High Court to Rule on Exception to Driver's Privacy Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

The U.S. Supreme Court on September 25 agreed to hear a case that could clarify what uses of personal information obtained from driver's license and vehicle registration databases are "permissible" under the federal Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. §§2721-2725. The DPPA regulates the disclosure of personal information contained in the records of state motor vehicle departments. The DPPA permits the disclosure of protected personal information for several "permissible uses" listed in §2721(b).

The Court granted a petition for certiorari filed by individuals asking the Court to review a decision of the U.S. Court of Appeals in Richmond (CCH Privacy Law in Marketing ¶60,751), holding that four attorneys who obtained motor vehicle records of South Carolina vehicle buyers for the purpose of engaging in mass solicitation without consent-a purpose prohibited by the DPPA-could not be liable for violating the DPPA, as a matter of law. According to the appellate court, the attorneys made permissible use of the buyers' personal information protected by the DPPA, specifically, use in connection with litigation, including investigation in anticipation of litigation, and the solicitation was conducted in the course of that permissible use.

The attorneys had sent several FOIA requests to the South Carolina Department of Motor Vehicles seeking information regarding individuals who purchased automobiles during specific periods of time, including the name, address, and telephone number of the buyer; the dealership where the automobile was purchased; the type of vehicle purchased; and the date of the purchase. The attorneys then mailed a letter to the individuals whose information was obtained, offering a free consultation and inviting the individuals to hire the attorneys to represent them in a lawsuit against certain dealerships. The letter included the label "ADVERTISING MATERIAL."

The DPPA provides that a state DMV may disclose personal information for use in connection with an investigation in anticipation of litigation. It was a matter of settled state law and practice that solicitation was an accepted, expected, and inextricably intertwined element of conduct satisfying the litigation exception under the DPPA, the Fourth Circuit said. Accordingly, such solicitation was not actionable by the buyers. Dismissal of the buyers' DPPA claims by the federal district court in Greenville, South Carolina, was affirmed.

The petition is Maracich v. Spears, 12-25.

Courts Differ on Whether Publisher’s Purchase, Use of Data Violated Driver’s Privacy Protection Act

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A class of Missouri residents could go forward with claims under the federal Driver’s Privacy Protection Act (DPPA) against West Publishing Co. for acquiring and disseminating personal information derived from driver’s license records from various states, the federal district court in Jefferson City, Missouri has ruled.

However, a class of Illinois residents could not pursue a DPPA class action against West Publishing for the same conduct, the U.S. Court of Appeals in Chicago has held.

Missouri Action

The federal district court held that the class representative had standing under the DPPA and granted the representative’s motion to certify the class.

According to the district court, the DPPA did not

(1) permit the publisher to obtain driver’s license information from the state when its sole purpose was to resell the information to third parties or

(2) permit the publisher to disclose the entire driver’s license database to a business or individual having only a potential future use for some of the information sold.

The Missouri residents were not required to present evidence of specific misuse of their personal information, according to the court. The publisher obtained, and continued to obtain, large databases of motor vehicle records from several states. The databases contained personal information belonging to millions of licensed drivers.

The DPPA made nondisclosure of personal information the default rule. Under the statute, states were permitted to disclose driver’s license information only to “authorized recipients” who obtained information for one of the permissible uses under the DPPA, and not simply a recipient whom the state had authorized to receive information.

The DPPA did not delegate to the states the decision of who was an “authorized recipient.” The publisher, therefore, was not an “authorized recipient” of the information based on its mere purported purpose of reselling information for permissible uses, in the district court’s view.

Rather than specifically listing prohibited uses for driver’s license information, the statute generally prohibited all but 14 permissible uses. Bulk resale was not included in those permissible uses. Only one DPPA exception made reference to “bulk distribution,” and that provision required that individuals opt in by providing their express consent to such bulk release for marketing and solicitation.

Given the strict linkage between the method of obtaining data and the restrictions on resale, Congress could not have intended to create a “gaping hole” in the statute for resellers by authorizing them to obtain the entire driver’s license database simply by identifying themselves as resellers, in the court’s opinion. Congress could have created a separate exception for resellers, but it did not.

Class Certification

The class consisted of all persons who registered a motor vehicle in or were issued a driver’s license or state identification card by 29 states and the District of Columbia since February 19, 2006, and whose personal information was obtained, disclosed, or sold by the publisher. There was no dispute as to the numerosity requirement for class certification.

The publisher’s business model for obtaining and then selling information was a question of fact common to all class members, the court said. This was true regardless of whether this business model resulted in some individual sales for uses that were authorized by the DPPA.

Class action litigation was the superior method for adjudicating the claims, according to the court. Given the large number of potential plaintiffs and the commonality of their claims, certifying the class would allow a more efficient adjudication of the controversy than would individually litigating the claims.

The decisions are Johnson v. West Publishing Co., CCH Privacy Law in Marketing ¶60,672 and ¶60,673.

Illinois Action

The Seventh Circuit held that the publisher’s acquisition of personal information contained in the motor vehicle records conduct did not violate the DPPA. The DPPA did not prohibit the publisher from reselling the residents’ personal information to third parties with permissible uses for the data under the statute.

The Illinois residents asserted that the publisher acquired the personal information contained in motor vehicle records of millions of drivers from state DMVs for resale. The residents, failed, however to state a DPPA claim.

The DPPA authorized the acquisition and resale of personal information by “authorized recipients” for 14 “permissible uses.” There was no allegation that the ultimate users of the records compiled and sold by the publisher lacked a permissible use for the records. The publisher did not have to have an immediate permissible use of its own in order to be an authorized recipient of the data, the appeals court said.

The decision in Graczyk v. West Publishing Co., will appear in CCH Privacy Law in Marketing.

Further information about CCH Privacy Law in Marketing appears here.

State’s Bulk Sale of Motor Vehicle Records Did Not Violate Federal Driver’s Privacy Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

The federal Driver’s Privacy Protection Act (DPPA) permitted the State of Texas to sell drivers motor vehicle (DMV) records in bulk to private entities that certified that they had a lawful purpose for acquiring the data, the U.S. Court of Appeals in New Orleans has decided.

A provision of the Texas Transportation Code allowed individuals and companies to buy magnetic tapes of driver’s license records, upon certification of a lawful purpose.

Plaintiffs bringing a purported class action on behalf of individuals with drivers licenses issued by the State of Texas asserted that the purchasing entities did not use all of the records immediately and maintained databases or resold the information.

The plaintiffs did not contend that the entities used any of the records for a purpose other than the permissible purposes listed in the DPPA; nor did they allege that records resold to third parties were used for impermissible purposes. Instead, they argued that maintaining records not actually used for the purpose stated at the time of purchase was itself an impermissible purpose under the DPPA.

The text and legislative history of the DPPA indicated that Congress intended to allow states to distribute DMV information in bulk, according to the court. Purchasers of the data were not required to actually use all of the data, as long as they did not use any of the information for a purpose not permitted by the DPPA. The DMV database was analogous to a set of legal reporters purchased by an attorney who intended to do research using the set, but was unlikely to read every single opinion, the court said.

In addition, the purchasing entities were not required to make use of the DMV records before reselling them to third parties for one or more of the DPPA’s permissible purposes. Dismissal of the DPPA claims with prejudice was affirmed.

The decision in Taylor v. Acxiom Corp. will appear at CCH Privacy Law in Marketing ¶60,510.

Class Certified in Privacy Action over Sale of Missouri Driver’s License Data

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Class certification has been granted by the federal district court in Kansas City to Missouri residents whose personal information was allegedly obtained by a data mining company from the Missouri Department of Revenue and sold to an online database operator, in violation of the federal Driver’s Privacy Protection Act (CCH Privacy Law in Marketing ¶25,500).

The data mining company allegedly acquired a large database from the Department of Revenue by falsely claiming that the information in the database was to be used to verify the identity of individuals doing business with the company. The database contained driver’s license information about class members, including their Social Security numbers.

The company allegedly transferred the information to the online database operator, which made the information available for sale on its website. The Department of Revenue allegedly authorized or participated in the dissemination of the class members’ personal data.

It was estimated that at least 300,000 Social Security numbers were in the database, which was sufficient to establish numerosity for class certification purposes, the court said. Class members’ claims involved several common issues of law and fact. The named class representative asserted that her claims emanated from the same legal theory or offense as the claims of the class.

A class action was superior to other methods of adjudicating the claims, in the court's view. Given the large number of potential plaintiffs and the commonality of their claims, class action treatment would be more efficient than individual adjudications.

The class was defined to include all licensed drivers in the state of Missouri whose personal information from their motor vehicle records was obtained, disclosed, or used by the defendants between July 21, 2004 and the present.

The decision is Roberts v. The Source for Public Data, CCH Privacy Law in Marketing ¶60,404.

Using Motor Vehicle Data to Solicit Legal Clients Would Violate Federal Privacy Law

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

A purported class of individuals could pursue claims against attorneys for violating the Driver's Privacy Protection Act (DPPA) by unlawfully obtaining personal information pursuant to the Freedom of Information Act (FOIA) from the South Carolina Department of Motor Vehicles (SCDMV) for the impermissible purpose of soliciting clients, the federal district court in Greenville, South Carolina has ruled.

The attorneys allegedly sent several FOIA requests to the SCDMV seeking information regarding individuals who purchased automobiles during specific periods of time, including the name, address, and telephone number of the buyer; the dealership where the automobile was purchased; the type of vehicle purchased; and the date of the purchase.

The attorneys then mailed a letter to the individuals, whose information was obtained, offering a free consultation and inviting the individuals to hire the attorneys to represent them in a lawsuit against certain dealerships. The letter included the label “ADVERTISING MATERIAL.”

Litigation, State-Action Exceptions

This conduct would not fall under the DPPA's “litigation exception,” according to the court. The DPPA provides that a state DMV may disclose personal information for use in connection with an investigation in anticipation of litigation. The exception permitted the attorneys to request information in an attempt to obtain evidence, but not to find and solicit clients.

The attorneys also did not qualify for the DPPA's state-action exception by functioning as “private attorneys general.” The attorneys did not allege that they provided any information to any government agency.

Knowledge, Damages Requirements

The individuals did not have to allege that the attorneys knowingly violated the DPPA, only that they knowingly obtained their personal information, the court said. The individuals were not required to plead actual damages in order to receive statutory liquidated damages under the DPPA.

The DPPA did not violate the Commerce Clause, the court determined. The personal information regulated by the DPPA was in interstate commerce and was therefore a proper subject of congressional regulation.

The decision is Maracich v. Spears, CCH Privacy Law in Marketing ¶60,380.