug Enforcement Administration or the Bureau of Alcohol, Tobacco, Firearms and Explosives, motor vehicle safety research by organizations such as the National Highway Traffic Safety Administration, and use by insurers like Geico and State Farm Insurance for claims investigation. It permits sharing with government agencies including the Internal Revenue Service and the Social Security Administration for statutorily defined functions, and with private parties for matters like towing and vehicle repossession handled by firms similar to Penske Corporation. Exceptions also cover disclosures incident to judicial processes in courts such as the United States Court of Appeals for the Ninth Circuit and compliance with orders from tribunals like the United States Supreme Court when applicable.

Enforcement and Penalties

Enforcement provisions create civil causes of action allowing individuals to sue for statutory damages, actual damages, and attorney's fees in federal courts including the United States District Court for the District of Columbia. State attorneys general, for example the Attorney General of California or the Attorney General of Texas, may bring enforcement actions for pattern or practice violations, reflecting enforcement models used under statutes like the Fair Credit Reporting Act and the Telephone Consumer Protection Act. Criminal penalties can attach where disclosure involves willful conduct that violates other federal statutes enforced by agencies such as the Department of Justice or the Federal Trade Commission through ancillary actions.

Impact and Legal Challenges

The DPPA has been litigated in cases before courts including the United States Supreme Court and various circuit courts such as the United States Court of Appeals for the Eleventh Circuit and the United States Court of Appeals for the Fourth Circuit. Plaintiffs and defendants have included media organizations like The New York Times Company and corporations such as Facebook-era entities addressing third-party access. Key issues have involved preemption questions against state law, First Amendment challenges invoking precedents like New York Times Co. v. Sullivan and statutory construction disputes drawing on Gonzales v. Raich-style interpretive approaches. The Act influenced state policies at agencies such as the Massachusetts Registry of Motor Vehicles and spurred compliance programs in private firms including LexisNexis and Carfax, while advocacy organizations such as Privacy Rights Clearinghouse tracked enforcement trends.

State Implementation and Interaction with Other Laws

States implemented DPPA requirements through statutes and agency rulemaking in jurisdictions including California, Texas, Florida, New York, and Illinois. Interaction with state public records laws like California Public Records Act created friction in cases resolved in state courts and federal circuits, and coordination with federal statutes such as the Driver License Compact-related agreements and the Real ID Act of 2005 adjusted disclosure practices. State motor vehicle agencies collaborated with national bodies such as the American Association of Motor Vehicle Administrators to harmonize policies and with private database services including Experian and TransUnion to manage permissible access, while legislative amendments at state legislatures like the Florida Legislature aligned local codes with federal DPPA mandates.

Category:United States federal privacy legislation