Driver Information Can Be Sold for Commercial Use Under DPPA

Information security has been a popular topic over the last decade as more of our personal information has moved to the virtual world.

While we have let the world into our photo albums, conversations, and daily routines through social networking, we have also become more vigilant about who we allow to access our personal records. We opt out of telemarketing, remove ourselves from subscriber lists, and decline to allow retailers to sell our information to “carefully selected” partners.

So is there a recourse to restrict to whom government entities can sell our information? According to a Seventh Circuit Court of Appeals opinion this week, that depends on how the information is used.

In the case Graczyk v. West Publishing, Illinois citizens brought a class action on behalf of licensed drivers in several states against West Publishing,* asserting claims under the Driver's Privacy Protection Act (DPPA), unjust enrichment, and seeking injunctive relief.

The plaintiffs argued that West Publishing acquired the personal information contained in motor vehicle records of millions of drivers from a state's Department of Motor Vehicles (DMV), and sold that information in violation of the DPPA.

West Publishing filed a motion to dismiss, arguing that the plaintiffs did not have standing and contending that the plaintiffs had failed to state a claim under the DPPA. The district court granted the motion, finding for West Publishing on both arguments. The plaintiffs appealed to the Seventh Circuit Court of Appeals.

Congress passed the DPPA as an amendment to the Violent Crime Control and Law Enforcement Act in response to nationwide reports that criminals were obtaining the personal information of their victims from state DMV records with relative ease.

The DPPA prohibits state DMVs from "knowingly disclosing or otherwise making available to any person or entity personal information ... about any individual obtained by the department in connection with a motor vehicle record." It also prohibits private individuals from "knowingly ... obtain[ing] or disclos[ing] personal information, from a motor vehicle record, for any use not permitted under [the DPPA]."

The DPAA does not prohibit all unconsented disclosures; the Act enumerates 14 permissible uses for which driver's license information can be disclosed, and allows an "authorized recipient of personal information" to resell or disclose driver's license information for those permissible uses.

The Seventh Circuit Court of Appeals affirmed the district court's decision, and noted that the Fifth Circuit had addressed precisely the same question. The Fifth Circuit concluded that the DPPA does not prohibit a reseller, such as West Publishing, from reselling personal information to others with permissible uses.

There are numerous information services companies that resell information obtained from DMVs. Before you file a claim alleging a DPPA violation, determine whether your potential defendant is reselling the information for one of the DPPA's permissible uses.

*Disclosure: Thomson Reuters owns both West Publishing and FindLaw.

Related Resources:

• Graczyk v. West Publishing (Seventh Circuit Court of Appeals)
• Dismissal of Driver's Privacy Protection Act Suit Affirmed (FindLaw's Fifth Circuit blog)
• FindLaw's Seventh Circuit blog (FindLaw)